@abtnode/blocklet-services 1.16.14-beta-a898bfcb → 1.16.14-beta-d802cd3c

package/api/routes/federated.js

@@ -0,0 +1,365 @@
+const { WELLKNOWN_SERVICE_PATH_PREFIX } = require('@abtnode/constant');
+const { signV2 } = require('@arcblock/jwt');
+const normalizePathPrefix = require('@abtnode/util/lib/normalize-path-prefix');
+const cloneDeep = require('lodash/cloneDeep');
+const get = require('lodash/get');
+
+const cors = require('cors');
+const { LOGIN_PROVIDER } = require('@blocklet/constant');
+const pick = require('lodash/pick');
+
+const { api } = require('../libs/api');
+const initJwt = require('../libs/jwt');
+const { createTokenFn, getDidConnectVersion } = require('../util');
+const verifyFederatedCall = require('../middlewares/verify-federated-call');
+const ensureBlocklet = require('../middlewares/ensure-blocklet');
+const checkFederatedCorsCall = require('../middlewares/check-federated-cors-call');
+const { getUserAvatarUrl } = require('../util/federated');
+
+const PREFIX = WELLKNOWN_SERVICE_PATH_PREFIX;
+
+const prefix = `${PREFIX}/api/federated`;
+
+module.exports = {
+  preInit(server) {
+    server.options(`${prefix}/prelogin`, cors({ credentials: true, origin: true }));
+    server.options(`${prefix}/login`, cors({ credentials: true, origin: true }));
+    server.options(`${prefix}/logout`, cors({ credentials: true, origin: true }));
+  },
+  init(server, node, options) {
+    // step 1 申请加入(member 向 master 申请)
+    server.post(`${prefix}/join`, ensureBlocklet(), async (req, res) => {
+      const { blocklet } = req;
+      const { site } = req.body;
+
+      const federated = cloneDeep(blocklet.settings.federated || {});
+      let sites = federated?.sites || [];
+      if (sites.length === 0) {
+        const nodeInfo = await req.getNodeInfo();
+        const blockletInfo = await req.getBlockletInfo();
+        const masterSite = {
+          appId: blockletInfo.wallet.address,
+          appPid: blockletInfo.permanentWallet.address,
+          migratedFrom: blocklet.migratedFrom || [],
+          appName: blockletInfo.name,
+          appDescription: blockletInfo.description,
+          appUrl: blockletInfo.appUrl,
+          appLogo:
+            blocklet.environmentObj.BLOCKLET_APP_LOGO ||
+            normalizePathPrefix(`${WELLKNOWN_SERVICE_PATH_PREFIX}/blocklet/logo`) ||
+            '/',
+          appLogoRect: blocklet.environmentObj.BLOCKLET_APP_LOGO_RECT,
+          did: blockletInfo.did,
+          pk: blockletInfo.permanentWallet.publicKey,
+          serverId: nodeInfo.did,
+          serverVersion: nodeInfo.version,
+          version: blocklet.meta.version,
+        };
+        sites = [masterSite];
+      }
+
+      let masterConfig = federated.config;
+      if (!masterConfig) {
+        masterConfig = {
+          appId: blocklet.appDid,
+          appPid: blocklet.appPid || blocklet.appDid,
+        };
+      }
+      if (site) {
+        sites.push({
+          ...site,
+          appliedAt: new Date(),
+          status: 'pending',
+          isMaster: false,
+        });
+      }
+      // member 申请后，将 member 展示在列表中
+      // 更新的是自己
+      await node.setFederated({
+        did: blocklet.appDid,
+        config: {
+          config: masterConfig,
+          sites,
+        },
+      });
+
+      // 将新增的数据返回给 member
+      res.json({
+        sites,
+      });
+    });
+
+    // step 2 审批(master 申批 member)
+    // core/state/lib/blocklet/manager/disk.js -> auditFederatedLogin
+    server.post(`${prefix}/audit-res`, ensureBlocklet(), verifyFederatedCall(), async (req, res) => {
+      const { blocklet } = req;
+      const { delegation, roles, appId, status } = req.body.verifyData;
+      const federated = cloneDeep(blocklet.settings.federated || {});
+      federated.config.delegation = delegation;
+      if (status === 'approved') {
+        const trustedPassports = blocklet.trustedPassports || [];
+        const hasTrustedPassport = trustedPassports.find((item) => item.issuerDid === appId);
+        if (!hasTrustedPassport) {
+          await node.configTrustedPassports({
+            teamDid: blocklet.meta.did,
+            trustedPassports: [
+              ...trustedPassports,
+              {
+                issuerDid: appId,
+                remark: 'Generated on join federated login',
