@allbluecn/web-app 0.4.8 → 0.4.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@allbluecn/web-app",
-  "version": "0.4.8",
+  "version": "0.4.9",
   "license": "AGPL-3.0-or-later",
   "type": "module",
   "files": [
@@ -102,6 +102,7 @@
     "i18next-browser-languagedetector": "^8.2.1",
     "ioredis": "^5.11.0",
     "is-hotkey": "^0.2.0",
+    "isomorphic-dompurify": "^3.22.0",
     "lowlight": "^3.3.0",
     "lucide-react": "^1.24.0",
     "mind-elixir": "^5.12.2",
@@ -130,14 +131,14 @@
     "three": "^0.180.0",
     "tw-animate-css": "^1.4.0",
     "zod": "^4.4.3",
-    "@allbluecn/ai-gateway": "0.4.8",
-    "@allbluecn/database": "0.4.8",
-    "@allbluecn/shared": "0.4.8",
-    "@allbluecn/prototype": "0.1.1",
+    "@allbluecn/database": "0.4.9",
     "@allbluecn/kernel": "0.3.0",
-    "@allbluecn/plugins-core": "0.4.8",
-    "@allbluecn/tiptap": "0.4.8",
-    "@allbluecn/ui": "0.4.8"
+    "@allbluecn/ai-gateway": "0.4.9",
+    "@allbluecn/plugins-core": "0.4.9",
+    "@allbluecn/prototype": "0.1.1",
+    "@allbluecn/tiptap": "0.4.9",
+    "@allbluecn/shared": "0.4.9",
+    "@allbluecn/ui": "0.4.9"
   },
   "devDependencies": {
     "@babel/parser": "^8.0.4",

package/src/components/chat/ai-chat-history/components/conversation-item.tsx

@@ -102,7 +102,7 @@ export function ConversationItem({
       await onDelete(conversation.id);
       setShowDeleteDialog(false);
     } catch (error) {
-      console.error("Failed to delete conversation:", error);
+      console.error("Failed to delete conversation:", error instanceof Error ? error.message : String(error));
     } finally {
       setIsDeleting(false);
     }

package/src/components/chat/ai-chat-history/index.tsx

@@ -107,7 +107,7 @@ export default function AIChatHistory({
         await onRename(conversationId, trimmedValue);
         setEditingId(null);
       } catch (error) {
-        console.error("Failed to rename conversation:", error);
+        console.error("Failed to rename conversation:", error instanceof Error ? error.message : String(error));
       } finally {
         setLoadingStates((prev) => {
           const next = { ...prev };

package/src/components/knowledge/editor/knowledge-doc-editor.tsx

@@ -139,7 +139,7 @@ function KnowledgeDocEditorBody({ document, editorWidth = 'auto', kbName, proper
       setDirty(false)
       setLastSavedAt(new Date())
     } catch (e) {
-      console.error('Auto-save failed:', e)
+      console.error('Auto-save failed:', e instanceof Error ? e.message : String(e))
     } finally {
       setSaving(false)
     }
@@ -176,7 +176,7 @@ function KnowledgeDocEditorBody({ document, editorWidth = 'auto', kbName, proper
       await saver(newTitle)
       onDocTitleChanged()
     } catch (e) {
-      console.error('Title update failed:', e)
+      console.error('Title update failed:', e instanceof Error ? e.message : String(e))
     }
   }, [onDocTitleChanged, saveHandlers])
 
@@ -186,7 +186,7 @@ function KnowledgeDocEditorBody({ document, editorWidth = 'auto', kbName, proper
       const saver = saveHandlers?.tags ?? ((t: string[]) => updateDocumentFn({ data: { id: docId.current, tags: t } }))
       await saver(newTags)
     } catch (e) {
-      console.error('Tags update failed:', e)
+      console.error('Tags update failed:', e instanceof Error ? e.message : String(e))
     }
   }, [saveHandlers])
 
