@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/harness/__tests__/media-prototype.spec.ts

@@ -1,5 +1,4 @@
 import { beforeEach, expect, it, vi } from "vitest"
-import type { ZodType } from "zod"
 const mocks = vi.hoisted(() => ({
   request: new Request("https://allblue.test/media"),
   auth: vi.fn(),
@@ -11,11 +10,56 @@ const mocks = vi.hoisted(() => ({
   rateLimit: vi.fn(),
 }))
 vi.mock("@tanstack/react-start", () => ({
-  createServerFn: () => ({
-    validator: (schema: ZodType) => ({
-      handler: (fn: (args: { data: unknown }) => unknown) => async (args: { data: unknown }) => fn({ data: schema.parse(args.data) }),
-    }),
-  }),
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
+    const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
+      validator(schema: any) {
+        api._validator = schema
+        return api
+      },
+      handler(fn: any) {
+        return async (args: { data: unknown }) => {
+          let data = args?.data
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data
+          }
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
+        }
+      },
+    }
+    return api
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
 }))
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => mocks.request }))
 vi.mock("@/server/auth-helpers", () => ({ requireAuth: mocks.auth }))

package/src/server/serverFns/harness/__tests__/media.spec.ts

@@ -1,7 +1,57 @@
 import { beforeEach, expect, it, vi } from "vitest"
-import type { ZodType } from "zod"
 const mocks = vi.hoisted(() => ({ request: new Request("https://allblue.test/media"), auth: vi.fn(), feature: vi.fn(), resource: vi.fn(), config: vi.fn(), generate: vi.fn(), thread: vi.fn(), rateLimit: vi.fn() }))
-vi.mock("@tanstack/react-start", () => ({ createServerFn: () => ({ validator: (schema: ZodType) => ({ handler: (fn: (args: { data: unknown }) => unknown) => async (args: { data: unknown }) => fn({ data: schema.parse(args.data) }) }) }) }))
+vi.mock("@tanstack/react-start", () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
+    const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
+      validator(schema: any) {
+        api._validator = schema
+        return api
+      },
+      handler(fn: any) {
+        return async (args: { data: unknown }) => {
+          let data = args?.data
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data
+          }
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
+        }
+      },
+    }
+    return api
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
+}))
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => mocks.request }))
 vi.mock("@/server/auth-helpers", () => ({ requireAuth: mocks.auth }))
 vi.mock("@/server/entitlements", () => ({ requireFeature: mocks.feature }))
@@ -9,19 +59,17 @@ vi.mock("@/server/resources", () => ({ requireResource: mocks.resource }))
 vi.mock("@/server/ai-gateway/adapter", () => ({ resolveAiConfig: mocks.config }))
 vi.mock("@/server/lib/rate-limit", () => ({ checkAiRateLimit: mocks.rateLimit }))
 vi.mock("@allbluecn/database", () => ({ prisma: { chatThread: { findFirst: mocks.thread } } }))
-vi.mock("@/server/ai-gateway/media", () => ({ generateImageForUser: mocks.generate, generateVideoForUser: mocks.generate, pollVideoForUser: mocks.generate, generateSpeechForUser: mocks.generate, generateTranscriptionForUser: mocks.generate }))
-import { generateImageFn, startVideoFn, pollVideoFn, generateSpeechFn, generateTranscriptionFn } from "../media"
+vi.mock("@/server/ai-gateway/media", () => ({ generateImageForUser: mocks.generate, generateSpeechForUser: mocks.generate, generateTranscriptionForUser: mocks.generate }))
+import { generateImageFn, generateSpeechFn, generateTranscriptionFn } from "../media"
 beforeEach(() => {
   vi.resetAllMocks()
   mocks.auth.mockResolvedValue({ user: { id: "owner" } })
   mocks.thread.mockResolvedValue({ id: "thread" })
   mocks.config.mockResolvedValue({ provider: "openai", apiKey: "test", model: "gpt-image-1" })
-  mocks.generate.mockResolvedValue({ runId: "run", images: [], artifacts: [], jobId: "job", text: "text" })
+  mocks.generate.mockResolvedValue({ runId: "run", images: [], artifacts: [], text: "text" })
 })
 const calls = [
   () => generateImageFn({ data: { prompt: "paint", threadId: "thread" } }),
-  () => startVideoFn({ data: { prompt: "film", threadId: "thread" } }),
-  () => pollVideoFn({ data: { jobId: "job", threadId: "thread" } }),
   () => generateSpeechFn({ data: { text: "speak", threadId: "thread" } }),
   () => generateTranscriptionFn({ data: { audio: "YQ==", threadId: "thread" } }),
 ]
@@ -35,10 +83,6 @@ it.each(calls.map((call, index) => ({ call, index })))("rejects foreign thread f
   await expect(call()).rejects.toThrow("Thread not found")
   expect(mocks.generate).not.toHaveBeenCalled()
 })
-it("does not charge generation quota again when polling", async () => {
-  await calls[2]()
-  expect(mocks.resource).not.toHaveBeenCalled()
-})
 it("media 生成端点按 userId 走 per-minute 限流（P3）", async () => {
   await calls[0]()
   expect(mocks.rateLimit).toHaveBeenCalledWith("owner", "mediaImage")

