@abtnode/blocklet-services 1.16.41-beta-20250325-154552-2bf78c26 → 1.16.41-beta-20250329-232306-53c45e3b

package/api/emails/_components/actions.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const jsx_runtime_1 = require("react/jsx-runtime");
+const components_1 = require("@react-email/components");
+const style_1 = require("../_libs/style");
+function Actions({ actions, }) {
+    return actions.length > 0 ? ((0, jsx_runtime_1.jsx)(components_1.Section, { style: style_1.actionsStyle, children: actions.map((item, index) => ((0, jsx_runtime_1.jsx)(components_1.Button, { href: item.link, target: "_blank", style: Object.assign(Object.assign({}, style_1.actionStyle), { padding: '6px 12px' }), children: item.title || item.name }, index))) })) : null;
+}
+exports.default = Actions;

package/api/emails/{components → _components}/article.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const jsx_runtime_1 = require("react/jsx-runtime");
 const components_1 = require("@react-email/components");
-const chain_1 = require("../libs/chain");
+const chain_1 = require("../_libs/chain");
 function Article({ data, }) {
     const host = (0, chain_1.getUrlHost)(data.url);
     return ((0, jsx_runtime_1.jsxs)("a", { href: data.url, target: "_blank", style: {

package/api/emails/{components → _components}/asset.js

@@ -2,8 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const jsx_runtime_1 = require("react/jsx-runtime");
 const components_1 = require("@react-email/components");
-const chain_1 = require("../libs/chain");
-const style_1 = require("../libs/style");
+const chain_1 = require("../_libs/chain");
+const style_1 = require("../_libs/style");
 function Asset({ locale, data, }) {
     const title = { zh: '接收', en: 'Received' }[locale] || 'Received';
     const chainHost = (0, chain_1.getUrlHost)(data.chainHost) || (0, chain_1.getChainHost)(data.chainId);

package/api/emails/{components → _components}/attachments.js

@@ -11,42 +11,44 @@ const compose_1 = __importDefault(require("./compose"));
 const transaction_1 = __importDefault(require("./transaction"));
 const dapp_1 = __importDefault(require("./dapp"));
 const article_1 = __importDefault(require("./article"));
-const style_1 = require("../libs/style");
+const style_1 = require("../_libs/style");
 function Attachments({ locale, severity = 'normal', attachments = [], }) {
-    const attachmentList = attachments.map((item) => {
+    const attachmentList = attachments
+        .map((item, index) => {
         switch (item.type) {
             case 'text':
                 return item.data.type === 'plain' ? ((0, jsx_runtime_1.jsx)(components_1.Text, { style: {
                         color: item.data.color || 'initial',
                         fontSize: { small: '12px', normal: '14px', large: '16px' }[item.data.size || 'normal'],
                         whiteSpace: 'pre-line!important',
-                    }, children: item.data.text })) : null;
+                    }, children: item.data.text }, `${item.type}-${index}`)) : null;
             case 'image':
                 return ((0, jsx_runtime_1.jsx)(components_1.Img, { src: item.data.url, alt: item.data.alt, style: {
                         width: '100%',
                         height: '150px',
                         objectFit: 'contain',
                         objectPosition: 'left center',
-                    } }));
+                    } }, `${item.type}-${index}`));
             case 'token':
-                return (0, jsx_runtime_1.jsx)(token_1.default, { data: item.data, locale: locale });
+                return (0, jsx_runtime_1.jsx)(token_1.default, { data: item.data, locale: locale }, `${item.type}-${index}`);
             case 'transaction':
-                return (0, jsx_runtime_1.jsx)(transaction_1.default, { data: item.data, locale: locale });
+                return (0, jsx_runtime_1.jsx)(transaction_1.default, { data: item.data, locale: locale }, `${item.type}-${index}`);
             case 'dapp':
-                return (0, jsx_runtime_1.jsx)(dapp_1.default, { data: item.data });
+                return (0, jsx_runtime_1.jsx)(dapp_1.default, { data: item.data }, `${item.type}-${index}`);
             case 'link':
-                return (0, jsx_runtime_1.jsx)(article_1.default, { data: item.data });
+                return (0, jsx_runtime_1.jsx)(article_1.default, { data: item.data }, `${item.type}-${index}`);
             case 'divider':
-                return (0, jsx_runtime_1.jsx)(components_1.Hr, {});
+                return (0, jsx_runtime_1.jsx)(components_1.Hr, {}, `${item.type}-${index}`);
             case 'vc':
             case 'asset':
-                return (0, jsx_runtime_1.jsx)(asset_1.default, { data: item.data, locale: locale });
+                return (0, jsx_runtime_1.jsx)(asset_1.default, { data: item.data, locale: locale }, `${item.type}-${index}`);
             case 'section':
-                return (0, jsx_runtime_1.jsx)(compose_1.default, { data: item.fields });
+                return (0, jsx_runtime_1.jsx)(compose_1.default, { data: item.fields }, `${item.type}-${index}`);
             default:
                 return null;
         }
-    });
-    return ((0, jsx_runtime_1.jsx)(components_1.Section, { style: Object.assign(Object.assign({}, style_1.attachmentsStyle), { borderColor: style_1.severityColorMap[severity] || style_1.severityColorMap.normal }), children: attachmentList }));
+    })
+        .filter(Boolean);
+    return attachmentList.length > 0 ? ((0, jsx_runtime_1.jsx)(components_1.Section, { style: Object.assign(Object.assign({}, style_1.attachmentsStyle), { borderColor: style_1.severityColorMap[severity] || style_1.severityColorMap.normal }), children: attachmentList })) : null;
 }
 exports.default = Attachments;

