@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/bug/bug-collect-tokens.ts

@@ -23,9 +23,8 @@
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import type { Prisma } from "@allbluecn/database";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { generateProjectToken } from "@/server/bug-report/tokens";
 import { assertProjectMembership } from "@/server/bug/bug-permissions";
 
@@ -63,12 +62,11 @@ function parseCollectConfig(raw: unknown): CollectPageConfigValue {
 const projectIdSchema = z.object({ projectId: z.string().min(1) });
 
 export const listCollectTokensFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(projectIdSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     const rows = await prisma.projectAccessToken.findMany({
@@ -104,12 +102,11 @@ const createCollectTokenSchema = z.object({
 });
 
 export const createCollectTokenFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(createCollectTokenSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     const { plaintext, tokenHash, tokenPrefix } = generateProjectToken();
@@ -140,12 +137,11 @@ const revokeCollectTokenSchema = z.object({
 });
 
 export const revokeCollectTokenFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(revokeCollectTokenSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     const revokedAt = new Date();
@@ -196,12 +192,11 @@ function mergeCollectConfig(
 }
 
 export const updateCollectConfigFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(updateCollectConfigSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     const existing = await prisma.projectAccessToken.findFirst({

package/src/server/serverFns/bug/bug-comments.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import type { AvatarConfig } from "@allbluecn/kernel";
 import { BUG_USER_BRIEF_SELECT } from "@/shared/bug/types";
 import type { BugCommentWithReplies } from "@/shared/bug/types";
@@ -42,6 +41,7 @@ function castCommentUser(u: {
 // 契约从裸数组扩展为 { items, nextCursor }（对齐 listBugActivitiesFn 口径）；
 // 回复树不单独分页：根页内所有回复整树随根返回，客户端渲染契约不变。
 export const listCommentsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       bugId: z.string(),
@@ -50,11 +50,9 @@ export const listCommentsFn = createServerFn({ method: "GET" })
       cursor: z.string().optional(),
     }),
   )
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 
@@ -122,12 +120,11 @@ const commentCreateSchema = z.object({
 });
 
 export const createCommentFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(commentCreateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 
@@ -189,12 +186,11 @@ const commentUpdateSchema = z.object({
 });
 
 export const updateCommentFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(commentUpdateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const existing = await prisma.bugComment.findUnique({
       where: { id: data.commentId },
@@ -226,12 +222,11 @@ export const updateCommentFn = createServerFn({ method: "POST" })
   });
 
 export const deleteCommentFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ commentId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const existing = await prisma.bugComment.findUnique({
       where: { id: data.commentId },

package/src/server/serverFns/bug/bug-crud/detail.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { castBugUsers } from "@/shared/bug/types";
 import type { BugDetail, ReproduceSteps } from "@/shared/bug/types";
 import { assertBugProjectMember } from "@/server/bug/bug-permissions";
@@ -28,12 +27,11 @@ import { BUG_DETAIL_SELECT, extractScreenshotBlobId } from "./detail-select";
 const bugIdSchema = z.object({ bugId: z.string() });
 
 export const getBugDetailFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(bugIdSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 
@@ -57,12 +55,11 @@ export const getBugDetailFn = createServerFn({ method: "GET" })
   });
 
 export const getBugNeighborsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(bugIdSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // 成员校验 + 圈定 projectId（任一方向越权均拒绝）
     const projectId = await assertBugProjectMember(data.bugId, userId);
@@ -91,12 +88,11 @@ const listEventsSchema = z.object({
 });
 
 export const listBugEventsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listEventsSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 

package/src/server/serverFns/bug/bug-crud.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { ensureBuiltinIndependentProject, resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { diffDescriptionBlocks } from "@/lib/story/description-diff";
 import {
@@ -81,12 +80,11 @@ const listSchema = z.object({
 });
 
 export const listBugsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // projectId === "__archived__" 为归档视图特殊值，直达 buildListWhere（跨项目成员圈定）；
     // 其余走 scope 解析：未传 = 全部可访问项目聚合，无效/非成员 → 静默回退独立项目，防越权
@@ -156,12 +154,11 @@ const createSchema = z.object({
 });
 
 export const createBugFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(createSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     let projectId = data.projectId;
     if (projectId) {
@@ -356,12 +353,11 @@ const BUG_Y_UPDATE_KEYS = new Set([
 
