@abtnode/blocklet-services 1.16.13-beta-55b3e93d → 1.16.13-beta-423a40b1

package/api/cache.js

@@ -3,12 +3,15 @@ const nodemailer = require('nodemailer');
 const getBlockletInfo = require('@blocklet/meta/lib/info');
 const md5 = require('@abtnode/util/lib/md5');
 
-const options = {
+const cache = new LRU({
   max: 100, // cache at most 100
   maxAge: 60 * 60 * 1000, // cache for 1 hour
-};
+});
 
-const cache = new LRU(options);
+const sessionCacheDisabledUser = new LRU({
+  max: 10000,
+  maxAge: 86400 * 1000, // cache for 1 day
+});
 
 const keyFns = {
   node() {
@@ -29,6 +32,9 @@ const keyFns = {
   notificationConfig(did) {
     return md5(`${did}:notificationConfig`);
   },
+  sessionCacheDisabledUser(did) {
+    return md5(`sessionCacheDisabledUser:${did}`);
+  },
 };
 
 cache.getNodeInfo = async ({ node }) => {
@@ -112,6 +118,17 @@ cache.getTransport = ({ did, config, force }) => {
   return transporter;
 };
 
+cache.sessionCacheDisabledUser = {
+  get: (did) => {
+    const cacheKey = cache.keyFns.sessionCacheDisabledUser(did);
+    return sessionCacheDisabledUser.get(cacheKey);
+  },
+  set: (did) => {
+    const cacheKey = cache.keyFns.sessionCacheDisabledUser(did);
+    return sessionCacheDisabledUser.set(cacheKey, true);
+  },
+};
+
 cache.keyFns = keyFns;
 
 module.exports = cache;

package/api/index.js

@@ -68,6 +68,7 @@ module.exports = function createServer(node, serverOptions = {}) {
     sessionTtl: process.env.ABT_NODE_SESSION_TTL,
     webWalletUrl: 'https://web.abtwallet.io',
     sessionTokenKey: 'login_token',
+    refreshTokenKey: 'refresh_token',
     ...serverOptions,
     isProduction,
     isE2E,
@@ -144,6 +145,10 @@ module.exports = function createServer(node, serverOptions = {}) {
     logger.info('node update', { pid: process.pid });
     cache.del(cache.keyFns.node());
   });
+  eventHub.on(EVENTS.USER_PERMISSION_UPDATED, ({ teamDid, user } = {}) => {
+    logger.info('user permission updated', { teamDid, userDid: user?.did });
+    cache.sessionCacheDisabledUser.set(user?.did);
+  });
 
   [BlockletInternalEvents.componentsUpdated, BlockletInternalEvents.appConfigChanged].forEach((name) => {
     eventHub.on(name, (data) => {
@@ -226,8 +231,11 @@ module.exports = function createServer(node, serverOptions = {}) {
   notificationService.sendToAppChannel.attach(server);
   relayService.sendToRelay.attach(server);
 
+  // API: auth: before auth middleware
+  authRoutes.createSessionRoutes.init(server, node);
+
   // Middleware: auth info
-  server.use(authMiddlewares.bearerToken);
+  server.use(authMiddlewares.sessionBearerToken);
   server.use(authMiddlewares.userInfo);
 
   // API: auth
@@ -239,7 +247,6 @@ module.exports = function createServer(node, serverOptions = {}) {
   createConnectRelayRoutes.init(server, node, options, wsRouter);
   authRoutes.attachDidAuthHandlers(server);
   authRoutes.createPassportRoutes.init(server, node);
-  authRoutes.createSessionRoutes.init(server, node);
 
   // API: gql
   ['/api/gql', '/api/preferences', '/api/uploads'].forEach((pathname) => {

package/api/libs/connect/session.js

@@ -40,7 +40,7 @@ const { getRolesFromAuthConfig, getBlockletAppIdList } = require('@blocklet/meta
 
 const logger = require('@abtnode/logger')(require('../../../package.json').name);
 
