@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/testcase/generation.ts

@@ -29,7 +29,7 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { requireFeature } from "@/server/entitlements";
 import { checkAiRateLimit } from "@/server/lib/rate-limit";
 import { truncateWithMarker } from "@/server/lib/text-truncate";
@@ -246,13 +246,12 @@ const startGenerationInputSchema = z.object({
 });
 
 export const startGenerationFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(startGenerationInputSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     // 计费门控（规格 §12）：serverFn 第一行 requireFeature
     await requireFeature(getRequest(), "testGeneration");
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await checkAiRateLimit(userId, "testGeneration");
 
     if (!(await hasAiKey(userId))) {
@@ -444,11 +443,10 @@ const adoptDraftsInputSchema = z.object({
 });
 
 export const adoptDraftsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(adoptDraftsInputSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id;
     const prisma = await getPrisma();
 
     const run = await prisma.testGenerationRun.findUnique({
@@ -534,11 +532,10 @@ const getGenerationInputSchema = z.object({
 });
 
 export const getGenerationFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(getGenerationInputSchema)
-  .handler(async ({ data }) => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id;
     const prisma = await getPrisma();
 
     const run = await prisma.testGenerationRun.findUnique({

package/src/server/serverFns/testcase/plans.ts

@@ -18,7 +18,7 @@
 // 测试计划 CRUD + 圈选关联 serverFn（照 testcase-crud / testcase-folders 写法惯例）。
 // 本文件只准导出 createServerFn 产物，select 常量、DTO cast、成员校验等辅助逻辑用
 // 文件内非导出成员（serverFn 纯净铁律）。
-// 权限口径与用例域一致：读走 requireAuth（detail 同 getTestCaseFn）/列表走
+// 权限口径与用例域一致：读走 authContextMiddleware 鉴权（detail 同 getTestCaseFn）/列表走
 // resolveStoryScopeProjectId 防越权；写须项目有效成员（suspended 视同无权限）。
 // 圈选幂等：addCasesToPlanFn 先查已存在关联 + 载荷内去重，createMany 只收增量；
 // DB 层 test_plan_cases.@@unique([planId, caseId])（迁移 20261005090000）兜底并发重放。
@@ -27,10 +27,9 @@
 // deprecatedCount 计数供 UI 顶部提示，不做静默隐藏。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { resolveStoryScopeProjectId } from "@/server/builtin-project";
 import { USER_BRIEF_SELECT, castUserBrief } from "@/server/story/user-brief";
 import {
@@ -139,12 +138,11 @@ const listPlansSchema = z.object({
 });
 
 export const listPlansFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listPlansSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // scope 解析：未传/无效/非成员 → 静默回退独立项目，防越权查询（同 listTestCasesFn）
     const projectId = await resolveStoryScopeProjectId(data.projectId, userId);
@@ -169,12 +167,11 @@ const createPlanSchema = z.object({
 });
 
 export const createPlanFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(createPlanSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // 未传 projectId 时回退内置独立项目（与读侧 resolve 同口径）；
     // resolve 内部已验成员资格，这里再过一次 assertProjectMembership 显式失败语义
@@ -237,13 +234,12 @@ function castPlanDetail(row: PlanDetailRow): TestPlanDetail {
 }
 
 export const getPlanFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(idSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 读侧与写侧同口径：须为计划所属项目的有效成员（审计 2026-10-25 读路径缺口）
-    await assertTestPlanProjectMember(data.id, session.user.id);
+    await assertTestPlanProjectMember(data.id, context.user.id);
     const row = await prisma.testPlan.findUnique({
       where: { id: data.id },
       select: PLAN_DETAIL_SELECT,
@@ -263,12 +259,11 @@ const updatePlanSchema = z.object({
 });
 
 export const updatePlanFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(updatePlanSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const existing = await prisma.testPlan.findUnique({
       where: { id: data.id },
@@ -322,12 +317,11 @@ export const updatePlanFn = createServerFn({ method: "POST" })
 // ── 删除（planCases 级联清理；TestRun.planId SetNull——执行批次保留但脱离计划）──
 
