@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/tasks/task-queries.ts

@@ -2,14 +2,13 @@
 // （我的任务列表）/ getAiTaskFn（任务详情 + run 历史）。本文件只准导出 createServerFn
 // 产物（纯净红线，CI 守护）：serializeTask、probeSourceExists 等辅助逻辑一律文件内
 // 非导出成员。
-// 鉴权惯例（同 testcase-crud）：serverFn 是独立 RPC 入口，路由层守卫拦不到，handler
-// 首行业务必须 requireAuth(getRequest()) 自查。
+// 鉴权惯例（同 testcase-crud）：serverFn 是独立 RPC 入口，路由层守卫拦不到，
+// 链上挂 authContextMiddleware 注入 context.user。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import type { Prisma } from "@allbluecn/database";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { fetchAssignedToMe } from "@/server/ai-task/assigned-query";
 import type { AssignedResult } from "@/server/ai-task/types";
 
@@ -58,11 +57,9 @@ async function probeSourceExists(
 }
 
 /** 「分配给我的」三表聚合（story → bug → testcase），直接透传任务 3 的查询结果 */
-export const listAssignedToMeFn = createServerFn({ method: "GET" }).handler(
-  async (): Promise<AssignedResult> => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+export const listAssignedToMeFn = createServerFn({ method: "GET" }).middleware([authContextMiddleware]).handler(
+  async ({ context }): Promise<AssignedResult> => {
+    const userId = context.user.id;
 
     return fetchAssignedToMe(userId);
   },
@@ -70,11 +67,9 @@ export const listAssignedToMeFn = createServerFn({ method: "GET" }).handler(
 
 /** 我的任务列表：归属圈定 + updatedAt 倒序投影（含 instruction 供前端指令搜索，
  *  useTaskFilter 纯函数按字段存在性自适应——任务 47 的过渡兼容即插即用） */
-export const listAiTasksFn = createServerFn({ method: "GET" }).handler(
-  async () => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+export const listAiTasksFn = createServerFn({ method: "GET" }).middleware([authContextMiddleware]).handler(
+  async ({ context }) => {
+    const userId = context.user.id;
 
     const prisma = await getPrisma();
     const rows = await prisma.aiTask.findMany({
@@ -113,15 +108,14 @@ const getAiTaskSchema = z.object({ id: z.string().min(1) });
 
 /** 任务详情：全字段 task（附关联项目名，信息区展示）+ run 历史（startedAt 倒序）+ 源条目存在性 */
 export const getAiTaskFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(getAiTaskSchema)
-  .handler(async ({ data }): Promise<{
+  .handler(async ({ data, context }): Promise<{
     task: ReturnType<typeof serializeTask> & { projectName: string | null };
     runs: AiTaskRunRow[];
     sourceExists: boolean | null;
   }> => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const prisma = await getPrisma();
 

package/src/server/serverFns/team.ts

@@ -3,7 +3,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import crypto from 'node:crypto'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { assertOwned } from '@/server/lib/ownership'
 import { requireTeamSeats } from '@/server/resources'
 import { auditLog } from '@/server/audit'
@@ -31,12 +31,11 @@ const createInvitationSchema = z.object({
 })
 
 export const createTeamInvitationFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(createInvitationSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const ownerId = session.user.id
+    const ownerId = context.user.id
 
     const email = data.channel === 'email' ? data.email!.toLowerCase() : null
 
@@ -129,12 +128,10 @@ export const createTeamInvitationFn = createServerFn({ method: 'POST' })
     return { success: true, token, invitationId: invitation.id }
   })
 
