@abtnode/blocklet-services 1.16.33-beta-20241024-064549-2c1ad302 → 1.16.33-beta-20241028-164124-17cf3c21

package/api/routes/oauth.js

@@ -1,6 +1,11 @@
 const { handleInvitationReceive, getApplicationInfo } = require('@abtnode/auth/lib/auth');
 const { upsertToPassports, createPassportSvg } = require('@abtnode/auth/lib/passport');
-const { WELLKNOWN_SERVICE_PATH_PREFIX, NODE_SERVICES, PASSPORT_STATUS, ROLES } = require('@abtnode/constant');
+const {
+  WELLKNOWN_SERVICE_PATH_PREFIX,
+  PASSPORT_STATUS,
+  ROLES,
+  SECURITY_RULE_DEFAULT_ID,
+} = require('@abtnode/constant');
 const { extractUserAvatar, getUserAvatarUrl, getAppAvatarUrl } = require('@abtnode/util/lib/user');
 const { fromAppDid } = require('@arcblock/did-ext');
 const { getBlockletAppIdList } = require('@blocklet/meta/lib/util');
@@ -28,7 +33,7 @@ const OAuthApple = require('../libs/auth/adapters/apple');
 const { getAvatarByEmail, transferPassport, getAvatarByUrl } = require('../libs/auth/utils');
 const initJwt = require('../libs/jwt');
 const { sendToUser } = require('../libs/notification');
-const { isInvitedUserOnly, createTokenFn, getDidConnectVersion, redirectWithoutCache } = require('../util');
+const { checkInvitedUserOnly, createTokenFn, getDidConnectVersion, redirectWithoutCache } = require('../util');
 const { ApiError } = require('../util/error');
 const federatedUtil = require('../util/federated');
 const { isOAuthEmailVerified, isEmailUniqueRequired, isEmailKycRequired, isSameEmail } = require('../libs/kyc');
@@ -172,7 +177,7 @@ function getAuthClient(blocklet, provider, { legacy = false, appPid } = {}) {
 
 async function login(req, node, options) {
   const blocklet = await req.getBlocklet();
-  const { locale = 'en', provider, componentId, inviter = null, sourceAppPid = null } = req.body;
+  const { locale = 'en', provider, inviter = null, sourceAppPid = null } = req.body;
   let visitorId = req.body?.visitorId;
   if (!visitorId) {
     visitorId = req.get('x-blocklet-visitor-id');
@@ -189,11 +194,10 @@ async function login(req, node, options) {
   const userDid = userWallet.address;
   const userPk = userWallet.publicKey;
 
-  // FIXME: @zhanghan 这里通过 componentId 来判断权限的方式实际上没有意义，因为用户可以尝试从别的 url 来登录
-  const config = await req.getServiceConfig(NODE_SERVICES.AUTH, { componentId });
+  const { accessPolicyConfig } = await req.getSecurityConfig({ id: SECURITY_RULE_DEFAULT_ID });
   const nodeInfo = await req.getNodeInfo();
   const { dataDir } = await getApplicationInfo({ node, nodeInfo, teamDid });
-  const [invitedUserOnly] = await isInvitedUserOnly(config, node, teamDid);
+  const isInvitedUserOnly = await checkInvitedUserOnly(accessPolicyConfig, node, teamDid);
 
   const lastLoginIp = getRequestIP(req);
   let passport = { name: 'Guest', role: 'guest' };
@@ -248,7 +252,7 @@ async function login(req, node, options) {
     let avatar = oauthInfo.picture ? await getAvatarByUrl(oauthInfo.picture) : await getAvatarByEmail(oauthInfo.email);
     avatar = await extractUserAvatar(avatar, { dataDir });
     // 当前 oauth 账户不存在，自动添加一个新用户
-    if (invitedUserOnly) {
+    if (isInvitedUserOnly) {
       throw new ApiError(403, t('needInviteToLogin', locale));
     }
 

package/api/routes/user-session.js

@@ -93,27 +93,27 @@ module.exports = {
     // NOTE: 保留 /login 路由，该功能不是针对于某一个实体来操作的，需要更明确表达意图
     app.post(`${prefix}/login`, ensureBlocklet(), async (req, res) => {
       const { blocklet } = req;
-      const { userDid, appPid, passportId } = req.body;
+      const loginUserSession = req.body;
       let visitorId = req.body?.visitorId;
       if (!visitorId) {
         visitorId = req.get('x-blocklet-visitor-id');
       }
 
