@allbluecn/web-app 0.4.16 → 0.4.18

package/src/server/notifications/notification-service.ts

@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { prisma } from '@allbluecn/database'
+import type {
+  CategoryPreferences,
+  NotificationCategory,
+  NotificationItem,
+  NotificationPreferences,
+} from '@allbluecn/shared'
+import { isInDndWindow, DEFAULT_CATEGORIES } from '@allbluecn/shared'
+import { notificationBus } from './event-bus'
+
+export { DEFAULT_CATEGORIES, isInDndWindow } from '@allbluecn/shared'
+
+export interface CreateNotificationInput {
+  userId: string
+  category: NotificationCategory
+  type: string
+  title: string
+  body?: string
+  link?: string
+}
+
+export async function getOrCreatePreferences(userId: string): Promise<NotificationPreferences> {
+  const existing = await prisma.notificationPreference.findUnique({ where: { userId } })
+  if (existing) {
+    return {
+      categories: { ...DEFAULT_CATEGORIES, ...(existing.categories as object) } as CategoryPreferences,
+      dndEnabled: existing.dndEnabled,
+      dndStart: existing.dndStart,
+      dndEnd: existing.dndEnd,
+    }
+  }
+  const defaults: NotificationPreferences = {
+    categories: { ...DEFAULT_CATEGORIES },
+    dndEnabled: false,
+    dndStart: '22:00',
+    dndEnd: '08:00',
+  }
+  try {
+    await prisma.notificationPreference.create({
+      data: {
+        userId,
+        categories: defaults.categories,
+        dndEnabled: defaults.dndEnabled,
+        dndStart: defaults.dndStart,
+        dndEnd: defaults.dndEnd,
+      },
+    })
+  } catch {
+    // 并发下唯一键冲突 = 已被其他请求创建，忽略
+  }
+  return defaults
+}
+
+/** fire-and-forget：任何失败只记日志不抛出，不阻断业务主流程 */
+export async function createNotification(input: CreateNotificationInput): Promise<void> {
+  try {
+    const prefs = await getOrCreatePreferences(input.userId)
+    if (!prefs.categories[input.category]) return
+
+    const created = await prisma.notification.create({
+      data: {
+        userId: input.userId,
+        category: input.category,
+        type: input.type,
+        title: input.title,
+        body: input.body,
+        link: input.link,
+      },
+    })
+
+    const item: NotificationItem = {
+      id: created.id,
+      category: created.category as NotificationCategory,
+      type: created.type,
+      title: created.title,
+      body: created.body,
+      link: created.link,
+      readAt: created.readAt ? created.readAt.toISOString() : null,
+      createdAt: created.createdAt.toISOString(),
+    }
+    notificationBus.emit(input.userId, { kind: 'notification', notification: item })
+  } catch (e) {
+    console.error('[notifications] create failed:', e instanceof Error ? e.message : 'unknown')
+  }
+}

package/src/server/resources.ts

@@ -83,6 +83,7 @@ export async function requireTeamSeats(
   ownerId: string,
   seatType: SeatType,
   amount = 1,
+  opts?: { excludeInvitationId?: string },
 ): Promise<void> {
   const licensed = await verifyActiveLicense()
   const { limits, addonSeats } = await resolveAccountPlanLimits(ownerId)
@@ -97,7 +98,14 @@ export async function requireTeamSeats(
   if (limit === 'unlimited') return
   const [members, pending] = await Promise.all([
     prisma.teamMembership.count({ where: { ownerId, seatType } }),
-    prisma.teamInvitation.count({ where: { ownerId, seatType, status: 'pending' } }),
+    prisma.teamInvitation.count({
+      where: {
+        ownerId,
+        seatType,
+        status: { in: ['pending', 'pending_approval'] },
+        ...(opts?.excludeInvitationId ? { id: { not: opts.excludeInvitationId } } : {}),
+      },
+    }),
   ])
   if (members + pending + amount > limit) {
     throw new ResourceLimitError(seatType === 'member' ? 'seats' : 'guestSeats', limit, members + pending)
@@ -141,7 +149,7 @@ export async function getResourceSnapshots(
       where: { ownerId: userId },
     }),
     prisma.teamInvitation.count({
-      where: { ownerId: userId, status: 'pending' },
+      where: { ownerId: userId, status: { in: ['pending', 'pending_approval'] } },
     }),
   ])
 

