@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/harness/github-workspace.ts

@@ -17,6 +17,7 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
 import { getCurrentSession } from "@/lib/session"
@@ -72,13 +73,11 @@ export const getGithubConnectionFn = createServerFn({ method: "GET" })
   })
 
 export const listGithubReposFn = createServerFn({ method: "GET" })
-  .handler(async () => {
+  .middleware([authContextMiddleware])
+  .handler(async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getCurrentSession(request)
-    if (!session?.user?.id) throw new Error("Unauthorized")
 
-    const { token } = await resolveGithubToken(session.user.id)
+    const { token } = await resolveGithubToken(context.user.id)
 
     if (!token) return { repos: [] }
 
@@ -118,14 +117,12 @@ export const listGithubReposFn = createServerFn({ method: "GET" })
  * 获取指定仓库的分支列表。
  */
 export const listGithubBranchesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(githubRepoRefSchema)
-  .handler(async ({ data: { owner, repo } }) => {
+  .handler(async ({ data: { owner, repo }, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getCurrentSession(request)
-    if (!session?.user?.id) throw new Error("Unauthorized")
 
-    const userId = session.user.id
+    const userId = context.user.id
 
     const providerConfig = await prisma.aiProviderConfig.findFirst({
       where: { userId, providerId: "github" },
@@ -176,21 +173,19 @@ export const listGithubBranchesFn = createServerFn({ method: "GET" })
  * BYOK 优先策略：默认只存 session 级 Account，用户显式「保存到服务器」才落库加密。
  */
 export const saveGithubTokenFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   // max(255)：GitHub 各类 token 远短于此，超长即误填/滥用
   // （不做前缀白名单：OAuth App 存量 token 为 40 位十六进制无前缀，前缀校验会误杀）
   .validator(z.object({ token: z.string().min(1).max(255) }))
-  .handler(async ({ data: { token } }) => {
+  .handler(async ({ data: { token }, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getCurrentSession(request)
-    if (!session?.user?.id) throw new Error("Unauthorized")
 
     const encrypted = encryptApiKey(token)
     await prisma.aiProviderConfig.upsert({
-      where: { userId_providerId: { userId: session.user.id, providerId: "github" } },
+      where: { userId_providerId: { userId: context.user.id, providerId: "github" } },
       update: { apiKey: encrypted },
       create: {
-        userId: session.user.id,
+        userId: context.user.id,
         providerId: "github",
         apiKey: encrypted,
       },
@@ -203,14 +198,12 @@ export const saveGithubTokenFn = createServerFn({ method: "POST" })
  * 清除保存的 GitHub token。
  */
 export const clearGithubTokenFn = createServerFn({ method: "POST" })
-  .handler(async () => {
+  .middleware([authContextMiddleware])
+  .handler(async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await getCurrentSession(request)
-    if (!session?.user?.id) throw new Error("Unauthorized")
 
     await prisma.aiProviderConfig.deleteMany({
-      where: { providerId: "github", userId: session.user.id },
+      where: { providerId: "github", userId: context.user.id },
     })
 
     return { success: true }

package/src/server/serverFns/harness/media.ts

@@ -16,13 +16,13 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from "@tanstack/react-start"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { getRequest } from "@tanstack/react-start/server"
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { z } from "zod"
-import { generateImageForUser, generateVideoForUser, pollVideoForUser, generateSpeechForUser, generateTranscriptionForUser, generatePrototypeForUser } from "@/server/ai-gateway/media"
+import { generateImageForUser, generateSpeechForUser, generateTranscriptionForUser, generatePrototypeForUser } from "@/server/ai-gateway/media"
 import { resolveAiConfig } from "@/server/ai-gateway/adapter"
 import { checkAiRateLimit } from "@/server/lib/rate-limit"
-import { requireAuth } from "@/server/auth-helpers"
 import { requireFeature } from "@/server/entitlements"
 import { requireResource } from "@/server/resources"
 
@@ -43,18 +43,17 @@ const GenerateImageSchema = z.object({
 })
 
 export const generateImageFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(GenerateImageSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
     const request = getRequest()
     await requireFeature(request, "mediaGeneration")
     await requireResource(request, "mediaGenerationsMonthly")
-
-    const session = await requireAuth(request)
-    if (!session?.user?.id) {
+    if (!context.user.id) {
       return { error: "Unauthorized" }
     }
-    const userId = session.user.id
+    const userId = context.user.id
     await checkAiRateLimit(userId, "mediaImage")
     const thread = await prisma.chatThread.findFirst({
       where: { id: data.threadId, userId }, select: { id: true },
@@ -89,101 +88,6 @@ export const generateImageFn = createServerFn({ method: "POST" })
     }
   })
 
