@allbluecn/web-app 0.3.0

package/src/server/entitlements.ts

@@ -0,0 +1,211 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { getProService } from '@/server/pro-services'
+import { type LicenseStatus, type ProFeature } from '@allbluecn/kernel'
+import { FeatureRegistry, OSS_BASE_FEATURES, type FeatureKey } from '@allbluecn/shared'
+import { requireAuth } from '@/server/auth-helpers'
+import { prisma } from '@allbluecn/database'
+import { readVerifiedEntitlements } from '@/server/entitlements-token-client'
+
+export class FeatureUnavailableError extends Error {
+  constructor(feature: FeatureKey) {
+    super(`功能 ${feature} 在当前部署不可用（缺少商业模块）`)
+    this.name = 'FeatureUnavailableError'
+    Object.setPrototypeOf(this, FeatureUnavailableError.prototype)
+  }
+}
+
+export class FeatureForbiddenError extends Error {
+  constructor(feature: FeatureKey) {
+    super(`无权限使用功能 ${feature}`)
+    this.name = 'FeatureForbiddenError'
+    Object.setPrototypeOf(this, FeatureForbiddenError.prototype)
+  }
+}
+
+export type EntitlementsSource =
+  | 'subscription'
+  | 'license'
+  | 'signed-token'
+  | 'oss-fallback'
+
+export interface EntitlementsResult {
+  planName: string
+  enabled: Record<FeatureKey, boolean>
+  unavailable: FeatureKey[]
+  source: EntitlementsSource
+}
+
+function featureMap(keys: readonly FeatureKey[]): Record<FeatureKey, boolean> {
+  const all: Record<FeatureKey, boolean> = {} as Record<FeatureKey, boolean>
+  for (const k of Object.keys(FeatureRegistry) as FeatureKey[]) {
+    all[k] = false
+  }
+  for (const k of keys) {
+    all[k] = true
+  }
+  return all
+}
+
+function getUnavailableFeatures(): FeatureKey[] {
+  return Object.keys(FeatureRegistry)
+    .map((k) => k as FeatureKey)
+    .filter((k) => {
+      const meta = FeatureRegistry[k]
+      if (!meta.module) return false
+      return getProService(meta.module as ProFeature) === null
+    })
+}
+
+export async function requireFeature(
+  request: Request | undefined,
+  feature: FeatureKey,
+): Promise<void> {
+  const meta = FeatureRegistry[feature]
+
+  if (meta.tier === 'oss') return
+
+  if (meta.module && getProService(meta.module as ProFeature) === null) {
+    throw new FeatureUnavailableError(feature)
+  }
+
+  const { enabled } = await resolveEntitlements(request)
+  if (enabled[feature] !== true) {
+    throw new FeatureForbiddenError(feature)
+  }
+}
+
+export async function verifyActiveLicense(): Promise<LicenseStatus | null> {
+  const license = getProService('license')
+  if (!license) return null
+  const status = await license.verify()
+  return status.reason === 'not_activated' ? null : status
+}
+
+async function resolveEntitlements(
+  request: Request | undefined,
+): Promise<EntitlementsResult> {
+  const licensed = await verifyActiveLicense()
+  if (licensed) {
+    if (licensed.valid && licensed.license) {
