@abtnode/blocklet-services 1.16.32-beta-4d47ae7f → 1.16.32-beta-0593a408

package/api/libs/kyc.js

@@ -0,0 +1,213 @@
+const get = require('lodash/get');
+const uniq = require('lodash/uniq');
+const pick = require('lodash/pick');
+const semver = require('semver');
+const { messages, getVCFromClaims } = require('@abtnode/auth/lib/auth');
+const { getPassportClaimUrl, getKycAcquireUrl } = require('@abtnode/auth/lib/passport');
+
+const { getTrustedIssuers } = require('../util/blocklet-utils');
+const { PASSPORT_VC_TYPES } = require('./auth/utils');
+
+const getPassportVc = async ({ blocklet, claims, challenge, locale, sourceAppPid, types = PASSPORT_VC_TYPES }) => {
+  const trustedIssuers = await getTrustedIssuers(blocklet, { sourceAppPid });
+  const { vc } = await getVCFromClaims({
+    claims,
+    challenge,
+    trustedIssuers,
+    types,
+    locale,
+  });
+
+  return vc;
+};
+
+/**
+ * @description 兼容老的 DID Wallet 版本，不是所有的 DID Wallet 都可以出示 profile url
+ * @param {import('../../types').DidWallet} didWallet
+ * @return {boolean}
+ */
+function isProfileUrlSupported(didWallet) {
+  if (!didWallet) {
+    return false;
+  }
+
+  const { os, version } = didWallet;
+  const webCanUse = os === 'web' && semver.satisfies(version, '>= 4.13.0');
+  const iosCanUse = os === 'ios' && semver.satisfies(version, '>= 5.6.0');
+  const androidCanUse = os === 'android' && semver.satisfies(version, '>= 5.6.0');
+
+  return webCanUse || iosCanUse || androidCanUse;
+}
+
+/**
+ * @description
+ * @param {object} settings
+ * @param {import('../../types').DidWallet} didWallet
+ * @return {string[]}
+ */
+function getProfileItems(settings, didWallet) {
+  const profileItems = ['fullName', 'avatar'];
+  if (settings?.email?.enabled) {
+    profileItems.push('email');
+  }
+  if (settings?.phone?.enabled) {
+    profileItems.push('phone');
+  }
+
+  if (isProfileUrlSupported(didWallet)) {
+    profileItems.push('url');
+  }
+
+  return uniq(profileItems);
+}
+
+const isEmailKycRequired = (blocklet) => {
+  return blocklet.settings.session?.email?.enabled && blocklet.settings.session?.email?.requireVerified;
+};
+
+const isEmailUniqueRequired = (blocklet) => {
+  return blocklet.settings.session?.email?.enabled && blocklet.settings.session?.email?.requireUnique;
+};
+
+const isOAuthKycTrusted = (blocklet) => {
+  return blocklet.settings.session?.email?.enabled && blocklet.settings.session?.email?.trustOauthProviders;
+};
+
+const isPhoneKycRequired = (blocklet) => {
+  return blocklet.settings.session?.phone?.enabled && blocklet.settings.session?.phone?.requireVerified;
+};
+
+const isPhoneUniqueRequired = (blocklet) => {
+  return blocklet.settings.session?.phone?.enabled && blocklet.settings.session?.phone?.requireUnique;
+};
+
+// github 的 email 是 verified, 其他 oauth 的 email 通过 email_verified 判断
+const isOAuthEmailVerified = (blocklet, info) => {
+  return isOAuthKycTrusted(blocklet) && (!!info?.email_verified || info?.provider === 'github');
+};
+
+const isProfileClaimRequired = (blocklet, user) => {
+  if (isEmailKycRequired(blocklet) && !user.email) {
+    return true;
+  }
+  if (isPhoneKycRequired(blocklet) && !user.phone) {
+    return true;
+  }
+  return false;
+};
+
+function getKycClaims(blocklet, user, locale, baseUrl, trustedIssuers) {
+  const claims = {};
+  if (isEmailKycRequired(blocklet) && !user?.emailVerified) {
+    const emailKycClaim = {
+      type: 'verifiableCredential',
+      description: messages.requestEmailKyc[locale],
+      item: ['VerifiedEmailCredential'],
