@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/__tests__/update-page-guard.test.ts

@@ -23,8 +23,12 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 vi.mock("@tanstack/react-start", () => {
   const createServerFn = () => {
-    const capture: { validator?: unknown; handler?: unknown } = {};
+    const capture: { validator?: unknown; handler?: unknown; middlewares?: unknown[] } = {};
     const api = {
+      middleware: (mws: unknown[]) => {
+        capture.middlewares = [...(capture.middlewares ?? []), ...mws];
+        return api;
+      },
       validator: (v: unknown) => {
         capture.validator = v;
         return api;
@@ -34,13 +38,42 @@ vi.mock("@tanstack/react-start", () => {
         return async (args: { data: unknown }) => {
           const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
           const data = v && v.parse ? v.parse(args.data) : args.data;
-          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的
+          // auth-helpers/getRequest 承接
+          let context: any = {};
+          for (const mw of capture.middlewares ?? []) {
+            const serverFn = (mw as any)?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
+          }
+          return (h as (p: { data: unknown; context: unknown }) => Promise<unknown>)({ data, context });
         };
       },
     };
     return api;
   };
-  return { createServerFn };
+  return {
+    // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+    // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+    createServerFn,
+    createMiddleware: (opts: any) => {
+      const mw: any = { options: { type: opts?.type } };
+      mw.server = (fn: Function) => {
+        mw.options.server = fn;
+        return mw;
+      };
+      return mw;
+    },
+  };
 });
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
 
@@ -69,8 +102,11 @@ const PRISMA = H.prisma;
 vi.mock("@allbluecn/database/get-prisma", () => ({
   getPrisma: async () => H.prisma,
 }));
+// 迁移后 requireAuth 消费入口：authContextMiddleware 内部调用
+vi.mock("@/server/auth-helpers", () => ({
+  requireAuth: H.fns.requireAuth,
+}));
 vi.mock("@allbluecn/kernel", () => ({
-  getServerSeam: () => ({ requireAuth: H.fns.requireAuth }),
   // database 主入口（pages.ts 的 Prisma 值导入连带加载）模块顶层注册 seam，mock 须提供
   registerPrismaSeam: () => {},
 }));

package/src/server/serverFns/__tests__/update-seats.test.ts

@@ -21,6 +21,11 @@ vi.mock('@tanstack/react-start', () => ({
   createServerFn: (_config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws)
+        return this
+      },
       validator(schema: any) {
         this._validator = schema
         return this
@@ -31,13 +36,40 @@ vi.mock('@tanstack/react-start', () => ({
           if (this._validator && data !== undefined) {
             data = this._validator.parse ? this._validator.parse(data) : data
           }
-          return fn({ data })
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: any = {}
+          for (const mw of this._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
         }
         return wrapped
       },
     }
     return api
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
 }))
 
 vi.mock('@tanstack/react-start/server', () => ({

package/src/server/serverFns/__tests__/update-story-guard.test.ts

@@ -32,24 +32,57 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 vi.mock("@tanstack/react-start", () => {
   const createServerFn = () => {
-    const capture: { validator?: unknown; handler?: unknown } = {};
+    const capture: { validator?: unknown; handler?: unknown; middlewares?: unknown[] } = {};
     const api = {
       validator: (v: unknown) => {
         capture.validator = v;
         return api;
       },
+      middleware: (mws: unknown[]) => {
+        capture.middlewares = mws;
+        return api;
+      },
       handler: (h: unknown) => {
         capture.handler = h;
         return async (args: { data: unknown }) => {
           const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
           const data = v && v.parse ? v.parse(args.data) : args.data;
-          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: Record<string, unknown> = {};
+          for (const mw of capture.middlewares ?? []) {
+            const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+            if (typeof serverFn !== "function") continue;
+            const result = await (
+              serverFn as (p: unknown) => Promise<{ context?: unknown }>
+            )({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: { context?: unknown }) => ({
+                context: { ...context, ...(inner?.context ?? {}) },
+              }),
+            });
+            context = (result?.context ?? context) as Record<string, unknown>;
+          }
+          return (h as (p: { data: unknown; context: unknown }) => Promise<unknown>)({ data, context });
         };
       },
     };
     return api;
   };
-  return { createServerFn };
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)
+  const createMiddleware = (opts?: { type?: string }) => {
+    const mw: { options: { type?: string; server?: unknown }; server?: unknown } = { options: { type: opts?.type } };
+    mw.server = (fn: unknown) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  };
+  return { createServerFn, createMiddleware };
 });
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
 