+                mappings: roles.map((item) => {
+                  return {
+                    from: { passport: item.name },
+                    to: { role: 'guest' },
+                  };
+                }),
+              },
+            ],
+          });
+        }
+      }
+
+      await node.setFederated({
+        did: blocklet.meta.did,
+        config: federated,
+      });
+      res.json(federated);
+    });
+
+    // step 3 同步站点群信息(master 向 member 广播站点群信息，广播请求在 manager/disk.js 文件中 class FederatedBlockletManager 发起 )
+    // 该路由为 member 接受响应的 api(只允许 master 调用)
+    server.post(`${prefix}/sync`, ensureBlocklet(), verifyFederatedCall({ isMaster: true }), async (req, res) => {
+      const { sites } = req.body.verifyData;
+      const { blocklet } = req;
+      const federated = cloneDeep(blocklet.settings.federated || {});
+      federated.sites = sites;
+      await node.setFederated({
+        did: blocklet.meta.did,
+        config: federated,
+      });
+      res.json(federated);
+    });
+
+    // step 4 检测自动登录条件(member 向 master 发起请求)
+    server.post(
+      `${prefix}/prelogin`,
+      cors({ credentials: true, origin: true }),
+      ensureBlocklet(),
+      checkFederatedCorsCall(),
+      async (req, res) => {
+        const { blocklet } = req;
+
+        const teamDid = blocklet.meta.did;
+        let user = null;
+        if (req.user) {
+          user = { ...req.user };
+          const currentUser = await node.getUser({
+            teamDid,
+            user: {
+              did: req.user.did,
+            },
+            options: {
+              enableConnectedAccount: true,
+            },
+          });
+          user.avatar = getUserAvatarUrl(currentUser.avatar, blocklet);
+        }
+        const blockletInfo = await req.getBlockletInfo();
+        const site = {
+          appId: blockletInfo.wallet.address,
+          appPid: blockletInfo.permanentWallet.address,
+          appName: blockletInfo.name,
+          appDescription: blockletInfo.description,
+          appUrl: blockletInfo.appUrl,
+          appLogo:
+            blocklet.environmentObj.BLOCKLET_APP_LOGO ||
+            normalizePathPrefix(`${WELLKNOWN_SERVICE_PATH_PREFIX}/blocklet/logo`) ||
+            '/',
+          appLogoRect: blocklet.environmentObj.BLOCKLET_APP_LOGO_RECT,
+          did: blockletInfo.did,
+        };
+        res.json({ user, site });
+      }
+    );
+
+    // step 5 完成自动登录(member 向 master 请求)
+    server.post(
+      `${prefix}/login`,
+      cors({ credentials: true, origin: true }),
+      ensureBlocklet(),
+      checkFederatedCorsCall(),
+      async (req, res) => {
+        if (!req.user) {
+          res.status(401).send('Unauthorized');
+          return;
+        }
+        let data;
+        const { onlyWriteCookie = false } = req.body;
+
+        if (!onlyWriteCookie) {
+          const { blocklet } = req;
+          const { permanentWallet } = await req.getBlockletInfo();
+          const teamDid = blocklet.meta.did;
+          const federatedSites = blocklet.settings?.federated?.sites || [];
+          const loginSite = federatedSites.find((item) => item.appUrl === req.headers.origin);
+
+          const currentUser = await node.getUser({
+            teamDid,
+            user: {
+              did: req.user.did,
+            },
+            options: {
+              enableConnectedAccount: true,
+            },
+          });
+
+          const user = pick(currentUser, ['did', 'pk', 'fullName', 'locale']);
+          user.lastLoginIp = get(req, 'headers[x-real-ip]') || '';
+
+          if (currentUser.email) {
+            user.email = currentUser.email;
+          }
+          if (currentUser.avatar) {
+            user.avatar = getUserAvatarUrl(currentUser.avatar, blocklet);
+          }
+
+          try {
+            ({ data } = await api.post(`${loginSite.appUrl}${prefix}/token`, {
+              signer: permanentWallet.address,
+              data: signV2(permanentWallet.address, permanentWallet.secretKey, {
+                appId: teamDid,
+                role: req.user.role,
+                user,
+                passport: req.user.passport,
+              }),
+            }));
+          } catch {