-      if (!userDid) {
+      if (!loginUserSession.userDid) {
         res.status(400).json({ error: 'userDid is required' });
         return;
       }
-      if (!appPid) {
+      if (!loginUserSession.appPid) {
         res.status(400).json({ error: 'appPid is required' });
         return;
       }
 
       const teamDid = blocklet.appPid;
-
       const userSessions = await node.getUserSession({
         teamDid,
-        userDid,
+        userDid: loginUserSession.userDid,
         visitorId,
+        id: loginUserSession.id,
       });
       const now = Date.now();
       const sessionTtl = blocklet.settings?.session?.ttl || SESSION_TTL;
@@ -122,7 +122,7 @@ module.exports = {
       const validSession = sortedUserSessions.some((x) => now - new Date(x.updatedAt).getTime() < sessionTtl * 1000);
 
       if (validSession) {
-        const user = await node.getUser({ teamDid, user: { did: userDid } });
+        const user = await node.getUser({ teamDid, user: { did: loginUserSession.userDid } });
         if (!user.approved) {
           res.status(401).json(messages.notAllowedAppUser.en);
           return;
@@ -138,7 +138,9 @@ module.exports = {
 
         const provider = sourceProvider || LOGIN_PROVIDER.WALLET;
 
-        const memberSite = federated.sites.find((item) => item.appPid === appPid && item.isMaster === false);
+        const memberSite = federated.sites.find(
+          (item) => item.appPid === loginUserSession.appPid && item.isMaster === false
+        );
         const postUser = pick(user, ['did', 'pk', 'fullName', 'locale', 'inviter', 'generation']);
         postUser.lastLoginAt = getRequestIP(req);
 
@@ -160,7 +162,7 @@ module.exports = {
               did: teamDid,
               data: {
                 user: postUser,
-                passport: passportId ? { id: passportId } : undefined,
+                passport: loginUserSession.passportId ? { id: loginUserSession.passportId } : undefined,
                 walletOS,
                 provider,
               },
@@ -179,7 +181,9 @@ module.exports = {
           const createToken = createTokenFn(createSessionToken);
           const { secret } = await req.getBlockletInfo();
           const sessionConfig = blocklet.settings?.session || {};
-          const targetPassport = passportId ? (user?.passports || []).find((item) => item.id === passportId) : null;
+          const targetPassport = loginUserSession.passportId
+            ? (user?.passports || []).find((item) => item.id === loginUserSession.passportId)
+            : null;
           const loggedInUser = await node.loginUser({
             teamDid,
             user: {
@@ -219,11 +223,12 @@ module.exports = {
         const walletDeviceId = req.get('wallet-device-id');
 
         const userSessionDoc = await node.upsertUserSession({
+          id: loginUserSession.id,
           teamDid,
-          userDid,
+          userDid: loginUserSession.userDid,
           visitorId,
-          appPid,
-          passportId,
+          appPid: loginUserSession.appPid,
+          passportId: loginUserSession.passportId,
           status: 'online',
           ua,
           lastLoginIp,
@@ -237,10 +242,10 @@ module.exports = {
         if (isFederatedLogin) {
           node.syncUserSession({
             teamDid,
-            userDid,
+            userDid: loginUserSession.userDid,
             visitorId: userSessionDoc.visitorId,
-            passportId,
-            targetAppPid: appPid,
+            passportId: loginUserSession.passportId,
+            targetAppPid: loginUserSession.appPid,
             ua,
             lastLoginIp,
             extra: {
@@ -254,9 +259,9 @@ module.exports = {
         logger.info('quick-login with', {
           teamDid,
           visitorId,
-          userDid,
-          appPid,
-          passportId,
+          userDid: loginUserSession.userDid,
+          appPid: loginUserSession.appPid,
+          passportId: loginUserSession.passportId,
           extra: {
             walletOS,
           },
@@ -267,17 +272,22 @@ module.exports = {
         logger.warn('failed to quick-login with', {
           teamDid,
           visitorId,
-          userDid,
-          appPid,
-          passportId,
+          userDid: loginUserSession.userDid,
+          appPid: loginUserSession.appPid,
+          passportId: loginUserSession.passportId,
         });
-        res.status(403).json({ error: 'session expired' });
+        res.status(401).json({ error: 'session expired' });
       }
     });
 
