@abtnode/blocklet-services 1.16.3 → 1.16.4-beta-8682e092

package/api/routes/oauth.js

@@ -1,23 +1,24 @@
 const { handleInvitationReceive, getApplicationInfo } = require('@abtnode/auth/lib/auth');
 const { upsertToPassports, createPassportSvg } = require('@abtnode/auth/lib/passport');
-const { WELLKNOWN_SERVICE_PATH_PREFIX, NODE_SERVICES, USER_TYPE, PASSPORT_STATUS } = require('@abtnode/constant');
+const { WELLKNOWN_SERVICE_PATH_PREFIX, NODE_SERVICES, PASSPORT_STATUS } = require('@abtnode/constant');
 const { parseUserAvatar, extractUserAvatar } = require('@abtnode/util/lib/user-avatar');
 const { types } = require('@arcblock/did');
 const { fromAppDid } = require('@arcblock/did-ext');
 const { getBlockletAppIdList } = require('@blocklet/meta/lib/util');
-const { uniqBy, uniq } = require('lodash');
 const get = require('lodash/get');
+const uniq = require('lodash/uniq');
 const last = require('lodash/last');
 const pick = require('lodash/pick');
+const uniqBy = require('lodash/uniqBy');
 const sortBy = require('lodash/sortBy');
 const joinUrl = require('url-join');
 
 const { AuthenticationClient } = require('../libs/auth/adapters/auth0');
 const { getAvatarByEmail, transferPassport } = require('../libs/auth/utils');
-const { getUser } = require('../libs/jwt');
 const initJwt = require('../libs/jwt');
 const { sendToUser } = require('../libs/notification');
 const { generateTranslate } = require('../libs/translate');
+const { getRawUser, mergeUserData, declareAccount, migrateAccount, normalizeUser } = require('../services/oauth');
 const { isInvitedUserOnly } = require('../util');
 
 const PREFIX = WELLKNOWN_SERVICE_PATH_PREFIX;
@@ -34,123 +35,102 @@ const translations = {
 };
 const t = generateTranslate({ translations });
 
-async function getDerivedUser(derivedDid, { node, teamDid }) {
-  const { users } = await node.getUsers({
-    teamDid,
-    query: {
-      derivedDid,
-    },
-  });
-  let currentUser;
-  if (users.length > 0) {
-    [currentUser] = users;
+function getAuthClient(blocklet, provider) {
+  const oauthConfig = blocklet?.settings?.oauth || {};
+  const providerConfig = oauthConfig?.[provider];
+  if (!providerConfig) {
+    throw new Error(`Provider ${provider} is not valid`);
   }
-  return currentUser;
+  const authClient = new AuthenticationClient({
+    domain: providerConfig.domain,
+  });
+  return authClient;
 }
 