+            res.status(500).send('Generate token error');
+          }
+        }
+
+        res.cookie('login_token', req.token, {
+          // HACK: 目前 sessionToken 的有效期就是 1h
+          maxAge: 60 * 60 * 1000,
+          expires: new Date(Date.now() + 60 * 60 * 1000),
+          sameSite: 'none',
+          secure: true,
+        });
+        res.json(data);
+      }
+    );
+
+    // step 6 发放自动登录 token(master 向 member 发起生成 token 请求)
+    server.post(`${prefix}/token`, ensureBlocklet(), verifyFederatedCall(), async (req, res) => {
+      const { user, appId, role, passport } = req.body.verifyData;
+      const { createSessionToken } = initJwt(node, options);
+      const createToken = createTokenFn(createSessionToken);
+      const { secret } = await req.getBlockletInfo();
+      const { blocklet } = req;
+      const teamDid = blocklet.meta.did;
+
+      const sessionConfig = blocklet.settings?.session || {};
+      const trustedPassports = blocklet.trustedPassports || [];
+      const masterPassport = trustedPassports.find((item) => item.issuerDid === appId);
+      const findMapping = masterPassport ? masterPassport.mappings.find((item) => item.from.passport === role) : null;
+      const targetPassport = findMapping
+        ? {
+            role: findMapping.to?.role || 'guest',
+            name: findMapping.to?.role || 'Guest',
+            id: passport?.id || '',
+          }
+        : { role: 'guest', name: 'Guest' };
+      const doc = await node.loginUser({
+        teamDid,
+        user: {
+          ...user,
+          // HACK: @zhanghan 这里会将 passport 插入到当前用户的 passport 列表中，federated 登录不应该插入 passport
+          // passport: findMapping ? targetPassport : null,
+          connectedAccount: {
+            provider: LOGIN_PROVIDER.FEDERATED,
+            id: appId,
+            did: user.did,
+            pk: user.pk,
+          },
+        },
+      });
+      const { sessionToken, refreshToken } = createToken(
+        doc.did,
+        {
+          secret,
+          role: targetPassport.role,
+          passport: targetPassport,
+          fullName: doc.fullName,
+          provider: LOGIN_PROVIDER.FEDERATED,
+        },
+        {
+          ...sessionConfig,
+          didConnectVersion: getDidConnectVersion(req),
+        }
+      );
+
+      res.json({ sessionToken, refreshToken });
+    });
+
+    // member 要求 master 退出登录
+    server.post(
+      `${prefix}/logout`,
+      cors({ credentials: true, origin: true }),
+      ensureBlocklet(),
+      checkFederatedCorsCall(),
+      (req, res) => {
+        res.clearCookie('login_token');
+        res.send('');
+      }
+    );
+
+    // member 主动调起 master 登录（实现登录 member 时，自动登录 master）
+
+    server.post(`${prefix}/loginByMember`, ensureBlocklet(), verifyFederatedCall(), async (req, res) => {
+      const { user, appId, passport } = req.body.verifyData;
+      const { createSessionToken } = initJwt(node, options);
+      const createToken = createTokenFn(createSessionToken);
+      const { secret } = await req.getBlockletInfo();
+      const { blocklet } = req;
+      const teamDid = blocklet.meta.did;
+
+      const sessionConfig = blocklet.settings?.session || {};
+      const prevUser = await node.getUser({
+        teamDid,
+        user: { did: user.did },
+        options: { enableConnectedAccount: true },
+      });
+      // HACK: member 调用 master 时，将 passport 的 role 还原为 master 中原有的 role
+      const targetPassport = passport?.id ? (prevUser?.passports || []).find((item) => item.id === passport.id) : null;
+      const doc = await node.loginUser({
+        teamDid,
+        user: {
+          ...user,
+          passport: targetPassport,
+          connectedAccount: {
+            provider: LOGIN_PROVIDER.WALLET,
+            id: appId,
+            did: user.did,
+            pk: user.pk,
+          },
+        },
+      });
+
+      const { sessionToken, refreshToken } = createToken(
+        doc.did,
+        {
+          secret,
+          passport: targetPassport,
+          role: targetPassport?.role || 'guest',
+          fullName: doc.fullName,
+        },
+        {
+          ...sessionConfig,
+          didConnectVersion: getDidConnectVersion(req),
+        }
+      );
+
+      res.json({ sessionToken, refreshToken });
+    });
+  },
+};