package/src/server/serverFns/harness/__tests__/sandbox-policy.test.ts

@@ -7,31 +7,56 @@
 import { beforeEach, describe, expect, it, vi } from "vitest"
 
 vi.mock("@tanstack/react-start", () => ({
-  createServerFn: (_config: unknown) => {
-    const api: {
-      _validator?: { parse: (input: unknown) => unknown }
-      validator: (schema: unknown) => typeof api
-      handler: (fn: (args: { data: unknown }) => Promise<unknown>) => (
-        args: { data: unknown },
-      ) => Promise<unknown>
-    } = {
-      _validator: undefined,
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
+    const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
       validator(schema: any) {
-        this._validator = schema
-        return this
+        api._validator = schema
+        return api
       },
       handler(fn: any) {
         return async (args: { data: unknown }) => {
           let data = args?.data
-          if (this._validator && data !== undefined) {
-            data = this._validator.parse(data)
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data
+          }
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
           }
-          return fn({ data })
+          return fn({ data, context })
         }
       },
     }
     return api
   },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
 }))
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }))
 
@@ -96,7 +121,7 @@ describe("getSandboxPolicyFn", () => {
 
   it("未登录拒绝", async () => {
     mocks.getCurrentSession.mockResolvedValue(null)
-    await expect(getSandboxPolicyFn({ data: { threadId: "t-1" } })).rejects.toThrow("Unauthorized")
+    await expect(getSandboxPolicyFn({ data: { threadId: "t-1" } })).rejects.toThrow("UNAUTHORIZED")
   })
 
   it("线程不存在时拒绝且不泄露归属信息", async () => {
@@ -193,7 +218,7 @@ describe("setSandboxPolicyFn", () => {
     mocks.getCurrentSession.mockResolvedValue(null)
     await expect(
       setSandboxPolicyFn({ data: { threadId: "t-1", level: "full", confirmFull: true } }),
-    ).rejects.toThrow("Unauthorized")
+    ).rejects.toThrow("UNAUTHORIZED")
     expect(mocks.update).not.toHaveBeenCalled()
   })
 })

package/src/server/serverFns/harness/__tests__/workspace-files.test.ts

@@ -7,31 +7,56 @@
 import { beforeEach, describe, expect, it, vi } from "vitest"
 