-export const listTeamInvitationsFn = createServerFn({ method: 'GET' }).handler(async () => {
+export const listTeamInvitationsFn = createServerFn({ method: 'GET' }).middleware([authContextMiddleware]).handler(async ({ context }) => {
     const prisma = await getPrisma()
   try {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const ownerId = session.user.id
+    const ownerId = context.user.id
     const now = new Date()
 
     await prisma.teamInvitation.updateMany({
@@ -187,12 +184,11 @@ export const listTeamInvitationsFn = createServerFn({ method: 'GET' }).handler(a
 const revokeSchema = z.object({ invitationId: z.string() })
 
 export const clearExpiredInvitationsFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({}))
-  .handler(async () => {
+  .handler(async ({ context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const ownerId = session.user.id
+    const ownerId = context.user.id
     const res = await prisma.teamInvitation.deleteMany({
       where: { ownerId, status: 'expired', channel: 'email' },
     })
@@ -208,12 +204,11 @@ export const clearExpiredInvitationsFn = createServerFn({ method: 'POST' })
   })
 
 export const revokeTeamInvitationFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(revokeSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const ownerId = session.user.id
+    const ownerId = context.user.id
     // DB-03：属主校验并入单次 findFirst（消除查后比对二次往返与 TOCTOU），文案保持
     const inv = await assertOwned(prisma.teamInvitation, { where: { id: data.invitationId, ownerId } }, '邀请不存在')
     if (inv.status !== 'pending' && inv.status !== 'pending_approval') throw new Error('仅待处理/待批准邀请可撤销')
@@ -238,12 +233,11 @@ export const revokeTeamInvitationFn = createServerFn({ method: 'POST' })
   })
 
 export const resendTeamInvitationFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(revokeSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const ownerId = session.user.id
+    const ownerId = context.user.id
     // DB-03：属主校验并入单次 findFirst（消除查后比对二次往返与 TOCTOU），文案保持
     const inv = await assertOwned(prisma.teamInvitation, { where: { id: data.invitationId, ownerId } }, '邀请不存在')
     if (inv.status !== 'pending' && inv.status !== 'expired') {
@@ -282,12 +276,11 @@ export const resendTeamInvitationFn = createServerFn({ method: 'POST' })
   })
 
 export const refreshTeamInvitationLinkFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ expiresInDays: z.number().int().min(1).max(365).optional() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const ownerId = session.user.id
+    const ownerId = context.user.id
 
     await requireTeamSeats(ownerId, 'member', 1)
 
@@ -333,11 +326,9 @@ export const refreshTeamInvitationLinkFn = createServerFn({ method: 'POST' })
 
 // ---------- 成员管理 ----------
 
-export const listTeamMembersFn = createServerFn({ method: 'GET' }).handler(async () => {
+export const listTeamMembersFn = createServerFn({ method: 'GET' }).middleware([authContextMiddleware]).handler(async ({ context }) => {
     const prisma = await getPrisma()
-  const request = getRequest()
-  const session = await requireAuth(request)
-  const ownerId = session.user.id
+  const ownerId = context.user.id
 
   // 以 memberId 判当前用户的归属：避免为已是别家成员的账号创建自引用 owner 记录（P2002）
   const ownEntry = await prisma.teamMembership.findUnique({
@@ -378,12 +369,11 @@ export const listTeamMembersFn = createServerFn({ method: 'GET' }).handler(async
 const removeMemberSchema = z.object({ membershipId: z.string() })
 
 export const removeTeamMemberFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(removeMemberSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const ownerId = session.user.id
+    const ownerId = context.user.id
     const m = await prisma.teamMembership.findUnique({ where: { id: data.membershipId } })
     if (!m) throw new Error('成员不存在')
     if (m.ownerId !== ownerId) throw new Error('权限不足：仅团队所有者可移除成员')
@@ -401,11 +391,9 @@ export const removeTeamMemberFn = createServerFn({ method: 'POST' })
     return { success: true }
   })
 
-export const leaveTeamFn = createServerFn({ method: 'POST' }).validator(z.object({})).handler(async () => {
+export const leaveTeamFn = createServerFn({ method: 'POST' }).middleware([authContextMiddleware]).validator(z.object({})).handler(async ({ context }) => {
     const prisma = await getPrisma()
-  const request = getRequest()
-  const session = await requireAuth(request)
-  const userId = session.user.id
+  const userId = context.user.id
   const m = await prisma.teamMembership.findUnique({ where: { memberId: userId } })
   if (!m) throw new Error('你未加入任何团队')
   await prisma.$transaction(async (tx) => {
@@ -430,12 +418,11 @@ const approveJoinRequestSchema = z.object({
 })
 
 export const approveTeamJoinRequestFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(approveJoinRequestSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const ownerId = session.user.id
+    const ownerId = context.user.id
 
