@allbluecn/web-app 0.4.8 → 0.4.10

package/src/components/story/detail/activity-timeline.tsx

@@ -35,6 +35,7 @@ import { listProjectsBriefFn } from "@/server/serverFns/project";
 import type { ActivityItem, UserBrief } from "@/components/story/types";
 import { groupActivities, type ActivityGroup } from "@/lib/story/activity-grouper";
 import { ArrowUpFromDot, ChevronDown, Dot, Sparkles, Layers, UserRound } from "lucide-react";
+import { sanitize } from "@/lib/sanitize";
 
 function getDiffDecorator(
   action: string,
@@ -245,7 +246,7 @@ function DiffCompare({ oldValue, newValue, oldDecorator, newDecorator, plain, bl
               <div className="w-1/2 border-r bg-red-50/40 dark:bg-red-950/20 p-2 pr-4">
                 <div className="flex items-center gap-1.5">
                   {b.oldDecorator}
-                  <div className="break-all" dangerouslySetInnerHTML={{ __html: b.left }} />
+                  <div className="break-all" dangerouslySetInnerHTML={{ __html: sanitize(b.left) }} />
                 </div>
               </div>
               <div className="absolute left-1/2 top-1/2 -translate-x-1/2 -translate-y-1/2 z-10 flex size-5 items-center justify-center rounded-full bg-background border">
@@ -254,7 +255,7 @@ function DiffCompare({ oldValue, newValue, oldDecorator, newDecorator, plain, bl
               <div className="w-1/2 bg-green-50/40 dark:bg-green-950/20 p-2 pl-4">
                 <div className="flex items-center gap-1.5">
                   {b.newDecorator}
-                  <div className="break-all" dangerouslySetInnerHTML={{ __html: b.right }} />
+                  <div className="break-all" dangerouslySetInnerHTML={{ __html: sanitize(b.right) }} />
                 </div>
               </div>
             </div>
@@ -271,7 +272,7 @@ function DiffCompare({ oldValue, newValue, oldDecorator, newDecorator, plain, bl
         {/* 测量用：渲染所有块右侧文本以计算总高度 */}
         <div ref={measureRef} className="absolute left-0 top-0 -z-10 invisible w-1/2 p-2 pl-4 break-all space-y-2">
           {renderedBlocks.map((b, idx) => (
-            <div key={idx} dangerouslySetInnerHTML={{ __html: b.right }} />
+            <div key={idx} dangerouslySetInnerHTML={{ __html: sanitize(b.right) }} />
           ))}
         </div>
       </div>
@@ -291,7 +292,7 @@ function DiffCompare({ oldValue, newValue, oldDecorator, newDecorator, plain, bl
       <div className="w-1/2 border-r bg-red-50/40 dark:bg-red-950/20 p-2 pr-4">
         <div className="flex items-center gap-1.5">
           {oldDecorator}
-          <div className="break-all" dangerouslySetInnerHTML={{ __html: single!.left }} />
+          <div className="break-all" dangerouslySetInnerHTML={{ __html: sanitize(single!.left) }} />
         </div>
       </div>
       <div className="absolute left-1/2 top-1/2 -translate-x-1/2 -translate-y-1/2 z-10 flex size-5 items-center justify-center rounded-full bg-background border">
@@ -300,7 +301,7 @@ function DiffCompare({ oldValue, newValue, oldDecorator, newDecorator, plain, bl
       <div className="w-1/2 bg-green-50/40 dark:bg-green-950/20 p-2 pl-4">
         <div className="flex items-center gap-1.5">
           {newDecorator}
-          <div className="break-all" dangerouslySetInnerHTML={{ __html: single!.right }} />
+          <div className="break-all" dangerouslySetInnerHTML={{ __html: sanitize(single!.right) }} />
         </div>
       </div>
       <div
@@ -311,7 +312,7 @@ function DiffCompare({ oldValue, newValue, oldDecorator, newDecorator, plain, bl
           transition: "opacity 0.25s ease",
         }}
       />
-      <div ref={measureRef} className="absolute left-0 top-0 -z-10 invisible w-1/2 p-2 pl-4 break-all" dangerouslySetInnerHTML={{ __html: single!.right }} />
+      <div ref={measureRef} className="absolute left-0 top-0 -z-10 invisible w-1/2 p-2 pl-4 break-all" dangerouslySetInnerHTML={{ __html: sanitize(single!.right) }} />
     </div>
   );
 }

