@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/design/designs.ts

@@ -16,12 +16,10 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import { Prisma } from '@allbluecn/database'
-import { getServerSeam } from '@allbluecn/kernel'
-import { sessionUserId } from '@/server/design/access'
 
 const listSchema = z.object({
   take: z.number().int().min(1).max(100).default(20),
@@ -29,12 +27,11 @@ const listSchema = z.object({
 })
 
 export const listDesignsFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(listSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    const userId = sessionUserId(session)
+    const userId = context.user.id
     return prisma.design.findMany({
       where: { userId, isDeleted: false },
       orderBy: { createdAt: 'desc' },
@@ -59,11 +56,10 @@ const createSchema = z.object({
 })
 
 export const createDesignFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(createSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     // 服务端同步建首页：否则首个 page 依赖左栏页面树挂载时自动创建，
     // 左栏折叠（localStorage.designLeftPanelOpen 持久化）时首页永不创建，
     // activePageId 恒 null，保存链路静默跳过，编辑内容全丢。
@@ -74,7 +70,7 @@ export const createDesignFn = createServerFn({ method: 'POST' })
         icon: data.icon,
         name: data.name,
         description: data.description,
-        userId: sessionUserId(session),
+        userId: context.user.id,
         pages: {
           create: {
             name: data.homeName ?? '首页',
@@ -103,15 +99,14 @@ const updateSchema = z.object({
 })
 
 export const updateDesignFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(updateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     // DB-03：属主校验合并进写入（updateMany 计数判定），1 次查询替代 2 次
     const { id: _id, ...rest } = data
     const res = await prisma.design.updateMany({
-      where: { id: data.id, userId: sessionUserId(session), isDeleted: false },
+      where: { id: data.id, userId: context.user.id, isDeleted: false },
       data: rest,
     })
     if (res.count === 0) throw new Error('未找到或无权限')
@@ -119,14 +114,13 @@ export const updateDesignFn = createServerFn({ method: 'POST' })
   })
 
 export const deleteDesignFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     // DB-03：属主校验合并进写入；where 不含 isDeleted 与原 findFirst 口径一致（重复软删幂等刷新 deletedAt）
     const res = await prisma.design.updateMany({
-      where: { id: data.id, userId: sessionUserId(session) },
+      where: { id: data.id, userId: context.user.id },
       data: { isDeleted: true, deletedAt: new Date() },
     })
     if (res.count === 0) throw new Error('未找到或无权限')

package/src/server/serverFns/design/page-versions.ts

@@ -16,11 +16,10 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
-import { getServerSeam } from '@allbluecn/kernel'
-import { assertPageOwner, assertPageVersionOwner, sessionUserId } from '@/server/design/access'
+import { assertPageOwner, assertPageVersionOwner } from '@/server/design/access'
 import { toNullableJsonInput } from '@/server/lib/prisma-json'
 
 const VERSION_NOTES_MAX = 500
@@ -28,14 +27,14 @@ const VERSION_NOTES_MAX = 500
 // 页面版本（快照）全部经 page.design.userId 归属校验：读写一律仅属主。
 
 export const listDesignPageVersionsFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({
     pageId: z.string(),
     limit: z.number().int().min(1).optional(),
   }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     await assertPageOwner(data.pageId, userId)
 
     return prisma.pageVersion.findMany({
@@ -47,11 +46,11 @@ export const listDesignPageVersionsFn = createServerFn({ method: 'GET' })
   })
 
 export const getDesignPageVersionFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ pageVersionId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     await assertPageVersionOwner(data.pageVersionId, userId)
 
     const pageVersion = await prisma.pageVersion.findUnique({
@@ -64,6 +63,7 @@ export const getDesignPageVersionFn = createServerFn({ method: 'GET' })
   })
 
 export const createDesignPageVersionFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({
     pageId: z.string(),
     notes: z.string().optional(),
@@ -71,10 +71,9 @@ export const createDesignPageVersionFn = createServerFn({ method: 'POST' })
     content: z.unknown().optional(),
     restoredFromVersion: z.number().int().optional(),
   }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     await assertPageOwner(data.pageId, userId)
 
     if (data.notes && data.notes.length > VERSION_NOTES_MAX) {
@@ -117,16 +116,16 @@ export const createDesignPageVersionFn = createServerFn({ method: 'POST' })
   })
 
 export const updateDesignPageVersionFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({
     pageVersionId: z.string(),
     notes: z.string().optional(),
     canvas: z.unknown().optional(),
     content: z.unknown().optional(),
   }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     await assertPageVersionOwner(data.pageVersionId, userId)
 
