npm - w-web-perm - Versions diffs - 1.0.48 → 1.0.49 - Mend

w-web-perm 1.0.48 → 1.0.49

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (95) hide show

package/.github/workflows/ci-test.yml +2 -2
package/_gh-pages-deploy/.nojekyll +0 -0
package/_gh-pages-deploy/WWebPerm.html +938 -0
package/_gh-pages-deploy/WWebPerm.mjs.html +1228 -0
package/_gh-pages-deploy/fonts/Montserrat/Montserrat-Bold.eot +0 -0
package/_gh-pages-deploy/fonts/Montserrat/Montserrat-Bold.ttf +0 -0
package/_gh-pages-deploy/fonts/Montserrat/Montserrat-Bold.woff +0 -0
package/_gh-pages-deploy/fonts/Montserrat/Montserrat-Bold.woff2 +0 -0
package/_gh-pages-deploy/fonts/Montserrat/Montserrat-Regular.eot +0 -0
package/_gh-pages-deploy/fonts/Montserrat/Montserrat-Regular.ttf +0 -0
package/_gh-pages-deploy/fonts/Montserrat/Montserrat-Regular.woff +0 -0
package/_gh-pages-deploy/fonts/Montserrat/Montserrat-Regular.woff2 +0 -0
package/_gh-pages-deploy/fonts/Source-Sans-Pro/sourcesanspro-light-webfont.eot +0 -0
package/_gh-pages-deploy/fonts/Source-Sans-Pro/sourcesanspro-light-webfont.svg +978 -0
package/_gh-pages-deploy/fonts/Source-Sans-Pro/sourcesanspro-light-webfont.ttf +0 -0
package/_gh-pages-deploy/fonts/Source-Sans-Pro/sourcesanspro-light-webfont.woff +0 -0
package/_gh-pages-deploy/fonts/Source-Sans-Pro/sourcesanspro-light-webfont.woff2 +0 -0
package/_gh-pages-deploy/fonts/Source-Sans-Pro/sourcesanspro-regular-webfont.eot +0 -0
package/_gh-pages-deploy/fonts/Source-Sans-Pro/sourcesanspro-regular-webfont.svg +1049 -0
package/_gh-pages-deploy/fonts/Source-Sans-Pro/sourcesanspro-regular-webfont.ttf +0 -0
package/_gh-pages-deploy/fonts/Source-Sans-Pro/sourcesanspro-regular-webfont.woff +0 -0
package/_gh-pages-deploy/fonts/Source-Sans-Pro/sourcesanspro-regular-webfont.woff2 +0 -0
package/_gh-pages-deploy/index.html +84 -0
package/_gh-pages-deploy/scripts/collapse.js +39 -0
package/_gh-pages-deploy/scripts/commonNav.js +28 -0
package/_gh-pages-deploy/scripts/linenumber.js +25 -0
package/_gh-pages-deploy/scripts/nav.js +12 -0
package/_gh-pages-deploy/scripts/polyfill.js +4 -0
package/_gh-pages-deploy/scripts/prettify/Apache-License-2.0.txt +202 -0
package/_gh-pages-deploy/scripts/prettify/lang-css.js +2 -0
package/_gh-pages-deploy/scripts/prettify/prettify.js +28 -0
package/_gh-pages-deploy/scripts/search.js +99 -0
package/_gh-pages-deploy/styles/jsdoc.css +776 -0
package/_gh-pages-deploy/styles/prettify.css +80 -0
package/dist/css/app.d8b16216.css +1 -0
package/dist/css/{chunk-vendors.f149e124.css → chunk-vendors.2d3ef2ba.css} +1 -1
package/dist/index.tmp +2 -2
package/dist/js/app-legacy.fb48310a.js +1 -0
package/dist/js/app.fb48310a.js +1 -0
package/dist/js/chunk-vendors-legacy.8fdd4435.js +21 -0
package/dist/js/chunk-vendors.8fdd4435.js +21 -0
package/dist/w-web-perm.umd.js +2 -2
package/dist/w-web-perm.umd.js.map +1 -1
package/docs/WWebPerm.html +2 -2
package/docs/WWebPerm.mjs.html +138 -199
package/docs/index.html +1 -1
package/package.json +15 -11
package/public/index.html +2 -2
package/server/WWebPerm.mjs +137 -198
package/server/procCore.mjs +169 -0
package/server/procLang.mjs +197 -0
package/server/procStaInfor.mjs +118 -0
package/server/provideTabs.mjs +1 -1
package/server/srLog.mjs +30 -0
package/server/staLogs/staEvent.callWorker.mjs +46 -0
package/server/staLogs/staEvent.mjs +116 -0
package/server/staLogs/staEvent.shellWorker.mjs +19 -0
package/server/staLogs/staEventTable.mjs +100 -0
package/server/staLogs/test_staEvent.mjs +22 -0
package/settings.json +40 -0
package/src/components/Common/CheckYes.vue +18 -1
package/src/components/Layout.vue +1 -1
package/src/components/LayoutContent.vue +13 -1
package/src/components/LayoutContentGrups.vue +32 -23
package/src/components/LayoutContentPemis.vue +32 -23
package/src/components/LayoutContentStaInfor.vue +536 -0
package/src/components/LayoutContentTargets.vue +32 -23
package/src/components/LayoutContentUsers.vue +32 -23
package/src/components/LayoutState.vue +5 -0
package/src/components/VeCgrups.vue +12 -3
package/src/components/VeCpemis.vue +12 -3
package/src/components/VeCrules.vue +12 -3
package/src/components/VeGrupBlngUsers.vue +18 -6
package/src/components/VePemiBlngGrups.vue +18 -6
package/src/getPerm.mjs +7 -17
package/src/getPermUserInfor.mjs +8 -18
package/src/main.js +1 -0
package/src/plugins/mShare.mjs +8 -13
package/src/plugins/mUI.mjs +11 -0
package/srv.mjs +76 -101
package/tableTags.json +1 -1
package/db/wperm/grups/data.mdb +0 -0
package/db/wperm/grups/lock.mdb +0 -0
package/db/wperm/pemis/data.mdb +0 -0
package/db/wperm/pemis/lock.mdb +0 -0
package/db/wperm/targets/data.mdb +0 -0
package/db/wperm/targets/lock.mdb +0 -0
package/db/wperm/users/data.mdb +0 -0
package/db/wperm/users/lock.mdb +0 -0
package/dist/css/app.30e81bfe.css +0 -1
package/dist/js/app-legacy.3324392e.js +0 -1
package/dist/js/app.3324392e.js +0 -1
package/dist/js/chunk-vendors-legacy.e8703728.js +0 -21
package/dist/js/chunk-vendors.e8703728.js +0 -21
package/test/getUserRules.test.mjs +0 -899

package/_gh-pages-deploy/WWebPerm.mjs.html ADDED Viewed

@@ -0,0 +1,1228 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="utf-8">
+    <title>WWebPerm.mjs - Documentation</title>
+    <script src="scripts/prettify/prettify.js"></script>
+    <script src="scripts/prettify/lang-css.js"></script>
+    <!--[if lt IE 9]>
+      <script src="//html5shiv.googlecode.com/svn/trunk/html5.js"></script>
+    <![endif]-->
+    <link type="text/css" rel="stylesheet" href="styles/prettify.css">
+    <link type="text/css" rel="stylesheet" href="styles/jsdoc.css">
+    <script src="scripts/nav.js" defer></script>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+</head>
+<body>
+<input type="checkbox" id="nav-trigger" class="nav-trigger" />