package/api/emails/{components → _components}/compose.js

@@ -12,10 +12,10 @@ function Compose({ data }) {
         const firstCol = data[i];
         const secondCol = data[i + 1];
         if (firstCol && secondCol) {
-            content.push((0, jsx_runtime_1.jsxs)("tr", { children: [(0, jsx_runtime_1.jsx)("td", { children: (0, jsx_runtime_1.jsx)(ComposeItem, { data: firstCol.data, style: { whiteSpace: 'nowrap' } }) }), (0, jsx_runtime_1.jsx)("td", { children: (0, jsx_runtime_1.jsx)(ComposeItem, { data: secondCol.data, style: { wordBreak: 'break-all' } }) })] }));
+            content.push((0, jsx_runtime_1.jsxs)("tr", { children: [(0, jsx_runtime_1.jsx)("td", { children: (0, jsx_runtime_1.jsx)(ComposeItem, { data: firstCol.data, style: { whiteSpace: 'nowrap' } }) }), (0, jsx_runtime_1.jsx)("td", { children: (0, jsx_runtime_1.jsx)(ComposeItem, { data: secondCol.data, style: { wordBreak: 'break-all' } }) })] }, i));
         }
         else if (firstCol) {
-            content.push((0, jsx_runtime_1.jsx)("tr", { children: (0, jsx_runtime_1.jsx)("td", { children: (0, jsx_runtime_1.jsx)(ComposeItem, { data: firstCol.data }) }) }));
+            content.push((0, jsx_runtime_1.jsx)("tr", { children: (0, jsx_runtime_1.jsx)("td", { children: (0, jsx_runtime_1.jsx)(ComposeItem, { data: firstCol.data }) }) }, i));
         }
         i += 2;
     }