-const GenerateVideoSchema = z.object({
-  prompt: z.string().min(1),
-  duration: z.number().optional(),
-  size: z.string().optional(),
-  referenceImage: z.string().min(1).optional(),
-  threadId: z.string(),
-})
-
-export const startVideoFn = createServerFn({ method: "POST" })
-  .validator(GenerateVideoSchema)
-  .handler(async ({ data }) => {
-    const prisma = await getPrisma()
-    const request = getRequest()
-    await requireFeature(request, "mediaGeneration")
-    await requireResource(request, "mediaGenerationsMonthly")
-
-    const session = await requireAuth(request)
-    if (!session?.user?.id) {
-      return { error: "Unauthorized" }
-    }
-    const userId = session.user.id
-    await checkAiRateLimit(userId, "mediaVideo")
-    const thread = await prisma.chatThread.findFirst({
-      where: { id: data.threadId, userId }, select: { id: true },
-    })
-    if (!thread) throw new Error("Thread not found")
-
-    const aiConfig = await resolveAiConfig(userId)
-    if (!aiConfig) {
-      return { error: "AI key not configured" }
-    }
-
-    const result = await generateVideoForUser({
-      userId,
-      threadId: data.threadId,
-      prompt: data.prompt,
-      duration: data.duration,
-      size: data.size,
-      referenceImage: data.referenceImage,
-      adapterKind: aiConfig.provider,
-      apiKey: aiConfig.apiKey,
-      model: aiConfig.model,
-      ...(aiConfig.baseUrl ? { baseURL: aiConfig.baseUrl } : {}),
-    })
-
-    return { jobId: result.jobId }
-  })
-
-const PollVideoSchema = z.object({
-  jobId: z.string(),
-  threadId: z.string(),
-})
-
-export const pollVideoFn = createServerFn({ method: "POST" })
-  .validator(PollVideoSchema)
-  .handler(async ({ data }) => {
-    const prisma = await getPrisma()
-    const request = getRequest()
-    await requireFeature(request, "mediaGeneration")
-
-    const session = await requireAuth(request)
-    if (!session?.user?.id) {
-      return { error: "Unauthorized" }
-    }
-    const userId = session.user.id
-    await checkAiRateLimit(userId, "mediaPoll")
-    const thread = await prisma.chatThread.findFirst({
-      where: { id: data.threadId, userId }, select: { id: true },
-    })
-    if (!thread) throw new Error("Thread not found")
-
-    const aiConfig = await resolveAiConfig(userId)
-    if (!aiConfig) {
-      return { error: "AI key not configured" }
-    }
-
-    const result = await pollVideoForUser({
-      userId,
-      threadId: data.threadId,
-      jobId: data.jobId,
-      adapterKind: aiConfig.provider,
-      apiKey: aiConfig.apiKey,
-      model: aiConfig.model,
-      ...(aiConfig.baseUrl ? { baseURL: aiConfig.baseUrl } : {}),
-    })
-
-    return {
-      status: result.status,
-      progress: result.progress,
-      url: result.url,
-      artifacts: result.artifacts,
-      error: result.error,
-    }
-  })
-
 const GenerateSpeechSchema = z.object({
   text: z.string().min(1),
   voice: z.string().optional(),
@@ -192,18 +96,17 @@ const GenerateSpeechSchema = z.object({
 })
 
 export const generateSpeechFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(GenerateSpeechSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
     const request = getRequest()
     await requireFeature(request, "mediaGeneration")
     await requireResource(request, "mediaGenerationsMonthly")
-
-    const session = await requireAuth(request)
-    if (!session?.user?.id) {
+    if (!context.user.id) {
       return { error: "Unauthorized" }
     }
-    const userId = session.user.id
+    const userId = context.user.id
     await checkAiRateLimit(userId, "mediaSpeech")
     const thread = await prisma.chatThread.findFirst({
       where: { id: data.threadId, userId }, select: { id: true },
@@ -247,18 +150,17 @@ const GenerateTranscriptionSchema = z.object({
 })
 
 export const generateTranscriptionFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(GenerateTranscriptionSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
     const request = getRequest()
     await requireFeature(request, "mediaGeneration")
     await requireResource(request, "mediaGenerationsMonthly")
-
-    const session = await requireAuth(request)
-    if (!session?.user?.id) {
+    if (!context.user.id) {
       return { error: "Unauthorized" }
     }
-    const userId = session.user.id
+    const userId = context.user.id
     await checkAiRateLimit(userId, "mediaTranscription")
     const thread = await prisma.chatThread.findFirst({
       where: { id: data.threadId, userId }, select: { id: true },
@@ -301,16 +203,15 @@ const GeneratePrototypeSchema = z.object({
  * 不扣 mediaGenerationsMonthly 配额（token 计量由 runChat 既有 AiUsageLog 承担）。
  */
 export const generatePrototypeFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(GeneratePrototypeSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const request = getRequest()
     await requireFeature(request, "mediaGeneration")
-
-    const session = await requireAuth(request)
-    if (!session?.user?.id) {
+    if (!context.user.id) {
       return { error: "Unauthorized" }
     }
-    const userId = session.user.id
+    const userId = context.user.id
     await checkAiRateLimit(userId, "mediaPrototype")
     // threadId 归属由下游 generatePrototypeForUser 的 requireThread 校验
     // （{ id, userId } findFirst，media/index.ts）——与上方各 fn 的本层校验同口径