 vi.mock("@tanstack/react-start", () => ({
-  createServerFn: (_config: unknown) => {
-    const api: {
-      _validator?: { parse: (input: unknown) => unknown }
-      validator: (schema: unknown) => typeof api
-      handler: (fn: (args: { data: unknown }) => Promise<unknown>) => (
-        args: { data: unknown },
-      ) => Promise<unknown>
-    } = {
-      _validator: undefined,
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
+    const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
       validator(schema: any) {
-        this._validator = schema
-        return this
+        api._validator = schema
+        return api
       },
       handler(fn: any) {
         return async (args: { data: unknown }) => {
           let data = args?.data
-          if (this._validator && data !== undefined) {
-            data = this._validator.parse(data)
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data
+          }
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
           }
-          return fn({ data })
+          return fn({ data, context })
         }
       },
     }
     return api
   },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
 }))
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }))
 
@@ -104,7 +129,7 @@ describe("createHarnessWorkspaceFn", () => {
     mocks.getCurrentSession.mockResolvedValue(null)
     await expect(
       createHarnessWorkspaceFn({ data: { name: "my-workspace" } }),
-    ).rejects.toThrow("Unauthorized")
+    ).rejects.toThrow("UNAUTHORIZED")
     expect(mocks.harnessWorkspaceCreate).not.toHaveBeenCalled()
   })
 
@@ -122,7 +147,7 @@ describe("createHarnessWorkspaceFn", () => {
 describe("listHarnessWorkspacesFn", () => {
   it("未登录拒绝", async () => {
     mocks.getCurrentSession.mockResolvedValue(null)
-    await expect(listHarnessWorkspacesFn({ data: undefined })).rejects.toThrow("Unauthorized")
+    await expect(listHarnessWorkspacesFn({ data: undefined })).rejects.toThrow("UNAUTHORIZED")
     expect(mocks.harnessWorkspaceFindMany).not.toHaveBeenCalled()
   })
 

package/src/server/serverFns/harness/attach-prototype.ts

@@ -3,11 +3,11 @@
 // Copyright (C) 2026 AllBlue Contributors
 
 import { createServerFn } from "@tanstack/react-start"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import type { Prisma } from "@allbluecn/database"
-import { requireAuth } from "@/server/auth-helpers"
 import { requireFeature } from "@/server/entitlements"
 import { assertRunOwnership, assertDesignOwnership } from "@/server/harness/attach-guards"
 import { sceneDocumentSchema } from "@/design-engine/ai/ai"
@@ -25,13 +25,13 @@ const AttachPrototypeToDesignSchema = z.object({
 })
 
 export const attachPrototypeToDesignFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(AttachPrototypeToDesignSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
     const request = getRequest()
     await requireFeature(request, "mediaGeneration")
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
 
     const run = await assertRunOwnership(data.generationRunId, userId)
     await assertDesignOwnership(data.designId, userId)

package/src/server/serverFns/harness/attach-to-kb.ts

@@ -3,10 +3,10 @@
 // Copyright (C) 2026 AllBlue Contributors
 
 import { createServerFn } from "@tanstack/react-start"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
 import { getPrisma } from "@allbluecn/database/get-prisma"
-import { requireAuth } from "@/server/auth-helpers"
 import { requireFeature } from "@/server/entitlements"
 import { indexDocumentById } from "@/server/ai-gateway/knowledge-index-core"
 import { assertKbOwnership, assertRunOwnership } from "@/server/harness/attach-guards"
@@ -35,13 +35,13 @@ function extractText(result: unknown): string | undefined {
 }
 
 export const attachToKbFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(AttachToKbSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
     const request = getRequest()
     await requireFeature(request, "mediaGeneration")
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
 
     const run = await assertRunOwnership(data.generationRunId, userId)
     await assertKbOwnership(data.kbId, userId)

