@allbluecn/web-app 0.4.17 → 0.4.18

package/src/routes/invite/$token/route.tsx

@@ -14,16 +14,24 @@
 //
 // You should have received a copy of this license.
 
-import { createFileRoute, redirect } from '@tanstack/react-router'
+import { createFileRoute } from '@tanstack/react-router'
+import { getTeamInvitationByTokenFn } from '@/server/serverFns/team'
 
 export const Route = createFileRoute('/invite/$token')({
-  beforeLoad: async ({ context, params, location }) => {
-    if (!context.session?.user?.id) {
-      throw redirect({
-        to: '/login',
-        search: { redirect: location.pathname + (location.searchStr ?? '') },
-      })
+  beforeLoad: async ({ context, params }) => {
+    const sessionUser = context.session?.user
+    const userId = sessionUser?.id ?? null
+    let inv = null
+    try {
+      inv = await getTeamInvitationByTokenFn({ data: { token: params.token, userId } })
+    } catch {
+      // invitation lookup failure, return null to let component handle
+    }
+    return {
+      token: params.token,
+      isLoggedIn: !!sessionUser?.id,
+      userId,
+      inv,
     }
-    return { token: params.token }
   },
 })

package/src/routes/share/prd/$prdId/route.tsx

@@ -0,0 +1,10 @@
+// AUTO-GENERATED by @allbluecn/kernel — DO NOT EDIT
+import { createFileRoute } from '@tanstack/react-router'
+import type { PluginRouteContext } from '@allbluecn/kernel'
+import { prd_route_3 } from '@allbluecn/plugins-core/prd/routes'
+
+export const Route = createFileRoute('/share/prd/$prdId')({
+  beforeLoad: ((ctx: PluginRouteContext) => prd_route_3.beforeLoad(ctx)) as any,
+  validateSearch: prd_route_3.validateSearch as any,
+  component: prd_route_3.Component as any,
+})

