@allbluecn/web-app 0.23.6 → 0.23.7

package/src/routes/_nav/settings/account/route.tsx

@@ -19,6 +19,8 @@ import { createFileRoute, redirect } from '@tanstack/react-router'
 import { getAccountTeamFn } from '@/server/serverFns/settings/account-team'
 import type { AvatarConfig } from '@allbluecn/kernel'
 import { toAvatarShape } from '@/components/shared-kit/avatars/avatar-shape'
+import { isDesktopServer } from '@/server/desktop-guest'
+import { isDesktopClient } from '@/lib/desktop-env'
 
 export const Route = createFileRoute('/_nav/settings/account')({
   beforeLoad: async () => {
@@ -32,6 +34,9 @@ export const Route = createFileRoute('/_nav/settings/account')({
     }
     // 未登录走框架跳转（beforeLoad + redirect），不再下发错误状态由组件二次判断
     if (result.error === 'unauthorized') {
+      // 桌面端免登录：不自动跳 /login（本地 guest 已就绪时这里是异常态），
+      // 降级为页面错误态，登录与否由用户自主决定
+      if (isDesktopServer() || isDesktopClient()) return { error: 'error' as const }
       throw redirect({ to: '/login' })
     }
     return {

package/src/routes/_nav/settings/team/route.tsx

@@ -17,6 +17,8 @@
 
 import { createFileRoute, redirect } from '@tanstack/react-router'
 import { getAccountTeamFn } from '@/server/serverFns/settings/account-team'
+import { isDesktopServer } from '@/server/desktop-guest'
+import { isDesktopClient } from '@/lib/desktop-env'
 
 export const Route = createFileRoute('/_nav/settings/team')({
   beforeLoad: async () => {
@@ -29,6 +31,9 @@ export const Route = createFileRoute('/_nav/settings/team')({
     }
     // 未登录走框架跳转（beforeLoad + redirect），不再下发错误状态由组件二次判断
     if (result.error === 'unauthorized') {
+      // 桌面端免登录：不自动跳 /login（本地 guest 已就绪时这里是异常态），
+      // 降级为页面错误态，登录与否由用户自主决定
+      if (isDesktopServer() || isDesktopClient()) return { error: 'error' as const }
       throw redirect({ to: '/login' })
     }
     return {

package/src/routes/api/auth/$.ts

@@ -16,13 +16,98 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createFileRoute } from '@tanstack/react-router'
-import { getAuthConfig } from '@/lib/auth/auth.config'
 import { StartAuthJS } from 'start-authjs'
+import { getAuthConfig } from '@/lib/auth/auth.config'
+import { getCurrentSession } from '@/lib/session'
+import { GUEST_USER_ID, isDesktopServer } from '@/server/desktop-guest'
+import { ensureLocalShadowUser } from '@/server/desktop-bootstrap'
+
+/**
+ * 桌面端「我是谁」端点回落（本地优先 P0 修复）：
+ *
+ * 客户端 useSession()（components/shared-kit/auth/auth-client.ts）打的就是
+ * /api/auth/session。authjs 只认自己的 JWT cookie —— 桌面壳里没有（本地免登录
+ * + 云端身份在 remote-auth.json），于是恒返回 null，所有以 session 判登录态的
+ * 组件（user-menu / collab gate / 评论署名 / AI 面板等）都把本地用户当匿名。
+ *
+ * 修法（服务端单点，覆盖面最大）：仅拦截 GET /api/auth/session，authjs 无会话
+ * 且为桌面部署时回落 getCurrentSession（鉴权单点：authjs → remote-auth 云身份
+ * → guest 影子用户）。其它路径（csrf/providers/signin/callback/...）与 POST
+ * 原样透传，登录/登出语义零改动。
+ *
+ * 安全：/api/auth/session 本就是会话自述端点，返回当前（可能 guest/云）身份
+ * 不扩大暴露面；Session 结构里没有 token/密钥。非桌面部署行为完全不变。
+ *
+ * guest 分支附带「懒 seed 影子用户」（幂等 upsert，失败仅 warn）：端点可能在
+ * root beforeLoad 的 getSessionFn 之前/失败时被调用，不 seed 就会下发一个 DB
+ * 里不存在的身份，随后写入撞 FK（P2003）。
+ */
+function isDesktopSessionEndpoint(request: Request): boolean {
+  if (!isDesktopServer()) return false
+  const pathname = new URL(request.url).pathname.replace(/\/+$/, '')
+  return pathname === '/api/auth/session'
+}
+
+/** 透传 authjs 的 Set-Cookie（坏 cookie 清理头），只替换 body */
+function rebuildSessionResponse(response: Response, payload: unknown): Response {
+  const headers = new Headers()
+  // undici 实现才有 getSetCookie；类型上做可选收窄，其它运行时退化为无 cookie 透传
+  const setCookies = (response.headers as Headers & { getSetCookie?: () => string[] }).getSetCookie?.() ?? []
+  for (const cookie of setCookies) headers.append('set-cookie', cookie)
+  headers.set('content-type', 'application/json')
+  headers.set('cache-control', 'no-store')
+  return new Response(JSON.stringify(payload), {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  })
+}
 
