@abtnode/auth 1.7.20 → 1.7.21

package/lib/auth.js

@@ -5,10 +5,12 @@ const get = require('lodash/get');
 const { verifyPresentation, createCredentialList } = require('@arcblock/vc');
 const formatContext = require('@abtnode/util/lib/format-context');
 const Mcrypto = require('@ocap/mcrypto');
+const Client = require('@ocap/client');
 const { fromSecretKey, WalletType } = require('@ocap/wallet');
 const getBlockletInfo = require('@blocklet/meta/lib/info');
 const { PASSPORT_STATUS, VC_TYPE_NODE_PASSPORT, ROLES } = require('@abtnode/constant');
 const axios = require('@abtnode/util/lib/axios');
+
 const logger = require('./logger');
 const verifySignature = require('./util/verify-signature');
 const {
@@ -199,6 +201,18 @@ const messages = {
     en: 'chainHost not found from server launcher info',
     zh: '节点初始化信息异常：缺少链地址',
   },
+  alreadyTransferred: {
+    en: 'The Blocklet Server already belongs to {owner}',
+    zh: '该节点已经属于 {owner}',
+  },
+  delegateTransferOwnerNFT: {
+    en: 'Sign the delegation transaction to authorize blocklet server to transfer your ownership NFT to new owner when he/she claims the transfer.',
+    zh: '签名下面的交易以授权节点转移所有权以及代表所有权的 NFT。',
+  },
+  notAllowedTransferToSelf: {
+    en: 'Not allowed to transfer the Server to yourself',
+    zh: '不能将节点转移给自己',
+  },
 };
 
 const PASSPORT_STATUS_KEY = 'passport-status';
@@ -372,11 +386,38 @@ const handleInvitationResponse = async ({
   claims,
   statusEndpointBaseUrl,
   endpoint,
+  newNftOwner,
 }) => {
   if (!nodeInfo.nodeOwner) {
     throw new Error(messages.notInitialized[locale]);
   }
 
+  const tmpInvitation = await node.getInvitation({ teamDid, inviteId });
+
+  if (tmpInvitation.role === 'owner' && userDid === nodeInfo.nodeOwner.did) {
+    throw new Error(messages.notAllowedTransferToSelf[locale]);
+  }
+
+  const inviteInfo = await node.processInvitation({ teamDid, inviteId });
+  if (inviteInfo.role === 'owner' && get(nodeInfo, 'ownerNft.holder')) {
+    // 这种情况下是 Transfer 有 Owner NFT 的 Blocklet Server
+    const client = new Client(nodeInfo.launcher.chainHost);
+
+    const { state: assetState } = await client.getAssetState({ address: nodeInfo.ownerNft.did });
+    if (assetState.owner !== newNftOwner) {
+      const hash = await client.transfer({
+        delegator: nodeInfo.ownerNft.holder,
+        to: newNftOwner,
+        assets: [nodeInfo.ownerNft.did],
+        wallet: getNodeWallet(nodeInfo.sk),
+      });
+
+      logger.info('transferred nft', { hash, nft: nodeInfo.ownerNft.did });
+      await node.updateNftHolder(newNftOwner);
+      logger.info('updated owner nft holder', { holder: newNftOwner, nft: nodeInfo.ownerNft.did });
+    }
+  }
+
   const claim = claims.find((x) => x.type === 'signature');
   verifySignature(claim, userDid, userPk, locale);
 
@@ -387,7 +428,6 @@ const handleInvitationResponse = async ({
     passportColor,
   } = await getTeamInfo({ node, nodeInfo, teamDid });
 
-  const inviteInfo = await node.processInvitation({ teamDid, inviteId });
   const { remark } = inviteInfo;
 
   const profile = claims.find((x) => x.type === 'profile');
@@ -424,6 +464,25 @@ const handleInvitationResponse = async ({
 
   const user = await getUser(node, teamDid, userDid);
 
+  if (role === 'owner') {
+    if (user && user.role === 'owner') {
+      throw new Error(messages.alreadyTransferred[locale](userDid));
+    }
+
+    await node.updateNodeOwner({ nodeOwner: { did: userDid, pk: userPk } });
+
+    const originalOwner = await getUser(node, teamDid, nodeInfo.nodeOwner.did);
+    const originalOwnerPassport = (originalOwner.passports || []).find((p) => p.role === 'owner');
+    if (originalOwnerPassport) {
+      await node.revokeUserPassport({ teamDid, userDid: nodeInfo.nodeOwner.did, passportId: originalOwnerPassport.id });
+      logger.info('passport revoked on server transfer claiming', {
+        teamDid,
+        userDid: nodeInfo.nodeOwner.did,
+        passportId: originalOwnerPassport.id,
+      });
+    }
+  }
+
   if (user) {
     const doc = await node.updateUser({
       teamDid,

package/lib/invitation.js

@@ -10,6 +10,7 @@ module.exports = {
       const { inviteId } = req.query;
       const groupPathPrefix = req.headers['x-group-path-prefix'] || '/';
 
