@abtnode/blocklet-services 1.16.34-beta-20241204-140321-4d75ca21 → 1.16.34-beta-20241205-145120-3a7aa096

package/api/libs/connect/session.js

@@ -52,7 +52,7 @@ const { getKycClaims, verifyKycClaims, getPassportVc, isProfileUrlSupported, get
 const { getTrustedIssuers, getFederatedTrustedIssuers } = require('../../util/blocklet-utils');
 const {
   getUserAvatarUrl,
-  migrateAuth0,
+  migrateFederatedAccount,
   getFederatedMaster,
   shouldSyncFederated,
   getUserWithinFederated,
@@ -533,7 +533,7 @@ module.exports = {
         appPid: teamDid,
         passportId: passport?.id,
         status: 'online',
-        ua,
+        ua: null,
         lastLoginIp,
         extra: {
           walletOS,
@@ -549,13 +549,13 @@ module.exports = {
             data: {
               users: [
                 {
+                  action: 'connectAccount',
                   did: updatedUser.did,
                   pk: updatedUser.pk,
                   fullName: updatedUser.fullName,
                   email: updatedUser.email || '',
                   avatar: getUserAvatarUrl(updatedUser.avatar, blocklet),
                   connectedAccount: [connectAccount, connectedNft],
-                  action: 'connectAccount',
                   sourceAppPid: sourceAppPid || masterSite.appPid,
                   inviter: updatedUser.inviter,
                   generation: updatedUser.generation,
@@ -1182,7 +1182,7 @@ module.exports = {
       });
 
       if (sourceAppPid) {
-        await migrateAuth0({
+        await migrateFederatedAccount({
           // 目前只允许未注册过的钱包绑定 auth0，所以直接传入钱包生成的 userDid 和 userPk
           toUserDid: userDid,
           toUserPk: userPk,

package/api/middlewares/check-federated.js

@@ -0,0 +1,157 @@
+const jwt = require('@arcblock/jwt');
+const { isMaster, getFederatedMaster } = require('@abtnode/auth/lib/util/federated');
+const { getVerifyData, verify } = require('@blocklet/sdk/lib/util/verify-sign');
+const { SIG_VERSION } = require('@blocklet/constant');
+const logger = require('../libs/logger')('check-federated');
+
+/**
+ * 检查站点群的调用权限
+ * @param {object} options
+ * @param {'all'|'masterToMember'|'memberToMaster'} options.mode
+ * @param {Array<'pending'|'approved'|'rejected'|'revoked'>} options.allowStatus
+ */
+function checkFederatedCall({ mode = 'all', allowStatus = ['approved', 'revoked'] } = {}) {
+  return (req, res, next) => {
+    const { blocklet } = req;
+    if (!blocklet) {
+      res.status(400).send('blocklet not exists');
+      return;
+    }
+
+    const { sig, data, sigPk } = getVerifyData(req, 'blocklet');
+
+    if (!(sig && data && sigPk)) {
+      res.status(400).send('missing sig or data or sigPk');
+    }
+
+    const masterSite = getFederatedMaster(blocklet);
+
+    if (masterSite) {
+      if (mode === 'memberToMaster') {
+        if (masterSite.appPid !== blocklet.appPid) {
+          res.status(403).send('Only master can handle this request');
+          return;
+        }
+      } else if (mode === 'masterToMember') {
+        if (masterSite.appPid === blocklet.appPid) {
+          res.status(403).send('Only member can handle this request');
+          return;
+        }
+      }
+    }
+
+    const federated = blocklet?.settings?.federated || {};
+    const sites = federated?.sites || [];
+
+    const validSite = sites.find((siteItem) => {
+      const valid = siteItem.pk === sigPk;
+      if (!valid) return false;
+
+      // master 发过来的请求，无条件信任（后面会检查签名）
+      if (isMaster(siteItem)) return true;
+      if (mode === 'masterToMember') return false;
+      if (!allowStatus.includes(siteItem.status)) return false;
+      return true;
+    });
+    if (!validSite) {
+      res.status(401).send('Unauthorized');
+      return;
+    }
+
+    const verified = verify(data, sig, {
+      appPk: sigPk,
+    });
+    if (!verified) {
+      logger.error('verify blocklet sig failed', { data, sig });
+      res.status(401).send('verify sig failed');
+      return;
+    }
+
+    req.verifySite = validSite;
+    req.verifyData = req.body;
+
+    next();
+  };
+}
+
+// DEPRECATED: @zhanghan 在 1.16.35 发布时移除旧版本的兼容
+function checkFederatedCallLegacy({ mode = 'all', allowStatus = ['approved', 'revoked'] } = {}) {
+  return (req, res, next) => {
+    const { blocklet } = req;
+    if (!blocklet) {
+      res.status(400).send('blocklet not exists');
+      return;
+    }
+
+    const { signer, data } = req.body;
+
+    if (!signer || !data) {
+      res.status(400).send('missing signer or signed data');
+      return;
+    }
+
+    const masterSite = getFederatedMaster(blocklet);
+
+    if (masterSite) {
+      if (mode === 'memberToMaster') {
+        if (masterSite.appPid !== blocklet.appPid) {
+          res.status(403).send('Only master can handle this request');
+          return;
+        }
+      } else if (mode === 'masterToMember') {
+        if (masterSite.appPid === blocklet.appPid) {
+          res.status(403).send('Only member can handle this request');
+          return;
+        }
+      }
+    }
+
+    const federated = blocklet?.settings?.federated || {};
+    const sites = federated?.sites || [];
+
+    const validSite = sites.find((siteItem) => {
+      const valid = siteItem.appPid === signer;
+      if (!valid) return false;
+
+      // master 发过来的请求，无条件信任（后面会检查签名）
+      if (isMaster(siteItem)) return true;
+      if (mode === 'masterToMember') return false;
+      if (!allowStatus.includes(siteItem.status)) return false;
+      return true;
+    });
+
+    if (!validSite) {
+      res.status(401).send('Unauthorized');
+      return;
+    }
+
+    if (!jwt.verify(data, validSite.pk)) {
+      res.status(401).send('Invalid signature during federated call');
+      return;
+    }
+
+    req.verifyData = jwt.decode(data);
+    req.verifySite = validSite;
+    next();
+  };
+}
+
+function checkFederatedCallWrapper(options) {
+  return (req, res, next) => {
+    const { blocklet } = req;
+    if (!blocklet) {
+      res.status(400).send('blocklet not exists');
+      return;
+    }
+
+    const { sigVersion } = getVerifyData(req, 'blocklet');
+
+    if (sigVersion === SIG_VERSION.DEFAULT) {
+      checkFederatedCall(options)(req, res, next);
+    } else if (sigVersion === SIG_VERSION.V0) {
+      checkFederatedCallLegacy(options)(req, res, next);
+    }
+  };
+}
+
+module.exports = { checkFederatedCall: checkFederatedCallWrapper };