w-serv-orm 1.1.7 → 1.1.8

package/src/getMapOrm.mjs

@@ -4,54 +4,98 @@ import map from 'lodash-es/map.js'
 import size from 'lodash-es/size.js'
 import take from 'lodash-es/take.js'
 import join from 'lodash-es/join.js'
+import truncate from 'lodash-es/truncate.js'
 import nowms2str from 'wsemi/src/nowms2str.mjs'
+import genIDSeq from 'wsemi/src/genIDSeq.mjs'
 import isarr from 'wsemi/src/isarr.mjs'
 import iseobj from 'wsemi/src/iseobj.mjs'
 import isestr from 'wsemi/src/isestr.mjs'
 import isnum from 'wsemi/src/isnum.mjs'
 import clearXSS from 'wsemi/src/clearXSS.mjs'
-import getItemsFail from './getItemsFail.mjs'
-
-
-let _ds = null
-let _woItems = null
+import getItemsFail from 'w-data-collector/src/getItemsFail.mjs'
 
 
 function getMsgFail(msg, fails) {
     //前端訊息僅列出失敗筆, 錯誤原文另由console.log輸出, 與既有整批錯誤之處理一致
     //有效主鍵(非空字串或數字)列為id[...], 否則列其於輸入內之位置, 失敗筆數過多時僅列前nShow筆並附總筆數
+    //主鍵超過nIdMax字元者截斷顯示(LMDB逐筆失敗常因主鍵超長, 故兩者常同時出現), log仍保留全文
 
-    //nShow
+    //nShow, nIdMax
     let nShow = 10
+    let nIdMax = 100
 
     //ss
     let ss = map(take(fails, nShow), (v) => {
         if (isestr(v.id) || isnum(v.id)) {
-            return `id[${v.id}]`
+            return `id[${truncate(String(v.id), { length: nIdMax, omission: '…' })}]`
         }
-        return `第${v.k + 1}筆`
+        return `data[${v.k}]`
     })
 
     //c
     let c = `${msg}: ${join(ss, ', ')}`
     if (size(fails) > nShow) {
-        c += `等共${size(fails)}筆`
+        c += `, ... (${size(fails)} in total)`
     }
 
     return c
 }
 
 
-function adjustData(woName, userId, data, mode = 'save') { //mode: 'insert', 'save', 'insert+save'
+function isPkIdString(dsTab, keys) {
+    //資料表之主鍵欄是否為id且可容納字串型之補值, 供adjustData判斷是否補主鍵
+
+    //check, 須有id欄; 有settings者另須標為pk
+    if (keys.indexOf('id') < 0) {
+        return false
+    }
+    let settings = get(dsTab, 'settings', null)
+    if (iseobj(settings) && get(settings, 'id.pk') !== true) {
+        return false
+    }
+
+    //check, 型別已知者須為字串型, 與w-orm-reladb可自動補值之主鍵欄型別一致
+    let type = get(settings, 'id.type', '') || get(dsTab, 'kpType.id', '')
+    if (isestr(type) && ['STRING', 'TEXT', 'CHAR', 'UUID', 'CITEXT'].indexOf(type.toUpperCase()) < 0) {
+        return false
+    }
+
+    return true
+}
+
+
+function getItemsIdXSS(data) {
+    //輸入數據之主鍵(非空字串)會被clearXSS改寫者, 回傳[{k,id}], k為其於輸入內之位置
+    //寫入路徑之欄位皆經clearXSS而select與del不經過, 主鍵被改寫後以原主鍵查詢與刪除皆找不到, 故呼叫端須於寫入前整批拒絕
+    let rs = []
+    each(isarr(data) ? data : [data], (v, k) => {
+        let id = get(v, 'id')
+        if (isestr(id) && clearXSS(id) !== id) {
+            rs.push({ k, id })
+        }
+    })
+    return rs
+}
+
+
+function getMsgIdXSS(msg, fails) {
+    //主鍵含HTML標記, 訊息只列位置不回顯主鍵, 主鍵原文另由console.log輸出
+    return getMsgFail(`${msg}, id contains HTML markup`, map(fails, (v) => {
+        return { k: v.k }
+    }))
+}
+
+
+function adjustData(ds, woName, userId, data, mode = 'save') { //mode: 'insert', 'save', 'insert+save'
 
