@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/serverFns/testcase/testcase-display-options.ts

@@ -24,7 +24,7 @@ import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { requireFeature } from "@/server/entitlements";
 import { isProEdition } from "@/server/pro-services";
 import {
@@ -109,11 +109,9 @@ async function capPageSize(request: Request, pageSize: TestCasePageSize): Promis
 }
 
 /** 获取当前用户持久化的用例显示选项（非法/缺失字段已回退默认值） */
-export const getTestCaseDisplayOptionsFn = createServerFn({ method: "GET" }).handler(async () => {
+export const getTestCaseDisplayOptionsFn = createServerFn({ method: "GET" }).middleware([authContextMiddleware]).handler(async ({ context }) => {
   const prisma = await getPrisma();
-  const request = getRequest();
-  const session = await requireAuth(request);
-  const userId = session.user.id;
+  const userId = context.user.id;
 
   const row = await prisma.testCaseFilterView.findFirst({
     where: { userId, name: TESTCASE_DISPLAY_OPTIONS_VIEW_NAME },
@@ -121,23 +119,22 @@ export const getTestCaseDisplayOptionsFn = createServerFn({ method: "GET" }).han
     select: { displayOptions: true },
   });
   const options = parseStoredOptions(row?.displayOptions);
-  options.pageSize = await capPageSize(request, options.pageSize);
+  options.pageSize = await capPageSize(getRequest(), options.pageSize);
   return options;
 });
 
 /** 保存当前用户的用例显示选项，返回更新后的完整对象 */
 export const updateTestCaseDisplayOptionsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(optionsSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // 服务端强制校验：pageSize > 200（500/1000）为 Pro 专属，前端锁定只是 UX
     const options: TestCaseDisplayOptions = {
       ...data,
-      pageSize: await capPageSize(request, data.pageSize),
+      pageSize: await capPageSize(getRequest(), data.pageSize),
     };
 
     // 与 get 路径同一 orderBy：并发双保留行时读写对齐首行，避免保存后读不到

package/src/server/serverFns/testcase/testcase-export.ts

@@ -16,7 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 // 用例列表 CSV 导出 serverFn（四期 Q8 任务 44，照 testcase-crud listTestCasesFn
-// 口径同构）。权限：首行 requireAuth + resolveStoryScopeProjectIds（projectId
+// 口径同构）。权限：authContextMiddleware 鉴权 + resolveStoryScopeProjectIds（projectId
 // 缺省 → 成员关系内全部项目聚合；传值 → 单项目经鉴权，防越权导出）。筛选：
 // filters 为客户端 serializeFilters 产物（FilterCondition JSON 串），与列表共
 // 用 server/testcase/list-query.ts buildListWhere 翻译——导出范围=当前筛选/
@@ -27,10 +27,9 @@
 // 四项），DB 枚举原值输出保持机器可读。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { buildListWhere } from "@/server/testcase/list-query";
 import { CSV_EXPORT_MAX_ROWS, toCsv, type CsvCell } from "@/server/csv";
@@ -70,12 +69,11 @@ const TEST_CASE_EXPORT_SELECT = {
 type TestCaseExportRow = Prisma.TestCaseGetPayload<{ select: typeof TEST_CASE_EXPORT_SELECT }>;
 
 export const exportTestCasesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(exportSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const projectIds = await resolveStoryScopeProjectIds(data.projectId, userId);
 

package/src/server/serverFns/testcase/testcase-filter-views.ts

@@ -24,10 +24,9 @@
 // update 无乐观锁（StoryFilterView 先例没有，任务 5 审查指针同口径）。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { TESTCASE_DISPLAY_OPTIONS_VIEW_NAME } from "@/shared/testcase/field-configs";
 
 // 显示选项保留行（任务 20，testcase-display-options.ts 落点）对视图清单
@@ -125,11 +124,9 @@ function toJson(value: Record<string, unknown>): Prisma.InputJsonValue {
   return value as unknown as Prisma.InputJsonValue;
 }
 
