@abtnode/blocklet-services 1.16.18-beta-7aa6be5a → 1.16.18-beta-bb4ebacc

package/api/routes/user.js

@@ -1,5 +1,5 @@
 const { NODE_SERVICES, WELLKNOWN_SERVICE_PATH_PREFIX } = require('@abtnode/constant');
-const { getApplicationInfo, upsertUserSession } = require('@abtnode/auth/lib/auth');
+const { getApplicationInfo } = require('@abtnode/auth/lib/auth');
 const { fromAppDid } = require('@arcblock/did-ext');
 const { extractUserAvatar } = require('@abtnode/util/lib/user');
 const formatContext = require('@abtnode/util/lib/format-context');
@@ -7,12 +7,15 @@ const createTranslator = require('@abtnode/util/lib/translate');
 const logger = require('@abtnode/logger')('blocklet-services:user');
 const { isFromPublicKey } = require('@arcblock/did');
 const { LOGIN_PROVIDER } = require('@blocklet/constant');
+const { fromPublicKey } = require('@ocap/wallet');
+const sortBy = require('lodash/sortBy');
+const head = require('lodash/head');
 
 const { isInvitedUserOnly, createTokenFn, getDidConnectVersion } = require('../util');
 const initJwt = require('../libs/jwt');
 const { getAvatarByUrl } = require('../libs/auth/utils');
 const { ApiError } = require('../util/error');
-const { loginWalletSchema, loginOAuthSchema } = require('../validators/login');
+const { loginWalletSchema, loginOAuthSchema, loginUserWalletSchema } = require('../validators/login');
 const verifySig = require('../middlewares/verify-sig');
 const { getAvatarByEmail } = require('../libs/auth/utils');
 const ensureBlocklet = require('../middlewares/ensure-blocklet');
@@ -213,7 +216,6 @@ async function loginOAuth(
   if (!validateUser(loginParams.user) || !validateUser(loginParams.user.connectedAccount)) {
     throw new ApiError(400, t('userInfoError', locale));
   }
-  // TODO: @zhanghan 暂不支持统一登录模式登录
   const doc = await node.loginUser(loginParams);
   return doc;
 }
@@ -240,14 +242,14 @@ async function login(req, node, options) {
   const { did: teamDid, wallet: blockletWallet, secret } = await req.getBlockletInfo();
   const blocklet = await req.getBlocklet();
 
-  let doc;
+  let userDoc;
   if (provider === LOGIN_PROVIDER.WALLET) {
-    doc = await loginWallet(
+    userDoc = await loginWallet(
       { did, pk, avatar, email, fullName },
       { node, req, locale, componentId, teamDid, updateInfo, sourceAppPid }
     );
   } else {
-    doc = await loginOAuth(
+    userDoc = await loginOAuth(
       { provider, id, avatar, email, fullName },
       { node, req, locale, componentId, teamDid, blockletWallet, updateInfo, sourceAppPid }
     );
@@ -259,9 +261,9 @@ async function login(req, node, options) {
   await node.createAuditLog(
     {
       action: 'login',
-      args: { teamDid, userDid: doc.did, passport, provider },
-      context: formatContext(Object.assign(req, { user: doc })),
-      result: doc,
+      args: { teamDid, userDid: userDoc.did, passport, provider },
+      context: formatContext(Object.assign(req, { user: userDoc })),
+      result: userDoc,
     },
     node
   );
@@ -271,35 +273,66 @@ async function login(req, node, options) {
   const createToken = createTokenFn(createSessionToken);
   const sessionConfig = blocklet.settings?.session || {};
   const { sessionToken, refreshToken } = createToken(
-    doc.did,
+    userDoc.did,
     {
       secret,
       passport,
       role: passport.role,
-      fullName: doc.fullName,
+      fullName: userDoc.fullName,
       provider,
       walletOS: 'api',
     },
     { ...sessionConfig, didConnectVersion: getDidConnectVersion(req) }
   );
-  const userSession = await upsertUserSession(
-    {
-      visitorId,
-      teamDid,
-      userDid: doc.did,
-      appPid: teamDid,
-      status: 'online',
-    },
-    { req, node }
-  );
+  const lastLoginIp = req.headers['x-real-ip'];
+  const ua = req.headers['user-agent'];
+  const userSession = await node.upsertUserSession({
+    visitorId,
+    teamDid,
+    userDid: userDoc.did,
+    appPid: teamDid,
+    status: 'online',
+    ua,
+    lastLoginIp,
+  });
+  node.syncUserSession({
+    teamDid,
+    userDid: userDoc.did,
+    visitorId: userSession.visitorId,
+    passportId: passport?.id,
+    targetAppPid: sourceAppPid,
+    ua,
+    lastLoginIp,
+  });
   return {
-    user: doc,
+    user: userDoc,
     token: sessionToken,
     refreshToken,
     visitorId: userSession?.visitorId || '',
   };
 }
 