     //check
-    if (!iseobj(_ds)) {
-        console.log('ds', _ds)
+    if (!iseobj(ds)) {
+        console.log('ds', ds)
         throw new Error('invalid ds')
     }
 
     //keys
-    let keys = _ds[woName].keys
+    let keys = ds[woName].keys
 
     //one
     let one = false
@@ -128,6 +172,17 @@ function adjustData(woName, userId, data, mode = 'save') { //mode: 'insert', 'sa
         })
     }
 
+    //id, 未提供有效主鍵者由本套件補值, 令回傳之主鍵與實際寫入者一致, 補值器同各ORM之genIDSeq
+    //有效主鍵之判定同w-orm系列: 非空字串或數字(reladb、mdb視數字為有效)
+    //補值寫在上方之複本, 不改呼叫端原物件; 無欄位之列不補, 保留ORM視空物件為無效輸入之行為
+    if (isPkIdString(ds[woName], keys)) {
+        each(data, (v) => {
+            if (size(v) > 0 && !isestr(v.id) && !isnum(v.id)) {
+                v.id = genIDSeq()
+            }
+        })
+    }
+
     //復原data型態, 若原本data為物件則取第0個回傳
     data = one ? data[0] : data
 
@@ -135,22 +190,22 @@ function adjustData(woName, userId, data, mode = 'save') { //mode: 'insert', 'sa
 }
 
 
-async function mapOrm(userId, woName, mode, input) {
+async function mapOrm(ds, woItems, userId, woName, mode, input) {
     //由woName自動綁定至woItems內的ORM物件
     let err = null
     let r
 
     //check
-    if (!iseobj(_woItems)) {
-        return Promise.reject(`無有效woItems`)
+    if (!iseobj(woItems)) {
+        return Promise.reject(`invalid woItems`)
     }
 
     //wo
-    let wo = get(_woItems, woName, null)
+    let wo = get(woItems, woName, null)
 
     //check
     if (wo === null) {
-        return Promise.reject(`ORM找不到表名稱: ${woName}`)
+        return Promise.reject(`can not find table[${woName}] in ORM`)
     }
 
     if (mode === 'select') {
@@ -159,7 +214,7 @@ async function mapOrm(userId, woName, mode, input) {
         r = await wo.select(input)
             .catch((msg) => {
                 console.log(`${woName}.select catch`, msg)
-                err = '取得資料失敗'
+                err = 'failed to select data'
             })
 
         //check
@@ -170,13 +225,23 @@ async function mapOrm(userId, woName, mode, input) {
     }
     else if (mode === 'insert' || mode === 'save') {
 
+        //inputOrig, 呼叫端原輸入, 逐筆失敗之訊息以呼叫端視角列出(本套件補出之主鍵只寫於複本, reject時呼叫端未曾取得)
+        let inputOrig = input
+
+        //check, 主鍵會被clearXSS改寫者整批拒絕, 不寫入任何一筆
+        let failsIdXSS = getItemsIdXSS(input)
+        if (size(failsIdXSS) > 0) {
+            console.log(`${woName}.${mode} id changed by clearXSS`, failsIdXSS)
+            return Promise.reject(getMsgIdXSS(mode === 'insert' ? 'failed to insert data' : 'failed to save data', failsIdXSS))
+        }
+
         //adjustData
         try {
-            input = adjustData(woName, userId, input, mode)
+            input = adjustData(ds, woName, userId, input, mode)
         }
         catch (e) {
-            console.log(`adjustData catch`, e.toString())
-            err = '調整資料失敗'
+            console.log(`${woName}.adjustData catch`, e.toString())
+            err = 'failed to adjust data'
             return Promise.reject(err)
         }
 