-export const listFilterViewsFn = createServerFn({ method: "GET" }).handler(async () => {
+export const listFilterViewsFn = createServerFn({ method: "GET" }).middleware([authContextMiddleware]).handler(async ({ context }) => {
   const prisma = await getPrisma();
-  const request = getRequest();
-  const session = await requireAuth(request);
-  const userId = session.user.id;
+  const userId = context.user.id;
   const rows = await prisma.testCaseFilterView.findMany({
     where: { userId, ...NOT_RESERVED },
     orderBy: { sortOrder: "asc" },
@@ -150,15 +147,14 @@ const createSchema = z.object({
 });
 
 export const createFilterViewFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(createSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     if (data.name === TESTCASE_DISPLAY_OPTIONS_VIEW_NAME) {
       throw new Error("该视图名称为系统保留，请换一个名称");
     }
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     const row = await prisma.testCaseFilterView.create({
       data: {
         userId,
@@ -185,15 +181,14 @@ const updateSchema = z.object({
 });
 
 export const updateFilterViewFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(updateSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     if (data.name === TESTCASE_DISPLAY_OPTIONS_VIEW_NAME) {
       throw new Error("该视图名称为系统保留，请换一个名称");
     }
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     const { id, ...patch } = data;
     const updates: Record<string, unknown> = {};
     if (patch.name !== undefined) updates.name = patch.name;
@@ -214,12 +209,11 @@ export const updateFilterViewFn = createServerFn({ method: "POST" })
 const deleteSchema = z.object({ id: z.string().min(1) });
 
 export const deleteFilterViewFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(deleteSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await prisma.testCaseFilterView.delete({
       // userId + 非保留名限定：他人视图与显示选项保留行均删不到（照 bug-views.ts）
       where: { id: data.id, userId, ...NOT_RESERVED },

package/src/server/serverFns/testcase/testcase-folders.ts

@@ -21,9 +21,8 @@
 // 视同无权限）。create/delete 落 ProjectActivity(targetType=testcase)。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { ensureBuiltinIndependentProject, resolveStoryScopeProjectId } from "@/server/builtin-project";
 import { assertTestProjectMembership as assertProjectMembership } from "@/server/testcase/permissions";
 
@@ -32,12 +31,11 @@ import { assertTestProjectMembership as assertProjectMembership } from "@/server
 const listSchema = z.object({ projectId: z.string().optional() });
 
 export const listFoldersFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const projectId = await resolveStoryScopeProjectId(data.projectId, userId);
 
@@ -58,12 +56,11 @@ const createSchema = z.object({
 });
 
 export const createFolderFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(createSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     let projectId = data.projectId;
     if (projectId) {
@@ -121,12 +118,11 @@ async function getFolderWithMembership(folderId: string, userId: string) {
 const renameSchema = z.object({ id: z.string(), name: z.string().min(1).max(100) });
 
 export const renameFolderFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(renameSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     await getFolderWithMembership(data.id, userId);
 
@@ -139,12 +135,11 @@ export const renameFolderFn = createServerFn({ method: "POST" })
 const deleteSchema = z.object({ id: z.string() });
 
 export const deleteFolderFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(deleteSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const folder = await getFolderWithMembership(data.id, userId);
 
@@ -177,12 +172,11 @@ const reorderSchema = z.object({
 });
 
 export const reorderFolderFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(reorderSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     const folder = await getFolderWithMembership(data.id, userId);
 

package/src/server/serverFns/testcase/testcase-groups.ts

@@ -23,10 +23,9 @@
 // unassigned，前端用已有模块树数据解析名称）。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 import { resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { buildListWhere } from "@/server/testcase/list-query";
 import {
@@ -92,12 +91,11 @@ const listGroupsSchema = z.object({
 });
 
 export const listGroupsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(listGroupsSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
 
     // scope 解析与列表一致（同 story/story-groups 与 bug 域）：未传 → 成员关系
     // 全部项目聚合；单项目经鉴权（无效/非成员 → 静默回退独立项目），防越权查询

package/src/server/serverFns/testcase/testcase-reorder.ts

@@ -23,9 +23,8 @@
 // 无 withCollabGuard/touchCollabSnapshot 接线。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context"
 
 const reorderSchema = z.object({
   // 批量上限 500（story-crud/bulk idListSchema 同款）：防误用超大拖垮 $transaction
@@ -40,15 +39,14 @@ const reorderSchema = z.object({
 });
 
