@allbluecn/web-app 0.23.5 → 0.23.7

package/src/routes/api/sync/__tests__/bootstrap.test.ts

@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
+// /api/sync/bootstrap 未登录态回归哨兵（sync 族状态码对齐）：requireAuth 抛
+// UnauthorizedError 必须映射 401 + { error: 'unauthorized' }（此前裸调直上抛
+// → 500）。非鉴权异常必须原样上抛（不吞）。
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({ requireAuth: vi.fn(), getPrisma: vi.fn() }))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: () => ({ url: 'https://allblue.test/api/sync/bootstrap' }),
+}))
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: mocks.requireAuth,
+  UnauthorizedError: class UnauthorizedError extends Error {
+    constructor(message = 'UNAUTHORIZED') {
+      super(message)
+      this.name = 'UnauthorizedError'
+    }
+  },
+}))
+vi.mock('@allbluecn/database/get-prisma', () => ({ getPrisma: mocks.getPrisma }))
+
+import { Route } from '../bootstrap'
+import { UnauthorizedError } from '@/server/auth-helpers'
+
+type Handler = () => Promise<Response>
+const GET = (Route.options.server as { handlers?: { GET?: Handler } } | undefined)?.handlers?.GET
+if (!GET) throw new Error('GET handler missing')
+
+const call = () => GET()
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.requireAuth.mockResolvedValue({ user: { id: 'u1' } })
+  mocks.getPrisma.mockResolvedValue({})
+})
+
+describe('/api/sync/bootstrap', () => {
+  it('未登录（UnauthorizedError）→ 401 + { error: "unauthorized" }', async () => {
+    mocks.requireAuth.mockRejectedValue(new UnauthorizedError())
+
+    const res = await call()
+
+    expect(res.status).toBe(401)
+    expect(await res.json()).toEqual({ error: 'unauthorized' })
+    // 鉴权失败不得触达数据库
+    expect(mocks.getPrisma).not.toHaveBeenCalled()
+  })
+
+  it('未登录（裸 Error("UNAUTHORIZED")，跨实例兜底）→ 401', async () => {
+    mocks.requireAuth.mockRejectedValue(new Error('UNAUTHORIZED'))
+
+    const res = await call()
+
+    expect(res.status).toBe(401)
+    expect(await res.json()).toEqual({ error: 'unauthorized' })
+  })
+
+  it('非鉴权异常（取 Prisma 失败）→ 原样上抛，不吞成响应', async () => {
+    mocks.getPrisma.mockRejectedValue(new Error('db down'))
+
+    await expect(call()).rejects.toThrow('db down')
+  })
+})

package/src/routes/api/sync/__tests__/pull.test.ts

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
+// /api/sync/pull 未登录态回归哨兵（sync 族状态码对齐）：requireAuth 抛
+// UnauthorizedError 必须映射 401 + { error: 'unauthorized' }（此前裸调直上抛
+// → 500）。非鉴权异常必须原样上抛（不吞）。
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({ requireAuth: vi.fn() }))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: () => ({ url: 'https://allblue.test/api/sync/pull' }),
+}))
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: mocks.requireAuth,
+  UnauthorizedError: class UnauthorizedError extends Error {
+    constructor(message = 'UNAUTHORIZED') {
+      super(message)
+      this.name = 'UnauthorizedError'
+    }
+  },
+}))
+vi.mock('@allbluecn/database/get-prisma', () => ({ getPrisma: async () => ({}) }))
+
+import { Route } from '../pull'
+import { UnauthorizedError } from '@/server/auth-helpers'
+
+type Handler = (ctx: { request: Request }) => Promise<Response>
+const POST = (Route.options.server as { handlers?: { POST?: Handler } } | undefined)?.handlers?.POST
+if (!POST) throw new Error('POST handler missing')
+
+const post = (body: unknown = { scopes: [], lastSeq: 0 }) =>
+  POST({
+    request: new Request('https://allblue.test/api/sync/pull', {
+      method: 'POST',
+      body: JSON.stringify(body),
+    }),
+  })
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.requireAuth.mockResolvedValue({ user: { id: 'u1' } })
+})
+
+describe('/api/sync/pull', () => {
+  it('未登录（UnauthorizedError）→ 401 + { error: "unauthorized" }', async () => {
+    mocks.requireAuth.mockRejectedValue(new UnauthorizedError())
+
+    const res = await post()
+
+    expect(res.status).toBe(401)
+    expect(await res.json()).toEqual({ error: 'unauthorized' })
+  })
+
+  it('未登录（裸 Error("UNAUTHORIZED")，跨实例兜底）→ 401', async () => {
+    mocks.requireAuth.mockRejectedValue(new Error('UNAUTHORIZED'))
+
+    const res = await post()
+
+    expect(res.status).toBe(401)
+    expect(await res.json()).toEqual({ error: 'unauthorized' })
+  })
+
+  it('非鉴权异常（scopes/lastSeq 缺失，schema 校验失败）→ 原样上抛，不吞成响应', async () => {
+    await expect(post({})).rejects.toMatchObject({ name: 'ZodError' })
+  })
+})