 async function login(req, node, options) {
-  const { token, locale = 'en', provider, componentId } = req.body;
   const blocklet = await req.getBlocklet();
   if (!blocklet.settings?.owner) {
     throw new Error('Cant login oauth account as owner');
   }
-  const oauthConfig = blocklet?.settings?.oauth || {};
-  const authClient = new AuthenticationClient({
-    domain: oauthConfig.auth0.domain,
-  });
+  const { token, locale = 'en', provider, componentId } = req.body;
+  const authClient = getAuthClient(blocklet, provider);
+
+  const currentTime = new Date().toISOString();
   const { did: teamDid, wallet: blockletWallet } = await req.getBlockletInfo();
   const config = await req.getServiceConfig(NODE_SERVICES.AUTH, { componentId });
   const nodeInfo = await req.getNodeInfo();
   const { dataDir } = await getApplicationInfo({ node, nodeInfo, teamDid });
   const [invitedUserOnly] = await isInvitedUserOnly(config, node, teamDid);
-  const userInfo = await authClient.getProfile(token);
-  const userWallet = fromAppDid(userInfo.sub, blockletWallet.secretKey, types.RoleType.ROLE_ACCOUNT);
+  const oauthInfo = await authClient.getProfile(token);
+  const userWallet = fromAppDid(oauthInfo.sub, blockletWallet.secretKey, types.RoleType.ROLE_ACCOUNT);
   const userDid = userWallet.address;
+  const userPk = userWallet.publicKey;
+  const lastLoginIp = get(req, 'headers[x-real-ip]') || '';
   let passport = { name: 'Guest', role: 'guest' };
-  let currentUser = await getDerivedUser(userDid, { node, teamDid });
-  // 当前 oauth 账户已经绑定了 wallet 账户
+  let currentUser = await getRawUser(teamDid, userDid, { getUser: node.getUser, getUsers: node.getUsers });
+  currentUser = await normalizeUser(teamDid, currentUser, {
+    updateUser: node.updateUser,
+    getBlockletInfo: req.getBlockletInfo,
+  });
+  // 当前账户已存在，更新账户信息
   if (currentUser) {
-    const validPassports = currentUser.passports.filter((item) => item.status === 'valid');
+    const allPassports = currentUser.passports || [];
+    const validPassports = allPassports.filter((item) => item.status === PASSPORT_STATUS.VALID);
     const lastUsedPassport = last(sortBy(validPassports, 'lastLoginAt'));
     if (lastUsedPassport) {
       passport = pick(lastUsedPassport, ['id', 'name', 'role']);
     }
     await node.updateUser({
       teamDid,
-      user: {
-        did: currentUser.did,
-        pk: currentUser.pk,
+      user: mergeUserData(currentUser, {
         locale,
-        passports: upsertToPassports(
-          currentUser.passports || [],
-          lastUsedPassport && {
-            ...lastUsedPassport,
-            lastLoginAt: new Date().toISOString(),
-          }
-        ),
-        lastLoginAt: new Date().toISOString(),
-        lastLoginIp: get(req, 'headers[x-real-ip]') || '',
-      },
+        lastLoginIp,
+        lastUsedPassport,
+        connectedAccount: { provider },
+      }),
     });
   } else {
     currentUser = {
       did: userWallet.address,
+      pk: userWallet.publicKey,
     };
-    let avatar = await getAvatarByEmail(userInfo.email);
+    let avatar = await getAvatarByEmail(oauthInfo.email);
     avatar = await extractUserAvatar(avatar, { dataDir });
-    const currentUserInfo = await getUser(node, teamDid, userDid);
     // 当前 oauth 账户不存在，自动添加一个新用户
-    if (!currentUserInfo) {
-      if (invitedUserOnly) {
-        throw new Error(t('needInviteToLogin', locale));
-      }
-      await node.addUser({
-        teamDid,
-        user: {
-          source: USER_TYPE.DERIVED,
-          extraConfigs: {
-            sourceId: userInfo.sub,
-            sourceProvider: provider,
-          },
-          did: userDid,
-          pk: userWallet.publicKey,
-          fullName: userInfo.nickname,
-          email: userInfo.email,
-          avatar,
-          locale,
-          type: 'profile',
-          approved: true,
-          passports: [],
-          firstLoginAt: new Date().toISOString(),
-          lastLoginAt: new Date().toISOString(),
-          lastLoginIp: get(req, 'headers[x-real-ip]') || '',
-        },
-      });
-    } else {
-      const validPassports = currentUserInfo.passports.filter((item) => item.status === 'valid');
-      const lastUsedPassport = last(sortBy(validPassports, 'lastLoginAt'));
-      if (lastUsedPassport) {
-        passport = pick(lastUsedPassport, ['id', 'name', 'role']);
-      }
-      // 当前用户已存在，更新用户信息
-      await node.updateUser({
-        teamDid,
-        user: {
-          did: userDid,
-          pk: userWallet.publicKey,
-          locale,
-          passports: upsertToPassports(
-            currentUser.passports || [],
-            lastUsedPassport && {
-              ...lastUsedPassport,
-              lastLoginAt: new Date().toISOString(),
-            }
-          ),
-          lastLoginAt: new Date().toISOString(),
-          lastLoginIp: get(req, 'headers[x-real-ip]') || '',
-        },
-      });
+    if (invitedUserOnly) {
+      throw new Error(t('needInviteToLogin', locale));
     }
+    await node.addUser({
+      teamDid,
+      user: {
+        extraConfigs: {
+          sourceProvider: provider,
+          connectedAccounts: [
+            {
+              provider,
+              id: oauthInfo.sub,
+              did: userDid,
+              pk: userPk,
+              lastLoginAt: currentTime,
+              firstLoginAt: currentTime,
+            },
+          ],
+        },
+        did: userDid,
+        pk: userPk,
+        fullName: oauthInfo.nickname,
+        email: oauthInfo.email,
+        avatar,
+        locale,
+        type: 'profile',
+        approved: true,
+        passports: [],
+        firstLoginAt: currentTime,
+        lastLoginAt: currentTime,
+        lastLoginIp,
+      },
+    });
+    await declareAccount({ wallet: userWallet, moniker: oauthInfo.nickname });
   }
 