+<label for="nav-trigger" class="navicon-button x">
+  <div class="navicon"></div>
+</label>
+<label for="nav-trigger" class="overlay"></label>
+<nav >
+    <h2><a href="index.html">Home</a></h2><h3>Classes</h3><ul><li><a href="WWebPerm.html">WWebPerm</a></li></ul>
+</nav>
+<div id="main">
+    <h1 class="page-title">WWebPerm.mjs</h1>
+    <section>
+        <article>
+            <pre class="prettyprint source linenums"><code>import path from 'path'
+import fs from 'fs'
+import get from 'lodash-es/get.js'
+import each from 'lodash-es/each.js'
+import map from 'lodash-es/map.js'
+import keys from 'lodash-es/keys.js'
+import size from 'lodash-es/size.js'
+import join from 'lodash-es/join.js'
+import iseobj from 'wsemi/src/iseobj.mjs'
+import isestr from 'wsemi/src/isestr.mjs'
+import ispint from 'wsemi/src/ispint.mjs'
+import isearr from 'wsemi/src/isearr.mjs'
+import isErr from 'wsemi/src/isErr.mjs'
+import isfun from 'wsemi/src/isfun.mjs'
+import ispm from 'wsemi/src/ispm.mjs'
+import cint from 'wsemi/src/cint.mjs'
+import j2o from 'wsemi/src/j2o.mjs'
+import strleft from 'wsemi/src/strleft.mjs'
+import strright from 'wsemi/src/strright.mjs'
+import strdelright from 'wsemi/src/strdelright.mjs'
+import pm2resolve from 'wsemi/src/pm2resolve.mjs'
+import fsIsFolder from 'wsemi/src/fsIsFolder.mjs'
+import fsIsFile from 'wsemi/src/fsIsFile.mjs'
+import replace from 'wsemi/src/replace.mjs'
+import strdelleft from 'wsemi/src/strdelleft.mjs'
+import ltdtmapping from 'wsemi/src/ltdtmapping.mjs'
+import pmKeyMutex from 'wsemi/src/pmKeyMutex.mjs'
+import WServHapiServer from 'w-serv-hapi/src/WServHapiServer.mjs'
+import WServOrm from 'w-serv-orm/src/WServOrm.mjs'
+import ds from '../src/schema/index.mjs'
+import { getUserRules } from '../src/plugins/mShare.mjs'
+import procCore from './procCore.mjs'
+import procLang from './procLang.mjs'
+import srLogInit from './srLog.mjs'
+import procStaInfor from './procStaInfor.mjs'
+/**
+ * 權限伺服器
+ *
+ * @class
+ * @param {Function} WOrm 輸入資料庫ORM函數
+ * @param {String} url 輸入資料庫連線字串，例如w-orm-lmdb為'./db'，或w-orm-mongodb為'mongodb://username:password@$127.0.0.1:27017'
+ * @param {String} db 輸入資料庫名稱字串
+ * @param {Function} getUserByToken 輸入處理函數，函數會傳入使用者token，通過此函數處理後並回傳使用者資訊物件，並至少須提供'id'、'email'、'name'、'isAdmin'欄位，且'isAdmin'限輸入'y'或'n'，且輸入'y'時會複寫權限系統該使用者之'isAdmin'欄位值
+ * @param {Function} verifyClientUser 輸入驗證瀏覽使用者身份之處理函數，函數會傳入使用者資訊物件，通過此函數識別後回傳布林值，允許使用者回傳true，反之回傳false
+ * @param {Function} verifyAppUser 輸入驗證應用程序使用者身份之處理函數，函數會傳入使用者資訊物件，通過此函數識別後回傳布林值，允許使用者回傳true，反之回傳false
+ * @param {Object} [opt={}] 輸入設定物件，預設{}
+ * @param {Integer} [opt.serverPort=11006] 輸入伺服器通訊port，預設11006
+ * @param {Boolean} [opt.useCheckUser=false] 輸入是否檢查使用者資訊布林值，預設false
+ * @param {Function} [opt.getUserById=null] 輸入當useCheckUser=true時依照使用者ID取得使用者資訊物件函數，預設null
+ * @param {Boolean} [opt.useExcludeWhenNotAdmin=false] 輸入使用ORM的select方法時是否自動刪除數據內isActive欄位之布林值，預設false
+ * @param {Object} [opt.webName={}] 輸入站台名稱物件，至少包含語系eng與cht鍵的名稱，預設{}
+ * @param {Object} [opt.webDescription={}] 輸入站台描述物件，至少包含語系eng與cht鍵的名稱，預設{}
+ * @param {String} [opt.webLogo=''] 輸入站台logo字串，採base64格式，預設''
+ * @param {String} [opt.subfolder=''] 輸入站台所在子目錄字串，提供站台位於內網採反向代理進行服務時，故需支援位於子目錄情形，預設''
+ * @param {String} [opt.urlRedirect=''] 輸入錯誤時自動轉址字串，提供站台例如無法登入或驗證失敗時須自動轉址，預設''
+ * @param {String} [opt.mappingBy='email'] 輸入外部系統識別使用者token後所提供之資料物件，與權限系統之使用者資料物件，兩者間查找之對應欄位，可選'id'、'email'、'name'，預設'email'
+ * @returns {Object} 回傳物件，其內server為hapi伺服器實體，wsrv為w-converhp的伺服器事件物件，wsds為w-serv-webdata的伺服器事件物件，可監聽error事件
+ * @example
+ *
+ * import WOrm from 'w-orm-lmdb/src/WOrmLmdb.mjs'
+ * import WWebPerm from './server/WWebPerm.mjs'
+ * import getSettings from './g.getSettings.mjs'
+ *
+ *
+ * //st
+ * let st = getSettings()
+ *
+ * let url = st.dbUrl
+ * let db = st.dbName
+ * let opt = {
+ *
+ *     useCheckUser: false,
+ *     getUserById: null,
+ *     useExcludeWhenNotAdmin: false,
+ *
+ *     serverPort: 11006,
+ *     subfolder: '', //mperm
+ *     urlRedirect: 'https://www.google.com/', //本機測試時得先編譯, 再瀏覽: http://localhost:11006/
+ *
+ *     webName: {
+ *         'eng': 'Permission Service',
+ *         'cht': '權限管理系統',
+ *     },
+ *     webDescription: {
+ *         'eng': 'A web service package for user permissions and management targets.',
+ *         'cht': 'A web service package for user permissions and management targets.',
+ *     },
+ *     webLogo: 'data:image/svg+xml;base64,...',
+ *
+ * }
+ *
+ * let getUserByToken = async (token) => {
+ *     // return {} //測試無法登入
+ *     if (token === '{token-for-application}') { //提供外部應用系統作為存取使用者
+ *         return {
+ *             id: 'id-for-application',
+ *             name: 'application',
+ *             email: 'application@example.com',
+ *             isAdmin: 'y',
+ *         }
+ *     }
+ *     if (token === 'sys') { //開發階段w-ui-loginout自動給予browser使用者(且位於localhost)的token為sys
+ *         return {
+ *             id: 'id-for-admin',
+ *             name: 'tester',
+ *             email: 'admin@example.com', //mappingBy為email, 開發階段時會使用email找到所建置之使用者資料
+ *             isAdmin: 'y',
+ *         }
+ *     }
+ *     console.log('invalid token', token)
+ *     console.log('於生產環境時得加入SSO等驗證token機制')
+ *     return {}
+ * }
+ *
+ * let verifyClientUser = (user, from) => {
+ *     console.log('verifyClientUser/user', user)
+ *     // return false //測試無法登入
+ *     console.log('於生產環境時得加入限制瀏覽器使用者身份機制')
+ *     return user.isAdmin === 'y' //測試僅系統管理者使用
+ * }
+ *
+ * let verifyAppUser = (user, from) => {
+ *     console.log('verifyAppUser/user', user)
+ *     // return false //測試無法登入
+ *     console.log('於生產環境時得加入限制應用程式使用者身份機制')
+ *     return user.isAdmin === 'y' //測試僅系統管理者使用
+ * }
+ *
+ * //WWebPerm
