@abtnode/auth 1.8.67-beta-794a8082 → 1.8.68-beta-500af7e5

package/lib/auth.js

@@ -164,6 +164,10 @@ const messages = {
     en: 'Missing blocklet url',
     zh: '缺少应用下载地址',
   },
+  missingBlockletDid: {
+    en: 'Missing blocklet did',
+    zh: '缺少应用 ID',
+  },
   missingChainHost: {
     en: 'Missing chain host',
     zh: '缺少链的端点地址',

package/lib/server.js

@@ -9,6 +9,8 @@ const { fromBase58, toAddress, toHex } = require('@ocap/util');
 const { toTypeInfo, isFromPublicKey } = require('@arcblock/did');
 const urlFriendly = require('@blocklet/meta/lib/url-friendly').default;
 const { slugify } = require('transliteration');
+const { getChainInfo } = require('@blocklet/meta/lib/util');
+const getBlockletInfo = require('@blocklet/meta/lib/info');
 const formatContext = require('@abtnode/util/lib/format-context');
 const {
   ROLES,
@@ -17,6 +19,7 @@ const {
   NFT_TYPE_SERVER_OWNERSHIP,
   SERVER_ROLES,
   NFT_TYPE_SERVERLESS,
+  MAIN_CHAIN_ENDPOINT,
 } = require('@abtnode/constant');
 const { toExternalBlocklet } = require('@blocklet/meta/lib/did');
 const {
@@ -222,12 +225,13 @@ const authenticateByNFT = async ({ node, claims, userDid, challenge, locale, isA
   return { role: ROLES.OWNER, teamDid: info.did, nft: state, user, passport: null, ownerDid, ownerNFT: address };
 };
 
-const authenticateBySession = async ({ node, userDid }) => {
+const authenticateBySession = async ({ node, userDid, locale, allowedRoles = ['owner', 'admin', 'member'] }) => {
   const info = await node.getNodeInfo();
   const user = await getUser(node, info.did, userDid);
-  const passport = (user.passports || []).find(
-    (x) => x.status === 'valid' && ['owner', 'admin', 'member'].includes(x.role)
-  );
+  if (!user) {
+    throw new Error(messages.userNotFound[locale]);
+  }
+  const passport = (user.passports || []).find((x) => x.status === 'valid' && allowedRoles.includes(x.role));
   return { role: passport ? passport.role : ROLES.GUEST, teamDid: info.did, user, passport: null };
 };
 
@@ -286,8 +290,8 @@ const getAuthNFTClaim =
   };
 
 const getKeyPairClaim =
-  () =>
-  async ({ extraParams: { locale, title }, context: { didwallet } }) => {
+  (node) =>
+  async ({ extraParams: { locale, appDid, title }, context: { didwallet } }) => {
     checkWalletVersion({ didwallet, locale });
 
     const description = {
@@ -295,10 +299,27 @@ const getKeyPairClaim =
       zh: '请为应用创建新的钥匙对',
     };
 
+    let appName = title;
+    let migrateFrom = '';
+
+    // We are rotating a key-pair for existing application
+    if (appDid) {
+      const blocklet = await node.getBlocklet({ did: appDid, attachRuntimeInfo: false });
+      if (!blocklet) {
+        throw new Error(messages.invalidBlocklet[locale]);
+      }
+
+      const info = await node.getNodeInfo();
+      const { name, wallet } = getBlockletInfo(blocklet, info.sk);
+      appName = name;
+      migrateFrom = wallet.address;
+    }
+
     return {
       mfa: !process.env.DID_CONNECT_MFA_DISABLED,
       description: description[locale] || description.en,
-      moniker: (urlFriendly(slugify(title)) || 'application').toLowerCase(),
+      moniker: (urlFriendly(slugify(appName)) || 'application').toLowerCase(),
+      migrateFrom,
       targetType: {
         role: 'application',
         hash: 'sha3',
@@ -308,9 +329,52 @@ const getKeyPairClaim =
     };
   };
 
+const getRotateKeyPairClaims = (node) => {
+  return [
+    {
+      authPrincipal: async ({ extraParams: { locale, appDid } }) => {
+        const description = {
+          en: 'Please select ',
+          zh: '请为应用创建新的钥匙对',
+        };
+
+        let chainInfo = { host: 'none', id: 'none', type: 'arcblock' };
+
+        if (!appDid) {
+          throw new Error(messages.missingBlockletDid[locale]);
+        }
+
+        const blocklet = await node.getBlocklet({ did: appDid, attachRuntimeInfo: false });
+        if (!blocklet) {
+          throw new Error(messages.invalidBlocklet[locale]);
+        }
+
+        // Try to use blocklet chain config if possible
+        // Since migration happens on the chain the app holds some actual assets
+        // We must ensure it happens on that chain
+        chainInfo = getChainInfo(blocklet.configObj);
+
+        // Fallback to main chain, since it is the default registry for all DID
+        if (chainInfo.host === 'none') {
+          chainInfo = { host: MAIN_CHAIN_ENDPOINT, id: 'main', type: 'arcblock' };
+        }
+
+        return {
+          chainInfo,
+          description: description[locale] || description.en,
+          target: '',
+        };
+      },
+    },
+    {
+      keyPair: getKeyPairClaim(node),
+    },
+  ];
+};
+
 const getLaunchBlockletClaims = (node, authMethod) => {
   const claims = {
-    blockletAppKeypair: ['keyPair', getKeyPairClaim()],
+    blockletAppKeypair: ['keyPair', getKeyPairClaim(node)],
   };
 
   if (authMethod === 'vc') {
@@ -389,6 +453,7 @@ const ensureBlockletPermission = async ({
   blocklet,
   isAuth,
   chainHost,
+  allowedRoles = ['owner', 'admin', 'member'],
 }) => {
   let result;
   if (authMethod === 'vc') {
@@ -416,6 +481,8 @@ const ensureBlockletPermission = async ({
     result = await authenticateBySession({
       node,
       userDid,
+      locale,
+      allowedRoles,
     });
   }
 