 export const Route = createFileRoute('/api/auth/$')({
   server: {
     handlers: {
-      GET: async ({ request }) => (await StartAuthJS(await getAuthConfig())).GET({ request }),
+      GET: async ({ request }) => {
+        const response = await (await StartAuthJS(await getAuthConfig())).GET({ request })
+        // 非桌面 / 非 session 端点 / 非 2xx：原样透传
+        if (!isDesktopSessionEndpoint(request) || !response.ok) return response
+
+        // authjs session 响应是 JSON：有会话 → { user, expires }；无会话 → null。
+        // Response body 只能读一次，故读文本后统一重建。
+        const text = await response.text()
+        let payload: unknown
+        try {
+          payload = JSON.parse(text)
+        } catch {
+          return rebuildSessionResponse(response, text)
+        }
+
+        const authUser = (payload as { user?: { id?: string } | null } | null)?.user
+        // 桌面本地凭据登录（有 authjs cookie）：authjs 结果优先，原样返回
+        if (authUser?.id) return rebuildSessionResponse(response, payload)
+
+        const session = await getCurrentSession(request)
+        if (!session?.user?.id) return rebuildSessionResponse(response, payload)
+
+        // guest 回落：懒 seed 本地影子用户（与 getSessionFn 同一幂等落库）。
+        // 只在 getSessionFn 里 seed 不够——root beforeLoad 的 RPC 失败/慢于端点时，
+        // 这里会下发一个 DB 里不存在的 guest 身份，随后任何写入都撞 FK（P2003）。
+        // 幂等 upsert，失败仅 warn：不阻断「我是谁」响应（首启体验优先）。
+        if (session.user.id === GUEST_USER_ID) {
+          try {
+            await ensureLocalShadowUser()
+          } catch (err) {
+            console.warn('[api/auth/session] 本地影子用户落库失败（不阻断 guest 身份响应）:', err)
+          }
+        }
+
+        return rebuildSessionResponse(response, {
+          user: session.user,
+          expires: session.expires,
+          // 会话来源标记：user-menu 的云态登出编排需区分「云身份」与本地
+          // authjs 凭据登录（二者 user.isGuest 均为 false），旧后端无此字段
+          desktopSession: session.user.isGuest ? 'guest' : 'cloud',
+        })
+      },
       POST: async ({ request }) => (await StartAuthJS(await getAuthConfig())).POST({ request }),
     },
   },

