@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/testcase/__tests__/regression.test.ts

@@ -51,24 +51,57 @@ const PRISMA = H.prisma;
 vi.mock("@tanstack/react-start", () => {
   // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
   const createServerFn = () => {
-    const capture: { validator?: unknown; handler?: unknown } = {};
+    const capture: { validator?: unknown; handler?: unknown; middlewares?: unknown[] } = {};
     const api = {
       validator: (v: unknown) => {
         capture.validator = v;
         return api;
       },
+      middleware: (mws: unknown[]) => {
+        capture.middlewares = mws;
+        return api;
+      },
       handler: (h: unknown) => {
         capture.handler = h;
         return async (args: { data: unknown }) => {
           const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
           const data = v && v.parse ? v.parse(args.data) : args.data;
-          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: Record<string, unknown> = {};
+          for (const mw of capture.middlewares ?? []) {
+            const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+            if (typeof serverFn !== "function") continue;
+            const result = await (
+              serverFn as (p: unknown) => Promise<{ context?: unknown }>
+            )({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: { context?: unknown }) => ({
+                context: { ...context, ...(inner?.context ?? {}) },
+              }),
+            });
+            context = (result?.context ?? context) as Record<string, unknown>;
+          }
+          return (h as (p: { data: unknown; context: unknown }) => Promise<unknown>)({ data, context });
         };
       },
     };
     return api;
   };
-  return { createServerFn };
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)
+  const createMiddleware = (opts?: { type?: string }) => {
+    const mw: { options: { type?: string; server?: unknown }; server?: unknown } = { options: { type: opts?.type } };
+    mw.server = (fn: unknown) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  };
+  return { createServerFn, createMiddleware };
 });
 
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));

package/src/server/serverFns/testcase/__tests__/run-cases.test.ts

@@ -67,24 +67,57 @@ const PRISMA = H.prisma;
 vi.mock("@tanstack/react-start", () => {
   // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
   const createServerFn = () => {
-    const capture: { validator?: unknown; handler?: unknown } = {};
+    const capture: { validator?: unknown; handler?: unknown; middlewares?: unknown[] } = {};
     const api = {
       validator: (v: unknown) => {
         capture.validator = v;
         return api;
       },
+      middleware: (mws: unknown[]) => {
+        capture.middlewares = mws;
+        return api;
+      },
       handler: (h: unknown) => {
         capture.handler = h;
         return async (args: { data: unknown }) => {
           const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
           const data = v && v.parse ? v.parse(args.data) : args.data;
-          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: Record<string, unknown> = {};
+          for (const mw of capture.middlewares ?? []) {
+            const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+            if (typeof serverFn !== "function") continue;
+            const result = await (
+              serverFn as (p: unknown) => Promise<{ context?: unknown }>
+            )({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: { context?: unknown }) => ({
+                context: { ...context, ...(inner?.context ?? {}) },
+              }),
+            });
+            context = (result?.context ?? context) as Record<string, unknown>;
+          }
+          return (h as (p: { data: unknown; context: unknown }) => Promise<unknown>)({ data, context });
         };
       },
     };
     return api;
   };
-  return { createServerFn };
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)
+  const createMiddleware = (opts?: { type?: string }) => {
+    const mw: { options: { type?: string; server?: unknown }; server?: unknown } = { options: { type: opts?.type } };
+    mw.server = (fn: unknown) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  };
+  return { createServerFn, createMiddleware };
 });
 
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));

package/src/server/serverFns/testcase/__tests__/runs.test.ts

@@ -68,24 +68,57 @@ const PRISMA = H.prisma;
 vi.mock("@tanstack/react-start", () => {
   // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
   const createServerFn = () => {
-    const capture: { validator?: unknown; handler?: unknown } = {};
+    const capture: { validator?: unknown; handler?: unknown; middlewares?: unknown[] } = {};
     const api = {
       validator: (v: unknown) => {
         capture.validator = v;
         return api;
       },
+      middleware: (mws: unknown[]) => {
+        capture.middlewares = mws;
+        return api;
+      },
       handler: (h: unknown) => {
         capture.handler = h;
         return async (args: { data: unknown }) => {
           const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
           const data = v && v.parse ? v.parse(args.data) : args.data;
-          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: Record<string, unknown> = {};
+          for (const mw of capture.middlewares ?? []) {
+            const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+            if (typeof serverFn !== "function") continue;
+            const result = await (
+              serverFn as (p: unknown) => Promise<{ context?: unknown }>
+            )({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: { context?: unknown }) => ({
+                context: { ...context, ...(inner?.context ?? {}) },
+              }),
+            });
+            context = (result?.context ?? context) as Record<string, unknown>;
+          }
+          return (h as (p: { data: unknown; context: unknown }) => Promise<unknown>)({ data, context });
         };
       },
     };
     return api;
   };
-  return { createServerFn };
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)
+  const createMiddleware = (opts?: { type?: string }) => {
+    const mw: { options: { type?: string; server?: unknown }; server?: unknown } = { options: { type: opts?.type } };
+    mw.server = (fn: unknown) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  };
+  return { createServerFn, createMiddleware };
 });
 
