@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/bug/bug-repro.ts

@@ -16,7 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 // AI 复现 serverFn 薄壳（任务 26，规格 §11）：runBugReproFn（详情面板「AI 复现」
-// 按钮）→ requireAuth + 项目成员校验 → 委派 runBugReproCore（组装/超时/校验/
+// 按钮）→ authContextMiddleware 鉴权 + 项目成员校验 → 委派 runBugReproCore（组装/超时/校验/
 // 落库全在 server/bug-report/repro-runner.ts）；listReproRunsFn 供详情「AI 复现
 // 报告卡片」分区（§5.4 第 6 分区）读取历史 run。同步执行（典型 < 30s，UI 按钮
 // loading 态；内部 55s 超时置 failed 可重试）。
@@ -24,9 +24,8 @@
 // 同 bug-fix.ts 先例）；运行器在独立模块。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import {
   REPRO_REPORT_SCHEMA,
   runBugReproCore,
@@ -74,11 +73,10 @@ function castRun(run: ReproRunRow): ReproRunItem {
 }
 
 export const runBugReproFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ bugId: z.string() }))
-  .handler(async ({ data }) => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 
@@ -86,12 +84,11 @@ export const runBugReproFn = createServerFn({ method: "POST" })
   });
 
 export const listReproRunsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ bugId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 

package/src/server/serverFns/bug/bug-story-bulk.ts

@@ -22,9 +22,8 @@
 // 本文件只准导出 createServerFn 产物（serverFn 纯净铁律）。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { getAccessibleProjectIds } from "@/server/bug/bug-permissions";
 
 const idListSchema = z.object({ bugIds: z.array(z.string()).min(1).max(500) });
@@ -35,12 +34,11 @@ const bulkLinkSchema = z.object({
 });
 
 export const bulkLinkBugsToStoryFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(bulkLinkSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     const visibleProjectIds = await getAccessibleProjectIds(userId);
 
     // story 归属校验（防跨项目挂载，testcase bulk 同口径）
@@ -90,12 +88,11 @@ export const bulkLinkBugsToStoryFn = createServerFn({ method: "POST" })
   });
 
 export const bulkUnlinkBugsFromStoryFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(idListSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     const visibleProjectIds = await getAccessibleProjectIds(userId);
 
     return prisma.$transaction(async (tx) => {
@@ -156,12 +153,11 @@ const listByStorySchema = z.object({
 
 /** 需求详情「关联 BUG」面板：按 storyId 反查（单值关联，量级有限，一次取全） */
 export const listBugsByStoryFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listByStorySchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // story 可见性：非成员静默回退空（防越权探测 storyId）
     const story = await prisma.story.findUnique({
@@ -216,12 +212,11 @@ const listForSelectSchema = z.object({
 });
 
 export const listBugsForSelectFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listForSelectSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     const projectId = await (async () => {
       // scope 解析同 listBugsFn：无效/非成员 → 回退独立项目
       const { resolveStoryScopeProjectId } = await import("@/server/builtin-project");

package/src/server/serverFns/bug/bug-story.ts

@@ -23,9 +23,8 @@
 // 描述序列化工具在 bug-story-utils.ts（serverFn 文件禁止非 createServerFn 导出）。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { assertBugProjectMember } from "@/server/bug/bug-permissions";
 import { buildConvertedDescription } from "./bug-story-utils";
 import { createStoryInternal } from "@/server/serverFns/story/story-crud/create-story-internal";
@@ -39,12 +38,11 @@ const linkSchema = z.object({
 });
 
 export const convertBugToStoryFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(bugIdSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 
@@ -97,12 +95,11 @@ export const convertBugToStoryFn = createServerFn({ method: "POST" })
   });
 
 export const linkBugToStoryFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(linkSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const projectId = await assertBugProjectMember(data.bugId, userId);
 
@@ -135,12 +132,11 @@ export const linkBugToStoryFn = createServerFn({ method: "POST" })
   });
 
 export const unlinkBugFromStoryFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(bugIdSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 

package/src/server/serverFns/bug/bug-views.ts

@@ -20,9 +20,8 @@
 // 显示选项保留行（BUG_DISPLAY_OPTIONS_VIEW_NAME）对视图清单不可见、不可建/改/删。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { toJsonInput } from "@/server/lib/prisma-json";
 import {
   BUG_DISPLAY_OPTIONS_VIEW_NAME,
@@ -63,11 +62,9 @@ const VIEW_SELECT = {
 
 const NOT_RESERVED = { name: { not: BUG_DISPLAY_OPTIONS_VIEW_NAME } };
 