+ * let instWWebPerm = WWebPerm(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser, opt)
+ *
+ * instWWebPerm.on('error', (err) => {
+ *     console.log(err)
+ * })
+ *
+ */
+function WWebPerm(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser, opt = {}) {
+    let instWServHapiServer = null
+    //check WOrm
+    if (!isfun(WOrm)) {
+        console.log('invalid WOrm', WOrm)
+        throw new Error('invalid WOrm')
+    }
+    //check url
+    if (!isestr(url)) {
+        console.log('invalid url', url)
+        throw new Error('invalid url')
+    }
+    //check db
+    if (!isestr(db)) {
+        console.log('invalid db', db)
+        throw new Error('invalid db')
+    }
+    //check getUserByToken
+    if (!isfun(getUserByToken)) {
+        console.log('invalid getUserByToken', getUserByToken)
+        throw new Error('invalid getUserByToken')
+    }
+    //check verifyClientUser
+    if (!isfun(verifyClientUser)) {
+        console.log('invalid verifyClientUser', verifyClientUser)
+        throw new Error('invalid verifyClientUser')
+    }
+    //check verifyAppUser
+    if (!isfun(verifyAppUser)) {
+        console.log('invalid verifyAppUser', verifyAppUser)
+        throw new Error('invalid verifyAppUser')
+    }
+    //serverPort
+    let serverPort = get(opt, 'serverPort')
+    if (!ispint(serverPort)) {
+        serverPort = 11006
+    }
+    serverPort = cint(serverPort)
+    //useCheckUser
+    let useCheckUser = get(opt, 'useCheckUser', false)
+    //getUserById
+    let getUserById = get(opt, 'getUserById', null)
+    //useExcludeWhenNotAdmin
+    let useExcludeWhenNotAdmin = get(opt, 'useExcludeWhenNotAdmin', false)
+    //webName
+    let webName = get(opt, 'webName', {})
+    //webDescription
+    let webDescription = get(opt, 'webDescription', {})
+    //webLogo
+    let webLogo = get(opt, 'webLogo', '')
+    //subfolder
+    let subfolder = get(opt, 'subfolder', '')
+    if (isestr(subfolder)) {
+        if (strright(subfolder, 1) === '/') { //右邊不需要給「/」
+            subfolder = strdelright(subfolder, 1)
+        }
+        if (strleft(subfolder, 1) !== '/') { //左邊需要給「/」
+            subfolder = `/${subfolder}`
+        }
+    }
+    //urlRedirect
+    let urlRedirect = get(opt, 'urlRedirect', '')
+    // console.log('urlRedirect', urlRedirect)
+    //params
+    let showLanguage = get(opt, 'showLanguage', 'n')
+    let language = get(opt, 'language', 'eng')
+    let showModeEditTargets = get(opt, 'showModeEditTargets', 'n')
+    let showModeEditPemis = get(opt, 'showModeEditPemis', 'n')
+    let showModeEditGrups = get(opt, 'showModeEditGrups', 'n')
+    let showModeEditUsers = get(opt, 'showModeEditUsers', 'n')
+    let modeEditTargets = get(opt, 'modeEditTargets', 'n')
+    let modeEditPemis = get(opt, 'modeEditPemis', 'n')
+    let modeEditGrups = get(opt, 'modeEditGrups', 'n')
+    let modeEditUsers = get(opt, 'modeEditUsers', 'n')
+    let widthTargetId = get(opt, 'widthTargetId', '')
+    let widthTargetDescription = get(opt, 'widthTargetDescription', '')
+    let widthPemisName = get(opt, 'widthPemisName', '')
+    let widthPemisDescription = get(opt, 'widthPemisDescription', '')
+    let widthGrupsName = get(opt, 'widthGrupsName', '')
+    let widthGrupsDescription = get(opt, 'widthGrupsDescription', '')
+    let widthUsersName = get(opt, 'widthUsersName', '')
+    let widthUsersEmail = get(opt, 'widthUsersEmail', '')
+    let widthUsersDescription = get(opt, 'widthUsersDescription', '')
+    //mappingBy
+    let mappingBy = get(opt, 'mappingBy', '')
+    if (mappingBy !== 'id' &amp;&amp; mappingBy !== 'email' &amp;&amp; mappingBy !== 'name') {
+        mappingBy = 'id'
+    }
+    // console.log('mappingBy', mappingBy)
+    //kpLangExt
+    let kpLangExt = get(opt, 'kpLangExt', null)
+    //kpLang
+    let kpLang = procLang({ kpLangExt, webName, webDescription })
+    //srLog
+    let srLog = srLogInit(opt)
+    //WServOrm
+    let optWServOrm = {
+        useCheckUser,
+        getUserById,
+        useExcludeWhenNotAdmin,
+    }
+    let wp = {}
+    try {
+        wp = WServOrm(ds, WOrm, url, db, optWServOrm)
+    }
+    catch (err) {
+        console.log(err)
+    }
+    let { woItems, procOrm } = wp
+    //pmKeyMutex: per-key in-memory mutex, 同 key 序列化、不同 key 並行.
+    //perm 為「整表批次 diff」寫入, key 粒度為 {op}:{keyTable}, 防同表並行 race (lost update).
+    let kmx = pmKeyMutex()
+    //procCore: 整表批次 diff 寫入邏輯 (updateTabItems + updateTargets/Pemis/Grups/Users)
+    let pc = procCore(woItems, procOrm, { srLog, kmx })
+    //procStaInfor: 統計資訊, fdLog 對齊 srLog 使用同一目錄; mock 由 settings.staEventMock 注入(e2e 統計圖穩定用)
+    let psi = procStaInfor({ fdLog: './_logs', mock: get(opt, 'staEventMock', false) })
+    //getWebInfor
+    let getWebInfor = (userId) => {
+        //info
+        srLog.info({ event: 'getWebInfor-success', userId })
+        return {
+            // webName, //已併入kpLang
+            // webDescription, //已併入kpLang
+            webLogo,
+            // urlRedirect, //登入失敗就需要轉址, 故須通過html模板取代提供, 無法用api提供
+            showLanguage,
+            language,
+            kpLang,
+            showModeEditTargets,
+            showModeEditPemis,
+            showModeEditGrups,
+            showModeEditUsers,
+            modeEditTargets,
+            modeEditPemis,
+            modeEditGrups,
+            modeEditUsers,
+            widthTargetId,
+            widthTargetDescription,
+            widthPemisName,
+            widthPemisDescription,
+            widthGrupsName,
+            widthGrupsDescription,
+            widthUsersName,
+            widthUsersEmail,
+            widthUsersDescription,
+        }
+    }
+    // //getTargetsList
+    // let getTargetsList = async (userId) => {
