@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/knowledge/public/legal/create.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { legalCanonicalId } from '@/server/knowledge/public/canonical-id'
 import { httpUrl } from "@/server/lib/validators";
 
@@ -39,11 +38,10 @@ const createSchema = z.object({
 })
 
 export const createLegalFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(createSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const result = await prisma.legalRegulation.create({
       data: {
         canonicalId: legalCanonicalId({ title: data.title, code: data.code }),
@@ -62,7 +60,7 @@ export const createLegalFn = createServerFn({ method: 'POST' })
         sourceUrl: data.sourceUrl || null,
         tags: data.tags,
         visibility: 'private',
-        userId: session.user.id,
+        userId: context.user.id,
       },
       select: { id: true },
     })

package/src/server/serverFns/knowledge/public/legal/delete.ts

@@ -17,20 +17,18 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 export const deleteLegalFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const existing = await prisma.legalRegulation.findUnique({ where: { id: data.id } })
     if (!existing) throw new Error('未找到')
-    const isOwner = existing.userId === session.user.id
-    const isAdmin = session.user.role === 'ADMIN' || session.user.role === 'SUPER_ADMIN'
+    const isOwner = existing.userId === context.user.id
+    const isAdmin = context.user.role === 'ADMIN' || context.user.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
     await prisma.legalRegulation.update({ where: { id: data.id }, data: { isDeleted: true } })
     return { success: true }

package/src/server/serverFns/knowledge/public/legal/detail.ts

@@ -17,17 +17,15 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { aggregateSharers, type PublicSharer } from '@/server/knowledge/public/share-merge'
 
 export const getLegalDetailFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const item = await prisma.legalRegulation.findFirst({
       where: { id: data.id, isDeleted: false },
       include: {
@@ -37,7 +35,7 @@ export const getLegalDetailFn = createServerFn({ method: 'GET' })
       },
     })
     if (!item) throw new Error('未找到')
-    if (item.visibility === 'private' && item.userId !== session.user.id) {
+    if (item.visibility === 'private' && item.userId !== context.user.id) {
       throw new Error('无权限')
     }
     let sharers: PublicSharer[] = []

package/src/server/serverFns/knowledge/public/legal/list.ts

@@ -18,9 +18,8 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { aggregateSharers } from '@/server/knowledge/public/share-merge'
 
 // 法规草稿的历史占位标题（早期创建表单未填标题时的默认值，当前代码已无写入点，
@@ -39,14 +38,13 @@ const listSchema = z.object({
 })
 
 export const listLegalFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(listSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const where: Prisma.LegalRegulationWhereInput = { isDeleted: false }
     where.NOT = { title: UNNAMED_LEGAL_TITLE }
-    const userId = session.user.id
+    const userId = context.user.id
     if (data.scope === 'private') {
       where.userId = userId
       where.visibility = 'private'

package/src/server/serverFns/knowledge/public/legal/share.ts

@@ -17,18 +17,16 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { shareToPublic, type ShareResult } from '@/server/knowledge/public/share-merge'
 
 export const shareLegalFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     const source = await prisma.legalRegulation.findFirst({
       where: { id: data.id, userId, isDeleted: false },
     })

package/src/server/serverFns/knowledge/public/legal/unshare.ts

@@ -17,18 +17,16 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 export const unshareLegalFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ canonicalId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     await prisma.knowledgeShareRecord.deleteMany({
-      where: { entityType: 'legal', canonicalId: data.canonicalId, userId: session.user.id },
+      where: { entityType: 'legal', canonicalId: data.canonicalId, userId: context.user.id },
     })
     return { success: true }
   })

package/src/server/serverFns/knowledge/public/legal/update.ts

@@ -18,9 +18,8 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { legalCanonicalId } from '@/server/knowledge/public/canonical-id'
 import { httpUrl } from "@/server/lib/validators";
 
@@ -41,16 +40,15 @@ const updateSchema = z.object({
 })
 
 export const updateLegalFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(updateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const { id, code, ...rest } = data
     const existing = await prisma.legalRegulation.findUnique({ where: { id } })
     if (!existing) throw new Error('未找到')
-    const isOwner = existing.userId === session.user.id
-    const isAdmin = session.user.role === 'ADMIN' || session.user.role === 'SUPER_ADMIN'
+    const isOwner = existing.userId === context.user.id
+    const isAdmin = context.user.role === 'ADMIN' || context.user.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
 
     const updateData: Prisma.LegalRegulationUncheckedUpdateInput = { ...rest }

package/src/server/serverFns/knowledge-index.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
-import { requireAuth } from "@/server/auth-helpers"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { getVectorStore } from "@/lib/vector-store"
 import { checkAiRateLimit } from "@/server/lib/rate-limit"
 import { tryAcquireReindex, releaseReindex } from "@/server/knowledge/reindex-guard"
@@ -30,18 +29,17 @@ import {
 } from "@/server/knowledge/knowledge-index-utils"
 
 export const indexKnowledgeDocumentFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ documentId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     // embedding 是计费 AI 调用，入口限流（审计 2026-10-25，与 AI 域同口径）
-    await checkAiRateLimit(session.user.id, "kbIndex")
+    await checkAiRateLimit(context.user.id, "kbIndex")
     const doc = await prisma.knowledgeDocument.findFirst({
       where: {
         id: data.documentId,
         isDeleted: false,
-        kb: { userId: session.user.id, isDeleted: false },
+        kb: { userId: context.user.id, isDeleted: false },
       },
       select: { id: true, kbId: true, title: true, content: true },
     })
@@ -53,17 +51,16 @@ export const indexKnowledgeDocumentFn = createServerFn({ method: "POST" })
   })
 
 export const deleteKnowledgeEmbeddingsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ documentId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     // 属主校验与 indexKnowledgeDocumentFn 同口径（审计 2026-10-25：裸 documentId 可删他人全部嵌入）
     const doc = await prisma.knowledgeDocument.findFirst({
       where: {
         id: data.documentId,
         isDeleted: false,
-        kb: { userId: session.user.id, isDeleted: false },
+        kb: { userId: context.user.id, isDeleted: false },
       },
       select: { id: true },
     })
@@ -74,15 +71,14 @@ export const deleteKnowledgeEmbeddingsFn = createServerFn({ method: "POST" })
   })
 
 export const reindexKnowledgeBaseFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ kbId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     // embedding 是计费 AI 调用，入口限流（审计 2026-10-25，与 AI 域同口径）
-    await checkAiRateLimit(session.user.id, "kbIndex")
+    await checkAiRateLimit(context.user.id, "kbIndex")
     const kb = await prisma.knowledgeBase.findFirst({
-      where: { id: data.kbId, userId: session.user.id, isDeleted: false },
+      where: { id: data.kbId, userId: context.user.id, isDeleted: false },
       select: { id: true },
     })
     if (!kb) throw new Error("未找到或无权限")

package/src/server/serverFns/knowledge.ts

@@ -18,11 +18,10 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { buildRoomName } from "@allbluecn/collab-core/rooms"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { jsonSizeOk, documentIdFromEmbeddingRowId, MAX_DOC_CONTENT_JSON_CHARS, MAX_DOC_PROPERTIES_JSON_CHARS } from '@/server/knowledge/knowledge-helpers'
 
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { indexDocumentById, resolveAiConfig, KB_EMBEDDINGS_TABLE } from '@/server/knowledge/knowledge-index-utils'
 import { generateEmbedding } from '@/server/ai-gateway/embedding'
 import { rerankCandidates, RECALL_MULTIPLIER } from '@/server/ai-gateway/rerank'
@@ -42,13 +41,12 @@ const READABLE_KB = (userId: string) => ({
 })
 
 export const listKnowledgeFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({}).optional())
-  .handler(async () => {
+  .handler(async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     return prisma.knowledgeBase.findMany({
-      where: { userId: session.user.id, isDeleted: false },
+      where: { userId: context.user.id, isDeleted: false },
       orderBy: [{ pinnedToSidebar: 'desc' }, { createdAt: 'asc' }],
       select: {
         id: true,
@@ -73,12 +71,11 @@ const createSchema = z.object({
 })
 
 export const createKnowledgeFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(createSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await requirePermission(userId, 'knowledge', 'write')
     const kb = await prisma.$transaction(async (tx) => {
       const knowledge = await tx.knowledgeBase.create({
@@ -109,13 +106,12 @@ export const createKnowledgeFn = createServerFn({ method: 'POST' })
 const detailSchema = z.object({ id: z.string() })
 
 export const getKnowledgeDetailFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(detailSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const kb = await prisma.knowledgeBase.findFirst({
-      where: { id: data.id, ...READABLE_KB(session.user.id) },
+      where: { id: data.id, ...READABLE_KB(context.user.id) },
       select: { id: true, name: true, description: true, icon: true, tags: true, visibility: true, createdAt: true, updatedAt: true },
     })
     if (!kb) throw new Error('未找到或无权限')
@@ -125,12 +121,11 @@ export const getKnowledgeDetailFn = createServerFn({ method: 'GET' })
 const deleteSchema = z.object({ id: z.string() })
 
 export const deleteKnowledgeFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(deleteSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await requirePermission(userId, 'knowledge', 'write')
     // DB-03：属主校验合并进软删（updateMany 计数判定），1 次查询替代 2 次并消除 TOCTOU。
     // DB-07：审计经 pro-service 独立连接（OSS 为 no-op）且自带 try/catch best-effort 语义，
@@ -154,12 +149,11 @@ const updateSchema = z.object({
 })
 
 export const updateKnowledgeFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(updateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await requirePermission(userId, 'knowledge', 'write')
     // DB-03：属主校验合并进写入（updateManyAndReturn 单查询返回更新行）
     const rows = await prisma.knowledgeBase.updateManyAndReturn({
@@ -179,15 +173,14 @@ export const updateKnowledgeFn = createServerFn({ method: 'POST' })
   })
 