+    /**
+     * 获取指定用户的所有登录会话
+     */
     app.get(`${prefix}`, ensureBlocklet(), async (req, res) => {
       const { blocklet } = req;
       const teamDid = blocklet.appPid;
+      const requestIp = getRequestIP(req);
+      const userAgent = req.get('user-agent');
 
       // NOTICE: 此处的 visitorId 必须显式传入，否则用户将无法正常查询自己的所有 sessions
       const { userDid, appPid, visitorId } = req.query;
@@ -308,7 +318,12 @@ module.exports = {
 
       // NOTICE: 移除 walletDeviceId 和 walletDeviceMessageToken，避免泄露
       const result = userSessions
-        .filter((x) => x?.user?.approved)
+        .filter((x) => {
+          if (x.lastLoginIp !== requestIp || x.ua !== userAgent || x.status === 'expired') {
+            return false;
+          }
+          return x?.user?.approved;
+        })
         .map((x) => {
           return omit(x, ['extra.walletDeviceId', 'extra.walletDeviceMessageToken']);
         });

package/api/routes/user.js

@@ -1,4 +1,4 @@
-const { NODE_SERVICES, WELLKNOWN_SERVICE_PATH_PREFIX } = require('@abtnode/constant');
+const { WELLKNOWN_SERVICE_PATH_PREFIX, SECURITY_RULE_DEFAULT_ID } = require('@abtnode/constant');
 const { getApplicationInfo } = require('@abtnode/auth/lib/auth');
 const { fromAppDid } = require('@arcblock/did-ext');
 const { extractUserAvatar } = require('@abtnode/util/lib/user');
@@ -17,7 +17,7 @@ const { Joi } = require('@arcblock/validator');
 const { parse } = require('@abtnode/core/lib/util/ua');
 const getRequestIP = require('@abtnode/util/lib/get-request-ip');
 
-const { isInvitedUserOnly, createTokenFn, getDidConnectVersion } = require('../util');
+const { checkInvitedUserOnly, createTokenFn, getDidConnectVersion } = require('../util');
 const initJwt = require('../libs/jwt');
 const { getAvatarByUrl } = require('../libs/auth/utils');
 const { ApiError } = require('../util/error');
@@ -61,10 +61,10 @@ const translations = {
 
 const t = createTranslator({ translations });
 
-async function checkNeedInvite({ req, node, teamDid, componentId, locale }) {
-  const config = await req.getServiceConfig(NODE_SERVICES.AUTH, { componentId });
-  const [invitedUserOnly] = await isInvitedUserOnly(config, node, teamDid);
-  if (invitedUserOnly) {
+async function checkNeedInvite({ req, node, teamDid, locale }) {
+  const { accessPolicyConfig } = await req.getSecurityConfig({ id: SECURITY_RULE_DEFAULT_ID });
+  const isInvitedUserOnly = await checkInvitedUserOnly(accessPolicyConfig, node, teamDid);
+  if (isInvitedUserOnly) {
     throw new ApiError(403, t('needInviteToLogin', locale));
   }
 }
@@ -467,7 +467,6 @@ module.exports = {
       if (error) {
         throw new ApiError(400, error.message);
       }
-      // FIXME: @zhanghan 需要根据 componentId 来判断当前 component 设置的访问权限，来看当前要登录的用户是否有登录的权限
       const blocklet = await req.getBlocklet();
       const { did: teamDid, secret } = await req.getBlockletInfo();
       const currentUser = await verifyUserSig(