package/src/server/serverFns/__tests__/update-testcase-guard.test.ts

@@ -21,25 +21,59 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 vi.mock("@tanstack/react-start", () => {
+  // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
   const createServerFn = () => {
-    const capture: { validator?: unknown; handler?: unknown } = {};
+    const capture: { validator?: unknown; handler?: unknown; middlewares?: unknown[] } = {};
     const api = {
       validator: (v: unknown) => {
         capture.validator = v;
         return api;
       },
+      middleware: (mws: unknown[]) => {
+        capture.middlewares = mws;
+        return api;
+      },
       handler: (h: unknown) => {
         capture.handler = h;
         return async (args: { data: unknown }) => {
           const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
           const data = v && v.parse ? v.parse(args.data) : args.data;
-          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: Record<string, unknown> = {};
+          for (const mw of capture.middlewares ?? []) {
+            const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+            if (typeof serverFn !== "function") continue;
+            const result = await (
+              serverFn as (p: unknown) => Promise<{ context?: unknown }>
+            )({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: { context?: unknown }) => ({
+                context: { ...context, ...(inner?.context ?? {}) },
+              }),
+            });
+            context = (result?.context ?? context) as Record<string, unknown>;
+          }
+          return (h as (p: { data: unknown; context: unknown }) => Promise<unknown>)({ data, context });
         };
       },
     };
     return api;
   };
-  return { createServerFn };
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)
+  const createMiddleware = (opts?: { type?: string }) => {
+    const mw: { options: { type?: string; server?: unknown }; server?: unknown } = { options: { type: opts?.type } };
+    mw.server = (fn: unknown) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  };
+  return { createServerFn, createMiddleware };
 });
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
 

package/src/server/serverFns/__tests__/workspace-kb-idor.test.ts

@@ -26,22 +26,56 @@ vi.mock("@tanstack/react-start", () => ({
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
       },
       handler(fn: Function) {
-        return async (args: any) => {
+        const wrapped = async (args: any) => {
           let data = args?.data;
           if (this._validator && data !== undefined) {
             data = this._validator.parse ? this._validator.parse(data) : data;
           }
-          return fn({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+          // context 合并语义），真实鉴权链由被 mock 的 auth-helpers 承接
+                    let context: any = {}
+                    for (const mw of this._middlewares) {
+                      const serverFn = mw?.options?.server
+                      if (!serverFn) continue
+                      const result = await serverFn({
+                        data,
+                        context,
+                        method: "POST",
+                        serverFnMeta: {},
+                        signal: new AbortController().signal,
+                        next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+                      })
+                      context = result.context
+                    }
+                    return fn({ data, context });
         };
+        return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
 }));
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
 

package/src/server/serverFns/__tests__/workspace-kb.test.ts

@@ -21,22 +21,56 @@ vi.mock("@tanstack/react-start", () => ({
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
       },
       handler(fn: Function) {
-        return async (args: any) => {
+        const wrapped = async (args: any) => {
           let data = args?.data;
           if (this._validator && data !== undefined) {
             data = this._validator.parse ? this._validator.parse(data) : data;
           }
-          return fn({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+          // context 合并语义），真实鉴权链由被 mock 的 auth-helpers 承接
+                    let context: any = {}
+                    for (const mw of this._middlewares) {
+                      const serverFn = mw?.options?.server
+                      if (!serverFn) continue
+                      const result = await serverFn({
+                        data,
+                        context,
+                        method: "POST",
+                        serverFnMeta: {},
+                        signal: new AbortController().signal,
+                        next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+                      })
+                      context = result.context
+                    }
+                    return fn({ data, context });
         };
+        return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
 }));
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
 