package/src/server/serverFns/__tests__/compliance.test.ts

@@ -92,8 +92,8 @@ describe('compliance serverFn 三路径权益门控', () => {
 
   it('路径 1：OSS 部署（proModule.compliance 为 null）→ FeatureUnavailableError', async () => {
     setProCompliance(null)
-    await expect(requestMyExportFn()).rejects.toBeInstanceOf(FeatureUnavailableError)
-    await expect(requestMyDeletionFn()).rejects.toBeInstanceOf(FeatureUnavailableError)
+    await expect(requestMyExportFn({ data: {} })).rejects.toBeInstanceOf(FeatureUnavailableError)
+    await expect(requestMyDeletionFn({ data: {} })).rejects.toBeInstanceOf(FeatureUnavailableError)
     expect(mocks.createExportJob).not.toHaveBeenCalled()
   })
 
@@ -109,8 +109,8 @@ describe('compliance serverFn 三路径权益门控', () => {
       planName: 'pro',
       features: { byokAi: true, hostedAi: true },
     })
-    await expect(requestMyExportFn()).rejects.toBeInstanceOf(FeatureForbiddenError)
-    await expect(requestMyDeletionFn()).rejects.toBeInstanceOf(FeatureForbiddenError)
+    await expect(requestMyExportFn({ data: {} })).rejects.toBeInstanceOf(FeatureForbiddenError)
+    await expect(requestMyDeletionFn({ data: {} })).rejects.toBeInstanceOf(FeatureForbiddenError)
     expect(mocks.createExportJob).not.toHaveBeenCalled()
   })
 
@@ -127,11 +127,11 @@ describe('compliance serverFn 三路径权益门控', () => {
       features: { compliance: true },
     })
 
-    const exported = await requestMyExportFn()
+    const exported = await requestMyExportFn({ data: {} })
     expect(exported).toEqual({ id: 'job-1' })
     expect(mocks.createExportJob).toHaveBeenCalledWith('user', 'u1', 'u1')
 
-    const deleted = await requestMyDeletionFn()
+    const deleted = await requestMyDeletionFn({ data: {} })
     expect(deleted).toEqual({ id: 'job-2' })
     expect(mocks.createDeleteJob).toHaveBeenCalledWith('user', 'u1', 'u1')
   })

package/src/server/serverFns/__tests__/notifications.test.ts

@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => ({
+    validator: () => ({
+      handler: (fn: unknown) => fn,
+    }),
+  }),
+}))
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: vi.fn(),
+}))
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: vi.fn(),
+}))
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    notification: {
+      findMany: vi.fn(),
+      updateMany: vi.fn(),
+      deleteMany: vi.fn(),
+      count: vi.fn(),
+    },
+    notificationPreference: {
+      findUnique: vi.fn(),
+      create: vi.fn(),
+      upsert: vi.fn(),
+    },
+  },
+}))
+
+import { prisma } from '@allbluecn/database'
+import { requireAuth } from '@/server/auth-helpers'
+import { markNotificationReadFn, deleteNotificationFn } from '../notifications'
+
+describe('notifications serverFn 越权防护', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('markAsRead 的 where 同时含 id 与 userId', async () => {
+    vi.mocked(requireAuth).mockResolvedValue({ user: { id: 'me' } } as never)
+    vi.mocked(prisma.notification.updateMany).mockResolvedValue({ count: 0 } as never)
+
+    await (markNotificationReadFn as unknown as (args: { data: unknown }) => Promise<unknown>)(
+      { data: { id: 'other-user-notification' } },
+    )
+
+    const arg = vi.mocked(prisma.notification.updateMany).mock.calls.at(-1)![0]
+    expect(arg?.where).toMatchObject({ id: 'other-user-notification', userId: 'me' })
+  })
+
+  it('delete 的 where 同时含 id 与 userId', async () => {
+    vi.mocked(requireAuth).mockResolvedValue({ user: { id: 'me' } } as never)
+    vi.mocked(prisma.notification.deleteMany).mockResolvedValue({ count: 0 } as never)
+
+    await (deleteNotificationFn as unknown as (args: { data: unknown }) => Promise<unknown>)({
+      data: { id: 'x' },
+    })
+
+    const arg = vi.mocked(prisma.notification.deleteMany).mock.calls.at(-1)![0]
+    expect(arg?.where).toMatchObject({ id: 'x', userId: 'me' })
+  })
+})

package/src/server/serverFns/__tests__/team-accept.test.ts

@@ -29,8 +29,10 @@ vi.mock('@tanstack/react-start/server', () => ({
 
 vi.mock('@allbluecn/database', () => ({
   prisma: {
-    teamInvitation: { findUnique: vi.fn() },
-    teamMembership: { findUnique: vi.fn() },
+    user: { findUnique: vi.fn() },
+    teamInvitation: { findUnique: vi.fn(), update: vi.fn() },
+    teamMembership: { findUnique: vi.fn(), create: vi.fn() },
+    teamJoinRequest: { findUnique: vi.fn(), upsert: vi.fn() },
     $transaction: vi.fn(),
   },
 }))
@@ -43,8 +45,13 @@ vi.mock('@/server/audit', () => ({
   auditLog: vi.fn(),
 }))
 