     // DB-03：属主校验并入单次 findFirst（include 关系一并取回）。
     // 此处内联 findFirst 而非 assertOwned：include 投影类型（reqRow.invitation）需走
@@ -499,12 +486,11 @@ export const approveTeamJoinRequestFn = createServerFn({ method: 'POST' })
   })
 
 export const rejectTeamJoinRequestFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(joinRequestSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const ownerId = session.user.id
+    const ownerId = context.user.id
 
     // DB-03：属主校验并入单次 findFirst
     const reqRow = await assertOwned(prisma.teamJoinRequest, { where: { id: data.requestId, ownerId } }, '申请不存在')
@@ -527,12 +513,11 @@ export const rejectTeamJoinRequestFn = createServerFn({ method: 'POST' })
   })
 
 export const deleteTeamInvitationFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(revokeSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const ownerId = session.user.id
+    const ownerId = context.user.id
 
     // DB-03：属主校验并入单次 findFirst
     const invRow = await assertOwned(prisma.teamInvitation, { where: { id: data.invitationId, ownerId } }, '邀请不存在')
@@ -553,12 +538,11 @@ export const deleteTeamInvitationFn = createServerFn({ method: 'POST' })
   })
 
 export const deleteTeamJoinRequestFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(joinRequestSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const ownerId = session.user.id
+    const ownerId = context.user.id
 
     // DB-03：属主校验并入单次 findFirst
     const reqRow = await assertOwned(prisma.teamJoinRequest, { where: { id: data.requestId, ownerId } }, '申请不存在')
@@ -576,11 +560,9 @@ export const deleteTeamJoinRequestFn = createServerFn({ method: 'POST' })
     return { success: true }
   })
 
-export const listTeamUsersFn = createServerFn({ method: 'GET' }).handler(async () => {
+export const listTeamUsersFn = createServerFn({ method: 'GET' }).middleware([authContextMiddleware]).handler(async ({ context }) => {
     const prisma = await getPrisma()
-  const request = getRequest()
-  const session = await requireAuth(request)
-  const userId = session.user.id
+  const userId = context.user.id
   const joined = await prisma.teamMembership.findUnique({ where: { memberId: userId } })
   const ownerId = joined ? joined.ownerId : userId
   const [owner, members] = await Promise.all([
@@ -796,17 +778,16 @@ export const applyTeamInvitationFn = createServerFn({ method: 'POST' })
   })
 
 export const acceptTeamInvitationFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(tokenSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+    const userId = context.user.id
     const currentUser = await prisma.user.findUnique({
       where: { id: userId },
       select: { email: true },
     })
-    const email = (currentUser?.email ?? session.user.email ?? '').toLowerCase()
+    const email = (currentUser?.email ?? context.user.email ?? '').toLowerCase()
     if (!email) throw new Error('当前账号缺少邮箱，无法申请')
 
     const inv = await prisma.teamInvitation.findUnique({ where: { token: data.token } })
@@ -864,12 +845,11 @@ const approveSchema = z.object({
 })
 
 export const approveTeamInvitationFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(approveSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const ownerId = session.user.id
+    const ownerId = context.user.id
 
     // DB-03：属主校验并入单次 findFirst
     const inv = await assertOwned(prisma.teamInvitation, { where: { id: data.invitationId, ownerId } }, '邀请不存在')