package/api/routes/oauth.js

@@ -1,7 +1,7 @@
 const { handleInvitationReceive, getApplicationInfo } = require('@abtnode/auth/lib/auth');
 const { upsertToPassports, createPassportSvg } = require('@abtnode/auth/lib/passport');
 const { WELLKNOWN_SERVICE_PATH_PREFIX, NODE_SERVICES, PASSPORT_STATUS } = require('@abtnode/constant');
-const { parseUserAvatar, extractUserAvatar } = require('@abtnode/util/lib/user');
+const { extractUserAvatar, getUserAvatarUrl, getAppAvatarUrl } = require('@abtnode/util/lib/user');
 const { fromAppDid } = require('@arcblock/did-ext');
 const { getBlockletAppIdList } = require('@blocklet/meta/lib/util');
 const get = require('lodash/get');
@@ -198,11 +198,10 @@ async function invite(req, node, options) {
   });
   const { dataDir, name: applicationName } = await getApplicationInfo({ node, nodeInfo, teamDid });
   if (currentUser) {
-    const avatar = await parseUserAvatar(currentUser.avatar, { did: teamDid, dataDir });
     profile = {
       email: currentUser.email,
       fullName: currentUser.fullName,
-      avatar,
+      avatar: getUserAvatarUrl(baseUrl, currentUser.avatar),
     };
     userDid = currentUser.did;
     userPk = currentUser.pk;
@@ -213,7 +212,7 @@ async function invite(req, node, options) {
     profile = {
       email,
       fullName,
-      avatar,
+      avatar: getUserAvatarUrl(baseUrl, avatar),
     };
   }
 
@@ -390,12 +389,12 @@ module.exports = {
       const userDid = req.user.did;
       const blocklet = await req.getBlockletInfo();
       const nodeInfo = await req.getNodeInfo();
-      const { did: teamDid, wallet: blockletWallet } = blocklet;
-      const { dataDir, passportColor } = await getApplicationInfo({ node, nodeInfo, teamDid });
+      const { did: teamDid, wallet: blockletWallet, appUrl } = blocklet;
+      const { passportColor } = await getApplicationInfo({ node, nodeInfo, teamDid });
       const issuerDidList = uniq([blockletWallet.address, ...getBlockletAppIdList(blocklet)]);
       // NOTICE: 这里获取的 did 是当前登录用户的永久 did，无需查询 connectedAccount
       const user = await node.getUser({ teamDid, user: { did: userDid } });
-      const ownerAvatarUrl = await parseUserAvatar(user?.avatar, { dataDir });
+      const ownerAvatarUrl = getUserAvatarUrl(appUrl, user.avatar);
       const { passports = [] } = user || {};
       // NOTICE: 保持每一种 role 的 passport 只有一个即可
       const passportTypes = uniqBy(
@@ -417,7 +416,9 @@ module.exports = {
             title: x.title,
             issuer: x.issuer.name,
             issuerDid: x.issuer.id,
+            issuerAvatarUrl: getAppAvatarUrl(appUrl),
             ownerName: user?.fullName,
+            ownerDid: userDid,
             ownerAvatarUrl,
             isDataUrl: true,
             preferredColor: passportColor || 'auto',

package/api/services/auth/connect/invite.js

@@ -36,7 +36,7 @@ module.exports = function createRoutes(node, authenticator, createSessionToken)
         };
       },
 
