w-web-api 1.0.52 → 1.0.55

package/src/components/MdPanel.vue

@@ -5,14 +5,14 @@
 </template>
 
 <script>
-// import get from 'lodash-es/get.js'
-// import find from 'lodash-es/find.js'
-// import each from 'lodash-es/each.js'
-// import map from 'lodash-es/map.js'
-// import size from 'lodash-es/size.js'
-// import sortBy from 'lodash-es/sortBy.js'
-// import isNumber from 'lodash-es/isNumber.js'
-// import cloneDeep from 'lodash-es/cloneDeep.js'
+// import get from 'lodash-es/get.js'
+// import find from 'lodash-es/find.js'
+// import each from 'lodash-es/each.js'
+// import map from 'lodash-es/map.js'
+// import size from 'lodash-es/size.js'
+// import sortBy from 'lodash-es/sortBy.js'
+// import isNumber from 'lodash-es/isNumber.js'
+// import cloneDeep from 'lodash-es/cloneDeep.js'
 // import sep from 'wsemi/src/sep.mjs'
 // import isobj from 'wsemi/src/isobj.mjs'
 // import iseobj from 'wsemi/src/iseobj.mjs'
@@ -73,80 +73,102 @@ export default {
 </script>
 
 <style scoped>
+/* Scalar 風格 markdown 渲染：無外框、細列分隔、等寬欄、名稱欄加粗、標題退場感 */
+.md {
+    font-size: 13px;
+    color: var(--c-1, #1b1b1b);
+}
 
 .md >>> table {
     border-collapse: collapse;
-    margin: 0;
-    padding: 0;
+    width: 100%;
+    font-size: 13px;
+    margin: 2px 0 8px;
     word-break: initial;
 }
 
-.md >>> tr {
-    margin: 0;
-    padding: 0;
-}
-
 .md >>> table tr th {
-    font-weight: bold;
-    background: #eee;
-    border: 1px solid #ddd;
-    border-bottom: 0;
+    text-align: left;
+    font-weight: 600;
+    font-size: 11.5px;
+    letter-spacing: .03em;
+    color: var(--c-2, #6b7280);
+    background: transparent;
+    border: none;
+    border-bottom: 1px solid var(--border, #e6e8ec);
     margin: 0;
-    padding: 6px 13px;
+    padding: 8px 18px 8px 0;
 }
 
 .md >>> table tr td {
-    border: 1px solid #ddd;
+    border: none;
+    border-bottom: 1px solid var(--border-soft, #eef0f3);
+    color: var(--c-1, #1b1b1b);
+    font-family: var(--font-code, ui-monospace, Menlo, Consolas, monospace);
+    font-size: 12.5px;
+    vertical-align: top;
     margin: 0;
-    padding: 6px 13px;
+    padding: 8px 18px 8px 0;
+}
+
+.md >>> table tbody tr:last-child td {
+    border-bottom: none;
 }
 
-.md >>> h1 {
-    font-weight: bold;
-    font-size: 1.2rem;
-    line-height: 1.2rem;
-    margin-top: 0.5rem;
-    margin-bottom: 0.5rem;
+.md >>> table tr td:first-child {
+    font-weight: 600;
+    color: var(--c-1, #1b1b1b);
 }
 
-.md >>> h2 {
-    font-weight: bold;
-    font-size: 1.1rem;
-    line-height: 1.1rem;
-    margin-top: 0.5rem;
-    margin-bottom: 0.5rem;
+/* 對齊 mockup：型別欄(第2欄)綠字、範例欄(第3欄)灰字 */
+.md >>> table tr td:nth-child(2) {
+    color: var(--m-post, #069061);
 }
 
-.md >>> h3 {
-    font-weight: bold;
-    font-size: 1rem;
-    line-height: 1rem;
-    margin-top: 0.5rem;
-    margin-bottom: 0.5rem;
+.md >>> table tr td:nth-child(3) {
+    color: var(--c-2, #6b7280);
 }
 