+      const nodeInfo = await node.getNodeInfo();
       try {
         let info;
         if (type === 'blocklet') {
@@ -24,22 +25,23 @@ module.exports = {
             // TODO: 需要将 CHAIN_HOST 纳入标准
             chainHost: blockletInfo.configObj.CHAIN_HOST,
             passportColor: blockletInfo.configObj[BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_PASSPORT_COLOR],
+            description: blockletInfo.meta.description,
           };
         } else {
-          const nodeInfo = await node.getNodeInfo();
           info = {
             did: nodeInfo.did,
             appDid: nodeInfo.did,
             url: '/',
             name: nodeInfo.name,
             version: nodeInfo.version,
+            description: nodeInfo.description,
           };
         }
 
         const teamDid = info.did;
         const invitations = await node.getInvitations({ teamDid });
         const invitation = invitations.find((v) => v.inviteId === inviteId);
-        if (!invitation) {
+        if (!invitation || Date.now() > new Date(invitation.expireDate).getTime()) {
           res.status(404).send('Invitation not found or invitation has been used');
           return;
         }
@@ -55,16 +57,21 @@ module.exports = {
           logger.error('failed to get role permission', { teamDid, role: role.name, error: err });
           role.permissions = [];
         }
+        const user = await node.getUser({ teamDid: nodeInfo.did, user: { did: invitation.inviter.did } });
+
+        const inviter = {
+          did: invitation.inviter.did,
+          email: invitation.inviter.email,
+          fullName: invitation.inviter.fullName,
+          role: invitation.inviter.role,
+          avatar: user && user.avatar,
+        };
 
         res.json({
           ...invitation,
           info,
-          inviter: {
-            did: invitation.inviter.did,
-            email: invitation.inviter.email,
-            fullName: invitation.inviter.fullName,
-            role: invitation.inviter.role,
-          },
+          inviter,
+          inviterRaw: invitation.inviter,
           role: role || {},
         });
       } catch (err) {

package/lib/server.js

@@ -160,12 +160,12 @@ const authenticateByNFT = async ({ node, claims, userDid, challenge, locale }) =
   }
 
   const user = await getUser(node, info.did, userDid);
-  return { role: ROLES.OWNER, teamDid: info.did, nft: state, user, passport: null };
+  return { role: ROLES.OWNER, teamDid: info.did, nft: state, user, passport: null, ownerDid, ownerNFT: address };
 };
 
 const getAuthVcClaim =
   (node) =>
-  async ({ extraParams: { locale, passportId = '' }, context: { didwallet } }) => {
+  async ({ extraParams: { locale, passportId }, context: { didwallet } }) => {
     checkWalletVersion({ didwallet, locale });
     const info = await node.getNodeInfo();
     const trustedPassports = (info.trustedPassports || []).map((x) => x.issuerDid);

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.7.20",
+  "version": "1.7.21",
   "description": "Simple lib to manage auth in ABT Node",
   "main": "lib/index.js",
   "files": [
@@ -20,12 +20,12 @@
   "author": "linchen <linchen1987@foxmail.com> (http://github.com/linchen1987)",
   "license": "MIT",
   "dependencies": {
-    "@abtnode/constant": "1.7.20",
-    "@abtnode/logger": "1.7.20",
-    "@abtnode/util": "1.7.20",
+    "@abtnode/constant": "1.7.21",
+    "@abtnode/logger": "1.7.21",
+    "@abtnode/util": "1.7.21",
     "@arcblock/did": "^1.16.15",
     "@arcblock/vc": "^1.16.15",
-    "@blocklet/meta": "1.7.20",
+    "@blocklet/meta": "1.7.21",
     "@ocap/client": "1.16.15",
     "@ocap/mcrypto": "^1.16.15",
     "@ocap/util": "^1.16.15",
@@ -40,5 +40,5 @@
   "devDependencies": {
     "jest": "^27.4.5"
   },
-  "gitHead": "7e579415aa56cc422f3e26d902cf029fbc92e47a"
+  "gitHead": "e7b99d9b3f878cc47e54ddfead2ac5284145b6ae"
 }