w-web-api 1.0.53 → 1.0.55

package/server/staLogs/staEvent.mjs

@@ -9,6 +9,7 @@ import genPm from 'wsemi/src/genPm.mjs'
 import isestr from 'wsemi/src/isestr.mjs'
 import fsTreeFolder from 'wsemi/src/fsTreeFolder.mjs'
 import fsBuildReadStreamText from 'wsemi/src/fsBuildReadStreamText.mjs'
+import filterVpfsByWindow from './filterVpfsByWindow.mjs'
 
 
 //staEvent（通用事件頻率統計，骨架移植自 w-web-sso server/staLogs/staIp.mjs，但「不過濾特定 event」、
@@ -25,13 +26,13 @@ import fsBuildReadStreamText from 'wsemi/src/fsBuildReadStreamText.mjs'
 //參數：
 //  timeLength   往回統計天數（預設 7）
 //  timeInterval 時間粒度 'hr'（每小時，預設）/ 'day'（每日）
-//  opt.fdLog    log 資料夾（預設 './_logs'，須與 srLog 寫入之 logFd 一致；e2e 可指向合成 log 達 hermetic）
+//  opt.fdLog    log 資料夾（預設 './logs'，須與 srLog 寫入之 logFd 一致；e2e 可指向合成 log 達 hermetic）
 async function staEvent(timeLength = 7, timeInterval = 'hr', opt = {}) {
 
     //fdLog
     let fdLog = get(opt, 'fdLog')
     if (!isestr(fdLog)) {
-        fdLog = './_logs'
+        fdLog = './logs'
     }
 
     //fmt
@@ -53,6 +54,7 @@ async function staEvent(timeLength = 7, timeInterval = 'hr', opt = {}) {
 
     //vpfs
     let vpfs = fsTreeFolder(fdLog)
+    vpfs = filterVpfsByWindow(vpfs, tStart, fmt) //開檔前剔除窗外檔, 見該模組註解
 
     //logs（逐檔逐行 stream parse，挑出 tStart 之後、且帶 event 字串者）
     let logs = []

package/server/staLogs/test_staEvent.mjs

@@ -10,9 +10,10 @@ import fs from 'fs'
 import path from 'path'
 import ot from 'dayjs'
 import staEvent from './staEvent.mjs'
+import filterVpfsByWindow from './filterVpfsByWindow.mjs'
 
 
-//tmp log 資料夾（落在主 cwd ./tmp/，集中可一鍵清；不污染真實 ./_logs）
+//tmp log 資料夾（落在主 cwd ./tmp/，集中可一鍵清；不污染真實 ./logs）
 let fdLog = './tmp/_logs-test-staEvent'
 
 //以「當前小時正中（:30）」為錨點，避免測試剛好跨小時邊界導致 bucket 飄移
@@ -71,6 +72,67 @@ function findBucket(rs, time) {
 }
 
