w-web-perm 1.1.8 → 1.1.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (51) hide show
  1. package/README.md +14 -4
  2. package/dist/index.tmp +1 -1
  3. package/dist/js/app-legacy.26e909d6.js +1 -0
  4. package/dist/js/app.26e909d6.js +1 -0
  5. package/dist/js/{chunk-vendors-legacy.00f159e8.js → chunk-vendors-legacy.b43f5548.js} +3 -3
  6. package/dist/js/{chunk-vendors.00f159e8.js → chunk-vendors.b43f5548.js} +3 -3
  7. package/dist/w-web-perm.umd.js +2 -2
  8. package/dist/w-web-perm.umd.js.map +1 -1
  9. package/docs/WWebPerm.html +78 -128
  10. package/docs/global.html +1280 -39
  11. package/docs/index.html +2 -2
  12. package/docs/server_WWebPerm.mjs.html +1247 -1196
  13. package/docs/server_dataChannel.mjs.html +131 -0
  14. package/docs/server_lockSave.mjs.html +2 -2
  15. package/docs/server_maskLog.mjs.html +2 -2
  16. package/docs/server_procCore.mjs.html +53 -11
  17. package/docs/server_staLogs_resolveShellWorker.mjs.html +180 -0
  18. package/docs/server_validateRows.mjs.html +184 -0
  19. package/docs/server_wrapInjected.mjs.html +2 -2
  20. package/docs/src_fetchJson.mjs.html +2 -2
  21. package/docs/src_js_legendFit.mjs.html +2 -2
  22. package/docs/src_plugins_reuseDeletedIds.mjs.html +2 -2
  23. package/docs/src_plugins_submitGuard.mjs.html +2 -2
  24. package/g_backupDb.mjs +4 -0
  25. package/g_initialData.mjs +1 -0
  26. package/g_initialTestData.mjs +1 -0
  27. package/g_mOrm.mjs +2 -7
  28. package/g_provideGrups.mjs +1 -0
  29. package/g_providePemis.mjs +1 -0
  30. package/g_provideTargets.mjs +1 -0
  31. package/g_provideUsers.mjs +1 -0
  32. package/package.json +14 -14
  33. package/server/WWebPerm.mjs +1245 -1194
  34. package/server/dataChannel.mjs +59 -0
  35. package/server/procCore.mjs +51 -9
  36. package/server/procLang.mjs +13 -3
  37. package/server/staLogs/resolveShellWorker.mjs +108 -0
  38. package/server/staLogs/staLogsCore.callWorker.mjs +29 -9
  39. package/server/validateRows.mjs +112 -0
  40. package/src/components/LayoutContentGrups.vue +8 -8
  41. package/src/components/LayoutContentPemis.vue +8 -8
  42. package/src/components/LayoutContentTargets.vue +2 -2
  43. package/src/components/LayoutContentUsers.vue +4 -4
  44. package/src/components/VeCgrups.vue +3 -3
  45. package/src/components/VeCpemis.vue +3 -3
  46. package/src/components/VeCrules.vue +3 -3
  47. package/src/components/VeGrupBlngUsers.vue +6 -6
  48. package/src/components/VePemiBlngGrups.vue +6 -6
  49. package/srv.mjs +0 -4
  50. package/dist/js/app-legacy.6f82d8bd.js +0 -1
  51. package/dist/js/app.6f82d8bd.js +0 -1
package/README.md CHANGED
@@ -33,10 +33,6 @@ let url = st.dbUrl
33
33
  let db = st.dbName
34
34
  let opt = {
35
35
 
36
- useCheckUser: false,
37
- getUserById: null,
38
- useExcludeWhenNotAdmin: false,
39
-
40
36
  serverPort: 11006,
41
37
  subfolder: '', //mperm
42
38
  urlRedirect: 'https://www.google.com/', //本機測試時得先編譯, 再瀏覽: http://localhost:11006/
@@ -97,3 +93,17 @@ instWWebPerm.on('error', (err) => {
97
93
  console.log(err)
98
94
  })
99
95
  ```
96
+
97
+ ## Upgrade Notes
98
+
99
+ ### Upgrading to w-serv-orm 1.1.11 / w-syslog 1.0.33 (2026-10-14)
100
+ - **Numeric ids are stored as strings**: a numeric row id sent to `/syncAndReplaceTabs` (or to `updatePemis`, `updateGrups`, `updateUsers`) is stored as its string form (`123` is stored as `'123'`) and the success response lists it as a string. Before, the number was replaced by a generated id while the response still showed the number. A number and its string form are the same id; `NaN` and `Infinity` count as no id (a new id is generated). `updateTargets` still accepts string ids only and rejects other ids with `saveRowFieldInvalid`.
