@allbluecn/web-app 0.23.1 → 0.23.3

package/src/server/sync/__tests__/ownership-transfer.test.ts

@@ -0,0 +1,896 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
+// 归属转移核心（正向，桌面本地优先 P2-A8a）回归哨兵。mock prisma 下钉死六条
+// 安全不变式（真库断言归 A13 集成实测）：
+// ① 属主 UPDATE 覆盖固定清单的每一张表且 where 恒为 fromUserId；
+// ② AiProviderConfig.userId（配置类）不在任何 UPDATE 中（TRANSFER_EXCLUDED）；
+// ③ 云身份行 upsert（载荷含传入昵称/头像）+ guest 行 deleteMany 被调；
+// ④ syncOutbox/syncRowState 零触达（转移开着触发器自然产出 op='upsert' +
+//    base_version=0，推送拓扑 A7 已修为 upsert 正向——实现若手碰同步两表即红）；
+// ⑤ 幂等：第二次调用 UPDATE 计数 0、guest 行 deleteMany 计 0（delete 会抛
+//    P2025 破坏二跑——审查轮 1 修复后用例钉死 no-op 语义），返回 { tables, rows: 0 } 不抛错；
+// ⑥ serverFn 校验：readRemoteAuth().userId ≠ data.cloudUserId 抛错（防参数伪造）。
+// A8b 追加：⑦ 身份字段省略时 handler 以 remoteAuth.sessionToken 自取 SaaS
+// profile（fetch stub），upsert 载荷携带自取资料；字段全传仍用传入值（向后兼容）；
+// ⑧ probeCloudAccountStatusFn 三态——空账号 { empty: true } / 非空 { empty: false }
+// / 探测失败（非 200、网络异常、形状漂移）一律 { empty: false, unreachable: true }
+// （宁可不转不可错转）。
+// 另有清单对齐断言：实现导出的属主清单与测试内固定清单逐项相等——schema 增删
+// User-relation FK 时此测试红（防实现清单与 schema 漂移的哨兵）。
+// @vitest-environment node
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ZodType } from 'zod'
+
+// ── 固定哨兵清单（schema.prisma @ a3adcc0a3 全量 User-relation FK 标量列 79 处，
+//    减 TRANSFER_EXCLUDED 的 AiProviderConfig.userId = 78；扫描口径见
+//    ownership-transfer.ts 头注释）──────────────────────────────────────────
+const TEST_OWNERSHIP_COLUMNS: readonly string[] = [
+  'Account.userId',
+  'AgentConversation.userId',
+  'AiTask.createdById',
+  'AiUsageLog.userId',
+  'AnyHubApp.userId',
+  'AnyHubMarketApp.userId',
+  'AnyHubRecommendation.reviewedBy',
+  'AnyHubRecommender.userId',
+  'ArticleFavorite.userId',
+  'Blob.userId',
+  'BookmarkCategory.userId',
+  'Bug.assigneeId',
+  'Bug.createdById',
+  'Bug.updatedById',
+  'BugActivity.userId',
+  'BugComment.userId',
+  'BugCommentReaction.userId',
+  'BugFilterView.userId',
+  'BugReproRun.createdById',
+  'BusinessAgentBinding.userId',
+  'ChatThread.userId',
+  'CodeSnippet.userId',
+  'Comment.userId',
+  'CommentIgnore.userId',
+  'CommentReaction.userId',
+  'Design.userId',
+  'DesignVersion.userId',
+  'DictionaryTerm.userId',
+  'EmailPreference.userId',
+  'EmailVerificationToken.userId',
+  'HarnessPlugin.userId',
+  'HarnessWorkspace.ownerId',
+  'IndustryCompliance.userId',
+  'InvitationUse.userId',
+  'Iteration.createdById',
+  'KnowledgeBase.userId',
+  'KnowledgeDocument.createdBy',
+  'KnowledgeShareRecord.userId',
+  'Label.createdById',
+  'LegalRegulation.userId',
+  'LicenseKey.issuedById',
+  'LoginLog.userId',
+  'Notification.userId',
+  'NotificationPreference.userId',
+  'PasswordResetToken.userId',
+  'Project.ownerId',
+  'ProjectAccessToken.createdById',
+  'ProjectActivity.userId',
+  'ProjectMember.userId',
+  'Review.reviewerId',
+  'ReviewComment.userId',
+  'RoleAssignment.userId',
+  'SsoMapping.userId',
+  'Story.assigneeId',
+  'Story.createdById',
+  'Story.updatedById',
+  'StoryActivity.userId',
+  'StoryComment.userId',
+  'StoryFilterView.userId',
+  'StoryReaction.userId',
+  'Subscription.userId',
+  'TeamInvitation.ownerId',
+  'TeamJoinRequest.ownerId',
+  'TeamJoinRequest.userId',
+  'TeamMembership.memberId',
+  'TeamMembership.ownerId',
+  'TestAutomationArtifact.createdById',
+  'TestCase.assigneeId',
+  'TestCase.createdById',
+  'TestCaseFilterView.userId',
+  'TestGenerationRun.createdById',
+  'TestRunCase.executedById',
+  'UserAgent.userId',
+  'UserSkill.userId',
+  'WebsiteBookmark.userId',
+  'Workspace.ownerId',
+  'WorkspaceMember.userId',
+  'WorkspaceQuickDoc.createdBy',
+]
+
+// 逐字钉死 guest userId 契约（与 desktop-guest.GUEST_USER_ID 同值）
+const GUEST = 'local-guest'
+const CLOUD = 'cloud-user-1'
+const CLOUD_NAME = '云上名字'
+const CLOUD_EMAIL = 'cloud@example.com'
