0.3.5 共享功能修复

2026-01-24 12:32:51 +08:00
parent 25923f308c
commit 3c3f407f4b
44 changed files with 3754 additions and 420 deletions
@@ -81,6 +81,8 @@ export async function GET(request: Request) {
        file_name: asset.file_name,
        mime_type: asset.mime_type,
        file_size: asset.file_size,
+        storage_id: (asset as any)?.storage_id ?? null,
+        updated_at: (asset as any)?.updated_at ?? null,
      },
    });
  }
@@ -94,6 +94,19 @@ export async function POST(request: Request) {
        return NextResponse.json({ error: 1 });
      }

+      // 只读权限：不允许通过 ONLYOFFICE 回调写回
+      try {
+        const perm = await client.query(api.documents.getPermissionForUser, {
+          userId,
+          id: String((asset as any).document_id || ""),
+        });
+        if (!perm || (perm as any).permission !== "edit") {
+          return NextResponse.json({ error: 1 });
+        }
+      } catch {
+        return NextResponse.json({ error: 1 });
+      }
+
      const downloadUrl = tryRewriteOnlyOfficeDownloadUrl(body.url);
      const upstream = await fetch(downloadUrl, { method: "GET", redirect: "follow" });
      if (!upstream.ok) {
@@ -0,0 +1,143 @@
+import { NextResponse } from "next/server";
+import crypto from "crypto";
+import { api } from "@/lib/convex/api";
+import { HttpError } from "@/lib/auth/authContext";
+import { getAuthedConvexClient } from "@/lib/convex/route";
+
+export const dynamic = "force-dynamic";
+
+const ONLYOFFICE_INTERNAL_URL = (process.env.ONLYOFFICE_INTERNAL_URL || "http://127.0.0.1:8081").replace(/\/+$/, "");
+
+const base64Url = (input: Buffer | string) =>
+  Buffer.from(input)
+    .toString("base64")
+    .replace(/=/g, "")
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_");
+
+const signHs256 = (payload: unknown, secret: string) => {
+  const header = { alg: "HS256", typ: "JWT" };
+  const headerPart = base64Url(JSON.stringify(header));
+  const payloadPart = base64Url(JSON.stringify(payload));
+  const signingInput = `${headerPart}.${payloadPart}`;
+  const signature = crypto.createHmac("sha256", secret).update(signingInput).digest();
+  return `${signingInput}.${base64Url(signature)}`;
+};
+
+const normalizeSecret = (raw: string) => {
+  const trimmed = String(raw || "").trim();
+  if (!trimmed) return "";
+  // 兼容用户把 .env 的值写成 "xxx" / 'xxx'
+  if (
+    (trimmed.startsWith("\"") && trimmed.endsWith("\"") && trimmed.length >= 2) ||
+    (trimmed.startsWith("'") && trimmed.endsWith("'") && trimmed.length >= 2)
+  ) {
+    return trimmed.slice(1, -1).trim();
+  }
+  return trimmed;
+};
+
+export async function POST(request: Request) {
+  let auth;
+  let client;
+  try {
+    const authed = await getAuthedConvexClient();
+    auth = authed.auth;
+    client = authed.client;
+  } catch (err) {
+    if (err instanceof HttpError) {
+      return NextResponse.json({ error: "未登录" }, { status: err.status });
+    }
+    return NextResponse.json({ error: "未登录" }, { status: 401 });
+  }
+
+  const { searchParams } = new URL(request.url);
+  const assetId = String(searchParams.get("assetId") || "").trim();
+  const key = String(searchParams.get("key") || "").trim();
+  if (!assetId) return NextResponse.json({ error: "缺少 assetId" }, { status: 400 });
+  if (!key) return NextResponse.json({ error: "缺少 key" }, { status: 400 });
+
+  const asset = await client.query(api.mediaAssets.getById, { userId: auth.userId, id: assetId });
+  if (!asset) {
+    return NextResponse.json({ error: "资源不存在" }, { status: 404 });
+  }
+
+  // 只读权限：不允许触发 forcesave（避免只读用户间接写回存储）
+  const docId = String((asset as any).document_id || "").trim();
+  if (!docId) {
+    return NextResponse.json({ error: "缺少 documentId" }, { status: 400 });
+  }
+  const doc = await client.query(api.documents.getMeta, { id: docId });
+  if (!doc || (doc as any).can_edit === false) {
+    return NextResponse.json({ error: "无权修改（只读共享的文件）" }, { status: 403 });