+    //     let rs = await woItems.targets.select()
+    //     return rs
+    // }
+    // //getPemisList
+    // let getPemisList = async (userId) => {
+    //     let rs = await woItems.pemis.select()
+    //     return rs
+    // }
+    // //getGrupsList
+    // let getGrupsList = async (userId) => {
+    //     let rs = await woItems.grups.select()
+    //     return rs
+    // }
+    // //getUsersList
+    // let getUsersList = async (userId) => {
+    //     let rs = await woItems.users.select()
+    //     return rs
+    // }
+    //checkUser
+    let checkUser = async(user) => {
+        let id = get(user, 'id', '')
+        if (!isestr(id)) {
+            console.log('user', user)
+            srLog.error({ event: 'checkUser-error', msg: 'cannotGetUserId' })
+            return Promise.reject(`cannotGetUserId`)
+        }
+        let email = get(user, 'email', '')
+        if (!isestr(email)) {
+            console.log('user', user)
+            srLog.error({ event: 'checkUser-error', msg: 'cannotGetUserEmail' })
+            return Promise.reject(`cannotGetUserEmail`)
+        }
+        let name = get(user, 'name', '')
+        if (!isestr(name)) {
+            console.log('user', user)
+            srLog.error({ event: 'checkUser-error', msg: 'cannotGetUserName' })
+            return Promise.reject(`cannotGetUserName`)
+        }
+        let isAdmin = get(user, 'isAdmin', '')
+        if (isAdmin !== 'y' &amp;&amp; isAdmin !== 'n') {
+            console.log('user', user)
+            console.log('user.isAdmin is not y or n', user.isAdmin)
+            srLog.error({ event: 'checkUser-error', msg: 'cannotGetUserRole' })
+            return Promise.reject(`cannotGetUserRole`)
+        }
+        return true
+    }
+    //getTokenUser
+    let getTokenUser = async(token) => {
+        //基於token查找使用者, 會基於外部getUserByToken以及perm內部users進行查找並比對
+        //userSelf
+        let userSelf = null
+        if (isestr(token)) {
+            userSelf = getUserByToken(token)
+            if (ispm(userSelf)) {
+                userSelf = await userSelf
+            }
+        }
+        // console.log('userSelf', userSelf)
+        //check
+        if (!iseobj(userSelf)) {
+            console.log(`token`, token)
+            srLog.error({ event: 'getTokenUser-error', msg: 'cannotFindUserFromToken' })
+            return Promise.reject(`cannotFindUserFromToken`)
+        }
+        //check userSelf
+        await checkUser(userSelf)
+        //須反查perm內users, 提供正規化屬性
+        let vSelf = get(userSelf, mappingBy, '')
+        // console.log('vSelf', vSelf)
+        //check
+        if (!isestr(vSelf)) {
+            console.log('userSelf', userSelf)
+            console.log('mappingBy', mappingBy)
+            srLog.error({ event: 'getTokenUser-error', msg: 'cannotGetUserProp', mappingBy })
+            return Promise.reject(`cannotGetUserProp`)
+        }
+        //userFind
+        let userFind = await woItems.users.select({ [mappingBy]: vSelf, isActive: 'y' })
+        userFind = get(userFind, 0, null)
+        // console.log('userFind', userFind)
+        //check
+        if (!iseobj(userFind)) {
+            console.log('userSelf', userSelf)
+            console.log('mappingBy', mappingBy)
+            srLog.error({ event: 'getTokenUser-error', msg: 'cannotGetUserFromPerm', mappingBy })
+            return Promise.reject(`cannotGetUserFromPerm`)
+        }
+        //複寫isAdmin
+        let isAdminSrc = get(userSelf, 'isAdmin', '')
+        let isAdminSelf = get(userFind, 'isAdmin', '')
+        if (isAdminSrc !== isAdminSelf) {
+            userFind.isAdmin = isAdminSelf
+        }
+        // console.log('userFind(isAdmin)', userFind)
+        return userFind
+    }
+    //p
+    let p = {
+        checkToken: async(token) => {
+            //getUserByToken
+            let u = await getUserByToken(token)
+            // console.log('u', u)
+            //checkUser
+            await checkUser(u)
+            return true
+        },
+    }
+    //getAndVerifyClientUser
+    let getAndVerifyClientUser = async (token, from = '') => {
+        //基於token查找client使用者, 會基於外部getUserByToken以及perm內部users進行查找並比對
+        //getTokenUser
+        let user = await getTokenUser(token)
+        //verifyClientUser
+        let b = verifyClientUser(user, from)
+        if (ispm(b)) {
+            b = await b
+        }
+        //check
+        if (!b) {
+            console.log('user', user)
+            srLog.error({ event: 'getAndVerifyClientUser-error', msg: 'userNoPermission', from })
+            return Promise.reject(`userNoPermission`)
+        }
+        return user
+    }
+    //getAndVerifyAppUser
+    let getAndVerifyAppUser = async (token, from = '') => {
+        //基於token查找app使用者, 會基於外部getUserByToken進行查找, 故只要getUserByToken提供使用者即可, 可支援getUserByToken給予針對應用程式所產生之虛擬使用者
+        //user
+        let user = null
+        if (isestr(token)) {
+            user = getUserByToken(token)
+            if (ispm(user)) {
+                user = await user
+            }
+        }
+        // console.log('user', user)
+        //check
+        if (!iseobj(user)) {
+            console.log(`token`, token)
+            srLog.error({ event: 'getAndVerifyAppUser-error', msg: 'cannotFindUserFromToken' })
+            return Promise.reject(`cannotFindUserFromToken`)
+        }
+        //verifyAppUser
+        let b = verifyAppUser(user, from)
+        if (ispm(b)) {
+            b = await b
+        }
+        //check
+        if (!b) {
+            console.log('user', user)
+            srLog.error({ event: 'getAndVerifyAppUser-error', msg: 'userNoPermission', from })
+            return Promise.reject(`userNoPermission`)