package/src/server/serverFns/harness/sandbox-policy.ts

@@ -19,7 +19,7 @@ import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start"
 import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
-import { getCurrentSession } from "@/lib/session"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import {
   SANDBOX_DEFAULT_POLICY_LEVEL,
   isSandboxPolicyLevel,
@@ -28,26 +28,26 @@ import { assertSandboxEntitled } from "@/server/ai-gateway/sandbox/entitlement"
 
 const threadIdInput = z.object({ threadId: z.string().min(1) })
 
-async function requireOwnedThread(threadId: string) {
-  const session = await getCurrentSession(getRequest())
-  if (!session?.user?.id) throw new Error("Unauthorized")
-
+// 归属校验 helper：userId 由 authContextMiddleware 注入（context.user.id），
+// 未登录拒绝走 middleware 的 UnauthorizedError；跨用户仍抛原 Error("Unauthorized")
+async function requireOwnedThread(threadId: string, userId: string) {
   const prisma = await getPrisma()
   const thread = await prisma.chatThread.findUnique({
     where: { id: threadId },
     select: { id: true, userId: true, sandboxPolicy: true },
   })
   if (!thread) throw new Error(`Chat thread not found: ${threadId}`)
-  if (thread.userId !== session.user.id) throw new Error("Unauthorized")
+  if (thread.userId !== userId) throw new Error("Unauthorized")
 
   return thread
 }
 
 /** 读取线程沙箱策略档；DB 值非法时回落默认档（fail-closed，不返回更宽的档）。 */
 export const getSandboxPolicyFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(threadIdInput)
-  .handler(async ({ data }) => {
-    const thread = await requireOwnedThread(data.threadId)
+  .handler(async ({ data, context }) => {
+    const thread = await requireOwnedThread(data.threadId, context.user.id)
     return isSandboxPolicyLevel(thread.sandboxPolicy)
       ? thread.sandboxPolicy
       : SANDBOX_DEFAULT_POLICY_LEVEL
@@ -58,6 +58,7 @@ export const getSandboxPolicyFn = createServerFn({ method: "GET" })
  * confirmFull: true，否则直接拒绝——UI 弹窗只是体验，这里才是安全边界。
  */
 export const setSandboxPolicyFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       threadId: z.string().min(1),
@@ -65,7 +66,7 @@ export const setSandboxPolicyFn = createServerFn({ method: "POST" })
       confirmFull: z.boolean().default(false),
     }),
   )
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
     // 启用面也过闸：策略档只在你有权使用沙箱时才有意义，UI 层的 FeatureGate
     // 只是体验优化，这里才是边界（desktop 在本函数内直放）。
@@ -77,7 +78,7 @@ export const setSandboxPolicyFn = createServerFn({ method: "POST" })
       throw new Error("Enabling full sandbox policy requires confirmFull")
     }
 
-    const thread = await requireOwnedThread(data.threadId)
+    const thread = await requireOwnedThread(data.threadId, context.user.id)
     const updated = await prisma.chatThread.update({
       where: { id: thread.id },
       data: { sandboxPolicy: data.level },

package/src/server/serverFns/harness/search-mention-candidates.ts

@@ -17,18 +17,16 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { z } from "zod"
-import { requireAuth } from "@/server/auth-helpers"
 
 /** 搜索当前用户有权访问的 KB 文档（自有知识库）——不依赖 storyId */
 export const searchKbDocsForMentionFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ query: z.string().default("") }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
 
     const accessibleKbs = await prisma.knowledgeBase.findMany({
       where: { userId, isDeleted: false },

package/src/server/serverFns/harness/workspace-files.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { z } from "zod"
-import { getCurrentSession } from "@/lib/session"
 
 async function assertWorkspaceOwner(workspaceId: string, userId: string) {
   const prisma = await getPrisma()
@@ -32,24 +31,22 @@ async function assertWorkspaceOwner(workspaceId: string, userId: string) {
 }
 