+  }
+
+  const payload = { c: "forcesave", key, userdata: `asset:${assetId}` };
+  const secret = normalizeSecret(process.env.ONLYOFFICE_JWT_SECRET || "");
+
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  const tryJson = async (res: Response) => (await res.json().catch(() => null)) as any;
+
+  try {
+    // 优先按文档推荐：使用 /command + token
+    if (secret) {
+      const token = signHs256(payload, secret);
+      const r = await fetch(`${ONLYOFFICE_INTERNAL_URL}/command`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ token }),
+      });
+      const j = await tryJson(r);
+      if (r.ok && Number(j?.error ?? 0) === 0) {
+        return NextResponse.json({ ok: true, via: "command", result: j });
+      }
+
+      // 兜底：部分环境可能暴露 /forcesave 直连接口
+      const r2 = await fetch(`${ONLYOFFICE_INTERNAL_URL}/forcesave`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(payload),
+      });
+      const j2 = await tryJson(r2);
+      if (r2.ok && Number(j2?.error ?? 0) === 0) {
+        return NextResponse.json({ ok: true, via: "forcesave", result: j2 });
+      }
+
+      return NextResponse.json(
+        { error: "触发 forcesave 失败", detail: { command: j, forcesave: j2 } },
+        { status: 502 },
+      );
+    }
+
+    // JWT 未启用：尝试 /forcesave 直连
+    const r = await fetch(`${ONLYOFFICE_INTERNAL_URL}/forcesave`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload),
+    });
+    const j = await tryJson(r);
+    if (r.ok && Number(j?.error ?? 0) === 0) {
+      return NextResponse.json({ ok: true, via: "forcesave", result: j });
+    }
+
+    // 最后兜底：部分部署可能仍接受不带 token 的 /command（不保证）
+    const r2 = await fetch(`${ONLYOFFICE_INTERNAL_URL}/command`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload),
+    });
+    const j2 = await tryJson(r2);
+    if (r2.ok && Number(j2?.error ?? 0) === 0) {
+      return NextResponse.json({ ok: true, via: "command_no_token", result: j2 });
+    }
+
+    return NextResponse.json(
+      { error: "触发 forcesave 失败", detail: { forcesave: j, command: j2 } },
+      { status: 502 },
+    );
+  } catch (error) {
+    console.error("[onlyoffice/forcesave] failed:", error);
+    return NextResponse.json({ error: "触发 forcesave 失败" }, { status: 502 });
+  }
+}
+
@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { isConvexEnabled } from "@/lib/convex/enabled";
 import { getAuthedConvexClient } from "@/lib/convex/route";
 import { api } from "@/lib/convex/api";
+import { HttpError } from "@/lib/auth/authContext";
 import type {
  DocumentSearchFilters,
  DocumentSearchRequest,
@@ -33,100 +34,389 @@ const TIME_FIELD_COLUMN = {
  created: "created_at",
 } as const;

-export async function POST(request: Request) {
-  if (!isConvexEnabled()) {
-    return NextResponse.json({ error: "当前仅支持 Convex 模式" }, { status: 501 });
-  }
+type RangeIso = { fromIso: string | null; toIso: string | null };

-  const { auth, client } = await getAuthedConvexClient();
-  const payload = (await request.json()) as DocumentSearchRequest;
-  const workspaceId = payload.workspaceId;
-
-  if (!workspaceId) {
-    return NextResponse.json({ error: "缺少 workspaceId" }, { status: 400 });
-  }
-
-  const filters: DocumentSearchFilters = {
-    ...DEFAULT_FILTERS,
-    ...payload.filters,
-  };
-
-  const limit = Math.min(payload.limit ?? 30, MAX_LIMIT);
-  const normalizedQuery = payload.query?.trim() ?? "";
-  const normalizedLower = normalizedQuery.toLowerCase();
-
-  const docs = await client.query(api.documents.listByWorkspace, { workspaceId });
-  const docMap = new Map(docs.map((d) => [d.id, d]));
-
-  const recentRows = await client.query(api.recents.listByWorkspace, {
-    userId: auth.userId,
-    workspaceId,
-    limit: 10,
-  });
-  const recent: DocumentSearchResult[] = recentRows
-    .map((r) => docMap.get(r.document_id))
-    .filter((row): row is (typeof docs)[number] => Boolean(row))