+vi.mock('@/server/resources', () => ({
+  requireTeamSeats: vi.fn().mockResolvedValue(undefined),
+}))
+
 import { prisma } from '@allbluecn/database'
-import { acceptTeamInvitationFn, getTeamInvitationByTokenFn } from '../team'
+import { requireTeamSeats } from '@/server/resources'
+import { acceptTeamInvitationFn, getTeamInvitationByTokenFn, approveTeamInvitationFn } from '../team'
 
 describe('acceptTeamInvitationFn', () => {
   beforeEach(() => vi.clearAllMocks())
@@ -68,18 +75,33 @@ describe('acceptTeamInvitationFn', () => {
       .rejects.toMatchObject({ message: expect.stringContaining('已加入') })
   })
 
-  it('link 邀请任意登录用户可接受 → 事务写入', async () => {
+  it('link 邀请任意登录用户申请 → 创建 TeamJoinRequest，不占用邀请行', async () => {
     vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({
       id: 'inv1', token: 't1', status: 'pending', seatType: 'guest', channel: 'link',
-      email: '', expiresAt: new Date(Date.now() + 60000), ownerId: 'owner1',
+      email: null, expiresAt: new Date(Date.now() + 60000), ownerId: 'owner1',
     } as never)
-    vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue(null)
-    vi.mocked(prisma.$transaction).mockImplementation(async (fn: any) => fn({
-      teamInvitation: { update: vi.fn().mockResolvedValue({}) },
-      teamMembership: { create: vi.fn().mockResolvedValue({ id: 'm1' }) },
+    vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue(null as never)
+    vi.mocked(prisma.user.findUnique).mockResolvedValue({ email: 'b@x.com' } as never)
+    vi.mocked(prisma.teamJoinRequest.findUnique).mockResolvedValue(null as never)
+    vi.mocked(prisma.teamJoinRequest.upsert).mockResolvedValue({ id: 'jr1' } as never)
+
+    const res = await acceptTeamInvitationFn({ data: { token: 't1', userId: null } })
+
+    expect(res).toMatchObject({ success: true, requiresApproval: true })
+    expect(prisma.teamJoinRequest.upsert).toHaveBeenCalledWith(expect.objectContaining({
+      where: { invitationId_email: { invitationId: 'inv1', email: 'b@x.com' } },
     }))
-    const result = await acceptTeamInvitationFn({ data: { token: 't1' } })
-    expect(result.success).toBe(true)
+    expect(prisma.teamInvitation.update).not.toHaveBeenCalled()
+  })
+
+  it('申请人是 owner 的 owner（互为成员）→ 拒绝', async () => {
+    vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({
+      id: 'inv1', token: 't1', status: 'pending', seatType: 'member', channel: 'link',
+      email: null, expiresAt: new Date(Date.now() + 60000), ownerId: 'owner1',
+    } as never)
+    vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue({ id: 'm1', ownerId: 'u2' } as never)
+    await expect(acceptTeamInvitationFn({ data: { token: 't1', userId: null } }))
+      .rejects.toMatchObject({ message: expect.stringContaining('已加入团队') })
   })
 