   const { createSessionToken } = initJwt(node, options);
@@ -163,37 +143,38 @@ async function login(req, node, options) {
 }
 
 async function invite(req, node, options) {
-  const { locale, inviteId, token, baseUrl } = req.body;
-  const { did: teamDid, wallet: blockletWallet } = await req.getBlockletInfo();
+  const { locale, inviteId, token, baseUrl, provider = 'auth0' } = req.body;
+  const blocklet = await req.getBlocklet();
+  const authClient = getAuthClient(blocklet, provider);
 
+  const { did: teamDid, wallet: blockletWallet } = await req.getBlockletInfo();
   const nodeInfo = await req.getNodeInfo();
-  const blocklet = await req.getBlocklet();
-  const oauthConfig = blocklet?.settings?.oauth || {};
-  const authClient = new AuthenticationClient({
-    domain: oauthConfig.auth0.domain,
-  });
-  const userInfo = await authClient.getProfile(token);
-  const userWallet = fromAppDid(userInfo.sub, blockletWallet.secretKey, types.RoleType.ROLE_ACCOUNT);
+  const oauthInfo = await authClient.getProfile(token);
+  const userWallet = fromAppDid(oauthInfo.sub, blockletWallet.secretKey, types.RoleType.ROLE_ACCOUNT);
   let userDid = userWallet.address;
   let userPk = userWallet.publicKey;
 
