@abtnode/blocklet-services 1.16.41 → 1.16.42-beta-20250403-230303-c167c6a1

package/api/routes/user-session.js

@@ -1,9 +1,14 @@
 /* eslint-disable no-await-in-loop */
-const { WELLKNOWN_SERVICE_PATH_PREFIX, SESSION_TTL, PASSPORT_LOG_ACTION } = require('@abtnode/constant');
+const {
+  WELLKNOWN_SERVICE_PATH_PREFIX,
+  SESSION_TTL,
+  PASSPORT_LOG_ACTION,
+  PASSPORT_STATUS,
+} = require('@abtnode/constant');
 const { LOGIN_PROVIDER } = require('@blocklet/constant');
 const pick = require('lodash/pick');
 const defaults = require('lodash/defaults');
-const cloneDeep = require('lodash/cloneDeep');
+const cloneDeep = require('@abtnode/util/lib/deep-clone');
 const omit = require('lodash/omit');
 const pLimit = require('p-limit');
 const { getSourceProvider } = require('@blocklet/meta/lib/did-utils');
@@ -11,6 +16,7 @@ const getRequestIP = require('@abtnode/util/lib/get-request-ip');
 const { getFederatedMembers, getFederatedMaster } = require('@abtnode/auth/lib/util/federated');
 const { messages } = require('@abtnode/auth/lib/auth');
 const { Joi } = require('@arcblock/validator');
+const { getDeviceData } = require('@abtnode/util/lib/device');
 const cors = require('cors');
 
 const logger = require('../libs/logger')('blocklet-services:user-session');
@@ -23,6 +29,8 @@ const checkUser = require('../middlewares/check-user');
 const prefix = `${WELLKNOWN_SERVICE_PATH_PREFIX}/api/user-session`;
 const limit = pLimit(5);
 
+const userInfoBlackList = ['extra.walletDeviceId', 'extra.walletDeviceMessageToken', 'extra.device'];
+
 async function getPassport(passportId, { node, teamDid }) {
   const passport = await node.getPassportById({ teamDid, passportId });
   return passport;
@@ -155,7 +163,7 @@ module.exports = {
       if (validSession) {
         const user = await node.getUser({ teamDid, user: { did: validUserSession.userDid } });
         if (!user.approved) {
-          res.status(401).json(messages.notAllowedAppUser.en);
+          res.status(401).json(messages.notAllowedAppUser[req.blockletLocale]);
           return;
         }
         const sourceProvider = getSourceProvider(user);
@@ -209,6 +217,16 @@ module.exports = {
           const targetPassport = validUserSession.passportId
             ? (user?.passports || []).find((item) => item.id === validUserSession.passportId)
             : null;
+          if (targetPassport?.status === PASSPORT_STATUS.EXPIRED) {
+            res.status(401).json({ error: messages.passportExpired[req.blockletLocale] });
+            return;
+          }
+          if (targetPassport?.status === PASSPORT_STATUS.REVOKED) {
+            res.status(401).json({
+              error: messages.passportRevoked[req.blockletLocale](targetPassport.title, targetPassport.issuer.name),
+            });
+            return;
+          }
           const loggedInUser = await node.loginUser({
             teamDid,
             user: {
@@ -259,8 +277,7 @@ module.exports = {
 
         const lastLoginIp = getRequestIP(req);
         const ua = req.get('user-agent');
-        const walletDeviceMessageToken = req.get('wallet-device-message-token');
-        const walletDeviceId = req.get('wallet-device-id');
+        const deviceData = getDeviceData({ req });
 
         const userSessionDoc = await node.upsertUserSession({
           id: validUserSession.id,
@@ -274,8 +291,7 @@ module.exports = {
           lastLoginIp,
           extra: {
             walletOS,
-            walletDeviceMessageToken,
-            walletDeviceId,
+            device: deviceData,
           },
         });
 
@@ -290,8 +306,7 @@ module.exports = {
             lastLoginIp,
             extra: {
               walletOS,
-              walletDeviceMessageToken,
-              walletDeviceId,
+              device: deviceData,
             },
           });
         }
@@ -349,10 +364,7 @@ module.exports = {
         .filter((x) => {
           return x?.user?.approved;
         })
-        .map((x) => {
-          // NOTICE: 移除 walletDeviceId 和 walletDeviceMessageToken，避免泄露
-          return omit(x, ['extra.walletDeviceId', 'extra.walletDeviceMessageToken']);
-        });
+        .map((x) => omit(x, userInfoBlackList));
 
       res.json(result);
     });
@@ -369,6 +381,8 @@ module.exports = {
       const { appPid } = blocklet;
       const teamDid = appPid;
 
+      const federatedSites = blocklet?.settings?.federated?.sites || [];
+
       const visitorId = req.get('x-blocklet-visitor-id');
 
       if (!visitorId) {
@@ -381,7 +395,17 @@ module.exports = {
         visitorId,
       });
 
-      const pendingList = userSessions.map((item) =>
+      const validUserSessions = userSessions.filter((x) => {
+        const federatedSite = federatedSites.find((y) => y.appPid === x.appPid);
+        if (federatedSite?.appPid === teamDid) {
+          return true;
+        }
+        if (federatedSite?.status === 'approved') {
+          return true;
+        }
+        return false;
+      });
+      const pendingList = validUserSessions.map((item) =>
         limit(() =>
           patchUserSessionData(item, {
             blocklet,
@@ -393,7 +417,7 @@ module.exports = {
       );
       await Promise.all(pendingList);
 
-      const result = userSessions
+      const result = validUserSessions
         .filter((x) => {
           if (x.status === 'expired') {
             return false;
@@ -404,10 +428,7 @@ module.exports = {
 
           return checkLoginUserSession(x, { req });
         })
-        .map((x) => {
-          // NOTICE: 移除 walletDeviceId 和 walletDeviceMessageToken，避免泄露
-          return omit(x, ['extra.walletDeviceId', 'extra.walletDeviceMessageToken']);
-        });
+        .map((x) => omit(x, userInfoBlackList));
 
       res.json(result);
     });