-.md >>> h4 {
-    font-weight: bold;
-    font-size: 1rem;
-    line-height: 1rem;
-    margin-top: 0.5rem;
-    margin-bottom: 0.5rem;
+.md >>> h1,
+.md >>> h2,
+.md >>> h3,
+.md >>> h4,
+.md >>> h5,
+.md >>> h6 {
+    font-weight: 600;
+    font-size: 13px;
+    line-height: 1.4;
+    color: var(--c-2, #6b7280);
+    margin: 8px 0 6px;
 }
 
-.md >>> h5 {
-    font-weight: bold;
-    font-size: 1rem;
-    line-height: 1rem;
-    margin-top: 0.5rem;
-    margin-bottom: 0.5rem;
+.md >>> p {
+    color: var(--c-2, #6b7280);
+    line-height: 1.6;
+    margin: 4px 0;
 }
 
-.md >>> h6 {
-    font-weight: bold;
-    font-size: 1rem;
-    line-height: 1rem;
-    margin-top: 0.5rem;
-    margin-bottom: 0.5rem;
+.md >>> code {
+    font-family: var(--font-code, ui-monospace, Menlo, Consolas, monospace);
+    font-size: 12px;
+    background: var(--bg-3, #eceef1);
+    border-radius: 4px;
+    padding: 1px 5px;
+}
+
+.md >>> pre {
+    font-family: var(--font-code, ui-monospace, Menlo, Consolas, monospace);
+    font-size: 12px;
+    background: var(--bg-2, #f7f8fa);
+    border: 1px solid var(--border, #e6e8ec);
+    border-radius: 8px;
+    padding: 12px 14px;
+    overflow: auto;
+}
+
+.md >>> pre code {
+    background: transparent;
+    padding: 0;
 }
 
 </style>

package/src/main.js

@@ -4,6 +4,7 @@ import get from 'lodash-es/get.js'
 // import 'regenerator-runtime/runtime'
 // import 'intersection-observer' //需供Vuetify的Intersection Observer, 專案內有使用v-intersect才需引入, 而w-component-vue沒用v-intersect
 import Vue from 'vue'
+import './assets/scalar-ui.css'
 import WServHapiClient from 'w-serv-hapi/src/WServHapiClient.mjs'
 import WAlert from 'w-component-vue/src/components/WAlert.mjs'
 import domMutation from 'w-component-vue/src/js/domMutation.mjs'
@@ -12,8 +13,6 @@ import domDragDrop from 'w-component-vue/src/js/domDragDrop.mjs'
 import App from './App.vue'
 import store from './store/index.mjs'
 import ui from './plugins/mUI.mjs'
-import mDataSelectorSchema from './plugins/mDataSelectorSchema.mjs'
-import * as s from './plugins/mShare.mjs'
 import ds from './schema/index.mjs'
 // console.log('globalState', globalState)
 // console.log('ds', ds)
@@ -31,14 +30,16 @@ Vue.prototype.$alert = function() {
     }
 }
 
-//dssm
-let dssm = mDataSelectorSchema(ds)
-
 //prototype
 Vue.prototype.$ui = ui
 Vue.prototype.$t = ui.getKpText
-Vue.prototype.$s = s
-Vue.prototype.$dssm = dssm
+//$transErr：後端 reject 之 err-key → 依當前 lang 反查顯示文字。
+//非字串或查無對應 key（getKpText 查不到會原樣回 key）則 fallback 'anUnexpectedErrorOccurred'，避免顯示生 key。
+Vue.prototype.$transErr = (err) => {
+    let key = (typeof err === 'string' && err) ? err : 'anUnexpectedErrorOccurred'
+    let msg = ui.getKpText(key)
+    return (msg && msg !== key) ? msg : ui.getKpText('anUnexpectedErrorOccurred')
+}
 Vue.prototype.$ds = ds
 Vue.prototype.$dg = {}
 
@@ -79,7 +80,9 @@ WServHapiClient({
 
             })
             .catch((err) => {
-                console.log(err)
+                console.log('getWebInfor failed', err)
+                //getWebInfor 失敗時導向連線錯誤態，避免 ready(需 webInfor) 永假而卡在「已登入」轉圈無回饋
+                ui.updateConnState('csErrConn')
             })
 