package/src/routes/api/sync/__tests__/push.test.ts

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
+// /api/sync/push 未登录态回归哨兵（sync 族状态码对齐）：requireAuth 抛
+// UnauthorizedError 必须映射 401 + { error: 'unauthorized' }——此前 handler 内
+// 裸调 requireAuth，异常直上抛由框架统一回 500，客户端把「会话过期」误判成
+// 服务端故障并在同步循环里反复重试。非鉴权异常必须原样上抛（不吞）。
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({ requireAuth: vi.fn() }))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: () => ({ url: 'https://allblue.test/api/sync/push' }),
+}))
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: mocks.requireAuth,
+  UnauthorizedError: class UnauthorizedError extends Error {
+    constructor(message = 'UNAUTHORIZED') {
+      super(message)
+      this.name = 'UnauthorizedError'
+    }
+  },
+}))
+vi.mock('@allbluecn/database/get-prisma', () => ({ getPrisma: async () => ({}) }))
+
+import { Route } from '../push'
+import { UnauthorizedError } from '@/server/auth-helpers'
+
+type Handler = (ctx: { request: Request }) => Promise<Response>
+const POST = (Route.options.server as { handlers?: { POST?: Handler } } | undefined)?.handlers?.POST
+if (!POST) throw new Error('POST handler missing')
+
+const post = (body: unknown = { ops: [] }) =>
+  POST({
+    request: new Request('https://allblue.test/api/sync/push', {
+      method: 'POST',
+      body: JSON.stringify(body),
+    }),
+  })
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.requireAuth.mockResolvedValue({ user: { id: 'u1' } })
+})
+
+describe('/api/sync/push', () => {
+  it('未登录（UnauthorizedError）→ 401 + { error: "unauthorized" }', async () => {
+    mocks.requireAuth.mockRejectedValue(new UnauthorizedError())
+
+    const res = await post()
+
+    expect(res.status).toBe(401)
+    expect(await res.json()).toEqual({ error: 'unauthorized' })
+  })
+
+  it('未登录（裸 Error("UNAUTHORIZED")，跨实例兜底）→ 401', async () => {
+    mocks.requireAuth.mockRejectedValue(new Error('UNAUTHORIZED'))
+
+    const res = await post()
+
+    expect(res.status).toBe(401)
+    expect(await res.json()).toEqual({ error: 'unauthorized' })
+  })
+
+  it('非鉴权异常（ops 缺失，schema 校验失败）→ 原样上抛，不吞成响应', async () => {
+    await expect(post({})).rejects.toMatchObject({ name: 'ZodError' })
+  })
+})