+      trustedIssuers,
+      optional: false,
+      acquireUrl: getKycAcquireUrl(baseUrl, '', 'email'),
+      claimUrl: getPassportClaimUrl(baseUrl, '', 'email'),
+    };
+    claims.emailKyc = ['verifiableCredential', emailKycClaim];
+  }
+
+  if (isPhoneKycRequired(blocklet) && !user?.phoneVerified) {
+    const phoneKycClaim = {
+      type: 'verifiableCredential',
+      description: messages.requestPhoneKyc[locale],
+      item: ['VerifiedPhoneCredential'],
+      trustedIssuers,
+      optional: false,
+      acquireUrl: getKycAcquireUrl(baseUrl, '', 'phone'),
+      claimUrl: getPassportClaimUrl(baseUrl, '', 'phone'),
+    };
+    claims.phoneKyc = ['verifiableCredential', phoneKycClaim];
+  }
+
+  return claims;
+}
+
+async function verifyKycClaims({ node, blocklet, teamDid, claims, challenge, locale, sourceAppPid, user }) {
+  const profile = claims.find((claim) => claim.type === 'profile');
+  const kycUpdates = pick(user || {}, ['emailVerified', 'phoneVerified']);
+
+  // verify email kyc
+  if (isEmailKycRequired(blocklet) && !user?.emailVerified) {
+    const emailKyc = await getPassportVc({
+      blocklet,
+      claims,
+      challenge,
+      locale,
+      sourceAppPid,
+      types: ['VerifiedEmailCredential'],
+    });
+    if (!emailKyc) {
+      throw new Error(messages.missingEmailKyc[locale]);
+    }
+    const email = get(emailKyc, 'credentialSubject.kyc.subject');
+    if (user && user.email && user.email !== email) {
+      throw new Error(messages.emailMismatch[locale]);
+    }
+    if (!user && isEmailUniqueRequired(blocklet)) {
+      const isEmailUsed = await node.isEmailUsed({ teamDid, email, verified: true });
+      if (isEmailUsed) {
+        throw new Error(messages.emailAlreadyUsed[locale]);
+      }
+    }
+
+    kycUpdates.emailVerified = true;
+  } else if (!user && profile?.email && isEmailUniqueRequired(blocklet)) {
+    const isEmailUsed = await node.isEmailUsed({ teamDid, email: profile.email, verified: false });
+    if (isEmailUsed) {
+      throw new Error(messages.emailAlreadyUsed[locale]);
+    }
+  }
+
+  // verify phone kyc
+  if (isPhoneKycRequired(blocklet) && !user?.phoneVerified) {
+    const phoneKyc = await getPassportVc({
+      blocklet,
+      claims,
+      challenge,
+      locale,
+      sourceAppPid,
+      types: ['VerifiedPhoneCredential'],
+    });
+    if (!phoneKyc) {
+      throw new Error(messages.missingPhoneKyc[locale]);
+    }
+    const phone = get(phoneKyc, 'credentialSubject.kyc.subject');
+    if (user && user.phone && user.phone !== phone) {
+      throw new Error(messages.phoneMismatch[locale]);
+    }
+    if (!user && isPhoneUniqueRequired(blocklet)) {
+      const isPhoneUsed = await node.isPhoneUsed({ teamDid, phone, verified: true });
+      if (isPhoneUsed) {
+        throw new Error(messages.phoneAlreadyUsed[locale]);
+      }
+    }
+    kycUpdates.phoneVerified = true;
+  } else if (!user && profile?.phone && isPhoneUniqueRequired(blocklet)) {
+    const isPhoneUsed = await node.isPhoneUsed({ teamDid, phone: profile.phone, verified: false });
+    if (isPhoneUsed) {
+      throw new Error(messages.phoneAlreadyUsed[locale]);
+    }
+  }
+
+  return kycUpdates;
+}
+
+module.exports = {
+  isEmailKycRequired,
+  isOAuthKycTrusted,
+  isPhoneKycRequired,
+  isEmailUniqueRequired,
+  isPhoneUniqueRequired,
+  isProfileUrlSupported,
+  isProfileClaimRequired,
+  isOAuthEmailVerified,
+  getProfileItems,
+  getKycClaims,
+  verifyKycClaims,
+  getPassportVc,
+};