@@ -198,7 +198,7 @@ function KnowledgeDocEditorBody({ document, editorWidth = 'auto', kbName, proper
     () => {
       if (saveHandlers?.properties && latestPropertyValues.current) {
         saveHandlers.properties(latestPropertyValues.current)
-          .catch((e) => console.error('Properties update failed:', e))
+          .catch((e) => console.error('Properties update failed:', e instanceof Error ? e.message : String(e)))
       }
     },
     { wait: EDITOR_AUTO_SAVE_MS },

package/src/components/knowledge/knowledge-settings-panel.tsx

@@ -66,7 +66,7 @@ export function KnowledgeSettingsPanel({ open, onOpenChange, kb, onUpdate }: Kno
       await updateKnowledgeFn({ data: { id: kb.id, visibility: v } })
       onUpdate?.()
     } catch (e) {
-      console.error('Update visibility failed:', e)
+      console.error('Update visibility failed:', e instanceof Error ? e.message : String(e))
     }
     setSaving(false)
   }
@@ -78,7 +78,7 @@ export function KnowledgeSettingsPanel({ open, onOpenChange, kb, onUpdate }: Kno
       onOpenChange(false)
       navigate({ to: '/knowledge' })
     } catch (e) {
-      console.error('Delete failed:', e)
+      console.error('Delete failed:', e instanceof Error ? e.message : String(e))
     }
     setDeleting(false)
   }

package/src/components/knowledge/knowledge-toolbar.tsx

@@ -127,7 +127,7 @@ export function KnowledgeToolbar({ kb, onUpdate, breadcrumb, docType, treeCollap
       await updateKnowledgeFn({ data: { id: kb.id, name: name.trim() } })
       onUpdate?.()
     } catch (e) {
-      console.error('Rename failed:', e)
+      console.error('Rename failed:', e instanceof Error ? e.message : String(e))
     }
     setEditingName(false)
   }
@@ -137,7 +137,7 @@ export function KnowledgeToolbar({ kb, onUpdate, breadcrumb, docType, treeCollap
     try {
       await updateKnowledgeFn({ data: { id: kb.id, tags } })
     } catch (e) {
-      console.error('Update tags failed:', e)
+      console.error('Update tags failed:', e instanceof Error ? e.message : String(e))
     }
   }
 
@@ -148,7 +148,7 @@ export function KnowledgeToolbar({ kb, onUpdate, breadcrumb, docType, treeCollap
       await updateKnowledgeFn({ data: { id: kb.id, visibility: value as 'private' | 'team' } })
       onUpdate?.()
     } catch (e) {
-      console.error('Update visibility failed:', e)
+      console.error('Update visibility failed:', e instanceof Error ? e.message : String(e))
     }
   }
 
@@ -161,7 +161,7 @@ export function KnowledgeToolbar({ kb, onUpdate, breadcrumb, docType, treeCollap
       window.dispatchEvent(new CustomEvent("knowledge-deleted"))
       navigate({ to: '/knowledge' })
     } catch (e) {
-      console.error('Delete failed:', e)
+      console.error('Delete failed:', e instanceof Error ? e.message : String(e))
     }
     setDeleting(false)
   }

package/src/components/knowledge/knowledge-tree-item.tsx

@@ -120,7 +120,7 @@ export function KnowledgeTreeItem({
       onRefresh()
       onDocRenamed?.(node.id)
     } catch (e) {
-      console.error('Rename failed:', e)
+      console.error('Rename failed:', e instanceof Error ? e.message : String(e))
     }
     finishEditing()
   }
@@ -134,7 +134,7 @@ export function KnowledgeTreeItem({
       setDeleteConfirm('')
       onRefresh()
     } catch (e) {
-      console.error('Delete failed:', e)
+      console.error('Delete failed:', e instanceof Error ? e.message : String(e))
     }
     setDeleting(false)
   }
@@ -156,7 +156,7 @@ export function KnowledgeTreeItem({
       onRefresh()
       onSelect(doc.id)
     } catch (e) {
-      console.error('Create child failed:', e)
+      console.error('Create child failed:', e instanceof Error ? e.message : String(e))
     }
     setCreatingChild(false)
   }

package/src/components/knowledge/knowledge-tree.tsx

@@ -107,7 +107,7 @@ export function KnowledgeTree({
       const docs = await listDocumentsFn({ data: { kbId } })
       setDocuments(docs as TreeNode[])
     } catch (e) {
-      console.error('Failed to fetch documents:', e)
+      console.error('Failed to fetch documents:', e instanceof Error ? e.message : String(e))
     } finally {
       setLoading(false)
     }
@@ -155,7 +155,7 @@ export function KnowledgeTree({
       await fetchDocuments()
       onSelect(doc.id)
     } catch (e) {
-      console.error('Create failed:', e)
+      console.error('Create failed:', e instanceof Error ? e.message : String(e))
     }
     setCreatingType(null)
   }

