@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/collab-snapshot.ts

@@ -17,7 +17,7 @@
 
 // 实体协同快照取用 serverFn（Yjs 多人协作 §5.2 首次种子化 / §6 SSR 初始
 // 快照链路，任务 14 知识库 + 任务 20 泛化 entity-story）：
-// requireAuth → assertCollabAccess（各 room 的唯一授权裁决点）→ §5.2 三态
+// middleware 鉴权 → assertCollabAccess（各 room 的唯一授权裁决点）→ §5.2 三态
 // 判定 → 返回 base64 编码的 Y.Doc update（客户端 Y.applyUpdate）。
 //
 // entityType 泛化（任务 20）：knowledge（缺省，任务 15 loader 兼容）与
@@ -37,12 +37,12 @@
 // 解析在 @/server/collab/seed（handler 内引用，客户端 split 后剥离）。
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import { buildRoomName } from '@allbluecn/collab-core/rooms'
 import { normalizeCollabSteps } from '@allbluecn/collab-core/steps'
-import { requireAuth, ForbiddenError } from '@/server/auth-helpers'
+import { ForbiddenError } from '@/server/auth-helpers';
 import { assertCollabAccess } from '@/server/collab-permissions'
 import {
   extractKnowledgeDocHtml,
@@ -62,6 +62,7 @@ import {
  * assertCollabAccess（owner ≥ edit、viewer → view、空间外 Forbidden）。
  */
 export const getCollabSnapshotFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       /** room 实体型（缺省 knowledge = 任务 15 知识库 loader 的既有入参形态） */
@@ -69,10 +70,8 @@ export const getCollabSnapshotFn = createServerFn({ method: 'POST' })
       docId: z.string().min(1),
     }),
   )
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id
 
     await assertCollabAccess(data.entityType, data.docId, userId)
 

package/src/server/serverFns/collab.ts

@@ -16,7 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 // 协同 ticket 签发（Yjs 多人协作 §4.2）：
-// - createCollabTicketFn：成员实体协同（requireAuth → parseRoomName →
+// - createCollabTicketFn：成员实体协同（middleware 鉴权 → parseRoomName →
 //   roomAccessTarget → assertCollabAccess → 按 role 签发）。
 // - createSharePresenceTicketFn：分享页 presence（不要求登录，Share 有效性
 //   + 密码门禁复验 → guest/member ticket，role 恒 view，§9）。
@@ -26,12 +26,13 @@
 // 对齐：room 原样写入（验签方校验与连接 room 严格相等）、exp 为 unix 秒。
 
 import { createServerFn } from '@tanstack/react-start'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import { buildRoomName } from '@allbluecn/collab-core/rooms'
 import { signTicket } from '@allbluecn/collab-core/ticket'
-import { requireAuth, ForbiddenError } from '@/server/auth-helpers'
+import { ForbiddenError } from '@/server/auth-helpers';
 import { getCurrentSession } from '@/lib/session'
 import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
 import {
@@ -54,12 +55,11 @@ import {
  * （授权走 assertCollabAccess，owner ≥ edit、viewer → view，§4.1）。
  */
 export const createCollabTicketFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ roomName: z.string().min(1) }))
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const user = session.user!
-    const userId = user.id!
+  .handler(async ({ data, context }) => {
+    const user = context.user
+    const userId = user.id
 
     const room = parseRoomName(data.roomName)
     const target = room ? roomAccessTarget(room) : null

package/src/server/serverFns/compliance.ts

@@ -1,21 +1,21 @@
 import { createServerFn } from '@tanstack/react-start'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { z } from 'zod'
 import { getRequest } from '@tanstack/react-start/server'
 import { checkRateLimit } from '@/server/middlewares/rate-limit-server-fn'
 import { getProService } from '@/server/pro-services'
-import { requireAuth } from '@/server/auth-helpers'
 import { requireFeature } from '@/server/entitlements'
 
 const JOB_RATE_LIMIT = { max: 3, windowMs: 3600_000 }
 // 删除类破坏性任务更收紧：1 次/小时（服务端限流统一走 rate-limit-server-fn 口径）
 const DELETE_RATE_LIMIT = { max: 1, windowMs: 3600_000 }
 