-const { isInvitedUserOnly } = require('../../util');
+const { isInvitedUserOnly, createTokenFn, getDidConnectVersion } = require('../../util');
 const { transferPassport } = require('../auth/utils');
 const { generateTranslate } = require('../translate');
 const { migrateAccount, declareAccount } = require('../../services/oauth');
@@ -204,7 +204,8 @@ module.exports = {
       action,
     }) => {
       const blocklet = await request.getBlocklet();
-      const { wallet, secret, name, passportColor, did: teamDid } = await request.getBlockletInfo();
+      const blockletInfo = await request.getBlockletInfo();
+      const { wallet, secret, name, passportColor, did: teamDid } = blockletInfo;
 
       // Check user approved
       const user = await node.getUser({
@@ -383,7 +384,13 @@ module.exports = {
       }
 
       // Generate new session token that client can save to localStorage
-      const sessionToken = await createSessionToken(realDid, { secret, passport, role });
+      const createToken = createTokenFn(createSessionToken);
+      const sessionConfig = blocklet.settings?.session || {};
+      const { sessionToken, refreshToken } = createToken(
+        realDid,
+        { secret, passport, role },
+        { ...sessionConfig, didConnectVersion: getDidConnectVersion(request) }
+      );
       logger.info(`${action}.success`, { userDid: realDid, role });
 
       if (
@@ -403,6 +410,7 @@ module.exports = {
           type: 'VerifiableCredential',
           data: vc,
           sessionToken,
+          refreshToken,
           nextWorkflowData: {
             userDid: realDid,
           },
@@ -411,6 +419,7 @@ module.exports = {
 
       return {
         sessionToken,
+        refreshToken,
         nextWorkflowData: {
           userDid: realDid,
         },
@@ -630,8 +639,14 @@ module.exports = {
       );
 
       // Generate new session token that client can save to localStorage
-      const sessionToken = await createSessionToken(userDid, { secret, passport, role });
-      return sessionToken;
+      const createToken = createTokenFn(createSessionToken);
+      const sessionConfig = blocklet.settings?.session || {};
+      const { sessionToken, refreshToken } = createToken(
+        userDid,
+        { secret, passport, role },
+        { ...sessionConfig, didConnectVersion: getDidConnectVersion(request) }
+      );
+      return { sessionToken, refreshToken };
     },
   },
 

package/api/libs/jwt.js

@@ -12,18 +12,20 @@ const getUser = async (node, teamDid, userDid) => {
 
 // eslint-disable-next-line no-unused-vars
 const initJwt = (node, options) => {
-  const ttl = options.sessionTtl || '7d';
+  // 保持默认有效期为 1 天
+  const ttl = options.sessionTtl || '1d';
 
-  const createSessionToken = (did, { role, secret, passport }) =>
+  const createSessionToken = (did, { role, secret, passport, expiresIn, tokenType }) =>
     createAuthToken({
       did,
       passport,
       role,
       secret,
-      expiresIn: ttl,
+      expiresIn: expiresIn || ttl,
+      tokenType,
     });
 
-  const verifySessionToken = (token, secret, teamDid) =>
+  const verifySessionToken = (token, secret, { checkFromDb, teamDid, checkToken } = {}) =>
     // eslint-disable-next-line implicit-arrow-linebreak
     new Promise((resolve, reject) => {
       jwt.verify(token, secret, async (err, decoded) => {
@@ -31,29 +33,43 @@ const initJwt = (node, options) => {
           return reject(err);
         }
 
+        if (typeof checkToken === 'function') {
+          try {
+            await checkToken(decoded);
+          } catch (e) {
+            return reject(e);
+          }
+        }
+
         const { did, role, passport } = decoded;
+        let user;
         if (!did) {
           return reject(new Error('Invalid jwt token: invalid did'));
         }
 
-        // NOTICE: session 中的 did 是永久 did，不需要查询 connectedAccount
-        const user = await getUser(node, teamDid, did);
-        if (!user) {
-          return reject(new Error('Invalid jwt token: invalid user'));
+        let isCheck = checkFromDb;
+        if (typeof checkFromDb === 'function') {
+          isCheck = checkFromDb(decoded);
         }
 
