@abtnode/blocklet-services 1.16.33-beta-20241024-064549-2c1ad302 → 1.16.33-beta-20241028-164124-17cf3c21

package/api/cache.js

@@ -13,6 +13,12 @@ const sessionCacheDisabledUser = new LRU({
   maxAge: 86400 * 1000, // cache for 1 day
 });
 
+const securityConfigCache = new LRU({
+  max: 5000, // 这里存储的是所有 blocklet 的缓存数据，需要设置的大一些
+  maxAge: 86400 * 1000, // 这部分数据不会频繁变动，设置为 1 天，将来可以通过页面进行性能优化设置
+});
+
+// FIXME: @zhanghan 将来需要缩短 cache key 的长度
 const keyFns = {
   node() {
     return md5('nodeState');
@@ -35,6 +41,9 @@ const keyFns = {
   sessionCacheDisabledUser(did) {
     return md5(`sessionCacheDisabledUser:${did}`);
   },
+  securityConfig(did, url) {
+    return [md5(['securityConfig', did].join(':')), url ? md5(url) : undefined].filter(Boolean).join(':');
+  },
 };
 
 cache.getNodeInfo = async ({ node }) => {
@@ -129,6 +138,36 @@ cache.sessionCacheDisabledUser = {
   },
 };
 
+cache.getSecurityConfig = async ({ did, url, force = false, getDataFn } = {}) => {
+  if (!did || url === undefined) {
+    return null;
+  }
+  const cacheKey = cache.keyFns.securityConfig(did, url);
+  if (!force) {
+    const exist = securityConfigCache.get(cacheKey);
+    if (exist) {
+      return exist;
+    }
+  }
+
+  const result = await getDataFn();
+  if (result) {
+    securityConfigCache.set(cacheKey, result);
+  }
+  return result;
+};
+cache.removeSecurityConfig = ({ did } = {}) => {
+  if (!did) {
+    return;
+  }
+  const prefix = cache.keyFns.securityConfig(did);
+  securityConfigCache.forEach((value, key) => {
+    if (key.startsWith(prefix)) {
+      securityConfigCache.del(key);
+    }
+  });
+};
+
 cache.keyFns = keyFns;
 
 module.exports = cache;

package/api/index.js

@@ -1,5 +1,7 @@
 const http = require('http');
 const get = require('lodash/get');
+const omitBy = require('lodash/omitBy');
+const isUndefined = require('lodash/isUndefined');
 const morgan = require('morgan');
 const express = require('express');
 const dayjs = require('@abtnode/util/lib/dayjs');
@@ -11,6 +13,7 @@ const bodyParser = require('body-parser');
 const httpProxy = require('@arcblock/http-proxy');
 const { minimatch } = require('minimatch');
 const { joinURL } = require('ufo');
+const helmet = require('helmet');
 
 const { WELLKNOWN_SERVICE_PATH_PREFIX, EVENTS, MAX_UPLOAD_FILE_SIZE } = require('@abtnode/constant');
 const {
@@ -23,6 +26,14 @@ const {
 const { getAppOgCacheDir } = require('@abtnode/util/lib/blocklet');
 const normalizePathPrefix = require('@abtnode/util/lib/normalize-path-prefix');
 const createInvite = require('@abtnode/auth/lib/invitation');
+const {
+  patchResponseHeader,
+  DEFAULT_HELMET_CONFIG,
+  cleanConfigOverride,
+  keepConfigOverride,
+  patchCors,
+} = require('@abtnode/util/lib/security');
+const { DEFAULT_CORS_CONFIG } = require('@abtnode/util/lib/cors');
 const eventHub =
   process.env.NODE_ENV === 'test' ? require('@arcblock/event-hub/single') : require('@arcblock/event-hub');
 
