@abtnode/auth 1.16.0-beta-ad6df3ae → 1.16.0-beta-7a7d5d97

package/lib/auth.js

@@ -110,8 +110,8 @@ const messages = {
     zh: '无效的凭证签名',
   },
   passportRevoked: {
-    en: (issuer) => `Passport has been revoked${issuer ? ' by ' : ''}${issuer || ''}`,
-    zh: (issuer) => `通行证已被${issuer ? ' ' : ''}${issuer || ''}${issuer ? ' ' : ''}吊销`,
+    en: (title, issuer) => `Passport ${title} has been revoked${issuer ? ' by ' : ''}${issuer || ''}`,
+    zh: (title, issuer) => `通行证 ${title} 已被${issuer ? ' ' : ''}${issuer || ''}${issuer ? ' ' : ''}吊销`,
   },
   notOwner: {
     en: 'The account does not match the owner account of this passport, please use the DID wallet that contains the owner account of this passport to receive.',
@@ -219,17 +219,13 @@ const messages = {
     en: 'This NFT is for another blocklet server',
     zh: '您所提供的所有权 NFT 不属于当前节点',
   },
-  requestNft: {
-    en: 'Please provide server ownership NFT',
-    zh: '请提供节点所有权 NFT',
+  requestBlockletSpaceNFT: {
+    en: 'Please provide Blocklet Space NFT',
+    zh: '请提供应用空间 NFT',
   },
-  requestServerlessNFT: {
-    en: 'Please provide serverless NFT',
-    zh: '请提供无服务 NFT',
-  },
-  serverlessNftIdRequired: {
-    en: 'Serverless NFT ID is required',
-    zh: '无服务 NFT ID 是必须的',
+  blockletSpaceNftIdRequired: {
+    en: 'Blocklet Space NFT ID is required',
+    zh: '应用空间 NFT ID 是必须的',
   },
   nftAlreadyConsume: {
     en: 'This NFT has already been used',
@@ -1008,7 +1004,10 @@ const getPassportStatus = async ({ node, teamDid, userDid, vcId, locale = 'en' }
           name: PASSPORT_STATUS_KEY,
           label: messages.statusLabel[locale],
           value: passport.status,
-          reason: passport.status === PASSPORT_STATUS.REVOKED ? messages.passportRevoked[locale](issuerName) : '',
+          reason:
+            passport.status === PASSPORT_STATUS.REVOKED
+              ? messages.passportRevoked[locale](passport.title, issuerName)
+              : '',
         },
       ],
     }),

package/lib/server.js

@@ -2,7 +2,10 @@ const get = require('lodash/get');
 const pick = require('lodash/pick');
 const isEmpty = require('lodash/isEmpty');
 const last = require('lodash/last');
+const uniq = require('lodash/uniq');
+const pRetry = require('p-retry');
 const { isNFTExpired, isNFTConsumed } = require('@abtnode/util/lib/nft');
+const axios = require('@abtnode/util/lib/axios');
 const Client = require('@ocap/client');
 const { fromPublicKey } = require('@ocap/wallet');
 const { types } = require('@ocap/mcrypto');
@@ -64,6 +67,40 @@ const getTrustedIssuers = (nodeInfo) => {
   return [nodeInfo.did, ...trustedPassports].filter(Boolean);
 };
 
+const getLauncherAppIdList = async (url) => {
+  try {
+    const urlObj = new URL('__blocklet__.js?type=json', url);
+
+    const func = async () => {
+      const { data } = await axios.get(urlObj.href);
+      const result = [data.appId, data.appPid];
+      if (Array.isArray(data.alsoKnownAs)) {
+        result.push(...data.alsoKnownAs);
+      }
+
+      return uniq(result.map((s) => s.trim()).filter(Boolean));
+    };
+
+    const delay = process.env.NODE_ENV === 'test' ? 100 : 5000;
+
+    const result = await pRetry(func, {
+      retries: 3,
+      minTimeout: delay,
+      maxTimeout: delay,
+      onFailedAttempt: (error) => {
+        logger.error(`attempt get launcher blocklet meta ${urlObj.href} failed.`, { error });
+      },
+    });
+
+    logger.info('launcher app id list:', { result, launcher: url });
+
+    return result;
+  } catch (error) {
+    logger.error(`get launcher blocklet meta ${url} failed.`, { error });
+    throw new Error(`get launcher blocklet meta ${url} failed: ${error.message}`);
+  }
+};
+
 const authenticateByVc = async ({
   node,
   locale,
@@ -112,7 +149,7 @@ const authenticateByVc = async ({
   // Get user passport from vc
   let passport = createUserPassport(vc);
   if (user && isUserPassportRevoked(user, passport)) {
-    throw new Error(messages.passportRevoked[locale](name));
+    throw new Error(messages.passportRevoked[locale](passport.title, name));
   }
 
