@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/agents/skill-crud.ts

@@ -17,11 +17,11 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
 import { requireFeature } from "@/server/entitlements"
 import { requireResource } from "@/server/resources"
-import { requireUserId } from "@/server/auth-helpers"
 import { SKILL_NAME_CONFLICT_CODE } from "@/lib/agents/skill-errors"
 
 const NAME_REGEX = /^[a-z0-9-]+$/
@@ -64,10 +64,10 @@ const SKILL_DTO_SELECT = {
   updatedAt: true,
 } as const
 
-export const listSkillsFn = createServerFn({ method: "GET" }).handler(async () => {
+export const listSkillsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware]).handler(async ({ context }) => {
     const prisma = await getPrisma()
-  const request = getRequest()
-  const userId = await requireUserId(request)
+  const userId = context.user.id
 
   const skills = await prisma.userSkill.findMany({
     where: { userId, isDeleted: false },
@@ -79,11 +79,12 @@ export const listSkillsFn = createServerFn({ method: "GET" }).handler(async () =
 })
 
 export const createSkillFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(skillInputSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const userId = await requireUserId(request)
+    const userId = context.user.id
 
     await requireFeature(request, "customAgents")
     await requireResource(request, "skillQuota", 1)
@@ -112,11 +113,11 @@ export const createSkillFn = createServerFn({ method: "POST" })
 const getSkillSchema = z.object({ id: z.string() })
 
 export const getSkillFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(getSkillSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = await requireUserId(request)
+    const userId = context.user.id
 
     const skill = await prisma.userSkill.findFirst({
       where: { id: data.id, userId, isDeleted: false },
@@ -149,11 +150,11 @@ function buildSkillUpdatePayload(input: SkillUpdateInput): Record<string, unknow
 }
 
 export const updateSkillFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(skillUpdateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = await requireUserId(request)
+    const userId = context.user.id
 
     // DB-03：属主校验合并进写入（updateMany 计数判定），1 次查询替代 2 次
     const update = buildSkillUpdatePayload(data)
@@ -171,11 +172,11 @@ export const updateSkillFn = createServerFn({ method: "POST" })
 const deleteSkillSchema = z.object({ id: z.string() })
 
 export const deleteSkillFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(deleteSkillSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = await requireUserId(request)
+    const userId = context.user.id
 
     // DB-03：属主校验合并进写入（updateMany 计数判定）
     const res = await prisma.userSkill.updateMany({

package/src/server/serverFns/ai/code-mode-readiness.ts

@@ -16,14 +16,13 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { getCodeModeReadiness } from "@/server/ai-gateway/code-mode"
-import { requireUserId } from "@/server/auth-helpers"
 
 // 仅面向已登录的 harness 工作台（useCodeModeReadiness 消费方），非公开端点
-export const getCodeModeReadinessFn = createServerFn({ method: "GET" }).handler(
+export const getCodeModeReadinessFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware]).handler(
   async () => {
-    await requireUserId(getRequest())
     return getCodeModeReadiness()
   },
 )

package/src/server/serverFns/ai/search-capability.ts

@@ -16,14 +16,13 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { isSearxngEnabled } from "@/server/web-search"
-import { requireUserId } from "@/server/auth-helpers"
 
 // 仅面向已登录的 harness 对话 UI（useSearchCapability 消费方），非公开端点
-export const getSearchCapabilityFn = createServerFn({ method: "GET" }).handler(
+export const getSearchCapabilityFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware]).handler(
   async () => {
-    await requireUserId(getRequest())
     return { searxngEnabled: isSearxngEnabled() }
   },
 )

package/src/server/serverFns/anyhub/app.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
 
 // DB-05：白名单 select（与 index.ts listAnyHubAppsFn 同一口径，防未来新增敏感列外泄）
 const ANY_HUB_APP_SELECT = {
@@ -42,13 +41,12 @@ const ANY_HUB_APP_SELECT = {
 } as const
 
 export const getAnyHubAppFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const app = await prisma.anyHubApp.findFirst({
-      where: { id: data.id, userId: session.user.id },
+      where: { id: data.id, userId: context.user.id },
       select: ANY_HUB_APP_SELECT,
     })
     if (!app) throw new Error('应用不存在')
@@ -56,14 +54,13 @@ export const getAnyHubAppFn = createServerFn({ method: 'GET' })
   })
 