@@ -122,6 +133,53 @@ module.exports = function createServer(node, serverOptions = {}) {
       proxyReq.write(req.rawBody);
     }
   });
+  const SECURITY_HEADER_MAP = {
+    contentSecurityPolicy: 'content-security-policy',
+    referrerPolicy: 'referrer-policy',
+    xFrameOptions: 'x-frame-options',
+    xPoweredBy: 'x-powered-by',
+    xXssProtection: 'x-xss-protection',
+  };
+  const CORS_HEADER_MAP = {
+    origin: 'access-control-allow-origin',
+    methods: 'access-control-allow-methods',
+    allowedHeaders: 'access-control-allow-headers',
+    exposedHeaders: 'access-control-expose-headers',
+    credentials: 'access-control-allow-credentials',
+    maxAge: 'access-control-max-age',
+    optionsSuccessStatus: 'access-control-allow-status',
+    preflightContinue: 'access-control-allow-preflight',
+  };
+
+  // NOTICE: !!! 注意这里最好不要有异步的函数，否则对 proxyRes 的处理可能不会被正确响应
+  // eslint-disable-next-line no-unused-vars
+  proxy.on('proxyRes', (proxyRes, req, res) => {
+    const securityConfig = req?.responseHeaderPolicyConfig;
+    if (securityConfig) {
+      const securityHeaderOverrideConfig = keepConfigOverride(
+        securityConfig?.responseHeaderPolicy?.securityHeader || {}
+      );
+      const corsOverrideConfig = keepConfigOverride(securityConfig?.responseHeaderPolicy?.cors || {});
+
+      for (const configKey of Object.keys(securityHeaderOverrideConfig)) {
+        if (!securityHeaderOverrideConfig[configKey]) {
+          const headerKey = SECURITY_HEADER_MAP[configKey];
+          if (isUndefined(req.get(headerKey))) {
+            delete proxyRes.headers[headerKey];
+          }
+        }
+      }
+
+      for (const configKey of Object.keys(corsOverrideConfig)) {
+        if (!corsOverrideConfig[configKey]) {
+          const headerKey = CORS_HEADER_MAP[configKey];
+          if (isUndefined(req.get(headerKey))) {
+            delete proxyRes.headers[headerKey];
+          }
+        }
+      }
+    }
+  });
 
   proxy.on('proxyRes', (proxyRes, req, res) => {
     const now = Date.now();
@@ -163,6 +221,11 @@ module.exports = function createServer(node, serverOptions = {}) {
       }
     });
   });
+  eventHub.on(BlockletEvents.securityConfigUpdated, ({ did }) => {
+    // 检测到安全配置更新后，需要批量删除指定前缀的 cache（会包含整个 blocklet 所有的 security cache）
+    logger.info('blocklet securityConfig update', { did, pid: process.pid });
+    cache.removeSecurityConfig({ did });
+  });
   eventHub.on(EVENTS.NODE_UPDATED, () => {
     logger.info('node update', { pid: process.pid });
     cache.del(cache.keyFns.node());
@@ -193,6 +256,42 @@ module.exports = function createServer(node, serverOptions = {}) {
     });
   });
 
+  async function wrapHelmet({ req, res, securityConfig, blocklet }, next) {
+    let config = securityConfig?.responseHeaderPolicy?.securityHeader || {};
+    config = cleanConfigOverride(config, req);
+
+    config = await patchResponseHeader(config, { node, blocklet });
+
+    helmet({
+      ...DEFAULT_HELMET_CONFIG,
+      ...omitBy(config, isUndefined),
+    })(req, res, next);
+  }
+
+  function wrapCors({ req, res, securityConfig, blocklet }, next) {
+    cors(async (_req, callback) => {
+      let config = securityConfig?.responseHeaderPolicy?.cors || {};
+      config = await patchCors(config, { node, blocklet });
+      config = cleanConfigOverride(config, req);
+
+      // HACK: 如果是 * ，需要转换为字符串来使用
+      if (config.origin?.join('') === '*') {
+        config.origin = '*';
+      }
+      if (config.allowedHeaders?.join('') === '*') {
+        config.allowedHeaders = '*';
+      }
+      if (config.exposedHeaders?.join('') === '*') {
+        config.exposedHeaders = '*';
+      }
+
+      callback(null, {
+        ...DEFAULT_CORS_CONFIG,
+        ...omitBy(config, isUndefined),
+      });
+    })(req, res, next);
+  }
+
   // Http server
   const server = express();
   const maxUploadSize = Number(process.env.MAX_UPLOAD_FILE_SIZE) || MAX_UPLOAD_FILE_SIZE;
@@ -205,8 +304,8 @@ module.exports = function createServer(node, serverOptions = {}) {
     },
   };
 