-        if (passport && passport.id) {
-          const valid = await node.isPassportValid({ teamDid, passportId: passport.id });
-          if (valid === false) {
-            return reject(new Error(`Passport ${passport.name} has been revoked`));
+        if (isCheck) {
+          // NOTICE: session 中的 did 是永久 did，不需要查询 connectedAccount
+          user = await getUser(node, teamDid, did);
+          if (!user) {
+            return reject(new Error('Invalid jwt token: invalid user'));
           }
-        }
 
-        user.role = role;
+          if (passport && passport.id) {
+            const valid = await node.isPassportValid({ teamDid, passportId: passport.id });
+            if (valid === false) {
+              return reject(new Error(`Passport ${passport.name} has been revoked`));
+            }
+          }
 
-        // backward compatible
-        if (!role && passport && !passport.id) {
-          user.role = passport.name;
+          user.role = role;
+          user.passport = passport;
+        } else {
+          user = { did, role, passport };
         }
 
         return resolve(user);

package/api/routes/connect/session.js

@@ -101,7 +101,7 @@ module.exports = {
       try {
         const { locale, currentConnected, responseClaims, challenge, currentStep } = req.body;
         const { createSessionToken } = initJwt(node, options);
-        const sessionToken = await switchPassport.onApprove({
+        const { sessionToken, refreshToken } = await switchPassport.onApprove({
           node,
           request: req,
           locale,
@@ -110,7 +110,7 @@ module.exports = {
           userDid: currentConnected.userDid,
           createSessionToken,
         });
-        res.json({ sessionToken });
+        res.json({ sessionToken, refreshToken });
       } catch (err) {
         console.error(err);
         res.json({ error: err.message });

package/api/routes/oauth.js

@@ -20,7 +20,7 @@ const { getAvatarByEmail, transferPassport, getAvatarByUrl } = require('../libs/
 const initJwt = require('../libs/jwt');
 const { sendToUser } = require('../libs/notification');
 const { generateTranslate } = require('../libs/translate');
-const { isInvitedUserOnly } = require('../util');
+const { isInvitedUserOnly, createTokenFn, getDidConnectVersion } = require('../util');
 const { ApiError } = require('../util/error');
 
 const PREFIX = WELLKNOWN_SERVICE_PATH_PREFIX;
@@ -152,12 +152,24 @@ async function login(req, node, options) {
 
   const { createSessionToken } = initJwt(node, options);
 
-  const sessionToken = await createSessionToken(currentUser.did, {
-    secret,
-    passport,
-    role: passport.role,
-  });
-  return sessionToken;
+  const createToken = createTokenFn(createSessionToken);
+  const sessionConfig = blocklet.settings?.session || {};
+  const { sessionToken, refreshToken } = createToken(
+    currentUser.did,
+    {
+      secret,
+      passport,
+      role: passport.role,
+    },
+    { ...sessionConfig, didConnectVersion: getDidConnectVersion(req) }
+  );
+
+  // for backward compatibility
+  if (!getDidConnectVersion(req)) {
+    return sessionToken;
+  }
+
+  return { sessionToken, refreshToken };
 }
 
 async function invite(req, node, options) {
@@ -261,8 +273,21 @@ async function invite(req, node, options) {
 
   const { createSessionToken } = initJwt(node, options);
 
-  const sessionToken = await createSessionToken(userDid, { secret, passport, role });
-  return sessionToken;
+  const createToken = createTokenFn(createSessionToken);
+  const sessionConfig = blocklet.settings?.session || {};
+
+  const { sessionToken, refreshToken } = createToken(
+    userDid,
+    { secret, passport, role },
+    { ...sessionConfig, didConnectVersion: getDidConnectVersion(req) }
+  );
+
+  // for backward compatibility
+  if (!getDidConnectVersion(req)) {
+    return sessionToken;
+  }
+
+  return { sessionToken, refreshToken };
 }
 