package/api/emails/_components/content.js

@@ -0,0 +1,15 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const jsx_runtime_1 = require("react/jsx-runtime");
+const components_1 = require("@react-email/components");
+const attachments_1 = __importDefault(require("./attachments"));
+const actions_1 = __importDefault(require("./actions"));
+const highlight_1 = require("../_libs/highlight");
+const style_1 = require("../_libs/style");
+function Content({ title, content, attachments = [], actions = [], style = {}, locale, raw = false, severity = 'normal', body = null, }) {
+    return ((0, jsx_runtime_1.jsxs)(components_1.Section, { style: style, children: [title ? (0, jsx_runtime_1.jsx)(components_1.Heading, { style: style_1.h1Style, children: title }) : null, content ? ((0, jsx_runtime_1.jsx)(components_1.Text, { className: "content", style: { whiteSpace: 'pre-line!important' }, dangerouslySetInnerHTML: { __html: raw ? content : (0, highlight_1.toClickableSpan)(content) } })) : null, body, (0, jsx_runtime_1.jsx)(attachments_1.default, { severity: severity, attachments: attachments, locale: locale }), (0, jsx_runtime_1.jsx)(actions_1.default, { actions: actions })] }));
+}
+exports.default = Content;

package/api/emails/{components → _components}/footer.js

@@ -10,7 +10,7 @@ const components_1 = require("@react-email/components");
 const constant_1 = require("@abtnode/constant");
 const copyright_1 = __importDefault(require("./copyright"));
 const powered_by_1 = __importDefault(require("./powered-by"));
-const style_1 = require("../libs/style");
+const style_1 = require("../_libs/style");
 function Footer({ showLogo = false, showCopyright = false, showBlocklet = true, appInfo, locale = 'en', unsubscribeToken, userInfo, poweredBy, }) {
     const userInfoName = (userInfo === null || userInfo === void 0 ? void 0 : userInfo.fullName) || (userInfo === null || userInfo === void 0 ? void 0 : userInfo.email);
     const userInfoDescription = userInfo === null || userInfo === void 0 ? void 0 : userInfo.did;

package/api/emails/{components → _components}/powered-by.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const jsx_runtime_1 = require("react/jsx-runtime");
 const components_1 = require("@react-email/components");
-const style_1 = require("../libs/style");
+const style_1 = require("../_libs/style");
 function PoweredBy(props) {
     const content = props.url ? ((0, jsx_runtime_1.jsx)(components_1.Link, { href: props.url, target: "_blank", style: Object.assign(Object.assign({}, style_1.linkStyle), { color: '#898989' }), children: props.name })) : (props.name);
     return ((0, jsx_runtime_1.jsxs)(components_1.Text, { style: {

package/api/emails/{components → _components}/token.js

@@ -2,8 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const jsx_runtime_1 = require("react/jsx-runtime");
 const components_1 = require("@react-email/components");
-const chain_1 = require("../libs/chain");
-const style_1 = require("../libs/style");
+const chain_1 = require("../_libs/chain");
+const style_1 = require("../_libs/style");
 function Token({ locale, data, }) {
     const showAddress = data.address.slice(0, 4) + '...' + data.address.slice(-4);
     const from = { zh: '来自', en: 'from' }[locale] || 'from';

package/api/emails/{components → _components}/transaction.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const jsx_runtime_1 = require("react/jsx-runtime");
-const chain_1 = require("../libs/chain");
+const chain_1 = require("../_libs/chain");
 function Transaction({ locale, data, }) {
     const chainHost = (0, chain_1.getChainHost)(data.chainId);
     const url = `https://${chainHost}/explorer/txs/${data.hash}`;