   it('email 邀请邮箱不匹配 → 拒绝', async () => {
@@ -98,6 +120,72 @@ describe('acceptTeamInvitationFn', () => {
       channel: 'email', email: 'b@x.com', owner: { id: 'o1', username: 'owner', email: 'o@x.com' },
     } as never)
     const result = await getTeamInvitationByTokenFn({ data: { token: 't1' } })
-    expect(result.effectiveStatus).toBe('pending')
+    expect(result?.effectiveStatus).toBe('pending')
+  })
+})
+
+describe('approveTeamInvitationFn', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('批准前复查席位，并用 acceptedBy 创建 membership', async () => {
+    vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({
+      id: 'inv1', ownerId: 'u2', status: 'pending_approval', seatType: 'member',
+      acceptedBy: 'u2', token: 't1', channel: 'email', email: 'b@x.com',
+      expiresAt: new Date(Date.now() + 60000), createdAt: new Date(),
+    } as never)
+    vi.mocked(prisma.$transaction).mockImplementation(async (fn: any) => {
+      const tx = {
+        teamMembership: { create: vi.fn().mockResolvedValue({ id: 'm1' }) },
+        teamInvitation: { update: vi.fn().mockResolvedValue({}) },
+      }
+      await fn(tx)
+      return tx
+    })
+    const result = await approveTeamInvitationFn({ data: { invitationId: 'inv1', seatType: 'member' } })
+    expect(result.success).toBe(true)
+    expect(requireTeamSeats).toHaveBeenCalledWith('u2', 'member', 1, { excludeInvitationId: 'inv1' })
+  })
+
+  it('批准后邮箱邀请置 accepted，重置链接邀请现在走 approveTeamJoinRequestFn', async () => {
+    vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({
+      id: 'inv1', ownerId: 'u2', status: 'pending_approval', seatType: 'member',
+      acceptedBy: 'u2', token: 't1', channel: 'link', email: null,
+      expiresAt: new Date(Date.now() + 60000), createdAt: new Date(),
+    } as never)
+    await expect(approveTeamInvitationFn({ data: { invitationId: 'inv1', seatType: 'member' } }))
+      .rejects.toMatchObject({ message: expect.stringContaining('approveTeamJoinRequestFn') })
+  })
+
+  it('acceptedBy 为 null 时用 applicantEmail 回填申请人', async () => {
+    vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({
+      id: 'inv1', ownerId: 'u2', status: 'pending_approval', seatType: 'member',
+      acceptedBy: null, applicantEmail: 'b@x.com', token: 't1', channel: 'email', email: 'b@x.com',
+      expiresAt: new Date(Date.now() + 60000), createdAt: new Date(),
+    } as never)
+    vi.mocked(prisma.user.findUnique).mockResolvedValue({ id: 'u2' } as never)
+    let txRef: any
+    vi.mocked(prisma.$transaction).mockImplementation(async (fn: any) => {
+      const tx = {
+        teamMembership: { create: vi.fn().mockResolvedValue({ id: 'm1' }) },
+        teamInvitation: { update: vi.fn().mockResolvedValue({}) },
+      }
+      txRef = tx
+      await fn(tx)
+      return tx
+    })
+    await approveTeamInvitationFn({ data: { invitationId: 'inv1', seatType: 'member' } })
+    expect(txRef.teamMembership.create).toHaveBeenCalledWith(
+      expect.objectContaining({ data: expect.objectContaining({ memberId: 'u2' }) }),
+    )
+  })
+
+  it('过期邀请拒绝批准', async () => {
+    vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({
+      id: 'inv1', ownerId: 'u2', status: 'pending_approval', seatType: 'member',
+      acceptedBy: 'u2', token: 't1', channel: 'email', email: 'b@x.com',
+      expiresAt: new Date(Date.now() - 1000), createdAt: new Date(),
+    } as never)
+    await expect(approveTeamInvitationFn({ data: { invitationId: 'inv1', seatType: 'member' } }))
+      .rejects.toMatchObject({ message: expect.stringContaining('过期') })
   })
 })

package/src/server/serverFns/__tests__/team-invitation.test.ts

@@ -39,7 +39,10 @@ vi.mock('@allbluecn/database', () => ({
       findMany: vi.fn(),
       update: vi.fn(),
       count: vi.fn(),
+      deleteMany: vi.fn(),
     },
+    teamJoinRequest: { updateMany: vi.fn(), findMany: vi.fn() },
+    $transaction: vi.fn(),
   },
 }))
 
@@ -60,84 +63,151 @@ vi.mock('@/server/email/sender', () => ({
 }))
 
 import { prisma } from '@allbluecn/database'
-import { createTeamInvitationFn } from '../team'
+import {
+  createTeamInvitationFn,
+  refreshTeamInvitationLinkFn,
+  listTeamInvitationsFn,
+  clearExpiredInvitationsFn,
+} from '../team'
 
-describe('createTeamInvitationFn 互斥校验', () => {
+describe('refreshTeamInvitationLinkFn', () => {
   beforeEach(() => vi.clearAllMocks())
 