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));

package/src/server/serverFns/testcase/__tests__/stats.test.ts

@@ -71,24 +71,57 @@ const PRISMA = H.prisma;
 vi.mock("@tanstack/react-start", () => {
   // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
   const createServerFn = () => {
-    const capture: { validator?: unknown; handler?: unknown } = {};
+    const capture: { validator?: unknown; handler?: unknown; middlewares?: unknown[] } = {};
     const api = {
       validator: (v: unknown) => {
         capture.validator = v;
         return api;
       },
+      middleware: (mws: unknown[]) => {
+        capture.middlewares = mws;
+        return api;
+      },
       handler: (h: unknown) => {
         capture.handler = h;
         return async (args: { data: unknown }) => {
           const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
           const data = v && v.parse ? v.parse(args.data) : args.data;
-          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: Record<string, unknown> = {};
+          for (const mw of capture.middlewares ?? []) {
+            const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+            if (typeof serverFn !== "function") continue;
+            const result = await (
+              serverFn as (p: unknown) => Promise<{ context?: unknown }>
+            )({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: { context?: unknown }) => ({
+                context: { ...context, ...(inner?.context ?? {}) },
+              }),
+            });
+            context = (result?.context ?? context) as Record<string, unknown>;
+          }
+          return (h as (p: { data: unknown; context: unknown }) => Promise<unknown>)({ data, context });
         };
       },
     };
     return api;
   };
-  return { createServerFn };
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)
+  const createMiddleware = (opts?: { type?: string }) => {
+    const mw: { options: { type?: string; server?: unknown }; server?: unknown } = { options: { type: opts?.type } };
+    mw.server = (fn: unknown) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  };
+  return { createServerFn, createMiddleware };
 });
 
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));

package/src/server/serverFns/testcase/__tests__/testcase-board.test.ts

@@ -38,25 +38,59 @@ const DB = H.db;
 const PRISMA = H.prisma;
 
 vi.mock("@tanstack/react-start", () => {
+  // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
   const createServerFn = () => {
-    const capture: { validator?: unknown; handler?: unknown } = {};
+    const capture: { validator?: unknown; handler?: unknown; middlewares?: unknown[] } = {};
     const api = {
       validator: (v: unknown) => {
         capture.validator = v;
         return api;
       },
+      middleware: (mws: unknown[]) => {
+        capture.middlewares = mws;
+        return api;
+      },
       handler: (h: unknown) => {
         capture.handler = h;
-        return async (args?: { data?: unknown }) => {
+        return async (args: { data: unknown }) => {
           const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
-          const data = v && v.parse ? v.parse(args?.data) : args?.data;
-          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+          const data = v && v.parse ? v.parse(args.data) : args.data;
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: Record<string, unknown> = {};
+          for (const mw of capture.middlewares ?? []) {
+            const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+            if (typeof serverFn !== "function") continue;
+            const result = await (
+              serverFn as (p: unknown) => Promise<{ context?: unknown }>
+            )({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: { context?: unknown }) => ({
+                context: { ...context, ...(inner?.context ?? {}) },
+              }),
+            });
+            context = (result?.context ?? context) as Record<string, unknown>;
+          }
+          return (h as (p: { data: unknown; context: unknown }) => Promise<unknown>)({ data, context });
         };
       },
     };
     return api;
   };
-  return { createServerFn };
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)
+  const createMiddleware = (opts?: { type?: string }) => {
+    const mw: { options: { type?: string; server?: unknown }; server?: unknown } = { options: { type: opts?.type } };
+    mw.server = (fn: unknown) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  };
+  return { createServerFn, createMiddleware };
 });
 
