@abtnode/blocklet-services 1.16.11-next-a4e155ae → 1.16.11-next-a9ab0bad

package/api/routes/user.js

@@ -4,6 +4,7 @@ const { fromAppDid } = require('@arcblock/did-ext');
 const { extractUserAvatar } = require('@abtnode/util/lib/user');
 const formatContext = require('@abtnode/util/lib/format-context');
 const logger = require('@abtnode/logger')('blocklet-services:user');
+const { isFromPublicKey } = require('@arcblock/did');
 
 const { generateTranslate } = require('../libs/translate');
 const { isInvitedUserOnly } = require('../util');
@@ -14,6 +15,14 @@ const { loginWalletSchema, loginOAuthSchema } = require('../validators/login');
 const verifySig = require('../middlewares/verify-sig');
 const { getAvatarByEmail } = require('../libs/auth/utils');
 
+const validateUser = (user) => {
+  try {
+    return user && user.did && user.pk && isFromPublicKey(user.did, user.pk);
+  } catch (e) {
+    return false;
+  }
+};
+
 const PREFIX = WELLKNOWN_SERVICE_PATH_PREFIX;
 
 const prefix = `${PREFIX}/user`;
@@ -22,11 +31,13 @@ const translations = {
     needInviteToLogin: '你需要被邀请才可以登录此应用',
     notAllowed: '你没有权限登录该节点',
     needComponentId: '缺少登录参数: componentId',
+    userInfoError: '登录用户信息有误',
   },
   en: {
     needInviteToLogin: 'You need to be invited to sign in to this app',
     notAllowed: 'You are not allowed to login to this node',
     needComponentId: 'componentId is required when login user',
+    userInfoError: 'Login user info is invalid',
   },
 };
 
@@ -111,7 +122,7 @@ async function loginWallet({ did, pk, avatar, email, fullName }, { node, req, lo
   }
 
   const lastLoginIp = req.get('x-real-ip');
-  const doc = await node.loginUser({
+  const loginParams = {
     teamDid,
     user: {
       did: currentUser?.did || did,
@@ -121,7 +132,11 @@ async function loginWallet({ did, pk, avatar, email, fullName }, { node, req, lo
       connectedAccount: { provider, did, pk },
       ...profile,
     },
-  });
+  };
+  if (!validateUser(loginParams.user) || !validateUser(loginParams.user.connectedAccount)) {
+    throw new ApiError(400, t('userInfoError', locale));
+  }
+  const doc = await node.loginUser(loginParams);
 
   // NOTICE: 使用 provider: wallet 登录的账号，其账号是由 wallet 产生的，所以不需要到链上 declare 了
   return doc;
@@ -166,7 +181,7 @@ async function loginOAuth(
 
   const lastLoginIp = req.get('x-real-ip');
 
-  const doc = await node.loginUser({
+  const loginParams = {
     teamDid,
     user: {
       did: currentUser?.did || userDid,
@@ -176,7 +191,11 @@ async function loginOAuth(
       connectedAccount: { provider, id, did: userDid, pk: userPk },
       ...profile,
     },
-  });
+  };
+  if (!validateUser(loginParams.user) || !validateUser(loginParams.user.connectedAccount)) {
+    throw new ApiError(400, t('userInfoError', locale));
+  }
+  const doc = await node.loginUser(loginParams);
   return doc;
 }
 

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.16.11-next-a4e155ae",
+  "version": "1.16.11-next-a9ab0bad",
   "description": "Provide unified services for every blocklet",
   "main": "api/index.js",
   "files": [
@@ -33,17 +33,17 @@
   "author": "wangshijun <wangshijun2010@gmail.com> (http://github.com/wangshijun)",
   "license": "Apache-2.0",
   "dependencies": {
-    "@abtnode/auth": "1.16.11-next-a4e155ae",
-    "@abtnode/client": "1.16.11-next-a4e155ae",
-    "@abtnode/connect-storage": "1.16.11-next-a4e155ae",
-    "@abtnode/constant": "1.16.11-next-a4e155ae",
-    "@abtnode/core": "1.16.11-next-a4e155ae",
-    "@abtnode/cron": "1.16.11-next-a4e155ae",
-    "@abtnode/logger": "1.16.11-next-a4e155ae",
-    "@abtnode/models": "1.16.11-next-a4e155ae",
-    "@abtnode/router-adapter": "1.16.11-next-a4e155ae",
-    "@abtnode/router-templates": "1.16.11-next-a4e155ae",
-    "@abtnode/util": "1.16.11-next-a4e155ae",
+    "@abtnode/auth": "1.16.11-next-a9ab0bad",
+    "@abtnode/client": "1.16.11-next-a9ab0bad",
+    "@abtnode/connect-storage": "1.16.11-next-a9ab0bad",
+    "@abtnode/constant": "1.16.11-next-a9ab0bad",
+    "@abtnode/core": "1.16.11-next-a9ab0bad",
+    "@abtnode/cron": "1.16.11-next-a9ab0bad",
+    "@abtnode/logger": "1.16.11-next-a9ab0bad",
+    "@abtnode/models": "1.16.11-next-a9ab0bad",
+    "@abtnode/router-adapter": "1.16.11-next-a9ab0bad",
+    "@abtnode/router-templates": "1.16.11-next-a9ab0bad",
+    "@abtnode/util": "1.16.11-next-a9ab0bad",
     "@arcblock/did": "^1.18.80",
     "@arcblock/did-auth": "1.18.80",
     "@arcblock/did-ext": "^1.18.80",
@@ -52,11 +52,11 @@
     "@arcblock/jwt": "1.18.80",
     "@arcblock/validator": "^1.18.80",
     "@arcblock/ws": "1.18.80",
-    "@blocklet/constant": "1.16.11-next-a4e155ae",
+    "@blocklet/constant": "1.16.11-next-a9ab0bad",
     "@blocklet/form-builder": "^0.1.11",
     "@blocklet/form-collector": "^0.1.6",
-    "@blocklet/meta": "1.16.11-next-a4e155ae",
-    "@blocklet/sdk": "1.16.11-next-a4e155ae",
+    "@blocklet/meta": "1.16.11-next-a9ab0bad",
+    "@blocklet/sdk": "1.16.11-next-a9ab0bad",
     "@did-connect/authenticator": "^2.1.59",
     "@did-connect/relay-adapter-express": "^2.1.59",
     "@did-connect/storage-nedb": "^2.1.59",
@@ -93,7 +93,7 @@
     "@nedb/core": "^2.1.2"
   },
   "devDependencies": {
-    "@abtnode/ux": "1.16.11-next-a4e155ae",
+    "@abtnode/ux": "1.16.11-next-a9ab0bad",
     "@arcblock/did-connect": "^2.5.48",
     "@arcblock/icons": "^2.5.48",
     "@arcblock/ux": "^2.5.48",
@@ -161,5 +161,5 @@
     "url": "https://github.com/ArcBlock/blocklet-server/issues",
     "email": "shijun@arcblock.io"
   },
-  "gitHead": "6e426ebc362f9763daf10299527f6d6acc1e0e25"
+  "gitHead": "55bb74175d9c30db5157e911cb88a226a307d734"
 }