+  // NOTICE: we need to trust proxy to get real ip address
   server.set('trust proxy', 'loopback');
-  server.disable('x-powered-by');
 
   server.use(cookieParser());
 
@@ -220,15 +319,34 @@ module.exports = function createServer(node, serverOptions = {}) {
   server.use(bodyParser.urlencoded({ extended: true, limit: `${maxUploadSize}mb`, verify }));
 
   // NOTE: will be overwrite by Blocklet Server in production
-  server.use(cors());
 
   // Shared util functions on current request
   server.use((req, res, next) => {
+    // NOTICE: 增加了 req 上的公用函数，比如 req.getBlocklet
     attachSharedUtils({ node, req, options });
     StaticService.attachUtils({ req, res, proxy });
     next();
   });
 
+  // 此处逻辑会为 service 和 blocklet 都增加安全相关的 header 配置
+  server.use(async (req, res, next) => {
+    const did = req.getBlockletDid();
+    // NOTICE: 非 blocklet 的请求也会经过这里，需要直接放行
+    if (!did) {
+      next();
+      return;
+    }
+    const blocklet = await req.getBlocklet({ attachRuntimeInfo: true });
+    const { accessPolicyConfig, responseHeaderPolicyConfig } = await req.getSecurityConfig();
+
+    req.accessPolicyConfig = accessPolicyConfig;
+    req.responseHeaderPolicyConfig = responseHeaderPolicyConfig;
+
+    wrapHelmet({ req, res, securityConfig: responseHeaderPolicyConfig, blocklet }, () => {
+      wrapCors({ req, res, securityConfig: responseHeaderPolicyConfig, blocklet }, next);
+    });
+  });
+
   /* istanbul ignore if */
   if (isProduction) {
     morgan.token('x-request-id', (req) => req.headers['x-request-id'] || '-');
@@ -413,6 +531,7 @@ module.exports = function createServer(node, serverOptions = {}) {
           req.target = target; // for internal use
           imageService.processImage(req, res);
         } else {
+          // NOTICE: 此处已经不需要再添加一次 header 了，在上面的中间件中会一起处理
           proxy.safeWeb(req, res, { target, headers });
         }
       } else {

package/api/libs/api.js

@@ -1,7 +1,7 @@
 const { default: axios } = require('axios');
 
-axios.defaults.timeout = 10 * 1000; // 超时时间设为10s
-
-const api = axios.create();
+const api = axios.create({
+  timeout: 10 * 1000,
+});
 
 module.exports = { api };

package/api/libs/connect/session.js

@@ -15,9 +15,8 @@ const {
   NODE_SERVICES,
   ROLES,
   WELLKNOWN_SERVICE_PATH_PREFIX,
-  WHO_CAN_ACCESS,
-  WHO_CAN_ACCESS_PREFIX_ROLES,
   MAIN_CHAIN_ENDPOINT,
+  SECURITY_RULE_DEFAULT_ID,
 } = require('@abtnode/constant');
 const {
   validatePassport,
@@ -35,7 +34,6 @@ const { fromAppDid } = require('@arcblock/did-ext');
 const { LOGIN_PROVIDER, BLOCKLET_APP_SPACE_REQUIREMENT, DID_SPACES } = require('@blocklet/constant');
 const createTranslator = require('@abtnode/util/lib/translate');
 const {
-  getRolesFromAuthConfig,
   getBlockletAppIdList,
   forEachBlockletSync,
   getAppName,
@@ -47,7 +45,7 @@ const { getDidSpacesInfoByClaims, silentAuthorizationInConnect } = require('@abt
 const getRequestIP = require('@abtnode/util/lib/get-request-ip');
 
