@allbluecn/web-app 0.5.0 → 0.5.1

package/src/server/serverFns/story/kb-scope.ts

@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import type { Prisma } from "@allbluecn/database";
+import { BUILTIN_INDEPENDENT_DISPLAY_ID } from "@/lib/builtin-project";
+
+export interface KbScopeInput {
+  projectId: string;
+  projectDisplayId: string | null;
+  userId: string;
+}
+
+/** 是否内置独立需求项目（displayId=STORY） */
+export function isIndependentProject(displayId: string | null): boolean {
+  return displayId === BUILTIN_INDEPENDENT_DISPLAY_ID;
+}
+
+/**
+ * 需求可选知识库范围（Prisma where，用于 KnowledgeBase 查询）：
+ * - 普通项目：visibility=general（跨用户）∪ 项目关联 KB（关联仅允许 team）
+ * - 独立需求（STORY）：自己的全部 ∪ 他人 team/general
+ */
+export function buildKbScopeWhere(input: KbScopeInput): Prisma.KnowledgeBaseWhereInput {
+  if (isIndependentProject(input.projectDisplayId)) {
+    return {
+      OR: [
+        { userId: input.userId },
+        { visibility: { in: ["team", "general"] } },
+      ],
+    };
+  }
+  return {
+    OR: [
+      { visibility: "general" },
+      { projectLinks: { some: { projectId: input.projectId } } },
+    ],
+  };
+}

package/src/server/serverFns/story/link-preview.ts

@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from "@tanstack/react-start";
+import { getRequest } from "@tanstack/react-start/server";
+import { z } from "zod";
+import { requireAuth } from "@/server/auth-helpers";
+
+const checkSchema = z.object({
+  url: z.string().url(),
+  origin: z.string().url().optional(),
+});
+
+/** SSRF 防护：仅允许公网 http/https 地址（拒绝内网 IP、localhost、本地域名） */
+function isPublicHttpUrl(raw: string): boolean {
+  let u: URL;
+  try {
+    u = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") return false;
+  const host = u.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (host === "localhost" || host === "::1" || host === "::" || host.endsWith(".local") || host.endsWith(".internal")) {
+    return false;
+  }
+  const ipv4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (ipv4) {
+    const [a, b] = [Number(ipv4[1]), Number(ipv4[2])];
+    if (a === 0 || a === 10 || a === 127 || a >= 224) return false;
+    if (a === 169 && b === 254) return false;
+    if (a === 172 && b >= 16 && b <= 31) return false;
+    if (a === 192 && b === 168) return false;
+  }
+  return true;
+}
+
+/** 解析 CSP frame-ancestors 指令，判断目标页面是否允许被应用嵌入 */
+function isFrameAncestorsAllowed(csp: string, targetUrl: string, appOrigin?: string): boolean {
+  const directive = csp
+    .split(";")
+    .map((d) => d.trim().toLowerCase())
+    .find((d) => d.startsWith("frame-ancestors"));
+  if (!directive) return true;
+  const value = directive.slice("frame-ancestors".length).trim();
+  if (!value || value.includes("'none'")) return false;
+  if (value.includes("*")) return true;
+  if (!appOrigin) return false;
+  const sources = value.split(/\s+/);
+  try {
+    // 目标与链接同源时 'self' 视为允许
+    const target = new URL(targetUrl);
+    const app = new URL(appOrigin);
+    if (target.host === app.host) return true;
+  } catch {
+    return false;
+  }
+  const appHost = appOrigin.replace(/^https?:\/\//, "").toLowerCase();
+  return sources.some((src) => src.replace(/^https?:\/\//, "") === appHost);
+}
+
+export const checkLinkEmbeddableFn = createServerFn({ method: "POST" })
+  .validator(checkSchema)
+  .handler(async ({ data }) => {
+    const request = getRequest();
+    await requireAuth(request);
+
+    if (!isPublicHttpUrl(data.url)) {
+      return { embeddable: false as const, reason: "invalid" as const };
+    }
+    try {
+      const res = await fetch(data.url, {
+        method: "GET",
+        redirect: "follow",
+        headers: {
+          "user-agent": "Mozilla/5.0 (compatible; AllBlueEmbedCheck/1.0)",
+          accept: "text/html,application/xhtml+xml,*/*;q=0.8",
+        },
+        signal: AbortSignal.timeout(8000),
+      });
+      res.body?.cancel().catch(() => {});
+      const contentType = (res.headers.get("content-type") || "").toLowerCase();
+      const isHtml = !contentType || contentType.includes("text/html") || contentType.includes("xhtml");
+      const isPdf = contentType.includes("application/pdf");
+      if (!isHtml && !isPdf) {
+        return { embeddable: false as const, reason: "not-html" as const };
+      }
+      const xfo = (res.headers.get("x-frame-options") || "").toLowerCase();
+      if (xfo.includes("deny") || xfo.includes("sameorigin")) {
+        return { embeddable: false as const, reason: "blocked" as const };
+      }
+      const csp = res.headers.get("content-security-policy") || "";
+      if (csp && !isFrameAncestorsAllowed(csp, data.url, data.origin)) {
+        return { embeddable: false as const, reason: "blocked" as const };
+      }
+      return { embeddable: true as const };
+    } catch {
+      // 预检失败（超时/网络异常）不阻塞，交给 iframe 实际尝试
+      return { embeddable: true as const };
+    }
+  });