package/api/services/auth/index.js

@@ -4,17 +4,9 @@ const cookie = require('cookie');
 const bearerToken = require('@abtnode/util/lib/express-bearer-token');
 
 const validators = require('@blocklet/sdk/lib/validators');
-const {
-  genPermissionName,
-  NODE_SERVICES,
-  WHO_CAN_ACCESS,
-  WHO_CAN_ACCESS_PREFIX_ROLES,
-  ROLES,
-  WELLKNOWN_SERVICE_PATH_PREFIX,
-} = require('@abtnode/constant');
+const { NODE_SERVICES, ROLES, WELLKNOWN_SERVICE_PATH_PREFIX } = require('@abtnode/constant');
 const { BLOCKLET_MODES } = require('@blocklet/constant');
 const { setUserInfoHeaders } = require('@abtnode/auth/lib/auth');
-const { getRolesFromAuthConfig } = require('@blocklet/meta/lib/util');
 
 const { createConnectToDidSpacesRoute } = require('@abtnode/auth/lib/connect-to-did-spaces');
 const logger = require('../../libs/logger')('auth');
@@ -45,7 +37,7 @@ const createSessionRoutes = require('./session');
 const createPassportRoutes = require('./passport');
 const { getRedirectUrl, shouldIgnoreUrl, redirectWithoutCache } = require('../../util');
 const { createConnectToDidSpacesForUserRoute } = require('./connect/connect-to-did-spaces-for-user');
-const { isEmailKycRequired } = require('../../libs/kyc');
+const { isEmailKycRequired, isPhoneKycRequired } = require('../../libs/kyc');
 
 const getTokenFromWsConnect = (req, options) => {
   const cookies = cookie.parse(req.headers.cookie || '');
@@ -90,9 +82,9 @@ const init = ({ node, options }) => {
    * @returns {CheckAuthRes} res
    */
   const checkAuth = async ({ req } = {}) => {
-    const config = (await req.getServiceConfig(NODE_SERVICES.AUTH)) || {};
+    const serviceConfig = (await req.getServiceConfig(NODE_SERVICES.AUTH)) || {};
 
-    const ignoreUrls = (get(config, 'ignoreUrls') || []).filter(Boolean);
+    const ignoreUrls = (get(serviceConfig, 'ignoreUrls') || []).filter(Boolean);
 
     // default public url
     // developers need not config the following urls in blocklet.yml
@@ -105,47 +97,35 @@ const init = ({ node, options }) => {
 
     const teamDid = req.getBlockletDid();
 
-    // 所有人都可以访问的情况
-    if (!config.whoCanAccess || config.whoCanAccess === WHO_CAN_ACCESS.ALL) {
-      if (config.blockUnauthenticated && !req.user) {
-        return {
-          blocked: true,
-          authenticated: false,
-        };
-      }
-    } else if (!req.user) {
-      // 需要被邀请才能访问的情况
-      const rbac = await node.getRBAC(teamDid);
-      const allRoles = await rbac.getRoles(teamDid);
+    const rbac = await node.getRBAC(teamDid);
+    const [allRoles, { accessPolicyConfig }] = await Promise.all([rbac.getRoles(teamDid), req.getSecurityConfig()]);
+
+    const accessRoles = accessPolicyConfig?.accessPolicy?.roles || null;
+    const accessReverse = accessPolicyConfig?.accessPolicy?.reverse || false;
+
+    // public 公开权限，不做任何拦截
+    if (accessRoles === null && accessReverse === false) {
+      return { ignored: true };
+    }
+
+    // invite only, 需要被邀请才能访问的情况
+    // HACK: 不是公开的情况下，就是需要有通行证才能访问，此时只需要判断 req.user 是否存在即可
+    // if (accessRoles.length === 0 && accessReverse === true) {}
+    if (!req.user) {
       const payableRole = allRoles.find((x) => x.extra?.acquire?.pay);
       return {
         blocked: true,
         authenticated: false,
         payable: payableRole?.extra?.acquire?.pay,
       };
-    } else if (config.whoCanAccess === WHO_CAN_ACCESS.OWNER && req.user.role !== ROLES.OWNER) {
-      // 需要 owner 才能访问
-      return {
-        blocked: true,
-        authenticated: true,
-        authorized: false,
-        requiredRoles: [
-          {
-            name: ROLES.OWNER,
-            title: 'Owner',
-            description: 'Owner',
-          },
-        ],
-      };
-    } else if (config.whoCanAccess.startsWith(WHO_CAN_ACCESS_PREFIX_ROLES)) {
-      // 指定 passport 才能访问
-      // 需要用户拥有的权限
-      const roles = getRolesFromAuthConfig(config);
-      if (!roles.includes(req.user.role)) {
-        const rbac = await node.getRBAC(teamDid);
-        // 系统中的所有权限
-        const allRoles = await rbac.getRoles(teamDid);
+    }
 