 const logger = require('../logger')('connect');
-const { isInvitedUserOnly, createTokenFn, getDidConnectVersion } = require('../../util');
+const { checkInvitedUserOnly, createTokenFn, getDidConnectVersion } = require('../../util');
 const { transferPassport, PASSPORT_VC_TYPES } = require('../auth/utils');
 const { migrateAccount, declareAccount } = require('../../services/oauth');
 const { getKycClaims, verifyKycClaims, getPassportVc, isProfileUrlSupported, getProfileItems } = require('../kyc');
@@ -94,18 +92,13 @@ const getRoleFromVC = async ({ vc, node, locale, blocklet, teamDid, sourceAppPid
   return role;
 };
 
-const validateRole = async ({ role, authConfig, locale, node, teamDid }) => {
-  if (authConfig.whoCanAccess === WHO_CAN_ACCESS.OWNER && role !== ROLES.OWNER) {
-    throw new Error(
-      {
-        zh: '你不是该应用的所有者',
-        en: 'You are not the owner of this application',
-      }[locale]
-    );
-  }
+const validateRole = async ({ role, securityConfig, locale, node, teamDid }) => {
+  const accessRoles = securityConfig?.accessPolicy?.roles ?? null;
+  const accessRevert = securityConfig?.accessPolicy?.revert ?? false;
 
   const roleList = await node.getRoles({ teamDid });
   if (!roleList.some((x) => x.name === role)) {
+    // 事实上，这里表示的是通行证已经被删除了，也就是这个 role 不存在了
     throw new Error(
       {
         zh: '通行证已被应用撤销',
@@ -114,17 +107,19 @@ const validateRole = async ({ role, authConfig, locale, node, teamDid }) => {
     );
   }
 
-  if (authConfig.whoCanAccess && authConfig.whoCanAccess.startsWith(WHO_CAN_ACCESS_PREFIX_ROLES)) {
-    const roles = getRolesFromAuthConfig(authConfig);
-    if (!roles.includes(role)) {
-      const list = roleList.filter((x) => roles.some((y) => y === x.name)).map((x) => x.title);
-      throw new Error(
-        {
-          zh: `请使用 ${list.join(' 或 ')} 通行证登录`,
-          en: `Please use ${list.join(' or ')} passport to login`,
-        }[locale]
-      );
-    }
+  if (accessRoles === null && accessRevert === false) {
+    return;
+  }
+
+  const validRoles = accessRevert ? (roleList || []).filter((x) => !accessRoles.includes(x.name)) : accessRoles;
+  if (!validRoles.includes(role)) {
+    const roleTitleList = (roleList || []).filter((x) => validRoles.some((y) => y === x.name)).map((x) => x.title);
+    throw new Error(
+      {
+        zh: `请使用 ${roleTitleList.join(' 或 ')} 通行证登录`,
+        en: `Please use ${roleTitleList.join(' or ')} passport to login`,
+      }[locale]
+    );
   }
 };
 
@@ -164,12 +159,12 @@ module.exports = {
      * }} param0
      * @returns
      */
-    onConnect: async ({ node, request, userDid, locale = 'en', passportId = '', componentId, action, baseUrl }) => {
+    onConnect: async ({ node, request, userDid, locale = 'en', passportId = '', action, baseUrl }) => {
       /**
        * @type {import('@abtnode/client').BlockletState}
        */
       const blocklet = await request.getBlocklet();
-      const config = await request.getServiceConfig(NODE_SERVICES.AUTH, { componentId });
+      const { accessPolicyConfig } = await request.getSecurityConfig({ id: SECURITY_RULE_DEFAULT_ID });
       const { did: teamDid, wallet: blockletWallet } = await request.getBlockletInfo();
       const sourceAppPid = getSourceAppPid(request);
 
