@abtnode/blocklet-services 1.16.16-beta-d6c5ed65 → 1.16.16-beta-d11cb031

package/api/index.js

@@ -182,7 +182,7 @@ module.exports = function createServer(node, serverOptions = {}) {
   server.use(
     bodyParser.json({
       // We have to set a larger hard limit since
-      limit: '2mb',
+      limit: '8mb',
 
       // https://flaviocopes.com/express-get-raw-body/
       // Side effects: this will double the memory consumption

package/api/libs/connect/session.js

@@ -36,7 +36,6 @@ const { getKeyPairClaim, getAuthPrincipalForMigrateAppToV2 } = require('@abtnode
 const merge = require('lodash/merge');
 const { fromAppDid } = require('@arcblock/did-ext');
 const { LOGIN_PROVIDER } = require('@blocklet/constant');
-const { signV2 } = require('@arcblock/jwt');
 const pick = require('lodash/pick');
 const createTranslator = require('@abtnode/util/lib/translate');
 
@@ -49,8 +48,7 @@ const { isInvitedUserOnly, createTokenFn, getDidConnectVersion } = require('../.
 const { transferPassport } = require('../auth/utils');
 const { migrateAccount, declareAccount } = require('../../services/oauth');
 const { getTrustedIssuers, getFederatedTrustedIssuers } = require('../../util/blocklet-utils');
-const { getFederatedMaster, getUserAvatarUrl } = require('../../util/federated');
-const { api } = require('../api');
+const { getUserAvatarUrl, migrateAuth0, getFederatedMaster, shouldSyncFederated } = require('../../util/federated');
 
 const vcTypes = [VC_TYPE_GENERAL_PASSPORT, VC_TYPE_NODE_PASSPORT];
 
@@ -247,6 +245,7 @@ module.exports = {
 
       const sourceAppPid = getSourceAppPid(request);
       const provider = getLoginProvider(request);
+      const masterSite = getFederatedMaster(blocklet);
 
       // Get passport vc
       if (action === 'login') {
@@ -346,7 +345,6 @@ module.exports = {
       // Update profile
       const passportForLog = passport || { name: 'Guest', role: 'guest' };
 
-      const masterSite = getFederatedMaster(blocklet);
       const connectAccount = { provider, did: userDid, pk: userPk };
 
       let updatedUser;
@@ -411,26 +409,32 @@ module.exports = {
       }
 
       // NOTICE: 采用异步来更新，不阻塞接口的正常响应
-      node.syncFederated({
-        did: teamDid,
-        data: {
-          users: [
-            {
-              did: updatedUser.did,
-              pk: updatedUser.pk,
-              fullName: updatedUser.fullName,
-              email: updatedUser.email || '',
-              avatar: getUserAvatarUrl(updatedUser.avatar, blocklet),
-              connectedAccount: [connectAccount, connectedNft],
-              action: 'connectAccount',
-            },
-          ],
-        },
-      });
+      if (shouldSyncFederated(sourceAppPid, masterSite, blocklet)) {
+        node.syncFederated({
+          did: teamDid,
+          data: {
+            users: [
+              {
+                did: updatedUser.did,
+                pk: updatedUser.pk,
+                fullName: updatedUser.fullName,
+                email: updatedUser.email || '',
+                avatar: getUserAvatarUrl(updatedUser.avatar, blocklet),
+                connectedAccount: [connectAccount, connectedNft],
+                action: 'connectAccount',
+                sourceAppPid: sourceAppPid || masterSite.appPid,
+              },
+            ],
+          },
+        });
+      }
 
       // Generate new session token that client can save to localStorage
       const createToken = createTokenFn(createSessionToken);
       const sessionConfig = blocklet.settings?.session || {};
+
+      // request.context.store.connectedWallet
+      const walletOS = request.context.didwallet.os;
       const { sessionToken, refreshToken } = createToken(
         realDid,
         {
@@ -440,6 +444,7 @@ module.exports = {
           fullName,
           // NOTE: token 中存储当前的 login provider
           provider,
+          walletOS,
         },
         { ...sessionConfig, didConnectVersion: getDidConnectVersion(request) }
       );
@@ -455,36 +460,6 @@ module.exports = {
         await node.setBlockletInitialized({ did: teamDid, owner: { did: realDid, pk: realPk } });
       }
 