     if (data.notes && data.notes.length > VERSION_NOTES_MAX) {
@@ -144,11 +143,11 @@ export const updateDesignPageVersionFn = createServerFn({ method: 'POST' })
   })
 
 export const deleteDesignPageVersionFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ pageVersionId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     await assertPageVersionOwner(data.pageVersionId, userId)
 
     await prisma.pageVersion.delete({

package/src/server/serverFns/design/pages.ts

@@ -16,24 +16,23 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import { Prisma } from '@allbluecn/database'
-import { getServerSeam } from '@allbluecn/kernel'
 import { buildRoomName } from '@allbluecn/collab-core/rooms'
 import { withCollabGuard } from '@/server/collab/write-guard'
-import { assertDesignOwner, assertPageOwner, sessionUserId } from '@/server/design/access'
+import { assertDesignOwner, assertPageOwner } from '@/server/design/access'
 
 export const listDesignPagesFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({
     designId: z.string(),
     take: z.number().int().min(1).max(200).default(50),
   }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     await assertDesignOwner(data.designId, userId)
     return prisma.designPage.findMany({
       where: { designId: data.designId },
@@ -44,16 +43,16 @@ export const listDesignPagesFn = createServerFn({ method: 'GET' })
   })
 
 export const createDesignPageFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({
     designId: z.string(),
     name: z.string().optional(),
     type: z.string(),
     parentId: z.string().nullable().optional(),
   }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     await assertDesignOwner(data.designId, userId)
     const maxOrder = await prisma.designPage.aggregate({
       where: { designId: data.designId, parentId: data.parentId ?? null },
@@ -87,6 +86,7 @@ export const createDesignPageFn = createServerFn({ method: 'POST' })
   })
 
 export const updateDesignPageFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({
     pageId: z.string(),
     name: z.string().optional(),
@@ -95,10 +95,9 @@ export const updateDesignPageFn = createServerFn({ method: 'POST' })
     canvas: z.any().optional(),
     content: z.any().optional(),
   }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     // §5.3 写入门卫（任务 29）：Y 属主面 = canvas（整场景 replace 语义）+
     // content（文档 fragment 面）。快照存在 → 转发 collab 内部通道（活跃判定
     // 在 collab 侧）；无快照 pass-through、不可达 TTL 降级 → 照旧直写（非协同
@@ -168,11 +167,11 @@ export const updateDesignPageFn = createServerFn({ method: 'POST' })
   })
 
 export const deleteDesignPageFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ pageId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     await assertPageOwner(data.pageId, userId)
     await prisma.$transaction(async (tx) => {
       const descendants = await tx.$queryRaw<Array<{ id: string }>>`
@@ -197,11 +196,11 @@ export const deleteDesignPageFn = createServerFn({ method: 'POST' })
   })
 
 export const getDesignPageFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ pageId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     // DB-03：属主校验（经 design.userId 关系过滤）与读取合并为单查询
     const page = await prisma.designPage.findFirst({
       where: { id: data.pageId, design: { userId } },

package/src/server/serverFns/design/reviews.ts

@@ -16,11 +16,10 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
-import { getServerSeam } from '@allbluecn/kernel'
-import { assertDesignReadable, sessionUserId } from '@/server/design/access'
+import { assertDesignReadable } from '@/server/design/access'
 
 const upsertReviewSchema = z.object({
   designId: z.string(),
@@ -30,11 +29,11 @@ const upsertReviewSchema = z.object({
 })
 
 export const upsertReviewFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(upsertReviewSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     // 审批由分享页评审面板发起（ShareReviewPanel）：属主与通过门禁的分享访客（需登录）皆可评审，
     // 不能收成属主专用；versionId 必须属于同一 design，否则可借他人 versionId 污染审批记录
     await assertDesignReadable(data.designId, userId)
@@ -83,11 +82,11 @@ const getReviewSchema = z.object({
 })
 
 export const getReviewFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(getReviewSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     await assertDesignReadable(data.designId, userId)
 
     const review = await prisma.review.findFirst({

package/src/server/serverFns/design/shares-password.ts

@@ -16,25 +16,22 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import type { Prisma } from '@allbluecn/database'
-import { getServerSeam } from '@allbluecn/kernel'
 import { notifyClients } from '@/lib/share-events'
 import { verifyDesignOwner } from '@allbluecn/database/lib/share-utils'
-import { sessionUserId } from '@/server/design/access'
 import { generateSharePassword, hashSharePassword } from '@/server/design/share-generate'
 
 export const setDesignSharePasswordFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ designId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     const { designId } = data
 