-export const listBugViewsFn = createServerFn({ method: "GET" }).handler(async () => {
+export const listBugViewsFn = createServerFn({ method: "GET" }).middleware([authContextMiddleware]).handler(async ({ context }) => {
   const prisma = await getPrisma();
-  const request = getRequest();
-  const session = await requireAuth(request);
-  const userId = session.user.id;
+  const userId = context.user.id;
   const rows = await prisma.bugFilterView.findMany({
     where: { userId, ...NOT_RESERVED },
     orderBy: { createdAt: "asc" },
@@ -100,15 +97,14 @@ const createSchema = z.object({
 });
 
 export const createBugViewFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(createSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest();
-    const session = await requireAuth(request);
+  .handler(async ({ data, context }) => {
     if (data.name === BUG_DISPLAY_OPTIONS_VIEW_NAME) {
       throw new Error("该视图名称为系统保留，请换一个名称");
     }
     const prisma = await getPrisma();
-    const userId = session.user.id;
+    const userId = context.user.id;
     assertDisplayOptionsSize(data.displayOptions);
     const row = await prisma.bugFilterView.create({
       data: {
@@ -132,15 +128,14 @@ const updateSchema = z.object({
 });
 
 export const updateBugViewFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(updateSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest();
-    const session = await requireAuth(request);
+  .handler(async ({ data, context }) => {
     if (data.name === BUG_DISPLAY_OPTIONS_VIEW_NAME) {
       throw new Error("该视图名称为系统保留，请换一个名称");
     }
     const prisma = await getPrisma();
-    const userId = session.user.id;
+    const userId = context.user.id;
     const { id, ...patch } = data;
     if (patch.displayOptions !== undefined) assertDisplayOptionsSize(patch.displayOptions);
     const updates: Record<string, unknown> = {};
@@ -160,12 +155,11 @@ export const updateBugViewFn = createServerFn({ method: "POST" })
 const deleteSchema = z.object({ id: z.string() });
 
 export const deleteBugViewFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(deleteSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await prisma.bugFilterView.delete({
       where: { id: data.id, userId, ...NOT_RESERVED },
     });

package/src/server/serverFns/bug/bug-webhooks.ts

@@ -23,9 +23,8 @@
 import { randomBytes } from "node:crypto";
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { assertFetchableUrl } from "@/server/fetch-guard";
 import { BUG_WEBHOOK_EVENTS } from "@/shared/bug/constants";
 import { TEST_RUN_WEBHOOK_EVENTS } from "../testcase/constants";
@@ -59,12 +58,11 @@ interface BugWebhookListItem {
 }
 
 export const listBugWebhooksFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(projectIdSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     const rows = await prisma.projectWebhook.findMany({
@@ -90,12 +88,11 @@ const createWebhookSchema = z.object({
 });
 
 export const createBugWebhookFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(createWebhookSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     // SEC-07 注册时校验：成员即可注册 webhook，私网/回环目标会形成服务端盲
@@ -132,12 +129,11 @@ const deleteWebhookSchema = z.object({
 });
 
 export const deleteBugWebhookFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(deleteWebhookSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     // findFirst 带 projectId 收敛：越权 webhookId 与不存在同话术
@@ -153,12 +149,11 @@ export const deleteBugWebhookFn = createServerFn({ method: "POST" })
 const toggleWebhookSchema = deleteWebhookSchema.extend({ enabled: z.boolean() });
 
 export const toggleBugWebhookFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(toggleWebhookSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     const existing = await prisma.projectWebhook.findFirst({

package/src/server/serverFns/bug/test-bug-confirm.ts

@@ -23,9 +23,8 @@
 // createServerFn 外无普通导出（成员校验复用 bug-permissions）。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { assertProjectMembership } from "@/server/bug/bug-permissions";
 
 const runIdSchema = z.object({ runId: z.string().min(1) });
@@ -42,12 +41,11 @@ interface PendingTestBugItem {
 
 /** 本批次 AI 起草且仍待确认的 Bug 清单（确认/回写后即从清单消失） */
 export const listPendingTestRunBugsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(runIdSchema)
-  .handler(async ({ data }): Promise<PendingTestBugItem[]> => {
+  .handler(async ({ data, context }): Promise<PendingTestBugItem[]> => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const run = await prisma.testRun.findUnique({
       where: { id: data.runId },
@@ -80,12 +78,11 @@ const confirmSchema = z.object({ bugId: z.string().min(1) });
 