package/src/server/serverFns/harness/attach-to-story.ts

@@ -3,10 +3,10 @@
 // Copyright (C) 2026 AllBlue Contributors
 
 import { createServerFn } from "@tanstack/react-start"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
 import { getPrisma } from "@allbluecn/database/get-prisma"
-import { requireAuth } from "@/server/auth-helpers"
 import { requireFeature } from "@/server/entitlements"
 import { assertFetchableUrl } from "@/server/fetch-guard"
 import { assertRunOwnership, assertStoryOwnership } from "@/server/harness/attach-guards"
@@ -27,13 +27,13 @@ const AttachToStorySchema = z.object({
 const MAX_ARTIFACT_BYTES = 10 * 1024 * 1024
 
 export const attachToStoryFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(AttachToStorySchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
     const request = getRequest()
     await requireFeature(request, "mediaGeneration")
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
 
     const run = await assertRunOwnership(data.generationRunId, userId)
     await assertStoryOwnership(data.storyId, userId)

package/src/server/serverFns/harness/cancel-run.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { z } from "zod"
-import { getCurrentSession } from "@/lib/session"
 import { chatRunStore } from "@/server/ai-gateway/persistence/run-store"
 
 const cancelRunInput = z.object({
@@ -52,12 +51,11 @@ const cancelRunInput = z.object({
  * provider 侧空闲回收——reaper 存在的全部意义就在这一步。
  */
 export const cancelRunFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(cancelRunInput)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const session = await getCurrentSession(getRequest())
-    if (!session?.user?.id) throw new Error("Unauthorized")
-    const userId = session.user.id
+    const userId = context.user.id
 
     const active = await prisma.chatRun.findFirst({
       where: {

package/src/server/serverFns/harness/extract-attachment.ts

@@ -16,9 +16,8 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { z } from "zod"
-import { requireAuth } from "@/server/auth-helpers"
 
 const extractAttachmentSchema = z.object({
   text: z.string().min(1),
@@ -35,11 +34,11 @@ const EXTRACT_PREVIEW_MAX_CHARS = 500
  * 此处返回 stub 以保证调用方接口一致。
  */
 export const extractAttachmentFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(extractAttachmentSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     // serverFn 首行自查鉴权（审计 2026-10-25 🟠）：当前虽为 echo 型 stub 无数据访问面，
     // 但 TODO 接入真实解析管线后若延续无鉴权即成未鉴权入口，先补齐约定
-    await requireAuth(getRequest())
     // TODO: 接入真实解析管线（如 mammoth、pdf-parse、markdown-it）
     return {
       extracted: data.text.slice(0, EXTRACT_PREVIEW_MAX_CHARS),

package/src/server/serverFns/harness/gallery.ts

@@ -16,12 +16,13 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from "@tanstack/react-start"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { getRequest } from "@tanstack/react-start/server"
-import { generateImageForUser, generateVideoForUser, generateSpeechForUser } from "@/server/ai-gateway/media"
+import { generateImageForUser, generateSpeechForUser } from "@/server/ai-gateway/media"
+import { trimGenerationRunInput } from "@/server/ai-gateway/media/trim-input"
 import { resolveAiConfigForModel } from "@/server/ai-gateway/provider-router"
 import { z } from "zod"
 import { getPrisma } from "@allbluecn/database/get-prisma"
-import { requireAuth } from "@/server/auth-helpers"
 import { requireFeature } from "@/server/entitlements"
 import { requireResource } from "@/server/resources"
 
@@ -54,8 +55,9 @@ function parseLinkedTarget(value: unknown): z.infer<typeof LinkedTargetSchema> |
 }
 
 export const listGenerationRunsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(ListGenerationRunsSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
     const request = getRequest()
     // 读取操作降级：OSS 部署（功能未授予）静默返回空列表，避免 UI 抛错
@@ -64,12 +66,10 @@ export const listGenerationRunsFn = createServerFn({ method: "GET" })
     } catch {
       return { runs: [], nextCursor: null }
     }
-
-    const session = await requireAuth(request)
-    if (!session?.user?.id) {
+    if (!context.user.id) {
       return { runs: [], nextCursor: null }
     }
-    const userId = session.user.id
+    const userId = context.user.id
 