-    if (!(await verifyDesignOwner(designId, sessionUserId(session)))) {
+    if (!(await verifyDesignOwner(designId, context.user.id))) {
       throw new Error("无权限")
     }
 
@@ -65,14 +62,13 @@ export const setDesignSharePasswordFn = createServerFn({ method: 'POST' })
 // 关闭密码仅置 hasPassword=false、password 列保留旧值（重开沿用旧密码）——
 // 有意设计：shareGatePassed 以 hasPassword 为权威开关（见 @/server/design/share-access）
 export const toggleDesignSharePasswordFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ designId: z.string(), enabled: z.boolean() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     const { designId, enabled } = data
 
-    if (!(await verifyDesignOwner(designId, sessionUserId(session)))) {
+    if (!(await verifyDesignOwner(designId, context.user.id))) {
       throw new Error("无权限")
     }
 
@@ -110,11 +106,10 @@ export const toggleDesignSharePasswordFn = createServerFn({ method: 'POST' })
   })
 
 export const setDesignSingleSharePasswordFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ shareId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     const { shareId } = data
 
     const share = await prisma.share.findUnique({
@@ -126,7 +121,7 @@ export const setDesignSingleSharePasswordFn = createServerFn({ method: 'POST' })
       throw new Error("Share not found")
     }
     // IDOR 封堵：share 行本身不携带属主，经关联 design 校验当前用户
-    if (!(await verifyDesignOwner(share.designId, sessionUserId(session)))) {
+    if (!(await verifyDesignOwner(share.designId, context.user.id))) {
       throw new Error("无权限")
     }
 
@@ -156,11 +151,10 @@ export const setDesignSingleSharePasswordFn = createServerFn({ method: 'POST' })
   })
 
 export const toggleDesignSingleSharePasswordFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ shareId: z.string(), enabled: z.boolean() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     const { shareId, enabled } = data
 
     const share = await prisma.share.findUnique({
@@ -172,7 +166,7 @@ export const toggleDesignSingleSharePasswordFn = createServerFn({ method: 'POST'
       throw new Error("Share not found")
     }
     // IDOR 封堵：share 行本身不携带属主，经关联 design 校验当前用户
-    if (!(await verifyDesignOwner(share.designId, sessionUserId(session)))) {
+    if (!(await verifyDesignOwner(share.designId, context.user.id))) {
       throw new Error("无权限")
     }
 

package/src/server/serverFns/design/shares.ts

@@ -16,24 +16,21 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import type { Prisma } from '@allbluecn/database'
-import { getServerSeam } from '@allbluecn/kernel'
 import { notifyClients } from '@/lib/share-events'
 import { verifyDesignOwner } from '@allbluecn/database/lib/share-utils'
-import { sessionUserId } from '@/server/design/access'
 import { EXPIRY_DAYS, generateSharePassword, generateShareToken, hashSharePassword } from '@/server/design/share-generate'
 
 export const listDesignSharesFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ designId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
 
-    if (!(await verifyDesignOwner(data.designId, sessionUserId(session)))) {
+    if (!(await verifyDesignOwner(data.designId, context.user.id))) {
       throw new Error("无权限")
     }
 
@@ -51,6 +48,7 @@ export const listDesignSharesFn = createServerFn({ method: 'GET' })
   })
 
 export const createDesignShareFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({
     designId: z.string(),
     enabled: z.boolean().optional(),
@@ -58,13 +56,11 @@ export const createDesignShareFn = createServerFn({ method: 'POST' })
     versionIds: z.array(z.string()).optional(),
     expiryDays: z.string().optional(),
   }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     const { designId, enabled, password, versionIds, expiryDays } = data
 
-    if (!(await verifyDesignOwner(designId, sessionUserId(session)))) {
+    if (!(await verifyDesignOwner(designId, context.user.id))) {
       throw new Error("无权限")
     }
 
@@ -147,18 +143,17 @@ export const createDesignShareFn = createServerFn({ method: 'POST' })
   })
 
 export const listDesignSingleSharesFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({
     designId: z.string(),
     page: z.number().int().min(1).default(1),
     pageSize: z.number().int().min(1).max(200).default(50),
   }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     const { designId, page, pageSize } = data
 