-// requireAuth 已保证 session.user.id 存在（服务端限流经 rate-limit-server-fn），
+// authContextMiddleware 已保证 context.user.id 存在（服务端限流经 rate-limit-server-fn），
 // 不再重复做空值防御
-export const requestMyExportFn = createServerFn({ method: 'POST' }).validator(z.object({})).handler(async () => {
+export const requestMyExportFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware]).validator(z.object({})).handler(async ({ context }) => {
   const request = getRequest()
-  const session = await requireAuth(request)
-  const userId = session.user.id
+  const userId = context.user.id
   await requireFeature(request, 'compliance')
   const rl = checkRateLimit(`compliance-export:${userId}`, JOB_RATE_LIMIT)
   if (!rl.allowed) {
@@ -28,10 +28,10 @@ export const requestMyExportFn = createServerFn({ method: 'POST' }).validator(z.
   return compliance.createExportJob('user', userId, userId)
 })
 
-export const requestMyDeletionFn = createServerFn({ method: 'POST' }).validator(z.object({})).handler(async () => {
+export const requestMyDeletionFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware]).validator(z.object({})).handler(async ({ context }) => {
   const request = getRequest()
-  const session = await requireAuth(request)
-  const userId = session.user.id
+  const userId = context.user.id
   await requireFeature(request, 'compliance')
   // 与 export 对齐的 per-user 频控：防重复提交刷出大量删除 job（不可逆流程防误触）
   const rl = checkRateLimit(`compliance-delete:${userId}`, DELETE_RATE_LIMIT)

package/src/server/serverFns/design/__tests__/comments.test.ts

@@ -42,12 +42,52 @@ const mocks = vi.hoisted(() => ({
 }))
 
 vi.mock('@tanstack/react-start', () => ({
-  createServerFn: () => ({
-    validator: (schema: ZodType) => ({
-      handler: (fn: (args: { data: unknown }) => unknown) => async (args: { data: unknown }) =>
-        fn({ data: schema.parse(args.data) }),
-    }),
-  }),
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
+    const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
+      validator: (schema: ZodType) => {
+        api._validator = schema
+        return api
+      },
+      handler: (fn: (args: { data: unknown; context?: unknown }) => unknown) => async (args: { data: unknown }) => {
+        const schema = api._validator as ZodType | undefined
+        const data = schema && args?.data !== undefined ? schema.parse(args.data) : args?.data
+        let context: any = {}
+        for (const mw of api._middlewares) {
+          const serverFn = mw?.options?.server
+          if (!serverFn) continue
+          const result = await serverFn({
+            data,
+            context,
+            method: 'POST',
+            serverFnMeta: {},
+            signal: new AbortController().signal,
+            next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+          })
+          context = result.context
+        }
+        return fn({ data, context })
+      },
+    }
+    return api
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
 }))
 vi.mock('@tanstack/react-start/server', () => ({
   getRequest: () => new Request('https://allblue.test/design'),
@@ -56,12 +96,16 @@ vi.mock('@tanstack/react-start/server', () => ({
     mocks.cookies.set(name, value)
   },
 }))
+// 迁移后 requireAuth 消费入口：authContextMiddleware 内部调用
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: async () => {
+    if (!mocks.session?.user?.id) throw new Error('UNAUTHORIZED')
+    return mocks.session
+  },
+}))
+// listCommentsFn（公开访客口径，未迁 middleware）仍走 seam 的 getCurrentSession
 vi.mock('@allbluecn/kernel', () => ({
   getServerSeam: () => ({
-    requireAuth: async () => {
-      if (!mocks.session?.user?.id) throw new Error('UNAUTHORIZED')
-      return mocks.session
-    },
     getCurrentSession: async () => mocks.session,
   }),
 }))