package/src/routes/api/sync/__tests__/snapshot.test.ts

@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
+// /api/sync/snapshot 未登录态回归哨兵（sync 族状态码对齐）：requireAuth 抛
+// UnauthorizedError 必须映射 401 + { error: 'unauthorized' }（此前裸调直上抛
+// → 500）。非鉴权异常必须原样上抛（不吞）。
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({ requireAuth: vi.fn() }))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: () => ({ url: 'https://allblue.test/api/sync/snapshot' }),
+}))
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: mocks.requireAuth,
+  UnauthorizedError: class UnauthorizedError extends Error {
+    constructor(message = 'UNAUTHORIZED') {
+      super(message)
+      this.name = 'UnauthorizedError'
+    }
+  },
+}))
+vi.mock('@allbluecn/database/get-prisma', () => ({ getPrisma: async () => ({}) }))
+
+import { Route } from '../snapshot'
+import { UnauthorizedError } from '@/server/auth-helpers'
+
+type Handler = (ctx: { request: Request }) => Promise<Response>
+const GET = (Route.options.server as { handlers?: { GET?: Handler } } | undefined)?.handlers?.GET
+if (!GET) throw new Error('GET handler missing')
+
+/** table 合法时才会走到业务查询；未登录用例用合法 URL 确保失败点只在鉴权 */
+const call = (table = 'projects') =>
+  GET({
+    request: new Request(`https://allblue.test/api/sync/snapshot?table=${table}`),
+  })
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.requireAuth.mockResolvedValue({ user: { id: 'u1' } })
+})
+
+describe('/api/sync/snapshot', () => {
+  it('未登录（UnauthorizedError）→ 401 + { error: "unauthorized" }', async () => {
+    mocks.requireAuth.mockRejectedValue(new UnauthorizedError())
+
+    const res = await call()
+
+    expect(res.status).toBe(401)
+    expect(await res.json()).toEqual({ error: 'unauthorized' })
+  })
+
+  it('未登录（裸 Error("UNAUTHORIZED")，跨实例兜底）→ 401', async () => {
+    mocks.requireAuth.mockRejectedValue(new Error('UNAUTHORIZED'))
+
+    const res = await call()
+
+    expect(res.status).toBe(401)
+    expect(await res.json()).toEqual({ error: 'unauthorized' })
+  })
+
+  it('非鉴权异常（缺少 table 参数，schema 校验失败）→ 原样上抛，不吞成响应', async () => {
+    await expect(call('')).rejects.toMatchObject({ name: 'ZodError' })
+  })
+})

package/src/routes/api/sync/bootstrap.ts

@@ -9,6 +9,7 @@ import { createFileRoute } from "@tanstack/react-router"
 import { getRequest } from "@tanstack/react-start/server"
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { requireAuth } from "@/server/auth-helpers"
+import { mapSyncAuthError } from "@/server/sync/http-errors"
 import { resolveSyncScopes } from "@/server/sync/scopes"
 import { SYNC_TABLES } from "@allbluecn/sync-core/registrations"
 
@@ -16,22 +17,26 @@ export const Route = createFileRoute("/api/sync/bootstrap")({
   server: {
     handlers: {
       GET: async () => {
-        const session = await requireAuth(getRequest())
-        const prisma = await getPrisma()
+        try {
+          const session = await requireAuth(getRequest())
+          const prisma = await getPrisma()
 
-        const [{ seq }] = await prisma.$queryRawUnsafe<Array<{ seq: bigint }>>(
-          `SELECT COALESCE(MAX(seq), 0) AS seq FROM sync_change_log`,
-        )
-        const counts = await Promise.all(
-          SYNC_TABLES.map(async (reg) => {
-            const [r] = await prisma.$queryRawUnsafe<Array<{ c: bigint }>>(
-              `SELECT COUNT(*)::bigint AS c FROM ${reg.table}`,
-            )
-            return { name: reg.table, count: Number(r.c) }
-          }),
-        )
-        void resolveSyncScopes // scopes 解析在快照分页端点逐页执行（此处仅鉴权）
-        return Response.json({ watermarkSeq: Number(seq), tables: counts })
+          const [{ seq }] = await prisma.$queryRawUnsafe<Array<{ seq: bigint }>>(
+            `SELECT COALESCE(MAX(seq), 0) AS seq FROM sync_change_log`,
+          )
+          const counts = await Promise.all(
+            SYNC_TABLES.map(async (reg) => {
+              const [r] = await prisma.$queryRawUnsafe<Array<{ c: bigint }>>(
+                `SELECT COUNT(*)::bigint AS c FROM ${reg.table}`,
+              )
+              return { name: reg.table, count: Number(r.c) }
+            }),
+          )
+          void resolveSyncScopes // scopes 解析在快照分页端点逐页执行（此处仅鉴权）
+          return Response.json({ watermarkSeq: Number(seq), tables: counts })
+        } catch (e) {
+          return mapSyncAuthError(e)
+        }
       },
     },
   },

package/src/routes/api/sync/pull.ts

@@ -9,6 +9,7 @@ import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { requireAuth } from "@/server/auth-helpers"
+import { mapSyncAuthError } from "@/server/sync/http-errors"
 import { resolveSyncScopes } from "@/server/sync/scopes"
 
 const pullSchema = z.object({
@@ -23,73 +24,77 @@ export const Route = createFileRoute("/api/sync/pull")({
   server: {
     handlers: {
       POST: async ({ request }) => {
-        const session = await requireAuth(getRequest())
-        const userId = session.user.id
-        const body = pullSchema.parse(await request.json())
+        try {
+          const session = await requireAuth(getRequest())
+          const userId = session.user.id
+          const body = pullSchema.parse(await request.json())
 
