@abtnode/blocklet-services 1.16.3 → 1.16.4-beta-8682e092

package/api/index.js

@@ -99,6 +99,7 @@ module.exports = function createServer(node, serverOptions = {}) {
     proxy.web(req, res, opts, (error) => {
       if (error) {
         logger.error('http proxy error', { error });
+        // TODO 如何同步的方便的拿到 nodeInfo
         res.status(502).send(`Can not proxy to upstream target: ${opts.target}`);
       }
     });

package/api/libs/auth/utils.js

@@ -27,14 +27,17 @@ async function getAvatarByEmail(email = '') {
     const base64Content = Buffer.from(data, 'binary').toString('base64');
 
     return `data:image/png;base64,${base64Content}`;
-  } catch {
-    logger.error(`Fetch gravatar failed: ${email}`);
+  } catch (error) {
+    logger.error(`Fetch gravatar failed: ${email}`, { error });
     return null;
   }
 }
 
 // FIXME: @zhanghan 转移通行证目前只能颁发新的，会导致用户数据中产生多余的通行证
 async function transferPassport(fromUser, toUser, { req, teamDid, node, nodeInfo }) {
+  if (!fromUser || !toUser) {
+    return;
+  }
   const {
     name: issuerName,
     wallet: issuerWallet,

package/api/libs/connect/session.js

@@ -5,7 +5,6 @@ const formatContext = require('@abtnode/util/lib/format-context');
 const { extractUserAvatar } = require('@abtnode/util/lib/user-avatar');
 const {
   messages,
-  getUser,
   getVCFromClaims,
   validatePassportStatus,
   getPassportStatusEndpoint,
@@ -19,7 +18,6 @@ const {
   VC_TYPE_NODE_PASSPORT,
   WHO_CAN_ACCESS,
   WHO_CAN_ACCESS_PREFIX_ROLES,
-  USER_TYPE,
 } = require('@abtnode/constant');
 const {
   validatePassport,
@@ -32,9 +30,9 @@ const {
   upsertToPassports,
 } = require('@abtnode/auth/lib/passport');
 const { getKeyPairClaim, getAuthPrincipalForMigrateAppToV2 } = require('@abtnode/auth/lib/server');
-const sortBy = require('lodash/sortBy');
-const last = require('lodash/last');
 const merge = require('lodash/merge');
+const { types } = require('@arcblock/did');
+const { fromAppDid } = require('@arcblock/did-ext');
 
 const { getRolesFromAuthConfig, getBlockletAppIdList } = require('@blocklet/meta/lib/util');
 
@@ -43,6 +41,7 @@ const logger = require('@abtnode/logger')(require('../../../package.json').name)
 const { isInvitedUserOnly } = require('../../util');
 const { transferPassport } = require('../auth/utils');
 const { generateTranslate } = require('../translate');
+const { getRawUser, mergeUserData, migrateAccount, normalizeUser } = require('../../services/oauth');
 
 const vcTypes = [VC_TYPE_GENERAL_PASSPORT, VC_TYPE_NODE_PASSPORT];
 
@@ -131,7 +130,7 @@ module.exports = {
       const { did: teamDid } = await request.getBlockletInfo();
 
       const profileFields = get(config, 'profileFields');
-      const [invitedUserOnly] = await isInvitedUserOnly(config, node, teamDid);
+      const [invitedUserOnly] = config ? await isInvitedUserOnly(config, node, teamDid) : [false];
       const trustedPassports = (blocklet.trustedPassports || []).map((x) => x.issuerDid);
       const trustedIssuers = [...getBlockletAppIdList(blocklet), ...trustedPassports].filter(Boolean);
 
@@ -153,7 +152,14 @@ module.exports = {
         claims.verifiableCredential.target = passportId;
       }
 
-      const user = await node.getUser({ teamDid: blocklet.meta.did, user: { did: userDid } });
+      let user = await getRawUser(blocklet.meta.did, userDid, {
+        getUser: node.getUser,
+        getUsers: node.getUsers,
+      });
+      user = await normalizeUser(teamDid, user, {
+        updateUser: node.updateUser,
+        getBlockletInfo: request.getBlockletInfo,
+      });
       if (user) {
         delete claims.profile;
       }
@@ -177,11 +183,21 @@ module.exports = {
       const { wallet, name, passportColor, did: teamDid } = await request.getBlockletInfo();
 