package/src/lib/anyhub/manager.ts

@@ -16,7 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { prisma } from "@allbluecn/database"
-import { execSync } from "child_process"
+import { execFileSync } from "child_process"
 import path from "path"
 import { getAnyHubBaseDir } from "./types"
 import type { AnyHubAppSource, AnyHubAppData } from "./types"
@@ -112,9 +112,17 @@ export const AnyHubManager = {
     let proxyBasePath: string | null = null
 
     if (isRelativeEntry) {
+      if (!/^[a-zA-Z0-9._-]+$/.test(manifest.name)) {
+        throw new Error("Invalid manifest name")
+      }
       const cloneDir = path.join(getAnyHubBaseDir(), "apps", manifest.name)
-      execSync(`git clone ${githubUrl} ${cloneDir}`, { stdio: "pipe" })
-      localPath = cloneDir
+      const resolvedClone = path.resolve(cloneDir)
+      const resolvedBase = path.resolve(getAnyHubBaseDir())
+      if (!resolvedClone.startsWith(resolvedBase + path.sep)) {
+        throw new Error("Clone directory outside allowed base path")
+      }
+      execFileSync("git", ["clone", "--depth", "1", githubUrl, resolvedClone], { stdio: "pipe" })
+      localPath = resolvedClone
       proxyBasePath = "/api/anyhub/proxy/"
       url = null
     }
@@ -177,7 +185,12 @@ export const AnyHubManager = {
     if (!app) throw new Error("应用不存在")
 
     if (app.source === "github" && app.localPath) {
-      execSync(`cd ${app.localPath} && git pull`, { stdio: "pipe" })
+      const resolvedBase = path.resolve(getAnyHubBaseDir())
+      const resolvedLocalPath = path.resolve(app.localPath)
+      if (!resolvedLocalPath.startsWith(resolvedBase + path.sep)) {
+        throw new Error("Local path outside allowed base path")
+      }
+      execFileSync("git", ["pull"], { cwd: resolvedLocalPath, stdio: "pipe" })
     }
 
     const updated = await prisma.anyHubApp.update({

package/src/lib/auth/auth.config.ts

@@ -72,7 +72,7 @@ async function getCachedProfile(userId: string): Promise<CachedProfile | null> {
     // DB 异常（如 Prisma Client 未 generate、字段缺失、连接失败）不应导致整个 session 崩溃。
     // @auth/core 的 session action 会把 session callback 的任何异常误判为 JWTSessionError 并删除 cookie，
     // 导致用户被登出。此处降级返回最小有效 profile，保持用户登录态。
-    console.error('[auth] getCachedProfile 查询失败，降级返回默认 profile:', e)
+    console.error('[auth] getCachedProfile 查询失败，降级返回默认 profile:', e instanceof Error ? e.message : String(e))
     return {
       username: '用户',
       avatarConfig: null,
@@ -163,7 +163,7 @@ export const authConfig: StartAuthJSConfig = {
               },
             })
           } catch (err) {
-            console.error('[auth] 记录登录日志失败:', err)
+            console.error('[auth] 记录登录日志失败:', err instanceof Error ? err.message : String(err))
           }
         }
 

package/src/lib/auth/sso-authorize.ts

@@ -33,7 +33,7 @@ export async function resolveSsoTokenUser(ssoToken: string): Promise<SsoAuthUser
         },
       })
     } catch (err) {
-      console.error('[auth] 记录 SSO 登录日志失败:', err)
+      console.error('[auth] 记录 SSO 登录日志失败:', err instanceof Error ? err.message : String(err))
     }
   }
 