+    // 指定 role 访问权限
+    if (accessRoles.length > 0) {
+      const roles = accessReverse
+        ? allRoles.filter((role) => !accessRoles.includes(role.name)).map((role) => role.name)
+        : accessRoles;
+      if (!roles.includes(req.user.role)) {
         return {
           blocked: true,
           authenticated: true,
@@ -176,22 +156,6 @@ const init = ({ node, options }) => {
       }
     }
 
-    if (!config.blockUnauthorized) {
-      return { ignored: true, ignoreReason: 'blockUnauthorized' };
-    }
-
-    const rule = await req.getRoutingRule();
-    if (rule.to && rule.to.interfaceName) {
-      const permissionName = genPermissionName(rule.to.interfaceName);
-      const rbac = await node.getRBAC(teamDid);
-
-      if (await rbac.can(req.user.role, ...permissionName.split('_'))) {
-        return {};
-      }
-
-      return { blocked: true, authenticated: true, authorized: false };
-    }
-
     return {};
   };
 
@@ -312,6 +276,7 @@ const init = ({ node, options }) => {
     setUserInfoHeaders(req);
 
     const { blocked } = await checkAuth({ req });
+
     if (blocked) {
       const component = await req.getComponent();
       if (component?.mode === 'development') {
@@ -346,13 +311,23 @@ const init = ({ node, options }) => {
         }
 
         // Security principles: user should not known the reason
-        return res.status(403).json({ code: 403, error: REASON_403 });
+        return res.status(403).json({ code: 403, error: REASON_403, reason: 'email_not_verified' });
+      }
+
+      if (isPhoneKycRequired(blocklet) && !req.user.phoneVerified) {
+        if (req.accepts(['html', 'json']) === 'html') {
+          return redirectWithoutCache(res, getRedirectUrl({ req, pagePath: '/kyc/phone', params: { updateKyc: 1 } }));
+        }
+
+        // Security principles: user should not known the reason
+        return res.status(403).json({ code: 403, error: REASON_403, reason: 'phone_not_verified' });
       }
     }
 
     return next();
   };
 
+  // 检查是否符合访问权限控制，不符合的就进行重定向
   middlewares.checkAuth = async (req, res, next) => {
     res.locals.auth = await checkAuth({ req });
     const { blocked, authenticated, authorized, payable, requiredRoles } = res.locals.auth;
@@ -380,7 +355,11 @@ const init = ({ node, options }) => {
             getRedirectUrl({
               req,
               pagePath: '/login',
-              params: { authenticated: 1, payable, requiredRoles: JSON.stringify(requiredRoles) },
+              params: {
+                authenticated: 1,
+                payable,
+                requiredRoles: JSON.stringify(requiredRoles),
+              },
             })
           );
         } else {

package/api/services/kyc/index.js

@@ -1,14 +1,53 @@
 const { WELLKNOWN_SERVICE_PATH_PREFIX, VERIFY_CODE_TTL } = require('@abtnode/constant');
-const { LOGIN_PROVIDER } = require('@blocklet/constant');
+const createTranslator = require('@abtnode/util/lib/translate');
 
 const { emailSchema } = require('../../socket/channel/did');
 const { sendEmail } = require('../../libs/email');
-const { isEmailKycRequired, isEmailUniqueRequired, isEmailBlocked, isEmailAllowed } = require('../../libs/kyc');
+const { isEmailBlocked, isEmailAllowed } = require('../../libs/kyc');
 
 const logger = require('../../libs/logger')('kyc');
 
