@allbluecn/web-app 0.5.0 → 0.6.0

package/src/server/serverFns/story/index.ts

@@ -21,6 +21,8 @@ export {
   createLabelFn,
 } from "./story-crud/labels";
 
+export { suggestStoryLabelsFn } from "./story-crud/label-suggest";
+
 export {
   listActivitiesFn,
 } from "./story-crud/activities";
@@ -82,6 +84,7 @@ export {
 
 export {
   addDependenciesFn,
+  updateDependencyFn,
   removeDependencyFn,
   getDependenciesFn,
 } from "./story-dependencies";
@@ -93,11 +96,11 @@ export {
   getLinksFn,
 } from "./story-links";
 
+export { checkLinkEmbeddableFn } from "./link-preview";
+
 export {
-  uploadAttachmentFn,
   removeAttachmentFn,
   getAttachmentsFn,
-  mockCloudStorageFn,
 } from "./story-attachments";
 
 export {
@@ -105,10 +108,12 @@ export {
   unlinkPrdFn,
   getLinkedPrdsFn,
   searchPrdsFn,
-  linkDocFn,
+  listStoryAvailableKbsFn,
+  searchKbDocsFn,
+  linkDocsFn,
   unlinkDocFn,
   getLinkedDocsFn,
-  searchDocsFn,
+  type SearchDocRow,
 } from "./story-assoc";
 
 export {

package/src/server/serverFns/story/kb-general.ts

@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 通用知识库（法律法规/行业合规/词典词条/网站收藏/周报月报）的纯工具定义。
+// 独立成文件以保持 story-assoc.ts（serverFn 模块）纯净：客户端可安全导入。
+
+export const GENERAL_GROUPS = ["legal", "compliance", "dictionary", "bookmark", "summary"] as const;
+export type GeneralGroup = (typeof GENERAL_GROUPS)[number];
+
+export const EXTERNAL_ID_PREFIX = "ext:";
+
+export function parseExternalDocId(id: string): { group: GeneralGroup; externalId: string } | null {
+  if (!id.startsWith(EXTERNAL_ID_PREFIX)) return null;
+  const rest = id.slice(EXTERNAL_ID_PREFIX.length);
+  const idx = rest.indexOf(":");
+  if (idx <= 0) return null;
+  const group = rest.slice(0, idx);
+  const externalId = rest.slice(idx + 1);
+  if (!(GENERAL_GROUPS as readonly string[]).includes(group) || !externalId) return null;
+  return { group: group as GeneralGroup, externalId };
+}
+
+export function externalDocId(group: GeneralGroup, externalId: string): string {
+  return `${EXTERNAL_ID_PREFIX}${group}:${externalId}`;
+}

package/src/server/serverFns/story/kb-scope.ts

@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import type { Prisma } from "@allbluecn/database";
+import { BUILTIN_INDEPENDENT_DISPLAY_ID } from "@/lib/builtin-project";
+
+export interface KbScopeInput {
+  projectId: string;
+  projectDisplayId: string | null;
+  userId: string;
+}
+
+/** 是否内置独立需求项目（displayId=STORY） */
+export function isIndependentProject(displayId: string | null): boolean {
+  return displayId === BUILTIN_INDEPENDENT_DISPLAY_ID;
+}
+
+/**
+ * 需求可选知识库范围（Prisma where，用于 KnowledgeBase 查询）：
+ * - 普通项目：visibility=general（跨用户）∪ 项目关联 KB（关联仅允许 team）
+ * - 独立需求（STORY）：自己的全部 ∪ 他人 team/general
+ */
+export function buildKbScopeWhere(input: KbScopeInput): Prisma.KnowledgeBaseWhereInput {
+  if (isIndependentProject(input.projectDisplayId)) {
+    return {
+      OR: [
+        { userId: input.userId },
+        { visibility: { in: ["team", "general"] } },
+      ],
+    };
+  }
+  return {
+    OR: [
+      { visibility: "general" },
+      { projectLinks: { some: { projectId: input.projectId } } },
+    ],
+  };
+}

