@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/story/story-assoc.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { ACTIVITY_SELECT, toActivityItem } from "@/server/story/types";
 import { buildKbScopeWhere } from "./kb-scope";
 import {
@@ -48,12 +47,11 @@ import { assertStoryProjectMember } from "@/server/story/permissions";
 // 批量关联设计（PRD 文档与 UI 画板同源 Design 表，链接统一落 storyDesignLink）。
 // 设计单属主：仅本人未删除设计可关联（口径同 searchDesignsFn），越界 id 归 failed。
 export const linkDesignsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string(), designIds: z.array(z.string()).min(1) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 
@@ -99,12 +97,11 @@ export const linkDesignsFn = createServerFn({ method: "POST" })
   });
 
 export const unlinkDesignFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string(), designId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 
@@ -132,12 +129,11 @@ export const unlinkDesignFn = createServerFn({ method: "POST" })
   });
 
 export const getLinkedDesignsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await assertStoryProjectMember(data.storyId, session.user.id);
+    await assertStoryProjectMember(data.storyId, context.user.id);
 
     const links = await prisma.storyDesignLink.findMany({
       where: { storyId: data.storyId, design: { isDeleted: false } },
@@ -160,12 +156,11 @@ export const getLinkedDesignsFn = createServerFn({ method: "GET" })
   });
 
 export const searchDesignsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ query: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // Design 单属主（无项目归属），口径同 listDesignsFn / attach-guards：仅返回本人未删除设计
     const prds = await prisma.design.findMany({
@@ -204,12 +199,11 @@ async function resolveStoryScope(storyId: string, userId: string) {
 }
 
 export const listStoryAvailableKbsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const scope = await resolveStoryScope(data.storyId, session.user.id);
+    const scope = await resolveStoryScope(data.storyId, context.user.id);
     const kbs = await prisma.knowledgeBase.findMany({
       where: { AND: [scope, { isDeleted: false }] },
       select: { id: true, name: true, icon: true, visibility: true },
@@ -219,6 +213,7 @@ export const listStoryAvailableKbsFn = createServerFn({ method: "GET" })
   });
 
 export const searchKbDocsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       storyId: z.string(),
@@ -228,15 +223,13 @@ export const searchKbDocsFn = createServerFn({ method: "GET" })
       cursor: z.string().optional(),
     }),
   )
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const scope = await resolveStoryScope(data.storyId, session.user.id);
+    const scope = await resolveStoryScope(data.storyId, context.user.id);
 
     if (data.generalGroup) {
       // 态③：通用知识库分组 → 平铺列表（周报月报暂无实体内容）
-      const items = await searchGeneralGroupDocs(data.generalGroup, session.user.id, data.query);
+      const items = await searchGeneralGroupDocs(data.generalGroup, context.user.id, data.query);
       return { items, nextCursor: null };
     }
 
@@ -281,12 +274,11 @@ export const searchKbDocsFn = createServerFn({ method: "GET" })
   });
 
 export const linkDocsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string(), docIds: z.array(z.string()).min(1) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await assertStoryProjectMember(data.storyId, userId);
     const scope = await resolveStoryScope(data.storyId, userId);
 
@@ -395,12 +387,11 @@ export const linkDocsFn = createServerFn({ method: "POST" })
   });
 
 export const unlinkDocFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string(), docId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 
@@ -431,11 +422,10 @@ export const unlinkDocFn = createServerFn({ method: "POST" })
   });
 
 export const getLinkedDocsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
     const links = await prisma.storyDocLink.findMany({
       where: { storyId: data.storyId },
       include: { doc: { select: DOC_SELECT } },

package/src/server/serverFns/story/story-attachments.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { ACTIVITY_SELECT, toActivityItem } from "@/server/story/types";
 import {
   assertStoryProjectMember,
@@ -27,12 +26,11 @@ import {
 } from "@/server/story/permissions";
 
 export const removeAttachmentFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ attachmentId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const attachment = await prisma.storyAttachment.findUnique({ where: { id: data.attachmentId } });
     // 反查附件所属需求的项目成员资格（SEC-03：防删他人需求的附件）
@@ -67,12 +65,11 @@ export const removeAttachmentFn = createServerFn({ method: "POST" })
   });
 
 export const getAttachmentsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await assertStoryProjectMember(data.storyId, session.user.id);
+    await assertStoryProjectMember(data.storyId, context.user.id);
 
     const attachments = await prisma.storyAttachment.findMany({
       where: { storyId: data.storyId },

package/src/server/serverFns/story/story-children.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { assertStoryProjectMember } from "@/server/story/permissions";
 import { STORY_LIST_SELECT, castStoryUsers } from "@/server/story/types";
 