package/src/server/serverFns/__tests__/workspace.test.ts

@@ -21,6 +21,11 @@ vi.mock("@tanstack/react-start", () => ({
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
@@ -31,13 +36,41 @@ vi.mock("@tanstack/react-start", () => ({
           if (this._validator && data !== undefined) {
             data = this._validator.parse ? this._validator.parse(data) : data;
           }
-          return fn({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+          // context 合并语义），真实鉴权链由被 mock 的 auth-helpers 承接
+                    let context: any = {}
+                    for (const mw of this._middlewares) {
+                      const serverFn = mw?.options?.server
+                      if (!serverFn) continue
+                      const result = await serverFn({
+                        data,
+                        context,
+                        method: "POST",
+                        serverFnMeta: {},
+                        signal: new AbortController().signal,
+                        next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+                      })
+                      context = result.context
+                    }
+                    return fn({ data, context });
         };
         return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({

package/src/server/serverFns/activity.ts

@@ -17,8 +17,7 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { addDays, startOfDay, startOfMonth, subMonths, eachDayOfInterval } from 'date-fns'
 import { formatInTimeZone, toZonedTime, fromZonedTime } from 'date-fns-tz'
 import { z } from 'zod'
@@ -67,12 +66,11 @@ const activityQuerySchema = z.object({
 })
 
 export const getActivityDataFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(activityQuerySchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     const timezone = normalizeTimeZone(data.timezone)
 
     const now = new Date()
@@ -135,11 +133,10 @@ export const getActivityDataFn = createServerFn({ method: 'GET' })
 // ── S16（裁决：dashboard 真数据最小范围）──
 
 /** 统计卡四项：PRD 总数 / 今日完成动态 / 未读评论（占位 0，读模型未建）/ 已装应用 */
-export const getDashboardStatsFn = createServerFn({ method: "GET" }).handler(async () => {
+export const getDashboardStatsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware]).handler(async ({ context }) => {
   const prisma = await getPrisma()
-  const request = getRequest()
-  const session = await requireAuth(request)
-  const userId = session.user.id
+  const userId = context.user.id
   const now = new Date()
 
   const [prdCount, todayDone, installedApps] = await Promise.all([
@@ -164,12 +161,11 @@ const recentActivitiesSchema = z.object({ take: z.number().int().min(1).max(50).
 /** 最近动态流：本人 storyActivity 最近 N 条（跨项目），action 经 ACTIVITY_LABEL
  * 本地化在客户端做（shared 常量同源）。 */
 export const getRecentActivitiesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(recentActivitiesSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
 
     const rows = await prisma.storyActivity.findMany({
       where: { userId },

package/src/server/serverFns/agents/agent-crud.ts

@@ -17,6 +17,7 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
 // AGENT_TOOL_KEYS 在模块顶层（zod schema）被消费，会保留进客户端 split stub——
@@ -24,7 +25,6 @@ import { z } from "zod"
 import { AGENT_TOOL_KEYS } from "@/server/ai-gateway/tools/select"
 import { requireFeature } from "@/server/entitlements"
 import { requireResource } from "@/server/resources"
-import { requireUserId } from "@/server/auth-helpers"
 
 const agentInputSchema = z.object({
   name: z.string().min(1).max(64),
@@ -92,10 +92,10 @@ const AGENT_DTO_SELECT = {
   updatedAt: true,
 } as const
 
