w-web-api 1.0.53 → 1.0.56

package/docs/WWebApi.html

@@ -885,7 +885,7 @@
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Mon Jun 22 2026 15:42:09 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Thu Jul 23 2026 11:40:34 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/index.html

@@ -71,7 +71,7 @@
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Mon Jun 22 2026 15:42:09 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Thu Jul 23 2026 11:40:34 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/server_WWebApi.mjs.html

@@ -277,7 +277,7 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
     //params
     let showLanguage = get(opt, 'showLanguage', 'y')
     let language = get(opt, 'language', 'eng')
-    let logFd = get(opt, 'logFd', './_logs') //srLog 寫入 + staEvent 統計共用之 log 資料夾
+    let logFd = get(opt, 'logFd', './logs') //srLog 寫入 + staEvent 統計共用之 log 資料夾
 
 
     //kpLangExt
@@ -299,7 +299,9 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
         wp = WServOrm(ds, WOrm, url, db, optWServOrm)
     }
     catch (err) {
-        console.log(err)
+        //ORM 為必要依賴：初始化失敗即 fail-fast，不以 wp={} 帶 undefined woItems/procOrm 殘缺啟動（與建構子其餘必要依賴一致）
+        console.log('WServOrm init failed', err)
+        throw err
     }
     let { woItems, procOrm } = wp
 
@@ -307,6 +309,9 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
     //srLog（後端 log；錯誤一律 log err-key 供識別，對齊 w-web-sso）
     let srLog = srLogInit(opt)
 
+    //maskTok：debug console.log 不印完整 token/authorization（憑證），僅前 4 碼 + ***，避免憑證落入 stdout
+    let maskTok = (t) => isestr(t) ? (strleft(t, 4) + '***') : t
+
     //kpFunExt 邊界統一處理：成功記 info（供 staEvent 統計呼叫頻率）；catch 後端錯誤 → srLog 該 err-key →
     //原樣 re-reject（前端依 key 查自己 lang 顯示）。event 統一加 'kpfun-' 前綴 → 專用事件、與 api/verifyConn 區分。
     let wrapErrLog = (event, fn) => {
@@ -390,14 +395,7 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
         }
 
         //check
-        if (true) {
-            // if (!iseobj(userSelf)) {
-            //     console.log(`token`, token)
-            //     console.log(`can not find the user from token`)
-            //     return Promise.reject('errUserNotFound')
-            // }
-            await checkUser(userSelf)
-        }
+        await checkUser(userSelf)
 
         return userSelf
     }
@@ -673,9 +671,8 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
                     //check
                     if (!isestr(token)) {
                         console.log('req.query', get(req, 'query'))
-                        console.log('token', token)
+                        console.log('token', maskTok(token))
                         console.log('[API]getUserByToken/check token: invalid token')
-                        console.log(`token does not have permission`)
                         return Promise.reject('errTokenNoPermission')
                     }
 
@@ -684,9 +681,8 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
 
                     //check
                     if (!iseobj(user)) {
-                        console.log('token', token)
+                        console.log('token', maskTok(token))
                         console.log('[API]getUserByToken/check user: invalid user')
-                        console.log(`token does not have permission`)
                         return Promise.reject('errTokenNoPermission')
                     }
 
@@ -721,7 +717,6 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
         //                 console.log('req.query', get(req, 'query'))
         //                 console.log('token', token)
         //                 console.log('[API]getAPIsList/check token: invalid token')
-        //                 console.log(`token does not have permission`)
         //                 return Promise.reject('errTokenNoPermission')
         //             }
 
@@ -732,7 +727,6 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
         //             if (!iseobj(user)) {
         //                 console.log('token', token)
         //                 console.log('[API]getAPIsList/check user: invalid user')
-        //                 console.log(`token does not have permission`)
         //                 return Promise.reject('errTokenNoPermission')
         //             }
 
@@ -770,7 +764,6 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
         //                 console.log('req.query', get(req, 'query'))
         //                 console.log('token', token)
         //                 console.log('[API]updateAPIs/check token: invalid token')
-        //                 console.log(`token does not have permission`)
         //                 return Promise.reject('errTokenNoPermission')
         //             }
 