 
 export const updateBugFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(updateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // ── Yjs 多人协作 §5.3 写入门卫（任务 22；T21 教训：提至 $transaction
     // 之前——门卫转发含网络 I/O（TTL 内重试最坏 ≈4s），事务内等待会击穿
@@ -585,12 +581,11 @@ export const updateBugFn = createServerFn({ method: "POST" })
 const deleteSchema = z.object({ bugId: z.string() });
 
 export const deleteBugFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(deleteSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const bug = await prisma.bug.findUnique({
       where: { id: data.bugId },
@@ -617,12 +612,11 @@ export const deleteBugFn = createServerFn({ method: "POST" })
 const archiveSchema = z.object({ bugId: z.string() });
 
 export const archiveBugFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(archiveSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // R7：与 bulk 归档同口径的项目成员校验（单条归档同属批量写权限语义）
     await assertBugsInMemberProjects([data.bugId], userId);
@@ -659,12 +653,11 @@ export const archiveBugFn = createServerFn({ method: "POST" })
   });
 
 export const unarchiveBugFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(archiveSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugsInMemberProjects([data.bugId], userId);
 
@@ -707,12 +700,11 @@ const idListSchema = z.object({ bugIds: z.array(z.string()).min(1).max(500) });
 const BULK_TX_BATCH_SIZE = 100;
 
 export const bulkArchiveBugsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(idListSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugsInMemberProjects(data.bugIds, userId);
 
@@ -760,12 +752,11 @@ export const bulkArchiveBugsFn = createServerFn({ method: "POST" })
   });
 
 export const bulkDeleteBugsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(idListSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugsInMemberProjects(data.bugIds, userId);
 
@@ -795,12 +786,11 @@ const bulkUpdateSchema = z.object({
 });
 
 export const bulkUpdateBugsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(bulkUpdateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugsInMemberProjects(data.bugIds, userId);
 

package/src/server/serverFns/bug/bug-display-options.ts

@@ -23,7 +23,7 @@ import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { requireFeature } from "@/server/entitlements";
 import { isProEdition } from "@/server/pro-services";
 import { toJsonInput } from "@/server/lib/prisma-json";
@@ -112,11 +112,9 @@ async function capPageSize(request: Request, pageSize: BugPageSize): Promise<Bug
 }
 
 /** 获取当前用户持久化的 BUG 显示选项（非法/缺失字段已回退默认值） */
-export const getBugDisplayOptionsFn = createServerFn({ method: "GET" }).handler(async () => {
+export const getBugDisplayOptionsFn = createServerFn({ method: "GET" }).middleware([authContextMiddleware]).handler(async ({ context }) => {
   const prisma = await getPrisma();
-  const request = getRequest();
-  const session = await requireAuth(request);
-  const userId = session.user.id;
+  const userId = context.user.id;
 
   const row = await prisma.bugFilterView.findFirst({
     where: { userId, name: BUG_DISPLAY_OPTIONS_VIEW_NAME },
@@ -124,23 +122,22 @@ export const getBugDisplayOptionsFn = createServerFn({ method: "GET" }).handler(
     select: { displayOptions: true },
   });
   const options = parseStoredOptions(row?.displayOptions);
-  options.pageSize = await capPageSize(request, options.pageSize);
+  options.pageSize = await capPageSize(getRequest(), options.pageSize);
   return options;
 });
 
 /** 保存当前用户的 BUG 显示选项，返回更新后的完整对象 */
 export const updateBugDisplayOptionsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(optionsSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // 服务端强制校验：pageSize > 200（500/1000）为 Pro 专属，前端锁定只是 UX
     const options: BugDisplayOptions = {
       ...data,
-      pageSize: await capPageSize(request, data.pageSize),
+      pageSize: await capPageSize(getRequest(), data.pageSize),
     };
 
     // 与 get 路径同一 orderBy：并发双保留行时读写对齐首行，避免保存后读不到

package/src/server/serverFns/bug/bug-export.ts

@@ -16,7 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 // BUG 列表 CSV 导出 serverFn（四期 Q8 任务 44，与 testcase-export.ts 同构；
-// 照 bug-crud listBugsFn 口径）。权限：首行 requireAuth + resolveStoryScope-
+// 照 bug-crud listBugsFn 口径）。权限：authContextMiddleware 鉴权 + resolveStoryScope-
 // ProjectIds（projectId 缺省 → 成员关系内全部项目聚合；传值 → 单项目经鉴权）。
 // 特殊值 projectId="__archived__"（归档视图）与 listBugsFn 同款直达 buildListWhere
 // （跨项目成员圈定，防越权读他项目归档数据）。筛选：filters 为客户端
@@ -29,10 +29,9 @@
 // 原值输出保持机器可读。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { checkRateLimit } from "@/server/middlewares/rate-limit-server-fn";
 import { resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { buildListWhere } from "./bug-list-query";
@@ -84,12 +83,11 @@ const BUG_EXPORT_SELECT = {
 type BugExportRow = Prisma.BugGetPayload<{ select: typeof BUG_EXPORT_SELECT }>;
 