   // Get role from vc
@@ -190,7 +227,8 @@ const authenticateByNFT = async ({ node, claims, userDid, challenge, locale, isA
     throw new Error(messages.invalidNftHolder[locale]);
   }
 
-  if (state.issuer !== info.launcher.did) {
+  const trustedLaunchers = await getLauncherAppIdList(get(info, 'launcher.url'));
+  if (!trustedLaunchers.includes(state.issuer)) {
     throw new Error(messages.invalidNftIssuer[locale]);
   }
 
@@ -283,10 +321,10 @@ const getAuthNFTClaim =
     checkWalletVersion({ didwallet, locale });
     if (launchType === 'serverless') {
       if (!nftId) {
-        throw new Error(messages.serverlessNftIdRequired[locale]);
+        throw new Error(messages.blockletSpaceNftIdRequired[locale]);
       }
 
-      return getServerlessNFTClaim(node, nftId, locale);
+      return getServerlessNFTClaim(nftId, locale);
     }
 
     return getOwnershipNFTClaim(node, locale);
@@ -458,27 +496,15 @@ const getOwnershipNFTClaim = async (node, locale) => {
   }
 
   return {
-    description: messages.requestNft[locale],
+    description: messages.requestBlockletSpaceNFT[locale],
     trustedIssuers: [info.ownerNft.issuer],
     tag, // tag is an unique identifier for the server in launcher
   };
 };
 
-const getServerlessNFTClaim = async (node, nftId, locale) => {
-  const info = await node.getNodeInfo();
-  if (!info.ownerNft || !info.ownerNft.issuer) {
-    throw new Error(messages.noNft[locale]);
-  }
-
-  const chainHost = get(info, 'launcher.chainHost', '');
-
-  if (!chainHost) {
-    throw new Error(messages.noChainHost[locale]);
-  }
-
+const getServerlessNFTClaim = async (nftId, locale) => {
   return {
-    description: messages.requestServerlessNFT[locale],
-    trustedIssuers: [info.ownerNft.issuer],
+    description: messages.requestBlockletSpaceNFT[locale],
     address: nftId,
   };
 };
@@ -779,4 +805,5 @@ module.exports = {
   getTrustedIssuers,
   getAuthNFTClaim,
   getServerlessNFTClaim,
+  getLauncherAppIdList,
 };

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.16.0-beta-ad6df3ae",
+  "version": "1.16.0-beta-7a7d5d97",
   "description": "Simple lib to manage auth in ABT Node",
   "main": "lib/index.js",
   "files": [
@@ -20,14 +20,14 @@
   "author": "linchen <linchen1987@foxmail.com> (http://github.com/linchen1987)",
   "license": "MIT",
   "dependencies": {
-    "@abtnode/constant": "1.16.0-beta-ad6df3ae",
-    "@abtnode/logger": "1.16.0-beta-ad6df3ae",
-    "@abtnode/util": "1.16.0-beta-ad6df3ae",
+    "@abtnode/constant": "1.16.0-beta-7a7d5d97",
+    "@abtnode/logger": "1.16.0-beta-7a7d5d97",
+    "@abtnode/util": "1.16.0-beta-7a7d5d97",
     "@arcblock/did": "1.18.64",
     "@arcblock/jwt": "^1.18.64",
     "@arcblock/vc": "1.18.64",
-    "@blocklet/constant": "1.16.0-beta-ad6df3ae",
-    "@blocklet/meta": "1.16.0-beta-ad6df3ae",
+    "@blocklet/constant": "1.16.0-beta-7a7d5d97",
+    "@blocklet/meta": "1.16.0-beta-7a7d5d97",
     "@ocap/client": "1.18.64",
     "@ocap/mcrypto": "1.18.64",
     "@ocap/util": "1.18.64",
@@ -36,6 +36,7 @@
     "joi": "17.7.0",
     "jsonwebtoken": "^9.0.0",
     "lodash": "^4.17.21",
+    "p-retry": "4.6.1",
     "semver": "^7.3.8",
     "transliteration": "^2.3.5",
     "url-join": "^4.0.1"
@@ -43,5 +44,5 @@
   "devDependencies": {
     "jest": "^27.5.1"
   },
-  "gitHead": "8fa60176a00400cd412b308df3c7d6dcd9af2db1"
+  "gitHead": "c25ddcc371454b2e2f7038aa5e64c7b7c27763cb"
 }