@@ -781,7 +774,6 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
         //             if (!iseobj(user)) {
         //                 console.log('token', token)
         //                 console.log('[API]updateAPIs/check user: invalid user')
-        //                 console.log(`token does not have permission`)
         //                 return Promise.reject('errTokenNoPermission')
         //             }
 
@@ -820,9 +812,8 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
                     //check
                     if (!isestr(token)) {
                         console.log('req.query', get(req, 'query'))
-                        console.log('token', token)
+                        console.log('token', maskTok(token))
                         console.log('[API]syncAndReplaceTabs/check token: invalid token')
-                        console.log(`token does not have permission`)
                         return Promise.reject('errTokenNoPermission')
                     }
 
@@ -834,8 +825,7 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
                         console.log('req.query', get(req, 'query'))
                         console.log('keyTable', keyTable)
                         console.log('[API]syncAndReplaceTabs/check keyTable: invalid keyTable')
-                        console.log(`token does not have permission`)
-                        return Promise.reject('errTokenNoPermission')
+                        return Promise.reject('errKeyTableInvalid')
                     }
 
                     //check keyTable
@@ -850,9 +840,8 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
 
                     //check
                     if (!iseobj(user)) {
-                        console.log('token', token)
+                        console.log('token', maskTok(token))
                         console.log('[API]syncAndReplaceTabs/check user: invalid user')
-                        console.log(`token does not have permission`)
                         return Promise.reject('errTokenNoPermission')
                     }
 
@@ -861,10 +850,9 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
 
                     //check userId
                     if (!isestr(userId)) {
-                        console.log('token', token)
+                        console.log('token', maskTok(token))
                         console.log('user', user)
                         console.log('[API]syncAndReplaceTabs/check userId: invalid userId')
-                        console.log(`token does not have permission`)
                         return Promise.reject('errTokenNoPermission')
                     }
 
@@ -902,7 +890,7 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
 
     //WServHapiServer
     instWServHapiServer = new WServHapiServer({
-        port: opt.serverPort,
+        port: serverPort,
         pathStaticFiles,
         apiName: 'api',
         apis,
@@ -917,16 +905,18 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
             //check
             if (!isestr(token)) {
                 console.log('apiType', apiType)
-                console.log('authorization', authorization)
+                console.log('authorization', maskTok(authorization))
                 console.log('invalid token')
                 return false
             }
 
-            //checkToken
+            //checkToken：套件層連線閘僅做「token 認證」（解析 user + 驗欄位齊備）。**授權**（如限管理員）屬
+            //套件使用者之責——由其提供之 getUserByToken（可對非授權者回 {}）/ verifyClientUser / verifyAppUser，
+            //或 WServOrm 之 useCheckUser/useExcludeWhenNotAdmin 等鉤子決定；套件不對連線層強加特定授權政策（避免越界、
+            //保留使用者彈性）。詳見 spec/設計要點與取捨.md「套件授權責任」。
             let b = await p.checkToken(token)
-            // console.log('b', b)
 
-            srLog.info({ event: 'verifyConn', apiType }) //連線驗證通過（checkToken 失敗時會 throw 不到此）
+            srLog.info({ event: 'verifyConn', apiType }) //連線之 token 認證通過（checkToken 失敗會 throw 不到此）
             return b
         },
         getUserIdByToken: async (token) => { //可使用async或sync函數
@@ -962,8 +952,8 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
                 return deleteApi(userId, id)
             }),
 
-            //統計資訊頁：回傳各 event 之時段發生頻率（讀 logFd 之 log）。連線已由 verifyClientUser 限管理員，
-            //故此處不另檢查（同 getApisList）。timeLength 天數 / timeInterval 'hr'|'day'。
+            //統計資訊頁：回傳各 event 之時段發生頻率（讀 logFd 之 log）。連線之 token 認證由 verifyConn 把關；
+            //授權（限管理員）屬套件使用者責任（見 verifyConn 註解與設計要點與取捨「套件授權責任」）。timeLength 天數 / timeInterval 'hr'|'day'。
             getStaEvent: wrapErrLog('getStaEvent', (userId, timeLength = 7, timeInterval = 'hr') => {
                 return staEvent(timeLength, timeInterval, { fdLog: logFd })
             }),
@@ -999,7 +989,7 @@ export default WWebApi
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Mon Jun 22 2026 15:42:09 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Thu Jul 23 2026 11:40:34 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/src_components_Common_CheckYesNo.vue.html