 export const exportBugsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(exportSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const rl = checkRateLimit(`bug-export:${userId}`, EXPORT_RATE_LIMIT);
     if (!rl.allowed) {

package/src/server/serverFns/bug/bug-fix.ts

@@ -23,9 +23,8 @@
 // 同 bug-comments.ts 先例）；权限与序列化助手下沉独立模块。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { fireBugWebhook } from "@/server/bug-report/webhook-out";
 import { assertBugProjectMember } from "@/server/bug/bug-permissions";
 
@@ -126,12 +125,11 @@ function castProgress(row: ProgressRow): FixProgressItem {
 }
 
 export const requestBugFixFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ bugId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const projectId = await assertBugProjectMember(data.bugId, userId);
 
@@ -194,12 +192,11 @@ export const requestBugFixFn = createServerFn({ method: "POST" })
   });
 
 export const cancelBugFixFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ bugId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 
@@ -230,12 +227,11 @@ export const cancelBugFixFn = createServerFn({ method: "POST" })
   });
 
 export const listFixRunsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ bugId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 

package/src/server/serverFns/bug/bug-groups.ts

@@ -21,9 +21,8 @@
 // （缺省 = 全部可访问项目聚合，防越权只返回成员关系内项目）。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import {
   BUG_GROUP_KEYS,
@@ -93,12 +92,11 @@ const inGroupSchema = z.object({
 });
 
 export const listBugsInGroupFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(inGroupSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const scope = await resolveReadScope(data.projectId, userId);
     const base = buildListWhere({
@@ -150,12 +148,11 @@ const allGroupsItemsSchema = z.object({
 });
 
 export const listAllGroupsItemsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(allGroupsItemsSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const scope = await resolveReadScope(data.projectId, userId);
     const base = buildListWhere({
@@ -202,12 +199,11 @@ const listGroupsSchema = z.object({
 });
 
 export const listBugGroupsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listGroupsSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const scope = await resolveReadScope(data.projectId, userId);
     const where = buildListWhere({

package/src/server/serverFns/bug/bug-reactions.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { assertProjectMembership } from "@/server/bug/bug-permissions";
 import { aggregateReactions } from "@/server/story/types";
 
@@ -36,12 +35,11 @@ async function assertBugCommentProjectMember(commentId: string, userId: string)
 }
 
 export const listBugCommentReactionsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ commentId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugCommentProjectMember(data.commentId, userId);
 
@@ -54,12 +52,11 @@ export const listBugCommentReactionsFn = createServerFn({ method: "GET" })
   });
 
 export const addBugCommentReactionFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ commentId: z.string(), emoji: z.string().min(1) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugCommentProjectMember(data.commentId, userId);
 
@@ -87,12 +84,11 @@ export const addBugCommentReactionFn = createServerFn({ method: "POST" })
   });
 
 export const toggleBugCommentReactionFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ commentId: z.string(), emoji: z.string().min(1) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugCommentProjectMember(data.commentId, userId);
 

package/src/server/serverFns/bug/bug-reorder.ts

@@ -21,9 +21,8 @@
 // story/testCase 的 boardOrder 直写先例一致，无 withCollabGuard 接线。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { getAccessibleProjectIds } from "@/server/bug/bug-permissions";
 
 const reorderSchema = z.object({
@@ -39,14 +38,13 @@ const reorderSchema = z.object({
 });
 
 export const reorderBugsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(reorderSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 可见性过滤进 where（SEC-03：防跨项目改他人 BUG 排序）；updateMany 对
     // 越权/不存在 id 静默跳过，不中断整批合法排序
-    const visibleProjectIds = await getAccessibleProjectIds(session.user.id);
+    const visibleProjectIds = await getAccessibleProjectIds(context.user.id);
 
     await prisma.$transaction(
       data.items.map((item) =>