package/src/server/serverFns/story/story-assoc.ts

@@ -20,6 +20,70 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { prisma } from "@allbluecn/database";
 import { requireAuth } from "@/server/auth-helpers";
+import { ACTIVITY_SELECT, toActivityItem } from "./types";
+import { buildKbScopeWhere } from "./kb-scope";
+import {
+  GENERAL_GROUPS,
+  EXTERNAL_ID_PREFIX,
+  parseExternalDocId,
+  externalDocId,
+  type GeneralGroup,
+} from "./kb-general";
+
+// ---------- 通用知识库（法律法规/行业合规/词典词条/网站收藏/周报月报） ----------
+
+const GENERAL_GROUP_TABLES = {
+  legal: "legalRegulation",
+  compliance: "industryCompliance",
+  dictionary: "dictionaryTerm",
+  bookmark: "websiteBookmark",
+} as const satisfies Record<Exclude<GeneralGroup, "summary">, string>;
+
+const GENERAL_ROW_SELECT = { id: true, title: true } as const;
+
+async function searchGeneralGroupDocs(
+  group: GeneralGroup,
+  userId: string,
+  query: string,
+): Promise<SearchDocRow[]> {
+  const table = GENERAL_GROUP_TABLES[group as Exclude<GeneralGroup, "summary">];
+  if (!table) return []; // summary（周报月报）暂无实体表，无可关联内容
+
+  const favoriteIds = await prisma.articleFavorite
+    .findMany({
+      where: { entityType: group, userId },
+      select: { entityId: true },
+    })
+    .then((r) => r.map((f) => f.entityId));
+
+  const rows = await (
+    prisma[table] as unknown as {
+      findMany: (args: Record<string, unknown>) => Promise<Array<{ id: string; title: string }>>;
+    }
+  ).findMany({
+    where: {
+      isDeleted: false,
+      ...(query ? { title: { contains: query, mode: "insensitive" as const } } : {}),
+      OR: [
+        { userId },
+        ...(favoriteIds.length > 0 ? [{ id: { in: favoriteIds } }] : []),
+      ],
+    },
+    select: GENERAL_ROW_SELECT,
+    orderBy: { updatedAt: "desc" as const },
+    take: 100,
+  });
+
+  return rows.map((row) => ({
+    id: externalDocId(group, row.id),
+    title: row.title,
+    kbId: `${EXTERNAL_ID_PREFIX}${group}`,
+    kbName: group,
+    kbIcon: "book",
+    docIcon: null,
+    parentId: null,
+  }));
+}
 
 export const linkPrdFn = createServerFn({ method: "POST" })
   .validator(z.object({ storyId: z.string(), prdId: z.string() }))
@@ -103,27 +167,247 @@ export const searchPrdsFn = createServerFn({ method: "GET" })
     }));
   });
 