     },

package/src/plugins/mUI.mjs

@@ -1,47 +1,12 @@
 import Vue from 'vue'
-import min from 'lodash-es/min.js'
-import size from 'lodash-es/size.js'
-import take from 'lodash-es/take.js'
-import isEqual from 'lodash-es/isEqual.js'
-import uniq from 'lodash-es/uniq.js'
-import set from 'lodash-es/set.js'
 import get from 'lodash-es/get.js'
 import each from 'lodash-es/each.js'
-import map from 'lodash-es/map.js'
-import filter from 'lodash-es/filter.js'
-import last from 'lodash-es/last.js'
-import split from 'lodash-es/split.js'
-import join from 'lodash-es/join.js'
-import drop from 'lodash-es/drop.js'
-import dropRight from 'lodash-es/dropRight.js'
-import groupBy from 'lodash-es/groupBy.js'
-import sortBy from 'lodash-es/sortBy.js'
 import cloneDeep from 'lodash-es/cloneDeep.js'
-import cint from 'wsemi/src/cint.mjs'
 import delay from 'wsemi/src/delay.mjs'
-import isarr from 'wsemi/src/isarr.mjs'
 import isestr from 'wsemi/src/isestr.mjs'
 import isfun from 'wsemi/src/isfun.mjs'
 import iseobj from 'wsemi/src/iseobj.mjs'
-import isearr from 'wsemi/src/isearr.mjs'
-import isEle from 'wsemi/src/isEle.mjs'
-import strleft from 'wsemi/src/strleft.mjs'
-import strdelleft from 'wsemi/src/strdelleft.mjs'
-import sep from 'wsemi/src/sep.mjs'
-import aes2str from 'wsemi/src/aes2str.mjs'
-import str2aes from 'wsemi/src/str2aes.mjs'
-import haskey from 'wsemi/src/haskey.mjs'
-import genPm from 'wsemi/src/genPm.mjs'
-import pmSeries from 'wsemi/src/pmSeries.mjs'
 import waitFun from 'wsemi/src/waitFun.mjs'
-import browserView from 'wsemi/src/browserView.mjs'
-import arrHas from 'wsemi/src/arrHas.mjs'
-import arrSort from 'wsemi/src/arrSort.mjs'
-import arrInsert from 'wsemi/src/arrInsert.mjs'
-import replace from 'wsemi/src/replace.mjs'
-import timemsTZ2past from 'wsemi/src/timemsTZ2past.mjs'
-import convertToTree from 'wsemi/src/convertToTree.mjs'
-// import WUiDwload from 'w-ui-dwload/src/WUiDwload.mjs'
 
 
 let kpFallback = {
@@ -132,16 +97,31 @@ function validLang(lang) {
 function getLang() {
     let lang = ''
 
-    //from window
+    //from URL ?lang=（最高優先；供「以指定語系載入初始畫面」用，如分享連結 /?lang=cht，對齊 w-web-sso getLang）
+    if (!isestr(lang)) {
+        let _lang = ''
+        try {
+            _lang = new URLSearchParams(get(window, 'location.search', '')).get('lang') || ''
+        }
+        catch (err) {
+            _lang = ''
+        }
+        if (isestr(_lang)) {
+            lang = validLang(_lang) //URL 帶非預期 lang 時 validLang 退回 eng
+        }
+    }
+
+    //from window ___pmwperm___.language（server 注入之初始語系；對齊 w-web-sso window 注入來源）。
+    //須在 store 之前：store.state.lang 預設為非空 'eng'（mutations.mjs），若 store 在前會永遠 shadow 掉 window 注入值。
+    //dev 未注入時為模板符號 {language} → validLang 退回 eng。
     if (!isestr(lang)) {
         let _lang = get(window, '___pmwperm___.language', '')
-        // console.log('_lang(from window)', _lang)
         if (isestr(_lang)) {
-            lang = validLang(_lang) //有可能取到未取代前模板符號
+            lang = validLang(_lang)
         }
     }
 