 export const deletePlanFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(idSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const existing = await prisma.testPlan.findUnique({
       where: { id: data.id },
@@ -362,12 +356,11 @@ const addCasesSchema = z.object({
 });
 
 export const addCasesToPlanFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(addCasesSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const plan = await prisma.testPlan.findUnique({
       where: { id: data.planId },
@@ -422,12 +415,11 @@ const removeCaseSchema = z.object({
 });
 
 export const removeCaseFromPlanFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(removeCaseSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const plan = await prisma.testPlan.findUnique({
       where: { id: data.planId },

package/src/server/serverFns/testcase/regression.ts

@@ -33,9 +33,8 @@
 // （编译期擦除，bug-repro.ts ReproRunItem 同先例）。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { assertBugProjectMember } from "@/server/bug/bug-permissions";
 import { createRunFn } from "./runs";
 import type { RunExecutorType } from "./constants";
@@ -57,12 +56,11 @@ function regressionRunName(title: string): string {
 // ── 发起回归（一键创建回归批次）──
 
 export const regressBugFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(bugIdSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const bug = await prisma.bug.findUnique({
       where: { id: data.bugId },
@@ -102,12 +100,11 @@ export const regressBugFn = createServerFn({ method: "POST" })
 // ── 回归徽标状态（Bug 详情挂载时查询）──
 
 export const getBugRegressionStatusFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(bugIdSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const projectId = await assertBugProjectMember(data.bugId, userId);
 

package/src/server/serverFns/testcase/run-cases.ts

@@ -31,10 +31,9 @@
 // 本文件只准导出 createServerFn 产物（serverFn 纯净铁律），守卫/合并均为文件内私有。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import {
   RUN_CASE_TERMINAL_STATUSES,
   finalizeRunIfComplete,
@@ -121,12 +120,11 @@ const reportStepSchema = z.object({
 });
 
 export const reportStepFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(reportStepSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const { row } = await loadReportContext(data.runCaseId, userId);
     if (!snapshotOrders(row.caseSnapshot).has(data.order)) {
@@ -170,12 +168,11 @@ const reportResultSchema = z.object({
 });
 
 export const reportResultFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(reportResultSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const { row, run } = await loadReportContext(data.runCaseId, userId);
     const now = new Date();
@@ -242,12 +239,11 @@ const addEvidenceSchema = z.object({
 });
 
 export const addEvidenceFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(addEvidenceSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const { row } = await loadReportContext(data.runCaseId, userId);
     if (!snapshotOrders(row.caseSnapshot).has(data.order)) {
@@ -311,12 +307,11 @@ const RUN_CASE_EXECUTION_SELECT = {
 const idSchema = z.object({ id: z.string().min(1) });
 
 export const getRunCaseFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(idSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await assertRunCaseProjectMember(data.id, session.user.id);
+    await assertRunCaseProjectMember(data.id, context.user.id);
 
     const row = await prisma.testRunCase.findUnique({
       where: { id: data.id },

package/src/server/serverFns/testcase/runs.ts

@@ -31,10 +31,9 @@
 // 本文件只准导出 createServerFn 产物（serverFn 纯净铁律），select/cast/校验均为文件内私有。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { resolveStoryScopeProjectId } from "@/server/builtin-project";
 import { buildCaseSnapshot } from "@/server/testcase/snapshot";
 import { USER_BRIEF_SELECT, castUserBrief } from "@/server/story/user-brief";
@@ -201,12 +200,11 @@ const createRunSchema = z
   });
 
 export const createRunFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(createRunSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // 审计 A3x-2 跨批收口：targetEnv 为 http(s) 时直用为 e2e 浏览器导航目标，
     // 服务端浏览器访问用户可控 URL 须经 fetch-guard（私网放行仅 desktop / 显式 env，同 browser-policy）
@@ -377,12 +375,11 @@ export const createRunFn = createServerFn({ method: "POST" })
 const idSchema = z.object({ id: z.string().min(1) });
 