 export const reorderTestCasesFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(reorderSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma();
-    const request = getRequest();
-    const session = await requireAuth(request);
     // 可见性过滤进 where（SEC-03：防跨项目改他人用例排序）；updateMany 对
     // 越权/不存在 id 静默跳过，不中断整批合法排序
     const memberships = await prisma.projectMember.findMany({
-      where: { userId: session.user.id, status: { not: "suspended" } },
+      where: { userId: context.user.id, status: { not: "suspended" } },
       select: { projectId: true },
     });
     const visibleProjectIds = memberships.map((m) => m.projectId);

package/src/server/serverFns/translation.ts

@@ -16,9 +16,8 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 import { checkAiRateLimit } from '@/server/lib/rate-limit'
 import { hasAiKey } from "@/server/ai-gateway/adapter"
 import { runChatAsAgent } from "@/server/ai-gateway/runs/agent-runtime"
@@ -30,11 +29,10 @@ const schema = z.object({
 })
 
 export const translateFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(schema)
-  .handler(async ({ data }) => {
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user.id
+  .handler(async ({ data, context }) => {
+    const userId = context.user.id
     // AI 昂贵调用独立限流（审计 🟠：对照 startGenerationFn 同款；先于 hasAiKey 消耗配额）
     await checkAiRateLimit(userId, "translation")
     if (!(await hasAiKey(userId))) throw new Error('AI 未配置')

package/src/server/serverFns/user/avatar.ts

@@ -17,9 +17,8 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 const schema = z.object({
   avatarConfig: z.record(z.string(), z.number()),
@@ -28,13 +27,12 @@ const schema = z.object({
 })
 
 export const updateAvatarFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(schema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     const user = await prisma.user.update({
-      where: { id: session.user.id },
+      where: { id: context.user.id },
       data: { ...data, avatarConfig: data.avatarConfig as object },
     })
     return { avatarConfig: user.avatarConfig, bgShape: user.bgShape, bgColor: user.bgColor }

package/src/server/serverFns/user/settings.ts

@@ -17,22 +17,20 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 const updateTimezoneSchema = z.object({
   timezone: z.string().min(1).max(50),
 })
 
 export const updateUserTimezoneFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(updateTimezoneSchema)
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     await prisma.user.update({
-      where: { id: session.user.id },
+      where: { id: context.user.id },
       data: { timezone: data.timezone },
     })
     return { success: true }

package/src/server/serverFns/user/update-locale.ts

@@ -2,17 +2,15 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { requireAuth } from '@/server/auth-helpers'
-import { getRequest } from '@tanstack/react-start/server'
+import { authContextMiddleware } from '@/server/middlewares/auth-context'
 
 export const updateLocaleFn = createServerFn({ method: 'POST' })
+  .middleware([authContextMiddleware])
   .validator(z.object({ locale: z.enum(['zh', 'en']) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
     await prisma.user.update({
-      where: { id: session.user.id },
+      where: { id: context.user.id },
       data: { locale: data.locale },
     })
     return { success: true }

package/src/server/serverFns/workspace-kb.ts

@@ -20,8 +20,7 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { z } from "zod";
 import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
-import { requireAuth } from "@/server/auth-helpers";
+import { authContextMiddleware } from "@/server/middlewares/auth-context";
 import { GENERAL_GROUP_TABLES, GENERAL_GROUPS, type GeneralGroup } from "@/server/knowledge/kb-general";
 import type { QuickDocRow, WorkspaceKbCardData } from "./workspace-kb-utils";
 import {
@@ -76,12 +75,11 @@ async function generalGroupVisibleFilter(
 }
 
 export const getWorkspaceKbCardFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ workspaceId: z.string() }))
-  .handler(async ({ data }): Promise<WorkspaceKbCardData> => {
+  .handler(async ({ data, context }): Promise<WorkspaceKbCardData> => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await requireWorkspaceMember(data.workspaceId, userId);
 
     const [linkRows, quickRows] = await Promise.all([
@@ -169,12 +167,11 @@ export const getWorkspaceKbCardFn = createServerFn({ method: "GET" })
   });
 
 export const listWorkspaceAvailableKbsFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ workspaceId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await requireWorkspaceMember(data.workspaceId, userId);
 
     const linked = await prisma.workspaceKnowledgeBase.findMany({
@@ -195,12 +192,11 @@ export const listWorkspaceAvailableKbsFn = createServerFn({ method: "GET" })
   });
 
 export const setWorkspaceKbsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ workspaceId: z.string(), kbIds: z.array(z.string()) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await requireWorkspaceMember(data.workspaceId, session.user.id);
+    await requireWorkspaceMember(data.workspaceId, context.user.id);
 