package/api/routes/federated.js

@@ -37,7 +37,18 @@ function getAuditLogActorByFederatedSite(blocklet) {
 }
 
 async function syncSwitchProfile(user, { node, teamDid, dataDir }) {
-  const tempUser = pick(user, ['did', 'pk', 'avatar', 'fullName', 'email', 'phone', 'url']);
+  const tempUser = pick(user, [
+    'did',
+    'pk',
+    'avatar',
+    'fullName',
+    'email',
+    'phone',
+    'url',
+    'inviter',
+    'emailVerified',
+    'phoneVerified',
+  ]);
 
   // 处理 avatar
   if (tempUser.avatar) {
@@ -58,7 +69,6 @@ async function syncSwitchProfile(user, { node, teamDid, dataDir }) {
 /**
  * 处理站点群中某一站点推送的同步 connectAccount 的请求
  */
-
 async function syncConnectAccount(user, { node, teamDid, dataDir, blocklet }) {
   const tempUser = pick(user, [
     'did',
@@ -71,7 +81,8 @@ async function syncConnectAccount(user, { node, teamDid, dataDir, blocklet }) {
     'connectedAccount',
     'sourceAppPid',
     'inviter',
-    'generation',
+    'emailVerified',
+    'phoneVerified',
   ]);
   const masterSite = getFederatedMaster(blocklet);
 
@@ -142,7 +153,23 @@ async function pullUserAccount(user, { node, teamDid, blocklet }) {
 
   if (!currentUser) return null;
 
-  const syncUser = pick(currentUser, ['did', 'pk', 'fullName', 'email', 'phone', 'url', 'remark', 'sourceProvider', 'locale', 'approved', 'extra', 'sourceAppPid']); // prettier-ignore
+  const syncUser = pick(currentUser, [
+    'did',
+    'pk',
+    'fullName',
+    'email',
+    'phone',
+    'url',
+    'remark',
+    'sourceProvider',
+    'locale',
+    'approved',
+    'extra',
+    'sourceAppPid',
+    'inviter',
+    'emailVerified',
+    'phoneVerified',
+  ]);
   syncUser.avatar = getUserAvatarUrl(currentUser.avatar, blocklet);
   syncUser.email = syncUser.email || '';
   syncUser.connectedAccounts = currentUser.connectedAccounts.map((x) => {
@@ -532,6 +559,8 @@ module.exports = {
           fullName: doc.fullName,
           provider: provider || LOGIN_PROVIDER.WALLET,
           walletOS,
+          emailVerified: doc.emailVerified,
+          phoneVerified: doc.phoneVerified,
         },
         {
           ...sessionConfig,
@@ -611,6 +640,8 @@ module.exports = {
           // 这里是 member 登录了 master 的账号，对于 master 来说，其实还是使用 wallet 来登录的
           provider: LOGIN_PROVIDER.WALLET,
           walletOS,
+          emailVerified: newUser.emailVerified,
+          phoneVerified: newUser.phoneVerified,
         },
         {
           ...sessionConfig,
@@ -701,6 +732,8 @@ module.exports = {
           provider: provider || LOGIN_PROVIDER.WALLET,
           walletOS,
           sourceAppPid: verifySite.appPid,
+          emailVerified: newUser.emailVerified,
+          phoneVerified: newUser.phoneVerified,
         },
         {
           ...sessionConfig,

package/api/routes/oauth.js

@@ -31,6 +31,7 @@ const { sendToUser } = require('../libs/notification');
 const { isInvitedUserOnly, createTokenFn, getDidConnectVersion } = require('../util');
 const { ApiError } = require('../util/error');
 const federatedUtil = require('../util/federated');
+const { isOAuthEmailVerified, isEmailUniqueRequired, isEmailKycRequired } = require('../libs/kyc');
 
 const PREFIX = WELLKNOWN_SERVICE_PATH_PREFIX;
 