-    .map((row) => ({
-      id: row.id,
-      title: row.title ?? "无标题",
-      snippet: "",
-      updatedAt: row.updated_at ?? null,
-      createdAt: row.created_at ?? null,
-      matchField: "recent",
-      hasOcr: false,
-      publicPath: `/documents/${row.id}`,
-      score: 0,
-    }));
-
-  if (!normalizedQuery) {
-    const response: DocumentSearchResponse = { results: [], recent };
-    return NextResponse.json(response);
-  }
-
-  const timeRangeMs = TIME_RANGE_TO_MS[filters.timeRange];
-  const timeField = TIME_FIELD_COLUMN[filters.timeField];
-  const boundaryIso =
-    typeof timeRangeMs === "number"
-      ? new Date(Date.now() - timeRangeMs).toISOString()
-      : null;
-
-  const narrowed = [...docs]
-    .sort((a, b) => {
-      const ta = a.updated_at ?? a.created_at ?? "";
-      const tb = b.updated_at ?? b.created_at ?? "";
-      return tb.localeCompare(ta);
-    })
-    .filter((row) => {
-      if (filters.onlyCurrentPage && payload.documentId) {
-        if (row.id !== payload.documentId) return false;
-      }
-
-      if (boundaryIso) {
-        const ts = (row as any)?.[timeField] ?? null;
-        if (!ts || typeof ts !== "string") return false;
-        if (ts < boundaryIso) return false;
-      }
-
-      const title = (row.title ?? "无标题").toLowerCase();
-      if (filters.exact) {
-        return title === normalizedLower;
-      }
-      return title.includes(normalizedLower);
-    });
-
-  const results: DocumentSearchResult[] = narrowed.slice(0, limit).map((row) => ({
-    id: row.id,
-    title: row.title ?? "无标题",
-    snippet: buildSnippet(row.title ?? "", normalizedQuery),
-    updatedAt: row.updated_at ?? null,
-    createdAt: row.created_at ?? null,
-    matchField: "title",
-    hasOcr: false,
-    publicPath: `/documents/${row.id}`,
-    score: 2,
-  }));
-
-  const response: DocumentSearchResponse = { results, recent };
-  return NextResponse.json(response);
+function parseDateToIso(value: string | undefined): string | null {
+  const raw = String(value ?? "").trim();
+  if (!raw) return null;
+  const d = new Date(raw);
+  if (Number.isNaN(d.getTime())) return null;
+  return d.toISOString();
 }

+function resolveCustomRangeIso(filters: DocumentSearchFilters): RangeIso {
+  const fromIso = parseDateToIso(filters.customRange?.from);
+  const toIso = parseDateToIso(filters.customRange?.to);
+  return { fromIso, toIso };
+}
+
+type MindmapNode = { data?: { text?: unknown }; children?: unknown[] };
+
+function extractTextFromMindmapData(data: unknown, maxChars = 60000): string {
+  const out: string[] = [];
+  const pushText = (value: unknown) => {
+    const s = typeof value === "string" ? value : null;
+    if (!s) return;
+    const trimmed = s.replace(/\s+/g, " ").trim();
+    if (!trimmed) return;
+    out.push(trimmed);
+  };
+
+  const walk = (node: unknown) => {
+    if (out.join("\n").length >= maxChars) return;
+    if (!node || typeof node !== "object") return;
+    const n = node as MindmapNode;
+    pushText(n.data?.text);
+    if (Array.isArray(n.children)) {
+      for (const c of n.children) {
+        walk(c);
+        if (out.join("\n").length >= maxChars) return;
+      }
+    }
+  };
+
+  walk(data);
+  const joined = out.join("\n").trim();
+  return joined.length > maxChars ? `${joined.slice(0, maxChars)}…` : joined;
+}
+
+export async function POST(request: Request) {
+  try {
+    if (!isConvexEnabled()) {
+      return NextResponse.json({ error: "当前仅支持 Convex 模式" }, { status: 501 });
+    }
+
+    const { auth, client } = await getAuthedConvexClient();
+    const payload = (await request.json()) as DocumentSearchRequest;
+    const workspaceId = payload.workspaceId;
+
+    if (!workspaceId) {
+      return NextResponse.json({ error: "缺少 workspaceId" }, { status: 400 });
+    }
+
+    const filters: DocumentSearchFilters = {
+      ...DEFAULT_FILTERS,
+      ...payload.filters,