package/src/server/serverFns/design/__tests__/designs.test.ts

@@ -11,10 +11,16 @@
  */
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-// ① createServerFn 链式 mock（照抄 ai-source-mode.test.ts，保留 zod validator 真实解析）
-vi.mock('@tanstack/react-start', () => {
-  const createServerFn = () => {
+// ① createServerFn 链式 mock（照抄 bug-crud.test.ts：middleware server 段执行 +
+// createMiddleware，保留 zod validator 真实解析；迁移后经 .middleware 注入 context.user）
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
     const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
       validator(schema: { parse: (d: unknown) => unknown }) {
         api._validator = schema
         return api
@@ -25,31 +31,48 @@ vi.mock('@tanstack/react-start', () => {
           if (api._validator && data !== undefined) {
             data = api._validator.parse ? api._validator.parse(data) : data
           }
-          return fn({ data })
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
         }
       },
     }
     return api
-  }
-  return { createServerFn }
-})
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
+}))
 vi.mock('@tanstack/react-start/server', () => ({
   getRequest: () => ({}),
 }))
 
-// ② seam mock
+// ② 鉴权链 mock：authContextMiddleware 内部 requireAuth（迁移后消费入口）
 const mocks = vi.hoisted(() => ({
   currentSession: vi.fn(),
 }))
 
-vi.mock('@allbluecn/kernel', () => ({
-  getServerSeam: () => ({
-    requireAuth: async () => {
-      const session = await mocks.currentSession()
-      if (!session?.user?.id) throw new Error('UNAUTHORIZED')
-      return session
-    },
-  }),
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: mocks.currentSession,
 }))
 
 vi.mock('@allbluecn/database', () => ({

package/src/server/serverFns/design/__tests__/page-versions.test.ts

@@ -39,24 +39,62 @@ const mocks = vi.hoisted(() => ({
 }))
 
 vi.mock('@tanstack/react-start', () => ({
-  createServerFn: () => ({
-    validator: (schema: ZodType) => ({
-      handler: (fn: (args: { data: unknown }) => unknown) => async (args: { data: unknown }) =>
-        fn({ data: schema.parse(args.data) }),
-    }),
-  }),
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
+    const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
+      validator: (schema: ZodType) => {
+        api._validator = schema
+        return api
+      },
+      handler: (fn: (args: { data: unknown; context?: unknown }) => unknown) => async (args: { data: unknown }) => {
+        const schema = api._validator as ZodType | undefined
+        const data = schema && args?.data !== undefined ? schema.parse(args.data) : args?.data
+        let context: any = {}
+        for (const mw of api._middlewares) {
+          const serverFn = mw?.options?.server
+          if (!serverFn) continue
+          const result = await serverFn({
+            data,
+            context,
+            method: 'POST',
+            serverFnMeta: {},
+            signal: new AbortController().signal,
+            next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+          })
+          context = result.context
+        }
+        return fn({ data, context })
+      },
+    }
+    return api
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
 }))
 vi.mock('@tanstack/react-start/server', () => ({
   getRequest: () => new Request('https://allblue.test/design'),
 }))
-vi.mock('@allbluecn/kernel', () => ({
-  getServerSeam: () => ({
-    requireAuth: async () => {
-      if (!mocks.session?.user?.id) throw new Error('UNAUTHORIZED')
-      return mocks.session
-    },
-    getCurrentSession: async () => mocks.session,
-  }),
+// 迁移后 requireAuth 消费入口：authContextMiddleware 内部调用
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: async () => {
+    if (!mocks.session?.user?.id) throw new Error('UNAUTHORIZED')
+    return mocks.session
+  },
 }))
 vi.mock('@allbluecn/database', () => ({
   prisma: mocks.prisma,

package/src/server/serverFns/design/__tests__/shares-password.test.ts

@@ -15,9 +15,17 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import bcrypt from 'bcryptjs'
 
 // ① createServerFn 链式 mock（照抄 designs.test.ts，保留 zod validator 真实解析）
-vi.mock('@tanstack/react-start', () => {
-  const createServerFn = () => {
+vi.mock('@tanstack/react-start', () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
     const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
       validator(schema: { parse: (d: unknown) => unknown }) {
         api._validator = schema
         return api
@@ -28,14 +36,37 @@ vi.mock('@tanstack/react-start', () => {
           if (api._validator && data !== undefined) {
             data = api._validator.parse ? api._validator.parse(data) : data
           }
-          return fn({ data })
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
         }
       },
     }
     return api
-  }
-  return { createServerFn }
-})
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
+}))
 vi.mock('@tanstack/react-start/server', () => ({
   getRequest: () => ({}),
 }))
@@ -46,14 +77,13 @@ const mocks = vi.hoisted(() => ({
   notifyClients: vi.fn(),
 }))
 
