@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/harness/__tests__/attach-prototype.spec.ts

@@ -1,5 +1,4 @@
 import { beforeEach, expect, it, vi } from "vitest"
-import type { ZodType } from "zod"
 
 const mocks = vi.hoisted(() => ({
   request: new Request("https://allblue.test/attach-prd"),
@@ -11,7 +10,58 @@ const mocks = vi.hoisted(() => ({
   pageUpdate: vi.fn(),
   runUpdate: vi.fn(),
 }))
-vi.mock("@tanstack/react-start", () => ({ createServerFn: () => ({ validator: (schema: ZodType) => ({ handler: (fn: (args: { data: unknown }) => unknown) => async (args: { data: unknown }) => fn({ data: schema.parse(args.data) }) }) }) }))
+vi.mock("@tanstack/react-start", () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
+    const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
+      validator(schema: any) {
+        api._validator = schema
+        return api
+      },
+      handler(fn: any) {
+        return async (args: { data: unknown }) => {
+          let data = args?.data
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data
+          }
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
+        }
+      },
+    }
+    return api
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
+}))
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => mocks.request }))
 vi.mock("@/server/auth-helpers", () => ({ requireAuth: mocks.auth }))
 vi.mock("@/server/entitlements", () => ({ requireFeature: mocks.feature }))

package/src/server/serverFns/harness/__tests__/attach-to-kb.spec.ts

@@ -1,5 +1,4 @@
 import { beforeEach, expect, it, vi } from "vitest"
-import type { ZodType } from "zod"
 
 const mocks = vi.hoisted(() => ({
   request: new Request("https://allblue.test/attach-kb"),
@@ -12,7 +11,58 @@ const mocks = vi.hoisted(() => ({
   runUpdate: vi.fn(),
   indexDoc: vi.fn(),
 }))
-vi.mock("@tanstack/react-start", () => ({ createServerFn: () => ({ validator: (schema: ZodType) => ({ handler: (fn: (args: { data: unknown }) => unknown) => async (args: { data: unknown }) => fn({ data: schema.parse(args.data) }) }) }) }))
+vi.mock("@tanstack/react-start", () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
+    const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
+      validator(schema: any) {
+        api._validator = schema
+        return api
+      },
+      handler(fn: any) {
+        return async (args: { data: unknown }) => {
+          let data = args?.data
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data
+          }
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
+        }
+      },
+    }
+    return api
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
+}))
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => mocks.request }))
 vi.mock("@/server/auth-helpers", () => ({ requireAuth: mocks.auth }))
 vi.mock("@/server/entitlements", () => ({ requireFeature: mocks.feature }))

package/src/server/serverFns/harness/__tests__/attach-to-story-ssrf.spec.ts

@@ -7,7 +7,6 @@
 // 用真实 assertFetchableUrl 验证私网/mapped artifact URL 在入口被拒、
 // 公网 URL 以 redirect:error 发起（防 302 跳私网）。
 import { beforeEach, expect, it, vi } from "vitest"
-import type { ZodType } from "zod"
 
 const mocks = vi.hoisted(() => ({
   request: new Request("https://allblue.test/attach-story"),
@@ -20,7 +19,58 @@ const mocks = vi.hoisted(() => ({
   runUpdate: vi.fn(),
   fetchMock: vi.fn(),
 }))
-vi.mock("@tanstack/react-start", () => ({ createServerFn: () => ({ validator: (schema: ZodType) => ({ handler: (fn: (args: { data: unknown }) => unknown) => async (args: { data: unknown }) => fn({ data: schema.parse(args.data) }) }) }) }))
+vi.mock("@tanstack/react-start", () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
+    const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
+      validator(schema: any) {
+        api._validator = schema
+        return api
+      },
+      handler(fn: any) {
+        return async (args: { data: unknown }) => {
+          let data = args?.data
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data
+          }
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
+        }
+      },
+    }
+    return api
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
+}))
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => mocks.request }))
 vi.mock("@/server/auth-helpers", () => ({ requireAuth: mocks.auth }))
 vi.mock("@/server/entitlements", () => ({ requireFeature: mocks.feature }))