@@ -49,6 +50,7 @@ const translations = {
     cantUnbindWalletAccount: '不能解绑钱包账户',
     cantUnbindSourceProvider: '不能解绑源账户',
     accountNotExist: '第三方登录的账户不存在，无法完成解绑操作',
+    emailUniqueRequired: '当前邮箱已经绑定过另一个账户，请更换邮箱',
   },
   en: {
     needInviteToLogin: 'You need to be invited to login in to this app',
@@ -62,6 +64,7 @@ const translations = {
     cantUnbindWalletAccount: 'Cannot unbind wallet provider',
     cantUnbindSourceProvider: 'Cannot unbind source provider',
     accountNotExist: "Connected account is not exist, can't finish disconnect",
+    emailUniqueRequired: 'Current email is already bind to another account, please change email',
   },
 };
 
@@ -83,6 +86,11 @@ async function getOAuthUserInfo({ blocklet, provider, token, idToken, code, appP
     const oauthToken = await authClient.getToken({ code });
     oauthInfo = await authClient.getProfile(oauthToken);
   }
+
+  if (oauthInfo) {
+    oauthInfo.provider = provider;
+  }
+
   return oauthInfo;
 }
 
@@ -244,11 +252,23 @@ async function login(req, node, options) {
       throw new ApiError(403, t('needInviteToLogin', locale));
     }
 
+    if (isEmailUniqueRequired(blocklet)) {
+      const used = await node.isEmailUsed({
+        teamDid,
+        email: oauthInfo.email,
+        verified: isEmailKycRequired(blocklet),
+      });
+      if (used) {
+        throw new ApiError(400, t('emailUniqueRequired', locale));
+      }
+    }
+
     passportForLog = { name: 'Guest', role: 'guest' };
     profile = {
       fullName: oauthInfo.name,
       email: oauthInfo.email,
       avatar,
+      emailVerified: isOAuthEmailVerified(blocklet, oauthInfo),
     };
     doc = await node.loginUser({
       teamDid,
@@ -336,7 +356,6 @@ async function login(req, node, options) {
   }
 
   const { createSessionToken } = initJwt(node, options);
-
   const createToken = createTokenFn(createSessionToken);
   const sessionConfig = blocklet.settings?.session || {};
   const { sessionToken, refreshToken } = createToken(
@@ -348,6 +367,8 @@ async function login(req, node, options) {
       fullName,
       provider,
       walletOS: 'web',
+      emailVerified: !!doc?.emailVerified,
+      phoneVerified: !!doc?.phoneVerified,
     },
     { ...sessionConfig, didConnectVersion: getDidConnectVersion(req) }
   );
@@ -399,6 +420,17 @@ async function invite(req, node, options) {
     userDid = currentUser.did;
     userPk = currentUser.pk;
   } else {
+    if (isEmailUniqueRequired(blocklet)) {
+      const used = await node.isEmailUsed({
+        teamDid,
+        email: oauthInfo.email,
+        verified: isEmailKycRequired(blocklet),
+      });
+      if (used) {
+        throw new ApiError(400, t('emailUniqueRequired', locale));
+      }
+    }
+
     let avatar = oauthInfo.picture ? await getAvatarByUrl(oauthInfo.picture) : await getAvatarByEmail(oauthInfo.email);
     avatar = await extractUserAvatar(avatar, { dataDir });
     profile = {
@@ -406,12 +438,15 @@ async function invite(req, node, options) {
       fullName: oauthInfo.name,
       avatar: getUserAvatarUrl(baseUrl, avatar),
     };
+    if (profile.email === oauthInfo.email && isOAuthEmailVerified(blocklet, oauthInfo)) {
+      profile.emailVerified = true;
+    }
   }
 
   const statusEndpointBaseUrl = joinURL(baseUrl, WELLKNOWN_SERVICE_PATH_PREFIX);
   const endpoint = baseUrl;
 