-        const prisma = await getPrisma()
-        const { SYNC_TABLE_MAP } = await import("@allbluecn/sync-core/registrations")
-        // scopes 服务端权威解析（客户端回显值仅作对账提示，不参与过滤）
-        const scopes = await resolveSyncScopes(prisma, userId)
-        const limit = Math.min(body.limit ?? PAGE_LIMIT, PAGE_LIMIT)
+          const prisma = await getPrisma()
+          const { SYNC_TABLE_MAP } = await import("@allbluecn/sync-core/registrations")
+          // scopes 服务端权威解析（客户端回显值仅作对账提示，不参与过滤）
+          const scopes = await resolveSyncScopes(prisma, userId)
+          const limit = Math.min(body.limit ?? PAGE_LIMIT, PAGE_LIMIT)
 
-        const logRows = await prisma.$queryRawUnsafe<
-          Array<{ seq: bigint; table_name: string; pk: string; op: string }>
-        >(
-          `SELECT seq, table_name, pk, op FROM sync_change_log
+          const logRows = await prisma.$queryRawUnsafe<
+            Array<{ seq: bigint; table_name: string; pk: string; op: string }>
+          >(
+            `SELECT seq, table_name, pk, op FROM sync_change_log
 WHERE seq > $1 AND scope = ANY($2)
 ORDER BY seq ASC
 LIMIT $3`,
-          body.lastSeq,
-          scopes,
-          limit + 1,
-        )
-        const hasMore = logRows.length > limit
-        const page = hasMore ? logRows.slice(0, limit) : logRows
+            body.lastSeq,
+            scopes,
+            limit + 1,
+          )
+          const hasMore = logRows.length > limit
+          const page = hasMore ? logRows.slice(0, limit) : logRows
 
-        const changes: Array<Record<string, unknown>> = []
-        for (const row of page) {
-          const reg = SYNC_TABLE_MAP.get(row.table_name)
-          if (!reg) continue // 未注册表（历史注册被移除）跳过
-          const change: Record<string, unknown> = {
-            table: row.table_name,
-            pk: row.pk,
-            op: row.op,
-          }
-          if (row.op === "upsert") {
-            // pk 来自 change_log（客户端 push 时写入）——键必须经注册表 pkColumns
-            // 白名单过滤（注入面收口），值参数化
-            const params: unknown[] = []
-            let where: string
-            if (reg.pkColumns.length === 1) {
-              params.push(row.pk)
-              where = `"${reg.pkColumns[0]}" = $1`
+          const changes: Array<Record<string, unknown>> = []
+          for (const row of page) {
+            const reg = SYNC_TABLE_MAP.get(row.table_name)
+            if (!reg) continue // 未注册表（历史注册被移除）跳过
+            const change: Record<string, unknown> = {
+              table: row.table_name,
+              pk: row.pk,
+              op: row.op,
+            }
+            if (row.op === "upsert") {
+              // pk 来自 change_log（客户端 push 时写入）——键必须经注册表 pkColumns
+              // 白名单过滤（注入面收口），值参数化
+              const params: unknown[] = []
+              let where: string
+              if (reg.pkColumns.length === 1) {
+                params.push(row.pk)
+                where = `"${reg.pkColumns[0]}" = $1`
+              } else {
+                const parsed = JSON.parse(row.pk) as Record<string, string>
+                where = reg.pkColumns
+                  .map((k) => {
+                    params.push(parsed[k])
+                    return `"${k}" = $${params.length}`
+                  })
+                  .join(" AND ")
+              }
+              const rows = await prisma.$queryRawUnsafe<Record<string, unknown>[]>(
+                `SELECT ${reg.columns.map((c) => `"${c}"`).join(", ")}, sync_version FROM ${reg.table} WHERE ${where}`,
+                ...params,
+              )
+              if (rows.length === 0) continue // 行已删（change_log 略滞后），下轮 delete 事件收敛
+              const payload: Record<string, unknown> = {}
+              for (const c of reg.columns) payload[c] = rows[0][c] ?? null
+              change.payload = payload
+              change.syncVersion = Number(rows[0].sync_version ?? 0)
             } else {
-              const parsed = JSON.parse(row.pk) as Record<string, string>
-              where = reg.pkColumns
-                .map((k) => {
-                  params.push(parsed[k])
-                  return `"${k}" = $${params.length}`
-                })
-                .join(" AND ")
+              change.syncVersion = 0
             }
-            const rows = await prisma.$queryRawUnsafe<Record<string, unknown>[]>(
-              `SELECT ${reg.columns.map((c) => `"${c}"`).join(", ")}, sync_version FROM ${reg.table} WHERE ${where}`,
-              ...params,
-            )
-            if (rows.length === 0) continue // 行已删（change_log 略滞后），下轮 delete 事件收敛
-            const payload: Record<string, unknown> = {}
-            for (const c of reg.columns) payload[c] = rows[0][c] ?? null
-            change.payload = payload
-            change.syncVersion = Number(rows[0].sync_version ?? 0)
-          } else {
-            change.syncVersion = 0
+            changes.push(change)
           }
-          changes.push(change)
-        }
 