+async function verifyUserSig({ userDid, signature, teamDid, data }, { node }) {
+  const currentUser = await node.getUser({
+    teamDid,
+    user: {
+      did: userDid,
+    },
+    options: {
+      enableConnectedAccount: true,
+    },
+  });
+  if (!currentUser) {
+    throw new Error('user is not exist');
+  }
+  const userWallet = fromPublicKey(currentUser.pk);
+  const valid = userWallet.verify(data, signature);
+  if (!valid) {
+    throw new Error('invalid signature');
+  }
+  return currentUser;
+}
+
 module.exports = {
   init(server, node, options) {
     async function loginFn(req, res) {
@@ -318,6 +351,111 @@ module.exports = {
     server.post(`${prefix}/login`, verifySig, loginFn);
     server.post(`${prefixApi}/login`, verifySig, loginFn);
 
+    /**
+     * @description 用于在 native 钱包中完成用户的自动登录
+     * @summary 暂时不允许用户注册，只允许登录
+     */
+    server.post(`${prefixApi}/loginByWallet`, async (req, res) => {
+      const { userDid, signature, walletOS, nonce, visitorId, passportId, sourceAppPid, locale } = req.body;
+      const { error } = loginUserWalletSchema.validate({
+        userDid,
+        signature,
+        walletOS,
+        nonce,
+        visitorId,
+        passportId,
+        sourceAppPid,
+        locale,
+      });
+      if (error) {
+        throw new ApiError(400, error.message);
+      }
+      const { did: teamDid, secret } = await req.getBlockletInfo();
+      const currentUser = await verifyUserSig({ userDid, signature, teamDid, data: nonce }, { node });
+      const { createSessionToken } = initJwt(node, options);
+      const createToken = createTokenFn(createSessionToken);
+      const blocklet = await req.getBlocklet();
+      const sessionConfig = blocklet.settings?.session || {};
+      const passports = currentUser?.passports || [];
+
+      let passport = null;
+      if (passportId) {
+        passport = passports.find((x) => x.passportId === passportId);
+      }
+      if (!passport) {
+        const now = new Date().getTime();
+        passport = head(
+          sortBy(passports, (x) => {
+            const lastLoginAt = new Date(x.lastLoginAt).getTime();
+            if (typeof lastLoginAt === 'number') {
+              return now - lastLoginAt;
+            }
+            return now;
+          })
+        );
+      }
+
+      if (!passport) {
+        passport = { name: 'Guest', role: 'guest' };
+      }
+
+      const lastLoginIp = req.get('x-real-ip');
+      const loginedUser = await node.loginUser({
+        teamDid,
+        user: {
+          did: currentUser.did,
+          pk: currentUser.pk,
+          locale,
+          lastLoginIp,
+          sourceAppPid,
+          connectedAccount: {
+            provider: LOGIN_PROVIDER.WALLET,
+            did: currentUser.did,
+            pk: currentUser.pk,
+          },
+        },
+      });
+
+      const { sessionToken, refreshToken } = createToken(
+        loginedUser.did,
+        {
+          secret,
+          passport,
+          role: passport?.role || 'guest',
+          fullName: loginedUser.fullName,
+          provider: 'wallet',
+          walletOS,
+        },
+        { ...sessionConfig, didConnectVersion: getDidConnectVersion(req) }
+      );
+      const ua = req.headers['user-agent'];
+      const userSession = await node.upsertUserSession({
+        visitorId,
+        teamDid,
+        userDid: loginedUser.did,
+        appPid: teamDid,
+        status: 'online',
+        ua,
+        lastLoginIp,
+      });
+      node.syncUserSession({
+        teamDid,
+        userDid,
+        visitorId: userSession.visitorId,
+        passportId,
+        targetAppPid: sourceAppPid,
+        ua,
+        lastLoginIp,
+      });
+
+      res.json({
+        sessionToken,
+        refreshToken,
+        nonce,
+        visitorId: userSession.visitorId,
+      });
+    });
+
     server.post(`${prefixApi}/logout`, ensureBlocklet(), async (req, res) => {
       if (req.user) {
         const { blocklet } = req;