@@ -554,7 +621,7 @@ const createLaunchBlockletHandler =
   };
 
 const getBlockletPermissionChecker =
-  (node) =>
+  (node, allowedRoles = ['owner', 'admin', 'member']) =>
   async ({ userDid, extraParams }) => {
     const { locale = 'en', connectedDid } = extraParams;
 
@@ -569,7 +636,7 @@ const getBlockletPermissionChecker =
 
     const info = await node.getNodeInfo();
     const user = await getUser(node, info.did, userDid);
-    const passport = (user.passports || []).find((x) => x.status === 'valid' && ['owner', 'admin'].includes(x.role));
+    const passport = (user.passports || []).find((x) => x.status === 'valid' && allowedRoles.includes(x.role));
     if (!passport) {
       throw new Error(
         {
@@ -580,15 +647,58 @@ const getBlockletPermissionChecker =
     }
   };
 
+const createRotateKeyPairHandler =
+  (node, authMethod) =>
+  async ({ claims, userDid, req, extraParams }) => {
+    const { locale, appDid } = extraParams;
+    logger.info('createRotateKeyPairHandler', extraParams);
+
+    const keyPair = claims.find((x) => x.type === 'keyPair');
+    if (!keyPair) {
+      logger.error('app keyPair must be provided');
+      throw new Error(messages.missingKeyPair[locale]);
+    }
+
+    if (!appDid) {
+      logger.error('appDid must be provided');
+      throw new Error(messages.missingBlockletDid[locale]);
+    }
+
+    const blocklet = await node.getBlocklet({ did: appDid, attachRuntimeInfo: false });
+    if (!blocklet) {
+      throw new Error(messages.invalidBlocklet[locale]);
+    }
+
+    const { role, user } = await ensureBlockletPermission({
+      authMethod,
+      node,
+      userDid,
+      locale,
+      allowedRoles: ['owner'],
+    });
+
+    await node.configBlocklet(
+      {
+        did: blocklet.meta.did,
+        configs: [{ key: 'BLOCKLET_APP_SK', value: toHex(keyPair.secret), secure: true }],
+        skipHook: true,
+        skipDidDocument: true,
+      },
+      formatContext(Object.assign(req, { user: { ...pick(user, ['did', 'fullName']), role } }))
+    );
+  };
+
 module.exports = {
   getAuthVcClaim,
   getKeyPairClaim,
   authenticateByVc,
   authenticateByNFT,
   authenticateBySession,
+  getRotateKeyPairClaims,
   getOwnershipNFTClaim,
   getLaunchBlockletClaims,
   createLaunchBlockletHandler,
+  createRotateKeyPairHandler,
   ensureBlockletPermission,
   getBlockletPermissionChecker,
   getSetupBlockletClaims,

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.8.67-beta-794a8082",
+  "version": "1.8.68-beta-500af7e5",
   "description": "Simple lib to manage auth in ABT Node",
   "main": "lib/index.js",
   "files": [
@@ -20,18 +20,18 @@
   "author": "linchen <linchen1987@foxmail.com> (http://github.com/linchen1987)",
   "license": "MIT",
   "dependencies": {
-    "@abtnode/constant": "1.8.67-beta-794a8082",
-    "@abtnode/logger": "1.8.67-beta-794a8082",
-    "@abtnode/util": "1.8.67-beta-794a8082",
-    "@arcblock/did": "1.18.54",
-    "@arcblock/jwt": "^1.18.54",
-    "@arcblock/vc": "1.18.54",
-    "@blocklet/constant": "1.8.67-beta-794a8082",
-    "@blocklet/meta": "1.8.67-beta-794a8082",
-    "@ocap/client": "1.18.54",
-    "@ocap/mcrypto": "1.18.54",
-    "@ocap/util": "1.18.54",
-    "@ocap/wallet": "1.18.54",
+    "@abtnode/constant": "1.8.68-beta-500af7e5",
+    "@abtnode/logger": "1.8.68-beta-500af7e5",
+    "@abtnode/util": "1.8.68-beta-500af7e5",
+    "@arcblock/did": "1.18.57",
+    "@arcblock/jwt": "^1.18.57",
+    "@arcblock/vc": "1.18.57",
+    "@blocklet/constant": "1.8.68-beta-500af7e5",
+    "@blocklet/meta": "1.8.68-beta-500af7e5",
+    "@ocap/client": "1.18.57",
+    "@ocap/mcrypto": "1.18.57",
+    "@ocap/util": "1.18.57",
+    "@ocap/wallet": "1.18.57",
     "axios": "^0.27.2",
     "joi": "17.7.0",
     "jsonwebtoken": "^9.0.0",
@@ -43,5 +43,5 @@
   "devDependencies": {
     "jest": "^27.5.1"
   },
-  "gitHead": "f4ad32bea4d80b12971fb6bef941bdbe2af6a834"
+  "gitHead": "9070621373f317a10ff0d289323bf725e30d3521"
 }