w-web-sso 1.1.13 → 1.1.14

package/docs/WWebSso.html

@@ -2492,7 +2492,7 @@ token發放/驗證/更新, 後台使用者/金鑰/IP管理與統計資訊, 以
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 17:28:25 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/global.html

@@ -3312,7 +3312,7 @@ why: 計時器之 async 回呼 reject 時無人接手, Node 預設即結束行
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 17:28:25 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/index.html

@@ -71,7 +71,7 @@
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 17:28:25 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/server_WWebSso.mjs.html

@@ -1457,7 +1457,7 @@ export default WWebSso
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 17:28:25 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/server_getIgnoredOrmKeys.mjs.html

@@ -93,7 +93,7 @@ export default getIgnoredOrmKeys
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 17:28:25 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/server_lockSave.mjs.html

@@ -102,7 +102,7 @@ export default createLockSave
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 17:28:25 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/server_ormWrite.mjs.html

@@ -108,7 +108,7 @@ export default ormWrite
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 17:28:25 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/server_staLogs_resolveShellWorker.mjs.html

@@ -167,7 +167,7 @@ export default resolveShellWorker
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 17:28:25 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/server_wrapTimer.mjs.html

@@ -117,7 +117,7 @@ export default wrapTimer
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 17:28:25 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/src_components_Common_CheckYesNo.vue.html

@@ -188,7 +188,7 @@ export default {
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 17:28:25 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/src_fetchSsoMsg.mjs.html

@@ -211,7 +211,7 @@ export { fetchSsoMsg, convertUser, hasUrlParam }
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 17:28:25 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/src_httpGetJson.mjs.html

@@ -100,7 +100,7 @@ export default httpGetJson
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 17:28:25 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/src_maskUrl.mjs.html

@@ -99,7 +99,7 @@ export default maskUrl
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 17:28:25 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/src_plugins_staUsage.mjs.html

@@ -237,7 +237,7 @@ export { getFreqVal, sumFreqVal, groupFreq, calcUsageSummary }
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 17:28:25 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/src_plugins_submitGuard.mjs.html

@@ -150,7 +150,7 @@ export default submitGuard
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 17:28:25 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "w-web-sso",
-  "version": "1.1.13",
+  "version": "1.1.14",
   "main": "dist/w-web-sso.umd.js",
   "dependencies": {
     "json5": "^2.2.3",

package/server/procCore.mjs

@@ -1312,9 +1312,14 @@ function proc(woItems, procOrm, { srLog, srEmail, salt, minExpired, kpLang, pass
         //'incorrect old password' reject 路徑, 自然不會多寄信.
         return await kmx(`changeUserPassword:${userId}`, async () => {
 
-            //讀取、驗舊密碼與寫入於 users 表鎖內(S07; kmx 在外層、表鎖在內層): password 為伺服器專有欄位、isForceChangePw 為雙方欄位(系統直寫須取表鎖),
-            //驗證所依之 DB 雜湊與寫入間不被其他寫入者(重設密碼、後台存檔)插隊; 只改不增, 列已被刪則拒絕而不新增殘缺列 (X5)
-            let { u, email } = await withTabLocks(['users'], async () => {
+            //讀取、驗舊密碼、撤銷其他 session 與寫入於 [tokens, users] 表鎖內(S07; kmx 在外層、表鎖在內層): password 為伺服器專有欄位、isForceChangePw 為雙方欄位(系統直寫須取表鎖),
+            //驗證所依之 DB 雜湊與寫入間不被其他寫入者(重設密碼、後台存檔、登入建立 session)插隊; 只改不增, 列已被刪則拒絕而不新增殘缺列 (X5)
+            //改密碼後之 session 處置 (R-SESS-01, ADR-093): 保留發出此請求之目前 session(token), 撤銷該使用者其他所有 session 權杖; app 權杖不是 session, 不撤銷
+            let { u, email } = await withTabLocks(['tokens', 'users'], async () => {
+
+                //鎖內再驗呼叫所用之權杖仍有效 (外審 sol#1): 鎖外之 checkToken 通過後、等鎖期間該 session 可能已被同使用者另一個改密碼請求或管理員重設撤銷,
+                //被撤銷之權杖不得再改密碼(否則「保留發出請求之目前 session」不成立, 該請求還會撤銷對方保留之 session); checkToken 只讀不取鎖, 可在鎖內呼叫
+                await checkToken(token)
 