package/src/routes/api/auth/__tests__/auth-session-desktop.test.ts

@@ -0,0 +1,194 @@
+// /api/auth/$ 的 GET 桌面回落（useSession 依赖的「我是谁」端点）。
+// 根因：authjs 只认自己的 JWT cookie，桌面壳内（本地免登录 / 云端身份在
+// remote-auth.json）恒返回 null → useSession() 恒 null → 各组件把本地用户当匿名。
+// 修法：仅 GET /api/auth/session 在 desktop 且 authjs 无会话时回落
+// getCurrentSession（authjs → remote-auth 云身份 → guest 影子身份）。
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const H = vi.hoisted(() => ({
+  getSession: vi.fn(),
+  readRemoteAuth: vi.fn(),
+  authJsGet: vi.fn(),
+  authJsPost: vi.fn(),
+  ensureLocalShadowUser: vi.fn(async () => 'local-guest'),
+  desktopServer: true,
+}))
+
+vi.mock('start-authjs', () => ({
+  StartAuthJS: async () => ({ GET: H.authJsGet, POST: H.authJsPost }),
+  getSession: H.getSession,
+}))
+vi.mock('@/lib/auth/auth.config', () => ({
+  getAuthConfig: async () => ({}),
+  resetProfileCache: vi.fn(),
+}))
+vi.mock('@/server/remote-auth', () => ({
+  readRemoteAuth: H.readRemoteAuth,
+}))
+// seed 走真模块会拉起 @allbluecn/database 的模块级 prisma 单例（测试环境无 DB）
+vi.mock('@/server/desktop-bootstrap', () => ({
+  ensureLocalShadowUser: H.ensureLocalShadowUser,
+}))
+
+type AuthRoute = typeof import('../$')['Route']
+
+async function importAuthRoute(desktop: boolean): Promise<AuthRoute> {
+  vi.resetModules()
+  H.desktopServer = desktop
+  vi.doMock('@/server/desktop-guest', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@/server/desktop-guest')>()
+    return { ...actual, isDesktopServer: () => H.desktopServer }
+  })
+  return (await import('../$')).Route
+}
+
+/** 模拟 authjs 的 session 端点响应（无会话 → JSON null） */
+function authJsResponse(body: unknown, init?: ResponseInit): Response {
+  return new Response(JSON.stringify(body), {
+    status: 200,
+    headers: { 'content-type': 'application/json' },
+    ...init,
+  })
+}
+
+function callGet(Route: AuthRoute, path = '/api/auth/session'): Promise<Response> {
+  const handlers = (Route.options as unknown as {
+    server: { handlers: Record<string, (ctx: { request: Request }) => Promise<Response>> }
+  }).server.handlers
+  return handlers.GET!({ request: new Request(`http://localhost${path}`, { method: 'GET' }) })
+}
+
+describe('/api/auth/session 桌面回落', () => {
+  beforeEach(() => {
+    // 真实桌面后端由 Electron 主进程注入该 env（fail-open 自检的正常路径）：
+    // 测试里显式给出，避免每条用例都打安全告警
+    vi.stubEnv('DESKTOP_USER_DATA_DIR', '/tmp/allblue-desktop-test')
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+    vi.clearAllMocks()
+  })
+
+  it('desktop + 无 authjs cookie → 返回 guest 影子身份（user.id=local-guest）且懒 seed 影子用户', async () => {
+    H.getSession.mockResolvedValue(null)
+    H.readRemoteAuth.mockResolvedValue(null)
+    H.authJsGet.mockResolvedValue(authJsResponse(null))
+
+    const Route = await importAuthRoute(true)
+    const res = await callGet(Route)
+    const data = (await res.json()) as { user?: { id?: string; isGuest?: boolean }; desktopSession?: string }
+
+    expect(res.status).toBe(200)
+    expect(data.user?.id).toBe('local-guest')
+    expect(data.user?.isGuest).toBe(true)
+    expect(data.desktopSession).toBe('guest')
+    // I3：端点命中 guest 时补 seed（不能只靠 root beforeLoad 的 getSessionFn——
+    // 那一步 RPC 失败时这里会下发未落库身份，后续写入撞 FK P2003）
+    expect(H.ensureLocalShadowUser).toHaveBeenCalledTimes(1)
+  })
+
+  it('desktop guest seed 抛错：仅 warn，不阻断「我是谁」响应', async () => {
+    H.getSession.mockResolvedValue(null)
+    H.readRemoteAuth.mockResolvedValue(null)
+    H.authJsGet.mockResolvedValue(authJsResponse(null))
+    H.ensureLocalShadowUser.mockRejectedValueOnce(new Error('db gone'))
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    const Route = await importAuthRoute(true)