package/src/components/settings/personal-team/account/account-client.tsx

@@ -67,7 +67,7 @@ export default function AccountClient({
         old ? { ...old, user: { ...old.user, avatarConfig: config, bgShape: shape, bgColor: color } } : old,
       )
     } catch (err) {
-      console.error("Failed to persist avatar:", err)
+      console.error("Failed to persist avatar:", err instanceof Error ? err.message : String(err))
       toast.error(t("profile.avatarSaveFailed"))
     }
   }, [queryClient])

package/src/components/story/detail/activity-timeline.tsx

@@ -35,6 +35,7 @@ import { listProjectsBriefFn } from "@/server/serverFns/project";
 import type { ActivityItem, UserBrief } from "@/components/story/types";
 import { groupActivities, type ActivityGroup } from "@/lib/story/activity-grouper";
 import { ArrowUpFromDot, ChevronDown, Dot, Sparkles, Layers, UserRound } from "lucide-react";
+import { sanitize } from "@/lib/sanitize";
 
 function getDiffDecorator(
   action: string,
@@ -245,7 +246,7 @@ function DiffCompare({ oldValue, newValue, oldDecorator, newDecorator, plain, bl
               <div className="w-1/2 border-r bg-red-50/40 dark:bg-red-950/20 p-2 pr-4">
                 <div className="flex items-center gap-1.5">
                   {b.oldDecorator}
-                  <div className="break-all" dangerouslySetInnerHTML={{ __html: b.left }} />
+                  <div className="break-all" dangerouslySetInnerHTML={{ __html: sanitize(b.left) }} />
                 </div>
               </div>
               <div className="absolute left-1/2 top-1/2 -translate-x-1/2 -translate-y-1/2 z-10 flex size-5 items-center justify-center rounded-full bg-background border">
@@ -254,7 +255,7 @@ function DiffCompare({ oldValue, newValue, oldDecorator, newDecorator, plain, bl
               <div className="w-1/2 bg-green-50/40 dark:bg-green-950/20 p-2 pl-4">
                 <div className="flex items-center gap-1.5">
                   {b.newDecorator}
-                  <div className="break-all" dangerouslySetInnerHTML={{ __html: b.right }} />
+                  <div className="break-all" dangerouslySetInnerHTML={{ __html: sanitize(b.right) }} />
                 </div>
               </div>
             </div>
@@ -271,7 +272,7 @@ function DiffCompare({ oldValue, newValue, oldDecorator, newDecorator, plain, bl
         {/* 测量用：渲染所有块右侧文本以计算总高度 */}
         <div ref={measureRef} className="absolute left-0 top-0 -z-10 invisible w-1/2 p-2 pl-4 break-all space-y-2">
           {renderedBlocks.map((b, idx) => (
-            <div key={idx} dangerouslySetInnerHTML={{ __html: b.right }} />
+            <div key={idx} dangerouslySetInnerHTML={{ __html: sanitize(b.right) }} />
           ))}
         </div>
       </div>
@@ -291,7 +292,7 @@ function DiffCompare({ oldValue, newValue, oldDecorator, newDecorator, plain, bl
       <div className="w-1/2 border-r bg-red-50/40 dark:bg-red-950/20 p-2 pr-4">
         <div className="flex items-center gap-1.5">
           {oldDecorator}
-          <div className="break-all" dangerouslySetInnerHTML={{ __html: single!.left }} />
+          <div className="break-all" dangerouslySetInnerHTML={{ __html: sanitize(single!.left) }} />
         </div>
       </div>
       <div className="absolute left-1/2 top-1/2 -translate-x-1/2 -translate-y-1/2 z-10 flex size-5 items-center justify-center rounded-full bg-background border">
@@ -300,7 +301,7 @@ function DiffCompare({ oldValue, newValue, oldDecorator, newDecorator, plain, bl
       <div className="w-1/2 bg-green-50/40 dark:bg-green-950/20 p-2 pl-4">
         <div className="flex items-center gap-1.5">
           {newDecorator}
-          <div className="break-all" dangerouslySetInnerHTML={{ __html: single!.right }} />
+          <div className="break-all" dangerouslySetInnerHTML={{ __html: sanitize(single!.right) }} />
         </div>
       </div>
       <div
@@ -311,7 +312,7 @@ function DiffCompare({ oldValue, newValue, oldDecorator, newDecorator, plain, bl
           transition: "opacity 0.25s ease",
         }}
       />
-      <div ref={measureRef} className="absolute left-0 top-0 -z-10 invisible w-1/2 p-2 pl-4 break-all" dangerouslySetInnerHTML={{ __html: single!.right }} />
+      <div ref={measureRef} className="absolute left-0 top-0 -z-10 invisible w-1/2 p-2 pl-4 break-all" dangerouslySetInnerHTML={{ __html: sanitize(single!.right) }} />
     </div>
   );
 }

