@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/notifications.ts

@@ -1,9 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import {
   NOTIFICATION_CATEGORIES,
   NOTIFICATION_FREQUENCIES,
@@ -27,12 +26,11 @@ const listSchema = z.object({
 })
 
 export const listNotificationsFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(listSchema)
-  .handler(async ({ data }): Promise<NotificationListResult> => {
+  .handler(async ({ data, context }): Promise<NotificationListResult> => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
 
     const where = {
       userId,
@@ -72,12 +70,11 @@ export const listNotificationsFn = createServerFn({ method: 'GET' })
 const markReadSchema = z.object({ id: z.string().min(1) })
 
 export const markNotificationReadFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(markReadSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await prisma.notification.updateMany({
       where: { id: data.id, userId, readAt: null },
       data: { readAt: new Date() },
@@ -86,12 +83,11 @@ export const markNotificationReadFn = createServerFn({ method: 'POST' })
   })
 
 export const markAllNotificationsReadFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({}).optional())
-  .handler(async () => {
+  .handler(async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     const result = await prisma.notification.updateMany({
       where: { userId, readAt: null },
       data: { readAt: new Date() },
@@ -102,34 +98,31 @@ export const markAllNotificationsReadFn = createServerFn({ method: 'POST' })
 const deleteSchema = z.object({ id: z.string().min(1) })
 
 export const deleteNotificationFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(deleteSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     await prisma.notification.deleteMany({ where: { id: data.id, userId } })
     return { success: true }
   })
 
 export const clearNotificationsFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({}).optional())
-  .handler(async () => {
+  .handler(async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     const result = await prisma.notification.deleteMany({ where: { userId } })
     return { success: true, count: result.count }
   })
 
 export const getUnreadCountFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({}).optional())
-  .handler(async () => {
+  .handler(async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     const count = await prisma.notification.count({
       where: { userId, readAt: null },
     })
@@ -137,12 +130,11 @@ export const getUnreadCountFn = createServerFn({ method: 'GET' })
   })
 
 export const getNotificationPreferencesFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(z.object({}).optional())
-  .handler(async () => {
+  .handler(async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    return getOrCreatePreferences(session.user.id)
+    return getOrCreatePreferences(context.user.id)
   })
 
 const preferencesSchema = z.object({
@@ -160,12 +152,11 @@ const preferencesSchema = z.object({
 export const updateNotificationPreferencesFn = createServerFn({
   method: 'POST',
 })
+  .middleware([authContextMiddleware])
   .validator(preferencesSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     const categories = { ...DEFAULT_CATEGORIES } as CategoryFrequencies
     for (const c of NOTIFICATION_CATEGORIES) {
       const v = data.categories[c]

package/src/server/serverFns/plugins/harness-plugins.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { toJsonInput } from "@/server/lib/prisma-json";
 import {
   precheckPluginCode,
@@ -62,12 +61,10 @@ const deletePluginSchema = z.object({
   id: z.string(),
 });
 
-export const listPluginsFn = createServerFn({ method: "GET" }).handler(
-  async () => {
+export const listPluginsFn = createServerFn({ method: "GET" }).middleware([authContextMiddleware]).handler(
+  async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const plugins = await prisma.harnessPlugin.findMany({
       where: { userId, isDeleted: false },
@@ -91,12 +88,11 @@ export const listPluginsFn = createServerFn({ method: "GET" }).handler(
 );
 
 export const upsertPluginFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(upsertPluginSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const precheck = precheckPluginCode(data);
     if (!precheck.ok) {
@@ -142,12 +138,11 @@ export const upsertPluginFn = createServerFn({ method: "POST" })
   });
 
 export const setPluginStatusFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(setPluginStatusSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // DB-03：属主校验合并进写入（updateMany 计数判定），1 次查询替代 findFirst+update 2 次
     const res = await prisma.harnessPlugin.updateMany({
@@ -163,12 +158,11 @@ export const setPluginStatusFn = createServerFn({ method: "POST" })
   });
 
 export const setPluginToolsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(setPluginToolsSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     for (const tool of data.tools) {
       if (!tool.name || tool.name.trim().length === 0) {
@@ -193,12 +187,11 @@ export const setPluginToolsFn = createServerFn({ method: "POST" })
   });
 
 export const deletePluginFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(deletePluginSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // DB-03：软删属主校验合并进写入（updateMany 计数判定）
     const res = await prisma.harnessPlugin.updateMany({

package/src/server/serverFns/project/module-overview.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context";
 import { assertProjectMembership } from "@/server/lib/project-membership";
 
 const projectIdSchema = z.object({ projectId: z.string().min(1) });
@@ -36,12 +35,11 @@ const moduleStorySchema = z.object({
 export type ModuleStoryItem = z.infer<typeof moduleStorySchema>;
 
 export const getModuleOverviewFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(projectIdSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await assertProjectMembership(data.projectId, session.user.id);
+    await assertProjectMembership(data.projectId, context.user.id);
 