-export const linkDocFn = createServerFn({ method: "POST" })
-  .validator(z.object({ storyId: z.string(), docId: z.string() }))
+const DOC_SELECT = {
+  id: true,
+  title: true,
+  parentId: true,
+  icon: true,
+  type: true,
+  kb: { select: { id: true, name: true, icon: true } },
+} as const;
+
+/** 搜索/列表行 = DocBrief + 树形父引用（KnowledgeSelectDialog 树形渲染用） */
+export type SearchDocRow = {
+  id: string;
+  title: string;
+  kbId: string;
+  kbName: string;
+  kbIcon: string;
+  docIcon: string | null;
+  parentId: string | null;
+};
+
+function toDocBrief(doc: {
+  id: string;
+  title: string;
+  parentId: string | null;
+  icon: string | null;
+  kb: { id: string; name: string; icon: string };
+}): SearchDocRow {
+  return {
+    id: doc.id,
+    title: doc.title,
+    kbId: doc.kb.id,
+    kbName: doc.kb.name,
+    kbIcon: doc.kb.icon,
+    docIcon: doc.icon,
+    parentId: doc.parentId,
+  };
+}
+
+/** 查需求 → 组装 scope 输入（内部复用） */
+async function resolveStoryScope(storyId: string, userId: string) {
+  const story = await prisma.story.findUnique({
+    where: { id: storyId },
+    select: { project: { select: { id: true, displayId: true } } },
+  });
+  if (!story) throw new Error("需求不存在");
+  return buildKbScopeWhere({
+    projectId: story.project.id,
+    projectDisplayId: story.project.displayId,
+    userId,
+  });
+}
+
+export const listStoryAvailableKbsFn = createServerFn({ method: "GET" })
+  .validator(z.object({ storyId: z.string() }))
   .handler(async ({ data }) => {
     const request = getRequest();
     const session = await requireAuth(request);
-
-    const existing = await prisma.storyDocLink.findUnique({
-      where: { storyId_docId: { storyId: data.storyId, docId: data.docId } },
+    const scope = await resolveStoryScope(data.storyId, session.user!.id!);
+    const kbs = await prisma.knowledgeBase.findMany({
+      where: { AND: [scope, { isDeleted: false }] },
+      select: { id: true, name: true, icon: true, visibility: true },
+      orderBy: { name: "asc" },
     });
-    if (existing) {
-      throw new Error("已关联此文档");
+    return kbs;
+  });
+
+export const searchKbDocsFn = createServerFn({ method: "GET" })
+  .validator(
+    z.object({
+      storyId: z.string(),
+      kbId: z.string().optional(),
+      generalGroup: z.enum(GENERAL_GROUPS).optional(),
+      query: z.string().default(""),
+      cursor: z.string().optional(),
+    }),
+  )
+  .handler(async ({ data }) => {
+    const request = getRequest();
+    const session = await requireAuth(request);
+    const scope = await resolveStoryScope(data.storyId, session.user!.id!);
+
+    if (data.generalGroup) {
+      // 态③：通用知识库分组 → 平铺列表（周报月报暂无实体内容）
+      const items = await searchGeneralGroupDocs(data.generalGroup, session.user!.id!, data.query);
+      return { items, nextCursor: null };
     }
 