+const translations = {
+  en: {
+    emailInvalid: 'Email is invalid',
+    emailAlreadyVerified:
+      'This email has already been verified. You can recover the verification NFT from your DID Wallet.',
+    emailNotAllowed:
+      "Sorry, we can't accept email addresses from this domain. Please use an email address from a different provider.",
+    emailBlocked: "We're unable to use this email address. Please try a different email address from another provider.",
+    emailSendSuccess: 'Verify code successfully sent',
+    emailAlreadySent:
+      "We've already sent a verification email. Please check your inbox or spam folder. If you don't see it, you can try again in a few minutes.",
+    emailVerifySuccess: 'Email is successfully verified',
+    emailTitle: 'Verify Your Email for {appName}',
+    emailHeadline:
+      'To ensure the security of your account and enhance your experience, you need to use following code to verify your email, and you will receive a NFT in your DID Wallet upon verification.',
+    emailValidCode:
+      "This code is valid for {ttl} minutes. If you don't want to verify your email, you can ignore this message.",
+    emailWarning:
+      '{appName} will never email you and ask you to disclose your password, credit card, or banking account number.',
+  },
+  zh: {
+    emailInvalid: '邮箱格式不正确',
+    emailAlreadyVerified: '此邮箱已验证。您可以从 DID 钱包中恢复验证证书。',
+    emailNotAllowed: '对不起，我们不接受此域名的电子邮件地址。请使用来自不同提供商的电子邮件地址。',
+    emailBlocked: '我们无法使用此电子邮件地址。请尝试使用来自不同提供商的电子邮件地址。',
+    emailSendSuccess: '验证码发送成功',
+    emailAlreadySent: '我们已发送验证电子邮件。请检查您的收件箱或垃圾邮件文件夹。如果您没有看到它，您可以稍后再试。',
+    emailVerifySuccess: '邮箱验证成功',
+    emailTitle: '验证您在 {appName} 的邮箱',
+    emailHeadline:
+      '为确保您的帐户安全并增强您的体验，您需要使用以下代码验证您的邮箱，并在验证后在您的 DID 钱包中收到 NFT。',
+    emailValidCode: '此代码有效期为 {ttl} 分钟。如果您不想验证您的邮箱，您可以忽略此消息。',
+    emailWarning: '{appName} 永远不会向您发送电子邮件并要求您披露您的密码、信用卡或银行账户信息。',
+  },
+};
+
+const t = createTranslator({ translations });
+
 const init = ({ node }) => {
   const onStartEmailVerify = async (req, res) => {
+    const { locale = 'en' } = req.query;
     try {
       const [blocklet, info] = await Promise.all([req.getBlocklet(), req.getBlockletInfo()]);
       const teamDid = blocklet.meta.did;
@@ -16,28 +55,14 @@ const init = ({ node }) => {
       const { error, value: subject } = emailSchema.validate(req.body.email);
 
       if (error) {
-        return res.status(400).send({ error: 'Email is invalid', code: 'email_invalid' });
+        return res.status(400).send({ error: t('emailInvalid', locale), code: 'email_invalid' });
       }
 