package/src/lib/anyhub/manager.ts

@@ -16,7 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { prisma } from "@allbluecn/database"
-import { execSync } from "child_process"
+import { execFileSync } from "child_process"
 import path from "path"
 import { getAnyHubBaseDir } from "./types"
 import type { AnyHubAppSource, AnyHubAppData } from "./types"
@@ -112,9 +112,17 @@ export const AnyHubManager = {
     let proxyBasePath: string | null = null
 
     if (isRelativeEntry) {
+      if (!/^[a-zA-Z0-9._-]+$/.test(manifest.name)) {
+        throw new Error("Invalid manifest name")
+      }
       const cloneDir = path.join(getAnyHubBaseDir(), "apps", manifest.name)
-      execSync(`git clone ${githubUrl} ${cloneDir}`, { stdio: "pipe" })
-      localPath = cloneDir
+      const resolvedClone = path.resolve(cloneDir)
+      const resolvedBase = path.resolve(getAnyHubBaseDir())
+      if (!resolvedClone.startsWith(resolvedBase + path.sep)) {
+        throw new Error("Clone directory outside allowed base path")
+      }
+      execFileSync("git", ["clone", "--depth", "1", githubUrl, resolvedClone], { stdio: "pipe" })
+      localPath = resolvedClone
       proxyBasePath = "/api/anyhub/proxy/"
       url = null
     }
@@ -177,7 +185,12 @@ export const AnyHubManager = {
     if (!app) throw new Error("应用不存在")
 
     if (app.source === "github" && app.localPath) {
-      execSync(`cd ${app.localPath} && git pull`, { stdio: "pipe" })
+      const resolvedBase = path.resolve(getAnyHubBaseDir())
+      const resolvedLocalPath = path.resolve(app.localPath)
+      if (!resolvedLocalPath.startsWith(resolvedBase + path.sep)) {
+        throw new Error("Local path outside allowed base path")
+      }
+      execFileSync("git", ["pull"], { cwd: resolvedLocalPath, stdio: "pipe" })
     }
 
     const updated = await prisma.anyHubApp.update({

package/src/lib/auth/auth.config.ts

@@ -72,7 +72,7 @@ async function getCachedProfile(userId: string): Promise<CachedProfile | null> {
     // DB 异常（如 Prisma Client 未 generate、字段缺失、连接失败）不应导致整个 session 崩溃。
     // @auth/core 的 session action 会把 session callback 的任何异常误判为 JWTSessionError 并删除 cookie，
     // 导致用户被登出。此处降级返回最小有效 profile，保持用户登录态。
-    console.error('[auth] getCachedProfile 查询失败，降级返回默认 profile:', e)
+    console.error('[auth] getCachedProfile 查询失败，降级返回默认 profile:', e instanceof Error ? e.message : String(e))
     return {
       username: '用户',
       avatarConfig: null,
@@ -163,7 +163,7 @@ export const authConfig: StartAuthJSConfig = {
               },
             })
           } catch (err) {
-            console.error('[auth] 记录登录日志失败:', err)
+            console.error('[auth] 记录登录日志失败:', err instanceof Error ? err.message : String(err))
           }
         }
 

package/src/lib/auth/sso-authorize.ts

@@ -33,7 +33,7 @@ export async function resolveSsoTokenUser(ssoToken: string): Promise<SsoAuthUser
         },
       })
     } catch (err) {
-      console.error('[auth] 记录 SSO 登录日志失败:', err)
+      console.error('[auth] 记录 SSO 登录日志失败:', err instanceof Error ? err.message : String(err))
     }
   }
 

package/src/lib/sanitize.ts

@@ -0,0 +1,5 @@
+import DOMPurify from 'isomorphic-dompurify'
+
+export function sanitize(html: string): string {
+  return DOMPurify.sanitize(html)
+}

package/src/routes/_nav/chat/route.lazy.tsx

@@ -145,7 +145,7 @@ function ChatPage() {
         clearHandoffState()
         applyConv(conv, pendingMsg)
       } catch (e) {
-        console.error('[chat] Failed to process pending workspace message:', e)
+        console.error('[chat] Failed to process pending workspace message:', e instanceof Error ? e.message : String(e))
         clearHandoffState()
       }
     })()