+    };
+
+    const limit = Math.min(payload.limit ?? 30, MAX_LIMIT);
+    const normalizedQuery = payload.query?.trim() ?? "";
+    const normalizedLower = normalizedQuery.toLowerCase();
+
+    const docs = await client.query(api.documents.listSearchDataByWorkspace, { workspaceId });
+    const docMap = new Map(docs.map((d) => [d.id, d]));
+
+    const recentRows = await client.query(api.recents.listByWorkspace, {
+      userId: auth.userId,
+      workspaceId,
+      limit: 10,
+    });
+    const recent: DocumentSearchResult[] = recentRows
+      .map((r) => docMap.get(r.document_id))
+      .filter((row): row is (typeof docs)[number] => Boolean(row))
+      .map((row) => ({
+        id: row.id,
+        title: row.title ?? "无标题",
+        snippet: "",
+        updatedAt: row.updated_at ?? null,
+        createdAt: row.created_at ?? null,
+        matchField: "recent",
+        hasOcr: false,
+        publicPath: `/documents/${row.id}`,
+        score: 0,
+      }));
+
+    if (!normalizedQuery) {
+      const response: DocumentSearchResponse = { results: [], recent };
+      return NextResponse.json(response);
+    }
+
+    const timeRangeMs = TIME_RANGE_TO_MS[filters.timeRange];
+    const timeField = TIME_FIELD_COLUMN[filters.timeField];
+    const boundaryIso =
+      typeof timeRangeMs === "number"
+        ? new Date(Date.now() - timeRangeMs).toISOString()
+        : null;
+    const { fromIso, toIso } = resolveCustomRangeIso(filters);
+
+    const eligibleDocs = [...docs]
+      .sort((a, b) => {
+        const ta = a.updated_at ?? a.created_at ?? "";
+        const tb = b.updated_at ?? b.created_at ?? "";
+        return tb.localeCompare(ta);
+      })
+      .filter((row) => {
+        if (filters.onlyCurrentPage && payload.documentId) {
+          if (row.id !== payload.documentId) return false;
+        }
+
+        if (boundaryIso) {
+          const ts = (row as any)?.[timeField] ?? null;
+          if (!ts || typeof ts !== "string") return false;
+          if (ts < boundaryIso) return false;
+        }
+
+        if (fromIso || toIso) {
+          const ts = (row as any)?.[timeField] ?? null;
+          if (!ts || typeof ts !== "string") return false;
+          if (fromIso && ts < fromIso) return false;
+          if (toIso && ts > toIso) return false;
+        }
+
+        return true;
+      });
+
+    const eligibleDocIds = new Set(eligibleDocs.map((d) => d.id));
+
+    type MatchInfo = {
+      score: number;
+      matchField: "title" | "content";
+      snippet: string;
+      hasOcr: boolean;
+    };
+
+    const matches = new Map<string, MatchInfo>();
+
+    const upsertMatch = (docId: string, patch: Partial<MatchInfo>) => {
+      const prev = matches.get(docId);
+      if (!prev) {
+        const score = typeof patch.score === "number" ? patch.score : 0;
+        const matchField = patch.matchField ?? "content";
+        const snippet = patch.snippet ?? "暂无正文内容";
+        const hasOcr = Boolean(patch.hasOcr);
+        matches.set(docId, { score, matchField, snippet, hasOcr });
+        return;
+      }
+
+      const next: MatchInfo = {
+        score: typeof patch.score === "number" ? Math.max(prev.score, patch.score) : prev.score,
+        matchField: patch.matchField ?? prev.matchField,
+        snippet: patch.snippet ?? prev.snippet,
+        hasOcr: prev.hasOcr || Boolean(patch.hasOcr),
+      };
+
+      // 若现有是标题匹配，不用较低分覆盖文案。
+      if (prev.matchField === "title" && next.matchField !== "title") {
+        next.matchField = "title";
+        next.snippet = prev.snippet;
+      }
+
+      // 若新分数更高，则用新片段（除标题外）
+      if (typeof patch.score === "number" && patch.score > prev.score && prev.matchField !== "title") {
+        next.snippet = patch.snippet ?? next.snippet;
+        next.matchField = patch.matchField ?? next.matchField;
+      }
+
+      matches.set(docId, next);
+    };
+