package/api/services/auth/connect/invite.js

@@ -6,7 +6,6 @@ const {
   messages,
   checkWalletVersion,
   beforeInvitationRequest,
-  upsertUserSession,
 } = require('@abtnode/auth/lib/auth');
 const { getSourceAppPid } = require('@blocklet/sdk/lib/util/login');
 const { NODE_SERVICES, WELLKNOWN_SERVICE_PATH_PREFIX } = require('@abtnode/constant');
@@ -98,17 +97,27 @@ module.exports = function createRoutes(node, authenticator, createSessionToken)
         { ...sessionConfig, didConnectVersion: getDidConnectVersion(req) }
       );
 
-      const userSessionDoc = await upsertUserSession(
-        {
-          teamDid,
-          visitorId,
-          userDid,
-          appPid: teamDid,
-          passportId: response.data.id,
-          status: 'online',
-        },
-        { req, node, sourceAppPid }
-      );
+      const lastLoginIp = req.headers['x-real-ip'];
+      const ua = req.headers['user-agent'];
+      const userSessionDoc = await node.upsertUserSession({
+        teamDid,
+        visitorId,
+        userDid,
+        appPid: teamDid,
+        passportId: response.data.id,
+        status: 'online',
+        ua,
+        lastLoginIp,
+      });
+      node.syncUserSession({
+        teamDid,
+        userDid,
+        visitorId: userSessionDoc.visitorId,
+        passportId: passport?.id,
+        targetAppPid: sourceAppPid,
+        ua,
+        lastLoginIp,
+      });
       await updateSession(
         {
           sessionToken,

package/api/services/auth/index.js

@@ -84,12 +84,16 @@ const init = ({ node, options }) => {
   };
 
   /**
-   * @returns {object} res
-   *  {boolean} res.blocked
-   *  {boolean} res.authenticated
-   *  {boolean} res.authorized
-   *  {boolean} res.ignored
-   *  {string} res.payable
+   * @typedef {object} CheckAuthRes
+   * @property {boolean} blocked
+   * @property {boolean} authenticated
+   * @property {boolean} authorized
+   * @property {boolean} ignored
+   * @property {string} payable
+   */
+
+  /**
+   * @returns {CheckAuthRes} res
    */
   const checkAuth = async ({ req } = {}) => {
     const config = (await req.getServiceConfig(NODE_SERVICES.AUTH)) || {};
@@ -107,24 +111,74 @@ const init = ({ node, options }) => {
 
     const teamDid = req.getBlockletDid();
 