 
+//testFilterVpfsByWindowDirect：直測 filterVpfsByWindow「粒度自適應」防線（filterVpfsByWindow.mjs:22），
+//以自造 vpfs 物件陣列覆蓋 P-2 要求之三個分支，不經 staEvent／fsTreeFolder。
+function testFilterVpfsByWindowDirect() {
+
+    //tStart 固定為 2026-07-08 21:00，keyStart（fmt='YYYY-MM-DDTHH'）= '2026-07-08T21'
+    let tStart = ot('2026-07-08T21:00:00')
+    let fmtHr2 = 'YYYY-MM-DDTHH'
+
+    //①day 粒度檔名（10 字元）× fmt='YYYY-MM-DDTHH'，且 tStart 落在該日內 → 應保留。
+    //對應規格：filterVpfsByWindow.mjs:11-14 註解——不 slice 則 '2026-07-08' < '2026-07-08T21'（同日
+    //字典序比較，短字串為前綴恆較小）誤判窗外漏讀整天；filterVpfsByWindow.mjs:22 之
+    //`bn >= keyStart.slice(0, bn.length)` 為此案例之防線（slice 後同為 '2026-07-08'，相等即保留）。
+    let vpfDaySameDate = { path: '/x/2026-07-08.log', name: '2026-07-08.log', isFolder: false, level: 1 }
+    let rs1 = filterVpfsByWindow([vpfDaySameDate], tStart, fmtHr2)
+    assert.strictEqual(rs1.length, 1, 'day 粒度同日檔名（10 字元）於 hr fmt（13 字元）下應被保留')
+
+    //②明確窗外之 hr 檔名（早於 tStart 所在小時）→ 應剔除。
+    //對應規格：filterVpfsByWindow.mjs:22 主邏輯 `bn >= keyStart.slice(0, bn.length)`——
+    //bn 與 keyStart 同為 hr 粒度（13 字元）時 slice 為 no-op，純字串比較即可判窗外。
+    let vpfHrBefore = { path: '/x/2026-07-08T10.log', name: '2026-07-08T10.log', isFolder: false, level: 1 }
+    let rs2 = filterVpfsByWindow([vpfHrBefore], tStart, fmtHr2)
+    assert.strictEqual(rs2.length, 0, '明確窗外（早於 tStart 小時）之 hr 檔名應被剔除')
+
+    //③非 ISO 前綴檔名 → fail-open 保留。
+    //對應規格：filterVpfsByWindow.mjs:9,19-20 註解——「fail-open: 檔名不符 ISO 前綴者一律保留
+    //（寧可多讀, 不可漏讀）」。
+    let vpfNonIso = { path: '/x/current.log', name: 'current.log', isFolder: false, level: 1 }
+    let rs3 = filterVpfsByWindow([vpfNonIso], tStart, fmtHr2)
+    assert.strictEqual(rs3.length, 1, '非 ISO 前綴檔名應 fail-open 保留')
+
+    console.log('=== testFilterVpfsByWindowDirect PASS ===')
+}
+
+
+//testGranularityAdaptiveIntegration：整合路徑驗證——srLog 之 logInterval（決定檔名粒度）與 staLogs 之
+//timeInterval（決定 fmt）不同調時（day 粒度檔名 × hr 粒度 fmt），窗內事件仍須被 staEvent 讀到。
+//對應規格：filterVpfsByWindow.mjs:11-14 註解之情境重現於整合路徑（經 fsTreeFolder + fsBuildReadStreamText
+//實際開檔讀行），證明 filterVpfsByWindow.mjs:22 之 slice 防線在 staEvent.mjs:57 呼叫處確實生效，
+//而非僅單元測試層級成立。
+async function testGranularityAdaptiveIntegration() {
+    let fdLog2 = './tmp/_logs-test-staEvent-granularity'
+    fs.rmSync(fdLog2, { recursive: true, force: true })
+    fs.mkdirSync(fdLog2, { recursive: true })
+
+    //tRef 近似 staEvent 內部之 tStart（timeLength=0 → tStart ≈ now）；day 粒度檔名（10 字元）＝ tRef 當日
+    let tRef = ot()
+    let dayFileName = `${tRef.format('YYYY-MM-DD')}.log`
+    let tEvent = tRef.add(5, 'second') //晚於 tStart，使 staEvent.mjs:76 之 per-line `t.isAfter(tStart)` 成立
+    let lines = [logLine(tEvent, 'granularityProbe')]
+    fs.writeFileSync(path.join(fdLog2, dayFileName), lines.join('\n') + '\n', 'utf8')
+
+    let rsG = await staEvent(0, 'hr', { fdLog: fdLog2 })
+    let totalG = rsG.reduce((acc, v) => acc + v.data.count, 0)
+    assert.strictEqual(totalG, 1, 'day 粒度檔名於 hr timeInterval 下，窗內事件應被 staEvent 計入（不被誤判窗外漏讀）')
+
+    fs.rmSync(fdLog2, { recursive: true, force: true })
+
+    console.log('=== testGranularityAdaptiveIntegration PASS ===')
+}
+
+
 async function main() {
 
     writeSyntheticLogs()
@@ -119,6 +181,10 @@ async function main() {
     //清理
     fs.rmSync(fdLog, { recursive: true, force: true })
 