 // eslint-disable-next-line no-unused-vars
@@ -403,7 +428,7 @@ module.exports = {
     server.post(`${prefix}/bind`, async (req, res) => {
       try {
         await bind(req, node, options);
-        res.status(200).send('');
+        res.status(200).json({});
       } catch (err) {
         logger.error('Failed bind oauth', { error: err });
         if (err instanceof ApiError) {
@@ -417,6 +442,7 @@ module.exports = {
     server.post(`${prefix}/switch`, async (req, res) => {
       const userDid = req.user.did;
       const { passportId } = req.body;
+      const blocklet = await req.getBlocklet();
       const { did: teamDid, secret } = await req.getBlockletInfo();
       // NOTICE: 这里获取的 did 是当前登录用户的永久 did，无需查询 connectedAccount
       const user = await node.getUser({ teamDid, user: { did: userDid } });
@@ -432,8 +458,20 @@ module.exports = {
         node
       );
       const { createSessionToken } = initJwt(node, options);
-      const sessionToken = await createSessionToken(userDid, { secret, passport, role: passport.role });
-      res.status(200).send(sessionToken);
+      const createToken = createTokenFn(createSessionToken);
+      const sessionConfig = blocklet.settings?.session || {};
+      const { sessionToken, refreshToken } = createToken(
+        userDid,
+        { secret, passport, role: passport.role },
+        { ...sessionConfig, didConnectVersion: getDidConnectVersion(req) }
+      );
+
+      // for backward compatibility
+      if (!getDidConnectVersion(req)) {
+        res.status(200).send(sessionToken);
+      }
+
+      res.status(200).json({ sessionToken, refreshToken });
     });
 
     /**

package/api/routes/user.js

@@ -7,7 +7,7 @@ const logger = require('@abtnode/logger')('blocklet-services:user');
 const { isFromPublicKey } = require('@arcblock/did');
 
 const { generateTranslate } = require('../libs/translate');
-const { isInvitedUserOnly } = require('../util');
+const { isInvitedUserOnly, createTokenFn, getDidConnectVersion } = require('../util');
 const initJwt = require('../libs/jwt');
 const { getAvatarByUrl } = require('../libs/auth/utils');
 const { ApiError } = require('../util/error');
@@ -207,6 +207,7 @@ async function login(req, node, options) {
     throw new ApiError(400, t('needComponentId', locale));
   }
   const { did: teamDid, wallet: blockletWallet, secret } = await req.getBlockletInfo();
+  const blocklet = await req.getBlocklet();
 
   let doc;
   if (provider === 'wallet') {
@@ -233,12 +234,18 @@ async function login(req, node, options) {
 
   const { createSessionToken } = initJwt(node, options);
 
-  const sessionToken = await createSessionToken(doc.did, {
-    secret,
-    passport,
-    role: passport.role,
-  });
-  return { user: doc, token: sessionToken };
+  const createToken = createTokenFn(createSessionToken);
+  const sessionConfig = blocklet.settings?.session || {};
+  const { sessionToken, refreshToken } = createToken(
+    doc.did,
+    {
+      secret,
+      passport,
+      role: passport.role,
+    },
+    { ...sessionConfig, didConnectVersion: getDidConnectVersion(req) }
+  );
+  return { user: doc, token: sessionToken, refreshToken };
 }
 
 module.exports = {

package/api/services/auth/connect/exchange-passport.js

@@ -46,7 +46,7 @@ module.exports = function createRoutes(node, authenticator, createSessionToken)
           action: 'exchangePassport',
         });
 
-        await updateSession({ sessionToken: result.sessionToken }, true);
+        await updateSession({ sessionToken: result.sessionToken, refreshToken: result.refreshToken }, true);
 
         return result;
       } catch (err) {

package/api/services/auth/connect/invite.js

@@ -10,6 +10,8 @@ const {
 const { NODE_SERVICES, WELLKNOWN_SERVICE_PATH_PREFIX } = require('@abtnode/constant');
 const logger = require('@abtnode/logger')(require('../../../../package.json').name);
 
