@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/design/ai/__tests__/agent-conversations.test.ts

@@ -20,23 +20,54 @@ const mocks = vi.hoisted(() => ({
 }));
 
 vi.mock("@tanstack/react-start", () => ({
-  createServerFn: () => ({
-    validator(schema: { parse: (v: unknown) => unknown }) {
-      const api = {
-        _validator: schema,
-        handler(fn: Function) {
-          const validator = (this as { _validator?: { parse: (v: unknown) => unknown } })
-            ._validator;
-          return async (args: { data?: unknown }) => {
-            let data = args?.data;
-            if (validator && data !== undefined) data = validator.parse(data);
-            return fn({ data });
-          };
-        },
-      };
-      return api;
-    },
-  }),
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
+    const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws);
+        return api;
+      },
+      validator(schema: { parse: (v: unknown) => unknown }) {
+        api._validator = schema;
+        return api;
+      },
+      handler(fn: Function) {
+        return async (args: { data?: unknown }) => {
+          let data = args?.data;
+          if (api._validator && data !== undefined) data = api._validator.parse(data);
+          let context: any = {};
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
+          }
+          return fn({ data, context });
+        };
+      },
+    };
+    return api;
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({
@@ -63,10 +94,8 @@ vi.mock("@/server/design/access", () => ({
   assertDesignOwner: mocks.assertDesignOwner,
 }));
 
-// getServerSeam 来自 @allbluecn/kernel（真实包），这里替 requireAuth 打桩
-vi.mock("@allbluecn/kernel", () => ({
-  getServerSeam: () => ({ requireAuth: mocks.requireAuth }),
-}));
+// 迁移后 requireAuth 消费入口：authContextMiddleware 内部调用
+vi.mock("@/server/auth-helpers", () => ({ requireAuth: mocks.requireAuth }));
 
 import {
   clearAgentConversationsFn,

package/src/server/serverFns/design/ai/__tests__/providers.test.ts

@@ -22,24 +22,54 @@ const mocks = vi.hoisted(() => ({
 }));
 
 vi.mock("@tanstack/react-start", () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
   createServerFn: () => {
-    const api = {
-      _validator: undefined as { parse: (v: unknown) => unknown } | undefined,
+    const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws);
+        return api;
+      },
       validator(schema: { parse: (v: unknown) => unknown }) {
-        this._validator = schema;
-        return this;
+        api._validator = schema;
+        return api;
       },
       handler(fn: Function) {
-        const validator = this._validator;
         return async (args: { data?: unknown }) => {
           let data = args?.data;
-          if (validator && data !== undefined) data = validator.parse(data);
-          return fn({ data });
+          if (api._validator && data !== undefined) data = api._validator.parse(data);
+          let context: any = {};
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
+          }
+          return fn({ data, context });
         };
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({
@@ -82,9 +112,13 @@ vi.mock("@/server/ai-gateway", () => ({
   fetchProviderModels: mocks.fetchProviderModels,
 }));
 
+// 迁移后 requireAuth 消费入口：authContextMiddleware 内部调用
+vi.mock("@/server/auth-helpers", () => ({
+  requireAuth: mocks.requireAuth,
+}));
+
 vi.mock("@allbluecn/kernel", () => ({
   getServerSeam: () => ({
-    requireAuth: mocks.requireAuth,
     requireUserInDb: mocks.requireUserInDb,
   }),
   // 本测试经 providers.ts → adapter.ts（invalidateAiConfigCache）引入 seam 注册调用

package/src/server/serverFns/design/ai/agent-conversations.ts

@@ -16,10 +16,9 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { z } from "zod"
 import { getPrisma } from "@allbluecn/database/get-prisma"
-import { getServerSeam } from "@allbluecn/kernel"
 import { assertDesignOwner } from "@/server/design/access"
 
 // 会话消息一次返回上限：Agent 会话量级有限，封顶防异常长会话一次性大返回
@@ -27,13 +26,12 @@ const MESSAGES_LIMIT = 500
 
 /** 列出用户在某个 PRD 下的所有 Agent 会话 */
 export const listAgentConversationsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ designId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     return prisma.agentConversation.findMany({
-      where: { userId: session.user.id, designId: data.designId },
+      where: { userId: context.user.id, designId: data.designId },
       orderBy: { updatedAt: "desc" },
       select: { id: true, title: true, createdAt: true, updatedAt: true },
     })
@@ -41,12 +39,11 @@ export const listAgentConversationsFn = createServerFn({ method: "GET" })
 
