@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/knowledge/public/bookmarks/refresh-favicon.ts

@@ -16,19 +16,17 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import { checkUserActionRateLimit } from '@/server/lib/rate-limit'
 import { syncBookmarkFavicon } from '@/server/knowledge/public/favicon'
 
 export const refreshFaviconFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id
     // P3：favicon 外链拉取 per-minute 频控（防借服务端代理扫描外网）
     await checkUserActionRateLimit(userId, 'faviconRefresh')
     // 仅书签属主可触发服务端外呼（审计 2026-10-25：裸 id 可让任意登录用户借服务端拉任意书签）

package/src/server/serverFns/knowledge/public/bookmarks/share.ts

@@ -17,18 +17,16 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { shareToPublic, type ShareResult } from '@/server/knowledge/public/share-merge'
 
 export const shareBookmarkFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     const source = await prisma.websiteBookmark.findFirst({
       where: { id: data.id, userId, isDeleted: false },
     })

package/src/server/serverFns/knowledge/public/bookmarks/sync-github.ts

@@ -16,24 +16,22 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import { checkUserActionRateLimit } from '@/server/lib/rate-limit'
 import { syncBookmarkGithub } from '@/server/knowledge/public/github-sync'
 
 export const syncBookmarkGithubFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
+  .handler(async ({ data, context }) => {
     // 仅书签属主可触发 GitHub 同步（审计 2026-10-25：裸 id 可对任意书签发起服务端
     // GitHub 外呼）；#485 已补属主校验，此处补 per-minute 频控堵配额放大
-    await checkUserActionRateLimit(session.user.id, 'githubSync')
+    await checkUserActionRateLimit(context.user.id, 'githubSync')
     const prisma = await getPrisma()
     const owned = await prisma.websiteBookmark.findFirst({
-      where: { id: data.id, isDeleted: false, userId: session.user.id },
+      where: { id: data.id, isDeleted: false, userId: context.user.id },
       select: { id: true },
     })
     if (!owned) throw new Error('书签不存在')

package/src/server/serverFns/knowledge/public/bookmarks/unshare.ts

@@ -17,17 +17,15 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 export const unshareBookmarkFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ canonicalId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await prisma.knowledgeShareRecord.deleteMany({
       where: { entityType: 'bookmark', canonicalId: data.canonicalId, userId },
     })

package/src/server/serverFns/knowledge/public/bookmarks/update.ts

@@ -18,9 +18,8 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { checkUserActionRateLimit } from '@/server/lib/rate-limit'
 import { bookmarkCanonicalId, parseGithubUrl } from '@/server/knowledge/public/canonical-id'
 import { fetchGithubData } from '@/server/knowledge/public/github-sync'
@@ -43,16 +42,15 @@ const updateSchema = z.object({
 })
 
 export const updateBookmarkFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(updateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const { id, ...rest } = data
     const existing = await prisma.websiteBookmark.findUnique({ where: { id } })
     if (!existing) throw new Error('未找到')
-    const isOwner = existing.userId === session.user.id
-    const isAdmin = session.user.role === 'ADMIN' || session.user.role === 'SUPER_ADMIN'
+    const isOwner = existing.userId === context.user.id
+    const isAdmin = context.user.role === 'ADMIN' || context.user.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
 
     const updateData: Prisma.WebsiteBookmarkUncheckedUpdateInput = { ...rest }
@@ -73,7 +71,7 @@ export const updateBookmarkFn = createServerFn({ method: 'POST' })
       updateData.githubSyncedAt = null
       // resolveFavicon 内部已走 assertFetchableUrl + redirect:"error"（SEC-05），
       // 此处补 per-minute 频控（与 refreshFaviconFn 同预算）
-      await checkUserActionRateLimit(session.user.id, 'faviconRefresh')
+      await checkUserActionRateLimit(context.user.id, 'faviconRefresh')
       try {
         updateData.faviconUrl = await resolveFavicon(data.url)
         updateData.faviconSyncedAt = new Date()

package/src/server/serverFns/knowledge/public/compliance/create.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { complianceCanonicalId } from '@/server/knowledge/public/canonical-id'
 import { httpUrl } from "@/server/lib/validators";
 