+const CLOUD_AVATAR = { hat: 3, body: 1, face: 5 }
+
+type UpdateManyFn = ReturnType<typeof vi.fn>
+
+/** Prisma 模型名 → client delegate 名（AiProviderConfig → aiProviderConfig） */
+const delegateOf = (model: string) => model.charAt(0).toLowerCase() + model.slice(1)
+
+/** 清单涉及的 distinct 模型（多列模型如 TeamMembership 只建一份 delegate） */
+const TEST_MODELS = [...new Set(TEST_OWNERSHIP_COLUMNS.map((e) => e.split('.')[0]))]
+
+const touchable = () => ({
+  updateMany: vi.fn(),
+  update: vi.fn(),
+  deleteMany: vi.fn(),
+  delete: vi.fn(),
+  create: vi.fn(),
+})
+
+type TouchableMock = ReturnType<typeof touchable>
+type DelegateMap = Record<string, { updateMany: UpdateManyFn }>
+type PrismaMock = DelegateMap & {
+  aiProviderConfig: { updateMany: UpdateManyFn }
+  syncOutbox: TouchableMock
+  syncRowState: TouchableMock
+  user: { upsert: UpdateManyFn; deleteMany: UpdateManyFn }
+  $transaction: (fn: (tx: unknown) => Promise<unknown>) => Promise<unknown>
+  /** A9：$executeRaw 只存在于事务闭包的 tx 上；外层 prisma 恒 undefined
+   *  （实现若绕过事务直连外层 raw 清表，此处 undefined 直接 TypeError 红） */
+  $executeRaw?: UpdateManyFn
+  /** $transaction 实际传入闭包的 tx 对象（执行序 / raw 断言入口） */
+  __tx?: { $executeRaw: UpdateManyFn }
+}
+
+function makePrismaMock(): PrismaMock {
+  const delegates: DelegateMap = {}
+  for (const model of TEST_MODELS) {
+    delegates[delegateOf(model)] = { updateMany: vi.fn() }
+  }
+  // 事务内客户端（tx）：与外层共享全部 delegate / user / 同步两表引用（既有断言
+  // 经外层访问照常可见），独占 $executeRaw——外层 prisma 无此方法，实现把 raw 清
+  // 表写在事务闭包外（污染窗口）即 TypeError 红（同闭包哨兵，A9）
+  const tx = {
+    ...delegates,
+    // 排除类与同步两表：实现绝不以 delegate 触达，桩在此「能接住误触」
+    aiProviderConfig: { updateMany: vi.fn() },
+    syncOutbox: touchable(),
+    syncRowState: touchable(),
+    // deleteMany 首跑模拟真删（count=1）；delete（单行）对已删行抛 P2025，
+    // 实现必须走 deleteMany——此处无 delete 桩，误用即 TypeError 红
+    user: { upsert: vi.fn(async () => ({})), deleteMany: vi.fn(async () => ({ count: 1 })) },
+    $executeRaw: vi.fn(async () => 1),
+  }
+  const prisma = { ...tx } as Record<string, unknown>
+  delete prisma.$executeRaw
+  prisma.$transaction = vi.fn(async (fn: (t: unknown) => Promise<unknown>) => fn(tx))
+  prisma.__tx = tx
+  // 对象展开会丢 index signature，显式回升（mock 形状与上方逐字一致）
+  return prisma as unknown as PrismaMock
+}
+
+/** 全部属主 delegate 的 updateMany 返回值统一设定（幂等用例置 0 模拟二跑空转；
+ *  缺列防呆用例删了 delegate，缺席跳过不炸桩） */
+const setUpdateCounts = (prisma: PrismaMock, count: number) => {
+  for (const model of TEST_MODELS) {
+    ;(prisma[delegateOf(model)] as { updateMany: UpdateManyFn } | undefined)?.updateMany.mockResolvedValue({
+      count,
+    })
+  }
+}
+
+import {
+  OWNERSHIP_COLUMNS,
+  TRANSFER_EXCLUDED,
+  reverseTransferOwnership,
+  transferOwnership,
+} from '../ownership-transfer'
+
+describe('transferOwnership（核心）', () => {
+  let prisma: PrismaMock
+
+  beforeEach(() => {
+    prisma = makePrismaMock()
+    setUpdateCounts(prisma, 1)
+  })
+
+  it('清单对齐：实现导出属主清单与固定哨兵清单逐项相等（schema 漂移哨兵）', () => {
+    const impl = OWNERSHIP_COLUMNS.map((c) => `${c.table}.${c.column}`)
+    expect(impl).toHaveLength(TEST_OWNERSHIP_COLUMNS.length)
+    expect(new Set(impl).size).toBe(impl.length) // 无重复条目
+    expect([...impl].sort()).toEqual([...TEST_OWNERSHIP_COLUMNS].sort())
+  })
+
+  it('①全部属主列各被 UPDATE 一次且 where 恒为 fromUserId（覆盖逐项断言）', async () => {
+    const result = await transferOwnership(prisma as never, GUEST, {
+      id: CLOUD,
+      name: CLOUD_NAME,
+      email: CLOUD_EMAIL,
+      avatarConfig: CLOUD_AVATAR,
+    })
+
+    expect(result).toEqual({ tables: TEST_OWNERSHIP_COLUMNS.length, rows: TEST_OWNERSHIP_COLUMNS.length })
+
+    // 按模型聚合断言：每列恰一次、where/data 载荷逐 call 精确匹配
+    const columnsByModel = new Map<string, string[]>()
+    for (const entry of TEST_OWNERSHIP_COLUMNS) {
+      const [model, column] = entry.split('.')