-      if (isEmailUniqueRequired(blocklet)) {
-        if (
-          await node.isEmailUsed({
-            teamDid,
-            email: subject,
-            verified: isEmailKycRequired(blocklet),
-            sourceProvider: LOGIN_PROVIDER.WALLET,
-          })
-        ) {
-          return res.status(400).send({
-            error: 'This email address is already in use. Please try a different email address.',
-            code: 'email_already_used',
-          });
-        }
-
-        if (await node.isSubjectIssued({ teamDid, subject })) {
+      // Do not issue duplicate email nft to same user
+      if (req.user) {
+        if (await node.isSubjectIssued({ teamDid, userDid: req.user.did, subject })) {
           return res.status(400).send({
-            error:
-              'This email has already been verified. You can log in using your DID Wallet or recover your certificate from the login page.',
+            error: t('emailAlreadyVerified', locale),
             code: 'email_already_verified',
           });
         }
@@ -47,8 +72,7 @@ const init = ({ node }) => {
       if (!isAllowed) {
         logger.warn('Email domain is not allowed', { teamDid, subject });
         return res.status(400).send({
-          error:
-            "Sorry, we can't accept email addresses from this domain. Please use an email address from a different provider.",
+          error: t('emailNotAllowed', locale),
           code: 'email_not_allowed',
         });
       }
@@ -57,15 +81,14 @@ const init = ({ node }) => {
       if (isBlocked) {
         logger.warn('Email domain is blocked', { teamDid, subject });
         return res.status(400).send({
-          error: "We're unable to use this email address. Please try a different email address from another provider.",
+          error: t('emailBlocked', locale),
           code: 'email_blocked',
         });
       }
 
       if (await node.isSubjectSent({ teamDid, subject })) {
         return res.status(400).send({
-          error:
-            "We've already sent a verification email. Please check your inbox or spam folder. If you don't see it, you can try again in a few minutes.",
+          error: t('emailAlreadySent', locale),
           code: 'email_already_sent',
         });
       }
@@ -76,11 +99,11 @@ const init = ({ node }) => {
       const result = await sendEmail(
         subject,
         {
-          title: `Verify Your Email on ${info.name}`,
-          body: `<p style="font-size:14px;line-height:24px;margin:16px 0;">To ensure the security of your account and enhance your experience, you need to use following code to verify your email, and you will receive a certificate in your DID Wallet upon verification.</p>
+          title: t('emailTitle', locale, { appName: info.name }),
+          body: `<p style="font-size:14px;line-height:24px;margin:16px 0;">${t('emailHeadline', locale)}</p>
           <p style="font-size:36px; line-height:24px; color: #333; font-weight: bold; text-align: center;">${doc.code}</p>
-          <p style="font-size:14px;line-height:24px;margin:16px 0;">This code is valid for ${VERIFY_CODE_TTL / 60 / 1000} minutes. If you don't want to verify your email, you can ignore this message.</p>
-          <p style="font-size:14px;line-height:24px;margin:16px 0;">${info.name} will never email you and ask you to disclose your password, credit card, or banking account number. </p>`,
+          <p style="font-size:14px;line-height:24px;margin:16px 0;">${t('emailValidCode', locale, { ttl: VERIFY_CODE_TTL / 60 / 1000 })}</p>
+          <p style="font-size:14px;line-height:24px;margin:16px 0;">${t('emailWarning', locale, { appName: info.name })}</p>`,
         },
         {
           teamDid,
@@ -92,7 +115,7 @@ const init = ({ node }) => {
       logger.info('send verify code', { teamDid, result });
       await node.sendVerifyCode({ teamDid, code: doc.code });
 
-      return res.status(200).send({ message: 'Verify code successfully sent' });
+      return res.status(200).send({ message: t('emailSendSuccess', locale) });
     } catch (error) {
       logger.error('Send mail failed', { error });
       return res.status(400).send(error.message);
@@ -100,6 +123,7 @@ const init = ({ node }) => {
   };
 
   const onEndEmailVerify = async (req, res) => {
+    const { locale = 'en' } = req.query;
     try {
       const blocklet = await req.getBlocklet();
       const teamDid = blocklet.meta.did;
@@ -108,7 +132,7 @@ const init = ({ node }) => {
       const result = await node.consumeVerifyCode({ teamDid, code });
       logger.info('consume verify code', { teamDid, code, result });
 
-      return res.status(200).send({ message: 'Email is successfully verified' });
+      return res.status(200).send({ message: t('emailVerifySuccess', locale) });
     } catch (error) {
       logger.error('Verify mail failed', { error });
       return res.status(400).send(error.message);