package/src/lib/commands/registry.ts

@@ -38,8 +38,8 @@ export const COMMAND_REGISTRY: CommandDefinition[] = [
   { id: "create-prd", titleKey: "command.createPrd", icon: "file", group: "action", action: { kind: "callback", id: "create-prd" }, keywords: ["新建", "创建", "PRD", "xj"], shortcut: ["N", "P"] },
   { id: "create-conversation", titleKey: "command.createConversation", icon: "message", group: "action", action: { kind: "callback", id: "create-conversation" }, keywords: ["新建对话", "新对话", "xjdh"], shortcut: ["N", "C"] },
   { id: "create-story", titleKey: "command.createStory", icon: "clipboardList", group: "action", action: { kind: "callback", id: "create-story" }, keywords: ["新建需求", "xjxq"], shortcut: ["N", "S"] },
-  { id: "toggle-theme", titleKey: "command.toggleTheme", icon: "earth", group: "action", action: { kind: "callback", id: "toggle-theme" }, keywords: ["切换主题", "暗黑", "主题", "qhzt"] },
-  { id: "sign-out", titleKey: "command.signOut", icon: "users", group: "action", action: { kind: "callback", id: "sign-out" }, keywords: ["退出登录", "登出", "tcdl"] },
+  { id: "toggle-theme", titleKey: "command.toggleTheme", icon: "sunMoon", group: "action", action: { kind: "callback", id: "toggle-theme" }, keywords: ["切换主题", "暗黑", "主题", "qhzt"], shortcut: ["Mod", "Shift", "L"] },
+  { id: "sign-out", titleKey: "command.signOut", icon: "logOut", group: "action", action: { kind: "callback", id: "sign-out" }, keywords: ["退出登录", "登出", "tcdl"] },
 ] as const
 
 export function getSequencePairs(registry: CommandDefinition[]): string[] {

package/src/lib/sanitize.ts

@@ -0,0 +1,5 @@
+import DOMPurify from 'isomorphic-dompurify'
+
+export function sanitize(html: string): string {
+  return DOMPurify.sanitize(html)
+}

package/src/routes/_nav/chat/route.lazy.tsx

@@ -145,7 +145,7 @@ function ChatPage() {
         clearHandoffState()
         applyConv(conv, pendingMsg)
       } catch (e) {
-        console.error('[chat] Failed to process pending workspace message:', e)
+        console.error('[chat] Failed to process pending workspace message:', e instanceof Error ? e.message : String(e))
         clearHandoffState()
       }
     })()

package/src/routes/_nav/design/index.lazy.tsx

@@ -116,7 +116,7 @@ function DesignDashboard() {
       setProjects((prev) => prev.filter((p) => p.id !== pendingDeleteId))
       setPendingDeleteId(null)
     } catch (error) {
-      console.error("Failed to delete design project:", error)
+      console.error("Failed to delete design project:", error instanceof Error ? error.message : String(error))
     } finally {
       setDeleting(false)
     }

package/src/routes/_nav/route.lazy.tsx

@@ -20,7 +20,7 @@ import Sidebar03 from '@/components/layout/sidebar-03'
 import { GlobalChatPanel } from '@/components/ai/global-chat-panel'
 import { TimezoneBootstrap } from '@/components/shared/timezone-bootstrap'
 import { SubscriptionProvider } from '@/components/billing/subscription-provider'
-import { CommandPalette } from '@/components/command-palette'
+import { CommandPalette } from '@/components/command/command-palette'
 import type { Session } from '@/lib/auth/auth-client'
 
 export const Route = createLazyFileRoute('/_nav')({

package/src/routes/_nav/settings/ai/route.tsx

@@ -24,7 +24,7 @@ export const Route = createFileRoute("/_nav/settings/ai")({
       const providers = await listAiProvidersFn()
       return { aiProviders: providers }
     } catch (e) {
-      console.error("[settings/ai] Failed to load provider list", e)
+      console.error("[settings/ai] Failed to load provider list", e instanceof Error ? e.message : String(e))
       return { aiProviders: [] }
     }
   },

package/src/routes/api/design/upload.ts

@@ -52,7 +52,15 @@ export const Route = createFileRoute("/api/design/upload")({
           })
         }
 