package/src/server/notifications/__tests__/notification-service.test.ts

@@ -0,0 +1,114 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@allbluecn/database', () =>
+  ({
+    prisma: {
+      notificationPreference: {
+        findUnique: vi.fn(),
+        create: vi.fn(),
+        update: vi.fn(),
+      },
+      notification: {
+        count: vi.fn(),
+        create: vi.fn(),
+      },
+    },
+  }) as any,
+)
+
+import { prisma } from '@allbluecn/database'
+import { createNotification, isInDndWindow, DEFAULT_CATEGORIES } from '../notification-service'
+import { notificationBus } from '../event-bus'
+
+const mockPreferenceFindUnique = prisma.notificationPreference.findUnique as ReturnType<typeof vi.fn>
+const mockPreferenceCreate = prisma.notificationPreference.create as ReturnType<typeof vi.fn>
+const mockNotificationCreate = prisma.notification.create as ReturnType<typeof vi.fn>
+
+describe('isInDndWindow', () => {
+  it('跨午夜区间：23:00 在 22:00-08:00 内', () => {
+    expect(isInDndWindow({ dndEnabled: true, dndStart: '22:00', dndEnd: '08:00' }, '23:00')).toBe(true)
+  })
+  it('跨午夜区间：06:30 在 22:00-08:00 内', () => {
+    expect(isInDndWindow({ dndEnabled: true, dndStart: '22:00', dndEnd: '08:00' }, '06:30')).toBe(true)
+  })
+  it('跨午夜区间：12:00 不在 22:00-08:00 内', () => {
+    expect(isInDndWindow({ dndEnabled: true, dndStart: '22:00', dndEnd: '08:00' }, '12:00')).toBe(false)
+  })
+  it('非跨午夜区间：13:00 在 09:00-18:00 内', () => {
+    expect(isInDndWindow({ dndEnabled: true, dndStart: '09:00', dndEnd: '18:00' }, '13:00')).toBe(true)
+  })
+  it('DND 关闭时恒为 false', () => {
+    expect(isInDndWindow({ dndEnabled: false, dndStart: '22:00', dndEnd: '08:00' }, '23:00')).toBe(false)
+  })
+})
+
+describe('createNotification', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('分类关闭时丢弃：不写库不 emit', async () => {
+    mockPreferenceFindUnique.mockResolvedValue({
+      userId: 'u1',
+      categories: { team: false, collaboration: true, system: true, billing: true, security: true },
+      dndEnabled: false,
+      dndStart: '22:00',
+      dndEnd: '08:00',
+    } as never)
+    const emitSpy = vi.spyOn(notificationBus, 'emit')
+
+    await createNotification({ userId: 'u1', category: 'team', type: 'team.invite_request', title: 't' })
+
+    expect(mockNotificationCreate).not.toHaveBeenCalled()
+    expect(emitSpy).not.toHaveBeenCalled()
+  })
+
+  it('分类开启时写库并 emit', async () => {
+    mockPreferenceFindUnique.mockResolvedValue(null)
+    mockPreferenceCreate.mockResolvedValue({} as never)
+    mockNotificationCreate.mockImplementation(async () =>
+      ({
+        userId: 'u1',
+        category: 'team',
+        type: 'team.invite_request',
+        title: 't',
+        body: 'b',
+        link: '/settings/team',
+        id: 'n1',
+        createdAt: new Date(),
+        readAt: null,
+      } as never),
+    )
+    const emitSpy = vi.spyOn(notificationBus, 'emit')
+
+    await createNotification({
+      userId: 'u1',
+      category: 'team',
+      type: 'team.invite_request',
+      title: 't',
+      body: 'b',
+      link: '/settings/team',
+    })
+
+    expect(mockNotificationCreate).toHaveBeenCalled()
+    expect(emitSpy).toHaveBeenCalledWith('u1', expect.objectContaining({ kind: 'notification' }))
+  })
+
+  it('通知失败不抛出（fire-and-forget 安全）', async () => {
+    mockPreferenceFindUnique.mockRejectedValue(new Error('db down'))
+    await expect(
+      createNotification({ userId: 'u1', category: 'team', type: 'team.invite_request', title: 't' }),
+    ).resolves.toBeUndefined()
+  })
+
+  it('DEFAULT_CATEGORIES 全开', () => {
+    expect(DEFAULT_CATEGORIES).toEqual({
+      team: true,
+      collaboration: true,
+      system: true,
+      billing: true,
+      security: true,
+    })
+  })
+})

package/src/server/notifications/__tests__/stream.test.ts

@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it, expect } from 'vitest'
+import { notificationBus } from '../event-bus'
+
+describe('notificationBus', () => {
+  it('subscribe 收到 emit 的值；unsubscribe 后不再收到', () => {
+    const received: unknown[] = []
+    const unsubscribe = notificationBus.subscribe('test-user', (v) =>
+      received.push(v),
+    )
+
+    notificationBus.emit('test-user', { kind: 'unread_snapshot', count: 3 })
+    expect(received).toEqual([{ kind: 'unread_snapshot', count: 3 }])
+
+    unsubscribe()
+    notificationBus.emit('test-user', { kind: 'unread_snapshot', count: 4 })
+    expect(received).toHaveLength(1)
+  })
+
+  it('不同 userId 互不干扰', () => {
+    const a: unknown[] = []
+    const b: unknown[] = []
+    notificationBus.subscribe('user-a', (v) => a.push(v))
+    notificationBus.subscribe('user-b', (v) => b.push(v))
+
+    notificationBus.emit('user-a', { kind: 'unread_snapshot', count: 1 })
+    expect(a).toHaveLength(1)
+    expect(b).toHaveLength(0)
+  })
+})

package/src/server/notifications/event-bus.ts

@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { EventEmitter } from 'node:events'
+import type { NotificationSseValue } from '@allbluecn/shared'
+
+const emitter = new EventEmitter()
+emitter.setMaxListeners(0)
+
+export const notificationBus = {
+  emit(userId: string, value: NotificationSseValue) {
+    emitter.emit(`user:${userId}`, value)
+  },
+  subscribe(userId: string, listener: (value: NotificationSseValue) => void) {
+    emitter.on(`user:${userId}`, listener)
+    return () => emitter.off(`user:${userId}`, listener)
+  },
+}