+    const res = await callGet(Route)
+    const data = (await res.json()) as { user?: { id?: string } }
+
+    expect(res.status).toBe(200)
+    expect(data.user?.id).toBe('local-guest')
+    expect(warnSpy).toHaveBeenCalled()
+  })
+
+  it('desktop + remoteAuth 云身份 → 返回云 userId（不是 guest），且不 seed guest 影子行', async () => {
+    H.getSession.mockResolvedValue(null)
+    H.readRemoteAuth.mockResolvedValue({
+      userId: 'cloud-user-abc',
+      planName: 'pro',
+      features: {},
+      sessionToken: 'cloud-session-token',
+      username: '云端用户',
+    })
+    H.authJsGet.mockResolvedValue(authJsResponse(null))
+
+    const Route = await importAuthRoute(true)
+    const data = (await (await callGet(Route)).json()) as {
+      user?: { id?: string; name?: string; isGuest?: boolean }
+      desktopSession?: string
+    }
+
+    expect(data.user?.id).toBe('cloud-user-abc')
+    expect(data.user?.name).toBe('云端用户')
+    expect(data.user?.isGuest).toBe(false)
+    expect(data.desktopSession).toBe('cloud')
+    expect(H.ensureLocalShadowUser).not.toHaveBeenCalled()
+  })
+
+  it('非 desktop：authjs 的 null 原样透传（不扩大暴露面）', async () => {
+    H.getSession.mockResolvedValue(null)
+    H.readRemoteAuth.mockResolvedValue(null)
+    H.authJsGet.mockResolvedValue(authJsResponse(null))
+
+    const Route = await importAuthRoute(false)
+    const data = await (await callGet(Route)).json()
+
+    expect(data).toBeNull()
+  })
+
+  it('desktop + 有效 authjs 会话：authjs 结果优先（不追加 desktopSession 标记）', async () => {
+    const authJsSession = { user: { id: 'authjs-user-1', name: '本地账号' }, expires: '2026-12-31' }
+    H.getSession.mockResolvedValue(authJsSession)
+    H.authJsGet.mockResolvedValue(authJsResponse(authJsSession))
+
+    const Route = await importAuthRoute(true)
+    const data = (await (await callGet(Route)).json()) as Record<string, unknown>
+
+    expect((data.user as { id?: string }).id).toBe('authjs-user-1')
+    expect(data.desktopSession).toBeUndefined()
+  })
+
+  it('desktop + 非 session 路径（csrf）：原样透传，不做身份回落', async () => {
+    H.authJsGet.mockResolvedValue(
+      new Response(JSON.stringify({ csrfToken: 't' }), { status: 200, headers: { 'content-type': 'application/json' } }),
+    )
+
+    const Route = await importAuthRoute(true)
+    const data = (await (await callGet(Route, '/api/auth/csrf')).json()) as Record<string, unknown>
+
+    expect(data.csrfToken).toBe('t')
+    expect(H.getSession).not.toHaveBeenCalled()
+  })
+
+  it('POST 原样交给 authjs（登录/登出流程零改动）', async () => {
+    H.authJsPost.mockResolvedValue(new Response('{}', { status: 200 }))
+
+    const Route = await importAuthRoute(true)
+    const handlers = (Route.options as unknown as {
+      server: { handlers: Record<string, (ctx: { request: Request }) => Promise<Response>> }
+    }).server.handlers
+    const res = await handlers.POST!({
+      request: new Request('http://localhost/api/auth/callback/credentials', { method: 'POST' }),
+    })
+
+    expect(H.authJsPost).toHaveBeenCalledTimes(1)
+    expect(res.status).toBe(200)
+  })
+
+  it('透传 authjs 的 Set-Cookie（坏 cookie 清理头不丢）', async () => {
+    H.getSession.mockResolvedValue(null)
+    H.readRemoteAuth.mockResolvedValue(null)
+    H.authJsGet.mockResolvedValue(
+      authJsResponse(null, { headers: { 'content-type': 'application/json', 'set-cookie': 'auth.session-token=; Max-Age=0' } }),
+    )
+
+    const Route = await importAuthRoute(true)
+    const res = await callGet(Route)
+
+    expect(res.headers.getSetCookie().some((c) => c.startsWith('auth.session-token='))).toBe(true)
+    expect(res.headers.get('cache-control')).toBe('no-store')
+  })
+})