                 //getGenUserByUserId (with password)
                 let u = await _getGenUserByKV('id', userId, { deletePassword: false })
@@ -1348,6 +1353,21 @@ function proc(woItems, procOrm, { srLog, srEmail, salt, minExpired, kpLang, pass
                 //hash newPassword
                 let passwordNew = hashPassword(newPassword, salt)
 
+                //撤銷其他 session(先於密碼寫入, 驗證皆已通過): 撤銷失敗即 reject 且密碼不變, 不會出現「密碼已變更但舊 session 仍有效」(R-SESS-01)
+                //(以布林旗標判失敗而非 errRevoke 是否為 null: reject 值可能為 null / undefined, 外審 sol#2)
+                let revokeFailed = false
+                let errRevoke = null
+                let nRevoked = await revokeSessionTokensLocked(userId, token)
+                    .catch((err) => {
+                        revokeFailed = true
+                        errRevoke = err
+                    })
+                if (revokeFailed) {
+                    srLog.error({ event: 'fun-changePassword-revokeSessions', key: 'userChangePasswordFail', userId, err: getErrorMessage(errRevoke) })
+                    return Promise.reject('userChangePasswordFail')
+                }
+                srLog.info({ event: 'fun-changePassword-revokeSessions', userId, nRevoked })
+
                 //save (清 isForceChangePw='n', 變更密碼成功後即解除強制變更), 更新者記該使用者本人 (R-CONC-04)
                 //逐筆檢查(ADR-080): 寫入失敗即 reject, 不寄「密碼已變更」信
                 let errTemp = null
@@ -1468,9 +1488,10 @@ function proc(woItems, procOrm, { srLog, srEmail, salt, minExpired, kpLang, pass
                 return Promise.reject('adminResetPasswordAlreadyTriggered')
             }
 
-            //目標 user 查找與寫入於 users 表鎖內(S08; kmx 在外層、表鎖在內層): password 為伺服器專有欄位、isForceChangePw 為雙方欄位(系統直寫須取表鎖);
+            //目標 user 查找、撤銷其全部 session 與寫入於 [tokens, users] 表鎖內(S08; kmx 在外層、表鎖在內層): password 為伺服器專有欄位、isForceChangePw 為雙方欄位(系統直寫須取表鎖);
             //只改不增, 目標已被刪則拒絕而不新增殘缺列 (X5); 更新者記操作管理員 (R-CONC-04)
-            let { targetAccount, targetName, targetEmail, newPassword } = await withTabLocks(['users'], async () => {
+            //改密碼後之 session 處置 (R-SESS-01, ADR-093): 撤銷對方全部 session 權杖(不含 app 權杖); 呼叫者(管理員 / app 權杖)自己之權杖不在撤銷範圍(目標不得為自己)
+            let { targetAccount, targetName, targetEmail, newPassword } = await withTabLocks(['tokens', 'users'], async () => {
 
                 //目標 user (含 password 拿到也不用, 只是確認存在)
                 let uTarget = null
@@ -1491,9 +1512,26 @@ function proc(woItems, procOrm, { srLog, srEmail, salt, minExpired, kpLang, pass
                 //產生隨機新密碼 (符合 passwordPolicy + account 限制)
                 let newPassword = genRandomPassword(passwordPolicy, targetAccount)
 
-                //hash + save (含 isForceChangePw='y')
-                //逐筆檢查(ADR-080): 寫入失敗即 reject, 不記節流、不寄出未生效之新密碼
+                //hash
                 let hashed = hashPassword(newPassword, salt)
+
+                //撤銷對方全部 session(先於密碼寫入): 撤銷失敗即 reject 且密碼不變, 不會出現「密碼已重設但舊 session 仍有效」(R-SESS-01)
+                //(以布林旗標判失敗而非 errRevoke 是否為 null: reject 值可能為 null / undefined, 外審 sol#2)
+                let revokeFailed = false
+                let errRevoke = null
+                let nRevoked = await revokeSessionTokensLocked(targetUserId)
+                    .catch((err) => {
+                        revokeFailed = true
+                        errRevoke = err
+                    })
+                if (revokeFailed) {
+                    srLog.error({ event: 'fun-adminResetUserPassword-revokeSessions', key: 'adminResetPasswordFailed', token: maskToken(token), targetUserId, err: getErrorMessage(errRevoke) })
+                    return Promise.reject('adminResetPasswordFailed')
+                }
+                srLog.info({ event: 'fun-adminResetUserPassword-revokeSessions', targetUserId, nRevoked })
+
+                //save (含 isForceChangePw='y')
+                //逐筆檢查(ADR-080): 寫入失敗即 reject, 不記節流、不寄出未生效之新密碼
                 let errTemp = null
                 await procOrm(operatorId, 'users', 'save', [{
                     id: targetUserId,
@@ -1595,6 +1633,40 @@ function proc(woItems, procOrm, { srLog, srEmail, salt, minExpired, kpLang, pass
     }
 
