@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/iteration/__tests__/iteration-stories.test.ts

@@ -18,9 +18,17 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 
 vi.mock("@tanstack/react-start", () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws);
+        return api;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
@@ -28,16 +36,40 @@ vi.mock("@tanstack/react-start", () => ({
       handler(fn: Function) {
         const wrapped = async (args: any) => {
           let data = args?.data;
-          if (this._validator && data !== undefined) {
-            data = this._validator.parse ? this._validator.parse(data) : data;
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data;
+          }
+          let context: any = {};
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
           }
-          return fn({ data });
+          return fn({ data, context });
         };
         return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({

package/src/server/serverFns/iteration/__tests__/iteration-transfer.test.ts

@@ -18,9 +18,17 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 
 vi.mock("@tanstack/react-start", () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws);
+        return api;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
@@ -28,16 +36,40 @@ vi.mock("@tanstack/react-start", () => ({
       handler(fn: Function) {
         const wrapped = async (args: any) => {
           let data = args?.data;
-          if (this._validator && data !== undefined) {
-            data = this._validator.parse ? this._validator.parse(data) : data;
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data;
+          }
+          let context: any = {};
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
           }
-          return fn({ data });
+          return fn({ data, context });
         };
         return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({

package/src/server/serverFns/iteration/iteration-auto-schedule.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
 import { toDatePart } from "@/lib/iteration/status";
 import { ensureUpcomingIterations } from "@/server/iteration/auto-schedule-internal";
 import { assertIterationProjectMembership as assertProjectMembership } from "@/server/iteration/permissions";
@@ -31,12 +30,11 @@ const CONFIG_SELECT = {
 
 
 export const getAutoScheduleFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ projectId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await assertProjectMembership(data.projectId, session.user.id);
+    await assertProjectMembership(data.projectId, context.user.id);
     const [cfg] = await prisma.iterationAutoSchedule.findMany({
       where: { projectId: data.projectId }, select: CONFIG_SELECT, take: 1,
     });
@@ -44,6 +42,7 @@ export const getAutoScheduleFn = createServerFn({ method: "GET" })
   });
 
 export const updateAutoScheduleFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       projectId: z.string(),
@@ -56,12 +55,10 @@ export const updateAutoScheduleFn = createServerFn({ method: "POST" })
       autoRollover: z.boolean(),
     }),
   )
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 配置写入会连锁触发排期补建，须为项目有效成员（SEC-03）
-    await assertProjectMembership(data.projectId, session.user.id);
+    await assertProjectMembership(data.projectId, context.user.id);
     await prisma.iterationAutoSchedule.upsert({
       where: { projectId: data.projectId },
       create: { ...data, startsOn: new Date(data.startsOn + "T00:00:00.000Z") },

package/src/server/serverFns/iteration/iteration-burndown.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
 import { assertIterationProjectMember } from "@/server/iteration/permissions";
 import { toDatePart } from "@/lib/iteration/status";
 import { computeBurndown } from "@/lib/iteration/burndown";
@@ -29,12 +28,11 @@ const ACTIVITY_STORY_SELECT = {
 } as const;
 
 export const getIterationBurndownFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ iterationId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await assertIterationProjectMember(data.iterationId, session.user.id);
+    await assertIterationProjectMember(data.iterationId, context.user.id);
     const iteration = await prisma.iteration.findUnique({
       where: { id: data.iterationId },
       select: { startDate: true, endDate: true, project: { select: { timezone: true } } },

package/src/server/serverFns/iteration/iteration-crud.ts

@@ -18,8 +18,7 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { z } from "zod";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { deriveIterationStatus, isDateRangeOverlapping, toDatePart } from "@/lib/iteration/status";
 import {
   listIterationsSchema,
@@ -77,14 +76,13 @@ function toSummary(
 }
 