@@ -195,13 +190,15 @@ module.exports = {
 
       if (action === 'login') {
         // passport claim
-        const [invitedUserOnly] = config ? await isInvitedUserOnly(config, node, teamDid) : [false];
+        const isInvitedUserOnly = accessPolicyConfig
+          ? await checkInvitedUserOnly(accessPolicyConfig, node, teamDid)
+          : [false];
         const passportClaim = {
           type: 'verifiableCredential',
           description: messages.requestPassport[locale],
           item: PASSPORT_VC_TYPES,
           trustedIssuers: await getTrustedIssuers(blocklet, { sourceAppPid }),
-          optional: !invitedUserOnly,
+          optional: !isInvitedUserOnly,
           claimUrl: getPassportClaimUrl(baseUrl),
         };
         if (passportId) {
@@ -291,7 +288,6 @@ module.exports = {
       claims,
       baseUrl,
       createSessionToken,
-      componentId,
       action,
       visitorId,
       inviter,
@@ -312,11 +308,10 @@ module.exports = {
       const realPk = currentUser?.pk || userPk;
 
       // Get auth config
-      const authConfig = (await request.getServiceConfig(NODE_SERVICES.AUTH, { componentId })) || {};
+      const { accessPolicyConfig } = await request.getSecurityConfig({ id: SECURITY_RULE_DEFAULT_ID });
 
       let vc;
       let nftState;
-      let invitedUserOnly = false;
       let defaultRole = ROLES.GUEST;
       let defaultTtl = 0;
       let defaultTtlPolicy = 'never';
@@ -336,8 +331,13 @@ module.exports = {
           locale,
           trustedIssuers: await getTrustedIssuers(blocklet, { sourceAppPid }),
         });
-        [invitedUserOnly, defaultRole, issuePassport] = await isInvitedUserOnly(authConfig, node, teamDid);
-        if (invitedUserOnly && !vc) {
+        const isInvitedUserOnly = await checkInvitedUserOnly(accessPolicyConfig, node, teamDid);
+        const userCount = await node.getUsersCount({ teamDid });
+        if (userCount === 0) {
+          defaultRole = ROLES.OWNER;
+          issuePassport = true;
+        }
+        if (isInvitedUserOnly && !vc) {
           throw new Error(messages.missingPassport[locale]);
         }
 
@@ -421,7 +421,7 @@ module.exports = {
 
       // Get role
       const role = await getRoleFromVC({ vc, node, locale, blocklet, teamDid, sourceAppPid });
-      await validateRole({ role, authConfig, locale, node, teamDid });
+      await validateRole({ role, securityConfig: accessPolicyConfig, locale, node, teamDid });
 
       checkAppOwner({ role, blocklet, userDid, locale });
 
@@ -711,8 +711,8 @@ module.exports = {
         throw new Error(messages.userMismatch[locale]);
       }
 
-      const config = await request.getServiceConfig(NODE_SERVICES.AUTH);
-      if (get(config, 'allowSwitchProfile', true) === false) {
+      const serviceConfig = await request.getServiceConfig(NODE_SERVICES.AUTH);
+      if (get(serviceConfig, 'allowSwitchProfile', true) === false) {
         throw new Error(messages.actionForbidden[locale]);
       }
 
@@ -823,7 +823,7 @@ module.exports = {
   },
 
   switchPassport: {
-    onConnect: async ({ node, request, locale, userDid, previousUserDid, componentId, baseUrl }) => {
+    onConnect: async ({ node, request, locale, userDid, previousUserDid, baseUrl }) => {
       if (userDid && previousUserDid && userDid !== previousUserDid) {
         throw new Error(messages.userMismatch[locale]);
       }
@@ -847,12 +847,8 @@ module.exports = {
         throw new Error(messages.notAuthorized[locale]);
       }
 