 /** 新建会话 */
 export const createAgentConversationFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ designId: z.string(), title: z.string().optional() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     // designId 是客户端任意传入的关联键，创建前校验属主，防向他人 design 挂垃圾会话行
     await assertDesignOwner(data.designId, userId)
     return prisma.agentConversation.create({
@@ -60,25 +57,23 @@ export const createAgentConversationFn = createServerFn({ method: "POST" })
 
 /** 删除单个会话（含消息，级联删除） */
 export const deleteAgentConversationFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     await prisma.agentConversation.deleteMany({
-      where: { id: data.id, userId: session.user.id },
+      where: { id: data.id, userId: context.user.id },
     })
     return { deleted: true }
   })
 
 /** 清除某 PRD 下的全部会话 */
 export const clearAgentConversationsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ designId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     // 与 create 同口径：designId 非本人 design 时拒绝，避免以他人 designId 维度清写
     await assertDesignOwner(data.designId, userId)
     await prisma.agentConversation.deleteMany({
@@ -89,13 +84,12 @@ export const clearAgentConversationsFn = createServerFn({ method: "POST" })
 
 /** 获取会话消息 */
 export const getAgentMessagesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ conversationId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     const conv = await prisma.agentConversation.findFirst({
-      where: { id: data.conversationId, userId: session.user.id },
+      where: { id: data.conversationId, userId: context.user.id },
       select: { id: true },
     })
     if (!conv) throw new Error("会话不存在")
@@ -117,6 +111,7 @@ export const getAgentMessagesFn = createServerFn({ method: "GET" })
 
 /** 保存消息到会话 */
 export const saveAgentMessageFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       conversationId: z.string(),
@@ -126,12 +121,10 @@ export const saveAgentMessageFn = createServerFn({ method: "POST" })
       isError: z.boolean().default(false),
     }),
   )
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     const conv = await prisma.agentConversation.findFirst({
-      where: { id: data.conversationId, userId: session.user.id },
+      where: { id: data.conversationId, userId: context.user.id },
       select: { id: true },
     })
     if (!conv) throw new Error("会话不存在")

package/src/server/serverFns/design/ai/fill-annotation.ts

@@ -16,9 +16,8 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { z } from "zod"
-import { getServerSeam } from "@allbluecn/kernel"
 import { checkAiRateLimit } from "@/server/lib/rate-limit"
 import { runChatWithModel } from "@/server/ai-gateway"
 import { buildFillPrompt } from "@/server/design/annotation-prompt"
@@ -60,12 +59,11 @@ function stripCodeFence(raw: string): string {
 }
 
 export const fillAnnotationFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(inputSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
+  .handler(async ({ data, context }) => {
     // 托管 AI 计费调用，与同域 generatePrototype 同口径 per-user 频控
-    await checkAiRateLimit(session.user.id, "fillAnnotation")
+    await checkAiRateLimit(context.user.id, "fillAnnotation")
 
     const systemPrompts = await buildFillPrompt({
       type: data.componentType,
@@ -79,7 +77,7 @@ export const fillAnnotationFn = createServerFn({ method: "POST" })
       [{ role: "user", content: "请根据组件信息填充注释模板。" }],
       {
         systemPrompts,
-        userId: session.user.id,
+        userId: context.user.id,
         model: data.model,
       },
     )

package/src/server/serverFns/design/ai/generate-prototype.ts

@@ -16,9 +16,8 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { z } from "zod"
-import { getServerSeam } from "@allbluecn/kernel"
 import { checkAiRateLimit } from "@/server/lib/rate-limit"
 import { runChatAsAgent } from "@/server/ai-gateway"
 import { prototypeSchema, extractJsonObject, type PrototypeResult } from "@/server/ai-gateway/media/prototype-schema"
@@ -33,14 +32,13 @@ const inputSchema = z.object({
 })
 
 export const generatePrototypeFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(inputSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     // 降级路径（FS-8.3）：AI 不支持流式输出的模型走本非流式入口。
     // 流式主路径为 SSE 路由 /api/design/prototype（routes/api/design/prototype/route.ts），
     // 前端按模型能力选择通道；本入口保留旧一次性 JSON 返回形态，不删除。
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    await checkAiRateLimit(session.user.id, "generatePrototype")
+    await checkAiRateLimit(context.user.id, "generatePrototype")
     const { prompt, model } = data
 