+const { createTokenFn, getDidConnectVersion } = require('../../../util');
+
 module.exports = function createRoutes(node, authenticator, createSessionToken) {
   return {
     action: 'invite',
@@ -54,6 +56,7 @@ module.exports = function createRoutes(node, authenticator, createSessionToken)
       const { locale, inviteId } = extraParams;
       const nodeInfo = await req.getNodeInfo();
       const { secret } = await req.getBlockletInfo();
+      const blocklet = await req.getBlocklet();
       const teamDid = req.headers['x-blocklet-did'];
       const statusEndpointBaseUrl = joinUrl(baseUrl, WELLKNOWN_SERVICE_PATH_PREFIX);
       const endpoint = baseUrl;
@@ -73,8 +76,14 @@ module.exports = function createRoutes(node, authenticator, createSessionToken)
       });
 
       // Generate new session token that client can save to localStorage
-      const sessionToken = await createSessionToken(userDid, { secret, passport, role });
-      await updateSession({ sessionToken }, true);
+      const createToken = createTokenFn(createSessionToken);
+      const sessionConfig = blocklet.settings?.session || {};
+      const { sessionToken, refreshToken } = createToken(
+        userDid,
+        { secret, passport, role },
+        { ...sessionConfig, didConnectVersion: getDidConnectVersion(req) }
+      );
+      await updateSession({ sessionToken, refreshToken }, true);
       await updateSession({ passportId: response.data.id });
       logger.info('invite.success', { userDid });
 

package/api/services/auth/connect/login.js

@@ -36,7 +36,7 @@ module.exports = function createRoutes(node, authenticator, createSessionToken)
           action: 'login',
         });
 
-        await updateSession({ sessionToken: result.sessionToken }, true);
+        await updateSession({ sessionToken: result.sessionToken, refreshToken: result.refreshToken }, true);
 
         return result;
       } catch (err) {

package/api/services/auth/connect/receive-transfer-app-owner.js

@@ -19,6 +19,8 @@ const { getBlockletChainInfo, isInProgress } = require('@blocklet/meta/lib/util'
 const { ROLES } = require('@abtnode/constant');
 const logger = require('@abtnode/logger')('blocklet-service:transfer-blocklet-owner');
 
+const { createTokenFn, getDidConnectVersion } = require('../../../util');
+
 const migrateAppOnChain = async (blocklet, oldSk, newSk) => {
   if (process.env.NODE_ENV === 'test') {
     return;
@@ -360,8 +362,14 @@ module.exports = function createRoutes(node, _, createSessionToken) {
       logger.info('transfer ownership success', { userDid });
 
       // Generate new session token that client can save to localStorage
-      const sessionToken = await createSessionToken(userDid, { secret, passport: vc, role });
-      await updateSession({ sessionToken }, true);
+      const createToken = createTokenFn(createSessionToken);
+      const sessionConfig = blocklet.settings?.session || {};
+      const { sessionToken, refreshToken } = createToken(
+        userDid,
+        { secret, passport: vc, role },
+        { ...sessionConfig, didConnectVersion: getDidConnectVersion(req) }
+      );
+      await updateSession({ sessionToken, refreshToken }, true);
       await updateSession({ passportId: vc?.id });
       logger.info('invite.success', { userDid });
 

package/api/services/auth/connect/setup.js

@@ -110,6 +110,7 @@ module.exports = function createRoutes(node, _authenticator, createSessionToken)
         }
 