 export const updateAnyHubAppFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     // DB-03：属主校验合并进写入（updateMany 计数判定）；version 由安装流程维护，此处不再回写原值
     const res = await prisma.anyHubApp.updateMany({
-      where: { id: data.id, userId: session.user.id },
+      where: { id: data.id, userId: context.user.id },
       data: {
         status: 'updating',
         updatedAt: new Date(),
@@ -74,14 +71,13 @@ export const updateAnyHubAppFn = createServerFn({ method: 'POST' })
   })
 
 export const deleteAnyHubAppFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     // DB-03：属主校验合并进删除（deleteMany 计数判定）
     const res = await prisma.anyHubApp.deleteMany({
-      where: { id: data.id, userId: session.user.id },
+      where: { id: data.id, userId: context.user.id },
     })
     if (res.count === 0) throw new Error('应用不存在')
     return { success: true }

package/src/server/serverFns/anyhub/index.ts

@@ -18,9 +18,8 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import type { Prisma } from "@allbluecn/database"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
 
 // DB-05：白名单 select（消费方 AnyHubAppData 覆盖全部标量列，防未来新增敏感列外泄）
 const ANY_HUB_APP_SELECT = {
@@ -43,13 +42,12 @@ const ANY_HUB_APP_SELECT = {
 } as const
 
 export const listAnyHubAppsFn = createServerFn({ method: 'GET' })
-  .handler(async () => {
+  .middleware([authContextMiddleware])
+  .handler(async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     // DB-05：白名单 select（消费方 AnyHubAppData 覆盖全部标量列，防未来新增敏感列外泄）
     return prisma.anyHubApp.findMany({
-      where: { userId: session.user.id },
+      where: { userId: context.user.id },
       orderBy: { createdAt: 'desc' },
       select: ANY_HUB_APP_SELECT,
     })
@@ -91,12 +89,11 @@ export const listMarketplaceAppsFn = createServerFn({ method: 'GET' })
   })
 
 export const togglePinFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ appId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     // DB-03：读回 pinned + 条件写收进事务，写路径带 userId 谓词消除 TOCTOU
     return prisma.$transaction(async (tx) => {
       const app = await tx.anyHubApp.findFirst({

package/src/server/serverFns/anyhub/install.ts

@@ -17,10 +17,10 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import path from 'node:path'
-import { requireAuth } from '@/server/auth-helpers'
 import { requireResource } from '@/server/resources'
 import { isLocalPathAllowed } from '@/lib/anyhub/local-path'
 
@@ -48,11 +48,11 @@ function assertGithubUrl(githubUrl: string): void {
 }
 
 export const installAnyHubAppFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(installSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const session = await requireAuth(request)
     // S6：安装按尝试计（含 installing/failed），超档拒绝（裁决：三档 200/1000/5000）
     await requireResource(request, 'installQuota', 1)
 
@@ -81,7 +81,7 @@ export const installAnyHubAppFn = createServerFn({ method: 'POST' })
         marketplaceAppId: data.source === 'marketplace' ? data.marketplaceAppId : undefined,
         githubUrl: data.source === 'github' ? data.githubUrl : undefined,
         localPath: resolvedLocalPath,
-        userId: session.user.id,
+        userId: context.user.id,
         status: 'installing',
       },
     })

package/src/server/serverFns/anyhub/permissions.ts

@@ -16,18 +16,16 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
 import { getAppPermissions, grantPermission, checkPermission } from '@/lib/anyhub/permissions'
 import { ALL_CAPABILITIES } from '@/lib/anyhub/capabilities'
 
 export const getAnyHubPermissionsFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    return getAppPermissions(data.id, session.user.id)
+  .handler(async ({ data, context }) => {
+    return getAppPermissions(data.id, context.user.id)
   })
 
 const updatePermissionSchema = z.object({
@@ -38,11 +36,10 @@ const updatePermissionSchema = z.object({
 })
 
 export const updateAnyHubPermissionFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(updatePermissionSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    await grantPermission(data.id, data.capability, session.user.id, data.granted)
+  .handler(async ({ data, context }) => {
+    await grantPermission(data.id, data.capability, context.user.id, data.granted)
     return { success: true }
   })
 