     // 校验与候选清单（listWorkspaceAvailableKbsFn）同口径（审计 🟡）：
     // 本空间已关联 ∪ 本人 team 库——防凭 id 把任意他人 team 库挂入自己空间
@@ -215,7 +211,7 @@ export const setWorkspaceKbsFn = createServerFn({ method: "POST" })
           id: { in: data.kbIds },
           visibility: "team",
           isDeleted: false,
-          OR: [{ id: { in: linkedIds } }, { userId: session.user.id }],
+          OR: [{ id: { in: linkedIds } }, { userId: context.user.id }],
         },
         select: { id: true },
       });
@@ -238,6 +234,7 @@ export const setWorkspaceKbsFn = createServerFn({ method: "POST" })
   });
 
 export const searchQuickDocCandidatesFn = createServerFn({ method: "GET" })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       workspaceId: z.string(),
@@ -246,11 +243,9 @@ export const searchQuickDocCandidatesFn = createServerFn({ method: "GET" })
       query: z.string().default(""),
     }),
   )
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await requireWorkspaceMember(data.workspaceId, userId);
 
     if (data.generalGroup) {
@@ -290,12 +285,11 @@ export const searchQuickDocCandidatesFn = createServerFn({ method: "GET" })
   });
 
 export const addQuickDocsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ workspaceId: z.string(), items: z.array(quickDocItemSchema).min(1) }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user.id;
+    const userId = context.user.id;
     await requireWorkspaceMember(data.workspaceId, userId);
 
     // DB-01：批量快捷文档原每项 2~3 次串行查询（存在性 findFirst + 查重 findFirst + create）。
@@ -411,6 +405,7 @@ export const addQuickDocsFn = createServerFn({ method: "POST" })
   });
 
 export const renameQuickDocFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       quickDocId: z.string(),
@@ -419,16 +414,14 @@ export const renameQuickDocFn = createServerFn({ method: "POST" })
       icon: z.string().optional(),
     }),
   )
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
     const row = await prisma.workspaceQuickDoc.findUnique({
       where: { id: data.quickDocId },
       select: { workspaceId: true },
     });
     if (!row) throw new Error("快捷文档不存在");
-    await requireWorkspaceMember(row.workspaceId, session.user.id);
+    await requireWorkspaceMember(row.workspaceId, context.user.id);
     await prisma.workspaceQuickDoc.update({
       where: { id: data.quickDocId },
       data: {
@@ -440,22 +433,22 @@ export const renameQuickDocFn = createServerFn({ method: "POST" })
   });
 
 export const removeQuickDocFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(z.object({ quickDocId: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
     const row = await prisma.workspaceQuickDoc.findUnique({
       where: { id: data.quickDocId },
       select: { workspaceId: true },
     });
     if (!row) throw new Error("快捷文档不存在");
-    await requireWorkspaceMember(row.workspaceId, session.user.id);
+    await requireWorkspaceMember(row.workspaceId, context.user.id);
     await prisma.workspaceQuickDoc.delete({ where: { id: data.quickDocId } });
     return { ok: true };
   });
 
 export const reorderQuickDocsFn = createServerFn({ method: "POST" })
+  .middleware([authContextMiddleware])
   .validator(
     z.object({
       workspaceId: z.string(),
@@ -467,11 +460,9 @@ export const reorderQuickDocsFn = createServerFn({ method: "POST" })
         .max(500),
     }),
   )
-  .handler(async ({ data }) => {
+  .handler(async ({ data, context }) => {
     const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    await requireWorkspaceMember(data.workspaceId, session.user.id);
+    await requireWorkspaceMember(data.workspaceId, context.user.id);
     const ids = data.items.map((item) => item.id);
     const owned = await prisma.workspaceQuickDoc.findMany({
       where: { id: { in: ids }, workspaceId: data.workspaceId },