-    const link = await prisma.storyDocLink.create({
-      data: {
-        storyId: data.storyId,
-        docId: data.docId,
+    if (data.kbId) {
+      // 态①：指定 KB（须在可用范围内）→ 全量树
+      const kb = await prisma.knowledgeBase.findFirst({
+        where: { AND: [scope, { id: data.kbId, isDeleted: false }] },
+        select: { id: true },
+      });
+      if (!kb) throw new Error("知识库不在可用范围内");
+      const docs = await prisma.knowledgeDocument.findMany({
+        where: {
+          kbId: data.kbId,
+          isDeleted: false,
+          ...(data.query ? { title: { contains: data.query, mode: "insensitive" as const } } : {}),
+        },
+        select: DOC_SELECT,
+        orderBy: [{ sortOrder: "asc" }, { createdAt: "asc" }],
+        take: 500,
+      });
+      return { items: docs.map(toDocBrief), nextCursor: null };
+    }
+
+    // 态②：全部可用 KB → 平铺分页
+    const rows = await prisma.knowledgeDocument.findMany({
+      where: {
+        isDeleted: false,
+        kb: { isDeleted: false, AND: [scope] },
+        ...(data.query ? { title: { contains: data.query, mode: "insensitive" as const } } : {}),
       },
+      select: { ...DOC_SELECT, createdAt: true },
+      orderBy: { createdAt: "desc" },
+      take: 21,
+      ...(data.cursor ? { cursor: { id: data.cursor }, skip: 1 } : {}),
     });
+    const hasMore = rows.length > 20;
+    const items = (hasMore ? rows.slice(0, 20) : rows).map(toDocBrief);
+    return {
+      items,
+      nextCursor: hasMore ? rows[rows.length - 1].id : null,
+    };
+  });
 
-    return link;
+export const linkDocsFn = createServerFn({ method: "POST" })
+  .validator(z.object({ storyId: z.string(), docIds: z.array(z.string()).min(1) }))
+  .handler(async ({ data }) => {
+    const request = getRequest();
+    const session = await requireAuth(request);
+    const userId = session.user!.id!;
+    const scope = await resolveStoryScope(data.storyId, userId);
+
+    const failed: Array<{ docId: string; reason: "outOfScope" }> = [];
+
+    // 通用知识库条目（ext:<group>:<externalId>）
+    const extIds = data.docIds.filter((id) => id.startsWith(EXTERNAL_ID_PREFIX));
+    const realIds = data.docIds.filter((id) => !id.startsWith(EXTERNAL_ID_PREFIX));
+
+    const extParsed = extIds
+      .map((id) => ({ id, parsed: parseExternalDocId(id) }))
+      .filter((x): x is { id: string; parsed: { group: GeneralGroup; externalId: string } } => x.parsed !== null);
+    for (const x of extIds) {
+      if (!extParsed.some((p) => p.id === x)) failed.push({ docId: x, reason: "outOfScope" });
+    }
+
+    // 校验外部条目真实存在（按分组表批量查询）
+    const existingExt = new Set(
+      await prisma.storyExternalLink
+        .findMany({ where: { storyId: data.storyId }, select: { group: true, externalId: true } })
+        .then((rows) => rows.map((r) => externalDocId(r.group as GeneralGroup, r.externalId))),
+    );
+    const extToLink: Array<{ group: GeneralGroup; externalId: string }> = [];
+    for (const { id, parsed } of extParsed) {
+      if (existingExt.has(id)) continue; // skipped