-    //from store
+    //from store（使用者執行期切換之語系；切換以 setLang(明確值) 直接寫入、其後無 setLang(null) 故能持久）
     if (!isestr(lang)) {
         let _lang = get(vo, '$store.state.lang', '')
         // console.log('_lang(from store)', _lang)

package/src/schema/tables/apis.mjs

@@ -86,6 +86,34 @@ let settings = {
         name: '輸出範例',
         type: 'STRING',
     },
+    'testBaseUrl': {
+        name: '測試基底網址',
+        type: 'STRING',
+    },
+    'authType': {
+        name: '認證類型',
+        type: 'STRING',
+    },
+    'authConfigJson': {
+        name: '認證設定JSON',
+        type: 'TEXT',
+    },
+    'defaultHeadersJson': {
+        name: '預設標頭JSON',
+        type: 'TEXT',
+    },
+    'defaultQueryJson': {
+        name: '預設查詢參數JSON',
+        type: 'TEXT',
+    },
+    'defaultBodyJson': {
+        name: '預設請求內容JSON',
+        type: 'TEXT',
+    },
+    'contentType': {
+        name: '內容類型',
+        type: 'STRING',
+    },
     'timeCreate': {
         name: '創建時間',
         type: 'STRING',
@@ -106,6 +134,8 @@ let funNew = (ndata = {}) => {
     o.timeCreate = nowms2str()
     o.timeUpdate = o.timeCreate
     o.isActive = 'y'
+    o.authType = isestr(o.authType) ? o.authType : 'none'
+    o.contentType = isestr(o.contentType) ? o.contentType : 'application/json'
     return o
 }
 

package/src/store/mutations.mjs

@@ -79,12 +79,6 @@ export let mutations = {
         state[msg.tableName] = msg.data
     },
 
-    [types.UpdateData] (state, msg) {
-        //msg.path內為存取路徑, 需使用set處理
-        // console.log('UpdateData msg', msg)
-        set(state, msg.path, msg.data)
-    },
-
     [types.UpdateHeightApp] (state, heightApp) {
         state.heightApp = heightApp
     },
@@ -93,14 +87,6 @@ export let mutations = {
         state.heightAppEff = heightAppEff
     },
 
-    [types.UpdateHeightToolbar] (state, heightToolbar) {
-        state.heightToolbar = heightToolbar
-    },
-
-    [types.UpdateMenu] (state, menu) {
-        state.menu = menu
-    },
-
     [types.UpdateUserToken] (state, userToken) {
         state.userToken = userToken
     },

package/src/store/types.mjs

@@ -6,10 +6,7 @@ export const UpdateSyncState = 'UpdateSyncState'
 export const UpdateLoading = 'UpdateLoading'
 // export const UpdateViewState = 'UpdateViewState'
 export const UpdateTableData = 'UpdateTableData'
-export const UpdateData = 'UpdateData'
 export const UpdateHeightApp = 'UpdateHeightApp'
 export const UpdateHeightAppEff = 'UpdateHeightAppEff'
-export const UpdateHeightToolbar = 'UpdateHeightToolbar'
-export const UpdateMenu = 'UpdateMenu'
 export const UpdateUserToken = 'UpdateUserToken'
 export const UpdateUserSelf = 'UpdateUserSelf'

package/srv.mjs

@@ -1,22 +1,44 @@
 import WOrm from 'w-orm-lmdb/src/WOrmLmdb.mjs'
 import WWebApi from './server/WWebApi.mjs'
 import getSettings from './g.getSettings.mjs'
+import get from 'lodash-es/get.js'
+import iseobj from 'wsemi/src/iseobj.mjs'
+import axios from 'axios'
+import JSON5 from 'json5'
+import fs from 'fs'
 
 
-//st
+//st（db 等系統參數由 g.getSettings 提供，供 g.mOrm 共用）
 let st = getSettings()
 