package/src/routes/_nav/design/index.lazy.tsx

@@ -116,7 +116,7 @@ function DesignDashboard() {
       setProjects((prev) => prev.filter((p) => p.id !== pendingDeleteId))
       setPendingDeleteId(null)
     } catch (error) {
-      console.error("Failed to delete design project:", error)
+      console.error("Failed to delete design project:", error instanceof Error ? error.message : String(error))
     } finally {
       setDeleting(false)
     }

package/src/routes/_nav/settings/ai/route.tsx

@@ -24,7 +24,7 @@ export const Route = createFileRoute("/_nav/settings/ai")({
       const providers = await listAiProvidersFn()
       return { aiProviders: providers }
     } catch (e) {
-      console.error("[settings/ai] Failed to load provider list", e)
+      console.error("[settings/ai] Failed to load provider list", e instanceof Error ? e.message : String(e))
       return { aiProviders: [] }
     }
   },

package/src/routes/api/design/upload.ts

@@ -52,7 +52,15 @@ export const Route = createFileRoute("/api/design/upload")({
           })
         }
 
-        const annotation = parseAnnotationJson(JSON.parse(metadataStr))
+        let annotation: ReturnType<typeof parseAnnotationJson>
+try {
+  annotation = parseAnnotationJson(JSON.parse(metadataStr))
+} catch {
+  return new Response(JSON.stringify({ error: "Invalid JSON in meta field" }), {
+    status: 400,
+    headers: { "Content-Type": "application/json" },
+  })
+}
         const docName = annotation.document.name || "Untitled"
 
         let project = await prisma.designProject.findFirst({

package/src/routes/design-files/$projectId/$artboardId/$filename.ts

@@ -17,7 +17,7 @@
 
 import { createFileRoute } from "@tanstack/react-router"
 import { readFile } from "node:fs/promises"
-import { join } from "node:path"
+import { resolve, normalize } from "node:path"
 import { existsSync } from "node:fs"
 import { requireAuth } from "@/server/auth-helpers"
 
@@ -40,7 +40,11 @@ export const Route = createFileRoute("/design-files/$projectId/$artboardId/$file
         }
 
         const safeFilename = filename.replace(/\.\./g, "").replace(/\//g, "")
-        const filePath = join(UPLOAD_ROOT, projectId, artboardId, safeFilename)
+        const baseDir = resolve(UPLOAD_ROOT, projectId, artboardId)
+        const filePath = normalize(resolve(baseDir, safeFilename))
+        if (!filePath.startsWith(resolve(baseDir))) {
+          throw new Error("Path traversal detected")
+        }
 
         if (!existsSync(filePath)) {
           return new Response("Not Found", { status: 404 })

package/src/routes/server.ai-stream.ts

@@ -103,7 +103,7 @@ export const Route = createFileRoute('/server/ai-stream')({
             },
           })
         } catch (err) {
-          console.warn('[ai-stream] chat failed', err)
+          console.warn('[ai-stream] chat failed', err instanceof Error ? err.message : String(err))
           const fallback = JSON.stringify({
             type: 'fallback',
             content: 'AI service is temporarily unavailable. Please try again later.',

package/src/server/audit.ts

@@ -20,6 +20,6 @@ export async function auditLog(entry: AuditEntryInput): Promise<void> {
       userAgent: null,
     })
   } catch (err) {
-    console.error('[audit] 写入失败:', err)
+    console.error('[audit] 写入失败:', err instanceof Error ? err.message : String(err))
   }
 }

package/src/server/keepalive/middleware.ts

@@ -35,7 +35,7 @@ export const neonKeepaliveMiddleware = createMiddleware().server(async ({ next }
         await prisma.$queryRawUnsafe('SELECT 1')
         ;(globalThis as any).__lastNeonKeepaliveAt = Date.now()
       } catch (e) {
-        console.warn('[neon-keepalive] error', e)
+        console.warn('[neon-keepalive] error', e instanceof Error ? e.message : String(e))
       }
     })(),
   ])

package/src/server/knowledge-public/github-sync.ts

@@ -33,18 +33,36 @@ const HEADERS: HeadersInit = {
     : {}),
 }
 
+function isAllowedGitHubUrl(url: string): boolean {
+  try {
+    const parsed = new URL(url)
+    return ['github.com', 'www.github.com'].includes(parsed.hostname)
+      && ['https:', 'http:'].includes(parsed.protocol)
+  } catch {
+    return false
+  }
+}
+
 export async function fetchGithubData(
   owner: string,
   repo: string,
 ): Promise<GithubData | null> {
-  const repoRes = await fetch(`${API}/repos/${owner}/${repo}`, { headers: HEADERS })
+  const repoUrl = `${API}/repos/${owner}/${repo}`
+  if (!isAllowedGitHubUrl(repoUrl)) {
+    throw new Error('URL not allowed')
+  }
+  const repoRes = await fetch(repoUrl, { headers: HEADERS, redirect: 'error' })
   if (!repoRes.ok) return null
   const repoJson: any = await repoRes.json()
 