+      columnsByModel.set(model, [...(columnsByModel.get(model) ?? []), column])
+    }
+    for (const [model, columns] of columnsByModel) {
+      const updateMany = (prisma[delegateOf(model)] as { updateMany: UpdateManyFn }).updateMany
+      const calls = updateMany.mock.calls as Array<
+        [{ where: Record<string, string>; data: Record<string, string> }]
+      >
+      expect(calls).toHaveLength(columns.length)
+      const touched = calls.map((c) => Object.keys(c[0].where)[0])
+      expect([...touched].sort()).toEqual([...columns].sort())
+      for (const call of calls) {
+        const col = Object.keys(call[0].where)[0]
+        expect(call[0]).toEqual({
+          where: { [col]: GUEST },
+          data: { [col]: CLOUD },
+        })
+      }
+    }
+  })
+
+  it('②AiProviderConfig.userId 不在任何 UPDATE 中（配置类排除）', async () => {
+    await transferOwnership(prisma as never, GUEST, { id: CLOUD, name: CLOUD_NAME })
+
+    expect(prisma.aiProviderConfig.updateMany).not.toHaveBeenCalled()
+    // 排除常量钉死 + 实现清单零残留（双保险：改常量名/漏排除均在此报）
+    expect(TRANSFER_EXCLUDED).toContain('AiProviderConfig.userId')
+    expect(
+      OWNERSHIP_COLUMNS.some((c) => c.table === 'AiProviderConfig'),
+    ).toBe(false)
+  })
+
+  it('③云身份行 upsert（载荷含传入昵称/头像）+ guest 行 delete 被调', async () => {
+    await transferOwnership(prisma as never, GUEST, {
+      id: CLOUD,
+      name: CLOUD_NAME,
+      email: CLOUD_EMAIL,
+      avatarConfig: CLOUD_AVATAR,
+    })
+
+    expect(prisma.user.upsert).toHaveBeenCalledTimes(1)
+    const arg = (prisma.user.upsert as UpdateManyFn).mock.calls[0][0] as {
+      where: { id: string }
+      create: Record<string, unknown>
+      update: Record<string, unknown>
+    }
+    expect(arg.where).toEqual({ id: CLOUD })
+    expect(arg.create).toMatchObject({
+      id: CLOUD,
+      email: CLOUD_EMAIL,
+      username: CLOUD_NAME,
+      avatarConfig: CLOUD_AVATAR,
+      status: 'ACTIVE',
+    })
+    // password 随机占位（同 desktop-bootstrap 惯例：凭据登录必失败）
+    expect(typeof arg.create.password).toBe('string')
+    expect((arg.create.password as string).length).toBeGreaterThan(0)
+    // update 分支留空（幂等：云身份行已存在时不覆盖既有资料）
+    expect(arg.update).toEqual({})
+
+    // 删 guest 行走 deleteMany（delete 对已删行抛 P2025 破坏幂等二跑）
+    expect(prisma.user.deleteMany).toHaveBeenCalledTimes(1)
+    expect(prisma.user.deleteMany).toHaveBeenCalledWith({ where: { id: GUEST } })
+  })
+
+  it('④syncOutbox/syncRowState 零触达（outbox 语义保全：触发器自然产出 upsert）', async () => {
+    await transferOwnership(prisma as never, GUEST, { id: CLOUD, name: CLOUD_NAME })
+
+    for (const table of ['syncOutbox', 'syncRowState'] as const) {
+      for (const fn of Object.keys(prisma[table])) {
+        expect(prisma[table][fn as keyof (typeof prisma)[typeof table]]).not.toHaveBeenCalled()
+      }
+    }
+    expect(
+      OWNERSHIP_COLUMNS.filter((c) => ['SyncOutbox', 'SyncRowState'].includes(c.table)),
+    ).toEqual([])
+  })
+
+  it('⑤幂等：重复调用 UPDATE 计数 0，返回 { tables, rows: 0 } 不抛错', async () => {
+    await transferOwnership(prisma as never, GUEST, { id: CLOUD, name: CLOUD_NAME })
+
+    // 二跑：所有属主列 where fromUserId 匹配 0 行（已翻转）；云身份行已存在 →
+    // upsert no-op；guest 行已删 → deleteMany 计 0 no-op（delete 在真库此处抛
+    // P2025 回滚二跑——审查轮 1 缺口，deleteMany 语义方为幂等）
+    setUpdateCounts(prisma, 0)
+    prisma.user.deleteMany.mockResolvedValue({ count: 0 })
+    await expect(
+      transferOwnership(prisma as never, GUEST, { id: CLOUD, name: CLOUD_NAME }),
+    ).resolves.toEqual({ tables: TEST_OWNERSHIP_COLUMNS.length, rows: 0 })
+  })
+
+  it('缺列防呆：清单含 mock 未建的 delegate 时报错并回滚（$transaction 不吞错）', async () => {
+    const broken = makePrismaMock()
+    // 事务闭包内的 tx 与外层共享 delegate 引用：删 tx 的（外层展开副本同步失引，
+    // 实现经 tx 取 delegate）——模拟「客户端缺该模型」
+    delete (broken as Record<string, unknown>).testCase
+    delete (broken.__tx as unknown as Record<string, unknown>).testCase
+    // 先给在册 delegate 填返回值：失败必须落在守卫（缺 TestCase）而非 undefined.count
+    setUpdateCounts(broken, 1)
+    await expect(
+      transferOwnership(broken as never, GUEST, { id: CLOUD, name: CLOUD_NAME }),
+    ).rejects.toThrow(/缺 TestCase delegate/)
+  })
+})
+
+// ── A9 反向转移核心（登出：cloud → guest，镜像正向六不变式）──────────────────
+
+describe('reverseTransferOwnership（A9 反向核心）', () => {
+  let prisma: PrismaMock
+
+  beforeEach(() => {
+    prisma = makePrismaMock()
+    setUpdateCounts(prisma, 1)
+  })
+
+  it('①反向全量翻转：每列恰一次 UPDATE，where 恒为 cloudUserId / data 恒为 guest', async () => {
+    const result = await reverseTransferOwnership(prisma as never, CLOUD, GUEST)
+
+    expect(result).toEqual({ tables: TEST_OWNERSHIP_COLUMNS.length, rows: TEST_OWNERSHIP_COLUMNS.length })
+
+    const columnsByModel = new Map<string, string[]>()
+    for (const entry of TEST_OWNERSHIP_COLUMNS) {
+      const [model, column] = entry.split('.')