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));

package/src/server/serverFns/testcase/__tests__/testcase-crud.test.ts

@@ -84,24 +84,57 @@ const PRISMA = H.prisma;
 vi.mock("@tanstack/react-start", () => {
   // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
   const createServerFn = () => {
-    const capture: { validator?: unknown; handler?: unknown } = {};
+    const capture: { validator?: unknown; handler?: unknown; middlewares?: unknown[] } = {};
     const api = {
       validator: (v: unknown) => {
         capture.validator = v;
         return api;
       },
+      middleware: (mws: unknown[]) => {
+        capture.middlewares = mws;
+        return api;
+      },
       handler: (h: unknown) => {
         capture.handler = h;
         return async (args: { data: unknown }) => {
           const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
           const data = v && v.parse ? v.parse(args.data) : args.data;
-          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: Record<string, unknown> = {};
+          for (const mw of capture.middlewares ?? []) {
+            const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+            if (typeof serverFn !== "function") continue;
+            const result = await (
+              serverFn as (p: unknown) => Promise<{ context?: unknown }>
+            )({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: { context?: unknown }) => ({
+                context: { ...context, ...(inner?.context ?? {}) },
+              }),
+            });
+            context = (result?.context ?? context) as Record<string, unknown>;
+          }
+          return (h as (p: { data: unknown; context: unknown }) => Promise<unknown>)({ data, context });
         };
       },
     };
     return api;
   };
-  return { createServerFn };
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)
+  const createMiddleware = (opts?: { type?: string }) => {
+    const mw: { options: { type?: string; server?: unknown }; server?: unknown } = { options: { type: opts?.type } };
+    mw.server = (fn: unknown) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  };
+  return { createServerFn, createMiddleware };
 });
 
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));

package/src/server/serverFns/testcase/__tests__/testcase-folders.test.ts

@@ -65,24 +65,57 @@ const PRISMA = H.prisma;
 vi.mock("@tanstack/react-start", () => {
   // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
   const createServerFn = () => {
-    const capture: { validator?: unknown; handler?: unknown } = {};
+    const capture: { validator?: unknown; handler?: unknown; middlewares?: unknown[] } = {};
     const api = {
       validator: (v: unknown) => {
         capture.validator = v;
         return api;
       },
+      middleware: (mws: unknown[]) => {
+        capture.middlewares = mws;
+        return api;
+      },
       handler: (h: unknown) => {
         capture.handler = h;
         return async (args: { data: unknown }) => {
           const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
           const data = v && v.parse ? v.parse(args.data) : args.data;
-          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: Record<string, unknown> = {};
+          for (const mw of capture.middlewares ?? []) {
+            const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+            if (typeof serverFn !== "function") continue;
+            const result = await (
+              serverFn as (p: unknown) => Promise<{ context?: unknown }>
+            )({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: { context?: unknown }) => ({
+                context: { ...context, ...(inner?.context ?? {}) },
+              }),
+            });
+            context = (result?.context ?? context) as Record<string, unknown>;
+          }
+          return (h as (p: { data: unknown; context: unknown }) => Promise<unknown>)({ data, context });
         };
       },
     };
     return api;
   };
-  return { createServerFn };
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)
+  const createMiddleware = (opts?: { type?: string }) => {
+    const mw: { options: { type?: string; server?: unknown }; server?: unknown } = { options: { type: opts?.type } };
+    mw.server = (fn: unknown) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  };
+  return { createServerFn, createMiddleware };
 });
 
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));

package/src/server/serverFns/testcase/__tests__/testcase-groups.test.ts

@@ -54,24 +54,57 @@ const PRISMA = H.prisma;
 vi.mock("@tanstack/react-start", () => {
   // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
   const createServerFn = () => {
-    const capture: { validator?: unknown; handler?: unknown } = {};
+    const capture: { validator?: unknown; handler?: unknown; middlewares?: unknown[] } = {};
     const api = {
       validator: (v: unknown) => {
         capture.validator = v;
         return api;
       },
+      middleware: (mws: unknown[]) => {
+        capture.middlewares = mws;
+        return api;
+      },
       handler: (h: unknown) => {
         capture.handler = h;
-        return async (args?: { data?: unknown }) => {
+        return async (args: { data: unknown }) => {
           const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
-          const data = v && v.parse ? v.parse(args?.data) : args?.data;
-          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+          const data = v && v.parse ? v.parse(args.data) : args.data;
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: Record<string, unknown> = {};
+          for (const mw of capture.middlewares ?? []) {
+            const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+            if (typeof serverFn !== "function") continue;
+            const result = await (
+              serverFn as (p: unknown) => Promise<{ context?: unknown }>
+            )({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: { context?: unknown }) => ({
+                context: { ...context, ...(inner?.context ?? {}) },
+              }),
+            });
+            context = (result?.context ?? context) as Record<string, unknown>;
+          }
+          return (h as (p: { data: unknown; context: unknown }) => Promise<unknown>)({ data, context });
         };
       },
     };
     return api;
   };
-  return { createServerFn };
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)
+  const createMiddleware = (opts?: { type?: string }) => {
+    const mw: { options: { type?: string; server?: unknown }; server?: unknown } = { options: { type: opts?.type } };
+    mw.server = (fn: unknown) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  };
+  return { createServerFn, createMiddleware };
 });
 