package/api/emails/{pages → _templates}/notification.js

@@ -6,16 +6,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.NotificationEmail = void 0;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const components_1 = require("@react-email/components");
-const footer_1 = __importDefault(require("../components/footer"));
-const content_1 = __importDefault(require("../components/content"));
-const layout_1 = __importDefault(require("../components/layout"));
-const header_1 = __importDefault(require("../components/header"));
-const NotificationEmail = ({ title, body = '', raw = false, // do not convert body to clickable span
-subject, attachments = [], actions = [], appInfo, locale = 'en', severity = 'normal', unsubscribeToken, userInfo, poweredBy, }) => {
-    return ((0, jsx_runtime_1.jsxs)(layout_1.default, { mainStyle: main, subject: subject, children: [(0, jsx_runtime_1.jsx)(components_1.Preview, { children: subject }), (0, jsx_runtime_1.jsx)(header_1.default, { appInfo: appInfo }), (0, jsx_runtime_1.jsx)(content_1.default, { style: container, title: title, content: body, attachments: attachments, actions: actions, locale: locale, severity: severity, raw: raw }), (0, jsx_runtime_1.jsx)(footer_1.default, { showCopyright: false, poweredBy: poweredBy, showBlocklet: true, appInfo: appInfo, locale: locale, unsubscribeToken: unsubscribeToken, userInfo: userInfo })] }));
-};
-exports.NotificationEmail = NotificationEmail;
-exports.default = exports.NotificationEmail;
+const footer_1 = __importDefault(require("../_components/footer"));
+const content_1 = __importDefault(require("../_components/content"));
+const layout_1 = __importDefault(require("../_components/layout"));
+const header_1 = __importDefault(require("../_components/header"));
 const fontFamily = 'HelveticaNeue,Helvetica,Arial,sans-serif';
 const main = {
     fontFamily,
@@ -25,3 +19,9 @@ const container = {
     backgroundColor: '#ffffff',
     padding: '5px 50px 30px 60px',
 };
+const NotificationEmail = ({ title, body = '', raw = false, // do not convert body to clickable span
+subject, attachments = [], actions = [], appInfo, locale = 'en', severity = 'normal', unsubscribeToken, userInfo, poweredBy, }) => {
+    return ((0, jsx_runtime_1.jsxs)(layout_1.default, { mainStyle: main, subject: subject, children: [(0, jsx_runtime_1.jsx)(components_1.Preview, { children: subject }), (0, jsx_runtime_1.jsx)(header_1.default, { appInfo: appInfo }), (0, jsx_runtime_1.jsx)(content_1.default, { style: container, title: title, content: body, attachments: attachments, actions: actions, locale: locale, severity: severity, raw: raw }), (0, jsx_runtime_1.jsx)(footer_1.default, { showCopyright: false, poweredBy: poweredBy, showBlocklet: true, appInfo: appInfo, locale: locale, unsubscribeToken: unsubscribeToken, userInfo: userInfo })] }));
+};
+exports.NotificationEmail = NotificationEmail;
+exports.default = exports.NotificationEmail;