       // Check user approved
-      const user = await getUser(node, teamDid, userDid);
+      let user = await getRawUser(teamDid, userDid, {
+        getUser: node.getUser,
+        getUsers: node.getUsers,
+      });
+      user = await normalizeUser(teamDid, user, {
+        updateUser: node.updateUser,
+        getBlockletInfo: request.getBlockletInfo,
+      });
       if (user && !user.approved) {
         throw new Error(messages.notAllowed[locale]);
       }
 
+      const realDid = user?.did || userDid;
+      const realPk = user?.pk || userPk;
+
       // Get auth config
       const authConfig = (await request.getServiceConfig(NODE_SERVICES.AUTH, { componentId })) || {};
 
@@ -203,7 +219,7 @@ module.exports = {
         vc = createPassportVC({
           issuerName: name,
           issuerWallet: wallet,
-          ownerDid: userDid,
+          ownerDid: realDid,
           passport: await createPassport({
             name: defaultRole,
             node,
@@ -213,7 +229,7 @@ module.exports = {
           }),
           endpoint: getPassportStatusEndpoint({
             baseUrl: joinUrl(baseUrl, WELLKNOWN_SERVICE_PATH_PREFIX),
-            userDid,
+            userDid: realDid,
             teamDid,
           }),
           ownerProfile: profile,
@@ -234,28 +250,25 @@ module.exports = {
       // Recreate passport with correct role
       passport = vc ? createUserPassport(vc, { role }) : null;
 
+      const currentTime = new Date().toISOString();
+
       // Update profile
       const passportForLog = passport || { name: 'Guest', role: 'guest' };
       if (user) {
         // Update user
         const doc = await node.updateUser({
           teamDid,
-          user: {
-            did: userDid,
-            pk: userPk,
+          user: mergeUserData(user, {
             locale,
-            passports: upsertToPassports(
-              user.passports || [],
-              passport && { ...passport, lastLoginAt: new Date().toISOString() }
-            ).filter(Boolean),
-            lastLoginAt: new Date().toISOString(),
+            lastUsedPassport: passport,
             lastLoginIp: get(request, 'headers[x-real-ip]') || '',
-          },
+            connectedAccount: { provider: 'wallet' },
+          }),
         });
         await node.createAuditLog(
           {
             action: 'login',
-            args: { teamDid, userDid, passport: passportForLog },
+            args: { teamDid, userDid: realDid, passport: passportForLog },
             context: formatContext(Object.assign(request, { user: doc })),
             result: doc,
           },
@@ -272,20 +285,32 @@ module.exports = {
             avatar: await extractUserAvatar(get(profile, 'avatar'), {
               dataDir: blocklet.env.dataDir,
             }),
-            did: userDid,
-            pk: userPk,
+            did: realDid,
+            pk: realPk,
             approved: true,
             locale,
             passports: [passport].filter(Boolean),
-            firstLoginAt: new Date().toISOString(),
-            lastLoginAt: new Date().toISOString(),
+            firstLoginAt: currentTime,
+            lastLoginAt: currentTime,
             lastLoginIp: get(request, 'headers[x-real-ip]') || '',
+            extraConfigs: {
+              sourceProvider: 'wallet',
+              connectedAccounts: [
+                {
+                  provider: 'wallet',
+                  did: realDid,
+                  pk: realPk,
+                  firstLoginAt: currentTime,
+                  lastLoginAt: currentTime,
+                },
+              ],
+            },
           },
         });
         await node.createAuditLog(
           {
             action: 'addUser',
-            args: { teamDid, userDid, reason: `first login as ${passportForLog.role}` },
+            args: { teamDid, userDid: realDid, reason: `first login as ${passportForLog.role}` },
             context: formatContext(Object.assign(request, { user: doc })),
             result: doc,
           },
@@ -294,8 +319,8 @@ module.exports = {
       }
 
       // Generate new session token that client can save to localStorage
-      const sessionToken = await createSessionToken(userDid, { passport, role });
-      logger.info('login.success', { userDid, role });
+      const sessionToken = await createSessionToken(realDid, { passport, role });
+      logger.info('login.success', { userDid: realDid, role });
 
       if (
         // if user provides owner passport AND app does not have owner, set this user to owner
@@ -303,8 +328,8 @@ module.exports = {
         // if the user will receive a owner passport AND app does not have owner, set this user to owner
         (issuePassport && defaultRole === ROLES.OWNER && !blocklet.settings?.owner)
       ) {
-        logger.info('Bind owner for blocklet', { teamDid, userDid });
-        await node.setBlockletInitialized({ did: teamDid, owner: { did: userDid, pk: userPk } });
+        logger.info('Bind owner for blocklet', { teamDid, userDid: realDid });
+        await node.setBlockletInitialized({ did: teamDid, owner: { did: realDid, pk: realPk } });
       }
 