 /** 确认提交：pendingConfirm true→false（转正进入 BUG 常规列表），活动留痕 */
 export const confirmTestRunBugFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(confirmSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const bug = await prisma.bug.findUnique({
       where: { id: data.bugId },

package/src/server/serverFns/changelog/__tests__/fetch.test.ts

@@ -14,10 +14,49 @@ const mocks = vi.hoisted(() => ({
 
 vi.mock("@tanstack/react-start", () => ({
   createServerFn: () => ({
+    _middlewares: [] as unknown[],
+    middleware(mws: unknown[]) {
+      this._middlewares.push(...mws);
+      return this;
+    },
     handler(fn: Function) {
-      return async (args?: { data?: unknown }) => fn({ data: args?.data });
+      const self = this;
+      return async (args?: { data?: unknown }) => {
+        // fetchChangelogFn 迁移后经 .middleware([authContextMiddleware]) 注入
+        // context.user：mock 依序执行 middleware 的 server 段（fetchChangelogFn
+        // 本体不消费 user，仅要求鉴权门卫先行），真实鉴权链由被 mock 的 auth-helpers 承接
+        let context: unknown = {};
+        for (const mw of self._middlewares) {
+          const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+          if (typeof serverFn !== "function") continue;
+          const result = await (
+            serverFn as (p: unknown) => Promise<{ context?: unknown }>
+          )({
+            data: args?.data,
+            context,
+            method: "GET",
+            serverFnMeta: {},
+            signal: new AbortController().signal,
+            next: (inner: { context?: unknown } | undefined) =>
+              Promise.resolve({ context: { ...(context as object), ...(inner?.context ?? {}) } }),
+          });
+          context = result.context;
+        }
+        return fn({ data: args?.data, context });
+      };
     },
   }),
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({

package/src/server/serverFns/changelog/fetch.ts

@@ -1,19 +1,17 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import type { DeveloperLogEntry } from '@allbluecn/kernel'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 // changelog 页位于 _nav（登录墙内），消费方仅 _nav/changelog/route.tsx loader；
-// serverFn 是独立 RPC 入口，未登录直调会被 _nav 布局拦在页面层——此处按
-// 「每个 handler 首行自查鉴权」约定补 requireAuth，封死匿名全表拉取面。
+// serverFn 是独立 RPC 入口，未登录直调会被 _nav 布局拦在页面层——按
+// authContextMiddleware 挂 per-fn 鉴权，封死匿名全表拉取面。
 // take 封顶防 developerLog 表增长后单次大返回（当前量级远低于上限，行为不变）。
 const CHANGELOG_MAX_ENTRIES = 500
 
 export const fetchChangelogFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .handler(async () => {
-    const request = getRequest()
-    await requireAuth(request)
     const prisma = await getPrisma()
     const logs = await prisma.developerLog.findMany({
       where: { isDeleted: false },

package/src/server/serverFns/chat/conversations.ts

@@ -18,9 +18,8 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { Prisma } from "@allbluecn/database"
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { z } from "zod"
-import { getCurrentSession } from "@/lib/session"
 
 /** 可空 Json 列的 createMany 入参收窄：null → Prisma.JsonNull（Prisma 拒绝裸 null） */
 function jsonRef(v: Prisma.JsonValue | null): Prisma.InputJsonValue | Prisma.NullableJsonNullValueInput {
@@ -28,16 +27,14 @@ function jsonRef(v: Prisma.JsonValue | null): Prisma.InputJsonValue | Prisma.Nul
 }
 
 export const listConversationsFn = createServerFn({ method: "GET" })
-  .handler(async () => {
+  .middleware([authContextMiddleware])
+  .handler(async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getCurrentSession(request)
-    if (!session?.user?.id) throw new Error("Unauthorized")
 
     const dayAgo = new Date(Date.now() - 24 * 60 * 60 * 1000)
 
     const conversations = await prisma.chatThread.findMany({
-      where: { userId: session.user.id },
+      where: { userId: context.user.id },
       orderBy: { updatedAt: "desc" },
       // DB-04/05：白名单 select + 防御性 take（侧栏只展示最近会话，截断最旧）
       take: 200,
@@ -75,12 +72,10 @@ const createConversationSchema = z.object({
 })
 
 export const createConversationFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(createConversationSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getCurrentSession(request)
-    if (!session?.user?.id) throw new Error("Unauthorized")
 
     const agentId = data.agentId || null
 
@@ -88,7 +83,7 @@ export const createConversationFn = createServerFn({ method: "POST" })
       const agent = await prisma.userAgent.findFirst({
         where: {
           id: agentId,
-          userId: session.user.id,
+          userId: context.user.id,
           isDeleted: false,
         },
         select: { id: true, userId: true, name: true, avatarEmoji: true },
@@ -97,7 +92,7 @@ export const createConversationFn = createServerFn({ method: "POST" })
     }
 
     const conversation = await prisma.chatThread.create({
-      data: { userId: session.user.id, agentId },
+      data: { userId: context.user.id, agentId },
       include: { agent: { select: { name: true, avatarEmoji: true } } },
     })
 