 export const listDocumentsFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ kbId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     // 读口径与 createDocumentFn（READABLE_KB）统一（审计 2026-10-25 🟠）：
     // 在他人 team/general KB 里建的文档必须能被列出，否则协作链路断裂
     const kb = await prisma.knowledgeBase.findFirst({
-      where: { id: data.kbId, ...READABLE_KB(session.user.id) },
+      where: { id: data.kbId, ...READABLE_KB(context.user.id) },
       select: { id: true },
     })
     if (!kb) throw new Error('未找到或无权限')
@@ -218,15 +211,14 @@ const createDocSchema = z.object({
 })
 
 export const createDocumentFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(createDocSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await requirePermission(userId, 'knowledge', 'write')
     const kb = await prisma.knowledgeBase.findFirst({
-      where: { id: data.kbId, ...READABLE_KB(session.user.id) },
+      where: { id: data.kbId, ...READABLE_KB(context.user.id) },
       select: { id: true },
     })
     if (!kb) throw new Error('未找到或无权限')
@@ -266,17 +258,16 @@ export const createDocumentFn = createServerFn({ method: 'POST' })
 const getDocSchema = z.object({ id: z.string() })
 
 export const getDocumentFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(getDocSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const doc = await prisma.knowledgeDocument.findFirst({
       where: {
         id: data.id,
         isDeleted: false,
         // 读口径与 createDocumentFn（READABLE_KB）统一（审计 2026-10-25 🟠）
-        kb: READABLE_KB(session.user.id),
+        kb: READABLE_KB(context.user.id),
       },
       select: {
         id: true,
@@ -322,12 +313,11 @@ const updateDocSchema = z
   })
 
 export const updateDocumentFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(updateDocSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await requirePermission(userId, 'knowledge', 'write')
     // ── Yjs 多人协作 §5.3 写入门卫（任务 17）：CollabDocument 存在且 patch 含
     // content → 一律转发 collab 内部通道（room 活跃判定在 collab 侧：在线应用
@@ -469,12 +459,11 @@ export const updateDocumentFn = createServerFn({ method: 'POST' })
 const deleteDocSchema = z.object({ id: z.string() })
 
 export const deleteDocumentFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(deleteDocSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await requirePermission(userId, 'knowledge', 'write')
     // 首页判定需回读行字段（isHomepage），属主校验走单查询 findFirst（行复用）
     const doc = await assertOwned(
@@ -518,14 +507,13 @@ export const deleteDocumentFn = createServerFn({ method: 'POST' })
   })
 
 export const getHomepageDocumentFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ kbId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     // 读口径与 createDocumentFn（READABLE_KB）统一（审计 2026-10-25 🟠）
     const kb = await prisma.knowledgeBase.findFirst({
-      where: { id: data.kbId, ...READABLE_KB(session.user.id) },
+      where: { id: data.kbId, ...READABLE_KB(context.user.id) },
       select: { id: true },
     })
     if (!kb) throw new Error('未找到或无权限')
@@ -536,14 +524,13 @@ export const getHomepageDocumentFn = createServerFn({ method: 'GET' })
   })
 
 export const getDocBreadcrumbFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ docId: z.string(), kbId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     // 读口径与 createDocumentFn（READABLE_KB）统一（审计 2026-10-25 🟠）
     const kb = await prisma.knowledgeBase.findFirst({
-      where: { id: data.kbId, ...READABLE_KB(session.user.id) },
+      where: { id: data.kbId, ...READABLE_KB(context.user.id) },
       select: { id: true },
     })
     if (!kb) throw new Error('未找到或无权限')
@@ -642,12 +629,11 @@ const searchPublicKnowledge = async (
 }
 
 export const searchDocumentsFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ query: z.string(), currentKbId: z.string().optional() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     const { query, currentKbId } = data
 
     const kbs = await prisma.knowledgeBase.findMany({
@@ -728,14 +714,13 @@ export const searchDocumentsFn = createServerFn({ method: 'GET' })
   })
 
 export const listKbProjectsFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ kbId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     await assertOwned(
       prisma.knowledgeBase,
-      { where: { id: data.kbId, ...READABLE_KB(session.user.id) }, select: { id: true } },
+      { where: { id: data.kbId, ...READABLE_KB(context.user.id) }, select: { id: true } },
       '知识库不存在',
     )
     const rows = await prisma.projectKnowledgeBase.findMany({
@@ -747,12 +732,11 @@ export const listKbProjectsFn = createServerFn({ method: 'GET' })
   })
 
 export const setKbProjectsFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ kbId: z.string(), projectIds: z.array(z.string()) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     // 与其他知识库写路径同口径（审计 2026-10-25：其他写路径均有，此处曾漏）
     await requirePermission(userId, 'knowledge', 'write')
     const kb = await prisma.knowledgeBase.findFirst({
@@ -784,12 +768,11 @@ const togglePinSchema = z.object({
 })
 
 export const toggleKnowledgePinFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(togglePinSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     // DB-03：属主校验合并进写入（updateManyAndReturn 单查询返回更新行）
     const rows = await prisma.knowledgeBase.updateManyAndReturn({
       where: { id: data.kbId, userId, isDeleted: false },