+        }
+        return user
+    }
+    //parsePayload
+    let parsePayload = async (req) => {
+        //payload
+        let payload = get(req, 'payload')
+        //to obj
+        if (isestr(payload)) {
+            payload = j2o(payload)
+        }
+        //check
+        if (!iseobj(payload)) {
+            console.log('payload', payload)
+            srLog.error({ event: 'parsePayload-error', msg: 'invalidPayload' })
+            return Promise.reject(`invalidPayload`)
+        }
+        //from
+        let from = get(payload, 'from', '')
+        //check
+        if (!isestr(from)) {
+            console.log('payload', payload)
+            srLog.error({ event: 'parsePayload-error', msg: 'invalidFromInPayload' })
+            return Promise.reject(`invalidFromInPayload`)
+        }
+        //rows
+        let rows = get(payload, 'rows', [])
+        //check
+        if (!isearr(rows)) {
+            console.log('payload', payload)
+            srLog.error({ event: 'parsePayload-error', msg: 'invalidRowsInPayload' })
+            return Promise.reject(`invalidRowsInPayload`)
+        }
+        //inp
+        let inp = {
+            from,
+            rows,
+        }
+        return inp
+    }
+    //syncAndReplaceTabs
+    let syncAndReplaceTabs = async (userId, inp, keyTable) => {
+        //序列化同表之並行整表 delAll+insert: 防 lost update (同 keyTable 序列化, 不同表並行)
+        return await kmx('syncAndReplaceTabs:' + keyTable, async () => {
+        //from
+        let from = get(inp, 'from', '')
+        // console.log('from', from)
+        //check
+        if (!isestr(from)) {
+            console.log('inp', inp)
+            srLog.error({ event: 'syncAndReplaceTabs-error', msg: 'invalidFrom', keyTable })
+            return Promise.reject(`invalidFrom`)
+        }
+        //rows
+        let rows = get(inp, 'rows', [])
+        // console.log(keyTable, rows)
+        //check
+        if (!isearr(rows)) {
+            console.log('inp', inp)
+            console.log('keyTable', keyTable)
+            srLog.error({ event: 'syncAndReplaceTabs-error', msg: 'invalidRows', keyTable })
+            return Promise.reject(`invalidRows`)
+        }
+        //save from
+        rows = map(rows, (v, k) => {
+            // v.order = k + 1 //order大部分由外部給予, 不能複寫
+            v.from = from
+            return v
+        })
+        //ltdtmapping
+        rows = ltdtmapping(rows, ds[keyTable].keys)
+        // console.log('ltdtmapping rows', rows)
+        //delAll from
+        await woItems[keyTable].delAll({ from })
+        //insert
+        // let r = await woItems[keyTable].insert(rows)
+        let r = await procOrm(userId, keyTable, 'insert', rows) //須使用procOrm才有辦法自動給予相關欄位
+        // console.log('r', r)
+        return r
+        })
+    }
+    //getGenUserByKV
+    let getGenUserByKV = async(keyUser, valueUser) => {
+        //userFind
+        let userFind = await woItems.users.select({ [keyUser]: valueUser, isActive: 'y' })
+        userFind = get(userFind, 0, null)
+        //check
+        if (!iseobj(userFind)) {
+            return null
+        }
+        return userFind
+    }
+    //getGenUserByUserId
+    let getGenUserByUserId = async(userId) => {
+        //userFind
+        let userFind = await getGenUserByKV('id', userId)
+        //check
+        if (!iseobj(userFind)) {
+            return null
+        }
+        return userFind
+    }
+    //getGenUserAndRulesByUserId
+    let getGenUserAndRulesByUserId = async (userId) => {
+        //userFind
+        let userFind = await getGenUserByUserId(userId)
+        // console.log('userFind', userFind)
+        //grups
+        let grups = await woItems.grups.select()
+        // console.log('grups', grups)
+        //pemis
+        let pemis = await woItems.pemis.select()
+        // console.log('pemis', pemis)
+        //targets
+        let targets = await woItems.targets.select()
+        // console.log('targets', targets)
+        //getUserRules
+        let kur = getUserRules(userFind, grups, pemis, targets)
+        // console.log('getUserRules', kur)
+        //check
+        if (!iseobj(kur)) {
+            console.log('userId', userId)
+            srLog.error({ event: 'getGenUserAndRulesByUserId-error', msg: 'cannotGetUserRules', userId })
+            return Promise.reject(`cannotGetUserRules`)
+        }
+        //grupsNames
+        let grupsNames = map(get(kur, 'grups', []), 'name') //kur.grups僅會提供isActive='y', 故grupsNames為有效權限群組名稱
+        grupsNames = join(grupsNames, ';')
+        return {
+            user: {
+                ...userFind,
+                grupsNames,
+            },
+            // grups: get(kur, 'grups', []),
+            rules: get(kur, 'rules', []),
+        }
+    }
+    //pathStaticFiles
+    let pathStaticFiles = 'dist'
+    let npmPathStaticFiles = './node_modules/w-web-perm/dist'
+    if (fsIsFolder(npmPathStaticFiles)) {
+        pathStaticFiles = npmPathStaticFiles
+    }
+    // console.log('pathStaticFiles', pathStaticFiles)
+    //subfolder
+    let fnEntryIn = 'index.tmp'
+    let fnEntryOut = 'index.html'
+    try {
+        let fpEntryIn = path.resolve(pathStaticFiles, fnEntryIn)
+        if (!fsIsFile(fpEntryIn)) {
+            fpEntryIn = path.resolve(pathStaticFiles, fnEntryOut) //本機開發另使用html替代tmp
+        }
+        if (!fsIsFile(fpEntryIn)) {
+            console.log('fpEntryIn', fpEntryIn)
+            throw new Error(`invalid fpEntryIn`)
+        }
+        let fpEntryOut = path.resolve(pathStaticFiles, fnEntryOut)
+        let c = fs.readFileSync(fpEntryIn, 'utf8')
+        c = replace(c, '/mperm/', '{sfd}/') //方法同genEntry
+        c = replace(c, '{sfd}', subfolder)