-        const nextSeq = page.length ? Number(page[page.length - 1].seq) : body.lastSeq
-        return Response.json({ changes, nextSeq, hasMore })
+          const nextSeq = page.length ? Number(page[page.length - 1].seq) : body.lastSeq
+          return Response.json({ changes, nextSeq, hasMore })
+        } catch (e) {
+          return mapSyncAuthError(e)
+        }
       },
     },
   },

package/src/routes/api/sync/push.ts

@@ -15,6 +15,7 @@ import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { requireAuth } from "@/server/auth-helpers"
+import { mapSyncAuthError } from "@/server/sync/http-errors"
 import { resolveSyncScopes } from "@/server/sync/scopes"
 
 const pushSchema = z.object({
@@ -82,72 +83,76 @@ export const Route = createFileRoute("/api/sync/push")({
   server: {
     handlers: {
       POST: async ({ request }) => {
-        const session = await requireAuth(getRequest())
-        const userId = session.user.id
-        const body = pushSchema.parse(await request.json())
+        try {
+          const session = await requireAuth(getRequest())
+          const userId = session.user.id
+          const body = pushSchema.parse(await request.json())
 
-        const prisma = await getPrisma()
-        const { applyOp, admitScopeForOp } = await import("@allbluecn/sync-core")
-        const { SYNC_TABLE_MAP } = await import("@allbluecn/sync-core/registrations")
-        const scopes = await resolveSyncScopes(prisma, userId)
-        // 首次上云的 scope 动态准入（C1 / 裁定 R5）：空云账号的 scopes 只有
-        // user:<id>，而 outbox 的容器行 scope = 自身 id、子行 scope = 父容器 id。
-        // 逐 op 按「属主自证」累积准入集合（同一 Set 穿过整批 op，依赖 outbox
-        // 的父先子后拓扑序），再交给 applyOp 做行级校验——准入只覆盖自证行，
-        // 不放宽到整表（边界见 @allbluecn/sync-core 的 scope-admission 头注释）。
-        const admittedScopes = new Set(scopes)
+          const prisma = await getPrisma()
+          const { applyOp, admitScopeForOp } = await import("@allbluecn/sync-core")
+          const { SYNC_TABLE_MAP } = await import("@allbluecn/sync-core/registrations")
+          const scopes = await resolveSyncScopes(prisma, userId)
+          // 首次上云的 scope 动态准入（C1 / 裁定 R5）：空云账号的 scopes 只有
+          // user:<id>，而 outbox 的容器行 scope = 自身 id、子行 scope = 父容器 id。
+          // 逐 op 按「属主自证」累积准入集合（同一 Set 穿过整批 op，依赖 outbox
+          // 的父先子后拓扑序），再交给 applyOp 做行级校验——准入只覆盖自证行，
+          // 不放宽到整表（边界见 @allbluecn/sync-core 的 scope-admission 头注释）。
+          const admittedScopes = new Set(scopes)
 