+//pathSettings：app 設定檔路徑，預設 ./settings.json；可由 `node srv.mjs <path>` 覆寫
+//（供 e2e restartBackend / 部署帶不同設定，日後更細緻功能便於擴充）。settings.json 為 JSON5 格式。
+let pathSettings = process.argv[2] || './settings.json'
+let stApp = JSON5.parse(fs.readFileSync(pathSettings, 'utf8'))
+
 let url = st.dbUrl
 let db = st.dbName
+let ssoBaseUrl = st.ssoBaseUrl
+let ssoAppToken = st.ssoAppToken
+let ssoLoginUrl = st.ssoLoginUrl
 let opt = {
 
     useCheckUser: false,
     getUserById: null,
     useExcludeWhenNotAdmin: false,
 
-    serverPort: 11005,
+    serverPort: get(stApp, 'serverPort', 11005),
     subfolder: '', //mapi
-    urlRedirect: 'https://www.google.com/', //本機測試時得先編譯, 再瀏覽: http://localhost:11005/
+    urlRedirect: ssoLoginUrl, //未登入時導向SSO登入頁, 本機測試時得先編譯, 再瀏覽: http://localhost:11005/
+
+    //語系（來自 settings.json）：language 由 WWebApi 注入 index.html ({language}) → 初始畫面即此語系；
+    //showLanguage 控右上語系選單顯隱。e2e 可用 restartBackend(genTempSettings({language})) 改 server 初始語系。
+    showLanguage: get(stApp, 'showLanguage', 'y'),
+    language: get(stApp, 'language', 'eng'),
+
+    //log 資料夾與輪檔間隔（srLog 寫入 + staEvent 統計皆讀此）。e2e 可用 genTempSettings({logFd}) 指向合成 log 達 hermetic。
+    logFd: get(stApp, 'logFd', './logs'),
+    logInterval: get(stApp, 'logInterval', 'hr'),
 