+      const granted = Object.entries(licensed.license!.features)
+        .filter(([, v]) => v === true)
+        .map(([k]) => k as FeatureKey)
+      return {
+        planName: 'enterprise-license',
+        enabled: featureMap(granted),
+        unavailable: getUnavailableFeatures(),
+        source: 'license',
+      }
+    }
+    return {
+      planName: 'enterprise-license',
+      enabled: featureMap([]),
+      unavailable: getUnavailableFeatures(),
+      source: 'license',
+    }
+  }
+
+  const session = await requireAuth(request)
+  const userId = session.user!.id!
+  const isGuest = session.user?.isGuest === true
+  const billing = getProService('billing')
+
+  if (billing) {
+    try {
+      const plan = await billing.getEffectivePlan(userId)
+      return {
+        planName: plan.planName,
+        enabled: plan.features as Record<FeatureKey, boolean>,
+        unavailable: getUnavailableFeatures(),
+        source: 'subscription',
+      }
+    } catch {
+      if (isGuest) {
+        return fallbackSignedTokenOrOss()
+      }
+      return {
+        planName: 'open-source',
+        enabled: featureMap(OSS_BASE_FEATURES),
+        unavailable: getUnavailableFeatures(),
+        source: 'oss-fallback',
+      }
+    }
+  }
+
+  // billing 模块不存在（OSS 部署）：guest 用签名 token，非 guest 走 OSS 白名单
+  if (isGuest) {
+    return fallbackSignedTokenOrOss()
+  }
+  return {
+    planName: 'open-source',
+    enabled: featureMap(OSS_BASE_FEATURES),
+    unavailable: getUnavailableFeatures(),
+    source: 'oss-fallback',
+  }
+}
+
+async function fallbackSignedTokenOrOss(): Promise<EntitlementsResult> {
+  const verified = await readVerifiedEntitlements()
+  if (verified && !verified.tokenExpired) {
+    return {
+      planName: 'offline',
+      enabled: verified.enabled,
+      unavailable: getUnavailableFeatures(),
+      source: 'signed-token',
+    }
+  }
+  return {
+    planName: 'open-source',
+    enabled: featureMap(OSS_BASE_FEATURES),
+    unavailable: getUnavailableFeatures(),
+    source: 'oss-fallback',
+  }
+}
+
+export async function requireCurrentWorkspaceId(userId: string): Promise<string> {
+  const user = await prisma.user.findUnique({
+    where: { id: userId },
+    select: { defaultWorkspaceId: true },
+  })
+
+  if (user?.defaultWorkspaceId) {
+    const ws = await prisma.workspace.findUnique({
+      where: { id: user.defaultWorkspaceId },
+      select: { ownerId: true },
+    })
+    if (ws?.ownerId === userId) {
+      return user.defaultWorkspaceId
+    }
+  }
+
+  const ws = await prisma.workspace.findFirst({
+    where: { ownerId: userId },
+    select: { id: true },
+  })
+  if (!ws) {
+    throw new Error('无 workspace')
+  }
+  return ws.id
+}
+
+export async function getEntitlements(
+  request: Request | undefined,
+): Promise<EntitlementsResult> {
+  return resolveEntitlements(request)
+}