-      signature: async ({ extraParams, context: { request, didwallet } }) => {
+      signature: async ({ extraParams, context: { request, baseUrl, didwallet } }) => {
         const { locale, inviteId } = extraParams;
         checkWalletVersion({ didwallet, locale });
         const nodeInfo = await request.getNodeInfo();
@@ -48,6 +48,7 @@ module.exports = function createRoutes(node, authenticator, createSessionToken)
           teamDid,
           inviteId,
           locale,
+          baseUrl,
         });
       },
     },

package/api/services/auth/connect/issue-passport.js

@@ -20,19 +20,13 @@ module.exports = function createRoutes(node) {
     },
 
     claims: {
-      signature: async ({ extraParams, context: { request, didwallet } }) => {
+      signature: async ({ extraParams, context: { request, baseUrl, didwallet } }) => {
         const { id, locale } = extraParams;
         checkWalletVersion({ didwallet, locale });
         const nodeInfo = await node.getNodeInfo();
         const teamDid = request.headers['x-blocklet-did'];
 
-        return createIssuePassportRequest({
-          node,
-          nodeInfo,
-          teamDid,
-          id,
-          locale,
-        });
+        return createIssuePassportRequest({ node, nodeInfo, teamDid, id, locale, baseUrl });
       },
     },
 

package/api/services/auth/connect/login.js

@@ -36,7 +36,15 @@ module.exports = function createRoutes(node, authenticator, createSessionToken)
           action: 'login',
         });
 
-        await updateSession({ sessionToken: result.sessionToken, refreshToken: result.refreshToken }, true);
+        await updateSession(
+          {
+            sessionToken: result.sessionToken,
+            refreshToken: result.refreshToken,
+            federatedSessionToken: result.federatedSessionToken || '',
+            federatedRefreshToken: result.federatedRefreshToken || '',
+          },
+          true
+        );
 
         return result;
       } catch (err) {

package/api/services/auth/connect/receive-transfer-app-owner.js

@@ -203,7 +203,8 @@ module.exports = function createRoutes(node, _, createSessionToken) {
         passportColor,
         dataDir,
         secret,
-      } = await getApplicationInfo({ node, teamDid: appPid });
+        logo,
+      } = await getApplicationInfo({ node, teamDid: appPid, baseUrl });
 
       const statusEndpointBaseUrl = baseUrl;
       const endpoint = baseUrl;
@@ -211,6 +212,7 @@ module.exports = function createRoutes(node, _, createSessionToken) {
       const vcParams = {
         issuerName,
         issuerWallet,
+        issuerAvatarUrl: logo,
         ownerDid: userDid,
         passport: await createPassport({
           name: ROLES.OWNER,

package/api/services/auth/session.js

@@ -3,6 +3,7 @@ const joinUrl = require('url-join');
 const SealedBox = require('tweetnacl-sealedbox-js');
 const { decodeEncryptionKey } = require('@abtnode/util/lib/security');
 const { WELLKNOWN_SERVICE_PATH_PREFIX, USER_AVATAR_URL_PREFIX, USER_AVATAR_PATH_PREFIX } = require('@abtnode/constant');
+const { LOGIN_PROVIDER } = require('@blocklet/constant');
 
 const { PREFIXES } = require('../../util/constants');
 const { createTokenFn, getDidConnectVersion } = require('../../util');
@@ -62,6 +63,7 @@ module.exports = {
                 passport: req.user.passport,
                 role: req.user.role,
                 fullName: user.fullName,
+                provider: req.user.provider || LOGIN_PROVIDER.WALLET,
               },
               { ...sessionConfig, didConnectVersion: getDidConnectVersion(req) }
             );
@@ -77,7 +79,7 @@ module.exports = {
           }
         }
 
-        res.json({ user, nextToken, nextRefreshToken });
+        res.json({ user, nextToken, nextRefreshToken, provider: req.user.provider || LOGIN_PROVIDER.WALLET });
       };
 
       const sessionApi = `${prefix}/api/did/session`;

package/api/services/dashboard/index.js

@@ -1,7 +1,7 @@
 const get = require('lodash/get');
 const { WsServer } = require('@arcblock/ws');
 const { WELLKNOWN_SERVICE_PATH_PREFIX, ROLES, EVENTS } = require('@abtnode/constant');
-const { createStreamLogManager, getLogFiles } = require('@abtnode/util/lib/log');
+const { createStreamLogManager, getLogFiles } = require('@abtnode/core/lib/util/log');
 const { BlockletEvents } = require('@blocklet/constant');
 const eventHub =
   process.env.NODE_ENV === 'test' ? require('@arcblock/event-hub/single') : require('@arcblock/event-hub');