     webName: {
         'eng': 'API Service',
@@ -24,7 +46,7 @@ let opt = {
     },
     webDescription: {
         'eng': 'A web service package as methods to send requests to and receive responses from an API.',
-        'cht': 'A web service package as methods to send requests to and receive responses from an API.',
+        'cht': '一套以方法形式，用於發送請求至API並接收其回應的網頁服務套件。',
     },
     webLogo: 'data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSBzdmcgIFBVQkxJQyAnLS8vVzNDLy9EVEQgU1ZHIDEuMS8vRU4nICAnaHR0cDovL3d3dy53My5vcmcvR3JhcGhpY3MvU1ZHLzEuMS9EVEQvc3ZnMTEuZHRkJz48c3ZnIGVuYWJsZS1iYWNrZ3JvdW5kPSJuZXcgMCAwIDMyIDMyIiB2ZXJzaW9uPSIxLjEiIHZpZXdCb3g9IjAgMCAzMiAzMiIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxuczp4bGluaz0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94bGluayI+PGcgaWQ9IkxheWVyXzIiLz48ZyBpZD0iTGF5ZXJfMyIvPjxnIGlkPSJMYXllcl80Ij48Zz48cGF0aCBkPSJNOS4wMiw2QzkuMDEyNyw2LDkuMDA2OCw1Ljk5OSw5LDZIMkMxLjQ0NzgsNiwxLDUuNTUyNywxLDVWMmMwLTAuNTUyNywwLjQ0NzgtMSwxLTFoNiAgICBjMC40MzA3LDAsMC44MTI1LDAuMjc1NCwwLjk0ODcsMC42ODM2bDAuOTQwNCwyLjgyMTNDOS45NzIyLDQuNjUxNCwxMC4wMiw0LjgyMDMsMTAuMDIsNUMxMC4wMiw1LjU1MjcsOS41NzIzLDYsOS4wMiw2eiBNMyw0ICAgIGg0LjYxMjhMNy4yNzkzLDNIM1Y0eiIgZmlsbD0iI0Y1RDgwMyIvPjwvZz48Zz48cGF0aCBkPSJNMjQuMDE5NSwyMmMtMC4wMDM5LDAtMC4wMTE3LDAuMDAxLTAuMDE5NSwwaC03Yy0wLjU1MjIsMC0xLTAuNDQ3My0xLTF2LTNjMC0wLjU1MjcsMC40NDc4LTEsMS0xaDYgICAgYzAuNDMwNywwLDAuODEyNSwwLjI3NTQsMC45NDgyLDAuNjgzNmwwLjk0MDQsMi44MjEzYzAuMDg0LDAuMTQ2NSwwLjEzMDksMC4zMTU0LDAuMTMwOSwwLjQ5NTEgICAgQzI1LjAxOTUsMjEuNTUyNywyNC41NzIzLDIyLDI0LjAxOTUsMjJ6IE0xOCwyMGg0LjYxMjNsLTAuMzMzLTFIMThWMjB6IiBmaWxsPSIjRjVEODAzIi8+PC9nPjxnPjxwYXRoIGQ9Ik0xNSwxNUgyYy0wLjU1MjIsMC0xLTAuNDQ3My0xLTFWNWMwLTAuNTUyNywwLjQ0NzgtMSwxLTFoMTNjMC41NTIyLDAsMSwwLjQ0NzMsMSwxdjkgICAgQzE2LDE0LjU1MjcsMTUuNTUyMiwxNSwxNSwxNXogTTMsMTNoMTFWNkgzVjEzeiIgZmlsbD0iIzAxODFCMCIvPjwvZz48Zz48cGF0aCBkPSJNMzAsMzFIMTdjLTAuNTUyMiwwLTEtMC40NDczLTEtMXYtOWMwLTAuNTUyNywwLjQ0NzgtMSwxLTFoMTNjMC41NTI3LDAsMSwwLjQ0NzMsMSwxdjkgICAgQzMxLDMwLjU1MjcsMzAuNTUyNywzMSwzMCwzMXogTTE4LDI5aDExdi03SDE4VjI5eiIgZmlsbD0iIzAxODFCMCIvPjwvZz48Zz48cGF0aCBkPSJNMjYsOGgtOGMtMC41NTI3LDAtMSwwLjQ0NzMtMSwxczAuNDQ3MywxLDEsMWg3djZjMCwwLjU1MjcsMC40NDczLDEsMSwxczEtMC40NDczLDEtMVY5ICAgIEMyNyw4LjQ0NzMsMjYuNTUyNyw4LDI2LDh6IiBmaWxsPSIjMDBBQ0JBIi8+PGc+PHBhdGggZD0iTTIwLDEyYy0wLjI1NTksMC0wLjUxMTctMC4wOTc3LTAuNzA3LTAuMjkzbC0yLTJjLTAuMzkwNi0wLjM5MDYtMC4zOTA2LTEuMDIzNCwwLTEuNDE0MWwyLTIgICAgIGMwLjM5MDYtMC4zOTA2LDEuMDIzNC0wLjM5MDYsMS40MTQxLDBzMC4zOTA2LDEuMDIzNCwwLDEuNDE0MUwxOS40MTQxLDlsMS4yOTMsMS4yOTNjMC4zOTA2LDAuMzkwNiwwLjM5MDYsMS4wMjM0LDAsMS40MTQxICAgICBDMjAuNTExNywxMS45MDIzLDIwLjI1NTksMTIsMjAsMTJ6IiBmaWxsPSIjRjVEODAzIi8+PC9nPjwvZz48Zz48cGF0aCBkPSJNMTQsMjVIN3YtNmMwLTAuNTUyNy0wLjQ0NzgtMS0xLTFzLTEsMC40NDczLTEsMXY3YzAsMC41NTI3LDAuNDQ3OCwxLDEsMWg4YzAuNTUyMiwwLDEtMC40NDczLDEtMSAgICBTMTQuNTUyMiwyNSwxNCwyNXoiIGZpbGw9IiMwMEFDQkEiLz48Zz48cGF0aCBkPSJNMTIsMjljLTAuMjU1OSwwLTAuNTExNy0wLjA5NzctMC43MDctMC4yOTNjLTAuMzkwNi0wLjM5MDYtMC4zOTA2LTEuMDIzNCwwLTEuNDE0MUwxMi41ODU5LDI2ICAgICBsLTEuMjkzLTEuMjkzYy0wLjM5MDYtMC4zOTA2LTAuMzkwNi0xLjAyMzQsMC0xLjQxNDFzMS4wMjM0LTAuMzkwNiwxLjQxNDEsMGwyLDJjMC4zOTA2LDAuMzkwNiwwLjM5MDYsMS4wMjM0LDAsMS40MTQxbC0yLDIgICAgIEMxMi41MTE3LDI4LjkwMjMsMTIuMjU1OSwyOSwxMiwyOXoiIGZpbGw9IiNGNUQ4MDMiLz48L2c+PC9nPjwvZz48ZyBpZD0iTGF5ZXJfNSIvPjxnIGlkPSJMYXllcl82Ii8+PGcgaWQ9IkxheWVyXzciLz48ZyBpZD0iTGF5ZXJfOCIvPjxnIGlkPSJMYXllcl85Ii8+PGcgaWQ9IkxheWVyXzEwIi8+PGcgaWQ9IkxheWVyXzExIi8+PGcgaWQ9IkxheWVyXzEyIi8+PGcgaWQ9IkxheWVyXzEzIi8+PGcgaWQ9IkxheWVyXzE0Ii8+PGcgaWQ9IkxheWVyXzE1Ii8+PGcgaWQ9IkxheWVyXzE2Ii8+PGcgaWQ9IkxheWVyXzE3Ii8+PGcgaWQ9IkxheWVyXzE4Ii8+PGcgaWQ9IkxheWVyXzE5Ii8+PGcgaWQ9IkxheWVyXzIwIi8+PGcgaWQ9IkxheWVyXzIxIi8+PGcgaWQ9IkxheWVyXzIyIi8+PGcgaWQ9IkxheWVyXzIzIi8+PGcgaWQ9IkxheWVyXzI0Ii8+PGcgaWQ9IkxheWVyXzI1Ii8+PGcgaWQ9IkxheWVyXzI2Ii8+PC9zdmc+',
 