package/src/server/keepalive/middleware.ts

@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createMiddleware } from '@tanstack/react-start'
+
+const KEEPALIVE_INTERVAL = 4 * 60 * 1000
+
+export const neonKeepaliveMiddleware = createMiddleware().server(async ({ next }) => {
+  const now = Date.now()
+  const last = ((globalThis as any).__lastNeonKeepaliveAt as number | undefined) || 0
+
+  if (now - last <= KEEPALIVE_INTERVAL) {
+    return next()
+  }
+
+  const [result] = await Promise.all([
+    next(),
+    (async () => {
+      try {
+        const { prisma } = await import('@allbluecn/database')
+        await prisma.$queryRawUnsafe('SELECT 1')
+        ;(globalThis as any).__lastNeonKeepaliveAt = Date.now()
+      } catch (e) {
+        console.warn('[neon-keepalive] error', e)
+      }
+    })(),
+  ])
+
+  return result
+})

package/src/server/knowledge-public/canonical-id.ts

@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+export function legalCanonicalId(input: { title: string; code?: string }): string {
+  const code = input.code?.trim()
+  return code || input.title.trim()
+}
+
+export function complianceCanonicalId(input: { title: string; code?: string }): string {
+  const code = input.code?.trim()
+  return code || input.title.trim()
+}
+
+export function dictionaryCanonicalId(title: string, industry: string): string {
+  const ind = industry.trim() || '通用'
+  return `${title.trim()}@${ind}`
+}
+
+export function bookmarkCanonicalId(rawUrl: string): string {
+  let url: URL
+  try {
+    url = new URL(rawUrl.trim())
+  } catch {
+    return rawUrl.trim().toLowerCase()
+  }
+  const host = url.hostname.toLowerCase().replace(/^www\./, '')
+  let path = url.pathname.replace(/\/+$/, '')
+  if (path.endsWith('.git')) path = path.replace(/\.git$/, '')
+  return path ? `${host}${path}` : host
+}
+
+export function parseGithubUrl(rawUrl: string): { owner: string; repo: string } | null {
+  let url: URL
+  try {
+    url = new URL(rawUrl.trim())
+  } catch {
+    return null
+  }
+  if (url.hostname.toLowerCase() !== 'github.com') return null
+  const parts = url.pathname.split('/').filter(Boolean)
+  if (parts.length < 2) return null
+  const owner = parts[0]
+  const repo = parts[1].replace(/\.git$/, '')
+  if (!owner || !repo) return null
+  return { owner, repo }
+}

package/src/server/knowledge-public/favicon.ts

@@ -0,0 +1,74 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+export async function resolveFavicon(rawUrl: string): Promise<string> {
+  let origin: string
+  let hostname: string
+  try {
+    const u = new URL(rawUrl)
+    origin = u.origin
+    hostname = u.hostname
+  } catch {
+    return `https://www.google.com/s2/favicons?domain=${rawUrl}&sz=64`
+  }
+
+  try {
+    const res = await fetch(rawUrl, {
+      signal: AbortSignal.timeout(5000),
+      headers: { 'User-Agent': 'AllBlue-KnowledgeBase' },
+    })
+    if (res.ok) {
+      const html = await res.text()
+      const match =
+        html.match(/<link[^>]*rel=["'](?:shortcut icon|icon|apple-touch-icon)["'][^>]*>/i) ||
+        html.match(/<link[^>]*href=["'][^"']*\.(?:png|ico|svg|jpg)["'][^>]*>/i)
+      if (match) {
+        const hrefMatch = match[0].match(/href=["']([^"']+)["']/i)
+        if (hrefMatch) {
+          const href = hrefMatch[1]
+          if (/^https?:\/\//i.test(href)) return href
+          if (href.startsWith('//')) return `https:${href}`
+          return `${origin}${href.startsWith('/') ? '' : '/'}${href}`
+        }
+      }
+      return `${origin}/favicon.ico`
+    }
+  } catch {
+    // fallthrough to google s2
+  }
+
+  return `https://www.google.com/s2/favicons?domain=${hostname}&sz=64`
+}
+
+export async function syncBookmarkFavicon(bookmarkId: string): Promise<string | null> {
+  const { prisma } = await import('@allbluecn/database')
+  const bm = await prisma.websiteBookmark.findUnique({
+    where: { id: bookmarkId },
+    select: { id: true, url: true },
+  })
+  if (!bm) return null
+  try {
+    const faviconUrl = await resolveFavicon(bm.url)
+    await prisma.websiteBookmark.update({
+      where: { id: bookmarkId },
+      data: { faviconUrl, faviconSyncedAt: new Date() },
+    })
+    return faviconUrl
+  } catch {
+    return null
+  }
+}

