@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/story/story-dependencies.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { STORY_LIST_SELECT, castStoryUsers, ACTIVITY_SELECT, toActivityItem } from "@/server/story/types";
 import type { Prisma } from "@allbluecn/database";
@@ -76,6 +75,7 @@ async function graphReaches(
 }
 
 export const addDependenciesFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       items: z
@@ -89,11 +89,9 @@ export const addDependenciesFn = createServerFn({ method: "POST" })
         .min(1),
     }),
   )
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // 本批全部端点需求的项目成员资格（SEC-03：防跨项目建依赖边）
     await assertStoriesProjectMember(
@@ -196,6 +194,7 @@ export const addDependenciesFn = createServerFn({ method: "POST" })
   });
 
 export const updateDependencyFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       depId: z.string(),
@@ -204,11 +203,9 @@ export const updateDependencyFn = createServerFn({ method: "POST" })
       type: edgeTypeSchema,
     }),
   )
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const dep = await prisma.storyDependency.findUnique({ where: { id: data.depId } });
     if (!dep) throw new Error("依赖关系不存在");
@@ -272,12 +269,11 @@ export const updateDependencyFn = createServerFn({ method: "POST" })
   });
 
 export const removeDependencyFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ depId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const dep = await prisma.storyDependency.findUnique({ where: { id: data.depId } });
     if (!dep) return null;
@@ -308,12 +304,11 @@ export const removeDependencyFn = createServerFn({ method: "POST" })
   });
 
 export const getDependenciesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await assertStoryProjectMember(data.storyId, session.user.id);
+    await assertStoryProjectMember(data.storyId, context.user.id);
 
     const deps = await prisma.storyDependency.findMany({
       where: { OR: [{ targetId: data.storyId }, { sourceId: data.storyId }] },
@@ -351,12 +346,11 @@ export const getDependenciesFn = createServerFn({ method: "GET" })
 
 // 甘特图依赖箭头数据源（列表/分组场景）：按项目范围聚合批量取依赖边
 export const listStoryDependenciesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ projectId: z.string().optional() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // 「全部项目」聚合语义：缺省 → 成员关系内全部 projectId；显式 → 单元素数组（含鉴权）
     const projectIds = await resolveStoryScopeProjectIds(data.projectId, userId);

package/src/server/serverFns/story/story-groups.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { GROUP_KEYS, ORDER_KEYS, ORDER_DIRECTIONS, resolveOrderDir } from "@/shared/list-kit/display-values";
 import type { GroupKey, OrderKey } from "@/shared/list-kit/display-types";
@@ -57,12 +56,11 @@ const schema = z.object({
 });
 
 export const listStoriesInGroupFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(schema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const projectIds = await resolveStoryScopeProjectIds(data.projectId, userId);
 
@@ -120,12 +118,11 @@ const allGroupsItemsSchema = z.object({
 });
 
 export const listAllGroupsItemsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(allGroupsItemsSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const projectIds = await resolveStoryScopeProjectIds(data.projectId, userId);
 
@@ -235,12 +232,11 @@ function sortGroupKeys(groupBy: GroupKey, keys: string[]): string[] {
 }
 
 export const listStoryGroupsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listGroupsSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const projectIds = await resolveStoryScopeProjectIds(data.projectId, userId);
 

package/src/server/serverFns/story/story-links.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { ACTIVITY_SELECT, toActivityItem } from "@/server/story/types";
 import { assertStoryProjectMember, assertStoryProjectMembership as assertProjectMembership } from "@/server/story/permissions";
 import { httpUrl } from "@/server/lib/validators";
@@ -27,12 +26,11 @@ import { httpUrl } from "@/server/lib/validators";
 
 
 export const addLinkFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string(), url: httpUrl, title: z.string().optional(), description: z.string().optional() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 
@@ -59,12 +57,11 @@ export const addLinkFn = createServerFn({ method: "POST" })
   });
 