-      const { permanentWallet } = blockletInfo;
-
-      let federatedSessionToken;
-      let federatedRefreshToken;
-      // member 使用 federated login 时，总是会让 Master 自动登录
-      if (masterSite && sourceAppPid) {
-        const postUser = pick(updatedUser, ['did', 'pk', 'fullName', 'locale']);
-        postUser.lastLoginAt = get(request, 'headers[x-real-ip]') || '';
-
-        if (updatedUser.email) {
-          postUser.email = updatedUser.email;
-        }
-        if (updatedUser.avatar) {
-          postUser.avatar = getUserAvatarUrl(updatedUser.avatar, blocklet);
-        }
-
-        const { data } = await api.post(
-          joinUrl(masterSite.appUrl, WELLKNOWN_SERVICE_PATH_PREFIX, '/api/federated/loginByMember'),
-          {
-            signer: permanentWallet.address,
-            data: signV2(permanentWallet.address, permanentWallet.secretKey, {
-              user: postUser,
-              passport,
-            }),
-          }
-        );
-        federatedSessionToken = data.sessionToken;
-        federatedRefreshToken = data.refreshToken;
-      }
-
       // issue passport for the first login user in a invite-only team
       if (issuePassport) {
         return {
@@ -493,8 +468,6 @@ module.exports = {
           data: vc,
           sessionToken,
           refreshToken,
-          federatedSessionToken,
-          federatedRefreshToken,
           nextWorkflowData: {
             userDid: realDid,
           },
@@ -504,8 +477,6 @@ module.exports = {
       return {
         sessionToken,
         refreshToken,
-        federatedSessionToken,
-        federatedRefreshToken,
         nextWorkflowData: {
           userDid: realDid,
         },
@@ -597,13 +568,23 @@ module.exports = {
       if (syncUserData.avatar) {
         syncUserData.avatar = getUserAvatarUrl(syncUserData.avatar, blocklet);
       }
+      const sourceAppPid = getSourceAppPid(request);
+      const masterSite = getFederatedMaster(blocklet);
       // NOTICE: 采用异步来更新，不阻塞接口的正常响应
-      node.syncFederated({
-        did: teamDid,
-        data: {
-          users: [{ ...syncUserData, action: 'switchProfile' }],
-        },
-      });
+      if (shouldSyncFederated(sourceAppPid, masterSite, blocklet)) {
+        node.syncFederated({
+          did: teamDid,
+          data: {
+            users: [
+              {
+                ...syncUserData,
+                action: 'switchProfile',
+                sourceAppPid: sourceAppPid || masterSite.appPid,
+              },
+            ],
+          },
+        });
+      }
     },
   },
 
@@ -660,6 +641,7 @@ module.exports = {
       createSessionToken,
       componentId,
       sourceAppPid,
+      provider,
     }) => {
       const blocklet = await request.getBlocklet();
       const { name, did: teamDid, secret } = await request.getBlockletInfo();
@@ -743,7 +725,15 @@ module.exports = {
       const sessionConfig = blocklet.settings?.session || {};
       const { sessionToken, refreshToken } = createToken(
         userDid,
-        { secret, passport, role, fullName: user.fullName, sourceAppPid },
+        {
+          secret,
+          passport,
+          role,
+          fullName: user.fullName,
+          provider,
+          // request.context.store.connectedWallet
+          walletOS: request.context.didwallet.os,
+        },
         { ...sessionConfig, didConnectVersion: getDidConnectVersion(request) }
       );
       return { sessionToken, refreshToken };
@@ -845,7 +835,9 @@ module.exports = {
     },
     onApprove: async ({ node, request, locale, userDid, userPk, claims, previousUserDid, baseUrl }) => {
       const blocklet = await request.getBlocklet();
-      const { did: teamDid, wallet: blockletWallet } = await request.getBlockletInfo();
+      const sourceAppPid = getSourceAppPid(request);
+      const blockletInfo = await request.getBlockletInfo();
+      const { did: teamDid, wallet: blockletWallet } = blockletInfo;
 
