@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/story/__tests__/bulk.test.ts

@@ -21,6 +21,11 @@ vi.mock("@tanstack/react-start", () => ({
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
@@ -31,13 +36,41 @@ vi.mock("@tanstack/react-start", () => ({
           if (this._validator && data !== undefined) {
             data = this._validator.parse ? this._validator.parse(data) : data;
           }
-          return fn({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+          // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+          let context: any = {};
+          for (const mw of this._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
+          }
+          return fn({ data, context });
         };
         return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({

package/src/server/serverFns/story/__tests__/story-assoc.test.ts

@@ -21,6 +21,11 @@ vi.mock("@tanstack/react-start", () => ({
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
@@ -31,13 +36,41 @@ vi.mock("@tanstack/react-start", () => ({
           if (this._validator && data !== undefined) {
             data = this._validator.parse ? this._validator.parse(data) : data;
           }
-          return fn({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+          // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+          let context: any = {};
+          for (const mw of this._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
+          }
+          return fn({ data, context });
         };
         return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({

package/src/server/serverFns/story/__tests__/story-attachments.test.ts

@@ -22,6 +22,11 @@ vi.mock("@tanstack/react-start", () => ({
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
@@ -32,13 +37,41 @@ vi.mock("@tanstack/react-start", () => ({
           if (this._validator && data !== undefined) {
             data = this._validator.parse ? this._validator.parse(data) : data;
           }
-          return fn({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+          // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+          let context: any = {};
+          for (const mw of this._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
+          }
+          return fn({ data, context });
         };
         return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({

package/src/server/serverFns/story/__tests__/story-crud-date-key.test.ts

@@ -11,34 +11,59 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 
 vi.mock("@tanstack/react-start", () => ({
-  createServerFn: (config: unknown) => {
-    const api: {
-      _validator: unknown;
-      validator(schema: unknown): unknown;
-      handler(
-        fn: (args: { data: unknown }) => unknown,
-      ): (args: { data: unknown }) => Promise<unknown>;
-    } = {
+  createServerFn: (config: any) => {
+    const api: any = {
       _validator: undefined,
-      validator(schema: unknown) {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
+      validator(schema: any) {
         this._validator = schema;
         return this;
       },
-      handler(fn: (args: { data: unknown }) => unknown) {
-        const validate = () => this._validator;
-        return async (args: { data: unknown }) => {
+      handler(fn: Function) {
+        const wrapped = async (args: any) => {
           let data = args?.data;
-          const schema = validate();
-          if (schema && data !== undefined) {
-            const parse = (schema as { parse?: (v: unknown) => unknown }).parse;
-            if (typeof parse === "function") data = parse(data);
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse ? this._validator.parse(data) : data;
+          }
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+          // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+          let context: any = {};
+          for (const mw of this._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
           }
-          return fn({ data });
+          return fn({ data, context });
         };
+        return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({

package/src/server/serverFns/story/__tests__/story-dependencies.test.ts

@@ -21,6 +21,11 @@ vi.mock("@tanstack/react-start", () => ({
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
@@ -31,13 +36,41 @@ vi.mock("@tanstack/react-start", () => ({
           if (this._validator && data !== undefined) {
             data = this._validator.parse ? this._validator.parse(data) : data;
           }
-          return fn({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+          // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+          let context: any = {};
+          for (const mw of this._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
+          }
+          return fn({ data, context });
         };
         return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({

package/src/server/serverFns/story/__tests__/story-gantt-deps.test.ts

@@ -23,6 +23,11 @@ vi.mock("@tanstack/react-start", () => ({
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
@@ -33,13 +38,41 @@ vi.mock("@tanstack/react-start", () => ({
           if (this._validator && data !== undefined) {
             data = this._validator.parse ? this._validator.parse(data) : data;
           }
-          return fn({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+          // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+          let context: any = {};
+          for (const mw of this._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
+          }
+          return fn({ data, context });
         };
         return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({

package/src/server/serverFns/story/__tests__/story-groups.test.ts

@@ -21,6 +21,11 @@ vi.mock("@tanstack/react-start", () => ({
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
@@ -31,13 +36,41 @@ vi.mock("@tanstack/react-start", () => ({
           if (this._validator && data !== undefined) {
             data = this._validator.parse ? this._validator.parse(data) : data;
           }
-          return fn({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+          // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+          let context: any = {};
+          for (const mw of this._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
+          }
+          return fn({ data, context });
         };
         return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({

package/src/server/serverFns/story/__tests__/story-read-path-authz.test.ts

@@ -21,23 +21,59 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 vi.mock("@tanstack/react-start", () => ({
-  createServerFn: (_config: unknown) => {
+  createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
       },
       handler(fn: Function) {
-        return async (args: any) => {
+        const wrapped = async (args: any) => {
           let data = args?.data;
-          if (this._validator && data !== undefined && this._validator.parse) data = this._validator.parse(data);
-          return fn({ data });
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse ? this._validator.parse(data) : data;
+          }
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+          // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+          let context: any = {};
+          for (const mw of this._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
+          }
+          return fn({ data, context });
         };
+        return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => undefined }));
 vi.mock("@/server/auth-helpers", () => ({ requireAuth: vi.fn(async () => ({ user: { id: "u1" } })) }));

package/src/server/serverFns/story/__tests__/story-search.test.ts

@@ -23,6 +23,11 @@ vi.mock("@tanstack/react-start", () => ({
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
@@ -33,13 +38,41 @@ vi.mock("@tanstack/react-start", () => ({
           if (this._validator && data !== undefined) {
             data = this._validator.parse ? this._validator.parse(data) : data;
           }
-          return fn({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+          // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+          let context: any = {};
+          for (const mw of this._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
+          }
+          return fn({ data, context });
         };
         return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({

package/src/server/serverFns/story/__tests__/story-transfer.test.ts

@@ -23,6 +23,11 @@ vi.mock("@tanstack/react-start", () => ({
   createServerFn: (config: any) => {
     const api: any = {
       _validator: undefined,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
       validator(schema: any) {
         this._validator = schema;
         return this;
@@ -33,13 +38,41 @@ vi.mock("@tanstack/react-start", () => ({
           if (this._validator && data !== undefined) {
             data = this._validator.parse ? this._validator.parse(data) : data;
           }
-          return fn({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+          // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+          let context: any = {};
+          for (const mw of this._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
+          }
+          return fn({ data, context });
         };
         return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({

package/src/server/serverFns/story/link-preview.ts

@@ -16,9 +16,8 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { checkUserActionRateLimit } from "@/server/lib/rate-limit";
 import { assertFetchableUrl } from "@/server/fetch-guard";
 
@@ -54,15 +53,14 @@ function isFrameAncestorsAllowed(csp: string, targetUrl: string, appOrigin?: str
 }
 
 export const checkLinkEmbeddableFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(checkSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-    if (!session?.user?.id) {
+  .handler(async ({ data, context }) => {
+    if (!context.user.id) {
       return { embeddable: false as const, reason: "invalid" as const };
     }
     // P3：外链嵌入预检会向目标站点发起服务端请求，per-minute 频控防滥用
-    await checkUserActionRateLimit(session.user.id, "linkPreview");
+    await checkUserActionRateLimit(context.user.id, "linkPreview");
 
     // SEC-06：统一 SSRF 守卫（覆盖 IPv6-mapped/整数 IP 混淆等自制检查漏掉的形态），
     // 拒绝话术与旧实现一致（embeddable:false + reason:"invalid"）