package/src/server/serverFns/story/link-preview.ts

@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from "@tanstack/react-start";
+import { getRequest } from "@tanstack/react-start/server";
+import { z } from "zod";
+import { requireAuth } from "@/server/auth-helpers";
+
+const checkSchema = z.object({
+  url: z.string().url(),
+  origin: z.string().url().optional(),
+});
+
+/** SSRF 防护：仅允许公网 http/https 地址（拒绝内网 IP、localhost、本地域名） */
+function isPublicHttpUrl(raw: string): boolean {
+  let u: URL;
+  try {
+    u = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") return false;
+  const host = u.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (host === "localhost" || host === "::1" || host === "::" || host.endsWith(".local") || host.endsWith(".internal")) {
+    return false;
+  }
+  const ipv4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (ipv4) {
+    const [a, b] = [Number(ipv4[1]), Number(ipv4[2])];
+    if (a === 0 || a === 10 || a === 127 || a >= 224) return false;
+    if (a === 169 && b === 254) return false;
+    if (a === 172 && b >= 16 && b <= 31) return false;
+    if (a === 192 && b === 168) return false;
+  }
+  return true;
+}
+
+/** 解析 CSP frame-ancestors 指令，判断目标页面是否允许被应用嵌入 */
+function isFrameAncestorsAllowed(csp: string, targetUrl: string, appOrigin?: string): boolean {
+  const directive = csp
+    .split(";")
+    .map((d) => d.trim().toLowerCase())
+    .find((d) => d.startsWith("frame-ancestors"));
+  if (!directive) return true;
+  const value = directive.slice("frame-ancestors".length).trim();
+  if (!value || value.includes("'none'")) return false;
+  if (value.includes("*")) return true;
+  if (!appOrigin) return false;
+  const sources = value.split(/\s+/);
+  try {
+    // 目标与链接同源时 'self' 视为允许
+    const target = new URL(targetUrl);
+    const app = new URL(appOrigin);
+    if (target.host === app.host) return true;
+  } catch {
+    return false;
+  }
+  const appHost = appOrigin.replace(/^https?:\/\//, "").toLowerCase();
+  return sources.some((src) => src.replace(/^https?:\/\//, "") === appHost);
+}
+
+export const checkLinkEmbeddableFn = createServerFn({ method: "POST" })
+  .validator(checkSchema)
+  .handler(async ({ data }) => {
+    const request = getRequest();
+    await requireAuth(request);
+
+    if (!isPublicHttpUrl(data.url)) {
+      return { embeddable: false as const, reason: "invalid" as const };
+    }
+    try {
+      const res = await fetch(data.url, {
+        method: "GET",
+        redirect: "follow",
+        headers: {
+          "user-agent": "Mozilla/5.0 (compatible; AllBlueEmbedCheck/1.0)",
+          accept: "text/html,application/xhtml+xml,*/*;q=0.8",
+        },
+        signal: AbortSignal.timeout(8000),
+      });
+      res.body?.cancel().catch(() => {});
+      const contentType = (res.headers.get("content-type") || "").toLowerCase();
+      const isHtml = !contentType || contentType.includes("text/html") || contentType.includes("xhtml");
+      const isPdf = contentType.includes("application/pdf");
+      if (!isHtml && !isPdf) {
+        return { embeddable: false as const, reason: "not-html" as const };
+      }
+      const xfo = (res.headers.get("x-frame-options") || "").toLowerCase();
+      if (xfo.includes("deny") || xfo.includes("sameorigin")) {
+        return { embeddable: false as const, reason: "blocked" as const };
+      }
+      const csp = res.headers.get("content-security-policy") || "";
+      if (csp && !isFrameAncestorsAllowed(csp, data.url, data.origin)) {
+        return { embeddable: false as const, reason: "blocked" as const };
+      }
+      return { embeddable: true as const };
+    } catch {
+      // 预检失败（超时/网络异常）不阻塞，交给 iframe 实际尝试
+      return { embeddable: true as const };
+    }
+  });