package/api/emails/_templates/verify-code-body.js

@@ -0,0 +1,49 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VerifyCodeBody = VerifyCodeBody;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const components_1 = require("@react-email/components");
+// @ts-ignore
+const constant_1 = require("@abtnode/constant");
+const actions_1 = __importDefault(require("../_components/actions"));
+// HACK: 只是短暂为了兼容现有 launcher 转发逻辑
+function VerifyCodeBody({ appName, locale = 'en', code, magicLink, }) {
+    const translations = {
+        en: {
+            title: `Login to ${appName}`,
+            followConfirmation: `Thank you for signing up for ${appName}. To confirm your account, please follow the button below.`,
+            confirmButton: 'Confirm account',
+            useConfirmLink: 'If Confirm Button does not work, please use the link below.',
+            orEnterCode: `Or enter the following code in the application: `,
+            followEnterCode: `Thank you for signing up for ${appName}. To confirm your account, please enter the following code in the application`,
+            codeExpiresIn: `This code expires in ${constant_1.VERIFY_CODE_TTL / 60 / 1000} minutes.`,
+            doNotShareCodeTitle: 'Do NOT share this code with anyone.',
+            doNotShareCode: "Only enter this code on the official application's website. If someone asks for this code, it could be a scam.",
+        },
+        zh: {
+            title: `登录 ${appName}`,
+            followConfirmation: `感谢您注册 ${appName}，请点击以下按钮确认您的账户。`,
+            confirmButton: '确认账户',
+            useConfirmLink: '如果确认按钮无法工作，请使用以下链接。',
+            orEnterCode: `或者在应用中输入以下代码：`,
+            followEnterCode: `感谢您注册 ${appName}，请在应用中输入以下代码确认您的账户。`,
+            codeExpiresIn: `此代码将在${constant_1.VERIFY_CODE_TTL / 60 / 1000}分钟内过期。`,
+            doNotShareCodeTitle: '请勿将此代码分享给任何人。',
+            doNotShareCode: '请仅在官方应用的网站上输入此代码。如果有人要求提供此代码，这可能是一个骗局。',
+        },
+    };
+    const translation = translations[locale] || translations.en;
+    if (code && magicLink) {
+        return ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)(components_1.Text, { children: translation.followConfirmation }), (0, jsx_runtime_1.jsx)(actions_1.default, { actions: [{ title: translation.confirmButton, link: magicLink }] }), (0, jsx_runtime_1.jsx)(components_1.Hr, {}), (0, jsx_runtime_1.jsxs)(components_1.Text, { children: [translation.orEnterCode, (0, jsx_runtime_1.jsx)("strong", { children: code })] }), (0, jsx_runtime_1.jsx)(components_1.Text, { children: translation.codeExpiresIn }), (0, jsx_runtime_1.jsxs)(components_1.Text, { children: [(0, jsx_runtime_1.jsx)("strong", { children: translation.doNotShareCodeTitle }), " ", translation.doNotShareCode] })] }));
+    }
+    if (magicLink) {
+        return ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)(components_1.Text, { children: translation.followConfirmation }), (0, jsx_runtime_1.jsx)(actions_1.default, { actions: [{ title: translation.confirmButton, link: magicLink }] }), (0, jsx_runtime_1.jsx)(components_1.Text, { children: translation.useConfirmLink }), (0, jsx_runtime_1.jsx)(components_1.Link, { href: magicLink, children: magicLink })] }));
+    }
+    if (code) {
+        return ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)(components_1.Text, { children: translation.followEnterCode }), (0, jsx_runtime_1.jsx)(components_1.Heading, { style: { textAlign: 'center' }, children: code }), (0, jsx_runtime_1.jsx)(components_1.Text, { children: translation.codeExpiresIn }), (0, jsx_runtime_1.jsxs)(components_1.Text, { children: [(0, jsx_runtime_1.jsx)("strong", { children: translation.doNotShareCodeTitle }), " ", translation.doNotShareCode] })] }));
+    }
+}
+exports.default = VerifyCodeBody;

package/api/emails/_templates/verify-code.js

@@ -0,0 +1,37 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VerifyCodeEmail = void 0;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const components_1 = require("@react-email/components");
+const footer_1 = __importDefault(require("../_components/footer"));
+const content_1 = __importDefault(require("../_components/content"));
+const layout_1 = __importDefault(require("../_components/layout"));
+const header_1 = __importDefault(require("../_components/header"));
+const verify_code_body_1 = __importDefault(require("./verify-code-body"));
+const fontFamily = 'HelveticaNeue,Helvetica,Arial,sans-serif';
+const main = {
+    fontFamily,
+};
+const container = {
+    margin: '20px auto',
+    backgroundColor: '#ffffff',
+    padding: '5px 50px 30px 60px',
+};
+const VerifyCodeEmail = ({ code, magicLink, appInfo, locale = 'en', userInfo, poweredBy, }) => {
+    const translations = {
+        en: {
+            title: `Login to ${appInfo.title}`,
+        },
+        zh: {
+            title: `登录 ${appInfo.title}`,
+        },
+    };
+    const translation = translations[locale] || translations.en;
+    const subject = `[${appInfo.title}] ${translation.title}`;
+    return ((0, jsx_runtime_1.jsxs)(layout_1.default, { mainStyle: main, subject: subject, children: [(0, jsx_runtime_1.jsx)(components_1.Preview, { children: subject }), (0, jsx_runtime_1.jsx)(header_1.default, { appInfo: appInfo }), (0, jsx_runtime_1.jsx)(content_1.default, { style: container, locale: locale, title: translation.title, body: (0, jsx_runtime_1.jsx)(verify_code_body_1.default, { locale: locale, code: code, magicLink: magicLink, appName: appInfo.title }) }), (0, jsx_runtime_1.jsx)(footer_1.default, { showCopyright: false, poweredBy: poweredBy, showBlocklet: true, appInfo: appInfo, locale: locale, userInfo: userInfo })] }));
+};
+exports.VerifyCodeEmail = VerifyCodeEmail;
+exports.default = exports.VerifyCodeEmail;