@@ -32,25 +54,33 @@ let opt = {
 
 let getUserByToken = async (token) => {
     // return {} //測試無法登入
-    if (token === '{token-for-application}') { //提供外部應用系統作為存取使用者
-        return {
-            id: 'id-for-application',
-            name: 'application',
-            email: 'application@example.com',
-            isAdmin: 'y',
-        }
+    //'sys' 為開發捷徑（w-ui-loginout 於 localhost 自動帶入）。加環境守門：NODE_ENV==='production' 時不接受，
+    //避免 srv.mjs 若作正式入口時 'sys' 成為遠端管理員後門。e2e/dev 未設 NODE_ENV=production 故仍可用；
+    //正式部署設 NODE_ENV=production 即停用此捷徑（並應改提供真實 getUserByToken）。
+    if (token === 'sys' && process.env.NODE_ENV !== 'production') {
+        return { id: 'id-for-admin', name: '測試者', email: 'admin@example.com', isAdmin: 'y' }
+    }
+    //未設定 SSO app token 時(本機開發未接SSO), 不打SSO直接拒絕
+    if (!ssoAppToken) {
+        console.log('ssoAppToken 未設定, 略過 SSO 驗證')
+        return {}
     }
-    if (token === 'sys') { //開發階段w-ui-loginout自動給予browser使用者(且位於localhost)的token為sys
-        return {
-            id: 'id-for-admin',
-            name: '測試者',
-            email: 'admin@example.com',
-            isAdmin: 'y',
+    //呼叫 SSO 解析 token -> user
+    try {
+        let url = `${ssoBaseUrl}/api/getSsoUserInfor?token=${encodeURIComponent(ssoAppToken)}&key=token&value=${encodeURIComponent(token)}`
+        let res = await axios.get(url)
+        let state = get(res, 'data.state', '')
+        let u = get(res, 'data.msg', null)
+        if (state !== 'success' || !iseobj(u)) {
+            console.log('SSO getSsoUserInfor 失敗', state)
+            return {}
         }
+        return { id: u.id, name: u.name, email: u.email, isAdmin: u.isAdmin }
+    }
+    catch (err) {
+        console.log('SSO getSsoUserInfor error', err.message)
+        return {}
     }
-    console.log('invalid token', token)
-    console.log('於生產環境時得加入SSO等驗證token機制')
-    return {}
 }
 
 let verifyClientUser = (user, from) => {

package/tableTags.json

@@ -1 +1 @@
-{"apis":"2026-03-28T23:37:07+08:00|m2kF53"}
+{"apis":"2026-07-11T17:47:54+08:00|7AQq2D"}