@@ -28,13 +27,12 @@ import type { StoryListItem } from "@/shared/story/types";
 const childrenSchema = z.object({ parentId: z.string() });
 
 export const listChildStoriesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(childrenSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 经父需求反查项目做成员校验
-    await assertStoryProjectMember(data.parentId, session.user.id);
+    await assertStoryProjectMember(data.parentId, context.user.id);
 
     const stories = await prisma.story.findMany({
       where: { parentId: data.parentId, archived: false },

package/src/server/serverFns/story/story-comments.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import type { CommentWithReplies, ReactionGroup } from "@/shared/story/types";
 import { USER_BRIEF_SELECT, castUserBrief } from "@/server/story/user-brief";
 import { aggregateReactions } from "@/server/story/types";
@@ -28,12 +27,11 @@ import { assertStoryProjectMember, assertStoryProjectMembership as assertProject
 
 
 export const listCommentsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await assertStoryProjectMember(data.storyId, userId);
 
     const comments = await prisma.storyComment.findMany({
@@ -84,12 +82,11 @@ const commentCreateSchema = z.object({
 });
 
 export const createCommentFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(commentCreateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 
@@ -135,12 +132,11 @@ const commentUpdateSchema = z.object({
 });
 
 export const updateCommentFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(commentUpdateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const existing = await prisma.storyComment.findUnique({
       where: { id: data.commentId },
@@ -164,12 +160,11 @@ export const updateCommentFn = createServerFn({ method: "POST" })
   });
 
 export const deleteCommentFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ commentId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const existing = await prisma.storyComment.findUnique({
       where: { id: data.commentId },

package/src/server/serverFns/story/story-crud/activities.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { assertStoryProjectMember } from "@/server/story/permissions";
 import { USER_BRIEF_SELECT, castUserBrief } from "@/server/story/user-brief";
 
@@ -30,12 +29,11 @@ const listActivitiesSchema = z.object({
 });
 
 export const listActivitiesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listActivitiesSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await assertStoryProjectMember(data.storyId, session.user.id);
+    await assertStoryProjectMember(data.storyId, context.user.id);
 
     const activities = await prisma.storyActivity.findMany({
       where: {

package/src/server/serverFns/story/story-crud/archive.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { STORY_LIST_SELECT, castStoryUsers } from "@/server/story/types";
 import { buildRoomName } from "@allbluecn/collab-core/rooms";
 import { touchCollabSnapshot } from "@/server/collab/touch-snapshot";
@@ -30,12 +29,11 @@ const archiveStorySchema = z.object({ storyId: z.string() });
 
 
 export const archiveStoryFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(archiveStorySchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 
@@ -72,12 +70,11 @@ export const archiveStoryFn = createServerFn({ method: "POST" })
   });
 
 export const unarchiveStoryFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(archiveStorySchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 

package/src/server/serverFns/story/story-crud/bulk.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { STORY_STATES, STORY_PRIORITIES, type StoryState, type StoryPriority } from "@/shared/story/constants";
 import { toDateKeyUtc } from "@/server/story/date-key";
 import type { Prisma } from "@allbluecn/database";
@@ -39,12 +38,11 @@ async function accessibleProjectIds(userId: string): Promise<string[]> {
 }
 
 export const bulkArchiveStoriesFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(idListSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     const visibleProjectIds = await accessibleProjectIds(userId);
 
     return prisma.$transaction(async (tx) => {
@@ -82,13 +80,12 @@ export const bulkArchiveStoriesFn = createServerFn({ method: "POST" })
   });
 
 export const bulkDeleteStoriesFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(idListSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 可见性过滤进 where：跨项目 id 静默跳过而非报错（SEC-03/DB-03：单语句消除跨项目删除）
-    const visibleProjectIds = await accessibleProjectIds(session.user.id);
+    const visibleProjectIds = await accessibleProjectIds(context.user.id);
     const result = await prisma.story.deleteMany({
       where: { id: { in: data.storyIds }, projectId: { in: visibleProjectIds } },
     });
@@ -112,12 +109,11 @@ const bulkUpdateSchema = z.object({
 });
 
 export const bulkUpdateStoriesFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(bulkUpdateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     const visibleProjectIds = await accessibleProjectIds(userId);
 
     return prisma.$transaction(async (tx) => {

package/src/server/serverFns/story/story-crud/detail.ts

@@ -17,20 +17,18 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { assertStoryProjectMember, assertStoryProjectMembership } from "@/server/story/permissions";
 import { STORY_LIST_SELECT, castStoryUsers } from "@/server/story/types";
 
 const detailSchema = z.object({ storyId: z.string() });
 
 export const getStoryNeighborsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(detailSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
 
     const current = await prisma.story.findUnique({
       where: { id: data.storyId },
@@ -38,7 +36,7 @@ export const getStoryNeighborsFn = createServerFn({ method: "GET" })
     });
     if (!current) return { prevId: null, nextId: null };
     // 读侧成员校验（复用已查到的 projectId，免二次反查）
-    await assertStoryProjectMembership(current.projectId, session.user.id);
+    await assertStoryProjectMembership(current.projectId, context.user.id);
 