 export const abortRunFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(idSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const existing = await prisma.testRun.findUnique({
       where: { id: data.id },
@@ -415,12 +412,11 @@ export const abortRunFn = createServerFn({ method: "POST" })
 // ── 详情（含执行矩阵行；渲染数据源是 caseSnapshot——审查重点 1 的读取面）──
 
 export const getRunFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(idSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await assertTestRunProjectMember(data.id, session.user.id);
+    await assertTestRunProjectMember(data.id, context.user.id);
     const row = await prisma.testRun.findUnique({
       where: { id: data.id },
       select: RUN_DETAIL_SELECT,
@@ -442,12 +438,11 @@ const listRunsSchema = z.object({
 });
 
 export const listRunsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listRunsSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // scope 解析：未传/无效/非成员 → 静默回退独立项目，防越权查询（同 listPlansFn）
     const projectId = await resolveStoryScopeProjectId(data.projectId, userId);

package/src/server/serverFns/testcase/stats.ts

@@ -38,9 +38,8 @@
 // 本文件只准导出 createServerFn 产物（serverFn 纯净铁律），成员校验/cast 文件内私有。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { resolveStoryScopeProjectId } from "@/server/builtin-project";
 // 同目录模块统一相对路径单条 import（审计 🟢：拆成绝对自引 + 相对两条易漂移）
 import { FAILURE_CATEGORY_VALUES, type RunCaseStatus } from "./constants";
@@ -56,18 +55,17 @@ const storyIdSchema = z.object({ storyId: z.string().min(1) });
 // ── 需求变更过期判定 ──
 
 export const getStoryStalenessFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(storyIdSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
 
     const story = await prisma.story.findUnique({
       where: { id: data.storyId },
       select: { id: true, projectId: true, updatedAt: true },
     });
     if (!story) throw new Error("需求不存在");
-    await assertProjectMembership(story.projectId, session.user.id);
+    await assertProjectMembership(story.projectId, context.user.id);
 
     // 窄口径：需求「内容」（描述/标题）最后编辑时间 vs 最新关联用例创建时间。
     // 从 storyActivity 的 content_edited 时间锚推导（web 直写与 collab exporter
@@ -100,18 +98,17 @@ export const getStoryStalenessFn = createServerFn({ method: "GET" })
 // ── 生成批次采纳率统计 ──
 
 export const listGenerationStatsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(storyIdSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
 
     const story = await prisma.story.findUnique({
       where: { id: data.storyId },
       select: { id: true, projectId: true },
     });
     if (!story) throw new Error("需求不存在");
-    await assertProjectMembership(story.projectId, session.user.id);
+    await assertProjectMembership(story.projectId, context.user.id);
 
     const rows = await prisma.testGenerationRun.findMany({
       where: { storyId: data.storyId },
@@ -150,12 +147,11 @@ const TREND_DAYS = 30;
 const projectStatsSchema = z.object({ projectId: z.string().min(1).optional() });
 
 export const getProjectTestStatsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(projectStatsSchema)
-  .handler(async ({ data }): Promise<ProjectTestStats> => {
+  .handler(async ({ data, context }): Promise<ProjectTestStats> => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const projectId = await resolveStoryScopeProjectId(data.projectId, session.user.id);
+    const projectId = await resolveStoryScopeProjectId(data.projectId, context.user.id);
 
     const since = new Date(Date.now() - TREND_DAYS * 24 * 60 * 60 * 1000);
     const [trendRows, genAgg, automationRows, flakyRows] = await Promise.all([
@@ -248,18 +244,17 @@ function castTriage(raw: unknown): RunFailureTriage | null {
 }
 
 export const listRunFailuresFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(idSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
 
     const run = await prisma.testRun.findUnique({
       where: { id: data.id },
       select: { id: true, projectId: true },
     });
     if (!run) throw new Error("执行批次不存在");
-    await assertProjectMembership(run.projectId, session.user.id);
+    await assertProjectMembership(run.projectId, context.user.id);
 
     const rows = await prisma.testRunCase.findMany({
       where: { runId: run.id, status: { in: ["failed", "blocked"] } },