@@ -58,9 +55,8 @@ const checkPermissionSchema = z.object({
  * userId 以 session 为准，不信任客户端传入值。
  */
 export const checkAnyHubPermissionFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(checkPermissionSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    return checkPermission(data.appId, data.method, session.user.id)
+  .handler(async ({ data, context }) => {
+    return checkPermission(data.appId, data.method, context.user.id)
   })

package/src/server/serverFns/anyhub/proxy.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
 import { ProxyAdapter } from '@/lib/anyhub/proxy'
 import { isLocalPathAllowed } from '@/lib/anyhub/local-path'
 
@@ -29,13 +28,12 @@ const serveFileSchema = z.object({
 })
 
 export const serveAnyHubFileFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(serveFileSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const app = await prisma.anyHubApp.findFirst({
-      where: { id: data.appId, userId: session.user.id },
+      where: { id: data.appId, userId: context.user.id },
       select: { localPath: true },
     })
     if (!app) throw new Error('应用不存在')

package/src/server/serverFns/auth/email-verification.ts

@@ -20,6 +20,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { getCurrentSession } from '@/lib/session'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
 import { sendTemplateEmail, generateEmailToken } from '@/server/email'
 
@@ -78,13 +79,11 @@ export const confirmEmailVerificationFn = createServerFn({ method: 'GET' })
   })
 
 export const resendVerificationEmailFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({}))
-  .handler(async () => {
+  .handler(async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getCurrentSession(request)
-    const userId = session?.user?.id
-    if (!userId) throw new Error('请先登录')
+    const userId = context.user.id
 
     await checkAuthRateLimit('resendVerify', 5, 15 * 60 * 1000)
 

package/src/server/serverFns/auth/session.ts

@@ -23,6 +23,7 @@ import type { FeatureKey } from '@allbluecn/kernel'
 import type { Session } from '@/lib/session'
 import { getCurrentSession } from '@/lib/session'
 import { buildGuestSession, isDesktopServer } from '@/server/desktop-guest'
+import { ensureLocalShadowUser } from '@/server/desktop-bootstrap'
 import { readRemoteAuth, writeRemoteAuth, writeRemoteSession, clearRemoteAuth } from '@/server/remote-auth'
 import { generateEntitlementsToken } from '@/server/entitlements-token'
 import type { RemoteAuthData } from '@/server/remote-auth'
@@ -76,6 +77,14 @@ export const getSessionFn = createServerFn({ method: 'GET' })
     if (!isDesktopServer()) return null
     const remoteAuth = await readRemoteAuth()
     if (remoteAuth) return buildRemoteSession(remoteAuth)
+    // 桌面 guest 分支懒 seed 影子用户（本地优先 P1）：首启为 local-guest 落库，
+    // 使 assertOwned/requireUserInDb/FK 全链可写。失败仅 warn 不阻断会话发放
+    // ——首启体验优先（规格 §3.1），下一请求再重试。
+    try {
+      await ensureLocalShadowUser()
+    } catch (err) {
+      console.warn('[getSessionFn] 本地影子用户落库失败（不阻断 guest 会话）:', err)
+    }
     return buildGuestSession()
   })
 

package/src/server/serverFns/billing.ts

@@ -20,7 +20,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { getProService } from '@/server/pro-services'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { BillingUnavailableError } from '@allbluecn/kernel'
 import { getEntitlements } from '@/server/entitlements'
 import { getResourceSnapshots } from '@/server/resources'
@@ -31,9 +31,8 @@ const requireBilling = () => {
   return billing
 }
 
-export const getEffectivePlanFn = createServerFn({ method: 'GET' }).handler(async () => {
+export const getEffectivePlanFn = createServerFn({ method: 'GET' }).middleware([authContextMiddleware]).handler(async () => {
   const request = getRequest()
-  const session = await requireAuth(request)
 
   const { planName, enabled, unavailable, source } = await getEntitlements(request)
   const resources = await getResourceSnapshots(request)
@@ -47,10 +46,8 @@ export const getEffectivePlanFn = createServerFn({ method: 'GET' }).handler(asyn
   }
 })
 
-export const getSubscriptionFn = createServerFn({ method: 'GET' }).handler(async () => {
-  const request = getRequest()
-  const session = await requireAuth(request)
-  const userId = session.user.id
+export const getSubscriptionFn = createServerFn({ method: 'GET' }).middleware([authContextMiddleware]).handler(async ({ context }) => {
+  const userId = context.user.id
   return requireBilling().getSubscription(userId)
 })
 