package/api/index.js

@@ -8,13 +8,12 @@ const onProxyRes = require('on-headers');
 require('express-async-errors');
 const cors = require('cors');
 const cookieParser = require('cookie-parser');
-const bodyParser = require('body-parser');
 const httpProxy = require('@arcblock/http-proxy');
 const { minimatch } = require('minimatch');
 const helmet = require('helmet');
 const isUrl = require('is-url');
 
-const { WELLKNOWN_SERVICE_PATH_PREFIX, EVENTS, MAX_UPLOAD_FILE_SIZE } = require('@abtnode/constant');
+const { WELLKNOWN_SERVICE_PATH_PREFIX, EVENTS } = require('@abtnode/constant');
 const {
   BlockletEvents,
   BlockletInternalEvents,
@@ -81,7 +80,9 @@ const checkBlocklet = require('./middlewares/check-blocklet');
 const proxyToDaemon = require('./middlewares/proxy-to-daemon');
 const attachSharedUtils = require('./util/attach-shared-utils');
 const createMediaRoutes = require('./routes/media');
+const createMCPRoutes = require('./routes/mcp');
 const ensureBlocklet = require('./middlewares/ensure-blocklet');
+const bodyParser = require('./middlewares/body-parser');
 
 const agent = new http.Agent({ maxSockets: Number.MAX_VALUE });
 
@@ -143,10 +144,6 @@ module.exports = function createServer(node, serverOptions = {}) {
   // eslint-disable-next-line no-unused-vars
   proxy.on('proxyReq', (proxyReq, req, res) => {
     req.proxyReqStart = Date.now();
-    if (req.rawBody) {
-      // Since we already consumed request stream, we need to write req.rawBody to proxy request here
-      proxyReq.write(req.rawBody);
-    }
   });
   const SECURITY_HEADER_MAP = {
     contentSecurityPolicy: 'content-security-policy',
@@ -286,6 +283,7 @@ module.exports = function createServer(node, serverOptions = {}) {
       !req.path.startsWith(`${WELLKNOWN_SERVICE_PATH_PREFIX}/studio`) &&
       req.path.startsWith(WELLKNOWN_SERVICE_PATH_PREFIX)
     ) {
+      const iconifyDomains = ['https://*.simplesvg.com', 'https://*.iconify.design', 'https://*.unisvg.com'];
       const whitelist = {
         // required for nft display and blocklet discover
         official: [
@@ -301,15 +299,7 @@ module.exports = function createServer(node, serverOptions = {}) {
         system: ['https://*.did.abtnet.io', 'https://*.ip.abtnet.io', 'https://*.slp.abtnet.io'],
 
         // required for icon request and display
-        thirdParty: [
-          'https://*.simplesvg.com',
-          'https://*.iconify.design',
-          'https://*.unisvg.com',
-          'https://js.stripe.com',
-          'https://ipapi.co',
-          'https://js.stripe.com',
-          'https://ipapi.co',
-        ],
+        thirdParty: ['https://js.stripe.com', 'https://ipapi.co', ...iconifyDomains],
       };
 
       // server level dynamic domains
@@ -360,7 +350,7 @@ module.exports = function createServer(node, serverOptions = {}) {
         directives: {
           defaultSrc: ["'self'"],
           baseUri: ["'self'"],
-          scriptSrc: ["'self'", isDev ? "'unsafe-inline'" : '', "'unsafe-eval'", 'https://unpkg.com'].filter(Boolean),
+          scriptSrc: ["'self'", "'unsafe-inline'", "'unsafe-eval'", 'https://unpkg.com'].filter(Boolean),
           styleSrc: ["'self'", "'unsafe-inline'", 'https:'],
           imgSrc: [
             "'self'",
@@ -369,7 +359,10 @@ module.exports = function createServer(node, serverOptions = {}) {
             'https://cdnjs.cloudflare.com',
             ...whitelist.spaces,
             ...whitelist.official,
+            ...iconifyDomains,
           ].filter(Boolean),
+          // 支持 google 字体
+          fontSrc: ['self', 'https://fonts.gstatic.com'],
           connectSrc: uniq(
             [
               "'self'",
@@ -442,7 +435,6 @@ module.exports = function createServer(node, serverOptions = {}) {
 