+    //=== 粒度自適應防線（P-2）===
+    testFilterVpfsByWindowDirect()
+    await testGranularityAdaptiveIntegration()
+
     console.log('=== test_staEvent PASS ===')
     console.log(`hr buckets: ${rs.length}, 本小時=${JSON.stringify(bNow.data)}, 前一小時=${JSON.stringify(bPrev.data)}`)
 }

package/settings.json

@@ -11,4 +11,8 @@
 
     // 伺服器通訊 port
     serverPort: 11005,
+    
+    logFd: './logs',
+    logInterval: 'hr',
+
 }

package/src/components/Layout.vue

@@ -106,7 +106,7 @@ export default {
             let showLanguage = get(vo, 'webInfor.showLanguage', '')
             // console.log('showLanguage', showLanguage)
             vo.showLangSelect = showLanguage === 'y'
-            //setLang(null)：改走 getLang 解析（URL ?lang= > store > window 注入之 server 語系），
+            //setLang(null)：改走 getLang 解析（URL ?lang= > window 注入之 server 語系 > store），
             //不再用 webInfor.language 明確覆蓋（否則會蓋掉 URL ?lang= 與使用者切換）。server 初始語系已由
             //window.___pmwperm___.language（WWebApi 注入 index.html）提供，getLang 會取得。
             vo.$ui.setLang(null, 'layout mounted')
@@ -116,10 +116,6 @@ export default {
     },
     computed: {
 
-        viewState: function() {
-            return get(this, `$store.state.viewState`, '')
-        },
-
         heightToolbar: function() {
             //console.log('computed heightToolbar')
 
@@ -128,11 +124,6 @@ export default {
             return get(vo, `$store.state.heightToolbar`, 0)
         },
 
-        userToken: function() {
-            let vo = this
-            return get(vo, `$store.state.userToken`)
-        },
-
         lang: function() {
             let vo = this
             return get(vo, `$store.state.lang`, '')
@@ -168,16 +159,6 @@ export default {
             return get(vo, `$store.state.webInfor.webLogo`, '')
         },
 
-        userSelf: function() {
-            let vo = this
-            return get(vo, `$store.state.userSelf`, '')
-        },
-
-        userName: function() {
-            let vo = this
-            return get(vo, `userSelf.name`, '')
-        },
-
     },
     methods: {
 

package/src/components/LayoutContent.vue

@@ -286,7 +286,6 @@ import filter from 'lodash-es/filter.js'
 import cloneDeep from 'lodash-es/cloneDeep.js'
 import isobj from 'wsemi/src/isobj.mjs'
 import iseobj from 'wsemi/src/iseobj.mjs'
-import timemsTZ2day from 'wsemi/src/timemsTZ2day.mjs'
 import convertToTree from 'wsemi/src/convertToTree.mjs'
 import { mdiArrowLeft, mdiArrowRight, mdiCloudBraces, mdiChartBar } from '@mdi/js'
 import WButtonCircle from 'w-component-vue/src/components/WButtonCircle.vue'
@@ -338,13 +337,6 @@ export default {
             mdiArrowRight,
             apiSelect: null,
 
-            kpColorMethod: {
-                GET: '#0082d0',
-                POST: '#069061',
-                PUT: '#ff5800',
-                DEL: '#ef0006',
-            },
-
             //API 管理：模式切換 / 新增 / 搜尋
             mode: 'docs', //'docs' | 'edit' | 'test'
             newMode: false,
@@ -509,24 +501,6 @@ export default {
             return method
         },
 
-        getMethodColor: function(item) {
-            let vo = this
-            let method = vo.getMethod(item)
-            let color = get(vo.kpColorMethod, method, '#888')
-            return color
-        },
-
-        getMethodColorByKey: function(key) {
-            let vo = this
-            let method = vo.getMethodByKey(key)
-            let color = get(vo.kpColorMethod, method, '#888')
-            return color
-        },
-
-        getDay: function(t) {
-            return timemsTZ2day(t)
-        },
-
         jsonHighlight: function(str) {
             let s = (str === null || str === undefined) ? '' : String(str)
             // escape HTML

package/src/components/LayoutContentEdit.vue

@@ -341,7 +341,7 @@ export default {
         onClickSave: function() {
             let vo = this
             vo.submitSave()
-                .catch(function(err) { console.log('catch', err); vo.$alert(vo.$t('anUnexpectedErrorOccurred'), 'error') })
+                .catch(function(err) { console.log('catch', err); vo.$alert(vo.$t('anUnexpectedErrorOccurred'), { type: 'error' }) })
                 .finally(function() { vo.$ui.updateLoading(false) })
         },
 