package/src/server/serverFns/harness/__tests__/attach-to-story.spec.ts

@@ -1,5 +1,4 @@
 import { beforeEach, expect, it, vi } from "vitest"
-import type { ZodType } from "zod"
 
 const mocks = vi.hoisted(() => ({
   request: new Request("https://allblue.test/attach-story"),
@@ -12,7 +11,58 @@ const mocks = vi.hoisted(() => ({
   runUpdate: vi.fn(),
   guardFetch: vi.fn(),
 }))
-vi.mock("@tanstack/react-start", () => ({ createServerFn: () => ({ validator: (schema: ZodType) => ({ handler: (fn: (args: { data: unknown }) => unknown) => async (args: { data: unknown }) => fn({ data: schema.parse(args.data) }) }) }) }))
+vi.mock("@tanstack/react-start", () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
+    const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
+      validator(schema: any) {
+        api._validator = schema
+        return api
+      },
+      handler(fn: any) {
+        return async (args: { data: unknown }) => {
+          let data = args?.data
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data
+          }
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
+        }
+      },
+    }
+    return api
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
+}))
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => mocks.request }))
 vi.mock("@/server/auth-helpers", () => ({ requireAuth: mocks.auth }))
 vi.mock("@/server/entitlements", () => ({ requireFeature: mocks.feature }))

package/src/server/serverFns/harness/__tests__/cancel-run.test.ts

@@ -7,31 +7,56 @@
 import { beforeEach, describe, expect, it, vi } from "vitest"
 
 vi.mock("@tanstack/react-start", () => ({
-  createServerFn: (_config: unknown) => {
-    const api: {
-      _validator?: { parse: (input: unknown) => unknown }
-      validator: (schema: unknown) => typeof api
-      handler: (fn: (args: { data: unknown }) => Promise<unknown>) => (
-        args: { data: unknown },
-      ) => Promise<unknown>
-    } = {
-      _validator: undefined,
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
+    const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
       validator(schema: any) {
-        this._validator = schema
-        return this
+        api._validator = schema
+        return api
       },
       handler(fn: any) {
         return async (args: { data: unknown }) => {
           let data = args?.data
-          if (this._validator && data !== undefined) {
-            data = this._validator.parse(data)
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data
+          }
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
           }
-          return fn({ data })
+          return fn({ data, context })
         }
       },
     }
     return api
   },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
 }))
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }))
 
@@ -70,7 +95,7 @@ describe("cancelRunFn", () => {
     mocks.getCurrentSession.mockResolvedValue(null)
     await expect(
       cancelRunFn({ data: { threadId: "t-1" } }),
-    ).rejects.toThrow("Unauthorized")
+    ).rejects.toThrow("UNAUTHORIZED")
     expect(mocks.findFirst).not.toHaveBeenCalled()
   })
 

package/src/server/serverFns/harness/__tests__/extract-attachment.spec.ts

@@ -8,13 +8,63 @@
  * 管线时延续无鉴权入口）。
  */
 import { beforeEach, describe, expect, it, vi } from "vitest"
-import type { ZodType } from "zod"
 
 const mocks = vi.hoisted(() => ({
   request: new Request("https://allblue.test/extract-attachment"),
   auth: vi.fn(),
 }))
-vi.mock("@tanstack/react-start", () => ({ createServerFn: () => ({ validator: (schema: ZodType) => ({ handler: (fn: (args: { data: unknown }) => unknown) => async (args: { data: unknown }) => fn({ data: schema.parse(args.data) }) }) }) }))
+vi.mock("@tanstack/react-start", () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
+    const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
+      validator(schema: any) {
+        api._validator = schema
+        return api
+      },
+      handler(fn: any) {
+        return async (args: { data: unknown }) => {
+          let data = args?.data
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data
+          }
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
+        }
+      },
+    }
+    return api
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
+}))
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => mocks.request }))
 vi.mock("@/server/auth-helpers", () => ({ requireAuth: mocks.auth }))
 