+    // 所有人都可以访问的情况
     if (!config.whoCanAccess || config.whoCanAccess === WHO_CAN_ACCESS.ALL) {
       if (config.blockUnauthenticated && !req.user) {
-        return { blocked: true, authenticated: false };
+        return {
+          blocked: true,
+          authenticated: false,
+        };
       }
     } else if (!req.user) {
+      // 需要被邀请才能访问的情况
       const rbac = await node.getRBAC(teamDid);
       const allRoles = await rbac.getRoles(teamDid);
       const payableRole = allRoles.find((x) => x.extra?.acquire?.pay);
-      return { blocked: true, authenticated: false, payable: payableRole?.extra?.acquire?.pay };
+      return {
+        blocked: true,
+        authenticated: false,
+        payable: payableRole?.extra?.acquire?.pay,
+      };
     } else if (config.whoCanAccess === WHO_CAN_ACCESS.OWNER && req.user.role !== ROLES.OWNER) {
-      return { blocked: true, authenticated: true, authorized: false };
+      // 需要 owner 才能访问
+      return {
+        blocked: true,
+        authenticated: true,
+        authorized: false,
+        requiredRoles: [
+          {
+            name: ROLES.OWNER,
+            title: 'Owner',
+            description: 'Owner',
+          },
+        ],
+      };
     } else if (config.whoCanAccess.startsWith(WHO_CAN_ACCESS_PREFIX_ROLES)) {
+      // 指定 passport 才能访问
+      // 需要用户拥有的权限
       const roles = getRolesFromAuthConfig(config);
       if (!roles.includes(req.user.role)) {
         const rbac = await node.getRBAC(teamDid);
+        // 系统中的所有权限
         const allRoles = await rbac.getRoles(teamDid);
-        const payableRole = allRoles.find((x) => roles.includes(x.name) && x.extra?.acquire?.pay);
-        return { blocked: true, authenticated: true, authorized: false, payable: payableRole?.extra?.acquire?.pay };
+
+        return {
+          blocked: true,
+          authenticated: true,
+          authorized: false,
+          requiredRoles: roles
+            .map((item) => {
+              if (item.name === ROLES.OWNER) {
+                return {
+                  name: item.name,
+                  title: 'Owner',
+                  description: 'Owner',
+                };
+              }
+              const findRole = allRoles.find((x) => x.name === item);
+              if (!findRole) {
+                return null;
+              }
+
+              return {
+                name: findRole.name,
+                title: findRole.title,
+                description: findRole.description,
+                payable: findRole?.extra?.acquire?.pay,
+              };
+            })
+            .filter((x) => x),
+        };
       }
     }
 
@@ -254,7 +308,7 @@ const init = ({ node, options }) => {
   };
 
   middlewares.checkAuth = async (req, res, next) => {
-    const { blocked, authenticated, authorized, payable } = await checkAuth({ req });
+    const { blocked, authenticated, authorized, payable, requiredRoles } = await checkAuth({ req });
 
     if (blocked) {
       if (!authenticated) {
@@ -269,7 +323,17 @@ const init = ({ node, options }) => {
 
       if (!authorized) {
         if (req.accepts(['html', 'json']) === 'html') {
-          res.redirect(getRedirectUrl({ req, pagePath: '/login', params: { authenticated: 1, payable } }));
+          res.redirect(
+            getRedirectUrl({
+              req,
+              pagePath: '/login',
+              params: {
+                authenticated: 1,
+                payable,
+                requiredRoles: JSON.stringify(requiredRoles),
+              },
+            })
+          );
         } else {
           // Security principles: user should not known the reason
           res.status(404).json({ code: 404, error: REASON_404 });

package/api/services/auth/session.js

@@ -1,6 +1,8 @@
 const nocache = require('nocache');
 const joinUrl = require('url-join');
 const pick = require('lodash/pick');
+const omit = require('lodash/omit');
+const merge = require('lodash/merge');
 const {
   WELLKNOWN_SERVICE_PATH_PREFIX,
   USER_AVATAR_URL_PREFIX,
@@ -9,6 +11,7 @@ const {
 } = require('@abtnode/constant');
 const { LOGIN_PROVIDER } = require('@blocklet/constant');
 
+const isUrl = require('is-url');
 const { PREFIXES } = require('../../util/constants');
 const { createTokenFn, getDidConnectVersion } = require('../../util');
 
@@ -57,7 +60,7 @@ module.exports = {
           .map((x) => pick(x, ['id', 'name', 'title', 'role']));
 
         res.json({
-          user,
+          user: omit(user, ['extra']),
           provider: req.user.provider || LOGIN_PROVIDER.WALLET,
           walletOS: req.user.walletOS,
         });
@@ -67,6 +70,50 @@ module.exports = {
       router.get(sessionApi, nocache(), sessionBearerToken, handleSession);
       router.post(sessionApi, nocache(), sessionBearerToken, handleSession);
 