package/src/server/notifications/notification-service.ts

@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { prisma } from '@allbluecn/database'
+import type {
+  CategoryPreferences,
+  NotificationCategory,
+  NotificationItem,
+  NotificationPreferences,
+} from '@allbluecn/shared'
+import { isInDndWindow, DEFAULT_CATEGORIES } from '@allbluecn/shared'
+import { notificationBus } from './event-bus'
+
+export { DEFAULT_CATEGORIES, isInDndWindow } from '@allbluecn/shared'
+
+export interface CreateNotificationInput {
+  userId: string
+  category: NotificationCategory
+  type: string
+  title: string
+  body?: string
+  link?: string
+}
+
+export async function getOrCreatePreferences(userId: string): Promise<NotificationPreferences> {
+  const existing = await prisma.notificationPreference.findUnique({ where: { userId } })
+  if (existing) {
+    return {
+      categories: { ...DEFAULT_CATEGORIES, ...(existing.categories as object) } as CategoryPreferences,
+      dndEnabled: existing.dndEnabled,
+      dndStart: existing.dndStart,
+      dndEnd: existing.dndEnd,
+    }
+  }
+  const defaults: NotificationPreferences = {
+    categories: { ...DEFAULT_CATEGORIES },
+    dndEnabled: false,
+    dndStart: '22:00',
+    dndEnd: '08:00',
+  }
+  try {
+    await prisma.notificationPreference.create({
+      data: {
+        userId,
+        categories: defaults.categories,
+        dndEnabled: defaults.dndEnabled,
+        dndStart: defaults.dndStart,
+        dndEnd: defaults.dndEnd,
+      },
+    })
+  } catch {
+    // 并发下唯一键冲突 = 已被其他请求创建，忽略
+  }
+  return defaults
+}
+
+/** fire-and-forget：任何失败只记日志不抛出，不阻断业务主流程 */
+export async function createNotification(input: CreateNotificationInput): Promise<void> {
+  try {
+    const prefs = await getOrCreatePreferences(input.userId)
+    if (!prefs.categories[input.category]) return
+
+    const created = await prisma.notification.create({
+      data: {
+        userId: input.userId,
+        category: input.category,
+        type: input.type,
+        title: input.title,
+        body: input.body,
+        link: input.link,
+      },
+    })
+
+    const item: NotificationItem = {
+      id: created.id,
+      category: created.category as NotificationCategory,
+      type: created.type,
+      title: created.title,
+      body: created.body,
+      link: created.link,
+      readAt: created.readAt ? created.readAt.toISOString() : null,
+      createdAt: created.createdAt.toISOString(),
+    }
+    notificationBus.emit(input.userId, { kind: 'notification', notification: item })
+  } catch (e) {
+    console.error('[notifications] create failed:', e instanceof Error ? e.message : 'unknown')
+  }
+}

package/src/server/resources.ts

@@ -83,6 +83,7 @@ export async function requireTeamSeats(
   ownerId: string,
   seatType: SeatType,
   amount = 1,
+  opts?: { excludeInvitationId?: string },
 ): Promise<void> {
   const licensed = await verifyActiveLicense()
   const { limits, addonSeats } = await resolveAccountPlanLimits(ownerId)
@@ -97,7 +98,14 @@ export async function requireTeamSeats(
   if (limit === 'unlimited') return
   const [members, pending] = await Promise.all([
     prisma.teamMembership.count({ where: { ownerId, seatType } }),
-    prisma.teamInvitation.count({ where: { ownerId, seatType, status: 'pending' } }),
+    prisma.teamInvitation.count({
+      where: {
+        ownerId,
+        seatType,
+        status: { in: ['pending', 'pending_approval'] },
+        ...(opts?.excludeInvitationId ? { id: { not: opts.excludeInvitationId } } : {}),
+      },
+    }),
   ])
   if (members + pending + amount > limit) {
     throw new ResourceLimitError(seatType === 'member' ? 'seats' : 'guestSeats', limit, members + pending)
@@ -141,7 +149,7 @@ export async function getResourceSnapshots(
       where: { ownerId: userId },
     }),
     prisma.teamInvitation.count({
-      where: { ownerId: userId, status: 'pending' },
+      where: { ownerId: userId, status: { in: ['pending', 'pending_approval'] } },
     }),
   ])
 