     const [storyAgg, prdLinks] = await Promise.all([
       prisma.story.aggregate({
@@ -82,12 +80,11 @@ export const getModuleOverviewFn = createServerFn({ method: "GET" })
   });
 
 export const listModuleStoriesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(projectIdSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await assertProjectMembership(data.projectId, session.user.id);
+    await assertProjectMembership(data.projectId, context.user.id);
     const stories = await prisma.story.findMany({
       where: { projectId: data.projectId, archived: false },
       orderBy: { updatedAt: "desc" },

package/src/server/serverFns/project.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context";
 import { auditLog } from "@/server/audit";
 import { validateDisplayId } from "@/lib/project-display-id";
 import { ensureBuiltinIndependentProject, migrateStoriesToIndependentProject } from "@/server/builtin-project";
@@ -85,12 +84,11 @@ const checkDisplayIdSchema = z.object({
 });
 
 export const checkDisplayIdAvailableFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(checkDisplayIdSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const formatError = validateDisplayId(data.displayId.toUpperCase());
     if (formatError) return { available: false, reason: formatError };
@@ -111,12 +109,10 @@ export const checkDisplayIdAvailableFn = createServerFn({ method: "GET" })
   });
 
 // 列出当前用户参与的项目
-export const listProjectsFn = createServerFn({ method: "GET" }).handler(
-  async () => {
+export const listProjectsFn = createServerFn({ method: "GET" }).middleware([authContextMiddleware]).handler(
+  async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const memberships = await prisma.projectMember.findMany({
       where: { userId, status: { not: "suspended" } },
@@ -149,12 +145,10 @@ export const listProjectsFn = createServerFn({ method: "GET" }).handler(
 );
 
 // 项目精简列表（供 story 等模块创建表单选择用）
-export const listProjectsBriefFn = createServerFn({ method: "GET" }).handler(
-  async () => {
+export const listProjectsBriefFn = createServerFn({ method: "GET" }).middleware([authContextMiddleware]).handler(
+  async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await ensureBuiltinIndependentProject(userId);
 
@@ -183,12 +177,11 @@ const createSchema = z.object({
 });
 
 export const createProjectFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(createSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const workspace = await prisma.workspace.findUnique({
       where: { id: data.workspaceId },
@@ -228,12 +221,11 @@ export const createProjectFn = createServerFn({ method: "POST" })
 const detailSchema = z.object({ projectId: z.string() });
 
 export const getProjectDetailFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(detailSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await requireProjectMember(data.projectId, userId);
 
     const project = await prisma.project.findUnique({
@@ -270,12 +262,11 @@ const updateSchema = z.object({
 });
 
 export const updateProjectFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(updateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await requireProjectMember(data.projectId, userId, ["owner", "admin"]);
 
     const { projectId, displayId, ...rest } = data;
@@ -303,12 +294,11 @@ const deleteSchema = z.object({
 });
 
 export const deleteProjectFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(deleteSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await requireProjectMember(data.projectId, userId, ["owner"]);
 
     const storyCount = await prisma.story.count({ where: { projectId: data.projectId } });
@@ -340,12 +330,11 @@ export const deleteProjectFn = createServerFn({ method: "POST" })
 
 // 列出项目成员
 export const listProjectMembersFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(detailSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await requireProjectMember(data.projectId, userId);
 
     const project = await prisma.project.findUnique({
@@ -383,12 +372,11 @@ const addMemberSchema = z.object({
 });
 
 export const addProjectMemberFromTeamFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(addMemberSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const currentUserId = session.user.id;
+    const currentUserId = context.user.id;
     await requireProjectMember(data.projectId, currentUserId, ["owner", "admin"]);
 
     const project = await prisma.project.findUnique({
@@ -444,12 +432,11 @@ const removeMemberSchema = z.object({
 });
 
 export const removeProjectMemberFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(removeMemberSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const currentUserId = session.user.id;
+    const currentUserId = context.user.id;
     const membership = await requireProjectMember(
       data.projectId,
       currentUserId,
@@ -486,12 +473,11 @@ const updateRoleSchema = z.object({
 });
 
 export const updateMemberRoleFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(updateRoleSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const currentUserId = session.user.id;
+    const currentUserId = context.user.id;
     await requireProjectMember(data.projectId, currentUserId, ["owner"]);
 
     // SEC-04：按 projectId 收敛查找，防止跨项目 memberId 操作（IDOR）
@@ -524,12 +510,11 @@ const activitiesSchema = z.object({
 });
 
 export const listProjectActivitiesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(activitiesSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await requireProjectMember(data.projectId, userId);
 
     return prisma.projectActivity.findMany({
@@ -557,12 +542,11 @@ const projectActivityDataSchema = z.object({
 });
 
 export const getProjectActivityDataFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(projectActivityDataSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await requireProjectMember(data.projectId, userId);
 
     const timezone = data.timezone || "Asia/Shanghai";
@@ -596,23 +580,20 @@ export const getProjectActivityDataFn = createServerFn({ method: "GET" })
   });
 