@@ -37,11 +36,10 @@ const createSchema = z.object({
 })
 
 export const createComplianceFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(createSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const result = await prisma.industryCompliance.create({
       data: {
         canonicalId: complianceCanonicalId({ title: data.title, code: data.code }),
@@ -55,7 +53,7 @@ export const createComplianceFn = createServerFn({ method: 'POST' })
         sourceUrl: data.sourceUrl || null,
         tags: data.tags,
         visibility: 'private',
-        userId: session.user.id,
+        userId: context.user.id,
       },
       select: { id: true },
     })

package/src/server/serverFns/knowledge/public/compliance/delete.ts

@@ -17,20 +17,18 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 export const deleteComplianceFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const existing = await prisma.industryCompliance.findUnique({ where: { id: data.id } })
     if (!existing) throw new Error('未找到')
-    const isOwner = existing.userId === session.user.id
-    const isAdmin = session.user.role === 'ADMIN' || session.user.role === 'SUPER_ADMIN'
+    const isOwner = existing.userId === context.user.id
+    const isAdmin = context.user.role === 'ADMIN' || context.user.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
     await prisma.industryCompliance.update({ where: { id: data.id }, data: { isDeleted: true } })
     return { success: true }

package/src/server/serverFns/knowledge/public/compliance/detail.ts

@@ -17,17 +17,15 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { aggregateSharers, type PublicSharer } from '@/server/knowledge/public/share-merge'
 
 export const getComplianceDetailFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const item = await prisma.industryCompliance.findFirst({
       where: { id: data.id, isDeleted: false },
       include: {
@@ -37,7 +35,7 @@ export const getComplianceDetailFn = createServerFn({ method: 'GET' })
       },
     })
     if (!item) throw new Error('未找到')
-    if (item.visibility === 'private' && item.userId !== session.user.id) {
+    if (item.visibility === 'private' && item.userId !== context.user.id) {
       throw new Error('无权限')
     }
     let sharers: PublicSharer[] = []

package/src/server/serverFns/knowledge/public/compliance/list.ts

@@ -18,9 +18,8 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { aggregateSharers } from '@/server/knowledge/public/share-merge'
 
 const listSchema = z.object({
@@ -38,14 +37,13 @@ const listSchema = z.object({
 const UNNAMED_COMPLIANCE_PLACEHOLDER_TITLE = '未命名合规'
 
 export const listComplianceFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(listSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const where: Prisma.IndustryComplianceWhereInput = { isDeleted: false }
     where.NOT = { title: UNNAMED_COMPLIANCE_PLACEHOLDER_TITLE }
-    const userId = session.user.id
+    const userId = context.user.id
     if (data.scope === 'private') {
       where.userId = userId
       where.visibility = 'private'

package/src/server/serverFns/knowledge/public/compliance/share.ts

@@ -17,18 +17,16 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { shareToPublic, type ShareResult } from '@/server/knowledge/public/share-merge'
 
 export const shareComplianceFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     const source = await prisma.industryCompliance.findFirst({
       where: { id: data.id, userId, isDeleted: false },
     })

package/src/server/serverFns/knowledge/public/compliance/unshare.ts

@@ -17,17 +17,15 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 export const unshareComplianceFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ canonicalId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await prisma.knowledgeShareRecord.deleteMany({
       where: { entityType: 'compliance', canonicalId: data.canonicalId, userId },
     })

package/src/server/serverFns/knowledge/public/compliance/update.ts

@@ -18,9 +18,8 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { complianceCanonicalId } from '@/server/knowledge/public/canonical-id'
 import { httpUrl } from "@/server/lib/validators";
 
@@ -39,16 +38,15 @@ const updateSchema = z.object({
 })
 
 export const updateComplianceFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(updateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const { id, code, ...rest } = data
     const existing = await prisma.industryCompliance.findUnique({ where: { id } })
     if (!existing) throw new Error('未找到')
-    const isOwner = existing.userId === session.user.id
-    const isAdmin = session.user.role === 'ADMIN' || session.user.role === 'SUPER_ADMIN'
+    const isOwner = existing.userId === context.user.id
+    const isAdmin = context.user.role === 'ADMIN' || context.user.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
 
     const updateData: Prisma.IndustryComplianceUncheckedUpdateInput = { ...rest }

package/src/server/serverFns/knowledge/public/dictionary/create.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { dictionaryCanonicalId } from '@/server/knowledge/public/canonical-id'
 import { httpUrl } from "@/server/lib/validators";
 
@@ -35,11 +34,10 @@ const createSchema = z.object({
 })
 
 export const createDictionaryFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(createSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     return prisma.dictionaryTerm.create({
       data: {
         canonicalId: dictionaryCanonicalId(data.title, data.industry),
@@ -51,7 +49,7 @@ export const createDictionaryFn = createServerFn({ method: 'POST' })
         referenceUrl: data.referenceUrl || null,
         tags: data.tags,
         visibility: 'private',
-        userId: session.user.id,
+        userId: context.user.id,
       },
       select: { id: true },
     })

package/src/server/serverFns/knowledge/public/dictionary/delete.ts

@@ -17,20 +17,18 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 export const deleteDictionaryFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const existing = await prisma.dictionaryTerm.findUnique({ where: { id: data.id } })
     if (!existing) throw new Error('未找到')
-    const isOwner = existing.userId === session.user.id
-    const isAdmin = session.user.role === 'ADMIN' || session.user.role === 'SUPER_ADMIN'
+    const isOwner = existing.userId === context.user.id
+    const isAdmin = context.user.role === 'ADMIN' || context.user.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
     await prisma.dictionaryTerm.update({ where: { id: data.id }, data: { isDeleted: true } })
     return { success: true }