 export const listIterationsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listIterationsSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 读门槛与列表 scope 同口径（SEC-03）：非成员静默回退独立项目，
     // 同时避免借读路径触发他人项目的迭代自愈排期
-    const scopeProjectId = await resolveStoryScopeProjectId(data.projectId, session.user.id);
+    const scopeProjectId = await resolveStoryScopeProjectId(data.projectId, context.user.id);
     // 惰性自愈：自动排期补建 + autoRollover（规格 §3.6）
     await ensureUpcomingIterations(scopeProjectId);
     await ensureAutoRollover(scopeProjectId);
@@ -118,12 +116,11 @@ export const listIterationsFn = createServerFn({ method: "GET" })
  *   listIterationsFn 的读时惰性自愈，避免只读视图触发建行。
  */
 export const listIterationsScopeFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ projectId: z.string().optional() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const projectIds = await resolveStoryScopeProjectIds(data.projectId, session.user.id);
+    const projectIds = await resolveStoryScopeProjectIds(data.projectId, context.user.id);
     const items = await prisma.iteration.findMany({
       where: { projectId: { in: projectIds }, archived: false },
       select: { id: true, name: true, startDate: true, endDate: true },
@@ -133,13 +130,12 @@ export const listIterationsScopeFn = createServerFn({ method: "GET" })
   });
 
 export const getIterationFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(iterationIdSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 读侧与写侧同口径：须为迭代所属项目的有效成员（审计 2026-10-25 读路径缺口）
-    await assertIterationProjectMember(data.id, session.user.id);
+    await assertIterationProjectMember(data.id, context.user.id);
     const it = await prisma.iteration.findUnique({ where: { id: data.id }, select: ITERATION_SELECT });
     if (!it) throw new Error("迭代不存在");
     const grouped = await prisma.story.groupBy({
@@ -152,13 +148,12 @@ export const getIterationFn = createServerFn({ method: "GET" })
   });
 
 export const createIterationsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(createIterationSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 与 testcase createTestCaseFn 同范式：建入前校验目标项目成员资格（SEC-03 残口收口）
-    await assertProjectMembership(data.projectId, session.user.id);
+    await assertProjectMembership(data.projectId, context.user.id);
     await assertNoOverlap(data.projectId, data);
     const created = await prisma.iteration.create({
       data: {
@@ -167,7 +162,7 @@ export const createIterationsFn = createServerFn({ method: "POST" })
         description: data.description,
         startDate: new Date(data.startDate + "T00:00:00.000Z"),
         endDate: new Date(data.endDate + "T00:00:00.000Z"),
-        createdById: session.user.id,
+        createdById: context.user.id,
       },
       select: { id: true },
     });
@@ -175,12 +170,11 @@ export const createIterationsFn = createServerFn({ method: "POST" })
   });
 
 export const updateIterationsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(updateIterationSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     const existing = await prisma.iteration.findUnique({ where: { id: data.id }, select: ITERATION_SELECT });
     if (!existing) throw new Error("迭代不存在");
     await assertProjectMembership(existing.projectId, userId);
@@ -207,18 +201,17 @@ export const updateIterationsFn = createServerFn({ method: "POST" })
   });
 
 export const archiveIterationsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string(), archived: z.boolean() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 先取回目标行校验成员资格，再改（SEC-03：防跨项目归档他人迭代）
     const existing = await prisma.iteration.findUnique({
       where: { id: data.id },
       select: { id: true, projectId: true },
     });
     if (!existing) throw new Error("迭代不存在");
-    await assertProjectMembership(existing.projectId, session.user.id);
+    await assertProjectMembership(existing.projectId, context.user.id);
     await prisma.iteration.update({
       where: { id: data.id },
       data: { archived: data.archived, archivedAt: data.archived ? new Date() : null },
@@ -227,18 +220,17 @@ export const archiveIterationsFn = createServerFn({ method: "POST" })
   });
 