package/src/server/desktop-guest.ts

@@ -38,5 +38,9 @@ export function buildGuestSession(): Session {
 }
 
 export function isDesktopServer(): boolean {
-  return process.env.DEPLOY_TARGET === 'desktop'
+  // 本模块被路由模块（如 _nav/route.tsx 的 beforeLoad）在客户端一并加载：
+  // 浏览器 bundle 无 Node process（或 env 被静态替换为空对象）时必须安全
+  // 返回 false——客户端侧的桌面判定走 lib/desktop-env.ts 的 isDesktopClient()
+  // （desktopBridge 运行时事实），两者在 beforeLoad 里合并使用。
+  return typeof process !== 'undefined' && process.env?.DEPLOY_TARGET === 'desktop'
 }

package/src/server/serverFns/auth/session.ts

@@ -22,7 +22,7 @@ import type { FeatureKey } from '@allbluecn/kernel'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import { getCurrentSession } from '@/lib/session'
 import { resetProfileCache } from '@/lib/auth/auth.config'
-import { buildGuestSession, isDesktopServer } from '@/server/desktop-guest'
+import { buildGuestSession, isDesktopServer, isGuestSession } from '@/server/desktop-guest'
 import { ensureLocalShadowUser } from '@/server/desktop-bootstrap'
 import { ensureCloudIdentity } from '@/server/desktop-cloud-identity'
 import { readRemoteAuth, writeRemoteAuth, writeRemoteSession, clearRemoteAuth } from '@/server/remote-auth'
@@ -53,22 +53,31 @@ const saasProfileSchema = z.object({
 // getCurrentSession 桌面回落需复用同一组装，且 lib/session 不得 import
 // serverFns/**（循环依赖），组装点移至 server 域纯模块。
 
+/** 桌面 guest 懒 seed 影子用户：失败仅 warn 不阻断会话发放（首启体验优先，规格 §3.1） */
+async function ensureGuestSeeded(): Promise<void> {
+  try {
+    await ensureLocalShadowUser()
+  } catch (err) {
+    console.warn('[getSessionFn] 本地影子用户落库失败（不阻断 guest 会话）:', err)
+  }
+}
+
 export const getSessionFn = createServerFn({ method: 'GET' })
   .handler(async () => {
     const request = getRequest()
     const session = await getCurrentSession(request)
-    if (session?.user?.id) return session
+    if (session?.user?.id) {
+      // getCurrentSession 已含桌面 guest 回落（鉴权单点）：guest 首启仍需懒 seed
+      // 本地影子用户（本地优先 P1），使 assertOwned/requireUserInDb/FK 全链可写。
+      // 失败仅 warn 不阻断会话发放——首启体验优先（规格 §3.1），下一请求再重试。
+      if (isGuestSession(session)) await ensureGuestSeeded()
+      return session
+    }
     if (!isDesktopServer()) return null
     const remoteAuth = await readRemoteAuth()
     if (remoteAuth) return buildRemoteSession(remoteAuth)
-    // 桌面 guest 分支懒 seed 影子用户（本地优先 P1）：首启为 local-guest 落库，
-    // 使 assertOwned/requireUserInDb/FK 全链可写。失败仅 warn 不阻断会话发放
-    // ——首启体验优先（规格 §3.1），下一请求再重试。
-    try {
-      await ensureLocalShadowUser()
-    } catch (err) {
-      console.warn('[getSessionFn] 本地影子用户落库失败（不阻断 guest 会话）:', err)
-    }
+    // 兜底分支（getCurrentSession 已覆盖 guest，此处防御未来改动）：保持旧行为
+    await ensureGuestSeeded()
     return buildGuestSession()
   })