-      const config = await request.getServiceConfig(NODE_SERVICES.AUTH, { componentId });
-      // FIXME: @zhanghan 在 blocklet-service 的页面中，无法提供 componentId，暂时只能默认不允许切换到 no-passport
-      let invitedUserOnly = true;
-      if (config) {
-        [invitedUserOnly] = await isInvitedUserOnly(config, node, teamDid);
-      }
+      const { accessPolicyConfig } = await request.getSecurityConfig({ id: SECURITY_RULE_DEFAULT_ID });
+      const isInvitedUserOnly = await checkInvitedUserOnly(accessPolicyConfig, node, teamDid);
 
       const blocklet = await request.getBlocklet();
       const sourceAppPid = getSourceAppPid(request);
@@ -863,7 +859,7 @@ module.exports = {
           description: messages.requestPassport[locale],
           item: PASSPORT_VC_TYPES,
           trustedIssuers: await getTrustedIssuers(blocklet, { sourceAppPid }),
-          optional: !invitedUserOnly,
+          optional: !isInvitedUserOnly,
           claimUrl: getPassportClaimUrl(baseUrl),
         },
       };
@@ -876,7 +872,6 @@ module.exports = {
       verifiableCredential,
       userDid,
       createSessionToken,
-      componentId,
       sourceAppPid,
       provider,
     }) => {
@@ -901,7 +896,7 @@ module.exports = {
       }
 
       // Get auth config
-      const authConfig = (await request.getServiceConfig(NODE_SERVICES.AUTH, { componentId })) || {};
+      const { accessPolicyConfig } = await request.getSecurityConfig({ id: SECURITY_RULE_DEFAULT_ID });
 
       // Get passport vc
       const vc = await getPassportVc({
@@ -911,13 +906,9 @@ module.exports = {
         trustedIssuers: await getTrustedIssuers(blocklet, { sourceAppPid }),
       });
 
-      // FIXME: @zhanghan 在 blocklet-service 的页面中，无法提供 componentId，暂时只能默认不允许切换到 no-passport
       // Validate passport required
-      let invitedUserOnly = true;
-      if (authConfig) {
-        [invitedUserOnly] = await isInvitedUserOnly(authConfig, node, teamDid);
-      }
-      if (invitedUserOnly && !vc) {
+      const isInvitedUserOnly = await checkInvitedUserOnly(accessPolicyConfig, node, teamDid);
+      if (isInvitedUserOnly && !vc) {
         throw new Error(messages.missingPassport[locale]);
       }
 
@@ -929,7 +920,7 @@ module.exports = {
 
       // Get role
       const role = await getRoleFromVC({ vc, node, locale, blocklet, teamDid, sourceAppPid });
-      await validateRole({ role, authConfig, locale, node, teamDid });
+      await validateRole({ role, securityConfig: accessPolicyConfig, locale, node, teamDid });
 
       checkAppOwner({ role, blocklet, userDid, locale });
 

package/api/libs/kyc.js

@@ -4,6 +4,7 @@ const pick = require('lodash/pick');
 const trim = require('lodash/trim');
 const lowerCase = require('lodash/lowerCase');
 const semver = require('semver');
+const { Hasher } = require('@ocap/mcrypto');
 const { LOGIN_PROVIDER } = require('@blocklet/constant');
 const { messages, getVCFromClaims } = require('@abtnode/auth/lib/auth');
 const { getPassportClaimUrl, getKycAcquireUrl } = require('@abtnode/auth/lib/passport');
@@ -144,6 +145,10 @@ async function getKycClaims(blocklet, user, locale, baseUrl, sourceAppPid) {
       acquireUrl: getKycAcquireUrl(baseUrl, '', 'email'),
       claimUrl: getPassportClaimUrl(baseUrl, '', 'email'),
     };
+    if (user?.email) {
+      emailKycClaim.tag = Hasher.SHA3.hash256(user.email);
+      emailKycClaim.description += `: ${user.email}`;
+    }
     claims.emailKyc = ['verifiableCredential', emailKycClaim];
   }
 