package/src/server/knowledge-public/github-sync.ts

@@ -0,0 +1,111 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { prisma } from '@allbluecn/database'
+
+export interface GithubData {
+  stars: number
+  repoUpdatedAt: Date | null
+  latestVersion: string | null
+  versionDate: Date | null
+}
+
+const API = 'https://api.github.com'
+const HEADERS: HeadersInit = {
+  Accept: 'application/vnd.github+json',
+  'User-Agent': 'AllBlue-KnowledgeBase',
+  ...(process.env.GITHUB_TOKEN
+    ? { Authorization: `Bearer ${process.env.GITHUB_TOKEN}` }
+    : {}),
+}
+
+export async function fetchGithubData(
+  owner: string,
+  repo: string,
+): Promise<GithubData | null> {
+  const repoRes = await fetch(`${API}/repos/${owner}/${repo}`, { headers: HEADERS })
+  if (!repoRes.ok) return null
+  const repoJson: any = await repoRes.json()
+
+  let latestVersion: string | null = null
+  let versionDate: Date | null = null
+  try {
+    const relRes = await fetch(`${API}/repos/${owner}/${repo}/releases/latest`, { headers: HEADERS })
+    if (relRes.ok) {
+      const relJson: any = await relRes.json()
+      latestVersion = relJson.tag_name ?? null
+      versionDate = relJson.published_at ? new Date(relJson.published_at) : null
+    }
+  } catch {
+    // ignore
+  }
+
+  return {
+    stars: repoJson.stargazers_count ?? 0,
+    repoUpdatedAt: repoJson.updated_at ? new Date(repoJson.updated_at) : null,
+    latestVersion,
+    versionDate,
+  }
+}
+
+export async function syncBookmarkGithub(bookmarkId: string): Promise<boolean> {
+  const bm = await prisma.websiteBookmark.findUnique({
+    where: { id: bookmarkId },
+    select: { id: true, isGithub: true, githubOwner: true, githubRepo: true },
+  })
+  if (!bm?.isGithub || !bm.githubOwner || !bm.githubRepo) return false
+
+  const data = await fetchGithubData(bm.githubOwner, bm.githubRepo)
+  await prisma.websiteBookmark.update({
+    where: { id: bookmarkId },
+    data: data
+      ? {
+          githubStars: data.stars,
+          githubRepoUpdatedAt: data.repoUpdatedAt,
+          githubLatestVersion: data.latestVersion,
+          githubVersionDate: data.versionDate,
+          githubSyncedAt: new Date(),
+        }
+      : { githubSyncedAt: new Date() },
+  })
+  return data !== null
+}
+
+export async function syncAllStaleGithubBookmarks(): Promise<number> {
+  const sixHoursAgo = new Date(Date.now() - 6 * 60 * 60 * 1000)
+  const stale = await prisma.websiteBookmark.findMany({
+    where: {
+      isGithub: true,
+      isDeleted: false,
+      OR: [
+        { githubSyncedAt: null },
+        { githubSyncedAt: { lt: sixHoursAgo } },
+      ],
+    },
+    select: { id: true },
+  })
+  let count = 0
+  for (const bm of stale) {
+    try {
+      await syncBookmarkGithub(bm.id)
+      count++
+    } catch (e) {
+      console.warn('[github-sync] failed for', bm.id, e)
+    }
+  }
+  return count
+}