package/src/server/serverFns/__tests__/compliance.test.ts

@@ -92,8 +92,8 @@ describe('compliance serverFn 三路径权益门控', () => {
 
   it('路径 1：OSS 部署（proModule.compliance 为 null）→ FeatureUnavailableError', async () => {
     setProCompliance(null)
-    await expect(requestMyExportFn()).rejects.toBeInstanceOf(FeatureUnavailableError)
-    await expect(requestMyDeletionFn()).rejects.toBeInstanceOf(FeatureUnavailableError)
+    await expect(requestMyExportFn({ data: {} })).rejects.toBeInstanceOf(FeatureUnavailableError)
+    await expect(requestMyDeletionFn({ data: {} })).rejects.toBeInstanceOf(FeatureUnavailableError)
     expect(mocks.createExportJob).not.toHaveBeenCalled()
   })
 
@@ -109,8 +109,8 @@ describe('compliance serverFn 三路径权益门控', () => {
       planName: 'pro',
       features: { byokAi: true, hostedAi: true },
     })
-    await expect(requestMyExportFn()).rejects.toBeInstanceOf(FeatureForbiddenError)
-    await expect(requestMyDeletionFn()).rejects.toBeInstanceOf(FeatureForbiddenError)
+    await expect(requestMyExportFn({ data: {} })).rejects.toBeInstanceOf(FeatureForbiddenError)
+    await expect(requestMyDeletionFn({ data: {} })).rejects.toBeInstanceOf(FeatureForbiddenError)
     expect(mocks.createExportJob).not.toHaveBeenCalled()
   })
 
@@ -127,11 +127,11 @@ describe('compliance serverFn 三路径权益门控', () => {
       features: { compliance: true },
     })
 
-    const exported = await requestMyExportFn()
+    const exported = await requestMyExportFn({ data: {} })
     expect(exported).toEqual({ id: 'job-1' })
     expect(mocks.createExportJob).toHaveBeenCalledWith('user', 'u1', 'u1')
 
-    const deleted = await requestMyDeletionFn()
+    const deleted = await requestMyDeletionFn({ data: {} })
     expect(deleted).toEqual({ id: 'job-2' })
     expect(mocks.createDeleteJob).toHaveBeenCalledWith('user', 'u1', 'u1')
   })

package/src/server/serverFns/__tests__/notifications.test.ts

@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => ({
+    validator: () => ({
+      handler: (fn: unknown) => fn,
+    }),
+  }),
+}))
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: vi.fn(),
+}))
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: vi.fn(),
+}))
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    notification: {
+      findMany: vi.fn(),
+      updateMany: vi.fn(),
+      deleteMany: vi.fn(),
+      count: vi.fn(),
+    },
+    notificationPreference: {
+      findUnique: vi.fn(),
+      create: vi.fn(),
+      upsert: vi.fn(),
+    },
+  },
+}))
+
+import { prisma } from '@allbluecn/database'
+import { requireAuth } from '@/server/auth-helpers'
+import { markNotificationReadFn, deleteNotificationFn } from '../notifications'
+
+describe('notifications serverFn 越权防护', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('markAsRead 的 where 同时含 id 与 userId', async () => {
+    vi.mocked(requireAuth).mockResolvedValue({ user: { id: 'me' } } as never)
+    vi.mocked(prisma.notification.updateMany).mockResolvedValue({ count: 0 } as never)
+
+    await (markNotificationReadFn as unknown as (args: { data: unknown }) => Promise<unknown>)(
+      { data: { id: 'other-user-notification' } },
+    )
+
+    const arg = vi.mocked(prisma.notification.updateMany).mock.calls.at(-1)![0]
+    expect(arg?.where).toMatchObject({ id: 'other-user-notification', userId: 'me' })
+  })
+
+  it('delete 的 where 同时含 id 与 userId', async () => {
+    vi.mocked(requireAuth).mockResolvedValue({ user: { id: 'me' } } as never)
+    vi.mocked(prisma.notification.deleteMany).mockResolvedValue({ count: 0 } as never)
+
+    await (deleteNotificationFn as unknown as (args: { data: unknown }) => Promise<unknown>)({
+      data: { id: 'x' },
+    })
+
+    const arg = vi.mocked(prisma.notification.deleteMany).mock.calls.at(-1)![0]
+    expect(arg?.where).toMatchObject({ id: 'x', userId: 'me' })
+  })
+})