   let profile;
-  let userSource = USER_TYPE.DERIVED;
-  // 如果当前 oauth 账户绑定了 wallet 账户，则需要以 wallet 为目标账户来颁发通行证
-  const bindUser = await getDerivedUser(userDid, { node, teamDid });
+  let currentUser = await getRawUser(teamDid, userDid, {
+    getUser: node.getUser,
+    getUsers: node.getUsers,
+  });
+  currentUser = await normalizeUser(teamDid, currentUser, {
+    updateUser: node.updateUser,
+    getBlockletInfo: req.getBlockletInfo,
+  });
   const { dataDir, name: applicationName } = await getApplicationInfo({ node, nodeInfo, teamDid });
-  if (bindUser) {
-    const avatar = await parseUserAvatar(bindUser.avatar, { did: teamDid, dataDir });
+  if (currentUser) {
+    const avatar = await parseUserAvatar(currentUser.avatar, { did: teamDid, dataDir });
     profile = {
-      email: bindUser.email,
-      fullName: bindUser.fullName,
+      email: currentUser.email,
+      fullName: currentUser.fullName,
       avatar,
     };
-    userDid = bindUser.did;
-    userPk = bindUser.pk;
-    userSource = USER_TYPE.WALLET;
+    userDid = currentUser.did;
+    userPk = currentUser.pk;
   } else {
-    const { email, nickname: fullName } = userInfo;
+    const { email, nickname: fullName } = oauthInfo;
     let avatar = await getAvatarByEmail(email);
     avatar = await extractUserAvatar(avatar, { dataDir });
     profile = {
@@ -217,60 +198,59 @@ async function invite(req, node, options) {
     teamDid,
     userDid,
     userPk,
-    userSource,
     locale,
   });
-  if (bindUser) {
-    // 如果已经绑定了 wallet 账户，则将 passport 发送给 wallet 账户
-    await sendToUser(
-      bindUser.did,
-      {
-        title: 'Invitation accepted',
-        body: `You accept an invitation to be a ${role} of ${applicationName}`,
-        attachments: [
-          {
-            type: 'vc',
-            data: {
-              credential: response.data,
-              tag: role,
-            },
-          },
-        ],
-      },
-      { req }
-    );
-    await node.updateUser({
-      teamDid,
-      user: {
-        did: bindUser.did,
-        pk: bindUser.pk,
-        extraConfigs: {
-          ...(bindUser.extraConfigs || {}),
-          connectedAccounts: [
+
+  if (currentUser) {
+    const { connectedAccounts = [] } = currentUser.extraConfigs || {};
+    const walletAccount = connectedAccounts.find((item) => item.provider === 'wallet');
+    if (walletAccount) {
+      // 如果已经绑定了 wallet 账户，则将 passport 发送给 wallet 账户
+      await sendToUser(
+        walletAccount.did,
+        {
+          title: 'Invitation accepted',
+          body: `You accept an invitation to be a ${role} of ${applicationName}`,
+          attachments: [
             {
-              provider: 'auth0',
-              id: userInfo.sub,
-              lastLoginAt: new Date().toISOString(),
+              type: 'vc',
+              data: {
+                credential: response.data,
+                tag: role,
+              },
             },
           ],
         },
-      },
-    });
+        { req }
+      );
+    }
   } else {
-    const currentUserInfo = await node.getUser({ teamDid, user: { did: userDid } });
     await node.updateUser({
       teamDid,
-      user: {
-        did: userDid,
-        pk: userPk,
-        extraConfigs: {
-          ...(currentUserInfo.extraConfigs || {}),
-          sourceId: userInfo.sub,
-          sourceProvider: 'auth0',
+      user: mergeUserData(
+        {
+          did: userDid,
+          pk: userPk,
+          extraConfigs: {
+            sourceProvider: provider,
+          },
         },
-      },
+        {
+          provider,
+          connectedAccount: {
+            provider,
+            id: oauthInfo.sub,
+            did: userWallet.address,
+            pk: userWallet.publicKey,
+            firstLoginAt: new Date().toISOString(),
+            lastLoginAt: new Date().toISOString(),
+          },
+        }
+      ),
     });
+    await declareAccount({ wallet: userWallet, moniker: oauthInfo.nickname });
   }
+
   const { createSessionToken } = initJwt(node, options);
 
   const sessionToken = await createSessionToken(userDid, { passport, role });
@@ -279,20 +259,29 @@ async function invite(req, node, options) {
 
 // eslint-disable-next-line no-unused-vars
 async function bind(req, node, options) {
-  const userDid = req.user.did;
   const { token, locale = 'en', provider } = req.body;
   const blocklet = await req.getBlocklet();
-  const oauthConfig = blocklet?.settings?.oauth || {};
-  const authClient = new AuthenticationClient({
-    domain: oauthConfig.auth0.domain,
-  });
+  const authClient = getAuthClient(blocklet, provider);
+
+  const userDid = req.user.did;
   const userInfo = await authClient.getProfile(token);
   const { did: teamDid, wallet: blockletWallet } = await req.getBlockletInfo();
   const userWallet = fromAppDid(userInfo.sub, blockletWallet.secretKey, types.RoleType.ROLE_ACCOUNT);
   let oauthUser = await node.getUser({ teamDid, user: { did: userWallet.address } });
+  if (oauthUser) {
+    if (oauthUser.extraConfigs?.bindDid) {
+      throw new Error('OAuth account is already bind to another wallet account');
+    }
+    throw new Error('OAuth account is already a main account');
+  }
 