@@ -158,6 +163,10 @@ async function getKycClaims(blocklet, user, locale, baseUrl, sourceAppPid) {
       acquireUrl: getKycAcquireUrl(baseUrl, '', 'phone'),
       claimUrl: getPassportClaimUrl(baseUrl, '', 'phone'),
     };
+    if (user?.phone) {
+      phoneKycClaim.tag = Hasher.SHA3.hash256(user.phone);
+      phoneKycClaim.description += `: ${user.phone}`;
+    }
     claims.phoneKyc = ['verifiableCredential', phoneKycClaim];
   }
 

package/api/libs/push-kit/index.js

@@ -3,6 +3,7 @@ const { sign } = require('@blocklet/sdk/lib/util/verify-sign');
 const getBlockletInfo = require('@blocklet/meta/lib/info');
 const { joinURL } = require('ufo');
 const pRetry = require('p-retry');
+const { SIG_VERSION } = require('@blocklet/constant');
 
 const { api } = require('../api');
 const logger = require('../logger')('blocklet-services:notification');
@@ -22,6 +23,7 @@ async function sendPush(receiver, notification, { node, teamDid }) {
   }
 
   const pushKitConfig = {
+    // @see https://test.store.blocklet.dev/blocklets/z2qa6xfPH6zHq5AQjb2Qm5CfmpndyQsvZrTKH
     did: config.did || 'z2qa6xfPH6zHq5AQjb2Qm5CfmpndyQsvZrTKH',
     pushPath: config.pushPath || '/api/push',
   };
@@ -77,11 +79,21 @@ async function sendPush(receiver, notification, { node, teamDid }) {
   }
 
   const blockletInfo = getBlockletInfo(blocklet);
+  const iat = Math.floor(Date.now() / 1000);
+  const exp = iat + 60 * 5;
 
   const sig = sign(
     {
-      targets: filterTargets,
-      data: notification,
+      body: {
+        targets: filterTargets,
+        data: notification,
+      },
+      query: {},
+      method: 'post',
+      // NOTICE: 这里只能使用 push-kit 中接收到的 req.originalUrl 值，不能使用完整路径，否则会校验失败
+      url: pushKitConfig.pushPath,
+      iat,
+      exp,
     },
     { appSk: blockletInfo.wallet.secretKey }
   );
@@ -99,6 +111,9 @@ async function sendPush(receiver, notification, { node, teamDid }) {
             headers: {
               'x-blocklet-sig': sig,
               'x-blocklet-sig-pk': blockletInfo.wallet.publicKey,
+              'x-blocklet-sig-iat': iat,
+              'x-blocklet-sig-exp': exp,
+              'x-blocklet-sig-version': SIG_VERSION.DEFAULT,
             },
           }
         ),

package/api/middlewares/verify-sig.js

@@ -1,12 +1,44 @@
+const { SIG_VERSION } = require('@blocklet/constant');
 const { verify } = require('@blocklet/sdk/lib/util/verify-sign');
+const semver = require('semver');
+const { parseURL } = require('ufo');
+
+const legacyFn = (req) => {
+  const data = req?.body ?? {};
+  const params = req?.query ?? {};
+  return { data, params };
+};
+
+const latestFn = (req) => {
+  const data = {};
+  data.body = req.body ?? {};
+  data.query = req.params ?? {};
+  data.method = req.method.toLowerCase();
+  data.url = parseURL(req.originalUrl).pathname;
+  const now = Math.floor(Date.now() / 1000);
+  const iat = Number(req.get('x-component-sig-iat'));
+  const exp = Number(req.get('x-component-sig-exp'));
+  if (Number.isNaN(iat) || Number.isNaN(exp)) {
+    throw new Error('invalid sig');
+  }
+  if (exp < now) {
+    throw new Error('expired sig');
+  }
+  data.iat = iat;
+  data.exp = exp;
+  return data;
+};
 