+        c = replace(c, '{urlRedirect}', urlRedirect)
+        c = replace(c, '{language}', language)
+        fs.writeFileSync(fpEntryOut, c, 'utf8')
+    }
+    catch (err) {
+        console.log(err)
+        console.log(`can not generate ${fnEntryOut}`)
+    }
+    //apis
+    let apis = [
+        {
+            method: 'GET',
+            path: '/api/getUserByToken', //未登入主頁時需先檢測token, getUserByToken為w-ui-loginout預設值, 若要更改兩邊須同時修改
+            handler: async function (req, res) {
+                // console.log('getUserByToken', req)
+                async function core() {
+                    //提供對象為browser使用者, 須先檢測token是否有效, 確認後回傳該使用者之資訊物件
+                    //token
+                    let token = get(req, 'query.token', '')
+                    // console.log('token', token)
+                    //check
+                    if (!isestr(token)) {
+                        console.log('req.query', get(req, 'query'))
+                        console.log('token', token)
+                        console.log('[API]getUserByToken/check token: invalid token')
+                        srLog.error({ event: 'api/getUserByToken-error', msg: 'tokenNoPermission' })
+                        return Promise.reject(`tokenNoPermission`)
+                    }
+                    //getAndVerifyClientUser
+                    let user = await getAndVerifyClientUser(token, 'getUserByToken')
+                    // console.log('user', user)
+                    //check
+                    if (!iseobj(user)) {
+                        console.log('token', token)
+                        console.log('[API]getUserByToken/check user: invalid user')
+                        srLog.error({ event: 'api/getUserByToken-error', msg: 'tokenNoPermission' })
+                        return Promise.reject(`tokenNoPermission`)
+                    }
+                    //info
+                    srLog.info({ event: 'api/getUserByToken-success', userId: get(user, 'id', '') })
+                    return user
+                }
+                //pm2resolve core
+                let r = await pm2resolve(core)() //w-ui-loginout接收已預設格式用pm2resolve轉過, 須另提取state進行判斷
+                if (isErr(r.msg)) {
+                    r.msg = r.msg.message
+                }
+                // console.log('getUserByToken', r)
+                return r
+            },
+        },
+        {
+            method: 'GET',
+            path: '/api/getPerm',
+            handler: async function (req, res) {
+                // console.log('getPerm', req)
+                async function core() {
+                    //提供對象為node與browser端, 須為client使用者, 須先檢測token是否有效, 再依照token取得使用者資訊物件, 再由其userId查詢回傳該使用者之權限資訊物件
+                    //token
+                    let token = get(req, 'query.token', '')
+                    // console.log('token', token)
+                    //check
+                    if (!isestr(token)) {
+                        console.log('req.query', get(req, 'query'))
+                        console.log('token', token)
+                        console.log('[API]getPerm/check token: invalid token')
+                        srLog.error({ event: 'api/getPerm-error', msg: 'tokenNoPermission' })
+                        return Promise.reject(`tokenNoPermission`)
+                    }
+                    //getAndVerifyClientUser, 發起token的所屬使用者, 驗證僅對client使用者, 不得使用app使用者
+                    let userSelf = await getAndVerifyClientUser(token, 'getPerm')
+                    // console.log('userSelf', userSelf)
+                    //check
+                    if (!iseobj(userSelf)) {
+                        console.log('token', token)
+                        console.log('[API]getPerm/check userSelf: invalid userSelf')
+                        srLog.error({ event: 'api/getPerm-error', msg: 'tokenNoPermission' })
+                        return Promise.reject(`tokenNoPermission`)
+                    }
+                    //userIdSelf, client使用者的userId
+                    let userIdSelf = get(userSelf, 'id', '')
+                    // console.log('userIdSelf', userIdSelf)
+                    //check
+                    if (!isestr(userIdSelf)) {
+                        console.log('token', token)
+                        console.log('userSelf', userSelf)
+                        console.log('[API]getPerm/check userIdSelf: invalid userIdSelf')
+                        srLog.error({ event: 'api/getPerm-error', msg: 'tokenNoPermission' })
+                        return Promise.reject(`tokenNoPermission`)
+                    }
+                    //getGenUserAndRulesByUserId, 查找到的client使用者與權限
+                    let userWithRulesSelf = await getGenUserAndRulesByUserId(userIdSelf)
+                    // console.log('getGenUserAndRulesByUserId', r)
+                    //check
+                    if (!iseobj(userWithRulesSelf)) {
+                        console.log('token', token)
+                        console.log('userSelf', userSelf)
+                        console.log('userIdSelf', userIdSelf)
+                        console.log('[API]getPerm/check userWithRulesSelf: invalid userWithRulesSelf')
+                        srLog.error({ event: 'api/getPerm-error', msg: 'tokenNoPermission' })
+                        return Promise.reject(`tokenNoPermission`)
+                    }
+                    //info
+                    srLog.info({ event: 'api/getPerm-success', userId: userIdSelf })
+                    return userWithRulesSelf
+                }
+                //pm2resolve core
+                let r = await pm2resolve(core)()
+                if (isErr(r.msg)) {
+                    r.msg = r.msg.message
+                }