-        // 整批单事务：逐 op 应用（依赖拓扑由客户端 outbox 顺序保证）
-        const results = await prisma.$transaction(async (tx) => {
-          const executor = {
-            query: <T = Record<string, unknown>>(sql: string, params: unknown[]) =>
-              tx.$queryRawUnsafe<T[]>(sql, ...params),
-            execute: (sql: string, params: unknown[]) =>
-              tx.$executeRawUnsafe(sql, ...params),
-          }
-          const out: Array<Record<string, unknown>> = []
-          for (const op of body.ops) {
-            const reg = SYNC_TABLE_MAP.get(op.table)
-            if (!reg) {
-              out.push({ opId: op.opId, status: "conflict", conflict: { reason: "unknownTable" } })
-              continue
+          // 整批单事务：逐 op 应用（依赖拓扑由客户端 outbox 顺序保证）
+          const results = await prisma.$transaction(async (tx) => {
+            const executor = {
+              query: <T = Record<string, unknown>>(sql: string, params: unknown[]) =>
+                tx.$queryRawUnsafe<T[]>(sql, ...params),
+              execute: (sql: string, params: unknown[]) =>
+                tx.$executeRawUnsafe(sql, ...params),
             }
-            const payload = op.payload as SyncPayload | undefined
-            await admitScopeForOp(executor, reg, { pk: op.pk, op: op.op, payload }, userId, admittedScopes)
-            const ctxScopes = [...admittedScopes]
-            let outcome = await applyOp(executor, reg, { ...op, payload }, {
-              userId,
-              scopes: ctxScopes,
-              now: new Date(),
-            })
-            // 编号重发号特例：stories/bugs 撞 identifier 唯一键 → 服务端重发号重试
-            if (outcome.kind === "conflict" && outcome.reason === "uniqueViolation" && (op.table === "stories" || op.table === "bugs") && payload) {
-              const oldIdentifier = payload.identifier as string | undefined
-              const newIdentifier = await reissueIdentifier(tx, op.table, payload)
-              if (newIdentifier && newIdentifier !== oldIdentifier) {
-                outcome = await applyOp(executor, reg, { ...op, payload }, {
-                  userId,
-                  scopes: ctxScopes,
-                  now: new Date(),
-                })
-                if (outcome.kind === "applied") {
-                  out.push({
-                    opId: op.opId,
-                    status: "applied",
-                    syncVersion: outcome.syncVersion,
-                    row: outcome.row,
-                    renamed: { from: oldIdentifier ?? "", to: newIdentifier },
+            const out: Array<Record<string, unknown>> = []
+            for (const op of body.ops) {
+              const reg = SYNC_TABLE_MAP.get(op.table)
+              if (!reg) {
+                out.push({ opId: op.opId, status: "conflict", conflict: { reason: "unknownTable" } })
+                continue
+              }
+              const payload = op.payload as SyncPayload | undefined
+              await admitScopeForOp(executor, reg, { pk: op.pk, op: op.op, payload }, userId, admittedScopes)
+              const ctxScopes = [...admittedScopes]
+              let outcome = await applyOp(executor, reg, { ...op, payload }, {
+                userId,
+                scopes: ctxScopes,
+                now: new Date(),
+              })
+              // 编号重发号特例：stories/bugs 撞 identifier 唯一键 → 服务端重发号重试
+              if (outcome.kind === "conflict" && outcome.reason === "uniqueViolation" && (op.table === "stories" || op.table === "bugs") && payload) {
+                const oldIdentifier = payload.identifier as string | undefined
+                const newIdentifier = await reissueIdentifier(tx, op.table, payload)
+                if (newIdentifier && newIdentifier !== oldIdentifier) {
+                  outcome = await applyOp(executor, reg, { ...op, payload }, {
+                    userId,
+                    scopes: ctxScopes,
+                    now: new Date(),
                   })
-                  continue
+                  if (outcome.kind === "applied") {
+                    out.push({
+                      opId: op.opId,
+                      status: "applied",
+                      syncVersion: outcome.syncVersion,
+                      row: outcome.row,
+                      renamed: { from: oldIdentifier ?? "", to: newIdentifier },
+                    })
+                    continue
+                  }
                 }
               }
+              out.push(mapOutcome(op.opId, outcome))
             }
-            out.push(mapOutcome(op.opId, outcome))
-          }
-          return out
-        })
+            return out
+          })
 
-        return Response.json({ results })
+          return Response.json({ results })
+        } catch (e) {
+          return mapSyncAuthError(e)
+        }
       },
     },
   },