package/src/server/knowledge-public/share-merge.ts

@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { prisma } from '@allbluecn/database'
+
+type EntityType = 'legal' | 'compliance' | 'dictionary' | 'bookmark'
+
+interface ShareInput {
+  model: 'legalRegulation' | 'industryCompliance' | 'dictionaryTerm' | 'websiteBookmark'
+  entityType: EntityType
+  sourceId: string
+  userId: string
+  fields?: string[]
+  cloneData: Record<string, unknown>
+}
+
+export type ShareResult = { action: 'created' | 'appended' | 'already' }
+
+export async function shareToPublic(input: ShareInput): Promise<ShareResult> {
+  const { model, entityType, userId, cloneData } = input
+  const canonicalId = String(cloneData.canonicalId)
+  const table = (prisma as any)[model]
+
+  const existing = await table.findFirst({
+    where: { canonicalId, visibility: 'public', isDeleted: false },
+    select: { id: true, canonicalId: true },
+  })
+
+  if (existing) {
+    const { canonicalId: _cid, visibility: _vis, userId: _uid, ...updateData } = cloneData
+    await table.update({ where: { id: existing.id }, data: updateData as any })
+    const already = await prisma.knowledgeShareRecord.findFirst({
+      where: { entityType, canonicalId, userId },
+      select: { id: true },
+    })
+    if (already) return { action: 'already' }
+    await prisma.knowledgeShareRecord.create({
+      data: { entityType, canonicalId, userId },
+    })
+    return { action: 'appended' }
+  }
+
+  const { canonicalId: _c, visibility: _v, userId: _u, ...restData } = cloneData
+  await table.update({
+    where: { id: input.sourceId },
+    data: { visibility: 'public', ...restData },
+  })
+  await prisma.knowledgeShareRecord.create({
+    data: { entityType, canonicalId, userId },
+  })
+  return { action: 'created' }
+}
+
+export async function aggregateSharers(
+  entityType: EntityType,
+  canonicalIds: string[],
+) {
+  if (canonicalIds.length === 0) return new Map<string, Array<{
+    id: string; username: string; avatarConfig: unknown; bgShape: string | null; bgColor: string | null
+  }>>()
+  const records = await prisma.knowledgeShareRecord.findMany({
+    where: { entityType, canonicalId: { in: canonicalIds } },
+    select: {
+      canonicalId: true,
+      user: {
+        select: { id: true, username: true, avatarConfig: true, bgShape: true, bgColor: true },
+      },
+    },
+    orderBy: { sharedAt: 'asc' },
+  })
+  const map = new Map<string, typeof records[number]['user'][]>()
+  for (const r of records) {
+    const arr = map.get(r.canonicalId) ?? []
+    arr.push(r.user)
+    map.set(r.canonicalId, arr)
+  }
+  return map
+}

package/src/server/middlewares/audit-recorder.ts

@@ -0,0 +1,37 @@
+import { getProService } from '../pro-services'
+import { requireFeature } from '@/server/entitlements'
+
+const WRITE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE'])
+
+export async function recordAuditEntry(
+  request: Request,
+  response: Response,
+  userId: string,
+): Promise<void> {
+  const audit = getProService('audit')
+  if (!audit) return
+  if (!WRITE_METHODS.has(request.method)) return
+  if (!response.status || response.status >= 400) return
+  try {
+    await requireFeature(request, 'audit')
+  } catch {
+    return
+  }
+
+  const url = new URL(request.url)
+  const path = url.pathname.split('/').filter(Boolean).slice(0, 3).join('/')
+  try {
+    await audit.log({
+      workspaceId: '',
+      userId,
+      action: `${request.method.toLowerCase()} ${path}`,
+      resourceType: 'request',
+      resourceId: url.pathname,
+      metadata: { method: request.method, path, status: response.status },
+      ip: null,
+      userAgent: request.headers.get('user-agent'),
+    })
+  } catch (err) {
+    console.error('[audit] middleware 写入失败:', err)
+  }
+}

package/src/server/middlewares/audit.ts

@@ -0,0 +1,20 @@
+import { createMiddleware } from '@tanstack/react-start'
+
+export const auditRequestMiddleware = createMiddleware().server(async ({ request, next }) => {
+  const result = await next()
+  let userId = ''
+  try {
+    const { getCurrentSession } = await import('@/lib/session')
+    const session = await getCurrentSession(request)
+    userId = (session as { user?: { id?: string } } | null)?.user?.id ?? ''
+  } catch {
+    /* 匿名用户不记录 */
+  }
+
+  if (result instanceof Response) {
+    const { recordAuditEntry } = await import('./audit-recorder')
+    await recordAuditEntry(request, result, userId)
+  }
+
+  return result
+})

package/src/server/middlewares/rate-limit-server-fn.ts

@@ -0,0 +1 @@
+export * from '@allbluecn/plugins-core/server/rate-limit'

package/src/server/middlewares/request.ts

@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createMiddleware } from '@tanstack/react-start'
+
+export interface RequestContext {
+  request: Request
+}
+
+export const requestContextMiddleware = createMiddleware().server<RequestContext>(async ({ request, next }) => {
+  return next({ context: { request } })
+})