+                // console.log('getPerm r', r)
+                return r
+            },
+        },
+        {
+            method: 'GET',
+            path: '/api/getPermUserInfor',
+            handler: async function (req, res) {
+                // console.log('getPermUserInfor', req)
+                async function core() {
+                    //提供對象為node端, 須為app使用者, 須先檢測token是否有效, 再由其userId查詢回傳該使用者權限資訊物件
+                    //tokenSelf
+                    let tokenSelf = get(req, 'query.token', '')
+                    // console.log('token', token)
+                    //check
+                    if (!isestr(tokenSelf)) {
+                        console.log('req.query', get(req, 'query'))
+                        console.log('[API]getPermUserInfor/check tokenSelf: invalid tokenSelf')
+                        srLog.error({ event: 'api/getPermUserInfor-error', msg: 'tokenNoPermission' })
+                        return Promise.reject(`tokenNoPermission`)
+                    }
+                    //getAndVerifyAppUser, 發起token的所屬使用者, 驗證須為app使用者
+                    let userSelf = await getAndVerifyAppUser(tokenSelf, 'getPermUserInfor')
+                    // console.log('userSelf', userSelf)
+                    //check
+                    if (!iseobj(userSelf)) {
+                        console.log('req.query', get(req, 'query'))
+                        console.log('tokenSelf', tokenSelf)
+                        console.log('[API]getPermUserInfor/check userSelf: invalid userSelf')
+                        srLog.error({ event: 'api/getPermUserInfor-error', msg: 'tokenNoPermission' })
+                        return Promise.reject(`tokenNoPermission`)
+                    }
+                    //userIdFind, 欲查找使用者的userId
+                    let userIdFind = get(req, 'query.userId', '')
+                    // console.log('userIdFind', userIdFind)
+                    //check
+                    if (!isestr(userIdFind)) {
+                        console.log('req.query', get(req, 'query'))
+                        console.log('tokenSelf', tokenSelf)
+                        console.log('[API]getPermUserInfor/check userIdFind: invalid userIdFind')
+                        srLog.error({ event: 'api/getPermUserInfor-error', msg: 'tokenNoPermission' })
+                        return Promise.reject(`tokenNoPermission`)
+                    }
+                    //getGenUserAndRulesByUserId, 查找到的使用者與權限
+                    let userWithRulesFind = await getGenUserAndRulesByUserId(userIdFind)
+                    // console.log('getGenUserAndRulesByUserId', userWithRulesFind)
+                    //check
+                    if (!iseobj(userWithRulesFind)) {
+                        console.log('userIdFind', userIdFind)
+                        console.log('[API]getPermUserInfor/check userWithRulesFind: invalid userWithRulesFind')
+                        srLog.error({ event: 'api/getPermUserInfor-error', msg: 'userIdNoPermrules' })
+                        return Promise.reject(`userIdNoPermrules`)
+                    }
+                    //info
+                    srLog.info({ event: 'api/getPermUserInfor-success', userId: userIdFind })
+                    return userWithRulesFind
+                }
+                //pm2resolve core
+                let r = await pm2resolve(core)() //w-ui-loginout接收已預設格式用pm2resolve轉過, 須另提取state進行判斷
+                if (isErr(r.msg)) {
+                    r.msg = r.msg.message
+                }
+                // console.log('getPermUserInfor', r)
+                return r
+            },
+        },
+        {
+            method: 'POST',
+            path: '/syncAndReplaceTabs',
+            handler: async function (req, res) {
+                // console.log('syncAndReplaceTabs', req)
+                // console.log('syncAndReplaceTabs payload', req.payload)
+                async function core() {
+                    //提供對象為node使用者, 須為系統管理者, 須先檢測token是否有效, 再進行數據變更
+                    //token
+                    let token = get(req, 'query.token', '')
+                    //check
+                    if (!isestr(token)) {
+                        console.log('req.query', get(req, 'query'))
+                        console.log('token', token)
+                        console.log('[API]syncAndReplaceTabs/check token: invalid token')
+                        srLog.error({ event: 'api/syncAndReplaceTabs-error', msg: 'tokenNoPermission' })
+                        return Promise.reject(`tokenNoPermission`)
+                    }
+                    //keyTable
+                    let keyTable = get(req, 'query.keyTable', '')
+                    //check
+                    if (!isestr(keyTable)) {
+                        console.log('req.query', get(req, 'query'))
+                        console.log('keyTable', keyTable)
+                        console.log('[API]syncAndReplaceTabs/check keyTable: invalid keyTable')
+                        srLog.error({ event: 'api/syncAndReplaceTabs-error', msg: 'tokenNoPermission' })
+                        return Promise.reject(`tokenNoPermission`)
+                    }
+                    //check keyTable
+                    let allowedTables = ['targets', 'pemis', 'grups', 'users']
+                    if (!allowedTables.includes(keyTable)) {
+                        console.log('[API]syncAndReplaceTabs/check keyTable: unexpected keyTable', keyTable)
+                        srLog.error({ event: 'api/syncAndReplaceTabs-error', msg: 'invalidKeyTable', keyTable })
+                        return Promise.reject(`invalidKeyTable`)
+                    }
+                    //getAndVerifyAppUser