       // issue passport for the first login user in a invite-only team
@@ -315,7 +340,7 @@ module.exports = {
           data: vc,
           sessionToken,
           nextWorkflowData: {
-            userDid,
+            userDid: realDid,
           },
         };
       }
@@ -323,7 +348,7 @@ module.exports = {
       return {
         sessionToken,
         nextWorkflowData: {
-          userDid,
+          userDid: realDid,
         },
       };
     },
@@ -341,7 +366,14 @@ module.exports = {
       }
 
       const { did: teamDid } = await request.getBlockletInfo();
-      const user = await getUser(node, teamDid, userDid);
+      let user = await getRawUser(teamDid, userDid, {
+        getUser: node.getUser,
+        getUsers: node.getUsers,
+      });
+      user = await normalizeUser(teamDid, user, {
+        updateUser: node.updateUser,
+        getBlockletInfo: request.getBlockletInfo,
+      });
 
       if (!user) {
         throw new Error(messages.userNotFound[locale]);
@@ -363,7 +395,14 @@ module.exports = {
       const teamDid = blocklet.meta.did;
 
       // check user approved
-      const user = await getUser(node, teamDid, userDid);
+      let user = await getRawUser(teamDid, userDid, {
+        getUser: node.getUser,
+        getUsers: node.getUsers,
+      });
+      user = await normalizeUser(teamDid, user, {
+        updateUser: node.updateUser,
+        getBlockletInfo: request.getBlockletInfo,
+      });
       if (!user) {
         throw new Error(messages.userNotFound[locale]);
       }
@@ -403,7 +442,14 @@ module.exports = {
 
       const { did: teamDid } = await request.getBlockletInfo();
 
-      const user = await getUser(node, teamDid, userDid);
+      let user = await getRawUser(teamDid, userDid, {
+        getUser: node.getUser,
+        getUsers: node.getUsers,
+      });
+      user = await normalizeUser(teamDid, user, {
+        updateUser: node.updateUser,
+        getBlockletInfo: request.getBlockletInfo,
+      });
 
       if (!user) {
         throw new Error(messages.userNotFound[locale]);
@@ -443,7 +489,14 @@ module.exports = {
       const { name, did: teamDid } = await request.getBlockletInfo();
 
       // Validate user
-      const user = await getUser(node, teamDid, userDid);
+      let user = await getRawUser(teamDid, userDid, {
+        getUser: node.getUser,
+        getUsers: node.getUsers,
+      });
+      user = await normalizeUser(teamDid, user, {
+        updateUser: node.updateUser,
+        getBlockletInfo: request.getBlockletInfo,
+      });
       if (!user) {
         throw new Error(messages.userNotFound[locale]);
       }
@@ -513,40 +566,61 @@ module.exports = {
 
   // 基本流程与 login 一致，但在创建更新用户信息的逻辑不一样
   bindWallet: {
-    onConnect: async ({ node, request, userDid, locale, passportId = '', componentId, previousUserDid }) => {
+    onConnect: async ({ node, request, userDid, locale, passportId = '', componentId }) => {
       const translations = {
         en: {
           notFound: "Can't get bind account infomation",
-          notDerivedAccount: "Current account is not a derived account, can't bind a DID Wallet account",
-          notWalletAccount: "Bind account is a derived account, can't bind",
-          alreadyBind: 'Bind account already bind with another account',
+          alreadyBindOAuth: 'already bind with another account',
+          alreadyBindWallet: 'Current account is already bind a wallet account',
+          alreadyMainAccount: 'Current account is already a main account',
         },
         zh: {
           notFound: '获取绑定账户信息失败',
-          notDerivedAccount: '当前账户不是一个派生账号，无法绑定 DID Wallet 账户',
-          notWalletAccount: '绑定的账户是一个派生账号，无法绑定',
-          alreadyBind: '该账户已绑定 OAuth 账户',
+          alreadyBindOAuth: '已绑定 OAuth 账户',
+          alreadyBindWallet: '该账户已绑定 Wallet 账户',
+          alreadyMainAccount: '已给该账户分配一个主账户',
         },
       };
       const t = generateTranslate({ translations });
-      const blocklet = await request.getBlocklet();
-      const config = await request.getServiceConfig(NODE_SERVICES.AUTH, { componentId });
       const { did: teamDid } = await request.getBlockletInfo();
-      const oauthUser = await getUser(node, teamDid, previousUserDid);
-      const bindUser = await node.getUser({ teamDid: blocklet.meta.did, user: { did: userDid } });
+
+      const walletUser = await node.getUser({ teamDid, user: { did: userDid } });
+      if (walletUser) {
+        throw new Error(t('alreadyMainAccount', locale));
+      }
+
+      const config = await request.getServiceConfig(NODE_SERVICES.AUTH, { componentId });
+      let oauthUser = await getRawUser(teamDid, request.user.did, {
+        getUser: node.getUser,
+        getUsers: node.getUsers,
+      });
+      oauthUser = await normalizeUser(teamDid, oauthUser, {
+        updateUser: node.updateUser,
+        getBlockletInfo: request.getBlockletInfo,
+      });
 