101
+ - **Ids owned by another source are rejected**: if an id pushed to `/syncAndReplaceTabs` already belongs to another `from`, the whole push is rejected with `invalidRows` before anything is deleted (before, the row was skipped while the push still returned success). External applications must use ids that do not overlap with other sources.
102
+ - **Logging**: with w-syslog 1.0.33, a log write failure no longer terminates the process (it is reported on stderr), and `WWebPerm` throws at construction when `opt.logFd` cannot be created.
103
+ - **Bundled usage**: the statistics worker file is located on first use from the installed package (`server/staLogs/staLogsCore.shellWorker.mjs`), so `dist/w-web-perm.umd.js` and downstream bundles can run the statistics; the package must be installed with its `server` folder.
104
+
105
+ ### Upgrading to w-serv-orm 1.1.10 / w-serv-hapi 1.1.6 (2026-10-14)
106
+ - **Removed options**: `opt.useCheckUser`, `opt.getUserById` and `opt.useExcludeWhenNotAdmin` were removed together with w-serv-orm 1.1.9. Passing any value other than `undefined`, `null` or `false` now throws when constructing `WWebPerm` (the message comes from w-serv-orm `checkOptRemoved`) and is logged to srLog. Delete these keys; users of the data channel are authorized by `verifyConn` (`verifyClientUser`), no replacement option is needed.
107
+ - **Data channel is select-only (behavior change)**: only `<table>.select` of `targets`, `pemis`, `grups` and `users` is exposed (`methodsExec: ['select']`, and `authorizeExec` allows select only). Calling raw `insert`, `save`, `del` or `delAll` now returns `invalid func[<table>.<method>]`. Clients that wrote tables directly must call `updateTargets`, `updatePemis`, `updateGrups` or `updateUsers`, which apply the save lock, serialization, validation and whole-table diff.
108
+ - **Write validation**: rows to be written are validated before anything is deleted or written. A string value that XSS cleaning would rewrite (for example `<` followed by a letter) is rejected with `htmlMarkupNotAllowed`; an id longer than 1978 UTF-8 bytes is rejected with `saveRowFieldInvalid` (admin lists) or `invalidRows` (`syncAndReplaceTabs`). Unexpected database write failures return `saveWriteFail`; the ORM messages are written to srLog only.
109
+ - **Process-level errors**: w-serv-hapi 1.1.6 no longer registers `unhandledRejection` or `uncaughtException` handlers, and `WWebPerm` does not register them either; the deployment decides its own process policy.
package/dist/index.tmp CHANGED
@@ -1,4 +1,4 @@
1
1
  <!doctype html><html xmlns="http://www.w3.org/1999/xhtml" lang="zh-tw"><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"/><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=no,minimal-ui"><meta http-equiv="X-UA-Compatible" content="ie=edge"><meta name="referrer" content="strict-origin"><title></title><link _href="https://cdn.jsdelivr.net/npm/@mdi/font@7.4.47/css/materialdesignicons.min.css" rel="stylesheet"><link _href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6.4.2/css/all.min.css" rel="stylesheet"><script>window.___pmwperm___={
2
2
  urlRedirect: '{urlRedirect}',
3
3
  language: '{language}',
4
- }</script><script defer="defer" src="{sfd}/js/chunk-vendors.00f159e8.js" type="module"></script><script defer="defer" src="{sfd}/js/app.6f82d8bd.js" type="module"></script><link href="{sfd}/css/chunk-vendors.3c580e72.css" rel="stylesheet"><link href="{sfd}/css/app.6918ec45.css" rel="stylesheet"><script defer="defer" src="{sfd}/js/chunk-vendors-legacy.00f159e8.js" nomodule></script><script defer="defer" src="{sfd}/js/app-legacy.6f82d8bd.js" nomodule></script></head><body style="font-family:'Microsoft JhengHei','Avenir','Helvetica', 'Arial', 'sans-serif'; padding:0px; margin:0px;"><noscript><strong>We're sorry but w-component-vue doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div></body></html>
4
+ }</script><script defer="defer" src="{sfd}/js/chunk-vendors.b43f5548.js" type="module"></script><script defer="defer" src="{sfd}/js/app.26e909d6.js" type="module"></script><link href="{sfd}/css/chunk-vendors.3c580e72.css" rel="stylesheet"><link href="{sfd}/css/app.6918ec45.css" rel="stylesheet"><script defer="defer" src="{sfd}/js/chunk-vendors-legacy.b43f5548.js" nomodule></script><script defer="defer" src="{sfd}/js/app-legacy.26e909d6.js" nomodule></script></head><body style="font-family:'Microsoft JhengHei','Avenir','Helvetica', 'Arial', 'sans-serif'; padding:0px; margin:0px;"><noscript><strong>We're sorry but w-component-vue doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div></body></html>