w-web-sso 1.1.13 → 1.1.15

package/docs/WWebSso.html

@@ -2492,7 +2492,7 @@ token發放/驗證/更新, 後台使用者/金鑰/IP管理與統計資訊, 以
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sat Oct 24 2026 21:09:45 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/global.html

@@ -3312,7 +3312,7 @@ why: 計時器之 async 回呼 reject 時無人接手, Node 預設即結束行
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sat Oct 24 2026 21:09:45 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/index.html

@@ -71,7 +71,7 @@
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sat Oct 24 2026 21:09:45 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/server_WWebSso.mjs.html

@@ -588,6 +588,17 @@ function WWebSso(WOrm, url, db, pathSettings, optExt = {}) {
     }
 
     let p = procCore(woItems, procOrm, { srLog, srEmail, salt, minExpired, kpLang, passwordPolicy, allowUserRegistration, siteUrl, verifyBaseUrl, withTabLocks, guardWrite })
+
+    //升級遷移 (ADR-095 補記): 啟動時對升級前建立之應用系統金鑰列一次性定案——升級前可用者視為系統服務用途(不設期限), 升級前即不可用者(已逾期、無 timeEnd、timeEnd 格式錯)標為已失效(retired), 不因「不設期限」而復活, 列不刪.
+    //冪等(已定案者不再處理); 不阻擋啟動——尚未定案之舊列(遷移進行中或失敗)讀取時依升級前規則判定, 永不比升級前更寬(已逾期者仍失效), 失敗者重啟後重試
+    p.migrateLegacyAppTokens()
+        .then((r) => {
+            logBoot('info', `應用系統金鑰升級遷移完成: 本次定案 ${r.marked} 筆(視為系統服務用途 ${r.system}、已失效 ${r.retired})`)
+        })
+        .catch((err) => {
+            logBoot('error', `應用系統金鑰升級遷移失敗(${err}): 尚未定案之舊列在重啟成功前依升級前規則判定(已逾期者仍失效, 未逾期者尚未改為不設期限)`)
+        })
+
     let pp = procProtect(woItems, p, {
         procOrm, //系統直寫(自動封鎖、計時器登錄 IP)經 procOrm 且在表鎖內, 更新者記 'system'
         withTabLocks,
@@ -1165,6 +1176,10 @@ function WWebSso(WOrm, url, db, pathSettings, optExt = {}) {
 
             return b
         },
+        //身分驗證責任(跨套件原則, 見自有套件庫主控之 dspec「使用者身分驗證原則」): 框架(w-converhp、w-serv-hapi、w-serv-webdata)不驗證token, 一律由本套件負責.
+        //本套件為token簽發方且資料通道不開表操作(useDbOrm:false): verifyConn只做IP封鎖與頻率, getUserIdByToken固定回空字串(不以本體token決定執行身分);
+        //故kpFunExt各函數一律以明確之token參數自行驗證(含管理員與細部權限), 查詢他人時以tokenSelf驗查詢方、tokenTarget只解析對象(checkTokenAndGetUserByToken);
+        //不帶token之公開入口只限列名者(登入、自助註冊〔須開啟〕、驗證信、重寄驗證信〔隨註冊開關〕、網站顯示資訊、密碼政策預檢), 新增函數不得省略token驗證.
         getUserIdByToken: async (token) => { //可使用async或sync函數
             return '' //不檢核, 查找與變更數據皆由kpFunExt內各函數各自檢核
         },
@@ -1343,6 +1358,15 @@ function WWebSso(WOrm, url, db, pathSettings, optExt = {}) {
                 return rs
             },
 
+            //createAppToken: 鑄造應用系統金鑰(ADR-095); data: { name, usage: 'user' | 'system', userId(使用者用途), perms(系統服務用途) }, 權杖字串由伺服端產生並於回傳值給予;
+            //權限閘同 updateTokensList(管理者或具 writeTokens 之系統服務用途金鑰); 後台清單存檔不再新增列
+            createAppToken: async (_t, token, lang, data) => {
+                if (!_strictStr(token)) return Promise.reject('tokenExpired')
+                srLog.info({ event: 'kpfun-createAppToken', token: maskToken(token), lang })
+                let r = await p.checkTokenAndCreateAppToken(token, data, { fun: funCheckAdmin, perm: 'writeTokens' })
+                return r
+            },
+
             getIpsList: async (_t, token) => {
                 if (!_strictStr(token)) return Promise.reject('tokenExpired')
                 srLog.info({ event: 'kpfun-getIpsList', token: maskToken(token) })
@@ -1457,7 +1481,7 @@ export default WWebSso
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sat Oct 24 2026 21:09:45 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/server_getIgnoredOrmKeys.mjs.html

@@ -93,7 +93,7 @@ export default getIgnoredOrmKeys
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sat Oct 24 2026 21:09:45 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/server_lockSave.mjs.html

@@ -102,7 +102,7 @@ export default createLockSave
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sat Oct 24 2026 21:09:45 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/server_ormWrite.mjs.html

@@ -108,7 +108,7 @@ export default ormWrite
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sat Oct 24 2026 21:09:45 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/server_staLogs_resolveShellWorker.mjs.html

@@ -167,7 +167,7 @@ export default resolveShellWorker
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sat Oct 24 2026 21:09:45 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/server_wrapTimer.mjs.html