@@ -435,7 +435,7 @@ export default {
 
             }
             core()
-                .catch(function(err) { console.log('catch', err); vo.$alert(vo.$t('anUnexpectedErrorOccurred'), 'error') })
+                .catch(function(err) { console.log('catch', err); vo.$alert(vo.$t('anUnexpectedErrorOccurred'), { type: 'error' }) })
                 .finally(function() { vo.$ui.updateLoading(false) })
         },
 

package/src/components/LayoutContentTest.vue

@@ -372,24 +372,6 @@ export default {
             return get(kpColorMethod, method, 'var(--c-2)')
         },
 
-        getStatusColor: function(status) {
-            // let vo = this
-            let s = parseInt(status, 10)
-            if (s >= 200 && s < 300) {
-                return '#2a2'
-            }
-            if (s >= 300 && s < 400) {
-                return '#68f'
-            }
-            if (s >= 400 && s < 500) {
-                return '#f82'
-            }
-            if (s >= 500) {
-                return '#f26'
-            }
-            return '#888'
-        },
-
         jsonToRows: function(jsonStr) {
             // let vo = this
             let rows = []
@@ -605,7 +587,7 @@ export default {
             core()
                 .catch(function(err) {
                     console.log('catch', err)
-                    vo.$alert(vo.$t('anUnexpectedErrorOccurred'), 'error')
+                    vo.$alert(vo.$t('anUnexpectedErrorOccurred'), { type: 'error' })
                 })
                 .finally(function() {
                     vo.sending = false

package/src/main.js

@@ -13,8 +13,6 @@ import domDragDrop from 'w-component-vue/src/js/domDragDrop.mjs'
 import App from './App.vue'
 import store from './store/index.mjs'
 import ui from './plugins/mUI.mjs'
-import mDataSelectorSchema from './plugins/mDataSelectorSchema.mjs'
-import * as s from './plugins/mShare.mjs'
 import ds from './schema/index.mjs'
 // console.log('globalState', globalState)
 // console.log('ds', ds)
@@ -32,9 +30,6 @@ Vue.prototype.$alert = function() {
     }
 }
 
-//dssm
-let dssm = mDataSelectorSchema(ds)
-
 //prototype
 Vue.prototype.$ui = ui
 Vue.prototype.$t = ui.getKpText
@@ -45,8 +40,6 @@ Vue.prototype.$transErr = (err) => {
     let msg = ui.getKpText(key)
     return (msg && msg !== key) ? msg : ui.getKpText('anUnexpectedErrorOccurred')
 }
-Vue.prototype.$s = s
-Vue.prototype.$dssm = dssm
 Vue.prototype.$ds = ds
 Vue.prototype.$dg = {}
 
@@ -87,7 +80,9 @@ WServHapiClient({
 
             })
             .catch((err) => {
-                console.log(err)
+                console.log('getWebInfor failed', err)
+                //getWebInfor 失敗時導向連線錯誤態，避免 ready(需 webInfor) 永假而卡在「已登入」轉圈無回饋
+                ui.updateConnState('csErrConn')
             })
 
     },

package/src/plugins/mUI.mjs

@@ -1,47 +1,12 @@
 import Vue from 'vue'
-import min from 'lodash-es/min.js'
-import size from 'lodash-es/size.js'
-import take from 'lodash-es/take.js'
-import isEqual from 'lodash-es/isEqual.js'
-import uniq from 'lodash-es/uniq.js'
-import set from 'lodash-es/set.js'
 import get from 'lodash-es/get.js'
 import each from 'lodash-es/each.js'
-import map from 'lodash-es/map.js'
-import filter from 'lodash-es/filter.js'
-import last from 'lodash-es/last.js'
-import split from 'lodash-es/split.js'
-import join from 'lodash-es/join.js'
-import drop from 'lodash-es/drop.js'
-import dropRight from 'lodash-es/dropRight.js'
-import groupBy from 'lodash-es/groupBy.js'
-import sortBy from 'lodash-es/sortBy.js'
 import cloneDeep from 'lodash-es/cloneDeep.js'
-import cint from 'wsemi/src/cint.mjs'
 import delay from 'wsemi/src/delay.mjs'
-import isarr from 'wsemi/src/isarr.mjs'
 import isestr from 'wsemi/src/isestr.mjs'
 import isfun from 'wsemi/src/isfun.mjs'
 import iseobj from 'wsemi/src/iseobj.mjs'
-import isearr from 'wsemi/src/isearr.mjs'
-import isEle from 'wsemi/src/isEle.mjs'
-import strleft from 'wsemi/src/strleft.mjs'
-import strdelleft from 'wsemi/src/strdelleft.mjs'
-import sep from 'wsemi/src/sep.mjs'
-import aes2str from 'wsemi/src/aes2str.mjs'
-import str2aes from 'wsemi/src/str2aes.mjs'
-import haskey from 'wsemi/src/haskey.mjs'
-import genPm from 'wsemi/src/genPm.mjs'
-import pmSeries from 'wsemi/src/pmSeries.mjs'
 import waitFun from 'wsemi/src/waitFun.mjs'
-import browserView from 'wsemi/src/browserView.mjs'
-import arrHas from 'wsemi/src/arrHas.mjs'
-import arrSort from 'wsemi/src/arrSort.mjs'
-import arrInsert from 'wsemi/src/arrInsert.mjs'
-import replace from 'wsemi/src/replace.mjs'
-import timemsTZ2past from 'wsemi/src/timemsTZ2past.mjs'
-import convertToTree from 'wsemi/src/convertToTree.mjs'
-// import WUiDwload from 'w-ui-dwload/src/WUiDwload.mjs'
 