 export const deleteIterationsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(iterationIdSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 先取回目标行校验成员资格，再删（SEC-03：防跨项目删除他人迭代）
     const existing = await prisma.iteration.findUnique({
       where: { id: data.id },
       select: { id: true, projectId: true },
     });
     if (!existing) throw new Error("迭代不存在");
-    await assertProjectMembership(existing.projectId, session.user.id);
+    await assertProjectMembership(existing.projectId, context.user.id);
     await prisma.iteration.delete({ where: { id: data.id } }); // Story.iterationId SetNull 自动解绑
     return { ok: true };
   });
@@ -246,12 +238,11 @@ export const deleteIterationsFn = createServerFn({ method: "POST" })
 const listIterationStoriesSchema = z.object({ iterationId: z.string() });
 
 export const listIterationStoriesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listIterationStoriesSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await assertIterationProjectMember(data.iterationId, session.user.id);
+    await assertIterationProjectMember(data.iterationId, context.user.id);
     const stories = await prisma.story.findMany({
       where: { iterationId: data.iterationId, archived: false },
       orderBy: [{ state: "asc" }, { updatedAt: "desc" }],

package/src/server/serverFns/iteration/iteration-stories.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
 import { deriveIterationStatus, toDatePart } from "@/lib/iteration/status";
 import { assertIterationProjectMembership as assertProjectMembership } from "@/server/iteration/permissions";
 
@@ -40,12 +39,11 @@ async function assertTargetJoinable(iterationId: string, userId: string) {
 }
 
 export const setStoryIterationFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string(), iterationId: z.string().nullable() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     const story = await prisma.story.findUnique({
       where: { id: data.storyId },
       select: { projectId: true, iterationId: true, iteration: { select: { name: true } } },
@@ -73,12 +71,11 @@ export const setStoryIterationFn = createServerFn({ method: "POST" })
   });
 
 export const addStoriesToIterationFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ iterationId: z.string(), storyIds: z.array(z.string()).min(1).max(200) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     const newName = await assertTargetJoinable(data.iterationId, userId);
     // 批量圈定后按项目去重校验成员资格（SEC-03：任一跨项目 id 整批拒绝，不做部分写入）
     const stories = await prisma.story.findMany({
@@ -114,12 +111,11 @@ export const addStoriesToIterationFn = createServerFn({ method: "POST" })
   });
 
 export const removeStoryFromIterationFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     const story = await prisma.story.findUnique({
       where: { id: data.storyId },
       select: { projectId: true, iterationId: true, iteration: { select: { name: true } } },

package/src/server/serverFns/iteration/iteration-transfer.ts

@@ -16,9 +16,8 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
 import { transferStoriesInternal } from "@/server/iteration/transfer-internal";
 
 // 模块私有：serverFn 文件只准导出 createServerFn（客户端 split 会保留普通导出）
@@ -29,15 +28,14 @@ const transferUnfinishedSchema = z.object({
 });
 
 export const transferUnfinishedFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(transferUnfinishedSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest();
-    const session = await requireAuth(request);
+  .handler(async ({ data, context }) => {
     const count = await transferStoriesInternal(
       data.iterationId,
       data.targetIterationId,
       data.storyIds,
-      session.user.id,
+      context.user.id,
     );
     return { count };
   });

package/src/server/serverFns/knowledge/public/bookmarks/categories.ts

@@ -17,41 +17,38 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 export const listBookmarkCategoriesFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({}).optional())
-  .handler(async () => {
+  .handler(async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     return prisma.bookmarkCategory.findMany({
-      where: { OR: [{ userId: null }, { userId: session.user.id }] },
+      where: { OR: [{ userId: null }, { userId: context.user.id }] },
       orderBy: [{ sortOrder: 'asc' }, { name: 'asc' }],
       select: { id: true, name: true, icon: true, sortOrder: true, isDefault: true, userId: true },
     })
   })
 