-  it('邀请自己 → 拒绝', async () => {
-    ;(prisma.user.findUnique as any).mockImplementation(async (opts: any) => {
-      if (opts.where.id === 'owner1') return { id: 'owner1', email: 'a@x.com' }
-      return null
+  it('生成新链接，删除旧链接', async () => {
+    vi.mocked(prisma.$transaction).mockImplementation(async (fn: any) => {
+      const tx = {
+        teamInvitation: {
+          deleteMany: vi.fn().mockResolvedValue({}),
+          create: vi.fn().mockResolvedValue({ id: 'inv-new', token: 'abc123' }),
+        },
+        teamJoinRequest: {
+          updateMany: vi.fn().mockResolvedValue({}),
+        },
+      }
+      return fn(tx)
     })
-    await expect(
-      createTeamInvitationFn({ data: { email: 'a@x.com', seatType: 'member', channel: 'email' } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining('自己') })
+    const result = await refreshTeamInvitationLinkFn({ data: {} })
+    expect(result.success).toBe(true)
+    expect(result.invitationId).toBe('inv-new')
+    expect(result.token).toBeTruthy()
+    expect(result.token.length).toBeGreaterThan(0)
   })
 
-  it('目标已在任何团队 → 拒绝', async () => {
-    ;(prisma.user.findUnique as any).mockImplementation(async (opts: any) => {
-      if (opts.where.id === 'owner1') return { id: 'owner1', email: 'a@x.com' }
-      if (opts.where.email === 'b@x.com') return { id: 'u2', email: 'b@x.com' }
-      return null
+  it('支持自定义有效期', async () => {
+    vi.mocked(prisma.$transaction).mockImplementation(async (fn: any) => {
+      const tx = {
+        teamInvitation: {
+          deleteMany: vi.fn().mockResolvedValue({}),
+          create: vi.fn().mockResolvedValue({ id: 'inv-new', token: 'xyz' }),
+        },
+        teamJoinRequest: {
+          updateMany: vi.fn().mockResolvedValue({}),
+        },
+      }
+      return fn(tx)
     })
-    vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue({
-      ownerId: 'other',
-    } as never)
-    await expect(
-      createTeamInvitationFn({ data: { email: 'b@x.com', seatType: 'member', channel: 'email' } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining('已加入') })
+    const result = await refreshTeamInvitationLinkFn({ data: { expiresInDays: 14 } })
+    expect(result.success).toBe(true)
   })
 
-  it('邮箱已有 pending 邀请 → 拒绝', async () => {
-    ;(prisma.user.findUnique as any).mockImplementation(async (opts: any) => {
-      if (opts.where.id === 'owner1') return { id: 'owner1', email: 'a@x.com' }
-      if (opts.where.email === 'b@x.com') return { id: 'u2', email: 'b@x.com' }
-      return null
+  it('默认有效期 7 天', async () => {
+    vi.mocked(prisma.$transaction).mockImplementation(async (fn: any) => {
+      const tx = {
+        teamInvitation: {
+          deleteMany: vi.fn().mockResolvedValue({}),
+          create: vi.fn().mockResolvedValue({ id: 'inv-new', token: 'tok' }),
+        },
+        teamJoinRequest: {
+          updateMany: vi.fn().mockResolvedValue({}),
+        },
+      }
+      return fn(tx)
     })
-    vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue(null)
-    vi.mocked(prisma.teamMembership.findFirst).mockResolvedValue(null)
-    vi.mocked(prisma.teamInvitation.findFirst).mockResolvedValue({ id: 'inv1' } as never)
-    await expect(
-      createTeamInvitationFn({ data: { email: 'b@x.com', seatType: 'member', channel: 'email' } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining('待处理') })
+    await refreshTeamInvitationLinkFn({ data: {} })
+    const createCall = vi.mocked(prisma.$transaction).mock.calls[0][0]
+    expect(createCall).toBeDefined()
   })
+})
 