 
+    //revokeSessionTokensLocked: 改密碼後之 session 處置 (R-SESS-01, ADR-093), 須於 [tokens, users] 表鎖內呼叫(與密碼寫入同一組鎖, 不可重入).
+    //只撤銷 userId 名下之 session 權杖(isApp !== 'y', 即使用者登入所發); app 權杖(isApp === 'y')不是 session, 其 userId 為擁有者, 不撤銷
+    //(與 revokeTokensByUserIdLocked 之刪除 / 停用 / 封鎖情境不同: 該情境是使用者本身失效, 名下一切權杖皆撤).
+    //exceptToken: 發出請求之目前 session 權杖字串, 該筆保留(使用者自行改密碼); 管理員重設不給, 全撤.
+    //逐筆檢查(ormWrite), 單筆失敗不中斷其餘筆, 有失敗即 reject(含失敗筆主鍵), resolve 回傳撤銷筆數; 冪等(無可撤者回 0)
+    let revokeSessionTokensLocked = async (userId, exceptToken = '') => {
+
+        //check
+        if (!isestr(userId)) {
+            return Promise.reject(`invalid userId`)
+        }
+
+        //ts
+        let ts = await woItems.tokens.select({ userId })
+
+        //tsDel, session 權杖且非目前 session
+        let tsDel = filter(ts, (t) => {
+            return get(t, 'isApp', '') !== 'y' && !(isestr(exceptToken) && get(t, 'token', '') === exceptToken)
+        })
+
+        //check
+        if (size(tsDel) === 0) {
+            return 0
+        }
+
+        //del
+        await ormWrite(woItems.tokens, 'del', map(tsDel, (t) => {
+            return { id: t.id }
+        }))
+
+        return size(tsDel)
+    }
+
+
     //updateTabItems
     //後台清單整表存檔(users / tokens / ips), 多人同時編輯之寫入契約 (原則 10; 規格 dspec/多人同時編輯之寫入契約.md; 規則帳本 rulebook_concurrency R-CONC-01~05):
     //- 讀取、比對、驗證依賴庫內之項、diff、寫入、撤銷 token、清快取全程在該表表鎖內(users 為 [tokens, users], 因寫入後同鎖撤銷 token); 讀取為鎖內新鮮讀取(無 ORM 快取).

package/src/components/LayoutContentUsers.vue

@@ -251,7 +251,7 @@
                         </template>
                         <!-- redir -->
                         <template v-else-if="props.key === 'redir'">
-                            <span v-if="cellFieldErr('redir', props.value)" :title="cellFieldErr('redir', props.value)">
+                            <span v-if="cellRedirErr($ui.gv(props.row, 'id'))" :title="cellRedirErr($ui.gv(props.row, 'id'))">
                                 <img style="padding-right:4px; vertical-align:sub; width:16px; height:16px;" :src="$ui.getIcon('warning')" />
                                 <span style="color:#F57C00;">{{ $ui.cstr(props.value) }}</span>
                             </span>
@@ -424,6 +424,7 @@ import WAggridVue from 'w-aggrid-vue/src/components/WAggridVue.vue'
 import WTimeminute from 'w-component-vue/src/components/WTimeminute.vue'
 import WButtonChip from 'w-component-vue/src/components/WButtonChip.vue'
 import { baselineOfUsers } from '../baselineOf.mjs'
+import { redirOrigOfUsers, redirErrIdsOfUsers } from '../usersRedirCheck.mjs'
 