 export const updateLinkFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ linkId: z.string(), url: httpUrl.optional(), title: z.string().optional(), description: z.string().optional() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // 反查链接所属需求的项目成员资格（SEC-03：防改他人需求的链接）
     const existing = await prisma.storyLink.findUnique({
@@ -97,12 +94,11 @@ export const updateLinkFn = createServerFn({ method: "POST" })
   });
 
 export const removeLinkFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ linkId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const link = await prisma.storyLink.findUnique({
       where: { id: data.linkId },
@@ -131,12 +127,11 @@ export const removeLinkFn = createServerFn({ method: "POST" })
   });
 
 export const getLinksFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await assertStoryProjectMember(data.storyId, session.user.id);
+    await assertStoryProjectMember(data.storyId, context.user.id);
 
     const links = await prisma.storyLink.findMany({
       where: { storyId: data.storyId },

package/src/server/serverFns/story/story-reactions.ts

@@ -17,21 +17,19 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { aggregateReactions } from "@/server/story/types";
 import { assertStoryProjectMember, assertStoryProjectMembership as assertProjectMembership } from "@/server/story/permissions";
 
 
 
 export const listStoryReactionsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await assertStoryProjectMember(data.storyId, userId);
 
     const reactions = await prisma.storyReaction.findMany({
@@ -43,12 +41,11 @@ export const listStoryReactionsFn = createServerFn({ method: "GET" })
   });
 
 export const addStoryReactionFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string(), emoji: z.string().min(1) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 
@@ -75,12 +72,11 @@ export const addStoryReactionFn = createServerFn({ method: "POST" })
   });
 
 export const toggleStoryReactionFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ storyId: z.string(), emoji: z.string().min(1) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 
@@ -111,12 +107,11 @@ export const toggleStoryReactionFn = createServerFn({ method: "POST" })
   });
 
 export const toggleCommentReactionFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ commentId: z.string(), emoji: z.string().min(1) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // 反查评论所属需求的项目成员资格（SEC-03：防对他人需求评论表态）
     const comment = await prisma.storyComment.findUnique({

package/src/server/serverFns/story/story-search.ts

@@ -17,18 +17,16 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { ensureBuiltinIndependentProject, resolveStoryScopeProjectId } from "@/server/builtin-project";
 
 export const searchStoriesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ query: z.string(), excludeIds: z.array(z.string()).optional(), projectId: z.string().optional() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     // R11：可选 projectId scope（BUG 详情关联需求选择器按 bug 所属项目搜索）。
     // 不传保持既有行为（用户独立项目）；传无效/非成员项目时
     // resolveStoryScopeProjectId 静默回退独立项目，与列表 scope 解析同口径。
@@ -69,15 +67,14 @@ const reorderStoriesSchema = z.object({
 });
 
 export const reorderStoriesFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(reorderStoriesSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 可见性过滤进 where（SEC-03：防跨项目改他人需求排序）；updateMany 对
     // 越权/不存在 id 静默跳过，不中断整批合法排序
     const memberships = await prisma.projectMember.findMany({
-      where: { userId: session.user.id, status: { not: "suspended" } },
+      where: { userId: context.user.id, status: { not: "suspended" } },
       select: { projectId: true },
     });
     const visibleProjectIds = memberships.map((m) => m.projectId);

package/src/server/serverFns/story/story-transfer.ts

@@ -17,11 +17,10 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { buildRoomName } from "@allbluecn/collab-core/rooms";
 import type { Prisma } from "@allbluecn/database";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { BUILTIN_INDEPENDENT_DISPLAY_ID } from "@/lib/builtin-project";
 import { resolveStoryScopeProjectId } from "@/server/builtin-project";
 import { withCollabGuard } from "@/server/collab/write-guard";
@@ -139,12 +138,11 @@ const transferToProjectSchema = z.object({
 });
 
 export const transferStoryToProjectFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(transferToProjectSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     return runTransferWithIdentifierRetry(async (tx) => {
       const existing = await tx.story.findUnique({
@@ -222,12 +220,11 @@ const transferAsChildSchema = z.object({
 });
 