     const [prev, next] = await Promise.all([
       prisma.story.findFirst({
@@ -57,13 +55,12 @@ export const getStoryNeighborsFn = createServerFn({ method: "GET" })
   });
 
 export const getStoryDetailFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(detailSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 读侧与写侧同口径：须为需求所属项目的有效成员（审计 2026-10-25 story 域读路径缺口）
-    await assertStoryProjectMember(data.storyId, session.user.id);
+    await assertStoryProjectMember(data.storyId, context.user.id);
     const story = await prisma.story.findUnique({
       where: { id: data.storyId },
       select: { ...STORY_LIST_SELECT, sequenceId: true },

package/src/server/serverFns/story/story-crud/label-suggest.ts

@@ -16,9 +16,8 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from "@tanstack/react-start"
-import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
-import { requireAuth } from "@/server/auth-helpers"
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { suggestLabelsCore } from "@/server/story/story-crud/label-suggest-core"
 
 const suggestSchema = z.object({
@@ -28,11 +27,10 @@ const suggestSchema = z.object({
 })
 
 export const suggestStoryLabelsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(suggestSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user?.id
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id
     if (!userId) throw new Error("用户未登录")
     return suggestLabelsCore(data, userId)
   })

package/src/server/serverFns/story/story-crud/labels.ts

@@ -17,10 +17,9 @@
 
 import { z } from "zod";
 import { getPrisma } from "@allbluecn/database/get-prisma";
-import { getRequest } from "@tanstack/react-start/server";
 import { createServerFn } from "@tanstack/react-start";
-import { requireAuth } from "@/server/auth-helpers";
-import type { Prisma } from '@allbluecn/database'
+import { authContextMiddleware } from "@/server/middlewares/auth-context";
+import type { Prisma } from "@allbluecn/database";
 import { upsertLabel } from "@/server/story/story-crud/label-upsert";
 
 const labelCreateSchema = z.object({
@@ -32,11 +31,10 @@ const labelCreateSchema = z.object({
 
 /** S24：标签范围 = 存量全局（projectId IS NULL）∪ 本项目归属。 */
 export const listLabelsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ projectId: z.string().optional() }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    await requireAuth(request);
     // null 字面量与 Prisma Nullable 字段类型不可比（TS 限制），Json 边界同款
     // 单点断言收窄（S24）
     const where = {
@@ -53,10 +51,9 @@ export const listLabelsFn = createServerFn({ method: "GET" })
 );
 
 export const createLabelFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(labelCreateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    return upsertLabel(data.name, session.user.id, data.color, data.projectId);
+    return upsertLabel(data.name, context.user.id, data.color, data.projectId);
   });

package/src/server/serverFns/story/story-crud/user-brief.ts

@@ -6,18 +6,16 @@
 // 与标签 CRUD 无关的职责混装），迁出为单一职责文件，客户端消费方同步改 import。
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { assertStoryProjectMembership } from "@/server/story/permissions";
 import { USER_BRIEF_SELECT } from "@/server/story/user-brief";
 
 export const listUsersBriefFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator((data?: { projectId?: string }) => data)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const currentUserId = session.user.id;
+    const currentUserId = context.user.id;
 
     if (data?.projectId) {
       // 项目级别：只返回项目成员——且仅对该项目的有效成员开放（防跨项目成员枚举）

package/src/server/serverFns/story/story-crud.ts

@@ -17,10 +17,9 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { buildRoomName } from "@allbluecn/collab-core/rooms";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { ensureBuiltinIndependentProject, resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { validateAssignee } from "@/server/lib/validate-assignee";
 import { withCollabGuard } from "@/server/collab/write-guard";
@@ -55,12 +54,11 @@ const listSchema = z.object({
 });
 
 export const listStoriesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const projectIds = await resolveStoryScopeProjectIds(data.projectId, userId);
 
@@ -99,12 +97,11 @@ const createSchema = z.object({
 });
 
 export const createStoryFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(createSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     let projectId = data.projectId;
     if (!projectId) {
@@ -200,12 +197,11 @@ function storyDescriptionToContent(description: string): { html: string; markdow
 }
 
 export const updateStoryFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(updateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // ── Yjs 多人协作 §5.3 写入门卫（任务 21；审查修正：提至 $transaction
     // 之前——门卫转发含网络 I/O（TTL 内重试最坏 ≈4s），事务内等待会击穿
@@ -514,12 +510,11 @@ export const updateStoryFn = createServerFn({ method: "POST" })
 const deleteSchema = z.object({ storyId: z.string() });
 
 export const deleteStoryFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(deleteSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // 先取回目标行校验成员资格，再删（SEC-03：防跨项目删除他人需求）
     const existing = await prisma.story.findUnique({