package/src/server/serverFns/harness/__tests__/gallery.spec.ts

@@ -1,15 +1,61 @@
 import { beforeEach, describe, expect, it, vi } from "vitest"
-import type { ZodType } from "zod"
 
 const mocks = vi.hoisted(() => ({
   request: new Request("https://allblue.test/gallery", { headers: { cookie: "session=test" } }),
   auth: vi.fn(), feature: vi.fn(), resource: vi.fn(), findMany: vi.fn(), findFirst: vi.fn(), thread: vi.fn(),
-  generate: vi.fn(), video: vi.fn(), speech: vi.fn(), config: vi.fn(),
+  generate: vi.fn(), speech: vi.fn(), config: vi.fn(),
 }))
 vi.mock("@tanstack/react-start", () => ({
-  createServerFn: () => ({ validator: (schema: ZodType) => ({
-    handler: (fn: (args: { data: unknown }) => unknown) => async (args: { data: unknown }) => fn({ data: schema.parse(args.data) }),
-  }) }),
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
+    const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
+      validator(schema: any) {
+        api._validator = schema
+        return api
+      },
+      handler(fn: any) {
+        return async (args: { data: unknown }) => {
+          let data = args?.data
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data
+          }
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
+        }
+      },
+    }
+    return api
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
 }))
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => mocks.request }))
 vi.mock("@allbluecn/database", () => ({ prisma: {
@@ -21,7 +67,6 @@ vi.mock("@/server/entitlements", () => ({ requireFeature: mocks.feature }))
 vi.mock("@/server/resources", () => ({ requireResource: mocks.resource }))
 vi.mock("@/server/ai-gateway/media", () => ({
   generateImageForUser: mocks.generate,
-  generateVideoForUser: mocks.video,
   generateSpeechForUser: mocks.speech,
 }))
 vi.mock("@/server/ai-gateway/provider-router", () => ({ resolveAiConfigForModel: mocks.config }))
@@ -70,6 +115,29 @@ describe("gallery", () => {
     expect(mocks.findMany.mock.calls[0][0].where.activity).toBe("tts")
     expect(page.runs[0].kind).toBe("speech")
   })
+  it("trims data URLs and media parts out of the list input payload (task 15 review ①)", async () => {
+    // 流式 run 的持久化 input：参考帧以 data URL 进 prompt 图片分片 + referenceImage 顶层键
+    const heavyInput = {
+      prompt: [
+        { type: "text", content: "电影感推镜" },
+        { type: "image", source: { type: "url", value: "data:image/png;base64,AAAA10MB" }, metadata: { role: "start_frame" } },
+      ],
+      referenceImage: "data:image/png;base64,BBBB16MB",
+      size: "720p",
+    }
+    mocks.findMany.mockResolvedValue([{ ...row("v"), activity: "video", input: heavyInput }])
+    const page = await listGenerationRunsFn({ data: {} })
+    const serialized = JSON.stringify(page.runs[0].input)
+    // 列表 payload 不含任何 data: 前缀（图片分片与 referenceImage 已剔除）
+    expect(serialized).not.toContain("data:")
+    // text 分片与轻量标量保留（getSourcePrompt 消费面）
+    expect(page.runs[0].input).toEqual({ prompt: [{ type: "text", content: "电影感推镜" }], size: "720p" })
+  })
+  it("keeps plain string input untouched in the list payload", async () => {
+    mocks.findMany.mockResolvedValue([{ ...row("i"), input: { prompt: "original", numberOfImages: 2 } }])
+    const page = await listGenerationRunsFn({ data: {} })
+    expect(page.runs[0].input).toEqual({ prompt: "original", numberOfImages: 2 })
+  })
   it("generates an image variant from the owned source image and saved prompt", async () => {
     const result = await createVariantFn({ data: { sourceRunId: "source", threadId: "thread-1" } })
     expect(mocks.findFirst.mock.calls[0][0].where).toMatchObject({ id: "source", userId: "user-1" })
@@ -77,13 +145,10 @@ describe("gallery", () => {
     expect(mocks.generate).toHaveBeenCalledWith(expect.objectContaining({ userId: "user-1", threadId: "thread-1", prompt: "original", referenceImage: "data:image/png;base64,aGVsbG8=", sourceRunId: "source" }))
     expect(result).toMatchObject({ runId: "new-run", images: [{ b64Json: "bmV3" }] })
   })
-  it("regenerates a video variant from the same prompt", async () => {
+  it("rejects video source as variant (video re-creation moved to the streaming route)", async () => {
     mocks.findFirst.mockResolvedValue({ ...row("source"), activity: "video", input: { prompt: "film again" } })
-    mocks.video.mockResolvedValue({ runId: "new-run", jobId: "video-job", model: "video-1", artifacts: [] })
-    const result = await createVariantFn({ data: { sourceRunId: "source", threadId: "thread-1" } })
-    expect(mocks.video).toHaveBeenCalledWith(expect.objectContaining({ prompt: "film again", threadId: "thread-1", userId: "user-1" }))
+    await expect(createVariantFn({ data: { sourceRunId: "source", threadId: "thread-1" } })).rejects.toThrow("does not support variants")
     expect(mocks.generate).not.toHaveBeenCalled()
-    expect(result).toMatchObject({ runId: "new-run", jobId: "video-job" })
   })
   it("regenerates a speech variant from the same text", async () => {
     mocks.findFirst.mockResolvedValue({ ...row("source"), activity: "tts", input: { text: "speak again" } })
@@ -91,7 +156,6 @@ describe("gallery", () => {
     const result = await createVariantFn({ data: { sourceRunId: "source", threadId: "thread-1" } })
     expect(mocks.speech).toHaveBeenCalledWith(expect.objectContaining({ text: "speak again", threadId: "thread-1", userId: "user-1" }))
     expect(mocks.generate).not.toHaveBeenCalled()
-    expect(mocks.video).not.toHaveBeenCalled()
     expect(result).toMatchObject({ runId: "new-run", id: "speech-1" })
   })
   it("rejects prototype source as variant", async () => {