package/src/server/serverFns/testcase/__tests__/automation.test.ts

@@ -72,24 +72,57 @@ const PRISMA = H.prisma;
 vi.mock("@tanstack/react-start", () => {
   // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
   const createServerFn = () => {
-    const capture: { validator?: unknown; handler?: unknown } = {};
+    const capture: { validator?: unknown; handler?: unknown; middlewares?: unknown[] } = {};
     const api = {
       validator: (v: unknown) => {
         capture.validator = v;
         return api;
       },
+      middleware: (mws: unknown[]) => {
+        capture.middlewares = mws;
+        return api;
+      },
       handler: (h: unknown) => {
         capture.handler = h;
         return async (args: { data: unknown }) => {
           const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
           const data = v && v.parse ? v.parse(args.data) : args.data;
-          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: Record<string, unknown> = {};
+          for (const mw of capture.middlewares ?? []) {
+            const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+            if (typeof serverFn !== "function") continue;
+            const result = await (
+              serverFn as (p: unknown) => Promise<{ context?: unknown }>
+            )({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: { context?: unknown }) => ({
+                context: { ...context, ...(inner?.context ?? {}) },
+              }),
+            });
+            context = (result?.context ?? context) as Record<string, unknown>;
+          }
+          return (h as (p: { data: unknown; context: unknown }) => Promise<unknown>)({ data, context });
         };
       },
     };
     return api;
   };
-  return { createServerFn };
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)
+  const createMiddleware = (opts?: { type?: string }) => {
+    const mw: { options: { type?: string; server?: unknown }; server?: unknown } = { options: { type: opts?.type } };
+    mw.server = (fn: unknown) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  };
+  return { createServerFn, createMiddleware };
 });
 
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => REQ }));
@@ -223,7 +256,7 @@ describe("generateArtifactFn", () => {
     ).resolves.toMatchObject({ artifact: expect.anything() });
   });
 
-  it("requireFeature 第一行门控 + AI 调用走 testgen bizKey + testcase.automation promptKey 覆盖", async () => {
+  it("requireFeature 门控先于业务逻辑（认证经 authContextMiddleware 前置）+ AI 调用走 testgen bizKey + testcase.automation promptKey 覆盖", async () => {
     M.runChatAsAgent.mockResolvedValue(aiOutput());
     M.runVitestSpec.mockResolvedValue(runResult());
 
@@ -231,7 +264,7 @@ describe("generateArtifactFn", () => {
 
     expect(M.requireFeature).toHaveBeenCalledWith(REQ, "testGeneration");
     expect(M.requireFeature.mock.invocationCallOrder[0]).toBeLessThan(
-      M.requireAuth.mock.invocationCallOrder[0],
+      M.checkAiRateLimit.mock.invocationCallOrder[0],
     );
     expect(M.checkAiRateLimit).toHaveBeenCalledWith(U, "testGeneration");
     expect(M.runChatAsAgent).toHaveBeenCalledTimes(1);

package/src/server/serverFns/testcase/__tests__/evidence-upload.test.ts

@@ -33,25 +33,59 @@ const M = H.fns;
 const BLOB_PUT = H.blobPut;
 
 vi.mock("@tanstack/react-start", () => {
+  // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
   const createServerFn = () => {
-    const capture: { validator?: unknown; handler?: unknown } = {};
+    const capture: { validator?: unknown; handler?: unknown; middlewares?: unknown[] } = {};
     const api = {
       validator: (v: unknown) => {
         capture.validator = v;
         return api;
       },
+      middleware: (mws: unknown[]) => {
+        capture.middlewares = mws;
+        return api;
+      },
       handler: (h: unknown) => {
         capture.handler = h;
         return async (args: { data: unknown }) => {
           const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
           const data = v && v.parse ? v.parse(args.data) : args.data;
-          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: Record<string, unknown> = {};
+          for (const mw of capture.middlewares ?? []) {
+            const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+            if (typeof serverFn !== "function") continue;
+            const result = await (
+              serverFn as (p: unknown) => Promise<{ context?: unknown }>
+            )({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: { context?: unknown }) => ({
+                context: { ...context, ...(inner?.context ?? {}) },
+              }),
+            });
+            context = (result?.context ?? context) as Record<string, unknown>;
+          }
+          return (h as (p: { data: unknown; context: unknown }) => Promise<unknown>)({ data, context });
         };
       },
     };
     return api;
   };
-  return { createServerFn };
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)
+  const createMiddleware = (opts?: { type?: string }) => {
+    const mw: { options: { type?: string; server?: unknown }; server?: unknown } = { options: { type: opts?.type } };
+    mw.server = (fn: unknown) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  };
+  return { createServerFn, createMiddleware };
 });
 