 // 确保用户拥有内置独立需求项目（供客户端调用）
-export const ensureBuiltinProjectFn = createServerFn({ method: "GET" }).handler(async () => {
+export const ensureBuiltinProjectFn = createServerFn({ method: "GET" }).middleware([authContextMiddleware]).handler(async ({ context }) => {
     const prisma = await getPrisma()
-  const request = getRequest();
-  const session = await requireAuth(request);
-  const userId = session.user.id;
+  const userId = context.user.id;
   const projectId = await ensureBuiltinIndependentProject(userId);
   return { id: projectId, name: BUILTIN_INDEPENDENT_NAME, displayId: BUILTIN_INDEPENDENT_DISPLAY_ID, icon: BUILTIN_INDEPENDENT_ICON };
 });
 
 export const listProjectKbsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ projectId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 读侧成员校验（审计 2026-10-25：任意登录用户可枚举任意项目关联的知识库）
-    await requireProjectMember(data.projectId, session.user.id);
+    await requireProjectMember(data.projectId, context.user.id);
     const rows = await prisma.projectKnowledgeBase.findMany({
       where: { projectId: data.projectId },
       select: {
@@ -624,13 +605,12 @@ export const listProjectKbsFn = createServerFn({ method: "GET" })
   });
 
 export const setProjectKbsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ projectId: z.string(), kbIds: z.array(z.string()) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 关联知识库改变项目全员可见范围：限 owner / admin（与其余项目级写路径口径一致）
-    await requireProjectMember(data.projectId, session.user.id, ["owner", "admin"]);
+    await requireProjectMember(data.projectId, context.user.id, ["owner", "admin"]);
     if (data.kbIds.length > 0) {
       const valid = await prisma.knowledgeBase.findMany({
         where: { id: { in: data.kbIds }, visibility: "team", isDeleted: false },

package/src/server/serverFns/references/create.ts

@@ -16,11 +16,10 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { createReference } from '@/server/references/engine'
 import { assertEntityAccessible } from '@/server/references/access'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 const createReferenceSchema = z.object({
   sourceModule: z.string().min(1),
@@ -34,11 +33,10 @@ const createReferenceSchema = z.object({
 })
 
 export const createReferenceFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(createReferenceSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id
     // 审计 🟠（2026-10-25）：engine 无属主校验，source/target 须逐一断言归属
     await assertEntityAccessible(userId, data.sourceModule, data.sourceEntityId, data.entityType)
     await assertEntityAccessible(userId, data.targetModule, data.targetEntityId, data.entityType)

package/src/server/serverFns/references/resolve.ts

@@ -16,11 +16,10 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { resolveReferences } from '@/server/references/engine'
 import { assertEntityAccessible, filterAccessibleRefs } from '@/server/references/access'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 const schema = z.object({
   sourceModule: z.string().min(1),
@@ -28,11 +27,10 @@ const schema = z.object({
 })
 
 export const resolveReferencesFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(schema)
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id
     // 审计 🟠（2026-10-25）：engine 无属主过滤——先断言 source 归属，再过滤
     // target 不可访问（他人/未登记模块）的引用行，防跨用户枚举
     await assertEntityAccessible(userId, data.sourceModule, data.sourceEntityId)

package/src/server/serverFns/references/search.ts

@@ -16,11 +16,10 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { searchReferences } from '@/server/references/engine'
 import { filterAccessibleRefs } from '@/server/references/access'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 const schema = z.object({
   q: z.string().default(''),
@@ -28,11 +27,10 @@ const schema = z.object({
 })
 
 export const searchReferencesFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(schema)
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id
     const types = data.types?.split(',').filter(Boolean)
     const results = await searchReferences(data.q, types)
     // 审计 🟠（2026-10-25）：engine 为全局索引（无用户/项目维度），按结果行

package/src/server/serverFns/share/design/[designId]/events.ts

@@ -16,9 +16,8 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { assertDesignReadable } from '@/server/design/access'
 
 const schema = z.object({
@@ -29,10 +28,9 @@ const schema = z.object({
 // 可读（属主或存在有效分享），防对任意/不存在 designId 恒返回已订阅的假契约
 // （审计 🟡 2026-10-25）。真实事件推送落地时须替换为实际订阅语义并重命名。
 export const shareEventsFn = createServerFn({ method: 'GET' })
+  .middleware([authContextMiddleware])
   .validator(schema)
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    await assertDesignReadable(data.designId, session.user.id)
+  .handler(async ({ data, context }) => {
+    await assertDesignReadable(data.designId, context.user.id)
     return { designId: data.designId, subscribed: true }
   })

package/src/server/serverFns/sso.ts

@@ -3,7 +3,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { getProService } from '@/server/pro-services'
-import { checkRateLimit } from '@/lib/pacer'
+import { checkRateLimit } from '@/server/lib/rate-limit'
 
 const SSO_DOMAIN_RATE_LIMIT = { max: 20, windowMs: 60_000 }
 // 审计 ⚪（2026-10-25）：仅按 domain 限流时，攻击者可轮换不同 domain 无限探测