       if (!oauthUser) {
-        throw new Error(t('notFound'));
+        throw new Error(t('notFound', locale));
       }
-      if (oauthUser.source !== USER_TYPE.DERIVED) {
-        throw new Error(t('notDerivedAccount'));
+      const oauthConnectedAccounts = oauthUser.extraConfigs?.connectedAccounts || [];
+      const sourceProvider = oauthUser.extraConfigs?.sourceProvider || 'wallet';
+      if (oauthConnectedAccounts.find((item) => item.provider === 'wallet')) {
+        throw new Error(t('alreadyBindWallet', locale));
       }
+
+      let bindUser = await getRawUser(teamDid, userDid, {
+        getUser: node.getUser,
+        getUsers: node.getUsers,
+      });
+      bindUser = await normalizeUser(teamDid, bindUser, {
+        updateUser: node.updateUser,
+        getBlockletInfo: request.getBlockletInfo,
+      });
+
       if (bindUser) {
-        if (bindUser.source === USER_TYPE.DERIVED) {
-          throw new Error(t('notWalletAccount'));
-        }
-        if (bindUser.extraConfigs?.derivedAccount) {
-          throw new Error(t('alreadyBind'));
+        const bindConnectedAccounts = bindUser.extraConfigs?.connectedAccounts || [];
+        if (bindConnectedAccounts.find((item) => item.provider === sourceProvider)) {
+          throw new Error(`${oauthUser.email} ${t('alreadyBindOAuth', locale)}`);
         }
       }
 
@@ -570,13 +644,21 @@ module.exports = {
 
       return claims;
     },
-    onApprove: async ({ node, request, locale, userDid, userPk, claims, createSessionToken, previousUserDid }) => {
-      const { did: teamDid } = await request.getBlockletInfo();
+    onApprove: async ({ node, request, locale, userDid, userPk, claims }) => {
+      const blocklet = await request.getBlocklet();
+      const { did: teamDid, wallet: blockletWallet } = await request.getBlockletInfo();
 
-      const oauthUser = await getUser(node, teamDid, previousUserDid);
+      const oauthUser = await node.getUser({ teamDid, user: { did: request.user.did } });
       const nodeInfo = await request.getNodeInfo();
       // Check user approved
-      let bindUser = await getUser(node, teamDid, userDid);
+      let bindUser = await getRawUser(teamDid, userDid, {
+        getUser: node.getUser,
+        getUsers: node.getUsers,
+      });
+      bindUser = await normalizeUser(teamDid, bindUser, {
+        updateUser: node.updateUser,
+        getBlockletInfo: request.getBlockletInfo,
+      });
       if (bindUser && !bindUser.approved) {
         throw new Error(messages.notAllowed[locale]);
       }
@@ -593,104 +675,72 @@ module.exports = {
 
       // TODO: 获取当前登录使用的 passport（无法获取到 passport.id）
       // 使用最近一次使用的 passport 来代替
-      const validPassports = oauthUser.passports.filter((item) => item.status === 'valid');
-      const lastUsedPassport = last(sortBy(validPassports, 'lastLoginAt'));
-      const passport = lastUsedPassport || { name: 'Guest', role: 'guest' };
-      if (bindUser) {
-        const mergePassport = (oauthUser.passports || []).reduce((sum, cur) => {
-          return upsertToPassports(sum, cur);
-        }, bindUser.passports || []);
-        const mergeProfile = merge(profile, {
-          email: bindUser.email,
-          fullName: bindUser.fullName,
-          avatar: bindUser.avatar,
-        });
+      const mergePassport = (oauthUser.passports || []).reduce((sum, cur) => {
+        return upsertToPassports(sum, cur);
+      }, bindUser?.passports || []);
+      const mergeProfile = merge(profile, {
+        email: bindUser?.email,
+        fullName: bindUser?.fullName,
+        avatar: bindUser?.avatar,
+      });
+      const currentTime = new Date().toISOString();
 