@@ -184,15 +249,15 @@ async function mapOrm(userId, woName, mode, input) {
         if (mode === 'insert') {
             r = await wo.insert(input)
                 .catch((msg) => {
-                    console.log(`${woName}.save catch`, msg)
-                    err = '新增資料失敗'
+                    console.log(`${woName}.insert catch`, msg)
+                    err = 'failed to insert data'
                 })
         }
         else if (mode === 'save') {
             r = await wo.save(input)
                 .catch((msg) => {
                     console.log(`${woName}.save catch`, msg)
-                    err = '儲存資料失敗'
+                    err = 'failed to save data'
                 })
         }
 
@@ -207,7 +272,7 @@ async function mapOrm(userId, woName, mode, input) {
             let fails = getItemsFail(r, input)
             if (size(fails) > 0) {
                 console.log(`${woName}.save fail`, fails)
-                return Promise.reject(getMsgFail('儲存資料失敗', fails))
+                return Promise.reject(getMsgFail('failed to save data', getItemsFail(r, inputOrig)))
             }
         }
 
@@ -229,7 +294,7 @@ async function mapOrm(userId, woName, mode, input) {
         r = await wo.del(input)
             .catch((msg) => {
                 console.log(`${woName}.del catch`, msg)
-                err = '刪除資料失敗'
+                err = 'failed to delete data'
             })
 
         //check, 單筆失敗時整批仍resolve並以該筆ok為0回報, 須逐筆檢查
@@ -237,7 +302,7 @@ async function mapOrm(userId, woName, mode, input) {
             let fails = getItemsFail(r, input)
             if (size(fails) > 0) {
                 console.log(`${woName}.del fail`, fails)
-                err = getMsgFail('刪除資料失敗', fails)
+                err = getMsgFail('failed to delete data', fails)
             }
         }
 
@@ -248,7 +313,7 @@ async function mapOrm(userId, woName, mode, input) {
         r = await wo.delAll(input)
             .catch((msg) => {
                 console.log(`${woName}.delAll catch`, msg)
-                err = '刪除資料失敗'
+                err = 'failed to delete data'
             })
 
     }
@@ -256,7 +321,20 @@ async function mapOrm(userId, woName, mode, input) {
 
         //check
         if (!iseobj(input)) {
-            return Promise.reject('mix僅支援輸入ltdtDiffByKey結果物件')
+            return Promise.reject('invalid input of mix, need the result object of ltdtDiffByKey')
+        }
+
+        //check, 新增與修改之主鍵會被clearXSS改寫者, 於任何步驟寫入之前整批拒絕
+        let msgsIdXSS = []
+        for (let [key, msg] of [['add', 'failed to insert data'], ['diff', 'failed to update data']]) {
+            let fails = getItemsIdXSS(get(input, key, []))
+            if (size(fails) > 0) {
+                console.log(`${woName}.mix ${key} id changed by clearXSS`, fails)
+                msgsIdXSS.push(getMsgIdXSS(msg, fails))
+            }
+        }
+        if (size(msgsIdXSS) > 0) {
+            return Promise.reject(join(msgsIdXSS, '; '))
         }
 
         //rt,r
@@ -271,19 +349,19 @@ async function mapOrm(userId, woName, mode, input) {
 
             //adjustData
             try {
-                add = adjustData(woName, userId, add, 'insert+save')
+                add = adjustData(ds, woName, userId, add, 'insert+save')
             }
             catch (e) {
-                console.log(`adjustData catch`, e.toString())
-                err = '調整資料失敗'
+                console.log(`${woName}.adjustData catch`, e.toString())
+                err = 'failed to adjust data'
                 return Promise.reject(err)
             }
 
             //insert
             await wo.insert(add)
                 .catch((msg) => {
-                    console.log(`${woName}.save catch`, msg)
-                    err = '新增資料失敗'
+                    console.log(`${woName}.insert catch`, msg)
+                    err = 'failed to insert data'
                 })
 
             //check
@@ -304,8 +382,8 @@ async function mapOrm(userId, woName, mode, input) {
             //del
             let rs = await wo.del(del)
                 .catch((msg) => {
-                    console.log(`${woName}.save catch`, msg)
-                    err = '刪除資料失敗'
+                    console.log(`${woName}.del catch`, msg)
+                    err = 'failed to delete data'
                 })
 