   // Http server
   const server = express();
-  const maxUploadSize = Number(process.env.MAX_UPLOAD_FILE_SIZE) || MAX_UPLOAD_FILE_SIZE;
 
   // A simple websocket router
   const wsRoutingRules = [];
@@ -457,17 +449,6 @@ module.exports = function createServer(node, serverOptions = {}) {
 
   server.use(cookieParser());
 
-  // https://flaviocopes.com/express-get-raw-body/
-  // Side effects: this will double the memory consumption
-  // Required because we need to do reverse proxy to upstream blocklets
-  const verify = (req, res, buf) => {
-    req.rawBody = buf;
-  };
-  server.use(bodyParser.json({ limit: `${maxUploadSize}mb`, verify }));
-  server.use(bodyParser.urlencoded({ extended: true, limit: `${maxUploadSize}mb`, verify }));
-
-  // NOTE: will be overwrite by Blocklet Server in production
-
   // Shared util functions on current request
   server.use((req, res, next) => {
     // NOTICE: 增加了 req 上的公用函数，比如 req.getBlocklet
@@ -613,6 +594,48 @@ self.blocklet = {
   /* istanbul ignore if */
   setupAccessLogger(server, isProduction ? getAccessLogStream() : undefined, true);
 
+  // Auth: login token and user info
+  server.use(authMiddlewares.sessionBearerToken);
+  server.use(authMiddlewares.userInfo);
+
+  // API: gql
+  [
+    '/api/gql',
+    '/api/project/:did/:projectId/:type/upload',
+    '/api/project/:did/:projectId/:releaseId/download/:file',
+  ].forEach((pathname) => {
+    server.use(
+      `${WELLKNOWN_SERVICE_PATH_PREFIX}${pathname}`,
+      async (req, res, next) => {
+        let info;
+        try {
+          info = await req.getBlockletInfo();
+        } catch (_) {
+          //
+        }
+        req.tenantMode = info?.tenantMode || BLOCKLET_TENANT_MODES.SINGLE;
+        if (req.tenantMode === BLOCKLET_TENANT_MODES.MULTIPLE || pathname === '/api/gql') {
+          checkGuestPermission(req, res, next);
+        } else {
+          checkMemberPermission(req, res, next);
+        }
+      },
+      proxyToDaemon({ proxy, node })
+    );
+  });
+
+  [
+    '/api/preferences',
+    '/api/theme',
+    '/api/uploads',
+    // 将上传 logo 代理给 daemon 完成
+    '/blocklet/logo/upload/:logoType/:did',
+    // media 相关处理代理到 daemon 中进行处理
+    '/api/media/upload/**',
+  ].forEach((pathname) => {
+    server.use(`${WELLKNOWN_SERVICE_PATH_PREFIX}${pathname}`, checkMemberPermission, proxyToDaemon({ proxy, node }));
+  });
+
   // Static assets
   StaticService.attachStaticResources({
     app: server,
@@ -625,6 +648,9 @@ self.blocklet = {
     ],
   });
 
+  // This must come after all proxied requests that begins with WELLKNOWN_SERVICE_PATH_PREFIX
+  server.use(WELLKNOWN_SERVICE_PATH_PREFIX, bodyParser);
+
   // Studio service
   StudioService.init(server, node);
 
@@ -641,10 +667,6 @@ self.blocklet = {
   // API: auth: before auth middleware
   authRoutes.createSessionRoutes.init(server, node);
 
-  // Middleware: auth info
-  server.use(authMiddlewares.sessionBearerToken);
-  server.use(authMiddlewares.userInfo);
-
   // Analytics
   AnalyticService.init({ app: server, node });
 