 export const createHarnessWorkspaceFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ name: z.string().min(1).max(80) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const session = await getCurrentSession(getRequest())
-    if (!session?.user?.id) throw new Error("Unauthorized")
     return prisma.harnessWorkspace.create({
-      data: { name: data.name, ownerId: session.user.id },
+      data: { name: data.name, ownerId: context.user.id },
       select: { id: true, name: true },
     })
   })
 
 export const listHarnessWorkspacesFn = createServerFn({ method: "GET" })
-  .handler(async () => {
+  .middleware([authContextMiddleware])
+  .handler(async ({ context }) => {
     const prisma = await getPrisma()
-    const session = await getCurrentSession(getRequest())
-    if (!session?.user?.id) throw new Error("Unauthorized")
     return prisma.harnessWorkspace.findMany({
-      where: { ownerId: session.user.id },
+      where: { ownerId: context.user.id },
       orderBy: { updatedAt: "desc" },
       select: {
         id: true,
@@ -62,12 +59,11 @@ export const listHarnessWorkspacesFn = createServerFn({ method: "GET" })
   })
 
 export const listWorkspaceFilesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ workspaceId: z.string().min(1) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const session = await getCurrentSession(getRequest())
-    if (!session?.user?.id) throw new Error("Unauthorized")
-    await assertWorkspaceOwner(data.workspaceId, session.user.id)
+    await assertWorkspaceOwner(data.workspaceId, context.user.id)
     return prisma.workspaceFile.findMany({
       where: { workspaceId: data.workspaceId },
       orderBy: { path: "asc" },
@@ -83,6 +79,7 @@ export const listWorkspaceFilesFn = createServerFn({ method: "GET" })
   })
 
 export const uploadWorkspaceFileFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       workspaceId: z.string(),
@@ -91,11 +88,9 @@ export const uploadWorkspaceFileFn = createServerFn({ method: "POST" })
       mimeType: z.string().default("application/octet-stream"),
     }),
   )
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const session = await getCurrentSession(getRequest())
-    if (!session?.user?.id) throw new Error("Unauthorized")
-    await assertWorkspaceOwner(data.workspaceId, session.user.id)
+    await assertWorkspaceOwner(data.workspaceId, context.user.id)
     return prisma.workspaceFile.upsert({
       where: { workspaceId_path: { workspaceId: data.workspaceId, path: data.path } },
       create: { ...data, size: data.content.length, source: "upload" },
@@ -105,12 +100,11 @@ export const uploadWorkspaceFileFn = createServerFn({ method: "POST" })
   })
 
 export const readWorkspaceFileFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ workspaceId: z.string().min(1), path: z.string().min(1) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const session = await getCurrentSession(getRequest())
-    if (!session?.user?.id) throw new Error("Unauthorized")
-    await assertWorkspaceOwner(data.workspaceId, session.user.id)
+    await assertWorkspaceOwner(data.workspaceId, context.user.id)
     const file = await prisma.workspaceFile.findFirst({
       where: { workspaceId: data.workspaceId, path: data.path },
       select: { content: true, mimeType: true },
@@ -120,15 +114,14 @@ export const readWorkspaceFileFn = createServerFn({ method: "GET" })
   })
 
 export const deleteWorkspaceFileFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ fileId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const session = await getCurrentSession(getRequest())
-    if (!session?.user?.id) throw new Error("Unauthorized")
     const file = await prisma.workspaceFile.findFirst({
       where: {
         id: data.fileId,
-        workspace: { ownerId: session.user.id },
+        workspace: { ownerId: context.user.id },
       },
       select: { id: true },
     })

package/src/server/serverFns/iteration/__tests__/iteration-auto-schedule.test.ts

@@ -19,9 +19,17 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 
 vi.mock("@tanstack/react-start", () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws);
+        return api;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
@@ -29,16 +37,40 @@ vi.mock("@tanstack/react-start", () => ({
       handler(fn: Function) {
         const wrapped = async (args: any) => {
           let data = args?.data;
-          if (this._validator && data !== undefined) {
-            data = this._validator.parse ? this._validator.parse(data) : data;
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data;
+          }
+          let context: any = {};
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
           }
-          return fn({ data });
+          return fn({ data, context });
         };
         return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({

package/src/server/serverFns/iteration/__tests__/iteration-crud.test.ts

@@ -18,9 +18,17 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 
 vi.mock("@tanstack/react-start", () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws);
+        return api;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
@@ -28,16 +36,40 @@ vi.mock("@tanstack/react-start", () => ({
       handler(fn: Function) {
         const wrapped = async (args: any) => {
           let data = args?.data;
-          if (this._validator && data !== undefined) {
-            data = this._validator.parse ? this._validator.parse(data) : data;
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data;
+          }
+          let context: any = {};
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
           }
-          return fn({ data });
+          return fn({ data, context });
         };
         return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({