+      // update user extra: settings, webhooks
+      const extraApi = `${prefix}/api/user/extra`;
+      const checkUser = async (req, res, next) => {
+        const { token } = req;
+        await ensureUser({ req, token });
+        if (!req.user) {
+          res.status(403).json(null);
+        } else {
+          next();
+        }
+      };
+      router.get(extraApi, nocache(), sessionBearerToken, checkUser, async (req, res) => {
+        const teamDid = req.getBlockletDid();
+        const user = await node.getUser({ teamDid, user: { did: req.user.did } });
+        res.json(user.extra || {});
+      });
+      router.post(extraApi, nocache(), sessionBearerToken, checkUser, async (req, res) => {
+        const teamDid = req.getBlockletDid();
+        const exist = await node.getUser({ teamDid, user: { did: req.user.did } });
+        const user = await node.updateUserExtra({
+          teamDid,
+          did: req.user.did,
+          extra: JSON.stringify(merge({}, exist.extra || {}, req.body)),
+        });
+        res.json(user.extra);
+      });
+      router.put(extraApi, nocache(), sessionBearerToken, checkUser, async (req, res) => {
+        if (['slack', 'api'].includes(req.body.type) === false) {
+          res.status(400).send({ error: 'invalid webhook type' });
+          return;
+        }
+
+        if (isUrl(req.body.url) === false) {
+          res.status(400).send({ error: 'invalid webhook url' });
+        }
+
+        await node.sendTestMessage({
+          webhook: { type: req.body.type, params: [{ name: 'url', value: req.body.url }] },
+          message: `This is a test message from user ${req.user.did}`,
+        });
+
+        res.json({ success: true });
+      });
+
       router.post(`${prefix}/api/did/refreshSession`, refreshBearerToken, async (req, res) => {
         const token = req.refreshToken;
         if (token) {

package/api/services/notification/blocklet-events-notifier.js

@@ -189,6 +189,7 @@ const init = ({ node, notificationService }) => {
             notification: {
               title: message.title[locale] || message.title[DEFAULT_LOCALE],
               body: message.body[locale] || message.body[DEFAULT_LOCALE],
+              source: 'app',
             },
           };
           notificationService.sendToUser.exec(input);

package/api/socket/channel/component.js

@@ -100,17 +100,18 @@ const sendToAppComponents = async ({ event, appDid, componentDid: inputComponent
     const componentDid = component.meta.did;
 
     if (!inputComponentDid || componentDid === inputComponentDid) {
-      // realAppDid is diff with appDid when app development mode
-      const realAppDid = app.appDid || appDid;
+      // appPid is diff with appDid when app development mode
+      // appPid is diff with appDid when app has been rotated
+      const appPid = app.appPid || appDid;
 
       // eslint-disable-next-line no-loop-func
-      broadcast(wsServer, getComponentChannel(realAppDid, componentDid), event, notification, async (count) => {
+      broadcast(wsServer, getComponentChannel(appPid, componentDid), event, notification, async (count) => {
         // FIXME @linchen 组件以 cluster 模式启动时, 是否确保所有组件实例都收到消息?
         if (count <= 0) {
-          logger.info('Online component client was not found', { realAppDid, componentDid });
+          logger.info('Online component client was not found', { appPid, componentDid });
           await lock.acquire();
           try {
-            await states.message.insert({ did: getCacheId(realAppDid, componentDid), event, data: notification });
+            await states.message.insert({ did: getCacheId(appPid, componentDid), event, data: notification });
             lock.release();
           } catch (error) {
             lock.release();

package/api/socket/channel/did.js

@@ -8,6 +8,9 @@ const { NODE_MODES } = require('@abtnode/constant');
 const { getWalletDid } = require('@blocklet/sdk/lib/did');
 const JWT = require('@arcblock/jwt');
 const pMap = require('p-map');
+const uniqBy = require('lodash/uniqBy');
+const uniq = require('lodash/uniq');
+const get = require('lodash/get');
 
 // eslint-disable-next-line global-require
 const logger = require('@abtnode/logger')(`${require('../../../package.json').name}:notification`);
@@ -34,21 +37,25 @@ const sendToUserDid = async ({ sender, receiver: rawDid, notification, options,
   const { keepForOfflineUser = true } = options || {};
   const receiver = Array.isArray(rawDid) ? rawDid : [rawDid];
 
-  const receiverDidList = [];
-  const receiverEmailList = [];
+  let receiverDidList = [];
+  let receiverEmailList = [];
+  let webhookList = [];
+
+  const webhookSenders = new Map();
 