   let latestVersion: string | null = null
   let versionDate: Date | null = null
   try {
-    const relRes = await fetch(`${API}/repos/${owner}/${repo}/releases/latest`, { headers: HEADERS })
+    const relUrl = `${API}/repos/${owner}/${repo}/releases/latest`
+    if (!isAllowedGitHubUrl(relUrl)) {
+      throw new Error('URL not allowed')
+    }
+    const relRes = await fetch(relUrl, { headers: HEADERS, redirect: 'error' })
     if (relRes.ok) {
       const relJson: any = await relRes.json()
       latestVersion = relJson.tag_name ?? null
@@ -104,7 +122,7 @@ export async function syncAllStaleGithubBookmarks(): Promise<number> {
       await syncBookmarkGithub(bm.id)
       count++
     } catch (e) {
-      console.warn('[github-sync] failed for', bm.id, e)
+      console.warn('[github-sync] failed for', bm.id, e instanceof Error ? e.message : String(e))
     }
   }
   return count

package/src/server/middlewares/audit-recorder.ts

@@ -32,6 +32,6 @@ export async function recordAuditEntry(
       userAgent: request.headers.get('user-agent'),
     })
   } catch (err) {
-    console.error('[audit] middleware 写入失败:', err)
+    console.error('[audit] middleware 写入失败:', err instanceof Error ? err.message : String(err))
   }
 }

package/src/server/middlewares/rate-limit.ts

@@ -0,0 +1,27 @@
+import { getRequest } from '@tanstack/react-start/server'
+
+const store = new Map<string, { count: number; resetAt: number }>()
+
+function check(key: string, max: number, windowMs: number): boolean {
+  const now = Date.now()
+  const entry = store.get(key)
+  if (!entry || now > entry.resetAt) {
+    store.set(key, { count: 1, resetAt: now + windowMs })
+    return true
+  }
+  if (entry.count >= max) return false
+  entry.count++
+  return true
+}
+
+export async function checkAuthRateLimit(
+  key: string,
+  max = 10,
+  windowMs = 15 * 60 * 1000,
+): Promise<void> {
+  const request = getRequest()
+  const ip = request?.headers?.get('x-forwarded-for') ?? 'unknown'
+  if (!check(`${key}:${ip}`, max, windowMs)) {
+    throw new Error('Too many requests')
+  }
+}

package/src/server/references/engine.ts

@@ -33,7 +33,8 @@ async function resolveDisplay(
   if (!entity) return { title: `[${targetModule}:${targetEntityId}]` }
 
   try {
-    const fields = [...entity.displayFields, "id"].join(", ")
+    const safeFields = [...entity.displayFields, "id"].filter(f => /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(f))
+    const fields = safeFields.join(", ")
     const rows = await prisma.$queryRawUnsafe<Record<string, unknown>[]>(
       `SELECT ${fields} FROM \`${entity.table}\` WHERE id = ?`,
       targetEntityId
@@ -80,13 +81,15 @@ export async function searchReferences(
   for (const config of filtered) {
     const mod = moduleRegistry.getModule(config.module)
     if (!mod) continue
-    const searchField = config.fields[0]
-    const { prisma: p } = await import("@allbluecn/database")
-    try {
-      const rows = await p.$queryRawUnsafe<Record<string, unknown>[]>(
-        `SELECT id, ${config.fields.join(", ")} FROM \`${mod.entities[0].table}\` WHERE \`${searchField}\` LIKE ? LIMIT 20`,
-        `%${query}%`
-      )
+const searchField = config.fields[0]
+      const safeSearchField = /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(searchField) ? searchField : "id"
+      const safeFields = config.fields.filter(f => /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(f))
+      const { prisma: p } = await import("@allbluecn/database")
+      try {
+        const rows = await p.$queryRawUnsafe<Record<string, unknown>[]>(
+          `SELECT id, ${safeFields.join(", ")} FROM \`${mod.entities[0].table}\` WHERE \`${safeSearchField}\` LIKE ? LIMIT 20`,
+          `%${query}%`
+        )
       for (const row of rows) {
         const display = mod.referenceDisplay(config.type, row)
         results.push({