+      columnsByModel.set(model, [...(columnsByModel.get(model) ?? []), column])
+    }
+    for (const [model, columns] of columnsByModel) {
+      const updateMany = (prisma[delegateOf(model)] as { updateMany: UpdateManyFn }).updateMany
+      const calls = updateMany.mock.calls as Array<
+        [{ where: Record<string, string>; data: Record<string, string> }]
+      >
+      expect(calls).toHaveLength(columns.length)
+      const touched = calls.map((c) => Object.keys(c[0].where)[0])
+      expect([...touched].sort()).toEqual([...columns].sort())
+      for (const call of calls) {
+        const col = Object.keys(call[0].where)[0]
+        expect(call[0]).toEqual({
+          where: { [col]: CLOUD },
+          data: { [col]: GUEST },
+        })
+      }
+    }
+  })
+
+  it('②guest 行重建（影子行 upsert）先于属主翻转 + 云身份行 deleteMany 删除', async () => {
+    await reverseTransferOwnership(prisma as never, CLOUD, GUEST)
+
+    // guest 影子行 upsert（ensureLocalShadowUserWith 同款载荷；幂等 update 留空）
+    expect(prisma.user.upsert).toHaveBeenCalledTimes(1)
+    const arg = (prisma.user.upsert as UpdateManyFn).mock.calls[0][0] as {
+      where: { id: string }
+      create: Record<string, unknown>
+      update: Record<string, unknown>
+    }
+    expect(arg.where).toEqual({ id: GUEST })
+    expect(arg.create).toMatchObject({
+      id: GUEST,
+      username: '本地用户',
+      email: 'guest@localhost',
+      bgShape: 'square',
+      status: 'ACTIVE',
+    })
+    expect(typeof arg.create.password).toBe('string')
+    expect((arg.create.password as string).length).toBeGreaterThan(0)
+    expect(arg.update).toEqual({})
+
+    // 云身份行删除走 deleteMany（delete 对已删行抛 P2025 破坏幂等二跑）
+    expect(prisma.user.deleteMany).toHaveBeenCalledTimes(1)
+    expect(prisma.user.deleteMany).toHaveBeenCalledWith({ where: { id: CLOUD } })
+
+    // FK 目标先存在：guest 行 upsert 必须早于第一条属主 UPDATE（翻转的合法目标）
+    const upsertOrder = (prisma.user.upsert as UpdateManyFn).mock.invocationCallOrder[0]
+    const firstUpdateOrder = Math.min(
+      ...(prisma.story.updateMany as UpdateManyFn).mock.invocationCallOrder,
+    )
+    expect(upsertOrder).toBeLessThan(firstUpdateOrder)
+  })
+
+  it('③outbox/row_state 同事务清空：$executeRaw 含两条 DELETE，且在闭包内于翻转后执行', async () => {
+    await reverseTransferOwnership(prisma as never, CLOUD, GUEST)
+
+    // raw 清表只经事务闭包的 tx（外层 prisma 无 $executeRaw——绕过事务即 TypeError 红）
+    const raw = prisma.__tx!.$executeRaw
+    expect(raw).toHaveBeenCalledTimes(2)
+    const sqls = (raw.mock.calls as Array<[TemplateStringsArray]>).map((c) =>
+      String(c[0]),
+    )
+    expect(sqls.some((s) => s.includes('DELETE FROM sync_outbox'))).toBe(true)
+    expect(sqls.some((s) => s.includes('DELETE FROM sync_row_state'))).toBe(true)
+    expect(prisma.$executeRaw).toBeUndefined()
+
+    // 同一事务：$transaction 恰一次（无第二事务 / 无事务外窗口）
+    expect(prisma.$transaction).toHaveBeenCalledTimes(1)
+
+    // 闭包内执行序：guest 行重建 → 属主翻转 → 云行删除 → raw 清表（最后清同步两表，
+    // 清空后引擎无从产出反向 op——审查重点「防反向 op 推上云污染」）
+    const rawOrder = raw.mock.invocationCallOrder
+    const lastUpdateOrder = Math.max(
+      ...(prisma.story.updateMany as UpdateManyFn).mock.invocationCallOrder,
+    )
+    const deleteOrder = (prisma.user.deleteMany as UpdateManyFn).mock.invocationCallOrder[0]
+    expect(Math.min(...rawOrder)).toBeGreaterThan(lastUpdateOrder)
+    expect(Math.min(...rawOrder)).toBeGreaterThan(deleteOrder)
+  })
+
+  it('④AiProviderConfig.userId 不翻转（配置类排除同正向）', async () => {
+    await reverseTransferOwnership(prisma as never, CLOUD, GUEST)
+    expect(prisma.aiProviderConfig.updateMany).not.toHaveBeenCalled()
+  })
+
+  it('⑤幂等二跑：UPDATE 计 0、deleteMany 计 0、raw 清表照常，返回 rows=0 不抛错', async () => {
+    await reverseTransferOwnership(prisma as never, CLOUD, GUEST)
+
+    // 二跑：属主列 where cloudUserId 匹配 0 行（已回 guest）；云身份行已删（deleteMany
+    // 计 0 no-op）；guest 行 upsert 幂等（update 留空）；raw 清表照常执行
+    setUpdateCounts(prisma, 0)
+    prisma.user.deleteMany.mockResolvedValue({ count: 0 })
+    await expect(
+      reverseTransferOwnership(prisma as never, CLOUD, GUEST),
+    ).resolves.toEqual({ tables: TEST_OWNERSHIP_COLUMNS.length, rows: 0 })