   // sender.appDid 就是当前 blockletDid，通知的发送方就是这个 blocklet 本身
   const teamDid = sender.appDid;
 
   await pMap(receiver, async (item) => {
-    const userInfoItem = await node.getUser({
-      teamDid,
-      user: { did: item },
-      options: { enableConnectedAccount: true },
-    });
-    const receiverDid = getWalletDid(userInfoItem) || item;
-    const receiverEmail = userInfoItem?.email;
-    if (receiverDid) {
+    const user = await node.getUser({ teamDid, user: { did: item }, options: { enableConnectedAccount: true } });
+    const walletEnabled = get(user, 'extra.notifications.wallet', true);
+    const emailEnabled = get(user, 'extra.notifications.email', true);
+    const webhooks = get(user, 'extra.webhooks', []);
+
+    const receiverDid = getWalletDid(user) || item;
+    const receiverEmail = user?.email;
+
+    if (receiverDid && walletEnabled) {
       try {
         await validateReceiver(receiverDid);
         receiverDidList.push(receiverDid);
@@ -56,17 +63,21 @@ const sendToUserDid = async ({ sender, receiver: rawDid, notification, options,
         /* empty */
       }
     }
-    if (receiverEmail) {
+    if (receiverEmail && emailEnabled) {
       try {
         await validateEmail(receiverEmail);
         receiverEmailList.push({
           email: receiverEmail,
-          locale: userInfoItem?.locale || 'en',
+          locale: user?.locale || 'en',
         });
       } catch {
         /* empty */
       }
     }
+
+    if (Array.isArray(webhooks)) {
+      webhookList.push(...webhooks.filter((x) => x.type && x.url));
+    }
   });
 
   if (receiverDidList.length === 0 && receiverEmailList.length === 0) {
@@ -85,6 +96,11 @@ const sendToUserDid = async ({ sender, receiver: rawDid, notification, options,
   // parse notification
   const notifications = parseNotification(notification, senderInfo);
 
+  // uniq receivers
+  receiverDidList = uniq(receiverDidList);
+  receiverEmailList = uniqBy(receiverEmailList, 'email');
+  webhookList = uniqBy(webhookList, 'url');
+
   // send notification
   notifications.forEach((data) => {
     for (const receiverDid of receiverDidList) {
@@ -95,14 +111,29 @@ const sendToUserDid = async ({ sender, receiver: rawDid, notification, options,
         }
       });
     }
-    // NOTICE: 目前只有 notification 的通知能够发送邮件，并且 type 可能为 undefined
-    if ([undefined, NOTIFICATION_TYPES.NOTIFICATION].includes(data.type)) {
-      for (const receiverEmail of receiverEmailList) {
-        sendEmail(receiverEmail.email, data, { teamDid: sender.appDid, node, locale: receiverEmail.locale }).catch(
-          (error) => {
-            logger.error('Failed to send email', { error });
-          }
-        );
+
+    // Do not send email for component activities
+    if (data.source !== 'app') {
+      // NOTICE: 目前只有 notification 的通知能够发送邮件，并且 type 可能为 undefined
+      if ([undefined, NOTIFICATION_TYPES.NOTIFICATION].includes(data.type)) {
+        for (const receiverEmail of receiverEmailList) {
+          sendEmail(receiverEmail.email, data, { teamDid: sender.appDid, node, locale: receiverEmail.locale }).catch(
+            (error) => {
+              logger.error('Failed to send email', { error });
+            }
+          );
+        }
+      }
+
+      // send webhook
+      for (const webhook of webhookList) {
+        let webhookSender = webhookSenders.get(webhook.type);
+        if (!webhookSender) {
+          webhookSender = node.getMessageSender(webhook.type);
+          webhookSenders.set(webhook.type, webhookSender);
+        }
+
+        webhookSender.sendNotification(webhook.url, notification);
       }
     }
   });

package/api/socket/util.js

@@ -29,6 +29,7 @@ const parseNotification = (notification, senderInfo) => {
       did: senderInfo.permanentWallet.address,
       pk: senderInfo.permanentWallet.pk,
       name: senderInfo.name,
+      logo: senderInfo.logo,
       // actualDid is the did of the application that is used to decrypt the message if needed
       actualDid: senderInfo.wallet.address,
       actualPk: senderInfo.wallet.pk,