-  it('未注册邮箱 + 席位可用 → 创建邀请', async () => {
-    vi.mocked(prisma.user.findUnique).mockResolvedValue(null)
-    vi.mocked(prisma.teamMembership.findFirst).mockResolvedValue(null)
-    vi.mocked(prisma.teamInvitation.findFirst).mockResolvedValue(null)
-    vi.mocked(prisma.teamInvitation.create).mockResolvedValue(
-      { id: 'inv1', token: 't1' } as never,
-    )
-    const result = await createTeamInvitationFn({
-      data: { email: 'new@x.com', seatType: 'guest', channel: 'link' },
-    })
-    expect(prisma.teamInvitation.create).toHaveBeenCalledWith(
+describe('listTeamInvitationsFn', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('返回所有邀请（含已过期链接）', async () => {
+    vi.mocked(prisma.teamInvitation.updateMany).mockResolvedValue({ count: 0 } as never)
+    vi.mocked(prisma.teamInvitation.findMany).mockResolvedValue([
+      {
+        id: 'inv2',
+        ownerId: 'owner1',
+        channel: 'email',
+        status: 'pending',
+        token: 'tok2',
+        email: 'b@x.com',
+        expiresAt: new Date(Date.now() + 86400000),
+        createdAt: new Date(Date.now() + 1000),
+        owner: { id: 'owner1', username: 'A', email: 'a@x.com' },
+      },
+      {
+        id: 'inv1',
+        ownerId: 'owner1',
+        channel: 'link',
+        status: 'expired',
+        token: 'old',
+        expiresAt: new Date(Date.now() - 86400000),
+        createdAt: new Date(Date.now() - 86400000),
+        owner: { id: 'owner1', username: 'A', email: 'a@x.com' },
+      },
+    ] as never)
+    vi.mocked(prisma.teamJoinRequest.updateMany).mockResolvedValue({ count: 0 } as never)
+    vi.mocked(prisma.teamJoinRequest.findMany).mockResolvedValue([] as never)
+    const result = await listTeamInvitationsFn()
+    expect(result.invitations).toHaveLength(2)
+    expect(result.invitations[0].channel).toBe('email')
+    expect(result.invitations[1].channel).toBe('link')
+    expect(result.joinRequests).toEqual([])
+  })
+
+  it('过期 pending/pending_approval 邀请自动标记为 expired', async () => {
+    vi.mocked(prisma.teamInvitation.updateMany).mockResolvedValue({ count: 1 } as never)
+    vi.mocked(prisma.teamInvitation.findMany).mockResolvedValue([])
+    vi.mocked(prisma.teamJoinRequest.updateMany).mockResolvedValue({ count: 0 } as never)
+    vi.mocked(prisma.teamJoinRequest.findMany).mockResolvedValue([])
+    await listTeamInvitationsFn()
+    expect(prisma.teamInvitation.updateMany).toHaveBeenCalledWith(
       expect.objectContaining({
-        data: expect.objectContaining({
-          email: 'new@x.com',
-          seatType: 'guest',
-          token: expect.any(String),
-          expiresAt: expect.any(Date),
+        where: expect.objectContaining({
+          status: { in: ['pending', 'pending_approval'] },
         }),
       }),
     )
-    expect(result.success).toBe(true)
   })
+})
 
-  it('link 邀请：已有 pending 链接邀请 → 拒绝（单 pending link 语义）', async () => {
-    vi.mocked(prisma.teamInvitation.findFirst).mockResolvedValue({ id: 'inv0' } as never)
-    await expect(
-      createTeamInvitationFn({ data: { seatType: 'member', channel: 'link' } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining('邀请链接') })
-  })
+describe('createTeamInvitationFn link 邀请', () => {
+  beforeEach(() => vi.clearAllMocks())
 
-  it('create 触发 P2002 → 转译为友好错误', async () => {
+  it('link 邀请：无旧 pending 链接 → 创建成功', async () => {
     vi.mocked(prisma.teamInvitation.findFirst).mockResolvedValue(null)
-    vi.mocked(prisma.teamInvitation.create).mockRejectedValue({ code: 'P2002' } as never)
-    await expect(
-      createTeamInvitationFn({ data: { seatType: 'member', channel: 'link' } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining('待处理') })
+    vi.mocked(prisma.teamInvitation.create).mockResolvedValue(
+      { id: 'inv1', token: 'abc' } as never,
+    )
+    const result = await createTeamInvitationFn({ data: { seatType: 'member', channel: 'link' } })
+    expect(result.success).toBe(true)
+    expect(result.invitationId).toBe('inv1')
+  })
+})
+
+describe('clearExpiredInvitationsFn', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('清除所有过期邀请', async () => {
+    vi.mocked(prisma.teamInvitation.deleteMany).mockResolvedValue({ count: 2 } as never)
+    const result = await clearExpiredInvitationsFn({ data: {} })
+    expect(result.success).toBe(true)
+    expect(result.count).toBe(2)
+    expect(prisma.teamInvitation.deleteMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: expect.objectContaining({ status: 'expired' }),
+      }),
+    )
   })
-})
+})