 
 let kpFallback = {

package/src/store/mutations.mjs

@@ -79,12 +79,6 @@ export let mutations = {
         state[msg.tableName] = msg.data
     },
 
-    [types.UpdateData] (state, msg) {
-        //msg.path內為存取路徑, 需使用set處理
-        // console.log('UpdateData msg', msg)
-        set(state, msg.path, msg.data)
-    },
-
     [types.UpdateHeightApp] (state, heightApp) {
         state.heightApp = heightApp
     },
@@ -93,14 +87,6 @@ export let mutations = {
         state.heightAppEff = heightAppEff
     },
 
-    [types.UpdateHeightToolbar] (state, heightToolbar) {
-        state.heightToolbar = heightToolbar
-    },
-
-    [types.UpdateMenu] (state, menu) {
-        state.menu = menu
-    },
-
     [types.UpdateUserToken] (state, userToken) {
         state.userToken = userToken
     },

package/src/store/types.mjs

@@ -6,10 +6,7 @@ export const UpdateSyncState = 'UpdateSyncState'
 export const UpdateLoading = 'UpdateLoading'
 // export const UpdateViewState = 'UpdateViewState'
 export const UpdateTableData = 'UpdateTableData'
-export const UpdateData = 'UpdateData'
 export const UpdateHeightApp = 'UpdateHeightApp'
 export const UpdateHeightAppEff = 'UpdateHeightAppEff'
-export const UpdateHeightToolbar = 'UpdateHeightToolbar'
-export const UpdateMenu = 'UpdateMenu'
 export const UpdateUserToken = 'UpdateUserToken'
 export const UpdateUserSelf = 'UpdateUserSelf'

package/srv.mjs

@@ -37,7 +37,7 @@ let opt = {
     language: get(stApp, 'language', 'eng'),
 
     //log 資料夾與輪檔間隔（srLog 寫入 + staEvent 統計皆讀此）。e2e 可用 genTempSettings({logFd}) 指向合成 log 達 hermetic。
-    logFd: get(stApp, 'logFd', './_logs'),
+    logFd: get(stApp, 'logFd', './logs'),
     logInterval: get(stApp, 'logInterval', 'hr'),
 