+      const table = GENERAL_GROUP_TABLES[parsed.group as Exclude<GeneralGroup, "summary">];
+      if (!table) {
+        failed.push({ docId: id, reason: "outOfScope" });
+        continue;
+      }
+      const found = await (
+        prisma[table] as unknown as {
+          findFirst: (args: Record<string, unknown>) => Promise<{ id: string } | null>;
+        }
+      ).findFirst({ where: { id: parsed.externalId, isDeleted: false }, select: { id: true } });
+      if (found) extToLink.push(parsed);
+      else failed.push({ docId: id, reason: "outOfScope" });
+    }
+    if (extToLink.length > 0) {
+      await prisma.storyExternalLink.createMany({
+        data: extToLink.map(({ group, externalId }) => ({ storyId: data.storyId, group, externalId })),
+        skipDuplicates: true,
+      });
+    }
+    const extSkipped = extParsed
+      .map((p) => p.id)
+      .filter((id) => !extToLink.some((x) => externalDocId(x.group, x.externalId) === id));
+
+    // 知识库文档（原有逻辑）
+    const docs = await prisma.knowledgeDocument.findMany({
+      where: { id: { in: realIds }, isDeleted: false },
+      select: { id: true, kbId: true },
+    });
+    const validKbs = await prisma.knowledgeBase.findMany({
+      where: { AND: [scope, { isDeleted: false }] },
+      select: { id: true },
+    });
+    const validKbIds = new Set(validKbs.map((k) => k.id));
+
+    for (const d of docs) {
+      if (!validKbIds.has(d.kbId)) failed.push({ docId: d.id, reason: "outOfScope" });
+    }
+    // 请求中不存在的真实文档 id 视为越界
+    const foundIds = new Set(docs.map((d) => d.id));
+    for (const id of realIds) {
+      if (!foundIds.has(id)) failed.push({ docId: id, reason: "outOfScope" });
+    }
+    const candidateIds = docs.filter((d) => validKbIds.has(d.kbId)).map((d) => d.id);
+
+    const existing = await prisma.storyDocLink.findMany({
+      where: { storyId: data.storyId, docId: { in: candidateIds } },
+      select: { docId: true },
+    });
+    const existingIds = new Set(existing.map((l) => l.docId));
+    const toLink = candidateIds.filter((id) => !existingIds.has(id));
+    const skipped = [
+      ...candidateIds.filter((id) => existingIds.has(id)),
+      ...extSkipped,
+    ];
+
+    if (toLink.length > 0) {
+      await prisma.storyDocLink.createMany({
+        data: toLink.map((docId) => ({ storyId: data.storyId, docId })),
+        skipDuplicates: true,
+      });
+    }
+
+    // 活动记录：成功关联知识库文档时记一条（newValue 为文档数量）
+    const linkedCount = toLink.length + extToLink.length;
+    let activity: ReturnType<typeof toActivityItem> | null = null;
+    if (linkedCount > 0) {
+      const created = await prisma.storyActivity.create({
+        data: {
+          storyId: data.storyId,
+          userId,
+          action: "kb_linked",
+          newValue: String(linkedCount),
+        },
+        select: ACTIVITY_SELECT,
+      });
+      activity = toActivityItem(created);
+    }
+
+    return {
+      linked: [...toLink, ...extToLink.map(({ group, externalId }) => externalDocId(group, externalId))],
+      skipped,
+      failed,
+      activity,
+    };
   });
 