             //check
@@ -317,7 +395,7 @@ async function mapOrm(userId, woName, mode, input) {
             let fails = getItemsFail(rs, del)
             if (size(fails) > 0) {
                 console.log(`${woName}.del fail`, fails)
-                msgsFail.push(getMsgFail('刪除資料失敗', fails))
+                msgsFail.push(getMsgFail('failed to delete data', fails))
             }
 
             //r
@@ -330,13 +408,16 @@ async function mapOrm(userId, woName, mode, input) {
         let diff = get(input, 'diff', [])
         if (size(diff) > 0) {
 
+            //diffOrig, 呼叫端原輸入, 逐筆失敗之訊息以呼叫端視角列出
+            let diffOrig = diff
+
             //adjustData
             try {
-                diff = adjustData(woName, userId, diff)
+                diff = adjustData(ds, woName, userId, diff)
             }
             catch (e) {
-                console.log(`adjustData catch`, e.toString())
-                err = '調整資料失敗'
+                console.log(`${woName}.adjustData catch`, e.toString())
+                err = 'failed to adjust data'
                 return Promise.reject(err)
             }
 
@@ -344,7 +425,7 @@ async function mapOrm(userId, woName, mode, input) {
             let rs = await wo.save(diff)
                 .catch((msg) => {
                     console.log(`${woName}.save catch`, msg)
-                    err = '變更資料失敗'
+                    err = 'failed to update data'
                 })
 
             //check
@@ -356,7 +437,7 @@ async function mapOrm(userId, woName, mode, input) {
             let fails = getItemsFail(rs, diff)
             if (size(fails) > 0) {
                 console.log(`${woName}.save fail`, fails)
-                msgsFail.push(getMsgFail('變更資料失敗', fails))
+                msgsFail.push(getMsgFail('failed to update data', getItemsFail(rs, diffOrig)))
             }
 
             //r
@@ -387,9 +468,10 @@ async function mapOrm(userId, woName, mode, input) {
 
 
 function getMapOrm(ds, woItems) {
-    _ds = ds
-    _woItems = woItems
-    return mapOrm
+    //每次呼叫各自綁定ds與woItems並回傳新函數, 令同一行程內之多個實例互不干擾; 回傳函數之參數形狀維持(userId, woName, mode, input)
+    return async (userId, woName, mode, input) => {
+        return mapOrm(ds, woItems, userId, woName, mode, input)
+    }
 }
 
 

package/src/getProc.mjs

@@ -1,88 +1,72 @@
 import get from 'lodash-es/get.js'
-import size from 'lodash-es/size.js'
 import filter from 'lodash-es/filter.js'
 import isarr from 'wsemi/src/isarr.mjs'
 import isestr from 'wsemi/src/isestr.mjs'
+import iseobj from 'wsemi/src/iseobj.mjs'
 import haskey from 'wsemi/src/haskey.mjs'
 import pmSeries from 'wsemi/src/pmSeries.mjs'
-import pmChain from 'wsemi/src/pmChain.mjs'
 import isfun from 'wsemi/src/isfun.mjs'
 import isbol from 'wsemi/src/isbol.mjs'
 
 
-let _funChecks = []
-let _funPreProcessing = []
-let _funPostProcessing = []
-let _mapOrm = null
-let _getUserById = null
-let useCheckUser = true
-let useExcludeWhenNotAdmin = true
+function addFun(fs, f, name, useGuard = false) {
+    //由外部添加擴充函數至該實例之陣列
+    //延後1ms生效係沿用既有之生效時序: 原為避開模組層陣列於循環引用時之「Cannot access before initialization」,
+    //改為各實例狀態後該原因已不成立, 惟使用端之啟動流程可能依賴此時序, 故保留
 
+    //check, 非函數於註冊時即拋錯; useGuard(check用)另推入恆reject之守門函數, 令拋錯被呼叫端攔下時該實例仍維持fail-closed
+    //註冊時拋錯屬建構期錯誤故為Error; 守門函數於procOrm內reject, 與procOrm其餘拒絕一致為字串
+    if (!isfun(f)) {
+        let msg = `${name} needs a function, but got ${typeof f}`
+        if (useGuard) {
+            fs.push(() => {
+                return Promise.reject(msg)
+            })
+        }
+        throw new Error(msg)
+    }
 