       const oauthUser = await node.getUser({ teamDid, user: { did: previousUserDid } });
       const nodeInfo = await request.getNodeInfo();
@@ -905,21 +897,31 @@ module.exports = {
           passports: mergePassport,
         },
       });
+      const masterSite = getFederatedMaster(blocklet);
       // NOTICE: 采用异步来更新，不阻塞接口的正常响应
-      node.syncFederated({
-        did: teamDid,
-        data: {
-          users: [
-            {
-              did: oauthUser.did,
-              pk: oauthUser.pk,
-              ...mergeProfile,
-              connectedAccount: [connectedAccount],
-              action: 'connectAccount',
-            },
-          ],
-        },
-      });
+      if (shouldSyncFederated(sourceAppPid, masterSite, blocklet)) {
+        const syncUserData = {
+          did: oauthUser.did,
+          pk: oauthUser.pk,
+          ...mergeProfile,
+          connectedAccount: [connectedAccount],
+        };
+        if (syncUserData.avatar) {
+          syncUserData.avatar = getUserAvatarUrl(syncUserData.avatar, blocklet);
+        }
+        node.syncFederated({
+          did: teamDid,
+          data: {
+            users: [
+              {
+                ...syncUserData,
+                action: 'connectAccount',
+                sourceAppPid: sourceAppPid || masterSite.appPid,
+              },
+            ],
+          },
+        });
+      }
 
       if (!bindUser) {
         bindUser = {
@@ -930,6 +932,7 @@ module.exports = {
         };
       }
 
+      // FIXME：@zhanghan 统一登录的 passport 相关问题后续统一处理
       await transferPassport(oauthUser, bindUser, {
         req: request,
         node,
@@ -939,12 +942,23 @@ module.exports = {
         revokePassport: true,
       });
 
-      const connectedAccounts = oauthUser?.connectedAccounts || [];
-      const sourceProvider = oauthUser?.sourceProvider;
-      const oauthAccount = connectedAccounts.find((item) => item.provider === sourceProvider);
-      const userWallet = fromAppDid(oauthAccount.id, blockletWallet.secretKey);
-      await declareAccount({ wallet: userWallet, blocklet });
-      await migrateAccount({ wallet: userWallet, blocklet, user: bindUser });
+      if (sourceAppPid) {
+        await migrateAuth0({
+          // 目前只允许未注册过的钱包绑定 auth0，所以直接传入钱包生成的 userDid 和 userPk
+          toUserDid: userDid,
+          toUserPk: userPk,
+          fromUserDid: previousUserDid,
+          blockletInfo,
+          blocklet,
+        });
+      } else {
+        const connectedAccounts = oauthUser?.connectedAccounts || [];
+        const sourceProvider = oauthUser?.sourceProvider;
+        const oauthAccount = connectedAccounts.find((item) => item.provider === sourceProvider);
+        const userWallet = fromAppDid(oauthAccount.id, blockletWallet.secretKey);
+        await declareAccount({ wallet: userWallet, blocklet });
+        await migrateAccount({ wallet: userWallet, blocklet, user: bindUser });
+      }
 
       await node.createAuditLog(
         {

package/api/libs/connect/shared.js

@@ -4,25 +4,47 @@ const { getConnectAppUrl, getChainInfo } = require('@blocklet/meta/lib/util');
 const { WELLKNOWN_SERVICE_PATH_PREFIX } = require('@abtnode/constant');
 const { getSourceAppPid } = require('@blocklet/sdk/lib/util/login');
 