@@ -63,16 +60,15 @@ export const listPublicPlansFn = createServerFn({ method: 'GET' })
   })
 
 export const createCheckoutSessionFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       planId: z.string(),
       currency: z.enum(['usd', 'cny']),
     }),
   )
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id
 
     const baseUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
     return requireBilling().createCheckoutSession({
@@ -85,11 +81,9 @@ export const createCheckoutSessionFn = createServerFn({ method: 'POST' })
     })
   })
 
-export const createCustomerPortalSessionFn = createServerFn({ method: 'POST' }).validator(z.object({})).handler(
-  async () => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+export const createCustomerPortalSessionFn = createServerFn({ method: 'POST' }).middleware([authContextMiddleware]).validator(z.object({})).handler(
+  async ({ context }) => {
+    const userId = context.user.id
 
     const baseUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
     return requireBilling().createCustomerPortalSession({
@@ -99,20 +93,17 @@ export const createCustomerPortalSessionFn = createServerFn({ method: 'POST' }).
   },
 )
 
-export const listInvoicesFn = createServerFn({ method: 'GET' }).handler(async () => {
-  const request = getRequest()
-  const session = await requireAuth(request)
-  const userId = session.user.id
+export const listInvoicesFn = createServerFn({ method: 'GET' }).middleware([authContextMiddleware]).handler(async ({ context }) => {
+  const userId = context.user.id
   return requireBilling().listInvoices(userId, 20)
 })
 
 export const updatePreferredCurrencyFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ currency: z.enum(['usd', 'cny']) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await prisma.user.update({
       where: { id: userId },
       data: { preferredCurrency: data.currency },
@@ -120,17 +111,16 @@ export const updatePreferredCurrencyFn = createServerFn({ method: 'POST' })
   })
 
 export const updateSeatsFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       addonSeats: z.number().int().min(0).max(100),
       successUrl: z.string().url().optional(),
     }),
   )
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     const baseUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
 
     const subscription = await prisma.subscription.findUnique({

package/src/server/serverFns/blob-upload.ts

@@ -16,9 +16,8 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
-import { requireAuth } from "@/server/auth-helpers"
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { getPorts } from "@/server/ai-gateway/runtime"
 
 // 与 attachment-policy.ts 的 SUPPORTED_MIME_TYPES 对齐（服务端独立 fail-closed 白名单）。
@@ -48,14 +47,12 @@ const UploadBlobSchema = z.object({
  * 客户端不接触 BlobStore 实现，不 import @allbluecn/database。
  */
 export const uploadBlobFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(UploadBlobSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    if (!session?.user?.id) {
-      return { error: "Unauthorized" as const }
-    }
-    const userId = session.user.id
+  .handler(async ({ data, context }) => {
+    // 原 requireAuth 后的 !session?.user?.id 软分支不可达（requireAuth 已抛），
+    // 迁移后由 middleware 统一抛 UnauthorizedError，死分支一并移除
+    const userId = context.user.id
 
     if (!BLOB_MIME_TYPES.has(data.mimeType)) {
       return { error: "UnsupportedMimeType" as const }

package/src/server/serverFns/bug/__tests__/bug-access-tokens.test.ts

@@ -25,6 +25,11 @@ vi.mock("@tanstack/react-start", () => ({
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
@@ -35,13 +40,41 @@ vi.mock("@tanstack/react-start", () => ({
           if (this._validator && data !== undefined) {
             data = this._validator.parse ? this._validator.parse(data) : data;
           }
-          return fn({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+          // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+          let context: any = {};
+          for (const mw of this._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
+          }
+          return fn({ data, context });
         };
         return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({

package/src/server/serverFns/bug/__tests__/bug-activities.test.ts

@@ -24,6 +24,11 @@ vi.mock("@tanstack/react-start", () => ({
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
@@ -34,13 +39,41 @@ vi.mock("@tanstack/react-start", () => ({
           if (this._validator && data !== undefined) {
             data = this._validator.parse ? this._validator.parse(data) : data;
           }
-          return fn({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+          // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+          let context: any = {};
+          for (const mw of this._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
+          }
+          return fn({ data, context });
         };
         return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({