+    expect(prisma.__tx!.$executeRaw).toHaveBeenCalledTimes(4) // 2（首跑）+ 2（二跑）
+  })
+
+  it('⑥审查重点（mock 翻译）：反向转移后 guest 对核心表读写可用——核心五表清单对齐 + 幂等二跑', async () => {
+    // 审查重点 3 用例（真库：guest 会话遍历 stories/bugs/testCases/knowledge 各查
+    // 一条写一条）的 mock 翻译：属主翻转覆盖核心表全部属主列（guest 行已重建 =
+    // FK 目标在位）+ deleteMany 幂等二跑 count=0（真库二跑不抛 P2025）。
+    const coreTables = [
+      ['story', 'Story'],
+      ['bug', 'Bug'],
+      ['testCase', 'TestCase'],
+      ['knowledgeBase', 'KnowledgeBase'],
+      ['knowledgeDocument', 'KnowledgeDocument'],
+    ] as const
+    await reverseTransferOwnership(prisma as never, CLOUD, GUEST)
+    for (const [delegate, model] of coreTables) {
+      const calls = (prisma[delegate] as { updateMany: UpdateManyFn }).updateMany.mock
+        .calls as Array<[{ where: Record<string, string>; data: Record<string, string> }]>
+      expect(calls.length).toBeGreaterThan(0)
+      for (const call of calls) {
+        expect(Object.values(call[0].where)).toEqual([CLOUD])
+        expect(Object.values(call[0].data)).toEqual([GUEST])
+      }
+      expect(TEST_OWNERSHIP_COLUMNS.some((c) => c.startsWith(`${model}.`))).toBe(true)
+    }
+
+    // 幂等二跑（真库语义：0 行匹配 / 行已删均 no-op，不破坏重试）
+    setUpdateCounts(prisma, 0)
+    prisma.user.deleteMany.mockResolvedValue({ count: 0 })
+    await expect(
+      reverseTransferOwnership(prisma as never, CLOUD, GUEST),
+    ).resolves.toBeDefined()
+  })
+
+  it('⑦源与目标相同（cloudUserId=guest）→ 拒绝执行', async () => {
+    await expect(
+      reverseTransferOwnership(prisma as never, GUEST, GUEST),
+    ).rejects.toThrow(/源与目标相同/)
+    expect(prisma.$transaction).not.toHaveBeenCalled()
+  })
+})
+
+// ── serverFn 校验（⑥）：transferOwnershipFn — renderer 发起，鉴权链 mock ────
+
+// A9：reverseTransferOwnership → ensureLocalShadowUserWith（desktop-bootstrap）
+// 的 import 链会触达 @allbluecn/database 模块级 prisma 单例（顶层 await 建客户端，
+// 缺 DATABASE_URL 即抛）——getter mock 拦住模块执行，单例在测试路径中不被消费
+// （With 版本收 tx 入参，无参包装不在此文件调用），照 desktop-bootstrap.test.ts
+// 「勿真连库」惯例。
+const dbMock = vi.hoisted(() => ({ prisma: null as unknown }))
+vi.mock('@allbluecn/database', () => ({
+  get prisma() {
+    return dbMock.prisma
+  },
+}))
+
+const sfMocks = vi.hoisted(() => ({
+  session: null as null | { user: { id: string } },
+  remoteAuth: null as null | { userId: string; sessionToken?: string },
+  accountEmpty: true,
+  prisma: null as unknown,
+  checkAuthRateLimit: vi.fn(),
+  clearRemoteAuth: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-start', () => ({
+  // 与 design serverFn 测试同款：依序执行 middleware server 段（复现 context 合并
+  // 语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
+    const api: {
+      _middlewares: Array<{ options?: { server?: unknown } }>
+      _validator?: ZodType
+      middleware: (mws: Array<{ options?: { server?: unknown } }>) => unknown
+      validator: (schema: ZodType) => unknown
+      handler: (fn: (args: { data: unknown; context?: unknown }) => unknown) => unknown
+    } = {
+      _middlewares: [],
+      middleware(mws) {
+        this._middlewares.push(...mws)
+        return api
+      },
+      validator(schema) {
+        this._validator = schema
+        return api
+      },
+      handler(fn) {
+        return async (args: { data: unknown }) => {
+          const schema = this._validator as ZodType | undefined
+          const data = schema && args?.data !== undefined ? schema.parse(args.data) : args?.data
+          let context: unknown = {}
+          for (const mw of this._middlewares) {
+            const serverFn = mw?.options?.server as
+              | ((inner: {
+                  data: unknown
+                  context: unknown
+                  method: string
+                  serverFnMeta: Record<string, never>
+                  signal: AbortSignal
+                  next: (n: { context: unknown }) => Promise<{ context: unknown }>
+                }) => Promise<{ context: unknown }>)
+              | undefined
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (n) => ({ context: { ...(context as object), ...((n?.context ?? {}) as object) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
+        }