package/src/server/serverFns/knowledge/public/dictionary/detail.ts

@@ -17,22 +17,20 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { aggregateSharers, type PublicSharer } from '@/server/knowledge/public/share-merge'
 
 export const getDictionaryDetailFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const item = await prisma.dictionaryTerm.findFirst({
       where: { id: data.id, isDeleted: false },
     })
     if (!item) throw new Error('未找到')
-    if (item.visibility === 'private' && item.userId !== session.user.id) {
+    if (item.visibility === 'private' && item.userId !== context.user.id) {
       throw new Error('无权限')
     }
     let sharers: PublicSharer[] = []

package/src/server/serverFns/knowledge/public/dictionary/list.ts

@@ -18,9 +18,8 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { aggregateSharers } from '@/server/knowledge/public/share-merge'
 
 const listSchema = z.object({
@@ -34,13 +33,12 @@ const listSchema = z.object({
 })
 
 export const listDictionaryFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(listSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const where: Prisma.DictionaryTermWhereInput = { isDeleted: false }
-    const userId = session.user.id
+    const userId = context.user.id
     if (data.scope === 'private') {
       where.userId = userId
       where.visibility = 'private'

package/src/server/serverFns/knowledge/public/dictionary/share.ts

@@ -17,18 +17,16 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { shareToPublic, type ShareResult } from '@/server/knowledge/public/share-merge'
 
 export const shareDictionaryFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     const source = await prisma.dictionaryTerm.findFirst({
       where: { id: data.id, userId, isDeleted: false },
     })

package/src/server/serverFns/knowledge/public/dictionary/unshare.ts

@@ -17,18 +17,16 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 export const unshareDictionaryFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ canonicalId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     await prisma.knowledgeShareRecord.deleteMany({
-      where: { entityType: 'dictionary', canonicalId: data.canonicalId, userId: session.user.id },
+      where: { entityType: 'dictionary', canonicalId: data.canonicalId, userId: context.user.id },
     })
     return { success: true }
   })

package/src/server/serverFns/knowledge/public/dictionary/update.ts

@@ -18,9 +18,8 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { dictionaryCanonicalId } from '@/server/knowledge/public/canonical-id'
 import { httpUrl } from "@/server/lib/validators";
 
@@ -36,15 +35,14 @@ const updateSchema = z.object({
 })
 
 export const updateDictionaryFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(updateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const existing = await prisma.dictionaryTerm.findUnique({ where: { id: data.id } })
     if (!existing) throw new Error('未找到')
-    const isOwner = existing.userId === session.user.id
-    const isAdmin = session.user.role === 'ADMIN' || session.user.role === 'SUPER_ADMIN'
+    const isOwner = existing.userId === context.user.id
+    const isAdmin = context.user.role === 'ADMIN' || context.user.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
 
     const updateData: Prisma.DictionaryTermUncheckedUpdateInput = { ...data }

package/src/server/serverFns/knowledge/public/entity-tags.ts

@@ -18,9 +18,8 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 const ENTITY_TYPES = ['legal', 'compliance', 'dictionary', 'bookmark'] as const
 type EntityType = (typeof ENTITY_TYPES)[number]
@@ -37,12 +36,11 @@ const TABLE_MAP: Record<EntityType, Prisma.Sql> = {
 }
 
 export const getEntityTagsFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ entityType: z.enum(ENTITY_TYPES) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
 
     const rows = await prisma.$queryRaw<{ tag: string }[]>`
       SELECT DISTINCT jsonb_array_elements_text("tags") as tag

package/src/server/serverFns/knowledge/public/favorite.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 // entityType 收敛为知识库公开域的固定集合（审计 ⚪：自由字符串可写入任意
 // entityType 造成自表数据污染；与 entity-tags.ts 的取值域保持一致）。
@@ -35,12 +34,11 @@ function assertFavoriteEntityType(entityType: string): void {
 }
 
 export const toggleFavoriteFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ entityType: z.string(), entityId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     assertFavoriteEntityType(data.entityType)
     // DB-03：toggle 的查后写（findFirst→delete/create）改为 deleteMany 计数判定，
     // 已收藏路径 1 次查询完成。防重实际靠 ArticleFavorite 的
@@ -59,12 +57,11 @@ export const toggleFavoriteFn = createServerFn({ method: 'POST' })
   })
 
 export const getFavoriteIdsFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ entityType: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     assertFavoriteEntityType(data.entityType)
     const favorites = await prisma.articleFavorite.findMany({
       where: { entityType: data.entityType, userId },