@@ -663,6 +685,9 @@ self.blocklet = {
   // media
   createMediaRoutes.init(server, node, options);
 
+  // MCP Service
+  createMCPRoutes.init(server, node);
+
   // API: auth
   createOAuthRoutes.init(server, node, options);
   createFederatedRoutes.init(server, node, options);
@@ -675,45 +700,8 @@ self.blocklet = {
   createConnectRelayRoutes.init(server, node, options, wsRouter);
   authRoutes.attachDidAuthHandlers(server);
   authRoutes.createPassportRoutes.init(server, node);
-  authRoutes.createPasskeyRoutes.init(server, node);
-  authRoutes.createCommonRoutes.init(server, node);
-
-  // API: gql
-  [
-    '/api/gql',
-    '/api/project/:did/:projectId/:type/upload',
-    '/api/project/:did/:projectId/:releaseId/download/:file',
-  ].forEach((pathname) => {
-    server.use(
-      `${WELLKNOWN_SERVICE_PATH_PREFIX}${pathname}`,
-      async (req, res, next) => {
-        let info;
-        try {
-          info = await req.getBlockletInfo();
-        } catch (_) {
-          //
-        }
-        req.tenantMode = info?.tenantMode || BLOCKLET_TENANT_MODES.SINGLE;
-        if (req.tenantMode === BLOCKLET_TENANT_MODES.MULTIPLE || pathname === '/api/gql') {
-          checkGuestPermission(req, res, next);
-        } else {
-          checkMemberPermission(req, res, next);
-        }
-      },
-      proxyToDaemon({ proxy, node })
-    );
-  });
-
-  [
-    '/api/preferences',
-    '/api/uploads',
-    // 将上传 logo 代理给 daemon 完成
-    '/blocklet/logo/upload/:logoType/:did',
-    // media 相关处理代理到 daemon 中进行处理
-    '/api/media/upload/**',
-  ].forEach((pathname) => {
-    server.use(`${WELLKNOWN_SERVICE_PATH_PREFIX}${pathname}`, checkMemberPermission, proxyToDaemon({ proxy, node }));
-  });
+  authRoutes.createPasskeyRoutes.init(server);
+  authRoutes.createCommonRoutes.init(server);
 
   // API: dns resolver
   createDnsResolver.init(server);

package/api/libs/auth/utils.js

@@ -9,6 +9,7 @@ const pick = require('lodash/pick');
 const uniq = require('lodash/uniq');
 const { LOGIN_PROVIDER } = require('@blocklet/constant');
 
+const { PASSPORT_LOG_ACTION, PASSPORT_ISSUE_ACTION } = require('@abtnode/constant');
 const { sendToUser } = require('../notification');
 
 const PASSPORT_VC_TYPES = [VC_TYPE_GENERAL_PASSPORT, VC_TYPE_NODE_PASSPORT];
@@ -62,11 +63,11 @@ async function transferPassport(fromUser, toUser, { req, teamDid, node, nodeInfo
         data: {
           credential: vc,
           tag: x.name,
-          display: x.display,
         },
       };
     })
   );
+
   const insertPassportList = attachments.map((item, index) => {
     return {
       ...createUserPassport(item.data.credential, { role: item.data.tag, display: item.data.display }),
@@ -119,6 +120,24 @@ async function transferPassport(fromUser, toUser, { req, teamDid, node, nodeInfo
       },
     });
   }
+
+  await Promise.all(
+    insertPassportList.map((item) => {
+      return node.createPassportLog(
+        teamDid,
+        {
+          passportId: item.id,
+          action: PASSPORT_LOG_ACTION.ISSUE,
+          operatorDid: fromUser.did,
+          metadata: {
+            action: PASSPORT_ISSUE_ACTION.ISSUE_ON_TRANSFER,
+          },
+        },
+        req
+      );
+    })
+  );
+
   if (revokePassport) {
     const revokePendingList = waitPassportList
       .filter((item) => item.id)