-function addFunCheck(f) {
-    //由外部添加擴充檢查函數
-
-    setTimeout(() => { //因互相引用的關係會出現「Cannot access '_funChecks' before initialization」, 故通過timer脫勾成為動態引用, 避開執行mInitialTestData時會先編譯與偵測問題
-        _funChecks.push(f)
-    }, 1)
-
-}
-
-
-function addFunPreProcessing(f) {
-    //由外部添加擴充前處理函數
-
-    setTimeout(() => { //因互相引用的關係會出現「Cannot access '_funChecks' before initialization」, 故通過timer脫勾成為動態引用, 避開執行mInitialTestData時會先編譯與偵測問題
-        _funPreProcessing.push(f)
-    }, 1)
-
-}
-
-
-function addFunPostProcessing(f) {
-    //由外部添加擴充後置處理函數
-
-    setTimeout(() => { //因互相引用的關係會出現「Cannot access '_funChecks' before initialization」, 故通過timer脫勾成為動態引用, 避開執行mInitialTestData時會先編譯與偵測問題
-        _funPostProcessing.push(f)
+    setTimeout(() => {
+        fs.push(f)
     }, 1)
 
 }
 
 
-async function procOrm(userId, woName, mode, input) {
-    //封裝mapOrm, 添加檢查userId功能
+async function procOrm(st, userId, woName, mode, input) {
+    //封裝mapOrm, 添加檢查userId功能, st為該實例之狀態
 
     //check
-    if (!isfun(_mapOrm)) {
+    if (!isfun(st.mapOrm)) {
         return Promise.reject(`invalid mapOrm`)
     }
 
     //check
-    if (useCheckUser && !isestr(userId)) {
+    if (st.useCheckUser && !isestr(userId)) {
         console.log('userId', userId)
-        console.log('找不到使用者主鍵')
-        return Promise.reject(`找不到使用者主鍵`)
+        console.log('invalid userId')
+        return Promise.reject(`invalid userId`)
     }
 
     //isAdmin
     let isAdmin = 'n'
 
     //useCheckUser
-    if (useCheckUser) {
+    if (st.useCheckUser) {
 
         //check
-        if (!isfun(_getUserById)) {
+        if (!isfun(st.getUserById)) {
             return Promise.reject(`invalid getUserById`)
         }
 
         //oSelf
-        let oSelf = await _getUserById(userId)
+        let oSelf = await st.getUserById(userId)
 
         //check
         if (!oSelf) {
             console.log('userId', userId)
-            console.log('找不到使用者資訊')
-            return Promise.reject(`找不到使用者資訊`)
+            console.log('can not find user')
+            return Promise.reject(`can not find user`)
         }
 
         //isAdmin
@@ -101,29 +85,33 @@ async function procOrm(userId, woName, mode, input) {
         if (isActive !== 'y') {
             console.log('userId', userId)
             console.log('oSelf', oSelf)
-            console.log('使用者被停權或無有效使用者資訊')
-            return Promise.reject(`使用者被停權或無有效使用者資訊`)
+            console.log('user is inactive or invalid')
+            return Promise.reject(`user is inactive or invalid`)
         }
 
     }
 
-    //_funChecks, 擴充檢查, 提供給各 mOrm[OOO].mjs 檢查
-    await pmSeries(_funChecks, (v) => {
+    //funChecks, 擴充檢查, 提供給各 mOrm[OOO].mjs 檢查
+    await pmSeries(st.funChecks, (v) => {
         return v({ woName, userId, isAdmin, mode, input })
     })
 