-export const listAgentsFn = createServerFn({ method: "GET" }).handler(async () => {
+export const listAgentsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware]).handler(async ({ context }) => {
     const prisma = await getPrisma()
-  const request = getRequest()
-  const userId = await requireUserId(request)
+  const userId = context.user.id
 
   const agents = await prisma.userAgent.findMany({
     where: { userId, isDeleted: false },
@@ -107,11 +107,12 @@ export const listAgentsFn = createServerFn({ method: "GET" }).handler(async () =
 })
 
 export const createAgentFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(agentInputSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const userId = await requireUserId(request)
+    const userId = context.user.id
 
     await requireFeature(request, "customAgents")
     await requireResource(request, "agentQuota", 1)
@@ -139,11 +140,11 @@ export const createAgentFn = createServerFn({ method: "POST" })
 const getAgentSchema = z.object({ id: z.string() })
 
 export const getAgentFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(getAgentSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = await requireUserId(request)
+    const userId = context.user.id
 
     const agent = await prisma.userAgent.findFirst({
       where: { id: data.id, userId, isDeleted: false },
@@ -194,11 +195,11 @@ function buildAgentUpdatePayload(input: AgentUpdateInput): Record<string, unknow
 }
 
 export const updateAgentFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(agentUpdateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = await requireUserId(request)
+    const userId = context.user.id
 
     // DB-03：属主校验合并进写入（updateMany 计数判定），1 次查询替代 2 次
     const update = buildAgentUpdatePayload(data)
@@ -216,11 +217,11 @@ export const updateAgentFn = createServerFn({ method: "POST" })
 const deleteAgentSchema = z.object({ id: z.string() })
 
 export const deleteAgentFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(deleteAgentSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = await requireUserId(request)
+    const userId = context.user.id
 
     // DB-03：属主校验合并进写入（updateMany 计数判定）
     const res = await prisma.userAgent.updateMany({

package/src/server/serverFns/agents/bindings.ts

@@ -1,17 +1,16 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { z } from "zod"
 import { BIZ_AGENT_KEYS } from "@/server/ai-gateway/runs/biz-keys"
 import { resolveSystemPrompt } from "@/server/ai-gateway/prompts/registry"
-import { requireUserId } from "@/server/auth-helpers"
 
 const bizKeySchema = z.enum(BIZ_AGENT_KEYS)
 
-export const listBindingsFn = createServerFn({ method: "GET" }).handler(async () => {
+export const listBindingsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware]).handler(async ({ context }) => {
     const prisma = await getPrisma()
-  const request = getRequest()
-  const userId = await requireUserId(request)
+  const userId = context.user.id
 
   const rows = await prisma.businessAgentBinding.findMany({
     where: { userId },
@@ -43,11 +42,11 @@ const upsertBindingSchema = z.object({
 })
 
 export const upsertBindingFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(upsertBindingSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-  const request = getRequest()
-  const userId = await requireUserId(request)
+  const userId = context.user.id
 
     if (data.agentId === null) {
       await prisma.businessAgentBinding.deleteMany({
@@ -72,11 +71,11 @@ export const upsertBindingFn = createServerFn({ method: "POST" })
 const setDefaultSchema = z.object({ agentId: z.string().nullable() })
 
 export const setDefaultAgentFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(setDefaultSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = await requireUserId(request)
+    const userId = context.user.id
 
     const agentId = data.agentId
     if (agentId === null) {
@@ -106,8 +105,8 @@ export const setDefaultAgentFn = createServerFn({ method: "POST" })
   })
 
 // 登录后智能体表单使用的内置 persona 提示词摘要（内容非机密，但端点仅面向已登录用户）
-export const getPersonaHintFn = createServerFn({ method: "GET" }).handler(async () => {
-  await requireUserId(getRequest())
+export const getPersonaHintFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware]).handler(async ({ context }) => {
   const sections = await resolveSystemPrompt("harness.agent-persona", {})
   return { hint: sections[0] ?? "" }
 })