+      },
+    }
+    return api
+  },
+  createMiddleware: (opts: { type?: string }) => {
+    const mw: { options: { type?: string; server?: unknown }; server?: unknown } = {
+      options: { type: opts?.type },
+    }
+    mw.server = (fn: unknown) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
+}))
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: () => new Request('https://allblue.test/rpc'),
+}))
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: async () => {
+    if (!sfMocks.session?.user?.id) throw new Error('UNAUTHORIZED')
+    return sfMocks.session
+  },
+}))
+vi.mock('@/server/remote-auth', () => ({
+  readRemoteAuth: async () => sfMocks.remoteAuth,
+  clearRemoteAuth: sfMocks.clearRemoteAuth,
+}))
+vi.mock('@/server/sync/account-status', () => ({
+  isAccountEmpty: async () => sfMocks.accountEmpty,
+}))
+vi.mock('@/server/middlewares/rate-limit', () => ({
+  checkAuthRateLimit: sfMocks.checkAuthRateLimit,
+}))
+vi.mock('@allbluecn/database/get-prisma', () => ({
+  getPrisma: async () => sfMocks.prisma,
+}))
+
+import {
+  transferOwnershipFn,
+  probeCloudAccountStatusFn,
+  reverseTransferOwnershipFn,
+} from '../../serverFns/sync/transfer'
+
+type Fn = (args: { data: unknown }) => Promise<unknown>
+const transferFn = transferOwnershipFn as unknown as Fn
+const reverseFn = reverseTransferOwnershipFn as unknown as Fn
+const probeFn = probeCloudAccountStatusFn as unknown as () => Promise<{
+  empty: boolean
+  unreachable?: boolean
+}>
+
+// SaaS fetch stub（saas-profile.ts / probeCloudAccountStatusFn 消费；vi.stubGlobal
+// 拦截，不真出网——惯例照 exchange-remote-token.test.ts）
+const fetchMock = vi.hoisted(() => vi.fn())
+
+describe('transferOwnershipFn（serverFn 校验）', () => {
+  beforeEach(() => {
+    sfMocks.session = { user: { id: GUEST } }
+    sfMocks.remoteAuth = { userId: CLOUD, sessionToken: 'tok-123' }
+    sfMocks.accountEmpty = true
+    sfMocks.prisma = makePrismaMock()
+    setUpdateCounts(sfMocks.prisma as PrismaMock, 1)
+    fetchMock.mockReset()
+  })
+
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('⑥remoteAuth.userId ≠ data.cloudUserId → 抛错，零触库', async () => {
+    sfMocks.remoteAuth = { userId: 'attacker-other' }
+
+    await expect(
+      transferFn({ data: { cloudUserId: CLOUD, name: CLOUD_NAME } }),
+    ).rejects.toThrow(/云账号|remoteAuth|不匹配/)
+
+    const p = sfMocks.prisma as PrismaMock
+    expect(p.story.updateMany).not.toHaveBeenCalled()
+    expect(p.user.upsert).not.toHaveBeenCalled()
+  })
+
+  it('无 remoteAuth（非 desktop / 未交换登录）→ 抛错', async () => {
+    sfMocks.remoteAuth = null
+
+    await expect(
+      transferFn({ data: { cloudUserId: CLOUD, name: CLOUD_NAME } }),
+    ).rejects.toThrow()
+    expect((sfMocks.prisma as PrismaMock).story.updateMany).not.toHaveBeenCalled()
+  })
+
+  it('账号非空（account-status.empty=false）→ 抛错拒绝转移', async () => {
+    sfMocks.accountEmpty = false
+
+    await expect(
+      transferFn({ data: { cloudUserId: CLOUD, name: CLOUD_NAME } }),
+    ).rejects.toThrow(/空账号|非空/)
+    expect((sfMocks.prisma as PrismaMock).story.updateMany).not.toHaveBeenCalled()
+  })
+
+  it('正向：guest 会话 + remoteAuth 匹配 + 空账号 → 以 GUEST→cloudUserId 转移并回传结果', async () => {
+    const result = (await transferFn({
+      data: {
+        cloudUserId: CLOUD,
+        name: CLOUD_NAME,
+        email: CLOUD_EMAIL,
+        avatarConfig: CLOUD_AVATAR,
+      },
+    })) as { tables: number; rows: number }
+
+    expect(result).toEqual({ tables: TEST_OWNERSHIP_COLUMNS.length, rows: TEST_OWNERSHIP_COLUMNS.length })
+    const p = sfMocks.prisma as PrismaMock
+    expect(p.story.updateMany).toHaveBeenCalledWith({
+      where: { createdById: GUEST },
+      data: { createdById: CLOUD },
+    })
+    expect(p.user.upsert).toHaveBeenCalledTimes(1)
+    expect(p.user.deleteMany).toHaveBeenCalledWith({ where: { id: GUEST } })
+  })
+
+  it('validator：cloudUserId 空串/缺失 → 校验失败', async () => {
+    await expect(transferFn({ data: { cloudUserId: '', name: 'x' } })).rejects.toThrow()
+    await expect(transferFn({ data: { name: 'x' } })).rejects.toThrow()
+  })
+})
+
+// ── A9：reverseTransferOwnershipFn（登出反向转移 serverFn 校验）──────────────