 export const transferStoryAsChildFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(transferAsChildSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     if (data.storyId === data.parentStoryId) {
       throw new Error("不能将需求设为自身的子需求");
@@ -420,12 +417,11 @@ const listProjectStoriesSchema = z.object({
 });
 
 export const listProjectStoriesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listProjectStoriesSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // 读门槛与列表 scope 同口径（SEC-03）：传 projectId 走 resolveStoryScopeProjectId
     // （非成员静默回退独立项目）；不传（「全部项目」选择器）只返回用户为有效成员的项目

package/src/server/serverFns/story/story-tree.ts

@@ -19,21 +19,19 @@
 // 无 rootId 时返回全部项目的根需求全字段（跨项目泄露）、二者均无成员校验。可从 git 恢复。
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { buildRoomName } from "@allbluecn/collab-core/rooms";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { withCollabGuard } from "@/server/collab/write-guard";
 import { checkDescendant } from "@/server/story/types";
 import { assertStoryProjectMembership as assertProjectMembership } from "@/server/story/permissions";
 
 export const addChildFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ parentId: z.string(), childId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const existingChild = await prisma.story.findUnique({
       where: { id: data.childId },
@@ -119,12 +117,11 @@ export const addChildFn = createServerFn({ method: "POST" })
   });
 
 export const removeChildFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ childId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const existing = await prisma.story.findUnique({
       where: { id: data.childId },

package/src/server/serverFns/story-display-options.ts

@@ -19,7 +19,7 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start"
 import { getRequest } from "@tanstack/react-start/server"
-import { requireAuth } from "@/server/auth-helpers"
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { requireFeature } from "@/server/entitlements"
 import { isProEdition } from "@/server/pro-services"
 import { toJsonInput } from "@/server/lib/prisma-json"
@@ -102,12 +102,11 @@ function parseStoredOptions(raw: unknown): DisplayOptions {
 // story-view.ts 共用单一来源，审计 🔵/🟡 2026-10-25）
 
 /** 获取当前用户持久化的 Display Options（非法/缺失字段已回退默认值） */
-export const getStoryDisplayOptionsFn = createServerFn({ method: "GET" }).handler(
-  async () => {
+export const getStoryDisplayOptionsFn = createServerFn({ method: "GET" }).middleware([authContextMiddleware]).handler(
+  async ({ context }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
 
     const user = await prisma.user.findUnique({
       where: { id: userId },
@@ -134,12 +133,12 @@ export const getStoryDisplayOptionsFn = createServerFn({ method: "GET" }).handle
 
 /** 保存当前用户的 Display Options，返回更新后的完整对象 */
 export const updateStoryDisplayOptionsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(displayOptionsSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
 
     // 服务端强制校验：pageSize > 200（500/1000）为 Pro 专属，前端锁定只是 UX
     // OSS 环境直接 cap 到 200；Pro 环境走 feature gate

package/src/server/serverFns/story-view.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { toJsonInput } from "@/server/lib/prisma-json";
 import { displayOptionsSchema } from "@/server/lib/display-options-schema";
 import { toSavedView } from "@/components/story/views/view-types";
@@ -40,11 +39,9 @@ const SELECT = {
   updatedAt: true,
 } satisfies Prisma.StoryFilterViewDefaultArgs["select"];
 