-  const { passport, response, role, inviteInfo } = await handleInvitationReceive({
+  const { passport, response, role, inviteInfo, user } = await handleInvitationReceive({
     node,
     req,
     endpoint,
@@ -532,13 +567,21 @@ async function invite(req, node, options) {
   }
 
   const { createSessionToken } = initJwt(node, options);
-
   const createToken = createTokenFn(createSessionToken);
   const sessionConfig = blocklet.settings?.session || {};
 
   const { sessionToken, refreshToken } = createToken(
     userDid,
-    { secret, passport, role, fullName: profile.fullName, provider, walletOS: 'web' },
+    {
+      secret,
+      passport,
+      role,
+      fullName: profile.fullName,
+      provider,
+      walletOS: 'web',
+      emailVerified: !!user?.emailVerified,
+      phoneVerified: !!user?.phoneVerified,
+    },
     { ...sessionConfig, didConnectVersion: getDidConnectVersion(req) }
   );
 
@@ -601,6 +644,10 @@ async function bind(req, node, options) {
     avatar,
   };
 
+  if (mergeProfile.email === oauthInfo.email && isOAuthEmailVerified(blocklet, oauthInfo)) {
+    mergeProfile.emailVerified = true;
+  }
+
   const currentTime = new Date().toISOString();
 
   const connectedAccount = {
@@ -775,9 +822,11 @@ module.exports = {
         'name'
       ).map((x) => {
         return {
-          ...pick(x, ['id', 'name', 'title', 'role']),
+          ...pick(x, ['id', 'name', 'title', 'role', 'scope', 'role']),
           display: createPassportSvg({
-            title: x.title,
+            scope: x.scope,
+            role: x.role,
+            title: x.scope === 'passport' ? x.title : x.name,
             issuer: x.issuer.name,
             issuerDid: x.issuer.id,
             issuerAvatarUrl,
@@ -850,7 +899,16 @@ module.exports = {
       const sessionConfig = blocklet.settings?.session || {};
       const { sessionToken, refreshToken } = createToken(
         userDid,
-        { secret, passport, role: passport.role, fullName: user?.fullName, provider, walletOS: 'web' },
+        {
+          secret,
+          passport,
+          role: passport.role,
+          fullName: user?.fullName,
+          provider,
+          walletOS: 'web',
+          emailVerified: !!user?.emailVerified,
+          phoneVerified: !!user?.phoneVerified,
+        },
         { ...sessionConfig, didConnectVersion: getDidConnectVersion(req) }
       );
 

package/api/routes/openapi.js

@@ -4,8 +4,8 @@ const { BLOCKLET_OPEN_API_FILE, BLOCKLET_OPEN_API_FILE_JSON } = require('@blockl
 const pMap = require('p-map');
 const YAML = require('yaml');
 const { joinURL } = require('ufo');
-const { fromAppDid } = require('@arcblock/did-ext');
-const { types } = require('@ocap/mcrypto');
+const { fromPublicKey } = require('@ocap/wallet');
+const { types, Hasher } = require('@ocap/mcrypto');
 
 const { api } = require('../libs/api');
 