+                    let user = await getAndVerifyAppUser(token, 'syncAndReplaceTabs')
+                    //check user
+                    if (!iseobj(user)) {
+                        console.log('token', token)
+                        console.log('[API]syncAndReplaceTabs/check user: invalid user')
+                        srLog.error({ event: 'api/syncAndReplaceTabs-error', msg: 'tokenNoPermission' })
+                        return Promise.reject(`tokenNoPermission`)
+                    }
+                    //userId
+                    let userId = get(user, 'id', '')
+                    //check userId
+                    if (!isestr(userId)) {
+                        console.log('token', token)
+                        console.log('user', user)
+                        console.log('[API]syncAndReplaceTabs/check userId: invalid userId')
+                        srLog.error({ event: 'api/syncAndReplaceTabs-error', msg: 'tokenNoPermission' })
+                        return Promise.reject(`tokenNoPermission`)
+                    }
+                    //parsePayload
+                    let inp = await parsePayload(req)
+                    //syncAndReplaceTabs
+                    let r = await syncAndReplaceTabs(userId, inp, keyTable)
+                    //info
+                    srLog.info({ event: 'api/syncAndReplaceTabs-success', userId, keyTable })
+                    return r
+                }
+                //pm2resolve core
+                let r = await pm2resolve(core)()
+                if (isErr(r.msg)) {
+                    r.msg = r.msg.message
+                }
+                // console.log('syncAndReplaceTabs', r)
+                return r
+            },
+        },
+    ]
+    //tableNamesExec, tableNamesSync
+    let tableNamesExec = keys(ds)
+    // let tableNamesSync = filter(tableNamesExec, (v) => {
+    //     return strright(v, 5) !== 'Items'//不同步數據
+    // })
+    let tableNamesSync = tableNamesExec
+    //WServHapiServer
+    instWServHapiServer = new WServHapiServer({
+        port: opt.serverPort,
+        pathStaticFiles,
+        apiName: 'api',
+        apis,
+        tokenType: 'Bearer',
+        verifyConn: async ({ apiType, authorization, query, headers, req }) => {
+            // console.log('verifyConn', `apiType[${apiType}]`, `authorization[${authorization}]`)
+            //token
+            let token = strdelleft(authorization, 7) //刪除Bearer
+            // console.log('token', token)
+            //check
+            if (!isestr(token)) {
+                console.log('apiType', apiType)
+                console.log('authorization', authorization)
+                console.log('invalid token')
+                return false
+            }
+            //checkToken
+            let b = await p.checkToken(token)
+            // console.log('b', b)
+            //ip, 對齊sso慣例x-forwarded-for取第1個, fallback到req remoteAddress, 取不到則略過
+            let ip = get(headers, 'x-forwarded-for', '').split(',')[0].trim()
+            if (!isestr(ip)) {
+                ip = get(req, 'info.remoteAddress', '') || get(req, 'socket.remoteAddress', '') || get(req, 'connection.remoteAddress', '')
+            }
+            //origin
+            let origin = get(headers, 'origin', '')
+            //referer
+            let referer = get(headers, 'referer', '')
+            //info
+            srLog.info({ event: 'verifyConn', ok: b, apiType, ip, origin, referer })
+            return b
+        },
+        getUserIdByToken: async (token) => { //可使用async或sync函數
+            // console.log('getUserIdByToken', token)
+            let user = await getUserByToken(token)
+            let userId = get(user, 'id', '')
+            if (!isestr(userId)) {
+                console.log('token', token)
+                console.log('userId', userId)
+                srLog.error({ event: 'getUserIdByToken-error', msg: 'cannotFindUserId' })
+                return Promise.reject(`cannotFindUserId`)
+            }
+            return userId
+        },
+        corsOrigins: ['*'],
+        useDbOrm: true,
+        kpOrm: woItems,
+        operOrm: procOrm, //procOrm的輸入為: userId, tableName, methodName, input
+        tableNamesExec,
+        methodsExec: ['select', 'insert', 'save', 'del', 'delAll'], //mix需於procOrm內註冊以提供
+        tableNamesSync,
+        kpFunExt: { //接收參數第1個為userId, 之後才是前端給予參數
+            getWebInfor,
+            // getTargetsList,
+            // getPemisList,
+            // getGrupsList,
+            // getUsersList,
+            updateTargets: pc.updateTargets,
+            updatePemis: pc.updatePemis,
+            updateGrups: pc.updateGrups,
+            updateUsers: pc.updateUsers,
+            getStaEvent: async (userId, timeLength, timeInterval) => {
+                let rs = await psi.getStaEvent(userId, timeLength, timeInterval)
+                srLog.info({ event: 'getStaEvent-success', userId })
+                return rs
+            },
+            getStaEventTable: async (userId) => {
+                let rs = await psi.getStaEventTable(userId)
+                srLog.info({ event: 'getStaEventTable-success', userId })
+                return rs
+            },
+        },
+        fnTableTags: 'tableTags-web-perm.json',
+    })
+    return instWServHapiServer
+}
+export default WWebPerm
+</code></pre>
+        </article>
+    </section>
+</div>
+<br class="clear">
+<footer>
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Mon Jun 22 2026 15:47:48 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+</footer>
+<script>prettyPrint();</script>
+<script src="scripts/polyfill.js"></script>
+<script src="scripts/linenumber.js"></script>
+</body>
+</html>