-        // Update bindUser account
-        await node.updateUser({
-          teamDid,
-          user: {
+      await node.updateUser({
+        teamDid,
+        user: mergeUserData(
+          {
             ...mergeProfile,
-            extraConfigs: {
-              ...(bindUser.extraConfigs || {}),
-              derivedAccount: {
-                provider: oauthUser.extraConfigs?.sourceProvider,
-                did: oauthUser.did,
-                pk: oauthUser.pk,
-              },
-              connectedAccounts: [
-                {
-                  provider: oauthUser.extraConfigs?.sourceProvider,
-                  id: oauthUser.extraConfigs?.sourceId,
-                  lastLoginAt: oauthUser.lastLoginAt,
-                },
-              ],
-            },
-            source: USER_TYPE.WALLET,
-            did: userDid,
-            pk: userPk,
-            locale,
+            did: oauthUser.did,
+            pk: oauthUser.pk,
             passports: mergePassport,
-            lastLoginAt: new Date().toISOString(),
-            lastLoginIp: get(request, 'headers[x-real-ip]') || '',
+            extraConfigs: oauthUser.extraConfigs,
           },
-        });
-        // TODO: @zhanghan 需要增加 auditLog
-      } else {
-        const doc = await node.addUser({
+          {
+            locale,
+            lastLoginIp: get(request, 'headers[x-real-ip]') || '',
+            connectedAccount: {
+              provider: 'wallet',
+              did: userDid,
+              pk: userPk,
+              lastLoginAt: currentTime,
+              firstLoginAt: currentTime,
+            },
+          }
+        ),
+      });
+
+      if (bindUser) {
+        // 更新 bind 用户记录的绑定信息
+        await node.updateUser({
           teamDid,
           user: {
-            ...profile,
-            source: USER_TYPE.WALLET,
+            did: bindUser.did,
+            pk: bindUser.pk,
             extraConfigs: {
-              derivedAccount: {
-                provider: oauthUser.extraConfigs?.sourceProvider,
-                did: oauthUser.did,
-                pk: oauthUser.pk,
-              },
-              connectedAccounts: [
-                {
-                  provider: oauthUser.extraConfigs?.sourceProvider,
-                  id: oauthUser.extraConfigs?.sourceId,
-                  lastLoginAt: oauthUser.lastLoginAt,
-                },
-              ],
+              ...(bindUser.extraConfigs || {}),
+              bindDid: userDid,
             },
-            avatar,
-            did: userDid,
-            pk: userPk,
-            approved: true,
-            locale,
-            passports: oauthUser.passports,
-            firstLoginAt: new Date().toISOString(),
-            lastLoginAt: new Date().toISOString(),
-            lastLoginIp: get(request, 'headers[x-real-ip]') || '',
           },
         });
-        bindUser = doc;
-        // TODO: @zhanghan 需要增加 auditLog
+      } else {
+        bindUser = {
+          ...oauthUser,
+          // 发送 passport 的对象要设置为 wallet-did
+          did: userDid,
+          pk: userPk,
+        };
       }
-      // 更新 oauth 用户记录的绑定信息
-      await node.updateUser({
-        teamDid,
-        user: {
-          did: oauthUser.did,
-          pk: oauthUser.pk,
-          extraConfigs: {
-            ...(oauthUser.extraConfigs || {}),
-            bindDid: userDid,
-          },
-        },
-      });
 
       await transferPassport(oauthUser, bindUser, { req: request, node, nodeInfo, teamDid });
 
-      // Generate new session token that client can save to localStorage
-      const sessionToken = await createSessionToken(userDid, { passport, role: passport.role });
-      logger.info('login.success', { userDid, role: passport.role });
+      const connectedAccounts = oauthUser?.extraConfigs?.connectedAccounts || [];
+      const sourceProvider = oauthUser?.extraConfigs?.sourceProvider;
+      const oauthAccount = connectedAccounts.find((item) => item.provider === sourceProvider);
+      const userWallet = fromAppDid(oauthAccount.id, blockletWallet.secretKey, types.RoleType.ROLE_ACCOUNT);
+      await migrateAccount({ wallet: userWallet, blocklet, user: bindUser });
+      // logger.info('bindWallet.success', { userDid, role: passport.role });
 
       return {
-        sessionToken,
         nextWorkflowData: {
           userDid,
         },