@@ -120,19 +115,17 @@ const updateConversationSchema = z.object({
 })
 
 export const updateConversationFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(updateConversationSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getCurrentSession(request)
-    if (!session?.user?.id) throw new Error("Unauthorized")
 
     const update: Record<string, unknown> = {}
     if (data.title !== undefined) update.title = data.title
     if (data.isArchived !== undefined) update.isArchived = data.isArchived
 
     await prisma.chatThread.update({
-      where: { id: data.id, userId: session.user.id },
+      where: { id: data.id, userId: context.user.id },
       data: update,
     })
 
@@ -144,15 +137,13 @@ const deleteConversationSchema = z.object({
 })
 
 export const deleteConversationFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(deleteConversationSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getCurrentSession(request)
-    if (!session?.user?.id) throw new Error("Unauthorized")
 
     await prisma.chatThread.delete({
-      where: { id: data.id, userId: session.user.id },
+      where: { id: data.id, userId: context.user.id },
     })
 
     return { success: true }
@@ -167,13 +158,11 @@ const FORK_MSG_BATCH_SIZE = 500;
 const FORK_MSG_WARN_THRESHOLD = 2000;
 
 export const forkConversationFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(forkConversationSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getCurrentSession(request)
-    if (!session?.user?.id) throw new Error("Unauthorized")
-    const userId = session.user.id
+    const userId = context.user.id
 
     const source = await prisma.chatThread.findFirst({
       where: { id: data.threadId, userId },

package/src/server/serverFns/chat/list-messages.ts

@@ -17,11 +17,11 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { z } from "zod"
-import { getCurrentSession } from "@/lib/session"
 
 export const listMessagesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       threadId: z.string().min(1),
@@ -33,15 +33,12 @@ export const listMessagesFn = createServerFn({ method: "GET" })
       limit: z.number().int().min(1).max(500).optional(),
     }),
   )
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getCurrentSession(request)
-    if (!session?.user?.id) throw new Error("Unauthorized")
 
     // SEC-17: 越权读防护——ChatThread 无成员表，仅属主可读消息
     const thread = await prisma.chatThread.findFirst({
-      where: { id: data.threadId, userId: session.user.id },
+      where: { id: data.threadId, userId: context.user.id },
       select: { id: true },
     })
     if (!thread) throw new Error("thread not found")

package/src/server/serverFns/collab-presence.ts

@@ -29,12 +29,12 @@
 // createSharePresenceTicketFn、团队 presence=本文件）。
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import { buildRoomName } from '@allbluecn/collab-core/rooms'
 import { signTicket } from '@allbluecn/collab-core/ticket'
-import { requireAuth, ForbiddenError } from '@/server/auth-helpers'
+import { ForbiddenError } from '@/server/auth-helpers';
 import { parseRoomName } from '@/server/collab-permissions'
 import { isUserInTeam, USER_BRIEF_SELECT } from '@/server/team-access'
 import {
@@ -44,15 +44,14 @@ import {
 } from '@/server/collab/ticket-utils'
 
 /**
- * 当前用户的团队 presence room 引导。未登录由 requireAuth 拒绝；
+ * 当前用户的团队 presence room 引导。未登录由 authContextMiddleware 拒绝；
  * 无团队成员行的账号按自属团队处理（与 listTeamMembersFn 的懒建 owner 行
  * 口径一致：presence 不触发行创建，ownerId 即自己）。
  */
-export const getPresenceRoomFn = createServerFn({ method: 'GET' }).handler(
-  async () => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+export const getPresenceRoomFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware]).handler(
+  async ({ context }) => {
+    const userId = context.user.id
 
     const prisma = await getPrisma()
     const membership = await prisma.teamMembership.findUnique({
@@ -88,12 +87,11 @@ export const getPresenceRoomFn = createServerFn({ method: 'GET' }).handler(
  * 入口），授权 = isUserInTeam(room.ownerId, me)。
  */
 export const createPresenceTicketFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ roomName: z.string().min(1) }))
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const user = session.user!
-    const userId = user.id!
+  .handler(async ({ data, context }) => {
+    const user = context.user
+    const userId = user.id
 
     const room = parseRoomName(data.roomName)
     if (!room || room.kind !== 'presence-team') {