package/src/server/serverFns/testcase/testcase-activities.ts

@@ -22,9 +22,8 @@
 // story 域 types 的单一事实源（activities.ts 先例）。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { assertTestCaseProjectMember } from "@/server/testcase/permissions";
 import { USER_BRIEF_SELECT, castUserBrief } from "@/server/story/user-brief";
 import type { TestCaseActivityItem } from "./types";
@@ -35,12 +34,11 @@ const listActivitiesSchema = z.object({
 });
 
 export const listTestCaseActivitiesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listActivitiesSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await assertTestCaseProjectMember(data.caseId, session.user.id);
+    await assertTestCaseProjectMember(data.caseId, context.user.id);
 
     const rows = await prisma.projectActivity.findMany({
       where: { targetType: "testcase", targetId: data.caseId },

package/src/server/serverFns/testcase/testcase-board.ts

@@ -24,10 +24,9 @@
 // 未归档用例，归档是「回收站」语义不进板）。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { buildListWhere } from "@/server/testcase/list-query";
 import { USER_BRIEF_SELECT, castUserBrief } from "@/server/story/user-brief";
@@ -134,12 +133,11 @@ const boardSchema = z.object({
 });
 
 export const listTestCaseBoardColumnsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(boardSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const projectIds = await resolveStoryScopeProjectIds(data.projectId, userId);
     const base = buildListWhere({

package/src/server/serverFns/testcase/testcase-crud.ts

@@ -25,10 +25,9 @@
 // 实际变更才 +1；state/automation/assignee/folder/story 等元数据变更不 bump（规格 §3：快照只锁内容）。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { buildListWhere } from "@/server/testcase/list-query";
 import { validateAssignee } from "@/server/lib/validate-assignee";
@@ -158,12 +157,11 @@ const listSchema = z.object({
 });
 
 export const listTestCasesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // scope 解析（同 story/story-groups 与 bug 域）：未传 → 成员关系全部项目聚合；
     // 单项目经鉴权（无效/非成员 → 静默回退独立项目），防越权查询
@@ -209,12 +207,11 @@ export const listTestCasesFn = createServerFn({ method: "GET" })
 const MAX_RETRIES = 5;
 
 export const createTestCaseFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(CreateTestCaseInputSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await assertProjectMembership(data.projectId, userId);
     await assertFolderInProject(data.projectId, data.folderId);
@@ -324,12 +321,11 @@ const CASE_Y_UPDATE_KEYS = new Set([
 ]);
 
 export const updateTestCaseFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(UpdateTestCaseInputSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // ── Yjs 多人协作 §5.3 写入门卫（任务 22；T21 教训：提至 $transaction
     // 之前——门卫转发含网络 I/O（TTL 内重试最坏 ≈4s），事务内等待会击穿
@@ -474,7 +470,7 @@ export const updateTestCaseFn = createServerFn({ method: "POST" })
     return castTestCase(updated);
   });
 
-// ── 详情（A12 详情页 loader）：列表 select + 关联需求引用；读门槛 requireAuth（同 getStoryDetailFn）──
+// ── 详情（A12 详情页 loader）：列表 select + 关联需求引用；读门槛 authContextMiddleware（同 getStoryDetailFn）──
 
 const idSchema = z.object({ id: z.string().min(1) });
 
@@ -494,12 +490,11 @@ function castTestCaseDetail(row: TestCaseDetailRow): TestCaseDetail {
 }
 
 export const getTestCaseFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(idSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await assertTestCaseProjectMember(data.id, session.user.id);
+    await assertTestCaseProjectMember(data.id, context.user.id);
     const row = await prisma.testCase.findUnique({
       where: { id: data.id },
       select: TEST_CASE_DETAIL_SELECT,
@@ -511,12 +506,11 @@ export const getTestCaseFn = createServerFn({ method: "GET" })
 // ── 归档 / 删除 ──
 
 export const archiveTestCaseFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(idSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const existing = await prisma.testCase.findUnique({
       where: { id: data.id },
@@ -545,12 +539,11 @@ export const archiveTestCaseFn = createServerFn({ method: "POST" })
   });
 
 export const deleteTestCaseFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(idSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const existing = await prisma.testCase.findUnique({
       where: { id: data.id },