     const types = [...serverRegisteredTypes()]
@@ -56,7 +54,7 @@ export const generatePrototypeFn = createServerFn({ method: "POST" })
       "design.prototype",
       [{ role: "user", content: prompt }],
       {
-        userId: session.user.id,
+        userId: context.user.id,
         model,
         promptVars: { schemaHint: buildSceneSchemaHint(types), catalog },
       },

package/src/server/serverFns/design/ai/hosted-models.ts

@@ -16,14 +16,13 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
-import { getServerSeam } from '@allbluecn/kernel'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { getProService } from '@/server/ai-gateway/pro-services'
 
 export const listHostedModelsFn = createServerFn({ method: 'GET' })
-  .handler(async () => {
-    const session = await getServerSeam().requireAuth(getRequest())
-    if (session?.user?.role !== 'SUPER_ADMIN') return { models: [], enabled: false }
+  .middleware([authContextMiddleware])
+  .handler(async ({ context }) => {
+    if (context.user.role !== 'SUPER_ADMIN') return { models: [], enabled: false }
     // HostedAiService 契约当前仅 chatStream（kernel pro-contract/hosted-ai.ts）。
     // 模型目录待 Pro 侧扩展 listModels 后接入；当前 OSS/Pro 均返回空列表，页面显示预留空态。
     const hosted = getProService('hostedAi')

package/src/server/serverFns/design/ai/providers.ts

@@ -17,7 +17,7 @@
 
 // apps/web/src/server/serverFns/design/ai/providers.ts
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { z } from "zod"
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import type { Prisma } from "@allbluecn/database"
@@ -91,24 +91,22 @@ function dbRowToMeta(provider: {
 }
 
 /** 列出当前用户可见的所有服务商（平台启用 ∪ 用户已配置） */
-export const listAiProvidersFn = createServerFn({ method: "GET" }).handler(
-  async () => {
+export const listAiProvidersFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware]).handler(
+  async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     return listVisibleProvidersForUser(userId)
   },
 )
 
 /** 获取单个 provider 的元数据 + 用户配置 */
 export const getAiProviderFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ providerId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
 
     const provider = await prisma.aiProvider.findUnique({
       where: { providerId: data.providerId },
@@ -179,12 +177,11 @@ const updateSchema = z.object({
 })
 
 export const updateAiProviderFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(updateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await getServerSeam().requireUserInDb(userId)
 
     const provider = await prisma.aiProvider.findUnique({
@@ -242,12 +239,11 @@ export const updateAiProviderFn = createServerFn({ method: "POST" })
   })
 
 export const deleteAiProviderConfigFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ providerId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await prisma.aiProviderConfig.deleteMany({
       where: { userId, providerId: data.providerId },
     })
@@ -262,12 +258,11 @@ export const deleteAiProviderConfigFn = createServerFn({ method: "POST" })
  * 不删除现有模型（自定义或 API 限制都应保留）。
  */
 export const refreshModelsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ providerId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await getServerSeam().requireUserInDb(userId)
     await checkAiRateLimit(userId, "refreshModels")
 
@@ -368,14 +363,13 @@ export const refreshModelsFn = createServerFn({ method: "POST" })
 
 /** 创建自定义模型，追加到用户 customModels（id 重复则报错） */
 export const createCustomModelFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({ providerId: z.string(), model: modelMetaSchema }),
   )
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await getServerSeam().requireUserInDb(userId)
 
     const provider = await prisma.aiProvider.findUnique({
@@ -428,11 +422,10 @@ export const createCustomModelFn = createServerFn({ method: "POST" })
   })
 
 /** 列出当前用户所有已启用 provider 的模型列表（聊天模型选择器用） */
-export const listEnabledModelsFn = createServerFn({ method: "GET" }).handler(
-  async () => {
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    const userId = session.user.id
+export const listEnabledModelsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware]).handler(
+  async ({ context }) => {
+    const userId = context.user.id
     return listEnabledModelsForUser(userId)
   },
 )
@@ -445,12 +438,11 @@ const testSchema = z.object({
 })
 
 export const testAiProviderFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(testSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await checkAiRateLimit(userId, "testProvider")
 
     const provider = await prisma.aiProvider.findUnique({
@@ -497,6 +489,7 @@ const CUSTOM_PROVIDER_MAX_PER_USER = 20
 