package/src/server/serverFns/harness/__tests__/github-workspace.spec.ts

@@ -9,7 +9,6 @@
  * - GitHub API fetch 必带超时信号；网络异常 console.warn 后仍返回空数组（不抛）。
  */
 import { beforeEach, describe, expect, it, vi } from "vitest"
-import type { ZodType } from "zod"
 
 const mocks = vi.hoisted(() => ({
   request: new Request("https://allblue.test/github"),
@@ -17,23 +16,56 @@ const mocks = vi.hoisted(() => ({
   fetchMock: vi.fn(),
 }))
 vi.mock("@tanstack/react-start", () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
   createServerFn: () => {
-    // 链式可省略 validator（listGithubReposFn 无 validator），两段挂同一 api 对象
     const api: any = {
-      validator(schema: ZodType) {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
+      validator(schema: any) {
         api._validator = schema
         return api
       },
-      handler(fn: (args: { data: unknown }) => unknown) {
+      handler(fn: any) {
         return async (args: { data: unknown }) => {
           let data = args?.data
-          if (api._validator && data !== undefined) data = api._validator.parse(data)
-          return fn({ data })
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data
+          }
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
         }
       },
     }
     return api
   },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
 }))
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => mocks.request }))
 vi.mock("@/lib/session", () => ({ getCurrentSession: mocks.session }))