+  // NOTICE: 这里获得的 userDid 已经是登录返回的 rawUserDid 了，无需再 getRawUser
   const bindUser = await node.getUser({ teamDid, user: { did: userDid } });
 
+  if (bindUser.extraConfigs?.sourceProvider !== 'wallet') {
+    throw new Error("OAuth account can't bind to a oauth account");
+  }
+
   const mergePassport = (oauthUser?.passports || []).reduce((sum, cur) => {
     return upsertToPassports(sum, cur);
   }, bindUser.passports || []);
@@ -311,30 +300,31 @@ async function bind(req, node, options) {
     avatar,
   };
 
+  const currentTime = new Date().toISOString();
+
   await node.updateUser({
     teamDid,
     user: {
       ...mergeProfile,
-      did: userDid,
-      pk: bindUser.pk,
-      locale,
-      source: USER_TYPE.WALLET,
-      extraConfigs: {
-        ...(bindUser.extraConfigs || {}),
-        derivedAccount: {
-          provider,
-          did: userWallet.address,
-          pk: userWallet.publicKey,
+      ...mergeUserData(
+        {
+          did: bindUser.did,
+          pk: bindUser.pk,
+          passports: mergePassport,
+          extraConfigs: bindUser.extraConfigs,
         },
-        connectedAccounts: [
-          {
+        {
+          locale,
+          connectedAccount: {
             provider,
             id: userInfo.sub,
-            lastLoginAt: new Date().toISOString(),
+            did: userWallet.address,
+            pk: userWallet.publicKey,
+            firstLoginAt: currentTime,
+            lastLoginAt: currentTime,
           },
-        ],
-      },
-      passports: mergePassport,
+        }
+      ),
     },
   });
   if (oauthUser) {
@@ -350,9 +340,11 @@ async function bind(req, node, options) {
         },
       },
     });
+    await migrateAccount({ wallet: userWallet, blocklet, user: bindUser });
   } else {
     oauthUser = {
       did: userWallet.address,
+      pk: userWallet.publicKey,
     };
   }
   const nodeInfo = await req.getNodeInfo();

package/api/services/auth/connect/bind-wallet.js

@@ -7,7 +7,7 @@ const { onConnect, onApprove } = bindWallet;
 module.exports = function createRoutes(node, authenticator, createSessionToken) {
   return {
     action: 'bind-wallet',
-    onConnect: async ({ req, userDid, extraParams: { locale, passportId = '', componentId, previousUserDid } }) => {
+    onConnect: async ({ req, userDid, extraParams: { locale, passportId = '', componentId } }) => {
       return onConnect({
         node,
         request: req,
@@ -15,20 +15,10 @@ module.exports = function createRoutes(node, authenticator, createSessionToken)
         locale,
         passportId,
         componentId,
-        previousUserDid,
       });
     },
 
-    onAuth: async ({
-      claims,
-      challenge,
-      userDid,
-      userPk,
-      updateSession,
-      extraParams: { locale, componentId, previousUserDid },
-      req,
-      baseUrl,
-    }) => {
+    onAuth: async ({ claims, challenge, userDid, userPk, extraParams: { locale, componentId }, req, baseUrl }) => {
       try {
         const result = await onApprove({
           node,
@@ -41,11 +31,8 @@ module.exports = function createRoutes(node, authenticator, createSessionToken)
           claims,
           createSessionToken,
           componentId,
-          previousUserDid,
         });
 
-        await updateSession({ sessionToken: result.sessionToken }, true);
-
         return result;
       } catch (err) {
         logger.error('login.error', { error: err, userDid });