@abtnode/auth 1.16.52-beta-20250909-073849-4e392ab1 → 1.16.52-beta-20250911-023851-d988be85

package/lib/passkey.js

@@ -2,7 +2,7 @@ const pick = require('lodash/pick');
 const { joinURL } = require('ufo');
 const { Joi } = require('@arcblock/validator');
 const { fromPublicKey } = require('@ocap/wallet');
-const { ROLES, PASSPORT_STATUS } = require('@abtnode/constant');
+const { ROLES, PASSPORT_STATUS, WELLKNOWN_BLOCKLET_ADMIN_PATH } = require('@abtnode/constant');
 const { LOGIN_PROVIDER } = require('@blocklet/constant');
 const { WELLKNOWN_SERVICE_PATH_PREFIX, SECURITY_RULE_DEFAULT_ID } = require('@abtnode/constant');
 const { fromBase64, toBase64, toBuffer, toUint8Array, toHex } = require('@ocap/util');
@@ -44,6 +44,23 @@ const shouldVerifyUser = (action) =>
   !process.env.ABT_NODE_NO_PASSKEY_USER_VERIFY &&
   ['verify-elevated', 'verify-destroy', 'disconnect', 'destroy-self'].includes(action);
 
+const shouldCheckRole = (mode, req) => {
+  if (mode === 'server') {
+    return true;
+  }
+  try {
+    const referrerUrl = req.get('referrer');
+    if (!referrerUrl) {
+      return true;
+    }
+    const url = new URL(referrerUrl);
+    return !url.pathname || url.pathname.startsWith(WELLKNOWN_BLOCKLET_ADMIN_PATH);
+  } catch (error) {
+    console.warn('Failed to parse URL when checking dashboard path', { error, referrerUrl: req.get('referrer') });
+    return true;
+  }
+};
+
 const isRegisterAction = (action) => ['register', 'connect-owner'].includes(action);
 
 const getDomain = (req) => req.get('host').split(':')[0];
@@ -425,25 +442,30 @@ function createPasskeyHandlers(node, mode, createToken) {
     }
 
     let expectedRoles = [ROLES.OWNER, ROLES.ADMIN, ROLES.MEMBER];
+    const userRoles = (req?.userExpanded?.passports || [])
+      .filter((x) => x.status === PASSPORT_STATUS.VALID && x.scope === 'passport')
+      .map((x) => x.role);
+    const shouldCheck = shouldCheckRole(mode, req);
     if (req.query.action === 'verify-destroy') {
       const { payload, roles, locale = 'en' } = req.query;
-      expectedRoles = validateVerifyDestroyRequest({
-        payload,
-        roles,
-        locale,
-        allowedRoles: expectedRoles,
-      });
+
+      expectedRoles = shouldCheck
+        ? validateVerifyDestroyRequest({
+            payload,
+            roles,
+            locale,
+            allowedRoles: expectedRoles,
+          })
+        : userRoles;
     }
     if (req.query.action === 'verify-destroy' || req.query.action === 'verify-elevated') {
       if (!req.userExpanded) {
         return res.status(400).send({ error: 'You need to be logged in to perform this action.' });
       }
-      const hasRoles = expectedRoles.some((role) =>
-        req.userExpanded.passports?.some(
-          (x) => x.role === role && x.status === PASSPORT_STATUS.VALID && x.scope === 'passport'
-        )
-      );
-      if (!hasRoles) {
+
+      const hasRoles = expectedRoles.some((role) => userRoles?.some((x) => x === role));
+
+      if (!hasRoles && shouldCheck && userRoles.length > 0) {
         return res.status(400).send({ error: 'You do not have the required passports to perform this action.' });
       }
     }

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.16.52-beta-20250909-073849-4e392ab1",
+  "version": "1.16.52-beta-20250911-023851-d988be85",
   "description": "Simple lib to manage auth in ABT Node",
   "main": "lib/index.js",
   "files": [
@@ -20,9 +20,9 @@
   "author": "linchen <linchen1987@foxmail.com> (http://github.com/linchen1987)",
   "license": "Apache-2.0",
   "dependencies": {
-    "@abtnode/constant": "1.16.52-beta-20250909-073849-4e392ab1",
-    "@abtnode/logger": "1.16.52-beta-20250909-073849-4e392ab1",
-    "@abtnode/util": "1.16.52-beta-20250909-073849-4e392ab1",
+    "@abtnode/constant": "1.16.52-beta-20250911-023851-d988be85",
+    "@abtnode/logger": "1.16.52-beta-20250911-023851-d988be85",
+    "@abtnode/util": "1.16.52-beta-20250911-023851-d988be85",
     "@arcblock/did": "1.24.0",
     "@arcblock/did-connect-js": "1.24.0",
     "@arcblock/did-ext": "1.24.0",
@@ -31,10 +31,10 @@
     "@arcblock/nft-display": "^3.1.37",
     "@arcblock/validator": "1.24.0",
     "@arcblock/vc": "1.24.0",
-    "@blocklet/constant": "1.16.52-beta-20250909-073849-4e392ab1",
+    "@blocklet/constant": "1.16.52-beta-20250911-023851-d988be85",
     "@blocklet/error": "^0.2.5",
-    "@blocklet/meta": "1.16.52-beta-20250909-073849-4e392ab1",
-    "@blocklet/sdk": "1.16.52-beta-20250909-073849-4e392ab1",
+    "@blocklet/meta": "1.16.52-beta-20250911-023851-d988be85",
+    "@blocklet/sdk": "1.16.52-beta-20250911-023851-d988be85",
     "@ocap/client": "1.24.0",
     "@ocap/mcrypto": "1.24.0",
     "@ocap/util": "1.24.0",
@@ -56,5 +56,5 @@
   "devDependencies": {
     "jest": "^29.7.0"
   },
-  "gitHead": "3b4b1551b181606f84799ba8b294fb36b483c9c3"
+  "gitHead": "90c5cf74138797733868312beb5e509c9db3a8f8"
 }