@abtnode/blocklet-services 1.16.34-beta-20241204-140321-4d75ca21 → 1.16.34-beta-20241206-124652-493dbc39

package/api/libs/connect/session.js

@@ -52,7 +52,7 @@ const { getKycClaims, verifyKycClaims, getPassportVc, isProfileUrlSupported, get
 const { getTrustedIssuers, getFederatedTrustedIssuers } = require('../../util/blocklet-utils');
 const {
   getUserAvatarUrl,
-  migrateAuth0,
+  migrateFederatedAccount,
   getFederatedMaster,
   shouldSyncFederated,
   getUserWithinFederated,
@@ -533,7 +533,7 @@ module.exports = {
         appPid: teamDid,
         passportId: passport?.id,
         status: 'online',
-        ua,
+        ua: null,
         lastLoginIp,
         extra: {
           walletOS,
@@ -549,13 +549,13 @@ module.exports = {
             data: {
               users: [
                 {
+                  action: 'connectAccount',
                   did: updatedUser.did,
                   pk: updatedUser.pk,
                   fullName: updatedUser.fullName,
                   email: updatedUser.email || '',
                   avatar: getUserAvatarUrl(updatedUser.avatar, blocklet),
                   connectedAccount: [connectAccount, connectedNft],
-                  action: 'connectAccount',
                   sourceAppPid: sourceAppPid || masterSite.appPid,
                   inviter: updatedUser.inviter,
                   generation: updatedUser.generation,
@@ -1182,7 +1182,7 @@ module.exports = {
       });
 
       if (sourceAppPid) {
-        await migrateAuth0({
+        await migrateFederatedAccount({
           // 目前只允许未注册过的钱包绑定 auth0，所以直接传入钱包生成的 userDid 和 userPk
           toUserDid: userDid,
           toUserPk: userPk,

package/api/libs/open-graph/index.js

@@ -87,7 +87,7 @@ const getOgImage = ({ input, info, cacheDir, format, tmpDir }) => {
   const color = getPassportColor(info.passportColor, info.did);
   const { value, error } = schema.validate(input);
   if (error) {
-    throw new Error(`open graph service params invalid: ${formatError(error)}`);
+    throw new CustomError(400, `open graph service params invalid: ${formatError(error)}`);
   }
   if (value.template === 'cover') {
     if (value.title && !value.description) {