     const where = {
       userId,
@@ -102,6 +102,11 @@ export const listGenerationRunsFn = createServerFn({ method: "GET" })
         model: true,
         artifacts: true,
         result: true,
+        // 视频再创作接流式进度（/api/generate/media）后，源 prompt 由客户端
+        // 从 input.prompt 读取并随流式请求重发（旧 createVariantFn 提交面不再消费）。
+        // 出口经 trimGenerationRunInput 裁剪：剔除 data URL/媒体分片/referenceImage，
+        // 防止 24 条/页把 base64 参考帧全量下发
+        input: true,
         usage: true,
         startedAt: true,
         threadId: true,
@@ -125,6 +130,7 @@ export const listGenerationRunsFn = createServerFn({ method: "GET" })
         model: run.model ?? undefined,
         artifacts: run.artifacts as never,
         result: run.result,
+        input: run.input ? trimGenerationRunInput(run.input) : undefined,
         usage: run.usage as never,
         startedAt: run.startedAt,
         threadId: run.threadId,
@@ -143,25 +149,21 @@ export const listGenerationRunsFn = createServerFn({ method: "GET" })
 const CreateVariantSchema = z.object({
   sourceRunId: z.string().min(1),
   prompt: z.string().trim().min(1).optional(),
-  // referenceImage 为用户可控 URL，服务端会在媒体管线（imageDataUrl）本地 fetch——
-  // SSRF 守卫在下游统一接线（assertFetchableUrl + redirect:error + 超时），本层不重复
-  referenceImage: z.string().min(1).optional(),
   threadId: z.string().min(1),
 })
 
 export const createVariantFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(CreateVariantSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
     const request = getRequest()
     await requireFeature(request, "mediaGeneration")
     await requireResource(request, "mediaGenerationsMonthly")
-
-    const session = await requireAuth(request)
-    if (!session?.user?.id) {
+    if (!context.user.id) {
       return { error: "Unauthorized" }
     }
-    const userId = session.user.id
+    const userId = context.user.id
 
     const sourceRun = await prisma.generationRun.findFirst({
       where: { id: data.sourceRunId, userId, thread: { userId } },
@@ -171,7 +173,8 @@ export const createVariantFn = createServerFn({ method: "POST" })
     const activity = sourceRun.activity ?? sourceRun.kind
     if (sourceRun.status !== "completed") throw new Error("Source run must be completed")
     if (activity === "prototype") throw new Error("Prototype runs cannot be regenerated as variants")
-    if (!["image", "video", "speech", "tts"].includes(activity)) {
+    // video 再创作已改走 /api/generate/media 流式进度（任务 15），不再提供非流式提交面
+    if (!["image", "speech", "tts"].includes(activity)) {
       throw new Error("Source run kind does not support variants")
     }
     const thread = await prisma.chatThread.findFirst({
@@ -186,13 +189,6 @@ export const createVariantFn = createServerFn({ method: "POST" })
       apiKey: config.apiKey, model: config.model,
       ...(config.baseUrl ? { baseURL: config.baseUrl } : {}),
     }
-    if (activity === "video") {
-      const input = z.object({ prompt: z.string().optional() }).safeParse(sourceRun.input ?? {})
-      const prompt = data.prompt ?? (input.success ? input.data.prompt : undefined)
-      if (!prompt?.trim()) throw new Error("A prompt is required")
-      const result = await generateVideoForUser({ userId, threadId: data.threadId, prompt, referenceImage: data.referenceImage, ...commonConfig })
-      return { runId: result.runId, jobId: result.jobId, model: result.model, artifacts: result.artifacts ?? [] }
-    }
     if (activity === "tts") {
       const input = z.object({ text: z.string().optional() }).safeParse(sourceRun.input ?? {})
       const text = (input.success ? input.data.text : undefined) ?? data.prompt