-    //_funPreProcessing, 擴充前處理input, 提供給各 mOrm[OOO].mjs 前處理
-    if (size(_funPreProcessing) > 0) {
-        let paramsIn = { woName, userId, isAdmin, mode, input } //將input與其他資訊一起封裝成params
-        let paramsOut = await pmChain(_funPreProcessing, paramsIn) //各非同步函數拿到輸入處理完皆輸出一樣結構數據params, 使各非同步函數都可拿到非input的重要資訊
-        input = paramsOut.input //由params提取input出來
+    //funPreProcessing, 擴充前處理input, 提供給各 mOrm[OOO].mjs 前處理
+    //逐一呼叫, 各前處理皆收新建之參數物件, input為前一個回傳之input; 回傳須為含input之物件, 否則reject, 避免input成為undefined而令select回全表
+    //迭代前先取快照, 呼叫進行中註冊者不套用於本次呼叫
+    for (let f of [...st.funPreProcessing]) {
+        let paramsOut = await f({ woName, userId, isAdmin, mode, input })
+        if (!iseobj(paramsOut) || paramsOut.input === undefined) {
+            return Promise.reject(`invalid return of pre-processing, need an object with input`)
+        }
+        input = paramsOut.input
     }
 
     //output
-    let output = await _mapOrm(userId, woName, mode, input)
+    let output = await st.mapOrm(userId, woName, mode, input)
 
     //useExcludeWhenNotAdmin, 非管理者則要過濾掉已刪除之數據
-    if (useExcludeWhenNotAdmin && isAdmin === 'n') {
+    if (st.useExcludeWhenNotAdmin && isAdmin === 'n') {
         if (mode === 'select' && isarr(output)) { //有可能為錯誤物件
             output = filter(output, (v) => {
                 if (haskey(v, 'isActive')) { //針對有isActive屬性
@@ -134,9 +122,10 @@ async function procOrm(userId, woName, mode, input) {
         }
     }
 
-    //_funPostProcessing, 擴充後處理output, 提供給各 mOrm[OOO].mjs 後處理
-    if (size(_funPostProcessing) > 0) {
-        output = await pmChain(_funPostProcessing, { woName, userId, isAdmin, mode, input, output })
+    //funPostProcessing, 擴充後處理output, 提供給各 mOrm[OOO].mjs 後處理
+    //逐一呼叫, 各後處理皆收新建之參數物件, output為前一個之回傳值, 回傳值成為新output; 迭代前先取快照
+    for (let f of [...st.funPostProcessing]) {
+        output = await f({ woName, userId, isAdmin, mode, input, output })
     }
 
     return output
@@ -150,29 +139,49 @@ function getProc(mapOrm, opt = {}) {
         return Promise.reject(`invalid mapOrm`)
     }
 
-    //save _mapOrm
-    _mapOrm = mapOrm
-
     //useCheckUser
-    useCheckUser = get(opt, 'useCheckUser')
+    let useCheckUser = get(opt, 'useCheckUser')
     if (!isbol(useCheckUser)) {
         useCheckUser = true
     }
 
-    //save _getUserById, 不事先檢查, 因若useCheckUser=false可允許不給
-    _getUserById = get(opt, 'getUserById')
+    //getUserById, 不事先檢查, 因若useCheckUser=false可允許不給
+    let getUserById = get(opt, 'getUserById')
 
     //useExcludeWhenNotAdmin
-    useExcludeWhenNotAdmin = get(opt, 'useExcludeWhenNotAdmin')
+    let useExcludeWhenNotAdmin = get(opt, 'useExcludeWhenNotAdmin')
     if (!isbol(useExcludeWhenNotAdmin)) {
         useExcludeWhenNotAdmin = true
     }
 
+    //st, 各實例之狀態, 每次呼叫各自建立, 令同一行程內之多個實例互不干擾
+    let st = {
+        funChecks: [],
+        funPreProcessing: [],
+        funPostProcessing: [],
+        mapOrm,
+        getUserById,
+        useCheckUser,
+        useExcludeWhenNotAdmin,
+    }
+
+    //回傳函數綁定st而不依賴this, 使用端可解構取用並當裸函數傳遞
     return {
-        addFunCheck,
-        addFunPreProcessing,
-        addFunPostProcessing,
-        procOrm,
+        addFunCheck: (f) => {
+            //由外部添加擴充檢查函數
+            addFun(st.funChecks, f, 'addFunCheck', true)
+        },
+        addFunPreProcessing: (f) => {
+            //由外部添加擴充前處理函數
+            addFun(st.funPreProcessing, f, 'addFunPreProcessing')
+        },
+        addFunPostProcessing: (f) => {
+            //由外部添加擴充後置處理函數
+            addFun(st.funPostProcessing, f, 'addFunPostProcessing')
+        },
+        procOrm: async (userId, woName, mode, input) => {
+            return procOrm(st, userId, woName, mode, input)
+        },
     }
 }
 