-vi.mock('@allbluecn/kernel', () => ({
-  getServerSeam: () => ({
-    requireAuth: async () => {
-      const session = await mocks.currentSession()
-      if (!session?.user?.id) throw new Error('UNAUTHORIZED')
-      return session
-    },
-  }),
+// 迁移后 requireAuth 消费入口：authContextMiddleware 内部调用
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: async () => {
+    const session = await mocks.currentSession()
+    if (!session?.user?.id) throw new Error('UNAUTHORIZED')
+    return session
+  },
 }))
 
 vi.mock('@/lib/share-events', () => ({

package/src/server/serverFns/design/__tests__/shares.test.ts

@@ -19,9 +19,17 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 // ① createServerFn 链式 mock（照抄 designs.test.ts，保留 zod validator 真实解析）
-vi.mock('@tanstack/react-start', () => {
-  const createServerFn = () => {
+vi.mock('@tanstack/react-start', () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
     const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
       validator(schema: { parse: (d: unknown) => unknown }) {
         api._validator = schema
         return api
@@ -32,14 +40,37 @@ vi.mock('@tanstack/react-start', () => {
           if (api._validator && data !== undefined) {
             data = api._validator.parse ? api._validator.parse(data) : data
           }
-          return fn({ data })
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
         }
       },
     }
     return api
-  }
-  return { createServerFn }
-})
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
+}))
 vi.mock('@tanstack/react-start/server', () => ({
   getRequest: () => ({}),
 }))
@@ -50,14 +81,13 @@ const mocks = vi.hoisted(() => ({
   notifyClients: vi.fn(),
 }))
 
-vi.mock('@allbluecn/kernel', () => ({
-  getServerSeam: () => ({
-    requireAuth: async () => {
-      const session = await mocks.currentSession()
-      if (!session?.user?.id) throw new Error('UNAUTHORIZED')
-      return session
-    },
-  }),
+// 迁移后 requireAuth 消费入口：authContextMiddleware 内部调用
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: async () => {
+    const session = await mocks.currentSession()
+    if (!session?.user?.id) throw new Error('UNAUTHORIZED')
+    return session
+  },
 }))
 
 vi.mock('@/lib/share-events', () => ({

package/src/server/serverFns/design/__tests__/versions.test.ts

@@ -14,9 +14,17 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 // ① createServerFn 链式 mock（照抄 designs.test.ts，保留 zod validator 真实解析）
-vi.mock('@tanstack/react-start', () => {
-  const createServerFn = () => {
+vi.mock('@tanstack/react-start', () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
     const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
       validator(schema: { parse: (d: unknown) => unknown }) {
         api._validator = schema
         return api
@@ -27,14 +35,37 @@ vi.mock('@tanstack/react-start', () => {
           if (api._validator && data !== undefined) {
             data = api._validator.parse ? api._validator.parse(data) : data
           }
-          return fn({ data })
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
         }
       },
     }
     return api
-  }
-  return { createServerFn }
-})
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
+}))
 vi.mock('@tanstack/react-start/server', () => ({
   getRequest: () => ({}),
 }))
@@ -43,14 +74,13 @@ const mocks = vi.hoisted(() => ({
   currentSession: vi.fn(),
 }))
 
-vi.mock('@allbluecn/kernel', () => ({
-  getServerSeam: () => ({
-    requireAuth: async () => {
-      const session = await mocks.currentSession()
-      if (!session?.user?.id) throw new Error('UNAUTHORIZED')
-      return session
-    },
-  }),
+// 迁移后 requireAuth 消费入口：authContextMiddleware 内部调用
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: async () => {
+    const session = await mocks.currentSession()
+    if (!session?.user?.id) throw new Error('UNAUTHORIZED')
+    return session
+  },
 }))
 
 vi.mock('@allbluecn/database', () => ({