 
 export default {
@@ -460,6 +461,7 @@ export default {
 
             firstLoading: true,
             baseline: null, //載入時(及存檔成功後重新讀取時)畫面所見之列的有序基準 [[id, 列摘要]], 存檔時送後端比對(多人同時編輯, 先動先贏); null 為未載入或算不出, 送出時被後端拒收
+            redirOrig: null, //與 baseline 同一快照各列之 redir 原值 Map(id → redir; 用 Map 以免被 Vue 響應式處理覆蓋 `__ob__` 等鍵), 供判定「載入時即為空之既有列(如自助註冊者)」不擋存檔 (R-VAL-02); null 為算不出(此時 baseline 亦為 null, 後端無基準一律拒收), 只檢查新增列
             errMsg: '', //清單載入失敗之訊息(getDataError), 有值時以訊息取代表格
             firstSetting: true,
             systemProcing: false, //程式端載入/重載清單資料期間為true, 用於排除非使用者操作之rowsChange
@@ -576,6 +578,7 @@ export default {
             .then((res) => {
                 // console.log(res)
                 vo.baseline = baselineOfUsers(res) //對畫面所見之同一快照自算基準(須在排序、變動之前; buildBaseline 不改輸入)
+                vo.redirOrig = redirOrigOfUsers(res)
                 res = sortBy(res, 'order')
                 vo.users = res
                 vo.markDataReload() //程式端寫入資料, 其後續 rowsChange 非使用者變更
@@ -747,29 +750,22 @@ export default {
             return kpErr
         },
 
+        //redir(登入後轉址)檢查, 鍵為列主鍵 id (R-VAL-02, ADR-094): 只攔下管理員本次新增或由非空改為空之列;
+        //載入時即為空之既有列(如自助註冊者)不擋存檔、不標警示——一列之既有資料問題不得擋住整份清單之存檔
         errItemsByRedir: function() {
             let vo = this
 
             //rows
             let rows = get(vo, 'opt.rows', [])
 
+            //ids
+            let ids = redirErrIdsOfUsers(rows, vo.redirOrig)
+
             //kpErr
             let kpErr = Object.create(null)
-            each(rows, (v, k) => {
-
-                //redir
-                let redir = get(v, 'redir', '')
-
-                //check
-                if (!isestr(redir)) {
-
-                    //kpErr
-                    kpErr[redir] = vo.$t(`userRedirEmpty`)
-
-                    return true //跳出換下一個
-                }
-
-            })
+            for (let id in ids) {
+                kpErr[id] = vo.$t(`userRedirEmpty`)
+            }
 
             return kpErr
         },
@@ -929,7 +925,6 @@ export default {
             let errMaps = {
                 'account': vo.errItemsByAccount,
                 'email': vo.errItemsByEmail,
-                'redir': vo.errItemsByRedir,
             }
             //鍵為使用者輸入之 account / email / redir 值: 自有鍵查值, 不把輸入值當 lodash 路徑 (含 . 或 [ 者會被解析為路徑而取到他列之錯誤文字; R-KEY-01)
             let kp = errMaps[field]
@@ -937,6 +932,14 @@ export default {
             return isestr(err) ? err : ''
         },
 
+        //redir 欄位錯誤查詢, 鍵為 row.id (空值不能當鍵: 否則所有 redir 為空之儲存格會同時被標警示, 含載入時即為空而不擋存檔之既有列)
+        cellRedirErr: function(id) {
+            let vo = this
+            let kp = vo.errItemsByRedir
+            let err = (kp !== null && typeof kp === 'object' && Object.prototype.hasOwnProperty.call(kp, id)) ? kp[id] : ''
+            return isestr(err) ? err : ''
+        },
+
         //新增列密碼欄位錯誤查詢, 鍵為 row.id (其他欄位以 value 當鍵, 但 password 不適合做鍵)
         cellPasswordErr: function(id) {
             let vo = this
@@ -1577,6 +1580,7 @@ export default {
                 await vo.$fapi.getUsersList(token)
                     .then((res) => {
                         vo.baseline = baselineOfUsers(res)
+                        vo.redirOrig = redirOrigOfUsers(res)
                         res = sortBy(res, 'order')
                         vo.users = res
                         vo.markDataReload() //程式端寫入資料, 其後續 rowsChange 非使用者變更
@@ -1584,6 +1588,7 @@ export default {
                     .catch((err) => {
                         console.log('refresh getUsersList catch', err)
                         vo.baseline = null //重新讀取失敗: 舊基準已過期, 不沿用; 其後再存檔被後端拒收並提示重新載入(不降級為不帶基準)
+                        vo.redirOrig = null //同上, redir 比對基準亦不沿用(null 時只檢查新增列; 後端無基準之存檔一律拒收並提示重新載入)
                     })
 