package/src/getSettings.mjs

@@ -76,7 +76,7 @@ function getSettings(opt = {}) {
     }
     catch (err) {
         console.log(err)
-        throw new Error('伺服器讀取設定檔失敗')
+        throw new Error('failed to read settings file')
     }
 
     return st

package/test/api-procOrm.test.mjs

@@ -46,7 +46,7 @@ describe('procOrm接w-orm-lowdb', function() {
     it('A02 del含無效主鍵', async function() {
         //R02: 逐筆ok為0即reject並列出失敗主鍵; R10: 單筆失敗不中斷整批, 有效筆已刪除
         let err = await getReject(proc('del', [{ id: 'a1' }, { id: 123 }]))
-        assert.strict.equal(err, '刪除資料失敗: id[123]')
+        assert.strict.equal(err, 'failed to delete data: id[123]')
         let rs = await proc('select', { id: 'a1' })
         assert.strict.equal(rs.length, 0)
     })
@@ -54,7 +54,7 @@ describe('procOrm接w-orm-lowdb', function() {
     it('A03 mix之del含無效主鍵', async function() {
         //R03: del之逐筆失敗不中斷diff, diff已寫入, 最後reject列出del之失敗
         let err = await getReject(proc('mix', { del: [{ id: 456 }], diff: [{ id: 'a2', isActive: 'y' }] }))
-        assert.strict.equal(err, '刪除資料失敗: id[456]')
+        assert.strict.equal(err, 'failed to delete data: id[456]')
         let rs = await proc('select', { id: 'a2' })
         assert.strict.equal(rs.length, 1)
     })
@@ -65,4 +65,29 @@ describe('procOrm接w-orm-lowdb', function() {
         assert.strict.deepEqual(r, [{ n: 0, nDeleted: 0, ok: 1 }])
     })
 
+    it('A05 save未帶主鍵時回傳之id可於資料庫查得', async function() {
+        //D1: 本套件補值並回傳, 與實際寫入之主鍵一致
+        let r = await proc('save', [{ isActive: 'y' }])
+        assert.ok(typeof r[0].id === 'string' && r[0].id.length > 0)
+        let rs = await proc('select', { id: r[0].id })
+        assert.strict.equal(rs.length, 1)
+    })
+
+    it('A06 主鍵為數學式者可依原主鍵查詢與刪除', async function() {
+        //wsemi 1.9.13起數學式不被clearXSS改寫, 寫入之主鍵即呼叫端所持者(1.9.12時會存成a < b而查不到、刪不掉)
+        let r = await proc('save', [{ id: 'a < b', isActive: 'y' }])
+        assert.strict.deepEqual(r, [{ id: 'a < b' }])
+        let rs = await proc('select', { id: 'a < b' })
+        assert.strict.equal(rs.length, 1)
+        let rd = await proc('del', [{ id: 'a < b' }])
+        assert.strict.deepEqual(rd, [{ n: 1, nDeleted: 1, ok: 1 }])
+    })
+
+    it('A07 主鍵會被改寫者整批拒絕且未寫入任何一筆', async function() {
+        let err = await getReject(proc('save', [{ id: 'ok-2', isActive: 'y' }, { id: 'a<b', isActive: 'y' }]))
+        assert.strict.equal(err, 'failed to save data, id contains HTML markup: data[1]')
+        let rs = await proc('select', {})
+        assert.ok(!rs.some((v) => ['ok-2', 'a<b', 'a&lt;b'].includes(v.id)), JSON.stringify(rs))
+    })
+
 })