-        const annotation = parseAnnotationJson(JSON.parse(metadataStr))
+        let annotation: ReturnType<typeof parseAnnotationJson>
+try {
+  annotation = parseAnnotationJson(JSON.parse(metadataStr))
+} catch {
+  return new Response(JSON.stringify({ error: "Invalid JSON in meta field" }), {
+    status: 400,
+    headers: { "Content-Type": "application/json" },
+  })
+}
         const docName = annotation.document.name || "Untitled"
 
         let project = await prisma.designProject.findFirst({

package/src/routes/design-files/$projectId/$artboardId/$filename.ts

@@ -17,7 +17,7 @@
 
 import { createFileRoute } from "@tanstack/react-router"
 import { readFile } from "node:fs/promises"
-import { join } from "node:path"
+import { resolve, normalize } from "node:path"
 import { existsSync } from "node:fs"
 import { requireAuth } from "@/server/auth-helpers"
 
@@ -40,7 +40,11 @@ export const Route = createFileRoute("/design-files/$projectId/$artboardId/$file
         }
 
         const safeFilename = filename.replace(/\.\./g, "").replace(/\//g, "")
-        const filePath = join(UPLOAD_ROOT, projectId, artboardId, safeFilename)
+        const baseDir = resolve(UPLOAD_ROOT, projectId, artboardId)
+        const filePath = normalize(resolve(baseDir, safeFilename))
+        if (!filePath.startsWith(resolve(baseDir))) {
+          throw new Error("Path traversal detected")
+        }
 
         if (!existsSync(filePath)) {
           return new Response("Not Found", { status: 404 })

package/src/routes/server.ai-stream.ts

@@ -103,7 +103,7 @@ export const Route = createFileRoute('/server/ai-stream')({
             },
           })
         } catch (err) {
-          console.warn('[ai-stream] chat failed', err)
+          console.warn('[ai-stream] chat failed', err instanceof Error ? err.message : String(err))
           const fallback = JSON.stringify({
             type: 'fallback',
             content: 'AI service is temporarily unavailable. Please try again later.',

package/src/server/audit.ts

@@ -20,6 +20,6 @@ export async function auditLog(entry: AuditEntryInput): Promise<void> {
       userAgent: null,
     })
   } catch (err) {
-    console.error('[audit] 写入失败:', err)
+    console.error('[audit] 写入失败:', err instanceof Error ? err.message : String(err))
   }
 }

package/src/server/keepalive/middleware.ts

@@ -35,7 +35,7 @@ export const neonKeepaliveMiddleware = createMiddleware().server(async ({ next }
         await prisma.$queryRawUnsafe('SELECT 1')
         ;(globalThis as any).__lastNeonKeepaliveAt = Date.now()
       } catch (e) {
-        console.warn('[neon-keepalive] error', e)
+        console.warn('[neon-keepalive] error', e instanceof Error ? e.message : String(e))
       }
     })(),
   ])

package/src/server/knowledge-public/github-sync.ts

@@ -33,18 +33,36 @@ const HEADERS: HeadersInit = {
     : {}),
 }
 
+function isAllowedGitHubUrl(url: string): boolean {
+  try {
+    const parsed = new URL(url)
+    return ['github.com', 'www.github.com'].includes(parsed.hostname)
+      && ['https:', 'http:'].includes(parsed.protocol)
+  } catch {
+    return false
+  }
+}
+
 export async function fetchGithubData(
   owner: string,
   repo: string,
 ): Promise<GithubData | null> {
-  const repoRes = await fetch(`${API}/repos/${owner}/${repo}`, { headers: HEADERS })
+  const repoUrl = `${API}/repos/${owner}/${repo}`
+  if (!isAllowedGitHubUrl(repoUrl)) {
+    throw new Error('URL not allowed')
+  }
+  const repoRes = await fetch(repoUrl, { headers: HEADERS, redirect: 'error' })
   if (!repoRes.ok) return null
   const repoJson: any = await repoRes.json()
 
   let latestVersion: string | null = null
   let versionDate: Date | null = null
   try {
-    const relRes = await fetch(`${API}/repos/${owner}/${repo}/releases/latest`, { headers: HEADERS })
+    const relUrl = `${API}/repos/${owner}/${repo}/releases/latest`
+    if (!isAllowedGitHubUrl(relUrl)) {
+      throw new Error('URL not allowed')
+    }
+    const relRes = await fetch(relUrl, { headers: HEADERS, redirect: 'error' })
     if (relRes.ok) {
       const relJson: any = await relRes.json()
       latestVersion = relJson.tag_name ?? null
@@ -104,7 +122,7 @@ export async function syncAllStaleGithubBookmarks(): Promise<number> {
       await syncBookmarkGithub(bm.id)
       count++
     } catch (e) {
-      console.warn('[github-sync] failed for', bm.id, e)
+      console.warn('[github-sync] failed for', bm.id, e instanceof Error ? e.message : String(e))
     }
   }
   return count