 /** 用户创建自定义 OpenAI 兼容服务商 */
 export const createCustomProviderFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       displayName: z.string().min(1).max(64),
@@ -505,11 +498,9 @@ export const createCustomProviderFn = createServerFn({ method: "POST" })
       defaultModel: z.string().min(1),
     }),
   )
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await getServerSeam().requireUserInDb(userId)
 
     // 频控：AiProvider 是全局目录表（行被所有用户的可见性查询扫描），

package/src/server/serverFns/design/ai/source-mode.ts

@@ -16,9 +16,9 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { z } from 'zod'
-import { AI_SOURCE_MODES, getServerSeam } from '@allbluecn/kernel'
+import { AI_SOURCE_MODES } from '@allbluecn/kernel'
 import { GUEST_USER_ID } from '@/server/desktop-guest'
 import { resolveSourceMode, setSourceMode } from '@/server/ai-gateway/source-mode'
 import type { AiSourceMode } from '@allbluecn/kernel'
@@ -26,12 +26,11 @@ import type { AiSourceMode } from '@allbluecn/kernel'
 const modeSchema = z.object({ mode: z.enum(AI_SOURCE_MODES) })
 
 export const setAiSourceModeFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(modeSchema)
-  .handler(async ({ data }) => {
-    const session = await getServerSeam().requireAuth(getRequest())
-    const userId = session?.user?.id
-    if (!userId) throw new Error('未登录')
-    const role = session?.user?.role
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id
+    const role = context.user.role
     const isGuest = userId === GUEST_USER_ID
     if (data.mode === 'hosted' && role !== 'SUPER_ADMIN') throw new Error('仅超级管理员可启用平台托管模式')
     if (data.mode === 'local-agent' && process.env.DEPLOY_TARGET !== 'desktop')
@@ -40,12 +39,11 @@ export const setAiSourceModeFn = createServerFn({ method: 'POST' })
   })
 
 export const getAiSourceModeFn = createServerFn({ method: 'GET' })
-  .handler(async () => {
-    const session = await getServerSeam().requireAuth(getRequest())
-    const userId = session?.user?.id
-    if (!userId) throw new Error('未登录')
+  .middleware([authContextMiddleware])
+  .handler(async ({ context }) => {
+    const userId = context.user.id
     const isGuest = userId === GUEST_USER_ID
     const mode = await resolveSourceMode({ userId, isGuest })
-    const canHosted = session?.user?.role === 'SUPER_ADMIN'
+    const canHosted = context.user.role === 'SUPER_ADMIN'
     return { mode, canHosted } as { mode: AiSourceMode | null; canHosted: boolean }
   })

package/src/server/serverFns/design/comments.ts

@@ -16,12 +16,13 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import type { Prisma } from '@allbluecn/database'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import { getServerSeam } from '@allbluecn/kernel'
-import { assertDesignReadable, DESIGN_FORBIDDEN_MESSAGE, sessionUserId } from '@/server/design/access'
+import { assertDesignReadable, DESIGN_FORBIDDEN_MESSAGE } from '@/server/design/access'
 
 const listSchema = z.object({
   designId: z.string(),
@@ -74,11 +75,11 @@ const createSchema = z.object({
 })
 
 export const createCommentFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(createSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     await assertDesignReadable(data.designId, userId)
 
     if (data.pageId) {
@@ -113,10 +114,10 @@ async function setCommentResolved(id: string, userId: string, resolved: boolean)
 const ignoreSchema = z.object({ id: z.string() })
 
 export const ignoreCommentFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(ignoreSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id
     await setCommentResolved(data.id, userId, true)
     return { success: true }
   })
@@ -128,11 +129,11 @@ const updateCommentSchema = z.object({
 
 // 正文只有作者本人可改
 export const updateCommentFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(updateCommentSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     const owned = await prisma.comment.findFirst({
       where: { id: data.id, userId },
       select: { id: true },
@@ -144,10 +145,10 @@ export const updateCommentFn = createServerFn({ method: 'POST' })
 const resolveSchema = z.object({ id: z.string(), resolved: z.boolean() })
 
 export const resolveCommentFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(resolveSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id
     await setCommentResolved(data.id, userId, data.resolved)
     return { success: true }
   })