package/src/server/serverFns/__tests__/team-accept.test.ts

@@ -29,8 +29,10 @@ vi.mock('@tanstack/react-start/server', () => ({
 
 vi.mock('@allbluecn/database', () => ({
   prisma: {
-    teamInvitation: { findUnique: vi.fn() },
-    teamMembership: { findUnique: vi.fn() },
+    user: { findUnique: vi.fn() },
+    teamInvitation: { findUnique: vi.fn(), update: vi.fn() },
+    teamMembership: { findUnique: vi.fn(), create: vi.fn() },
+    teamJoinRequest: { findUnique: vi.fn(), upsert: vi.fn() },
     $transaction: vi.fn(),
   },
 }))
@@ -43,8 +45,13 @@ vi.mock('@/server/audit', () => ({
   auditLog: vi.fn(),
 }))
 
+vi.mock('@/server/resources', () => ({
+  requireTeamSeats: vi.fn().mockResolvedValue(undefined),
+}))
+
 import { prisma } from '@allbluecn/database'
-import { acceptTeamInvitationFn, getTeamInvitationByTokenFn } from '../team'
+import { requireTeamSeats } from '@/server/resources'
+import { acceptTeamInvitationFn, getTeamInvitationByTokenFn, approveTeamInvitationFn } from '../team'
 
 describe('acceptTeamInvitationFn', () => {
   beforeEach(() => vi.clearAllMocks())
@@ -68,18 +75,33 @@ describe('acceptTeamInvitationFn', () => {
       .rejects.toMatchObject({ message: expect.stringContaining('已加入') })
   })
 
-  it('link 邀请任意登录用户可接受 → 事务写入', async () => {
+  it('link 邀请任意登录用户申请 → 创建 TeamJoinRequest，不占用邀请行', async () => {
     vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({
       id: 'inv1', token: 't1', status: 'pending', seatType: 'guest', channel: 'link',
-      email: '', expiresAt: new Date(Date.now() + 60000), ownerId: 'owner1',
+      email: null, expiresAt: new Date(Date.now() + 60000), ownerId: 'owner1',
     } as never)
-    vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue(null)
-    vi.mocked(prisma.$transaction).mockImplementation(async (fn: any) => fn({
-      teamInvitation: { update: vi.fn().mockResolvedValue({}) },
-      teamMembership: { create: vi.fn().mockResolvedValue({ id: 'm1' }) },
+    vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue(null as never)
+    vi.mocked(prisma.user.findUnique).mockResolvedValue({ email: 'b@x.com' } as never)
+    vi.mocked(prisma.teamJoinRequest.findUnique).mockResolvedValue(null as never)
+    vi.mocked(prisma.teamJoinRequest.upsert).mockResolvedValue({ id: 'jr1' } as never)
+
+    const res = await acceptTeamInvitationFn({ data: { token: 't1', userId: null } })
+
+    expect(res).toMatchObject({ success: true, requiresApproval: true })
+    expect(prisma.teamJoinRequest.upsert).toHaveBeenCalledWith(expect.objectContaining({
+      where: { invitationId_email: { invitationId: 'inv1', email: 'b@x.com' } },
     }))
-    const result = await acceptTeamInvitationFn({ data: { token: 't1' } })
-    expect(result.success).toBe(true)
+    expect(prisma.teamInvitation.update).not.toHaveBeenCalled()
+  })
+
+  it('申请人是 owner 的 owner（互为成员）→ 拒绝', async () => {
+    vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({
+      id: 'inv1', token: 't1', status: 'pending', seatType: 'member', channel: 'link',
+      email: null, expiresAt: new Date(Date.now() + 60000), ownerId: 'owner1',
+    } as never)
+    vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue({ id: 'm1', ownerId: 'u2' } as never)
+    await expect(acceptTeamInvitationFn({ data: { token: 't1', userId: null } }))
+      .rejects.toMatchObject({ message: expect.stringContaining('已加入团队') })
   })
 