+    for (const row of eligibleDocs) {
+      const title = (row.title ?? "无标题").trim() || "无标题";
+      const titleLower = title.toLowerCase();
+      const hitTitle = filters.exact ? titleLower === normalizedLower : titleLower.includes(normalizedLower);
+      if (hitTitle) {
+        upsertMatch(row.id, {
+          score: 3,
+          matchField: "title",
+          snippet: buildSnippet(title, normalizedQuery),
+        });
+      }
+
+      if (filters.titleOnly) continue;
+
+      const rawText = String(row.raw_text ?? "").trim();
+      if (rawText) {
+        const hitContent = rawText.toLowerCase().includes(normalizedLower);
+        if (hitContent) {
+          upsertMatch(row.id, {
+            score: 2,
+            matchField: "content",
+            snippet: buildSnippet(rawText, normalizedQuery),
+          });
+        }
+      }
+    }
+
+    if (!filters.titleOnly) {
+      // 思维导图（默认纳入“正文”搜索）
+      const mindmaps = await client
+        .query(api.mindmaps.listByWorkspace, { workspaceId, includeDeleted: false })
+        .catch(() => []);
+      for (const m of mindmaps) {
+        const docId = String(m.document_id ?? "").trim();
+        if (!docId || !eligibleDocIds.has(docId)) continue;
+        if (!docMap.has(docId)) continue;
+
+        const text = extractTextFromMindmapData(m.data ?? null);
+        if (!text) continue;
+        if (!text.toLowerCase().includes(normalizedLower)) continue;
+
+        upsertMatch(docId, {
+          score: 1.6,
+          matchField: "content",
+          snippet: buildSnippet(`思维导图：${text}`, normalizedQuery),
+        });
+      }
+
+      // Luckysheet 在线表格（标题 + 行内容）
+      const [tables, tableRows] = await Promise.all([
+        client
+          .query(api.tables.listByWorkspaceForSearch, {
+            userId: auth.userId,
+            workspaceId,
+            includeArchived: false,
+            limit: 3000,
+          })
+          .catch(() => []),
+        client
+          .query(api.tables.listRowsByWorkspaceForSearch, {
+            userId: auth.userId,
+            workspaceId,
+            limit: 8000,
+          })
+          .catch(() => []),
+      ]);
+
+      const tableTitleById = new Map<string, string>();
+      for (const t of tables) {
+        if (!eligibleDocIds.has(t.document_id)) continue;
+        tableTitleById.set(t.id, String(t.title ?? "").trim() || "未命名表格");
+
+        const hitTableTitle = String(t.title ?? "").toLowerCase().includes(normalizedLower);
+        if (hitTableTitle && docMap.has(t.document_id)) {
+          upsertMatch(t.document_id, {
+            score: 1.5,
+            matchField: "content",
+            snippet: buildSnippet(`表格：${t.title}`, normalizedQuery),
+          });
+        }
+      }
+
+      for (const r of tableRows) {
+        const docId = String(r.document_id ?? "").trim();
+        if (!docId || !eligibleDocIds.has(docId)) continue;
+        if (!docMap.has(docId)) continue;
+        const rowHash = String(r.row_hash ?? "").trim();
+        if (!rowHash) continue;
+        if (!rowHash.toLowerCase().includes(normalizedLower)) continue;
+
+        const tableTitle = tableTitleById.get(String(r.table_id ?? "").trim()) ?? "未命名表格";
+        upsertMatch(docId, {
+          score: 1.4,
+          matchField: "content",
+          snippet: buildSnippet(`表格：${tableTitle}\n${rowHash}`, normalizedQuery),
+        });
+      }
+
+      // 附件/图片：默认搜索文件名；勾选“搜索附件内容”后再纳入 OCR/解析文本。
+      const assets = await client
+        .query(api.mediaAssets.listSearchDataByWorkspace, {
+          userId: auth.userId,
+          workspaceId,
+          includeDeleted: false,
+          limit: 5000,
+        })
+        .catch(() => []);
+
+      const toEnqueueExtract: { id: string; mime: string | null; name: string | null; status: string | null; type: string | null }[] = [];
+
+      for (const a of assets) {
+        const docId = String(a.document_id ?? "").trim();