package/src/server/serverFns/auth/forgot-password.ts

@@ -19,6 +19,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
 import { prisma } from '@allbluecn/database'
 import { randomBytes } from 'crypto'
+import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
 
 const forgotPasswordSchema = z.object({
   email: z.string().email('请输入有效邮箱'),
@@ -31,6 +32,7 @@ function generateToken(): string {
 export const forgotPasswordFn = createServerFn({ method: 'POST' })
   .validator(forgotPasswordSchema)
   .handler(async ({ data }) => {
+    await checkAuthRateLimit('forgotPassword', 5, 15 * 60 * 1000)
     const user = await prisma.user.findUnique({
       where: { email: data.email },
       select: { id: true },
@@ -45,7 +47,7 @@ export const forgotPasswordFn = createServerFn({ method: 'POST' })
           data: { token, userId: user.id, expiresAt },
         })
       } catch (dbError) {
-        console.error('Database error:', dbError)
+        console.error('Database error:', dbError instanceof Error ? dbError.message : String(dbError))
       }
     }
 

package/src/server/serverFns/auth/invitation.ts

@@ -23,6 +23,7 @@ import { requireAdmin } from '@/server/auth-helpers'
 const DEFAULT_CODE = '123123'
 
 export const createDefaultInvitationFn = createServerFn({ method: 'POST' })
+  .validator(z.object({}))
   .handler(async () => {
     const hasPermission = true
 

package/src/server/serverFns/auth/register.ts

@@ -20,6 +20,7 @@ import { z } from 'zod'
 import { prisma } from '@allbluecn/database'
 import bcrypt from 'bcryptjs'
 import { getRandomConfig, presetBgColors } from '@/components/settings/personal-team/account/avatar/avatar-config'
+import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
 
 const registerSchema = z.object({
   username: z.string().min(3).max(20),
@@ -31,6 +32,7 @@ const registerSchema = z.object({
 export const registerFn = createServerFn({ method: 'POST' })
   .validator(registerSchema)
   .handler(async ({ data }) => {
+    await checkAuthRateLimit('register', 5, 15 * 60 * 1000)
     const exists = await prisma.user.findFirst({
       where: { OR: [{ email: data.email }, { username: data.username }] },
       select: { id: true },

package/src/server/serverFns/auth/reset-password.ts

@@ -19,6 +19,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
 import { prisma } from '@allbluecn/database'
 import bcrypt from 'bcryptjs'
+import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
 
 const resetPasswordSchema = z.object({
   token: z.string().min(1, 'Token is required'),
@@ -43,6 +44,7 @@ export const validateResetTokenFn = createServerFn({ method: 'GET' })
 export const resetPasswordFn = createServerFn({ method: 'POST' })
   .validator(resetPasswordSchema)
   .handler(async ({ data }) => {
+    await checkAuthRateLimit('resetPassword', 5, 15 * 60 * 1000)
     const resetToken = await prisma.passwordResetToken.findUnique({
       where: { token: data.token },
       select: { id: true, userId: true, usedAt: true, expiresAt: true },

package/src/server/serverFns/auth/session.ts

@@ -16,6 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
 import { getRequest } from '@tanstack/react-start/server'
 import type { FeatureKey } from '@allbluecn/shared'
 import type { Session } from '@/lib/session'
@@ -117,7 +118,7 @@ export const exchangeRemoteTokenFn = createServerFn({ method: 'POST' })
     return { success: true, userId: profile.user.id, planName }
   })
 
-export const logoutRemoteFn = createServerFn({ method: 'POST' }).handler(async () => {
+export const logoutRemoteFn = createServerFn({ method: 'POST' }).validator(z.object({})).handler(async () => {
   if (isDesktopServer()) {
     await clearRemoteAuth()
     return { success: true }

package/src/server/serverFns/billing.ts

@@ -85,7 +85,7 @@ export const createCheckoutSessionFn = createServerFn({ method: 'POST' })
     })
   })
 