@@ -25,7 +25,7 @@ async function getOpenAPIJSON(appDir) {
   return null;
 }
 
-async function getComponentOpenAPIData(component, { generateDid }) {
+async function getComponentOpenAPIData(component) {
   const { mountPoint } = component;
   const appDir = component?.env?.appDir;
   const { title, description, did } = component?.meta || {};
@@ -45,7 +45,10 @@ async function getComponentOpenAPIData(component, { generateDid }) {
     Object.keys(pathItem).forEach((method) => {
       const operation = pathItem[method];
       operation.tags = [title];
-      const operationWallet = generateDid(JSON.stringify(['openapi', did, pathname, method]));
+      const walletPk = Hasher.SHA3.hash256(JSON.stringify(['openapi', did, pathname, method]));
+      const operationWallet = fromPublicKey(walletPk, {
+        role: types.RoleType.ROLE_ANY,
+      });
       operation['x-id'] = operationWallet.address;
       operation['x-did'] = did;
       operation['x-path'] = pathname;
@@ -87,7 +90,7 @@ function mergeOpenAPI(dataList, { blocklet }) {
   };
 }
 
-async function generateOpenAPIData({ blocklet, did, generateDid }) {
+async function generateOpenAPIData({ blocklet, did }) {
   const blockletCompontList = blocklet?.children || [];
   const appUrl = blocklet?.environmentObj?.BLOCKLET_APP_URL;
   const healthCheckUrl = joinURL(appUrl, '.well-known/service/health');
@@ -100,15 +103,13 @@ async function generateOpenAPIData({ blocklet, did, generateDid }) {
   if (did) {
     const findComponent = runningCompontList.find((component) => component?.meta?.did === did);
     if (findComponent) {
-      const result = getComponentOpenAPIData(findComponent, { baseUrl: appUrl, generateDid });
+      const result = getComponentOpenAPIData(findComponent, { baseUrl: appUrl });
       return result;
     }
     return null;
   }
   // 多个 component 组合
-  const componentListData = await pMap(runningCompontList, (x) =>
-    getComponentOpenAPIData(x, { baseUrl: appUrl, generateDid })
-  );
+  const componentListData = await pMap(runningCompontList, (x) => getComponentOpenAPIData(x, { baseUrl: appUrl }));
   const result = mergeOpenAPI(componentListData, { blocklet });
   return result;
 }
@@ -119,12 +120,7 @@ module.exports = {
     app.get(`${WELLKNOWN_SERVICE_PATH_PREFIX}/openapi.yml`, async (req, res) => {
       const { did } = req.query;
       const blocklet = await req.getBlocklet({ useCache: false });
-      const { permanentWallet } = await req.getBlockletInfo();
-      const rootSk = permanentWallet.secretKey;
-      function generateDid(didPath) {
-        return fromAppDid(didPath, rootSk, types.RoleType.ROLE_ASSET);
-      }
-      const data = await generateOpenAPIData({ blocklet, did, generateDid });
+      const data = await generateOpenAPIData({ blocklet, did });
       const ymlData = YAML.stringify(data);
       res.setHeader('Content-Disposition', 'attachment; filename="openapi.yml"');
       res.status(200).send(ymlData);
@@ -133,12 +129,7 @@ module.exports = {
     app.get(`${WELLKNOWN_SERVICE_PATH_PREFIX}/openapi.json`, async (req, res) => {
       const { did } = req.query;
       const blocklet = await req.getBlocklet({ useCache: false });
-      const { permanentWallet } = await req.getBlockletInfo();
-      const rootSk = permanentWallet.secretKey;
-      function generateDid(didPath) {
-        return fromAppDid(didPath, rootSk, types.RoleType.ROLE_ASSET);
-      }
-      const data = await generateOpenAPIData({ blocklet, did, generateDid });
+      const data = await generateOpenAPIData({ blocklet, did });
       res.status(200).json(data);
     });
   },

package/api/routes/opencomponent.js

@@ -4,8 +4,8 @@ const { BLOCKLET_OPEN_COMPONENT_FILE, BLOCKLET_OPEN_COMPONENT_FILE_JSON } = requ
 const pMap = require('p-map');
 const YAML = require('yaml');
 const { joinURL } = require('ufo');
-const { fromAppDid } = require('@arcblock/did-ext');
-const { types } = require('@ocap/mcrypto');
+const { types, Hasher } = require('@ocap/mcrypto');
+const { fromPublicKey } = require('@ocap/wallet');
 
 const { api } = require('../libs/api');
 