                 //isModified

package/src/usersRedirCheck.mjs

@@ -0,0 +1,68 @@
+import get from 'lodash-es/get.js'
+import isestr from 'wsemi/src/isestr.mjs'
+
+
+//後台使用者清單之 redir(登入後轉址)檢查 (R-VAL-02, ADR-094; 第 116 項):
+//- redir 不可由管理員在本次編輯中設為空: 新增列、或既有列之 redir 由非空改為空者攔下(提示「尚未給予有效登入後轉址」, 該列 redir 格顯示警示)
+//- 載入時即為空的既有列不擋存檔、不標警示: 自助註冊者即如此(註冊流程不收 redir, 預設空字串; 使用者於 view=user / view=backstage 登入不需 redir,
+//  view=login 登入時以「無有效轉址」提示, 見 spec/流程_使用者一般登入.md E2E-016、spec/流程_使用者自動登入.md E2E-005); 一列之既有資料問題不得擋住整份清單之存檔
+//- 比對基準 redirOrig 為 Map(列主鍵 → 載入(及存檔成功後重新讀取)時畫面所見之 redir 原值): 用 Map 而非物件, 因基準存於 Vue data,
+//  Vue 2 會把純物件轉為響應式並以 `__ob__` 鍵掛 Observer(列主鍵恰為 `__ob__` 時會覆蓋其原值), Map 不被響應式處理, 且任何主鍵字串(`__proto__` 等)皆無原型鍵衝突(R-KEY-01)
+//- 基準算不出(null, 如存檔成功後重新讀取失敗)時: 只檢查新增列; 既有列不檢查——此時 baseline 亦為 null, 後端對無基準之存檔一律拒收(saveBaselineFormat, 提示重新載入),
+//  不會有任何列被寫入, 不必在前端對既有列先擋(先擋反而使使用者先看到不相干之 redir 訊息而到不了重新載入提示); 列不在基準內且非新增者(基準有效時)視為管理員所設, 嚴格檢查
+
+
+//redirOrigOfUsers: rows 為 getUsersList 之回傳(未排序、未變動); 回傳 Map(id → redir 原值; 非字串者記為空字串)
+function redirOrigOfUsers(rows) {
+    let mp = new Map()
+    for (let r of Array.isArray(rows) ? rows : []) {
+        let id = get(r, 'id', '')
+        if (typeof id !== 'string') {
+            continue
+        }
+        let redir = get(r, 'redir', '')
+        mp.set(id, typeof redir === 'string' ? redir : '')
+    }
+    return mp
+}
+
+
+//redirErrIdsOfUsers: rows 為畫面當前之列(含 _isNew 標記), redirOrig 為 redirOrigOfUsers 之結果或 null; 回傳 { [id]: true }(無原型物件)為不合規則之列
+function redirErrIdsOfUsers(rows, redirOrig) {
+    let kp = Object.create(null)
+    let known = redirOrig instanceof Map
+    for (let r of Array.isArray(rows) ? rows : []) {
+
+        //redir 非空即合規
+        if (isestr(get(r, 'redir', ''))) {
+            continue
+        }
+
+        //id
+        let id = get(r, 'id', '')
+
+        //新增列: 一律嚴格(標記優先於基準, 即使主鍵碰巧與基準內某列相同)
+        let isNew = get(r, '_isNew') === true
+
+        if (!isNew) {
+
+            //基準算不出: 既有列不檢查(後端無基準一律拒收, 見檔頭)
+            if (!known) {
+                continue
+            }
+
+            //載入時即為空之既有列: 既有資料之狀態, 不屬本次編輯所致
+            if (typeof id === 'string' && redirOrig.has(id) && !isestr(redirOrig.get(id))) {
+                continue
+            }
+
+        }
+
+        kp[typeof id === 'string' ? id : String(id)] = true
+    }
+    return kp
+}
+
+
+export { redirOrigOfUsers, redirErrIdsOfUsers }
+export default { redirOrigOfUsers, redirErrIdsOfUsers }