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));

package/src/server/serverFns/testcase/__tests__/generation.test.ts

@@ -82,24 +82,57 @@ const PRISMA = H.prisma;
 vi.mock("@tanstack/react-start", () => {
   // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
   const createServerFn = () => {
-    const capture: { validator?: unknown; handler?: unknown } = {};
+    const capture: { validator?: unknown; handler?: unknown; middlewares?: unknown[] } = {};
     const api = {
       validator: (v: unknown) => {
         capture.validator = v;
         return api;
       },
+      middleware: (mws: unknown[]) => {
+        capture.middlewares = mws;
+        return api;
+      },
       handler: (h: unknown) => {
         capture.handler = h;
         return async (args: { data: unknown }) => {
           const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
           const data = v && v.parse ? v.parse(args.data) : args.data;
-          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: Record<string, unknown> = {};
+          for (const mw of capture.middlewares ?? []) {
+            const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+            if (typeof serverFn !== "function") continue;
+            const result = await (
+              serverFn as (p: unknown) => Promise<{ context?: unknown }>
+            )({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: { context?: unknown }) => ({
+                context: { ...context, ...(inner?.context ?? {}) },
+              }),
+            });
+            context = (result?.context ?? context) as Record<string, unknown>;
+          }
+          return (h as (p: { data: unknown; context: unknown }) => Promise<unknown>)({ data, context });
         };
       },
     };
     return api;
   };
-  return { createServerFn };
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)
+  const createMiddleware = (opts?: { type?: string }) => {
+    const mw: { options: { type?: string; server?: unknown }; server?: unknown } = { options: { type: opts?.type } };
+    mw.server = (fn: unknown) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  };
+  return { createServerFn, createMiddleware };
 });
 
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => REQ }));
@@ -227,7 +260,7 @@ beforeEach(() => {
 });
 
 describe("startGenerationFn", () => {
-  it("requireFeature('testGeneration') 在认证前第一行执行（计费门控）", async () => {
+  it("requireFeature('testGeneration') 门控先于业务逻辑（认证经 authContextMiddleware 前置）", async () => {
     DB.storyFindUnique.mockResolvedValue({
       id: "s-1",
       projectId: P,
@@ -243,7 +276,7 @@ describe("startGenerationFn", () => {
 
     expect(M.requireFeature).toHaveBeenCalledWith(REQ, "testGeneration");
     expect(M.requireFeature.mock.invocationCallOrder[0]).toBeLessThan(
-      M.requireAuth.mock.invocationCallOrder[0]!,
+      DB.storyFindUnique.mock.invocationCallOrder[0]!,
     );
   });
 

package/src/server/serverFns/testcase/__tests__/plans.test.ts

@@ -72,24 +72,57 @@ const PRISMA = H.prisma;
 vi.mock("@tanstack/react-start", () => {
   // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
   const createServerFn = () => {
-    const capture: { validator?: unknown; handler?: unknown } = {};
+    const capture: { validator?: unknown; handler?: unknown; middlewares?: unknown[] } = {};
     const api = {
       validator: (v: unknown) => {
         capture.validator = v;
         return api;
       },
+      middleware: (mws: unknown[]) => {
+        capture.middlewares = mws;
+        return api;
+      },
       handler: (h: unknown) => {
         capture.handler = h;
         return async (args: { data: unknown }) => {
           const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
           const data = v && v.parse ? v.parse(args.data) : args.data;
-          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: Record<string, unknown> = {};
+          for (const mw of capture.middlewares ?? []) {
+            const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+            if (typeof serverFn !== "function") continue;
+            const result = await (
+              serverFn as (p: unknown) => Promise<{ context?: unknown }>
+            )({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: { context?: unknown }) => ({
+                context: { ...context, ...(inner?.context ?? {}) },
+              }),
+            });
+            context = (result?.context ?? context) as Record<string, unknown>;
+          }
+          return (h as (p: { data: unknown; context: unknown }) => Promise<unknown>)({ data, context });
         };
       },
     };
     return api;
   };
-  return { createServerFn };
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)
+  const createMiddleware = (opts?: { type?: string }) => {
+    const mw: { options: { type?: string; server?: unknown }; server?: unknown } = { options: { type: opts?.type } };
+    mw.server = (fn: unknown) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  };
+  return { createServerFn, createMiddleware };
 });
 
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));