-    if (!(await verifyDesignOwner(designId, sessionUserId(session)))) {
+    if (!(await verifyDesignOwner(designId, context.user.id))) {
       throw new Error("无权限")
     }
 
@@ -199,19 +194,18 @@ export const listDesignSingleSharesFn = createServerFn({ method: 'GET' })
   })
 
 export const createDesignSingleShareFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({
     designId: z.string(),
     versionId: z.string(),
     password: z.string().max(128).optional().nullable(),
     expiryDays: z.string().optional(),
   }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     const { designId, versionId, password, expiryDays } = data
 
-    if (!(await verifyDesignOwner(designId, sessionUserId(session)))) {
+    if (!(await verifyDesignOwner(designId, context.user.id))) {
       throw new Error("无权限")
     }
 
@@ -254,11 +248,10 @@ export const createDesignSingleShareFn = createServerFn({ method: 'POST' })
   })
 
 export const getDesignSingleShareFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ shareId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     const share = await prisma.share.findUnique({
       where: { id: data.shareId },
     })
@@ -266,7 +259,7 @@ export const getDesignSingleShareFn = createServerFn({ method: 'GET' })
       throw new Error("Share not found")
     }
     // IDOR 封堵：share 行本身不携带属主，经关联 design 校验当前用户
-    if (!(await verifyDesignOwner(share.designId, sessionUserId(session)))) {
+    if (!(await verifyDesignOwner(share.designId, context.user.id))) {
       throw new Error("无权限")
     }
     // 密码哈希化后不回传（见 getDesignShareFn 注）
@@ -274,15 +267,14 @@ export const getDesignSingleShareFn = createServerFn({ method: 'GET' })
   })
 
 export const updateDesignSingleShareFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({
     shareId: z.string(),
     enabled: z.boolean().optional(),
     expiryDays: z.string().optional(),
   }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     const { shareId, enabled, expiryDays } = data
 
     const share = await prisma.share.findUnique({
@@ -294,7 +286,7 @@ export const updateDesignSingleShareFn = createServerFn({ method: 'POST' })
       throw new Error("Share not found")
     }
     // IDOR 封堵：share 行本身不携带属主，经关联 design 校验当前用户
-    if (!(await verifyDesignOwner(share.designId, sessionUserId(session)))) {
+    if (!(await verifyDesignOwner(share.designId, context.user.id))) {
       throw new Error("无权限")
     }
 
@@ -340,11 +332,10 @@ export const updateDesignSingleShareFn = createServerFn({ method: 'POST' })
   })
 
 export const deleteDesignSingleShareFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ shareId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
     const { shareId } = data
 
     const share = await prisma.share.findUnique({
@@ -356,7 +347,7 @@ export const deleteDesignSingleShareFn = createServerFn({ method: 'POST' })
       throw new Error("Share not found")
     }
     // IDOR 封堵：share 行本身不携带属主，经关联 design 校验当前用户
-    if (!(await verifyDesignOwner(share.designId, sessionUserId(session)))) {
+    if (!(await verifyDesignOwner(share.designId, context.user.id))) {
       throw new Error("无权限")
     }
 

package/src/server/serverFns/design/versions.ts

@@ -16,22 +16,21 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
-import { getServerSeam } from '@allbluecn/kernel'
-import { assertDesignOwner, sessionUserId } from '@/server/design/access'
+import { assertDesignOwner } from '@/server/design/access'
 import { sortSnapshotsByTree, type DesignPage } from '@/lib/design-tree-utils'
 
 export const listDesignVersionsFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({
     designId: z.string(),
     take: z.number().int().min(1).max(200).default(50),
   }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     await assertDesignOwner(data.designId, userId)
 
     const versions = await prisma.designVersion.findMany({
@@ -66,6 +65,7 @@ export const listDesignVersionsFn = createServerFn({ method: 'GET' })
 // 调用方（页面还原走 executeRestoreVersion → updateDesignPageFn + createDesignPageVersionFn），
 // 且允许以自传 JSON 覆盖任意 pageId 的 canvas/content（审计 2026-10-25 🔴），整段移除。
 export const createDesignVersionFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({
     designId: z.string(),
     major: z.number().int().min(0),
@@ -75,10 +75,9 @@ export const createDesignVersionFn = createServerFn({ method: 'POST' })
     pageIds: z.array(z.string()),
     selectedPageVersions: z.record(z.string(), z.number().int()).optional(),
   }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const userId = context.user.id
     const { designId, major, minor, patch, notes, pageIds, selectedPageVersions } = data
     await assertDesignOwner(designId, userId)