@@ -117,7 +117,7 @@ export default wrapTimer
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sat Oct 24 2026 21:09:45 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/src_components_Common_CheckYesNo.vue.html

@@ -188,7 +188,7 @@ export default {
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sat Oct 24 2026 21:09:45 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/src_fetchSsoMsg.mjs.html

@@ -211,7 +211,7 @@ export { fetchSsoMsg, convertUser, hasUrlParam }
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sat Oct 24 2026 21:09:45 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/src_httpGetJson.mjs.html

@@ -100,7 +100,7 @@ export default httpGetJson
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sat Oct 24 2026 21:09:45 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/src_maskUrl.mjs.html

@@ -99,7 +99,7 @@ export default maskUrl
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sat Oct 24 2026 21:09:45 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/src_plugins_staUsage.mjs.html

@@ -237,7 +237,7 @@ export { getFreqVal, sumFreqVal, groupFreq, calcUsageSummary }
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sat Oct 24 2026 21:09:45 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/src_plugins_submitGuard.mjs.html

@@ -150,7 +150,7 @@ export default submitGuard
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Fri Oct 23 2026 11:30:30 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sat Oct 24 2026 21:09:45 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "w-web-sso",
-  "version": "1.1.13",
+  "version": "1.1.15",
   "main": "dist/w-web-sso.umd.js",
   "dependencies": {
     "json5": "^2.2.3",

package/server/WWebSso.mjs

@@ -541,6 +541,17 @@ function WWebSso(WOrm, url, db, pathSettings, optExt = {}) {
     }
 
     let p = procCore(woItems, procOrm, { srLog, srEmail, salt, minExpired, kpLang, passwordPolicy, allowUserRegistration, siteUrl, verifyBaseUrl, withTabLocks, guardWrite })
+
+    //升級遷移 (ADR-095 補記): 啟動時對升級前建立之應用系統金鑰列一次性定案——升級前可用者視為系統服務用途(不設期限), 升級前即不可用者(已逾期、無 timeEnd、timeEnd 格式錯)標為已失效(retired), 不因「不設期限」而復活, 列不刪.
+    //冪等(已定案者不再處理); 不阻擋啟動——尚未定案之舊列(遷移進行中或失敗)讀取時依升級前規則判定, 永不比升級前更寬(已逾期者仍失效), 失敗者重啟後重試
+    p.migrateLegacyAppTokens()
+        .then((r) => {
+            logBoot('info', `應用系統金鑰升級遷移完成: 本次定案 ${r.marked} 筆(視為系統服務用途 ${r.system}、已失效 ${r.retired})`)
+        })
+        .catch((err) => {
+            logBoot('error', `應用系統金鑰升級遷移失敗(${err}): 尚未定案之舊列在重啟成功前依升級前規則判定(已逾期者仍失效, 未逾期者尚未改為不設期限)`)
+        })
+
     let pp = procProtect(woItems, p, {
         procOrm, //系統直寫(自動封鎖、計時器登錄 IP)經 procOrm 且在表鎖內, 更新者記 'system'
         withTabLocks,
@@ -1118,6 +1129,10 @@ function WWebSso(WOrm, url, db, pathSettings, optExt = {}) {
 
             return b
         },
+        //身分驗證責任(跨套件原則, 見自有套件庫主控之 dspec「使用者身分驗證原則」): 框架(w-converhp、w-serv-hapi、w-serv-webdata)不驗證token, 一律由本套件負責.
+        //本套件為token簽發方且資料通道不開表操作(useDbOrm:false): verifyConn只做IP封鎖與頻率, getUserIdByToken固定回空字串(不以本體token決定執行身分);
+        //故kpFunExt各函數一律以明確之token參數自行驗證(含管理員與細部權限), 查詢他人時以tokenSelf驗查詢方、tokenTarget只解析對象(checkTokenAndGetUserByToken);
+        //不帶token之公開入口只限列名者(登入、自助註冊〔須開啟〕、驗證信、重寄驗證信〔隨註冊開關〕、網站顯示資訊、密碼政策預檢), 新增函數不得省略token驗證.
         getUserIdByToken: async (token) => { //可使用async或sync函數
             return '' //不檢核, 查找與變更數據皆由kpFunExt內各函數各自檢核
         },
@@ -1296,6 +1311,15 @@ function WWebSso(WOrm, url, db, pathSettings, optExt = {}) {
                 return rs
             },
 
+            //createAppToken: 鑄造應用系統金鑰(ADR-095); data: { name, usage: 'user' | 'system', userId(使用者用途), perms(系統服務用途) }, 權杖字串由伺服端產生並於回傳值給予;
+            //權限閘同 updateTokensList(管理者或具 writeTokens 之系統服務用途金鑰); 後台清單存檔不再新增列
+            createAppToken: async (_t, token, lang, data) => {
+                if (!_strictStr(token)) return Promise.reject('tokenExpired')
+                srLog.info({ event: 'kpfun-createAppToken', token: maskToken(token), lang })
+                let r = await p.checkTokenAndCreateAppToken(token, data, { fun: funCheckAdmin, perm: 'writeTokens' })
+                return r
+            },
+
             getIpsList: async (_t, token) => {
                 if (!_strictStr(token)) return Promise.reject('tokenExpired')
                 srLog.info({ event: 'kpfun-getIpsList', token: maskToken(token) })