 const verifySig = async (req, res, next) => {
   try {
     const blocklet = await req.getBlocklet();
     const sig = req.get('x-blocklet-sig');
-    const data = typeof req.body === 'undefined' ? {} : req.body;
-    const params = typeof req.query === 'undefined' ? {} : req.query;
-    const verified = verify({ data, params }, sig, {
+    const sigVersion = req.get('x-blocklet-sig-version');
+    // FIXME: @zhanghan 2024-11-30 需要移除这个旧的兼容（提升总体的安全性）
+    const getData = semver.gt(semver.coerce(sigVersion), semver.coerce(SIG_VERSION.V0)) ? latestFn : legacyFn;
+    const data = await getData(req);
+
+    const verified = verify(data, sig, {
       // NOTICE: blocklet-service 的运行环境中不包含以下环境变量，必须从 blocklet 信息中去获取并传递
       type: blocklet.environmentObj.BLOCKLET_APP_CHAIN_TYPE,
       appSk: blocklet.environmentObj.BLOCKLET_APP_SK,

package/api/routes/blocklet.js

@@ -7,7 +7,6 @@ const JWT = require('@arcblock/jwt');
 const { isValid } = require('@arcblock/did');
 const { joinURL } = require('ufo');
 const cors = require('cors');
-const handleInstanceInStore = require('@abtnode/core/lib/util/public-to-store');
 const { getPassportStatusEndpoint } = require('@abtnode/auth/lib/auth');
 const { createPassportVC, createPassport, createUserPassport } = require('@abtnode/auth/lib/passport');
 
@@ -227,18 +226,6 @@ module.exports = {
 
         await node.setBlockletInitialized({ did: blocklet.meta.did, owner: { did: userDid, pk } });
 
-        // 调用 store 管理公开实例
-        // 如果一个 blocklet 没有设置 公开实例，启动成功后不应给 store 发请求
-        const { publicToStore } = blocklet.settings;
-        if (publicToStore && !startError) {
-          try {
-            await handleInstanceInStore(blocklet, { userDid, publicToStore });
-          } catch (error) {
-            // 即使实例公开不成功，不能影响正常启动流程
-            logger.error('failed to send blocklet logo', { did: blocklet.meta.did, error });
-          }
-        }
-
         // send notification to wallet
         const receiver = userDid;
         const token = JWT.sign(wallet.address, wallet.secretKey);

package/api/routes/env.js

@@ -9,7 +9,7 @@ module.exports = {
     server.get(`**${WELLKNOWN_SERVICE_PATH_PREFIX}/api/env`, async (req, res) => {
       res.type('js');
 
-      const [blockletInfo, blocklet, config, info] = await Promise.all([
+      const [blockletInfo, blocklet, serviceConfig, info] = await Promise.all([
         req.getBlockletInfo(),
         req.getBlocklet(),
         req.getServiceConfig(NODE_SERVICES.AUTH),
@@ -37,7 +37,7 @@ module.exports = {
   pathPrefix: "${pathPrefix}",
   apiPrefix: "${pathPrefix.replace(/\/+$/, '')}${WELLKNOWN_SERVICE_PATH_PREFIX}",
   ${groupPathPrefix ? `groupPathPrefix: "${groupPathPrefix}",` : ''}
-  webWalletUrl: "${info.webWalletUrl || config.webWalletUrl || opts.webWalletUrl}",
+  webWalletUrl: "${info.webWalletUrl || serviceConfig.webWalletUrl || opts.webWalletUrl}",
   nftDomainUrl: "${info.nftDomainUrl || ''}",
   passportColor: "${passportColor}",
   serverDid: "${info.did}",