 export const createBookmarkCategoryFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ name: z.string().min(1).max(20), icon: z.string().default('Folder') }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     // max+1 聚合与创建同事务（审计 2026-10-25：收窄 check-then-act 竞态窗口；
     // 极端并发仍可能重复 sortOrder，展示层按 sortOrder+name 排序可容忍）
     return prisma.$transaction(async (tx) => {
       const last = await tx.bookmarkCategory.findFirst({
-        where: { userId: session.user.id },
+        where: { userId: context.user.id },
         orderBy: { sortOrder: 'desc' },
       })
       return tx.bookmarkCategory.create({
         data: {
           name: data.name,
           icon: data.icon,
-          userId: session.user.id,
+          userId: context.user.id,
           sortOrder: (last?.sortOrder ?? 0) + 1,
         },
         select: { id: true, name: true, icon: true, sortOrder: true },
@@ -60,15 +57,14 @@ export const createBookmarkCategoryFn = createServerFn({ method: 'POST' })
   })
 
 export const deleteBookmarkCategoryFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const cat = await prisma.bookmarkCategory.findUnique({ where: { id: data.id } })
     if (!cat) throw new Error('未找到')
     if (cat.isDefault) throw new Error('预置分类不可删除')
-    if (cat.userId !== session.user.id) throw new Error('无权限')
+    if (cat.userId !== context.user.id) throw new Error('无权限')
     await prisma.bookmarkCategory.delete({ where: { id: data.id } })
     return { success: true }
   })

package/src/server/serverFns/knowledge/public/bookmarks/create.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { checkUserActionRateLimit } from '@/server/lib/rate-limit'
 import { bookmarkCanonicalId, parseGithubUrl } from '@/server/knowledge/public/canonical-id'
 import { fetchGithubData } from '@/server/knowledge/public/github-sync'
@@ -41,12 +40,11 @@ const createSchema = z.object({
 })
 
 export const createBookmarkFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(createSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     // categoryId 必须存在且属于当前用户或为公共分类（审计 2026-10-25：
     // 防把书签挂到他人自定义分类下造成数据关联错乱）
     if (data.categoryId) {

package/src/server/serverFns/knowledge/public/bookmarks/delete.ts

@@ -17,20 +17,18 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 export const deleteBookmarkFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const existing = await prisma.websiteBookmark.findUnique({ where: { id: data.id } })
     if (!existing) throw new Error('未找到')
-    const isOwner = existing.userId === session.user.id
-    const isAdmin = session.user.role === 'ADMIN' || session.user.role === 'SUPER_ADMIN'
+    const isOwner = existing.userId === context.user.id
+    const isAdmin = context.user.role === 'ADMIN' || context.user.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
     await prisma.websiteBookmark.update({ where: { id: data.id }, data: { isDeleted: true } })
     return { success: true }

package/src/server/serverFns/knowledge/public/bookmarks/detail.ts

@@ -17,18 +17,16 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { aggregateSharers, type PublicSharer } from '@/server/knowledge/public/share-merge'
 
 export const getBookmarkDetailFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     const item = await prisma.websiteBookmark.findFirst({
       where: { id: data.id, isDeleted: false },
       include: { category: { select: { icon: true } } },

package/src/server/serverFns/knowledge/public/bookmarks/favorite.ts

@@ -17,17 +17,15 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 export const toggleFavoriteBookmarkFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ canonicalId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     // DB-03：同 toggleFavoriteFn——deleteMany 计数判定合并查后写，防并发重复收藏。
     // 审计 2026-10-25 核实：ArticleFavorite 有 @@unique([entityType, entityId, userId])
     // 兜底，并发双击时 create 撞唯一约束（P2002）——按「已收藏」语义吞掉该竞态。

package/src/server/serverFns/knowledge/public/bookmarks/list.ts

@@ -18,9 +18,8 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { aggregateSharers } from '@/server/knowledge/public/share-merge'
 
 const listSchema = z.object({
@@ -33,12 +32,11 @@ const listSchema = z.object({
 })
 
 export const listBookmarksFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(listSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     const where: Prisma.WebsiteBookmarkWhereInput = { isDeleted: false }
     if (data.scope === 'private') {
       where.userId = userId