+
+describe('reverseTransferOwnershipFn（A9 serverFn 校验）', () => {
+  beforeEach(() => {
+    sfMocks.session = { user: { id: CLOUD } }
+    sfMocks.remoteAuth = { userId: CLOUD, sessionToken: 'tok-123' }
+    sfMocks.accountEmpty = true
+    sfMocks.prisma = makePrismaMock()
+    setUpdateCounts(sfMocks.prisma as PrismaMock, 1)
+    sfMocks.clearRemoteAuth.mockClear()
+    // 桌面守卫开闸（isDesktopServer 消费 DEPLOY_TARGET，照 probeFn 用例先例）
+    vi.stubEnv('DEPLOY_TARGET', 'desktop')
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it('①remoteAuth 缺失（非云态/已清理）→ 拒绝，零触库零清理', async () => {
+    sfMocks.remoteAuth = null
+
+    await expect(reverseFn({ data: { cloudUserId: CLOUD } })).rejects.toThrow(/云账号|remoteAuth|不匹配/)
+
+    const p = sfMocks.prisma as PrismaMock
+    expect(p.story.updateMany).not.toHaveBeenCalled()
+    expect(p.user.upsert).not.toHaveBeenCalled()
+    expect(sfMocks.clearRemoteAuth).not.toHaveBeenCalled()
+  })
+
+  it('②remoteAuth.userId ≠ data.cloudUserId（参数伪造）→ 拒绝', async () => {
+    sfMocks.remoteAuth = { userId: 'attacker-other' }
+
+    await expect(reverseFn({ data: { cloudUserId: CLOUD } })).rejects.toThrow(/不匹配/)
+    expect((sfMocks.prisma as PrismaMock).story.updateMany).not.toHaveBeenCalled()
+    expect(sfMocks.clearRemoteAuth).not.toHaveBeenCalled()
+  })
+
+  it('③会话身份 ≠ cloudUserId（本地凭据会话与云身份并存防御）→ 拒绝', async () => {
+    sfMocks.session = { user: { id: 'local-auth-user' } }
+
+    await expect(reverseFn({ data: { cloudUserId: CLOUD } })).rejects.toThrow(/会话|身份/)
+    expect((sfMocks.prisma as PrismaMock).story.updateMany).not.toHaveBeenCalled()
+    expect(sfMocks.clearRemoteAuth).not.toHaveBeenCalled()
+  })
+
+  it('④非 desktop 部署 → 拒绝（桌面守卫）', async () => {
+    vi.stubEnv('DEPLOY_TARGET', 'vercel')
+
+    await expect(reverseFn({ data: { cloudUserId: CLOUD } })).rejects.toThrow(/仅桌面端/)
+    expect((sfMocks.prisma as PrismaMock).story.updateMany).not.toHaveBeenCalled()
+  })
+
+  it('⑤成功：cloud→guest 反向转移执行 + 事务提交后清 remote-auth（崩窗口收敛）', async () => {
+    const result = (await reverseFn({ data: { cloudUserId: CLOUD } })) as {
+      tables: number
+      rows: number
+    }
+
+    expect(result).toEqual({ tables: TEST_OWNERSHIP_COLUMNS.length, rows: TEST_OWNERSHIP_COLUMNS.length })
+    const p = sfMocks.prisma as PrismaMock
+    expect(p.story.updateMany).toHaveBeenCalledWith({
+      where: { createdById: CLOUD },
+      data: { createdById: GUEST },
+    })
+    expect(p.user.upsert).toHaveBeenCalledTimes(1)
+    expect(p.user.deleteMany).toHaveBeenCalledWith({ where: { id: CLOUD } })
+    // 反向转移一旦提交，数据已是 guest 属主——remote-auth 残留会造「云态零数据」
+    // 假丢数据窗口（A8b 发现 2 的镜像），serverFn 提交后立即清理（幂等）
+    expect(sfMocks.clearRemoteAuth).toHaveBeenCalledTimes(1)
+  })
+
+  it('validator：cloudUserId 空串/缺失 → 校验失败', async () => {
+    await expect(reverseFn({ data: { cloudUserId: '' } })).rejects.toThrow()
+    await expect(reverseFn({ data: {} })).rejects.toThrow()
+  })
+})
+
+// ── A8b ⑦：身份字段省略 → 自取 SaaS profile（向后兼容：全传仍用传入值）────
+
+const SAAS_PROFILE = {
+  user: {
+    id: CLOUD,
+    name: '云端昵称',
+    email: 'saas@example.com',
+    avatarConfig: { hat: 2, body: 4 },
+    bgShape: 'circle',
+    bgColor: '#3b82f6',
+  },
+}
+
+describe('transferOwnershipFn 身份字段省略（A8b 自取 SaaS profile）', () => {
+  beforeEach(() => {
+    sfMocks.session = { user: { id: GUEST } }
+    sfMocks.remoteAuth = { userId: CLOUD, sessionToken: 'tok-123' }
+    sfMocks.accountEmpty = true
+    sfMocks.prisma = makePrismaMock()
+    setUpdateCounts(sfMocks.prisma as PrismaMock, 1)
+    fetchMock.mockReset()
+    vi.stubGlobal('fetch', fetchMock)
+  })
+
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('name 省略 → 以 remoteAuth.sessionToken 自取 profile，upsert 载荷携带自取资料', async () => {
+    fetchMock.mockResolvedValue({ ok: true, json: async () => SAAS_PROFILE })
+
+    const result = (await transferFn({ data: { cloudUserId: CLOUD } })) as { rows: number }
+    expect(result.rows).toBe(TEST_OWNERSHIP_COLUMNS.length)
+
+    // 自取请求：SaaS exchange 端点 + 云会话 token cookie（照 exchange 先例）
+    expect(fetchMock).toHaveBeenCalledTimes(1)