+        if (!docId || !eligibleDocIds.has(docId)) continue;
+        if (!docMap.has(docId)) continue;
+
+        const fileName = String(a.file_name ?? "").trim();
+        if (fileName && fileName.toLowerCase().includes(normalizedLower)) {
+          upsertMatch(docId, {
+            score: 1.2,
+            matchField: "content",
+            snippet: buildSnippet(`附件：${fileName}`, normalizedQuery),
+          });
+        }
+
+        if (!filters.includeOcr) continue;
+
+        // 说明：勾选“搜索附件内容”时，若附件尚未生成 ocr_text，则后台排队解析（避免用户长期搜不到）。
+        const ocrTextValue = String(a.ocr_text ?? "").trim();
+        if (!ocrTextValue) {
+          const assetType = String((a as any).asset_type ?? "").trim() || null;
+          const mimeType = String((a as any).mime_type ?? "").toLowerCase().trim() || null;
+          const ocrStatus = String((a as any).ocr_status ?? "").trim() || null;
+          const nameLower = String(a.file_name ?? "").toLowerCase().trim() || null;
+
+          const supported =
+            assetType === "file" &&
+            (mimeType === "application/pdf" ||
+              mimeType === "application/vnd.openxmlformats-officedocument.wordprocessingml.document" ||
+              mimeType === "application/vnd.openxmlformats-officedocument.presentationml.presentation" ||
+              mimeType === "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" ||
+              (nameLower ? [".pdf", ".docx", ".pptx", ".xlsx"].some((ext) => nameLower.endsWith(ext)) : false));
+
+          const busy = ocrStatus === "queued" || ocrStatus === "running";
+          if (supported && !busy) {
+            toEnqueueExtract.push({ id: a.id, mime: mimeType, name: a.file_name ?? null, status: ocrStatus, type: assetType });
+          }
+          continue;
+        }
+
+        if (!ocrTextValue.toLowerCase().includes(normalizedLower)) continue;
+
+        upsertMatch(docId, {
+          score: 1.7,
+          matchField: "content",
+          snippet: buildSnippet(`附件：${fileName || a.id}\n${ocrTextValue}`, normalizedQuery),
+          hasOcr: true,
+        });
+      }
+
+      if (toEnqueueExtract.length > 0) {
+        // 说明：限制每次搜索触发的解析数量，避免请求变慢；剩余附件可继续通过下一次搜索逐步排队。
+        await Promise.all(
+          toEnqueueExtract
+            .slice(0, 3)
+            .map((item) =>
+              client.mutation(api.mediaAssets.enqueueExtractText, { userId: auth.userId, id: item.id }).catch(() => null),
+            ),
+        );
+      }
+    }
+
+    const results: DocumentSearchResult[] = [];
+    for (const [docId, match] of matches.entries()) {
+      const row = docMap.get(docId);
+      if (!row) continue;
+      results.push({
+        id: row.id,
+        title: row.title ?? "无标题",
+        snippet: match.snippet,
+        updatedAt: row.updated_at ?? null,
+        createdAt: row.created_at ?? null,
+        matchField: match.matchField,
+        hasOcr: match.hasOcr,
+        publicPath: `/documents/${row.id}`,
+        score: match.score,
+      });
+    }
+
+    results.sort((a, b) => {
+      if (b.score !== a.score) return b.score - a.score;
+      const ta = a.updatedAt ?? a.createdAt ?? "";
+      const tb = b.updatedAt ?? b.createdAt ?? "";
+      const byTime = tb.localeCompare(ta);
+      if (byTime) return byTime;
+      return String(a.title ?? "").localeCompare(String(b.title ?? ""));
+    });
+
+    const limitedResults = results.slice(0, limit);
+
+    const response: DocumentSearchResponse = { results: limitedResults, recent };
+    return NextResponse.json(response);
+  } catch (err) {
+    if (err instanceof HttpError) {
+      return NextResponse.json({ error: err.message }, { status: err.status });
+    }
+    const message = err instanceof Error ? err.message : "搜索失败，请稍后再试";
+    console.error("[search/documents] failed:", err);
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}