本卡屬 FR-114 資安修正（母卡 CM-2019），第 5 批「信任鏈與客戶層級設定」卡 5A-5，修 M13 第 17 條（補進，不在 145 件 SUMMARY 內）與 SUMMARY #92（出自 M09-3）。中。修法規格來自內化卡 CM-2017（M13 部分）與 CM-1987（M09 部分），計畫在 docs/features/FR-114-2609-security-fix-dispatch/batches/plan-b5A.md「卡 5A-5」段。
M13 第 17 條：帳號被管理員停權（停用）之後，這個帳號手上已經拿到的通行證（token）與自動續期功能仍然可以繼續使用——目前系統只檢查「這支通行證有沒有被單獨撤銷」與「帳號存不存在」，沒有檢查「帳號現在是不是已經被停權」。
#92：日誌轉送設定只提供兩個明文傳送選項（UDP／TCP），沒有加密選項，客戶內網上跑的日誌內容完全是明文，可能被攔截。
首腦核對：
/Users/chouraymond/Projects/Jedicogy/module/jedi-python-package/.claude/worktrees/jedi-wt-fix-security/<套件目錄>（branch fix/security-b1）改，只動自己那支套件的子目錄、只 git add 該子目錄下的檔。 本卡對應 jedi-iam 與 jedi-log，各自 worktree（建議 jedi-wt-fix-security/jedi-iam、.../jedi-log）。pyproject.toml 把該套件的 pin 改成 jedi-xxx = { path = "/Users/chouraymond/Projects/Jedicogy/module/jedi-python-package/.claude/worktrees/jedi-wt-fix-security/jedi-xxx", develop = true }，poetry update jedi-xxx。這個 path 改動不 commit（git add 時跳過 pyproject.toml）。/Users/chouraymond/Projects/Billows/Audit-Manager/compliance-manager-fe/.claude/worktrees/wt-fix-security（branch fix/security-b1；不存在就 git worktree add .claude/worktrees/wt-fix-security -b fix/security-b1 開）。 本卡涉及日誌轉送設定表單的下拉選項改動。jedi-iam/jedi_iam/middleware/core.py:74-82 is_token_revoked
jedi-iam/jedi_iam/middleware/core.py:84-87 _lookup_user，只查帳號存在，新判斷要加在這裡
jedi-iam/jedi_iam/middleware/core.py:103 _lookup_user 內含 elevated_readonly_scope 提權，⚠️不提權會全站401，新判斷要在拿回的user物件上判斷、不要另開查詢
jedi-iam/jedi_iam/middleware/core.py:35 reason 清單
jedi-iam/jedi_iam/middleware/jwt_mw.py:162-163 check_if_token_revoked，HTTP 路徑
jedi-iam/jedi_iam/middleware/jwt_mw.py:157-158 revoked_token_callback
jedi-iam/jedi_iam/middleware/jwt_mw.py:67 錯誤碼清單
jedi-iam/jedi_iam/middleware/jwt_mw.py ⚠️HTTP 路徑傳 None 給 login_token_service、socket 路徑必須傳，兩條路徑都要補到（典型兩入口問題）
jedi-iam/jedi_iam/api/routes/login_route.py:84 refresh_auth_required
jedi-iam/jedi_iam/api/routes/login_route.py:87 refresh_user_token
jedi-iam/jedi_iam/api/routing.py:89 /refresh 路由
jedi-iam/jedi_iam/api/guards.py:60-61 守門相關
jedi-iam/jedi_iam/app/service/login_service.py:133 create_refresh_token
jedi-iam/jedi_iam/app/service/login_service.py:137 add_token_to_db
jedi-log/jedi_api_log/forwarding/domain/service/log_forwarding_setting_domain_service.py:20 VALID_TRANSPORTS，#92 核心
jedi-log/jedi_api_log/forwarding/infra/model/log_forwarding_setting.py:37 transport String(10) 欄位，寬度需確認
jedi-log/jedi_api_log/forwarding/common/forwarder.py:177-182 socktype 分支，加密要包 TLS 在此
jedi-log/jedi_api_log/forwarding/common/gelf_handler.py:76,80,142,158-159 GELF 側，兩條路都要支援（兩入口只改一邊）
jedi-log/jedi_api_log/forwarding/app/service/log_forwarding_app_service.py:158 delivery_confirmed 寫死 ==tcp
jedi-log/jedi_api_log/forwarding/app/service/log_forwarding_app_service.py:183-185 寫死 udp 提示
jedi-log/jedi_api_log/forwarding/app/service/log_forwarding_app_service.py:105,145 測試發送端點
jedi-log/jedi_api_log/forwarding/api/serializers/log_forwarding.py 序列化層
compliance-manager-fe/src/views/log-forwarding/LogForwardingForm.vue:69-72 transportOptions computed
compliance-manager-fe/src/views/log-forwarding/LogForwardingForm.vue:271-276 Dropdown template，照抄 :258-263 的 protocol 下拉
compliance-manager-fe/src/views/log-forwarding/LogForwardingForm.vue:52 預設值
compliance-manager-fe/src/views/log-forwarding/LogForwardingForm.vue:111 fallback
compliance-manager-fe/src/views/log-forwarding/LogForwardingForm.vue:162 送出 payload
compliance-manager-fe/src/i18n/zh-tw/log-forwarding.json:11-14 transport_hint 文案
compliance-manager-fe/src/i18n/en/log-forwarding.json:11-14 transport_hint 文案（英文）
_lookup_user（core.py:84-87）拿到 user 物件後，補判斷帳號是否已停權（⚠️需 grep status／is_active／enabled 等欄位名確認停權欄位的實際名稱，M13 第 13 條「角色停用」的既有寫法可當範本）。注意：不要另開一次查詢，在已經拿回的 user 物件上判斷即可，否則會影響效能且可能繞過既有的 elevated_readonly_scope 提權（:103），該提權若被誤動會導致全站 401。jwt_mw.py:162-163）與 socket 路徑（core.py）兩條路徑都要補——這是典型的兩入口問題：HTTP 路徑目前傳 None 給 login_token_service，socket 路徑必須傳實際值，兩邊都要接上新的停權判斷。login_route.py:84-87／login_service.py:133-137）同樣補上停權查核——停權帳號不能靠續期繼續延長通行證效期。use_tls）。這需要 DB 加欄位（migration，出貨基線待重產）。既有 udp／tcp 兩個選項要保留，不強制加密。