+function getFederatedMasterAppInfo({ blocklet, sourceAppPid, baseUrl, version, request, groupPathPrefix, nodeInfo }) {
+  const { federated } = blocklet.settings;
+  const master = federated.sites.find((x) => x.appPid === sourceAppPid);
+  // 对于 ux 来说，要展示的始终是 pid，所以这个给 agentDid 的赋值也需要是 pid
+  // federated 登录模式下，需要告知原有的 blocklet-did
+  const agentDid = blocklet.appPid;
+
+  return {
+    name: master.appName,
+    description: master.appescription || `Connect to ${master.appName}`,
+    icon: joinUrl(master.appUrl, WELLKNOWN_SERVICE_PATH_PREFIX, `/blocklet/logo?v=${version}`),
+    link: getConnectAppUrl({ request, baseUrl }),
+    updateSubEndpoint: true,
+    subscriptionEndpoint: joinUrl(groupPathPrefix, WELLKNOWN_SERVICE_PATH_PREFIX, 'websocket'),
+    nodeDid: nodeInfo.did,
+    agentDid,
+  };
+}
+
 module.exports = {
   appInfo: async ({ request, baseUrl }) => {
     const groupPathPrefix = request.headers['x-group-path-prefix'] || '/';
 
-    const [blocklet, meta, info] = await Promise.all([
-      request.getBlocklet(),
-      request.getBlockletInfo(),
-      request.getNodeInfo(),
-    ]);
-    // 对于 ux 来说， 要展示的始终是 pid，所以这个给 agentDid 的赋值也需要是 pid
-    let agentDid;
+    const [blocklet, info] = await Promise.all([request.getBlocklet(), request.getNodeInfo()]);
+
     const sourceAppPid = getSourceAppPid(request);
-    // federated 登录模式下，需要告知原有的 blocklet-did
-    if (sourceAppPid) {
-      agentDid = blocklet.appPid;
-    }
 
     const version = get(blocklet, 'meta.version', '');
 
+    if (sourceAppPid) {
+      return getFederatedMasterAppInfo({
+        blocklet,
+        sourceAppPid,
+        baseUrl,
+        version,
+        groupPathPrefix,
+        request,
+        nodeInfo: info,
+      });
+    }
+    const meta = await request.getBlockletInfo();
     return {
       name: meta.name,
       description: meta.description || `Connect to ${meta.name}`,
@@ -32,7 +54,6 @@ module.exports = {
       subscriptionEndpoint: joinUrl(groupPathPrefix, WELLKNOWN_SERVICE_PATH_PREFIX, 'websocket'),
       nodeDid: info.did,
       // NOTE: publisher 是 WalletAuthenticator 中自动添加的
-      agentDid,
     };
   },
 

package/api/libs/jwt.js

@@ -18,7 +18,7 @@ const initJwt = (node, options) => {
 
   const createSessionToken = (
     did,
-    { role, secret, passport, expiresIn, tokenType, fullName, provider = LOGIN_PROVIDER.WALLET }
+    { role, secret, passport, expiresIn, tokenType, fullName, provider = LOGIN_PROVIDER.WALLET, walletOS }
   ) =>
     createAuthToken({
       did,
@@ -29,6 +29,7 @@ const initJwt = (node, options) => {
       tokenType,
       fullName,
       provider,
+      walletOS,
     });
 
   const verifySessionToken = (token, secret, { checkFromDb, teamDid, checkToken } = {}) =>
@@ -47,7 +48,7 @@ const initJwt = (node, options) => {
           }
         }
 
-        const { did, role, passport, fullName, provider = LOGIN_PROVIDER.WALLET } = decoded;
+        const { did, role, passport, fullName, provider = LOGIN_PROVIDER.WALLET, walletOS } = decoded;
         let user;
         if (!did) {
           return reject(new Error('Invalid jwt token: invalid did'));
@@ -75,8 +76,9 @@ const initJwt = (node, options) => {
           user.role = role;
           user.passport = passport;
           user.provider = provider;
+          user.walletOS = walletOS;
         } else {
-          user = { did, role, passport, fullName, provider };
+          user = { did, role, passport, fullName, provider, walletOS };
         }
 
         return resolve(user);

package/api/routes/federated.js

@@ -6,6 +6,7 @@ const get = require('lodash/get');
 const isNil = require('lodash/isNil');
 const pLimit = require('p-limit');
 const pRetry = require('p-retry');
+const joinUrl = require('url-join');
 