package/src/server/middlewares/audit-recorder.ts

@@ -32,6 +32,6 @@ export async function recordAuditEntry(
       userAgent: request.headers.get('user-agent'),
     })
   } catch (err) {
-    console.error('[audit] middleware 写入失败:', err)
+    console.error('[audit] middleware 写入失败:', err instanceof Error ? err.message : String(err))
   }
 }

package/src/server/middlewares/rate-limit.ts

@@ -0,0 +1,27 @@
+import { getRequest } from '@tanstack/react-start/server'
+
+const store = new Map<string, { count: number; resetAt: number }>()
+
+function check(key: string, max: number, windowMs: number): boolean {
+  const now = Date.now()
+  const entry = store.get(key)
+  if (!entry || now > entry.resetAt) {
+    store.set(key, { count: 1, resetAt: now + windowMs })
+    return true
+  }
+  if (entry.count >= max) return false
+  entry.count++
+  return true
+}
+
+export async function checkAuthRateLimit(
+  key: string,
+  max = 10,
+  windowMs = 15 * 60 * 1000,
+): Promise<void> {
+  const request = getRequest()
+  const ip = request?.headers?.get('x-forwarded-for') ?? 'unknown'
+  if (!check(`${key}:${ip}`, max, windowMs)) {
+    throw new Error('Too many requests')
+  }
+}

package/src/server/references/engine.ts

@@ -33,7 +33,8 @@ async function resolveDisplay(
   if (!entity) return { title: `[${targetModule}:${targetEntityId}]` }
 
   try {
-    const fields = [...entity.displayFields, "id"].join(", ")
+    const safeFields = [...entity.displayFields, "id"].filter(f => /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(f))
+    const fields = safeFields.join(", ")
     const rows = await prisma.$queryRawUnsafe<Record<string, unknown>[]>(
       `SELECT ${fields} FROM \`${entity.table}\` WHERE id = ?`,
       targetEntityId
@@ -80,13 +81,15 @@ export async function searchReferences(
   for (const config of filtered) {
     const mod = moduleRegistry.getModule(config.module)
     if (!mod) continue
-    const searchField = config.fields[0]
-    const { prisma: p } = await import("@allbluecn/database")
-    try {
-      const rows = await p.$queryRawUnsafe<Record<string, unknown>[]>(
-        `SELECT id, ${config.fields.join(", ")} FROM \`${mod.entities[0].table}\` WHERE \`${searchField}\` LIKE ? LIMIT 20`,
-        `%${query}%`
-      )
+const searchField = config.fields[0]
+      const safeSearchField = /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(searchField) ? searchField : "id"
+      const safeFields = config.fields.filter(f => /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(f))
+      const { prisma: p } = await import("@allbluecn/database")
+      try {
+        const rows = await p.$queryRawUnsafe<Record<string, unknown>[]>(
+          `SELECT id, ${safeFields.join(", ")} FROM \`${mod.entities[0].table}\` WHERE \`${safeSearchField}\` LIKE ? LIMIT 20`,
+          `%${query}%`
+        )
       for (const row of rows) {
         const display = mod.referenceDisplay(config.type, row)
         results.push({

package/src/server/serverFns/auth/forgot-password.ts

@@ -19,6 +19,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
 import { prisma } from '@allbluecn/database'
 import { randomBytes } from 'crypto'
+import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
 