 export const unlinkDocFn = createServerFn({ method: "POST" })
@@ -131,12 +415,17 @@ export const unlinkDocFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const request = getRequest();
     const session = await requireAuth(request);
-
-    const link = await prisma.storyDocLink.delete({
+    const parsed = parseExternalDocId(data.docId);
+    if (parsed) {
+      await prisma.storyExternalLink.deleteMany({
+        where: { storyId: data.storyId, group: parsed.group, externalId: parsed.externalId },
+      });
+      return { ok: true };
+    }
+    await prisma.storyDocLink.delete({
       where: { storyId_docId: { storyId: data.storyId, docId: data.docId } },
     });
-
-    return link;
+    return { ok: true };
   });
 
 export const getLinkedDocsFn = createServerFn({ method: "GET" })
@@ -144,43 +433,43 @@ export const getLinkedDocsFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const request = getRequest();
     const session = await requireAuth(request);
-
     const links = await prisma.storyDocLink.findMany({
       where: { storyId: data.storyId },
-      include: {
-        doc: {
-          select: {
-            id: true,
-            title: true,
-          },
-        },
-      },
+      include: { doc: { select: DOC_SELECT } },
     });
+    const docRows = links.map((link) => toDocBrief(link.doc));
 
-    return links.map((link) => ({
-      id: link.doc.id,
-      title: link.doc.title,
-    }));
-  });
-
-export const searchDocsFn = createServerFn({ method: "GET" })
-  .validator(z.object({ query: z.string() }))
-  .handler(async ({ data }) => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-
-    const docs = await prisma.knowledgeDocument.findMany({
-      where: {
-        title: {
-          contains: data.query,
-          mode: "insensitive",
-        },
-      },
-      take: 10,
+    const extLinks = await prisma.storyExternalLink.findMany({
+      where: { storyId: data.storyId },
+      select: { group: true, externalId: true },
     });
-
-    return docs.map((doc) => ({
-      id: doc.id,
-      title: doc.title,
-    }));
+    const byGroup = new Map<GeneralGroup, string[]>();
+    for (const l of extLinks) {
+      const group = l.group as GeneralGroup;
+      const arr = byGroup.get(group) ?? [];
+      arr.push(l.externalId);
+      byGroup.set(group, arr);
+    }
+    const extRows: SearchDocRow[] = [];
+    for (const [group, ids] of byGroup) {
+      const table = GENERAL_GROUP_TABLES[group as Exclude<GeneralGroup, "summary">];
+      if (!table) continue;
+      const rows = await (
+        prisma[table] as unknown as {
+          findMany: (args: Record<string, unknown>) => Promise<Array<{ id: string; title: string }>>;
+        }
+      ).findMany({ where: { id: { in: ids } }, select: GENERAL_ROW_SELECT });
+      for (const row of rows) {
+        extRows.push({
+          id: externalDocId(group, row.id),
+          title: row.title,
+          kbId: `${EXTERNAL_ID_PREFIX}${group}`,
+          kbName: group,
+          kbIcon: "book",
+          docIcon: null,
+          parentId: null,
+        });
+      }
+    }
+    return [...docRows, ...extRows];
   });

package/src/server/serverFns/story/story-attachments.ts

@@ -21,36 +21,6 @@ import { z } from "zod";
 import { prisma } from "@allbluecn/database";
 import { requireAuth } from "@/server/auth-helpers";
 
-export const uploadAttachmentFn = createServerFn({ method: "POST" })
-  .handler(async () => {
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const formData = await request.formData();
-
-    const storyId = formData.get("storyId") as string;
-    const file = formData.get("file") as File;
-
-    if (!storyId || !file) {
-      throw new Error("缺少 storyId 或 file");
-    }
-
-    const storageUrl = `/mock-storage/${Date.now()}-${file.name}`;
-    const fileSize = BigInt(file.size);
-    const mimeType = file.type;
-
-    const attachment = await prisma.storyAttachment.create({
-      data: {
-        storyId,
-        fileName: file.name,
-        fileSize,
-        mimeType,
-        storageUrl,
-      },
-    });
-
-    return attachment;
-  });
-
 export const removeAttachmentFn = createServerFn({ method: "POST" })
   .validator(z.object({ attachmentId: z.string() }))
   .handler(async ({ data }) => {
@@ -73,6 +43,14 @@ export const getAttachmentsFn = createServerFn({ method: "GET" })
     const attachments = await prisma.storyAttachment.findMany({
       where: { storyId: data.storyId },
       orderBy: { createdAt: "desc" },
+      select: {
+        id: true,
+        fileName: true,
+        fileSize: true,
+        mimeType: true,
+        description: true,
+        fileHash: true,
+      },
     });
 
     return attachments.map((att) => ({
@@ -80,18 +58,9 @@ export const getAttachmentsFn = createServerFn({ method: "GET" })
       fileName: att.fileName,
       fileSize: Number(att.fileSize),
       mimeType: att.mimeType,
-      storageUrl: att.storageUrl,
+      description: att.description,
+      fileHash: att.fileHash,
+      // 读取入口统一为内容路由（历史 mock 行无文件体，预览会 404）
+      storageUrl: `/api/attachments/${att.id}/content`,
     }));
   });
-
-export const mockCloudStorageFn = createServerFn({ method: "POST" })
-  .validator(z.object({ file: z.any() }))
-  .handler(async ({ data }) => {
-    const { file } = data;
-    const mockUrl = `/mock-storage/${Date.now()}-${file.name}`;
-
-    return {
-      url: mockUrl,
-      provider: "mock",
-    };
-  });