     webName: {
@@ -46,7 +46,7 @@ let opt = {
     },
     webDescription: {
         'eng': 'A web service package as methods to send requests to and receive responses from an API.',
-        'cht': 'A web service package as methods to send requests to and receive responses from an API.',
+        'cht': '一套以方法形式，用於發送請求至API並接收其回應的網頁服務套件。',
     },
     webLogo: 'data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSBzdmcgIFBVQkxJQyAnLS8vVzNDLy9EVEQgU1ZHIDEuMS8vRU4nICAnaHR0cDovL3d3dy53My5vcmcvR3JhcGhpY3MvU1ZHLzEuMS9EVEQvc3ZnMTEuZHRkJz48c3ZnIGVuYWJsZS1iYWNrZ3JvdW5kPSJuZXcgMCAwIDMyIDMyIiB2ZXJzaW9uPSIxLjEiIHZpZXdCb3g9IjAgMCAzMiAzMiIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxuczp4bGluaz0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94bGluayI+PGcgaWQ9IkxheWVyXzIiLz48ZyBpZD0iTGF5ZXJfMyIvPjxnIGlkPSJMYXllcl80Ij48Zz48cGF0aCBkPSJNOS4wMiw2QzkuMDEyNyw2LDkuMDA2OCw1Ljk5OSw5LDZIMkMxLjQ0NzgsNiwxLDUuNTUyNywxLDVWMmMwLTAuNTUyNywwLjQ0NzgtMSwxLTFoNiAgICBjMC40MzA3LDAsMC44MTI1LDAuMjc1NCwwLjk0ODcsMC42ODM2bDAuOTQwNCwyLjgyMTNDOS45NzIyLDQuNjUxNCwxMC4wMiw0LjgyMDMsMTAuMDIsNUMxMC4wMiw1LjU1MjcsOS41NzIzLDYsOS4wMiw2eiBNMyw0ICAgIGg0LjYxMjhMNy4yNzkzLDNIM1Y0eiIgZmlsbD0iI0Y1RDgwMyIvPjwvZz48Zz48cGF0aCBkPSJNMjQuMDE5NSwyMmMtMC4wMDM5LDAtMC4wMTE3LDAuMDAxLTAuMDE5NSwwaC03Yy0wLjU1MjIsMC0xLTAuNDQ3My0xLTF2LTNjMC0wLjU1MjcsMC40NDc4LTEsMS0xaDYgICAgYzAuNDMwNywwLDAuODEyNSwwLjI3NTQsMC45NDgyLDAuNjgzNmwwLjk0MDQsMi44MjEzYzAuMDg0LDAuMTQ2NSwwLjEzMDksMC4zMTU0LDAuMTMwOSwwLjQ5NTEgICAgQzI1LjAxOTUsMjEuNTUyNywyNC41NzIzLDIyLDI0LjAxOTUsMjJ6IE0xOCwyMGg0LjYxMjNsLTAuMzMzLTFIMThWMjB6IiBmaWxsPSIjRjVEODAzIi8+PC9nPjxnPjxwYXRoIGQ9Ik0xNSwxNUgyYy0wLjU1MjIsMC0xLTAuNDQ3My0xLTFWNWMwLTAuNTUyNywwLjQ0NzgtMSwxLTFoMTNjMC41NTIyLDAsMSwwLjQ0NzMsMSwxdjkgICAgQzE2LDE0LjU1MjcsMTUuNTUyMiwxNSwxNSwxNXogTTMsMTNoMTFWNkgzVjEzeiIgZmlsbD0iIzAxODFCMCIvPjwvZz48Zz48cGF0aCBkPSJNMzAsMzFIMTdjLTAuNTUyMiwwLTEtMC40NDczLTEtMXYtOWMwLTAuNTUyNywwLjQ0NzgtMSwxLTFoMTNjMC41NTI3LDAsMSwwLjQ0NzMsMSwxdjkgICAgQzMxLDMwLjU1MjcsMzAuNTUyNywzMSwzMCwzMXogTTE4LDI5aDExdi03SDE4VjI5eiIgZmlsbD0iIzAxODFCMCIvPjwvZz48Zz48cGF0aCBkPSJNMjYsOGgtOGMtMC41NTI3LDAtMSwwLjQ0NzMtMSwxczAuNDQ3MywxLDEsMWg3djZjMCwwLjU1MjcsMC40NDczLDEsMSwxczEtMC40NDczLDEtMVY5ICAgIEMyNyw4LjQ0NzMsMjYuNTUyNyw4LDI2LDh6IiBmaWxsPSIjMDBBQ0JBIi8+PGc+PHBhdGggZD0iTTIwLDEyYy0wLjI1NTksMC0wLjUxMTctMC4wOTc3LTAuNzA3LTAuMjkzbC0yLTJjLTAuMzkwNi0wLjM5MDYtMC4zOTA2LTEuMDIzNCwwLTEuNDE0MWwyLTIgICAgIGMwLjM5MDYtMC4zOTA2LDEuMDIzNC0wLjM5MDYsMS40MTQxLDBzMC4zOTA2LDEuMDIzNCwwLDEuNDE0MUwxOS40MTQxLDlsMS4yOTMsMS4yOTNjMC4zOTA2LDAuMzkwNiwwLjM5MDYsMS4wMjM0LDAsMS40MTQxICAgICBDMjAuNTExNywxMS45MDIzLDIwLjI1NTksMTIsMjAsMTJ6IiBmaWxsPSIjRjVEODAzIi8+PC9nPjwvZz48Zz48cGF0aCBkPSJNMTQsMjVIN3YtNmMwLTAuNTUyNy0wLjQ0NzgtMS0xLTFzLTEsMC40NDczLTEsMXY3YzAsMC41NTI3LDAuNDQ3OCwxLDEsMWg4YzAuNTUyMiwwLDEtMC40NDczLDEtMSAgICBTMTQuNTUyMiwyNSwxNCwyNXoiIGZpbGw9IiMwMEFDQkEiLz48Zz48cGF0aCBkPSJNMTIsMjljLTAuMjU1OSwwLTAuNTExNy0wLjA5NzctMC43MDctMC4yOTNjLTAuMzkwNi0wLjM5MDYtMC4zOTA2LTEuMDIzNCwwLTEuNDE0MUwxMi41ODU5LDI2ICAgICBsLTEuMjkzLTEuMjkzYy0wLjM5MDYtMC4zOTA2LTAuMzkwNi0xLjAyMzQsMC0xLjQxNDFzMS4wMjM0LTAuMzkwNiwxLjQxNDEsMGwyLDJjMC4zOTA2LDAuMzkwNiwwLjM5MDYsMS4wMjM0LDAsMS40MTQxbC0yLDIgICAgIEMxMi41MTE3LDI4LjkwMjMsMTIuMjU1OSwyOSwxMiwyOXoiIGZpbGw9IiNGNUQ4MDMiLz48L2c+PC9nPjwvZz48ZyBpZD0iTGF5ZXJfNSIvPjxnIGlkPSJMYXllcl82Ii8+PGcgaWQ9IkxheWVyXzciLz48ZyBpZD0iTGF5ZXJfOCIvPjxnIGlkPSJMYXllcl85Ii8+PGcgaWQ9IkxheWVyXzEwIi8+PGcgaWQ9IkxheWVyXzExIi8+PGcgaWQ9IkxheWVyXzEyIi8+PGcgaWQ9IkxheWVyXzEzIi8+PGcgaWQ9IkxheWVyXzE0Ii8+PGcgaWQ9IkxheWVyXzE1Ii8+PGcgaWQ9IkxheWVyXzE2Ii8+PGcgaWQ9IkxheWVyXzE3Ii8+PGcgaWQ9IkxheWVyXzE4Ii8+PGcgaWQ9IkxheWVyXzE5Ii8+PGcgaWQ9IkxheWVyXzIwIi8+PGcgaWQ9IkxheWVyXzIxIi8+PGcgaWQ9IkxheWVyXzIyIi8+PGcgaWQ9IkxheWVyXzIzIi8+PGcgaWQ9IkxheWVyXzI0Ii8+PGcgaWQ9IkxheWVyXzI1Ii8+PGcgaWQ9IkxheWVyXzI2Ii8+PC9zdmc+',
 
@@ -54,8 +54,10 @@ let opt = {
 
 let getUserByToken = async (token) => {
     // return {} //測試無法登入
-    //開發階段 w-ui-loginout 於 localhost 自動給 token 'sys'
-    if (token === 'sys') {
+    //'sys' 為開發捷徑（w-ui-loginout 於 localhost 自動帶入）。加環境守門：NODE_ENV==='production' 時不接受，
+    //避免 srv.mjs 若作正式入口時 'sys' 成為遠端管理員後門。e2e/dev 未設 NODE_ENV=production 故仍可用；
+    //正式部署設 NODE_ENV=production 即停用此捷徑（並應改提供真實 getUserByToken）。
+    if (token === 'sys' && process.env.NODE_ENV !== 'production') {
         return { id: 'id-for-admin', name: '測試者', email: 'admin@example.com', isAdmin: 'y' }
     }
     //未設定 SSO app token 時(本機開發未接SSO), 不打SSO直接拒絕

package/tableTags.json

@@ -1 +1 @@
-{"apis":"2026-06-22T12:43:06+08:00|Yl6xfX"}
+{"apis":"2026-07-11T17:47:54+08:00|7AQq2D"}