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));

package/src/server/serverFns/testcase/automation.ts

@@ -43,7 +43,7 @@ import type { Prisma } from "@allbluecn/database";
 import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { requireFeature } from "@/server/entitlements";
 import { checkAiRateLimit } from "@/server/lib/rate-limit";
 import { hasAiKey } from "@/server/ai-gateway/adapter";
@@ -177,13 +177,12 @@ const generateArtifactInputSchema = z.object({
 const inFlightArtifactJobs = new Set<string>();
 
 export const generateArtifactFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(generateArtifactInputSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     // 计费门控（复用任务 20 testGeneration 口径，YAGNI 不另立 key）：serverFn 第一行 requireFeature
     await requireFeature(getRequest(), "testGeneration");
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await checkAiRateLimit(userId, "testGeneration");
 
     if (!(await hasAiKey(userId))) {
@@ -351,11 +350,10 @@ async function runArtifactGeneration(
 const artifactIdInputSchema = z.object({ artifactId: z.string().min(1) });
 
 export const adoptArtifactFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(artifactIdInputSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id;
     const prisma = await getPrisma();
 
     const artifact = await prisma.testAutomationArtifact.findUnique({
@@ -401,11 +399,10 @@ export const adoptArtifactFn = createServerFn({ method: "POST" })
   });
 
 export const rejectArtifactFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(artifactIdInputSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id;
     const prisma = await getPrisma();
 
     const artifact = await prisma.testAutomationArtifact.findUnique({
@@ -430,11 +427,10 @@ export const rejectArtifactFn = createServerFn({ method: "POST" })
 const listArtifactsInputSchema = z.object({ caseId: z.string().min(1) });
 
 export const listArtifactsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(listArtifactsInputSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id;
     const prisma = await getPrisma();
 
     const testCase = await prisma.testCase.findUnique({

package/src/server/serverFns/testcase/bulk.ts

@@ -23,9 +23,8 @@
 // 用例回收站无此门槛，与用例页单条归档口径一致）。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import {
   TEST_CASE_PRIORITY_VALUES,
   TEST_CASE_STATE_VALUES,
@@ -46,12 +45,11 @@ async function accessibleProjectIds(userId: string): Promise<string[]> {
 }
 
 export const bulkArchiveTestCasesFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(idListSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const visibleProjectIds = await accessibleProjectIds(session.user.id);
+    const visibleProjectIds = await accessibleProjectIds(context.user.id);
     const result = await prisma.testCase.updateMany({
       where: {
         id: { in: data.caseIds },
@@ -64,13 +62,12 @@ export const bulkArchiveTestCasesFn = createServerFn({ method: "POST" })
   });
 
 export const bulkDeleteTestCasesFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(idListSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 可见性过滤进 where：跨项目 id 静默跳过而非报错（SEC-03/DB-03：单语句消除跨项目删除）
-    const visibleProjectIds = await accessibleProjectIds(session.user.id);
+    const visibleProjectIds = await accessibleProjectIds(context.user.id);
     const result = await prisma.testCase.deleteMany({
       where: { id: { in: data.caseIds }, projectId: { in: visibleProjectIds } },
     });
@@ -93,12 +90,11 @@ const bulkUpdateSchema = z.object({
 });
 
 export const bulkUpdateTestCasesFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(bulkUpdateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     const visibleProjectIds = await accessibleProjectIds(userId);
 
     const data_: Record<string, unknown> = {};

package/src/server/serverFns/testcase/evidence-upload.ts

@@ -22,9 +22,8 @@
 // 专用白名单（仅 image/* + 10MB），共享端点行为零变更。客户端不接触 BlobStore 实现。
 // 本文件只准导出 createServerFn 产物（serverFn 纯净铁律），白名单为文件内私有。
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { getPorts } from "@/server/ai-gateway/runtime";
 
 /** 执行证据白名单：仅图片家族（fail-closed 前缀匹配，独立于会话附件白名单） */
@@ -42,14 +41,13 @@ const UploadEvidenceSchema = z.object({
 });
 
 export const uploadEvidenceFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(UploadEvidenceSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-    if (!session?.user?.id) {
+  .handler(async ({ data, context }) => {
+    if (!context.user.id) {
       return { error: "Unauthorized" as const };
     }
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // SVG 显式拒绝（image/ 前缀白名单会放过 image/svg+xml）：/api/blob/$id 以存储
     // mimeType inline 服务，SVG 内嵌脚本会在应用 origin 执行（self-XSS）——安全裁决