 const cors = require('cors');
 const { LOGIN_PROVIDER } = require('@blocklet/constant');
@@ -14,16 +15,18 @@ const { getApplicationInfo } = require('@abtnode/auth/lib/auth');
 const pick = require('lodash/pick');
 const defaults = require('lodash/defaults');
 const remove = require('lodash/remove');
+const { fromAppDid } = require('@arcblock/did-ext');
 
 const logger = require('@abtnode/logger')('blocklet-services:federated');
 
 const { api } = require('../libs/api');
 const initJwt = require('../libs/jwt');
 const { createTokenFn, getDidConnectVersion } = require('../util');
-const verifyFederatedCall = require('../middlewares/verify-federated-call');
 const ensureBlocklet = require('../middlewares/ensure-blocklet');
+const verifyFederatedCall = require('../middlewares/verify-federated-call');
 const checkFederatedCorsCall = require('../middlewares/check-federated-cors-call');
-const { getUserAvatarUrl } = require('../util/federated');
+const { getUserAvatarUrl, getFederatedMaster } = require('../util/federated');
+const { declareAccount, migrateAccount } = require('../services/oauth');
 
 const PREFIX = WELLKNOWN_SERVICE_PATH_PREFIX;
 
@@ -50,7 +53,7 @@ async function syncSwitchProfile(user, { node, teamDid, dataDir }) {
 }
 
 async function syncConnectAccount(user, { node, teamDid, dataDir }) {
-  const tempUser = pick(user, ['did', 'pk', 'avatar', 'fullName', 'email', 'connectedAccount']);
+  const tempUser = pick(user, ['did', 'pk', 'avatar', 'fullName', 'email', 'connectedAccount', 'sourceAppPid']);
 
   // 处理 avatar
   if (tempUser.avatar) {
@@ -166,7 +169,7 @@ module.exports = {
         .filter((item) => item.appId !== federated.config.appId)
         .map((item) => {
           return limitSync(async () => {
-            const url = `${item.appUrl}/${WELLKNOWN_SERVICE_PATH_PREFIX}/api/federated/sync`;
+            const url = joinUrl(item.appUrl, WELLKNOWN_SERVICE_PATH_PREFIX, '/api/federated/sync');
             // NOTICE: 即使通知其他 member 失败了，也不影响来源 member 退出统一登录
             try {
               await pRetry(() => api.post(url, postData), {
@@ -272,7 +275,10 @@ module.exports = {
           for (const user of users) {
             pendingList.push(
               limitSync(async () => {
-                await syncFnMaps[user.action]?.(user, { node, teamDid, dataDir });
+                await syncFnMaps[user.action]?.(
+                  { ...user, sourceAppPid: user.sourceAppPid === teamDid ? undefined : user.sourceAppPid },
+                  { node, teamDid, dataDir }
+                );
               })
             );
           }
@@ -370,13 +376,15 @@ module.exports = {
           }
 
           try {
-            ({ data } = await api.post(`${loginSite.appUrl}${prefix}/token`, {
+            ({ data } = await api.post(joinUrl(loginSite.appUrl, prefix, 'token'), {
               signer: permanentWallet.address,
               data: signV2(permanentWallet.address, permanentWallet.secretKey, {
                 masterPid: teamDid,
                 role: req.user.role,
                 user,
                 passport: req.user.passport,
+                walletOS: req.user.walletOS,
+                provider: req.user.provider,
               }),
             }));
           } catch {
@@ -398,7 +406,7 @@ module.exports = {
 