-export const listStoryViewsFn = createServerFn({ method: "GET" }).handler(async () => {
+export const listStoryViewsFn = createServerFn({ method: "GET" }).middleware([authContextMiddleware]).handler(async ({ context }) => {
     const prisma = await getPrisma()
-  const request = getRequest();
-  const session = await requireAuth(request);
-  const userId = session.user.id;
+  const userId = context.user.id;
   const rows = await prisma.storyFilterView.findMany({
     where: { userId },
     orderBy: { sortOrder: "asc" },
@@ -74,12 +71,11 @@ const createSchema = z.object({
 });
 
 export const createStoryViewFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(createSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     // 写入闸门：非法形状（缺 orderDir/pageSize 等）在落库前被拒
     const displayOptions = displayOptionsSchema.parse(data.displayOptions);
     const row = await prisma.storyFilterView.create({
@@ -108,12 +104,11 @@ const updateSchema = z.object({
 });
 
 export const updateStoryViewFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(updateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     const { id, ...patch } = data;
     const data2: Record<string, unknown> = {};
     if (patch.name !== undefined) data2.name = patch.name;
@@ -135,12 +130,11 @@ export const updateStoryViewFn = createServerFn({ method: "POST" })
 const deleteSchema = z.object({ id: z.string() });
 
 export const deleteStoryViewFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(deleteSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await prisma.storyFilterView.delete({ where: { id: data.id, userId } });
     return { success: true };
   });

package/src/server/serverFns/tasks/task-crud.ts

@@ -4,16 +4,15 @@
 // 核心）与 lookupCreateSource 等辅助逻辑一律文件内非导出成员——createAiTaskFn 的
 // runNow 与 runAiTaskFn 复用同一个 runTaskExecution，保证两条入口的限流/占位/建
 // run/调度执行体行为完全同款。
-// 鉴权惯例（同 task-queries）：serverFn 是独立 RPC 入口，路由层守卫拦不到，handler
-// 首行业务必须 requireAuth(getRequest()) 自查；run 入口鉴权后先过
+// 鉴权惯例（同 task-queries）：serverFn 是独立 RPC 入口，路由层守卫拦不到，
+// 链上挂 authContextMiddleware 注入 context.user；run 入口鉴权后先过
 // checkAiRateLimit(userId, "aiTask")，再做属主/成员校验。
 // 并发裁决（双击防重入）：updateMany 以 status:{not:"running"} 做条件更新占位，
 // count===0 即已有在跑实例，抛「任务正在运行」，不建 run 不调执行体。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { assertProjectMembership } from "@/server/bug/bug-permissions";
 import { checkAiRateLimit } from "@/server/lib/rate-limit";
 import { executeAiTaskRun } from "@/server/ai-task/executor";
@@ -142,11 +141,10 @@ const createAiTaskSchema = z
  * 做最小存在性校验（仅上下文提示、非权限边界）；源型落库以源条目的项目为准（run 前
  * 成员重校验的基准，显式传值不覆盖），runNow 复用执行核心 */
 export const createAiTaskFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(createAiTaskSchema)
-  .handler(async ({ data }): Promise<{ id: string; runId?: string }> => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+  .handler(async ({ data, context }): Promise<{ id: string; runId?: string }> => {
+    const userId = context.user.id;
 
 
     const prisma = await getPrisma();
@@ -211,13 +209,12 @@ export const createAiTaskFn = createServerFn({ method: "POST" })
     return { id: task.id };
   });
 
-/** 手动运行一次：requireAuth → 限流 → 执行核心（属主/成员/并发占位/建 run/调度） */
+/** 手动运行一次：鉴权 middleware → 限流 → 执行核心（属主/成员/并发占位/建 run/调度） */
 export const runAiTaskFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string().min(1) }))
-  .handler(async ({ data }): Promise<{ runId: string }> => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+  .handler(async ({ data, context }): Promise<{ runId: string }> => {
+    const userId = context.user.id;
 
     await checkAiRateLimit(userId, "aiTask");
 
@@ -227,11 +224,10 @@ export const runAiTaskFn = createServerFn({ method: "POST" })
 
 /** 删除任务：属主过滤 + running 拒绝；runs 级联由 schema Cascade 承担 */
 export const deleteAiTaskFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ id: z.string().min(1) }))
-  .handler(async ({ data }): Promise<{ ok: true }> => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+  .handler(async ({ data, context }): Promise<{ ok: true }> => {
+    const userId = context.user.id;
 
 
     const prisma = await getPrisma();