+    const [url, init] = fetchMock.mock.calls[0] as [string, { headers: { Cookie: string } }]
+    expect(url).toContain('/api/auth/desktop-callback?exchange=true')
+    expect(init.headers.Cookie).toBe('auth.session-token=tok-123')
+
+    // 云身份行 upsert：昵称/邮箱/头像来自 SaaS（缺 name 兜底 = cloudUserId）
+    const arg = (sfMocks.prisma as PrismaMock).user.upsert.mock.calls[0][0] as {
+      create: Record<string, unknown>
+    }
+    expect(arg.create).toMatchObject({
+      id: CLOUD,
+      username: '云端昵称',
+      email: 'saas@example.com',
+      avatarConfig: { hat: 2, body: 4 },
+      bgShape: 'circle',
+      bgColor: '#3b82f6',
+    })
+  })
+
+  it('字段全传 → 用传入值，零 SaaS 出网（A8a 调用形态向后兼容）', async () => {
+    await transferFn({
+      data: { cloudUserId: CLOUD, name: CLOUD_NAME, email: CLOUD_EMAIL, avatarConfig: CLOUD_AVATAR },
+    })
+    expect(fetchMock).not.toHaveBeenCalled()
+    const arg = (sfMocks.prisma as PrismaMock).user.upsert.mock.calls[0][0] as {
+      create: Record<string, unknown>
+    }
+    expect(arg.create).toMatchObject({
+      username: CLOUD_NAME,
+      email: CLOUD_EMAIL,
+      avatarConfig: CLOUD_AVATAR,
+    })
+  })
+
+  it('name 省略且 SaaS 资料获取失败 → 抛错走 bind:fail，零触库', async () => {
+    fetchMock.mockResolvedValue({ ok: false, status: 503 })
+
+    await expect(transferFn({ data: { cloudUserId: CLOUD } })).rejects.toThrow(/SaaS/)
+    const p = sfMocks.prisma as PrismaMock
+    expect(p.story.updateMany).not.toHaveBeenCalled()
+    expect(p.user.upsert).not.toHaveBeenCalled()
+  })
+
+  it('name 省略且无 sessionToken → 抛错，零出网零触库', async () => {
+    sfMocks.remoteAuth = { userId: CLOUD }
+    await expect(transferFn({ data: { cloudUserId: CLOUD } })).rejects.toThrow(/token/)
+    expect(fetchMock).not.toHaveBeenCalled()
+    expect((sfMocks.prisma as PrismaMock).story.updateMany).not.toHaveBeenCalled()
+  })
+})
+
+// ── A8b ⑧：probeCloudAccountStatusFn 三态（claim 探测）────────────────────
+
+describe('probeCloudAccountStatusFn（claim 探测三态）', () => {
+  beforeEach(() => {
+    sfMocks.session = { user: { id: GUEST } }
+    sfMocks.remoteAuth = { userId: CLOUD, sessionToken: 'tok-123' }
+    sfMocks.checkAuthRateLimit.mockReset()
+    fetchMock.mockReset()
+    // 桌面守卫（isDesktopServer）开闸：本 serverFn 与 exchangeRemoteTokenFn 同口径
+    vi.stubEnv('DEPLOY_TARGET', 'desktop')
+    vi.stubGlobal('fetch', fetchMock)
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+    vi.unstubAllGlobals()
+  })
+
+  it('SaaS 200 空账号 → { empty: true }（cookie 携带云会话 token）', async () => {
+    fetchMock.mockResolvedValue({ ok: true, json: async () => ({ empty: true }) })
+    await expect(probeFn()).resolves.toEqual({ empty: true })
+    const [url, init] = fetchMock.mock.calls[0] as [string, { headers: { Cookie: string } }]
+    expect(url).toContain('/api/sync/account-status')
+    expect(init.headers.Cookie).toBe('auth.session-token=tok-123')
+  })
+
+  it('SaaS 200 非空账号 → { empty: false }', async () => {
+    fetchMock.mockResolvedValue({ ok: true, json: async () => ({ empty: false }) })
+    await expect(probeFn()).resolves.toEqual({ empty: false })
+  })
+
+  it('探测失败三形态（非 200 / 网络异常 / 形状漂移）→ 一律 { empty: false, unreachable: true }', async () => {
+    fetchMock.mockResolvedValue({ ok: false, status: 503 })
+    await expect(probeFn()).resolves.toEqual({ empty: false, unreachable: true })
+
+    fetchMock.mockRejectedValue(new Error('ECONNREFUSED'))
+    await expect(probeFn()).resolves.toEqual({ empty: false, unreachable: true })
+
+    fetchMock.mockResolvedValue({ ok: true, json: async () => ({ empty: 'yes' }) })
+    await expect(probeFn()).resolves.toEqual({ empty: false, unreachable: true })
+  })
+
+  it('无云会话（未交换登录）→ 抛错，零出网', async () => {
+    sfMocks.remoteAuth = { userId: CLOUD }
+    await expect(probeFn()).rejects.toThrow(/云会话/)
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  it('限流挂载：走 checkAuthRateLimit（防探测代理暴力面）', async () => {
+    fetchMock.mockResolvedValue({ ok: true, json: async () => ({ empty: true }) })
+    await probeFn()
+    expect(sfMocks.checkAuthRateLimit).toHaveBeenCalledTimes(1)
+    expect(sfMocks.checkAuthRateLimit.mock.calls[0][0]).toBe('probeCloudAccountStatus')
+  })
+})