package/api/middlewares/check-federated.js

@@ -0,0 +1,157 @@
+const jwt = require('@arcblock/jwt');
+const { isMaster, getFederatedMaster } = require('@abtnode/auth/lib/util/federated');
+const { getVerifyData, verify } = require('@blocklet/sdk/lib/util/verify-sign');
+const { SIG_VERSION } = require('@blocklet/constant');
+const logger = require('../libs/logger')('check-federated');
+
+/**
+ * 检查站点群的调用权限
+ * @param {object} options
+ * @param {'all'|'masterToMember'|'memberToMaster'} options.mode
+ * @param {Array<'pending'|'approved'|'rejected'|'revoked'>} options.allowStatus
+ */
+function checkFederatedCall({ mode = 'all', allowStatus = ['approved', 'revoked'] } = {}) {
+  return (req, res, next) => {
+    const { blocklet } = req;
+    if (!blocklet) {
+      res.status(400).send('blocklet not exists');
+      return;
+    }
+
+    const { sig, data, sigPk } = getVerifyData(req, 'blocklet');
+
+    if (!(sig && data && sigPk)) {
+      res.status(400).send('missing sig or data or sigPk');
+    }
+
+    const masterSite = getFederatedMaster(blocklet);
+
+    if (masterSite) {
+      if (mode === 'memberToMaster') {
+        if (masterSite.appPid !== blocklet.appPid) {
+          res.status(403).send('Only master can handle this request');
+          return;
+        }
+      } else if (mode === 'masterToMember') {
+        if (masterSite.appPid === blocklet.appPid) {
+          res.status(403).send('Only member can handle this request');
+          return;
+        }
+      }
+    }
+
+    const federated = blocklet?.settings?.federated || {};
+    const sites = federated?.sites || [];
+
+    const validSite = sites.find((siteItem) => {
+      const valid = siteItem.pk === sigPk;
+      if (!valid) return false;
+
+      // master 发过来的请求，无条件信任（后面会检查签名）
+      if (isMaster(siteItem)) return true;
+      if (mode === 'masterToMember') return false;
+      if (!allowStatus.includes(siteItem.status)) return false;
+      return true;
+    });
+    if (!validSite) {
+      res.status(401).send('Unauthorized');
+      return;
+    }
+
+    const verified = verify(data, sig, {
+      appPk: sigPk,
+    });
+    if (!verified) {
+      logger.error('verify blocklet sig failed', { data, sig });
+      res.status(401).send('verify sig failed');
+      return;
+    }
+
+    req.verifySite = validSite;
+    req.verifyData = req.body;
+
+    next();
+  };
+}
+
+// DEPRECATED: @zhanghan 在 1.16.35 发布时移除旧版本的兼容
+function checkFederatedCallLegacy({ mode = 'all', allowStatus = ['approved', 'revoked'] } = {}) {
+  return (req, res, next) => {
+    const { blocklet } = req;
+    if (!blocklet) {
+      res.status(400).send('blocklet not exists');
+      return;
+    }
+
+    const { signer, data } = req.body;
+
+    if (!signer || !data) {
+      res.status(400).send('missing signer or signed data');
+      return;
+    }
+
+    const masterSite = getFederatedMaster(blocklet);
+
+    if (masterSite) {
+      if (mode === 'memberToMaster') {
+        if (masterSite.appPid !== blocklet.appPid) {
+          res.status(403).send('Only master can handle this request');
+          return;
+        }
+      } else if (mode === 'masterToMember') {
+        if (masterSite.appPid === blocklet.appPid) {
+          res.status(403).send('Only member can handle this request');
+          return;
+        }
+      }
+    }
+
+    const federated = blocklet?.settings?.federated || {};
+    const sites = federated?.sites || [];
+
+    const validSite = sites.find((siteItem) => {
+      const valid = siteItem.appPid === signer;
+      if (!valid) return false;
+
+      // master 发过来的请求，无条件信任（后面会检查签名）
+      if (isMaster(siteItem)) return true;
+      if (mode === 'masterToMember') return false;
+      if (!allowStatus.includes(siteItem.status)) return false;
+      return true;
+    });
+
+    if (!validSite) {
+      res.status(401).send('Unauthorized');
+      return;
+    }
+
+    if (!jwt.verify(data, validSite.pk)) {
+      res.status(401).send('Invalid signature during federated call');
+      return;
+    }
+
+    req.verifyData = jwt.decode(data);
+    req.verifySite = validSite;
+    next();
+  };
+}
+
+function checkFederatedCallWrapper(options) {
+  return (req, res, next) => {
+    const { blocklet } = req;
+    if (!blocklet) {
+      res.status(400).send('blocklet not exists');
+      return;
+    }
+
+    const { sigVersion } = getVerifyData(req, 'blocklet');
+
+    if (sigVersion === SIG_VERSION.DEFAULT) {
+      checkFederatedCall(options)(req, res, next);
+    } else if (sigVersion === SIG_VERSION.V0) {
+      checkFederatedCallLegacy(options)(req, res, next);
+    }
+  };
+}
+
+module.exports = { checkFederatedCall: checkFederatedCallWrapper };

package/api/routes/blocklet.js

@@ -58,6 +58,10 @@ const polishBlocklet = (doc) => {
 };
 
 const prefix = WELLKNOWN_SERVICE_PATH_PREFIX;
+const staticDir =
+  process.env.NODE_ENV === 'production'
+    ? path.resolve(__dirname, '../../dist')
+    : path.resolve(__dirname, '../../public');
 
 module.exports = {
   init(server, node) {
@@ -540,23 +544,25 @@ module.exports = {
       try {
         const { type } = req.params;
         const blocklet = await req.getBlocklet();
-
         const appSplash = get(blocklet, `environmentObj.BLOCKLET_APP_SPLASH_${type.toUpperCase()}`);
-        const splashFile = path.join(get(blocklet, 'env.dataDir'), appSplash);
-        if (fs.existsSync(splashFile)) {
-          if (isImageRequest(req)) {
-            const appDir = getAppImageCacheDir(blocklet.env.cacheDir);
-            processAndRespond(req, res, appDir, () => {
-              stream = fs.createReadStream(splashFile);
-              return Promise.resolve([stream, path.extname(splashFile).slice(1)]);
-            });
+        if (appSplash) {
+          const splashFile = path.join(get(blocklet, 'env.dataDir'), appSplash);
+          if (fs.existsSync(splashFile)) {
+            if (isImageRequest(req)) {
+              const appDir = getAppImageCacheDir(blocklet.env.cacheDir);
+              processAndRespond(req, res, appDir, () => {
+                stream = fs.createReadStream(splashFile);
+                return Promise.resolve([stream, path.extname(splashFile).slice(1)]);
+              });
+            } else {
+              const cache = req.query.nocache !== '1';
+              res.sendFile(splashFile, cache ? { maxAge: '365d', immutable: true } : { maxAge: 0 });
+            }
           } else {
-            const cache = req.query.nocache !== '1';
-            res.sendFile(splashFile, cache ? { maxAge: '365d', immutable: true } : { maxAge: 0 });
+            res.sendFile(`/images/splash-${type}.png`, { root: staticDir, maxAge: '1h' });
           }
         } else {
-          // FIXME: send fallback splash image
-          res.status(404).send('splash image not found');
+          res.sendFile(`/images/splash-${type}.png`, { root: staticDir, maxAge: '1h' });
         }
       } catch (err) {
         stream?.destroy();