         // Generate new session token that client can save to localStorage
+        // HACK: 此处没有 passportId，所以特意不设置 refreshToken，失效后下次登录就能选择合适的 passport
         const sessionToken = await createSessionToken(userDid, { secret, role: 'owner' });
         await updateSession({ sessionToken }, true);
         logger.info('setup.connect.success', { userDid });

package/api/services/auth/connect/switch-passport.js

@@ -17,7 +17,7 @@ module.exports = function createRoutes(node, authenticator, createSessionToken)
     },
 
     onAuth: async ({ claims, challenge, userDid, updateSession, extraParams, req }) => {
-      const sessionToken = await onApprove({
+      const { sessionToken, refreshToken } = await onApprove({
         node,
         request: req,
         challenge,
@@ -27,7 +27,7 @@ module.exports = function createRoutes(node, authenticator, createSessionToken)
         createSessionToken,
       });
 
-      await updateSession({ sessionToken }, true);
+      await updateSession({ sessionToken, refreshToken }, true);
     },
   };
 };

package/api/services/auth/index.js

@@ -2,7 +2,7 @@
 const get = require('lodash/get');
 const cookie = require('cookie');
 const minimatch = require('minimatch');
-const bearerToken = require('express-bearer-token');
+const bearerToken = require('@abtnode/util/lib/express-bearer-token');
 
 const validators = require('@blocklet/sdk/lib/validators');
 const {
@@ -39,6 +39,7 @@ const createSessionRoutes = require('./session');
 const createPassportRoutes = require('./passport');
 const { getRedirectUrl } = require('../../util');
 const createGetDIDSpacesEndpointRoutes = require('./connect/get-did-spaces-endpoint');
+const { sessionCacheDisabledUser } = require('../../cache');
 
 const getTokenFromWsConnect = (req, options) => {
   const cookies = cookie.parse(req.headers.cookie || '');
@@ -60,6 +61,8 @@ const isDevWsConnect = async (req) => {
 const REASON_404 = 'Not Found';
 
 const init = ({ node, options }) => {
+  const { createSessionToken, verifySessionToken } = initJwt(node, options);
+
   /**
    * set user info to req.user
    */
@@ -68,7 +71,12 @@ const init = ({ node, options }) => {
       if (token) {
         const teamDid = req.getBlockletDid();
         const { secret } = await req.getBlockletInfo();
-        const user = await verifySessionToken(token, secret, teamDid);
+        const opt = {
+          checkFromDb: (decoded) => sessionCacheDisabledUser.get(decoded?.did),
+          teamDid,
+        };
+
+        const user = await verifySessionToken(token, secret, opt);
         req.user = user;
       }
     } catch {
@@ -131,14 +139,13 @@ const init = ({ node, options }) => {
     return {};
   };
 
-  const { createSessionToken, verifySessionToken } = initJwt(node, options);
   const { authenticator, handlers } = initAuth(node, options);
 
   const middlewares = {};
   const routes = {};
 
   // auth middleware for http request
-  middlewares.bearerToken = bearerToken({
+  middlewares.sessionBearerToken = bearerToken({
     queryKey: options.sessionTokenKey,
     bodyKey: options.sessionTokenKey,
     headerKey: 'Bearer',
@@ -149,6 +156,12 @@ const init = ({ node, options }) => {
     },
   });
 
+  middlewares.refreshBearerToken = bearerToken({
+    bodyKey: options.refreshTokenKey,
+    headerKey: 'Bearer',
+    reqKey: 'refreshToken',
+  });
+
   // set user info to req.user and req.headers
   middlewares.userInfo = async (req, res, next) => {
     const { token } = req;
@@ -184,8 +197,17 @@ const init = ({ node, options }) => {
 
   // public http api
   routes.createPassportRoutes = createPassportRoutes;
-  // eslint-disable-next-line no-shadow
-  routes.createSessionRoutes = { init: (router, node) => createSessionRoutes.init(router, node, createSessionToken) };
+  routes.createSessionRoutes = {
+    // eslint-disable-next-line no-shadow
+    init: (router, node) =>
+      createSessionRoutes.init(router, node, createSessionToken, {
+        ...options,
+        middlewares,
+        ensureUser,
+        createSessionToken,
+        verifySessionToken,
+      }),
+  };
 
   const ensureWsUser = async (req) => {
     const token = getTokenFromWsConnect(req, options);