-export const createCustomerPortalSessionFn = createServerFn({ method: 'POST' }).handler(
+export const createCustomerPortalSessionFn = createServerFn({ method: 'POST' }).validator(z.object({})).handler(
   async () => {
     const request = getRequest()
     const session = await requireAuth(request)

package/src/server/serverFns/compliance.ts

@@ -1,4 +1,5 @@
 import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
 import { getRequest } from '@tanstack/react-start/server'
 import { checkRateLimit } from '@/lib/pacer'
 import { getProService } from '@/server/pro-services'
@@ -7,7 +8,7 @@ import { requireFeature } from '@/server/entitlements'
 
 const JOB_RATE_LIMIT = { max: 3, windowMs: 3600_000 }
 
-export const requestMyExportFn = createServerFn({ method: 'POST' }).handler(async () => {
+export const requestMyExportFn = createServerFn({ method: 'POST' }).validator(z.object({})).handler(async () => {
   const request = getRequest()
   const session = await requireAuth(request)
   if (!session?.user?.id) {
@@ -26,7 +27,7 @@ export const requestMyExportFn = createServerFn({ method: 'POST' }).handler(asyn
   return compliance.createExportJob('user', userId, userId)
 })
 
-export const requestMyDeletionFn = createServerFn({ method: 'POST' }).handler(async () => {
+export const requestMyDeletionFn = createServerFn({ method: 'POST' }).validator(z.object({})).handler(async () => {
   const request = getRequest()
   const session = await requireAuth(request)
   if (!session?.user?.id) {

package/src/server/serverFns/design/settings.ts

@@ -42,6 +42,7 @@ export const getDesignSettingsFn = createServerFn({ method: 'GET' })
   })
 
 export const generateSketchTokenFn = createServerFn({ method: 'POST' })
+  .validator(z.object({}))
   .handler(async () => {
     const request = getRequest()
     const session = await requireAuth(request)

package/src/server/serverFns/team.ts

@@ -232,7 +232,7 @@ export const removeTeamMemberFn = createServerFn({ method: 'POST' })
     return { success: true }
   })
 
-export const leaveTeamFn = createServerFn({ method: 'POST' }).handler(async () => {
+export const leaveTeamFn = createServerFn({ method: 'POST' }).validator(z.object({})).handler(async () => {
   const request = getRequest()
   const session = await requireAuth(request)
   const userId = session.user!.id!

package/src/server/sso/tokens.ts

@@ -1,10 +1,25 @@
-import { createHmac, timingSafeEqual } from 'node:crypto'
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto'
 
-const SECRET = process.env.SSO_STATE_SECRET ?? 'dev-only-insecure-sso-secret'
 const DEFAULT_TTL_MS = 60_000
 
+let _cachedSecret: string | null = null
+function getSecret(): string {
+  if (_cachedSecret) return _cachedSecret
+  const raw = process.env.SSO_STATE_SECRET
+  if (!raw) {
+    if (process.env.NODE_ENV === 'production') {
+      throw new Error('[SSO] SSO_STATE_SECRET is required in production')
+    }
+    console.warn('[SSO] SSO_STATE_SECRET not set, using random dev key')
+    _cachedSecret = randomBytes(32).toString('base64url')
+    return _cachedSecret
+  }
+  _cachedSecret = raw
+  return _cachedSecret
+}
+
 function sign(payload: string): string {
-  return createHmac('sha256', SECRET).update(payload).digest('base64url')
+  return createHmac('sha256', getSecret()).update(payload).digest('base64url')
 }
 
 function verify(token: string): string | null {

package/src/start.ts

@@ -28,7 +28,7 @@ if (import.meta.env.SSR && !globalAny.__githubSyncTimer) {
       const n = await syncAllStaleGithubBookmarks()
       if (n > 0) console.log(`[github-sync] synced ${n} bookmarks`)
     } catch (e) {
-      console.warn('[github-sync] error', e)
+      console.warn('[github-sync] error', e instanceof Error ? e.message : String(e))
     }
   }, 6 * 60 * 60 * 1000)
 }
@@ -62,7 +62,7 @@ const apiCorsMiddleware = createMiddleware().server(async ({ request, next }: an
     if (allowedOrigins.includes(origin)) {
       headers.set('Access-Control-Allow-Origin', origin)
       headers.set('Access-Control-Allow-Credentials', 'true')
-      headers.set('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
+      headers.set('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
       headers.set('Access-Control-Allow-Headers', 'Content-Type, Authorization')
     }
   }

package/vite.shared.ts

@@ -118,7 +118,7 @@ export function createWebViteConfig(opts: WebViteConfigOptions) {
       },
       optimizeDeps: {
         exclude: ['@allbluecn/ai-gateway', '@allbluecn/database', '@allbluecn/shared', '@allbluecn/ui', '@allbluecn/plugins-core', '@allbluecn/tiptap'],
-        include: ['@tanstack/react-router'],
+        include: ['@tanstack/react-router', 'use-sync-external-store', 'swr'],
       },
       ssr: {
         noExternal: [