 const forgotPasswordSchema = z.object({
   email: z.string().email('请输入有效邮箱'),
@@ -31,6 +32,7 @@ function generateToken(): string {
 export const forgotPasswordFn = createServerFn({ method: 'POST' })
   .validator(forgotPasswordSchema)
   .handler(async ({ data }) => {
+    await checkAuthRateLimit('forgotPassword', 5, 15 * 60 * 1000)
     const user = await prisma.user.findUnique({
       where: { email: data.email },
       select: { id: true },
@@ -45,7 +47,7 @@ export const forgotPasswordFn = createServerFn({ method: 'POST' })
           data: { token, userId: user.id, expiresAt },
         })
       } catch (dbError) {
-        console.error('Database error:', dbError)
+        console.error('Database error:', dbError instanceof Error ? dbError.message : String(dbError))
       }
     }
 

package/src/server/serverFns/auth/invitation.ts

@@ -23,6 +23,7 @@ import { requireAdmin } from '@/server/auth-helpers'
 const DEFAULT_CODE = '123123'
 
 export const createDefaultInvitationFn = createServerFn({ method: 'POST' })
+  .validator(z.object({}))
   .handler(async () => {
     const hasPermission = true
 

package/src/server/serverFns/auth/register.ts

@@ -20,6 +20,7 @@ import { z } from 'zod'
 import { prisma } from '@allbluecn/database'
 import bcrypt from 'bcryptjs'
 import { getRandomConfig, presetBgColors } from '@/components/settings/personal-team/account/avatar/avatar-config'
+import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
 
 const registerSchema = z.object({
   username: z.string().min(3).max(20),
@@ -31,6 +32,7 @@ const registerSchema = z.object({
 export const registerFn = createServerFn({ method: 'POST' })
   .validator(registerSchema)
   .handler(async ({ data }) => {
+    await checkAuthRateLimit('register', 5, 15 * 60 * 1000)
     const exists = await prisma.user.findFirst({
       where: { OR: [{ email: data.email }, { username: data.username }] },
       select: { id: true },

package/src/server/serverFns/auth/reset-password.ts

@@ -19,6 +19,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
 import { prisma } from '@allbluecn/database'
 import bcrypt from 'bcryptjs'
+import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
 
 const resetPasswordSchema = z.object({
   token: z.string().min(1, 'Token is required'),
@@ -43,6 +44,7 @@ export const validateResetTokenFn = createServerFn({ method: 'GET' })
 export const resetPasswordFn = createServerFn({ method: 'POST' })
   .validator(resetPasswordSchema)
   .handler(async ({ data }) => {
+    await checkAuthRateLimit('resetPassword', 5, 15 * 60 * 1000)
     const resetToken = await prisma.passwordResetToken.findUnique({
       where: { token: data.token },
       select: { id: true, userId: true, usedAt: true, expiresAt: true },

package/src/server/serverFns/auth/session.ts

@@ -16,6 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
 import { getRequest } from '@tanstack/react-start/server'
 import type { FeatureKey } from '@allbluecn/shared'
 import type { Session } from '@/lib/session'
@@ -117,7 +118,7 @@ export const exchangeRemoteTokenFn = createServerFn({ method: 'POST' })
     return { success: true, userId: profile.user.id, planName }
   })
 
-export const logoutRemoteFn = createServerFn({ method: 'POST' }).handler(async () => {
+export const logoutRemoteFn = createServerFn({ method: 'POST' }).validator(z.object({})).handler(async () => {
   if (isDesktopServer()) {
     await clearRemoteAuth()
     return { success: true }

package/src/server/serverFns/billing.ts

@@ -85,7 +85,7 @@ export const createCheckoutSessionFn = createServerFn({ method: 'POST' })
     })
   })
 
-export const createCustomerPortalSessionFn = createServerFn({ method: 'POST' }).handler(
+export const createCustomerPortalSessionFn = createServerFn({ method: 'POST' }).validator(z.object({})).handler(
   async () => {
     const request = getRequest()
     const session = await requireAuth(request)

package/src/server/serverFns/compliance.ts

@@ -1,4 +1,5 @@
 import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
 import { getRequest } from '@tanstack/react-start/server'
 import { checkRateLimit } from '@/lib/pacer'
 import { getProService } from '@/server/pro-services'
@@ -7,7 +8,7 @@ import { requireFeature } from '@/server/entitlements'
 
 const JOB_RATE_LIMIT = { max: 3, windowMs: 3600_000 }
 
-export const requestMyExportFn = createServerFn({ method: 'POST' }).handler(async () => {
+export const requestMyExportFn = createServerFn({ method: 'POST' }).validator(z.object({})).handler(async () => {
   const request = getRequest()
   const session = await requireAuth(request)
   if (!session?.user?.id) {
@@ -26,7 +27,7 @@ export const requestMyExportFn = createServerFn({ method: 'POST' }).handler(asyn
   return compliance.createExportJob('user', userId, userId)
 })
 