@@ -25,7 +25,7 @@ async function getOpenComponentJSON(appDir) {
   return null;
 }
 
-async function getComponentOpenComponentData(component, { generateDid }) {
+async function getComponentOpenComponentData(component) {
   const { mountPoint } = component;
   const appDir = component?.env?.appDir;
   const { title, description, did } = component?.meta || {};
@@ -43,7 +43,10 @@ async function getComponentOpenComponentData(component, { generateDid }) {
     const mergedPathname = joinURL(mountPoint, pathname);
     const pathItem = jsonData.paths[pathname];
     pathItem.tags = [title];
-    const itemWallet = generateDid(JSON.stringify(['opencomponent', did, pathname]));
+    const walletPk = Hasher.SHA3.hash256(JSON.stringify(['opencomponent', did, pathname]));
+    const itemWallet = fromPublicKey(walletPk, {
+      role: types.RoleType.ROLE_ANY,
+    });
     pathItem['x-id'] = itemWallet.address;
     pathItem['x-did'] = did;
     pathItem['x-path'] = pathname;
@@ -83,7 +86,7 @@ function mergeOpenComponent(dataList, { blocklet }) {
   };
 }
 
-async function generateOpenComponentData({ blocklet, did, generateDid }) {
+async function generateOpenComponentData({ blocklet, did }) {
   const blockletCompontList = blocklet?.children || [];
   const appUrl = blocklet?.environmentObj?.BLOCKLET_APP_URL;
   const healthCheckUrl = joinURL(appUrl, '.well-known/service/health');
@@ -96,14 +99,14 @@ async function generateOpenComponentData({ blocklet, did, generateDid }) {
   if (did) {
     const findComponent = runningCompontList.find((component) => component?.meta?.did === did);
     if (findComponent) {
-      const result = getComponentOpenComponentData(findComponent, { baseUrl: appUrl, generateDid });
+      const result = getComponentOpenComponentData(findComponent, { baseUrl: appUrl });
       return result;
     }
     return null;
   }
   // 多个 component 组合
   const componentListData = await pMap(runningCompontList, (x) =>
-    getComponentOpenComponentData(x, { baseUrl: appUrl, generateDid })
+    getComponentOpenComponentData(x, { baseUrl: appUrl })
   );
   const result = mergeOpenComponent(componentListData, { blocklet });
   return result;
@@ -115,12 +118,7 @@ module.exports = {
     app.get(`${WELLKNOWN_SERVICE_PATH_PREFIX}/opencomponent.yml`, async (req, res) => {
       const { did } = req.query;
       const blocklet = await req.getBlocklet({ useCache: false });
-      const { permanentWallet } = await req.getBlockletInfo();
-      const rootSk = permanentWallet.secretKey;
-      function generateDid(didPath) {
-        return fromAppDid(didPath, rootSk, types.RoleType.ROLE_ASSET);
-      }
-      const data = await generateOpenComponentData({ blocklet, did, generateDid });
+      const data = await generateOpenComponentData({ blocklet, did });
       const ymlData = YAML.stringify(data);
       res.setHeader('Content-Disposition', 'attachment; filename="opencomponent.yml"');
       res.status(200).send(ymlData);
@@ -129,12 +127,7 @@ module.exports = {
     app.get(`${WELLKNOWN_SERVICE_PATH_PREFIX}/opencomponent.json`, async (req, res) => {
       const { did } = req.query;
       const blocklet = await req.getBlocklet({ useCache: false });
-      const { permanentWallet } = await req.getBlockletInfo();
-      const rootSk = permanentWallet.secretKey;
-      function generateDid(didPath) {
-        return fromAppDid(didPath, rootSk, types.RoleType.ROLE_ASSET);
-      }
-      const data = await generateOpenComponentData({ blocklet, did, generateDid });
+      const data = await generateOpenComponentData({ blocklet, did });
       res.status(200).json(data);
     });
   },