     // step 6 发放自动登录 token(master 向 member 发起生成 token 请求)
     server.post(`${prefix}/token`, ensureBlocklet(), verifyFederatedCall(), async (req, res) => {
-      const { user, masterPid, role, passport } = req.body.verifyData;
+      const { user, masterPid, role, passport, walletOS, provider } = req.body.verifyData;
       const { createSessionToken } = initJwt(node, options);
       const createToken = createTokenFn(createSessionToken);
       const { secret } = await req.getBlockletInfo();
@@ -438,7 +446,7 @@ module.exports = {
           // passport: findMapping ? targetPassport : null,
           sourceAppPid: masterPid,
           connectedAccount: {
-            provider: LOGIN_PROVIDER.WALLET,
+            provider: provider || LOGIN_PROVIDER.WALLET,
             id: masterPid,
             did: user.did,
             pk: user.pk,
@@ -452,7 +460,8 @@ module.exports = {
           role: targetPassport.role,
           passport: targetPassport,
           fullName: doc.fullName,
-          provider: LOGIN_PROVIDER.WALLET,
+          provider: provider || LOGIN_PROVIDER.WALLET,
+          walletOS,
         },
         {
           ...sessionConfig,
@@ -483,7 +492,7 @@ module.exports = {
     // member 传递过来的 user.did 和 user.pk 均为 master-site 与钱包生成的
 
     server.post(`${prefix}/loginByMember`, ensureBlocklet(), verifyFederatedCall(), async (req, res) => {
-      const { user, passport } = req.body.verifyData;
+      const { user, passport, walletOS, provider } = req.body.verifyData;
       const { createSessionToken } = initJwt(node, options);
       const createToken = createTokenFn(createSessionToken);
       const { secret } = await req.getBlockletInfo();
@@ -520,8 +529,7 @@ module.exports = {
           pk: realPk,
           passport: targetPassport,
           connectedAccount: {
-            // member 在使用 federated login 时，本质还是使用 wallet 来登录的，所以对 master-site 来说，登录的 provider 就是 wallet
-            provider: LOGIN_PROVIDER.WALLET,
+            provider: provider || LOGIN_PROVIDER.WALLET,
             did: user.did,
             pk: user.pk,
           },
@@ -537,6 +545,7 @@ module.exports = {
           fullName: newUser.fullName,
           // 这里是 member 登录了 master 的账号，对于 master 来说，其实还是使用 wallet 来登录的
           provider: LOGIN_PROVIDER.WALLET,
+          walletOS,
         },
         {
           ...sessionConfig,
@@ -546,5 +555,49 @@ module.exports = {
 
       res.json({ sessionToken, refreshToken });
     });
+
+    server.post(`${prefix}/migrateAuth0`, ensureBlocklet(), verifyFederatedCall(), async (req, res) => {
+      const { blocklet } = req;
+      const { did: teamDid, wallet: blockletWallet } = await req.getBlockletInfo();
+      const { fromUserDid, toUserDid, toUserPk } = req.body.verifyData;
+      const oauthUser = await node.getUser({ teamDid, user: { did: fromUserDid } });
+      const connectedAccounts = oauthUser?.connectedAccounts || [];
+      const sourceProvider = oauthUser?.sourceProvider;
+      const oauthAccount = connectedAccounts.find((item) => item.provider === sourceProvider);
+      const userWallet = fromAppDid(oauthAccount.id, blockletWallet.secretKey);
+
+      const bindUser = {
+        did: toUserDid,
+        pk: toUserPk,
+      };
+      await declareAccount({ wallet: userWallet, blocklet });
+      await migrateAccount({ wallet: userWallet, blocklet, user: bindUser });
+      res.json({});
+    });
+
+    server.post(`${prefix}/loginMaster`, ensureBlocklet(), async (req, res) => {
+      if (!req.user) {
+        res.status(401).send('Unauthorized');
+        return;
+      }
+      const { blocklet } = req;
+      const masterSite = getFederatedMaster(blocklet);
+      if (!masterSite) {
+        res.status(400).send('No federated context found');
+        return;
+      }
+
+      const { did: teamDid, permanentWallet } = await req.getBlockletInfo();
+      const user = await node.getUser({ teamDid, user: { did: req.user.did } });
+      const { passport, walletOS, provider } = req.user;
+      const url = joinUrl(masterSite.appUrl, prefix, 'loginByMember');
+      const postData = {
+        signer: permanentWallet.address,
+        data: signV2(permanentWallet.address, permanentWallet.secretKey, { user, passport, walletOS, provider }),
+      };
+
+      const { data } = await api.post(url, postData);
+      res.json(data);
+    });
   },
 };