-export const requestMyDeletionFn = createServerFn({ method: 'POST' }).handler(async () => {
+export const requestMyDeletionFn = createServerFn({ method: 'POST' }).validator(z.object({})).handler(async () => {
   const request = getRequest()
   const session = await requireAuth(request)
   if (!session?.user?.id) {

package/src/server/serverFns/design/settings.ts

@@ -42,6 +42,7 @@ export const getDesignSettingsFn = createServerFn({ method: 'GET' })
   })
 
 export const generateSketchTokenFn = createServerFn({ method: 'POST' })
+  .validator(z.object({}))
   .handler(async () => {
     const request = getRequest()
     const session = await requireAuth(request)

package/src/server/serverFns/team.ts

@@ -232,7 +232,7 @@ export const removeTeamMemberFn = createServerFn({ method: 'POST' })
     return { success: true }
   })
 
-export const leaveTeamFn = createServerFn({ method: 'POST' }).handler(async () => {
+export const leaveTeamFn = createServerFn({ method: 'POST' }).validator(z.object({})).handler(async () => {
   const request = getRequest()
   const session = await requireAuth(request)
   const userId = session.user!.id!

package/src/server/sso/tokens.ts

@@ -1,10 +1,25 @@
-import { createHmac, timingSafeEqual } from 'node:crypto'
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto'
 
-const SECRET = process.env.SSO_STATE_SECRET ?? 'dev-only-insecure-sso-secret'
 const DEFAULT_TTL_MS = 60_000
 
+let _cachedSecret: string | null = null
+function getSecret(): string {
+  if (_cachedSecret) return _cachedSecret
+  const raw = process.env.SSO_STATE_SECRET
+  if (!raw) {
+    if (process.env.NODE_ENV === 'production') {
+      throw new Error('[SSO] SSO_STATE_SECRET is required in production')
+    }
+    console.warn('[SSO] SSO_STATE_SECRET not set, using random dev key')
+    _cachedSecret = randomBytes(32).toString('base64url')
+    return _cachedSecret
+  }
+  _cachedSecret = raw
+  return _cachedSecret
+}
+
 function sign(payload: string): string {
-  return createHmac('sha256', SECRET).update(payload).digest('base64url')
+  return createHmac('sha256', getSecret()).update(payload).digest('base64url')
 }
 
 function verify(token: string): string | null {

package/src/start.ts

@@ -28,7 +28,7 @@ if (import.meta.env.SSR && !globalAny.__githubSyncTimer) {
       const n = await syncAllStaleGithubBookmarks()
       if (n > 0) console.log(`[github-sync] synced ${n} bookmarks`)
     } catch (e) {
-      console.warn('[github-sync] error', e)
+      console.warn('[github-sync] error', e instanceof Error ? e.message : String(e))
     }
   }, 6 * 60 * 60 * 1000)
 }
@@ -62,7 +62,7 @@ const apiCorsMiddleware = createMiddleware().server(async ({ request, next }: an
     if (allowedOrigins.includes(origin)) {
       headers.set('Access-Control-Allow-Origin', origin)
       headers.set('Access-Control-Allow-Credentials', 'true')
-      headers.set('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
+      headers.set('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
       headers.set('Access-Control-Allow-Headers', 'Content-Type, Authorization')
     }
   }

package/vite.shared.ts

@@ -118,7 +118,7 @@ export function createWebViteConfig(opts: WebViteConfigOptions) {
       },
       optimizeDeps: {
         exclude: ['@allbluecn/ai-gateway', '@allbluecn/database', '@allbluecn/shared', '@allbluecn/ui', '@allbluecn/plugins-core', '@allbluecn/tiptap'],
-        include: ['@tanstack/react-router'],
+        include: ['@tanstack/react-router', 'use-sync-external-store', 'swr'],
       },
       ssr: {
         noExternal: [