@@ -174,7 +174,7 @@ export default {
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Mon Jun 22 2026 15:42:09 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Thu Jul 23 2026 11:40:34 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/logs/2026-06-19T16.log

@@ -0,0 +1,6 @@
+{"level":50,"time":1781856410899,"pid":16564,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}
+{"level":50,"time":1781856420503,"pid":16564,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}
+{"level":50,"time":1781856490388,"pid":16564,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}
+{"level":50,"time":1781856524374,"pid":16564,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}
+{"level":50,"time":1781856931047,"pid":16564,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}
+{"level":50,"time":1781856965662,"pid":16564,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}

package/logs/2026-06-20T11.log

@@ -0,0 +1,4 @@
+{"level":50,"time":1781925021318,"pid":1168,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}
+{"level":50,"time":1781925045743,"pid":1168,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}
+{"level":50,"time":1781925121224,"pid":1168,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}
+{"level":50,"time":1781925160739,"pid":1168,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}

package/logs/2026-06-20T14.log

@@ -0,0 +1,2 @@
+{"level":50,"time":1781937105131,"pid":10624,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}
+{"level":50,"time":1781937144581,"pid":10624,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}

package/logs/2026-06-21T20.log

@@ -0,0 +1 @@
+{"level":50,"time":1782044666261,"pid":18148,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}

package/logs/2026-06-21T21.log

@@ -0,0 +1,4 @@
+{"level":50,"time":1782047515013,"pid":18320,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}
+{"level":50,"time":1782047552686,"pid":18320,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}
+{"level":50,"time":1782048081069,"pid":12768,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}
+{"level":50,"time":1782048118569,"pid":12768,"hostname":"semi-win-dev3","event":"proxyRequest","err":"errReqUrlInvalid"}

package/logs/2026-06-22T07.log

@@ -0,0 +1,12 @@
+{"level":30,"time":1782085260282,"pid":15936,"hostname":"semi-win-dev3","event":"verifyClientUser","from":"getUserByToken","userId":"id-for-admin"}
+{"level":30,"time":1782085260282,"pid":15936,"hostname":"semi-win-dev3","event":"api/getUserByToken","userId":"id-for-admin"}
+{"level":30,"time":1782085262399,"pid":15936,"hostname":"semi-win-dev3","event":"verifyConn","apiType":"main"}
+{"level":30,"time":1782085262418,"pid":15936,"hostname":"semi-win-dev3","event":"verifyConn","apiType":"main"}
+{"level":30,"time":1782085262426,"pid":15936,"hostname":"semi-win-dev3","event":"verifyConn","apiType":"main"}
+{"level":30,"time":1782085262428,"pid":15936,"hostname":"semi-win-dev3","event":"verifyConn","apiType":"main"}
+{"level":30,"time":1782085262429,"pid":15936,"hostname":"semi-win-dev3","event":"kpfun-getWebInfor"}
+{"level":30,"time":1782085262493,"pid":15936,"hostname":"semi-win-dev3","event":"verifyConn","apiType":"main"}
+{"level":30,"time":1782085263657,"pid":15936,"hostname":"semi-win-dev3","event":"verifyConn","apiType":"main"}
+{"level":30,"time":1782085263695,"pid":15936,"hostname":"semi-win-dev3","event":"kpfun-getStaEvent"}
+{"level":30,"time":1782085264394,"pid":15936,"hostname":"semi-win-dev3","event":"verifyConn","apiType":"main"}
+{"level":30,"time":1782085266394,"pid":15936,"hostname":"semi-win-dev3","event":"verifyConn","apiType":"main"}