   it('email 邀请邮箱不匹配 → 拒绝', async () => {
@@ -98,6 +120,72 @@ describe('acceptTeamInvitationFn', () => {
       channel: 'email', email: 'b@x.com', owner: { id: 'o1', username: 'owner', email: 'o@x.com' },
     } as never)
     const result = await getTeamInvitationByTokenFn({ data: { token: 't1' } })
-    expect(result.effectiveStatus).toBe('pending')
+    expect(result?.effectiveStatus).toBe('pending')
+  })
+})
+
+describe('approveTeamInvitationFn', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('批准前复查席位，并用 acceptedBy 创建 membership', async () => {
+    vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({
+      id: 'inv1', ownerId: 'u2', status: 'pending_approval', seatType: 'member',
+      acceptedBy: 'u2', token: 't1', channel: 'email', email: 'b@x.com',
+      expiresAt: new Date(Date.now() + 60000), createdAt: new Date(),
+    } as never)
+    vi.mocked(prisma.$transaction).mockImplementation(async (fn: any) => {
+      const tx = {
+        teamMembership: { create: vi.fn().mockResolvedValue({ id: 'm1' }) },
+        teamInvitation: { update: vi.fn().mockResolvedValue({}) },
+      }
+      await fn(tx)
+      return tx
+    })
+    const result = await approveTeamInvitationFn({ data: { invitationId: 'inv1', seatType: 'member' } })
+    expect(result.success).toBe(true)
+    expect(requireTeamSeats).toHaveBeenCalledWith('u2', 'member', 1, { excludeInvitationId: 'inv1' })
+  })
+
+  it('批准后邮箱邀请置 accepted，重置链接邀请现在走 approveTeamJoinRequestFn', async () => {
+    vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({
+      id: 'inv1', ownerId: 'u2', status: 'pending_approval', seatType: 'member',
+      acceptedBy: 'u2', token: 't1', channel: 'link', email: null,
+      expiresAt: new Date(Date.now() + 60000), createdAt: new Date(),
+    } as never)
+    await expect(approveTeamInvitationFn({ data: { invitationId: 'inv1', seatType: 'member' } }))
+      .rejects.toMatchObject({ message: expect.stringContaining('approveTeamJoinRequestFn') })
+  })
+
+  it('acceptedBy 为 null 时用 applicantEmail 回填申请人', async () => {
+    vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({
+      id: 'inv1', ownerId: 'u2', status: 'pending_approval', seatType: 'member',
+      acceptedBy: null, applicantEmail: 'b@x.com', token: 't1', channel: 'email', email: 'b@x.com',
+      expiresAt: new Date(Date.now() + 60000), createdAt: new Date(),
+    } as never)
+    vi.mocked(prisma.user.findUnique).mockResolvedValue({ id: 'u2' } as never)
+    let txRef: any
+    vi.mocked(prisma.$transaction).mockImplementation(async (fn: any) => {
+      const tx = {
+        teamMembership: { create: vi.fn().mockResolvedValue({ id: 'm1' }) },
+        teamInvitation: { update: vi.fn().mockResolvedValue({}) },
+      }
+      txRef = tx
+      await fn(tx)
+      return tx
+    })
+    await approveTeamInvitationFn({ data: { invitationId: 'inv1', seatType: 'member' } })
+    expect(txRef.teamMembership.create).toHaveBeenCalledWith(
+      expect.objectContaining({ data: expect.objectContaining({ memberId: 'u2' }) }),
+    )
+  })
+
+  it('过期邀请拒绝批准', async () => {
+    vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({
+      id: 'inv1', ownerId: 'u2', status: 'pending_approval', seatType: 'member',
+      acceptedBy: 'u2', token: 't1', channel: 'email', email: 'b@x.com',
+      expiresAt: new Date(Date.now() - 1000), createdAt: new Date(),
+    } as never)
+    await expect(approveTeamInvitationFn({ data: { invitationId: 'inv1', seatType: 'member' } }))
+      .rejects.toMatchObject({ message: expect.stringContaining('过期') })
   })
 })