@abtnode/blocklet-services 1.16.54-beta-20251016-050817-2fc632b8 → 1.16.54-beta-20251021-070951-25e3083c

package/api/cache.js

@@ -1,7 +1,7 @@
 const { DBCache, getAbtNodeRedisAndSQLiteUrl } = require('@abtnode/db-cache');
 const nodemailer = require('nodemailer');
 const { LRUCache } = require('lru-cache');
-const getBlockletInfo = require('@blocklet/meta/lib/info');
+const { getBlockletInfo } = require('@blocklet/meta/lib/info');
 const { fromJSON } = require('@ocap/wallet');
 
 const CACHE_TTL = 60 * 60 * 1000;

package/api/emails/_components/asset.js

@@ -4,10 +4,15 @@ const jsx_runtime_1 = require("react/jsx-runtime");
 const components_1 = require("@react-email/components");
 const chain_1 = require("../_libs/chain");
 const style_1 = require("../_libs/style");
-function Asset({ locale, data, }) {
+function Asset({ locale, data, type = 'vc', }) {
     const title = { zh: '接收', en: 'Received' }[locale] || 'Received';
     const chainHost = (0, chain_1.getUrlHost)(data.chainHost) || (0, chain_1.getChainHost)(data.chainId);
     const url = `https://${chainHost}/explorer/assets/${data.did}`;
-    return ((0, jsx_runtime_1.jsxs)("a", { href: url, target: "_blank", style: Object.assign(Object.assign({}, style_1.assetStyle), { margin: '1em 0', textDecoration: 'none', color: 'initial', display: 'block' }), children: [(0, jsx_runtime_1.jsxs)(components_1.Row, { style: style_1.titleStyle, children: [(0, jsx_runtime_1.jsx)(components_1.Column, { children: title }), (0, jsx_runtime_1.jsx)(components_1.Column, { align: "right", style: style_1.summaryStyle, children: "+1 Asset" })] }), (0, jsx_runtime_1.jsx)(components_1.Text, { style: style_1.remarkStyle, children: data.did })] }));
+    return ((0, jsx_runtime_1.jsxs)("a", { href: url, target: "_blank", style: Object.assign(Object.assign({}, style_1.assetStyle), { margin: '1em 0', textDecoration: 'none', color: 'initial', display: 'block' }), onClick: (e) => {
+            if (type === 'vc') {
+                e.preventDefault();
+                return;
+            }
+        }, children: [(0, jsx_runtime_1.jsxs)(components_1.Row, { style: style_1.titleStyle, children: [(0, jsx_runtime_1.jsx)(components_1.Column, { children: title }), (0, jsx_runtime_1.jsx)(components_1.Column, { align: "right", style: style_1.summaryStyle, children: "+1 Asset" })] }), (0, jsx_runtime_1.jsx)(components_1.Text, { style: style_1.remarkStyle, children: data.did })] }));
 }
 exports.default = Asset;

package/api/emails/_components/attachments.js

@@ -41,7 +41,7 @@ function Attachments({ locale, severity = 'normal', attachments = [], }) {
                 return (0, jsx_runtime_1.jsx)(components_1.Hr, {}, `${item.type}-${index}`);
             case 'vc':
             case 'asset':
-                return (0, jsx_runtime_1.jsx)(asset_1.default, { data: item.data, locale: locale }, `${item.type}-${index}`);
+                return (0, jsx_runtime_1.jsx)(asset_1.default, { type: item.type, data: item.data, locale: locale }, `${item.type}-${index}`);
             case 'section':
                 return (0, jsx_runtime_1.jsx)(compose_1.default, { data: item.fields }, `${item.type}-${index}`);
             default:

package/api/index.js

@@ -88,6 +88,7 @@ const createOpenEventRoutes = require('./routes/openevent');
 const createOpenComponentRoutes = require('./routes/opencomponent');
 const createOpenEmbedRoutes = require('./routes/openembed');
 const createAccessKeyRoutes = require('./routes/access-key');
+const createSignRoutes = require('./routes/sign');
 const checkRunning = require('./middlewares/check-running');
 const { launcherLogin } = require('./middlewares/launcher-login');
 const { checkMemberPermission, checkGuestPermission } = require('./middlewares/check-permission');
@@ -800,6 +801,7 @@ self.blocklet = {
   createCspProxyRoutes.init(server);
   createUserSessionRoutes.init(server, node, options);
   createEnvRoutes.init(server, node, options);
+  createSignRoutes.init(server, node, options);
   createBlockletRoutes.init(server, node);
   createConnectSessionRoutes.init(server, node, options);
   createConnectRelayRoutes.init(server, node, options, wsRouter);

package/api/libs/connect/v1.js

@@ -4,8 +4,8 @@ const { toAddress } = require('@ocap/util');
 const { WalletAuthenticator } = require('@arcblock/did-connect-js');
 const { types } = require('@ocap/mcrypto');
 const { getBlockletAppIdList } = require('@blocklet/meta/lib/util');
-const getBlockletInfo = require('@blocklet/meta/lib/info');
-const WalletHandlers = require('@blocklet/sdk/lib/wallet-handler');
+const { getBlockletInfo } = require('@blocklet/meta/lib/info');
+const { WalletHandlers } = require('@blocklet/sdk');
 const { getDelegation } = require('@blocklet/sdk/lib/connect/shared');
 const { sendToUser, sendToRelay } = require('@blocklet/sdk/lib/util/send-notification');
 const { WELLKNOWN_SERVICE_PATH_PREFIX } = require('@abtnode/constant');

package/api/libs/connect/v2.js

@@ -1,7 +1,7 @@
 const path = require('path');
 const DynamicStorage = require('@abtnode/connect-storage');
 const { Authenticator } = require('@did-connect/authenticator');
-const createHandlers = require('@blocklet/sdk/lib/connect/handler');
+const { createConnectHandlers: createHandlers } = require('@blocklet/sdk/lib/connect/handler');
 const { sendToUser } = require('@blocklet/sdk/lib/util/send-notification');
 const { WELLKNOWN_SERVICE_PATH_PREFIX } = require('@abtnode/constant');
 

package/api/libs/email.js

@@ -1,6 +1,6 @@
 const { Joi } = require('@arcblock/validator');
 const { render } = require('@react-email/components');
-const getBlockletInfo = require('@blocklet/meta/lib/info');
+const { getBlockletInfo } = require('@blocklet/meta/lib/info');
 const { getEmailServiceProvider, getEmailSignatureConfig } = require('@abtnode/auth/lib/email');
 const { sendEmailWithLauncher } = require('@abtnode/auth/lib/launcher');
 const { isActivityIncluded } = require('@abtnode/util/lib/notification-preview/util');

package/api/libs/push-kit/index.js

@@ -1,6 +1,6 @@
 const uniqWith = require('lodash/uniqWith');
 const { getSignData } = require('@blocklet/sdk/lib/util/verify-sign');
-const getBlockletInfo = require('@blocklet/meta/lib/info');
+const { getBlockletInfo } = require('@blocklet/meta/lib/info');
 const { joinURL } = require('ufo');
 const pRetry = require('p-retry');
 const pMap = require('p-map');
@@ -88,7 +88,7 @@ async function sendPush(receiver, notification, { node, teamDid }) {
 
   const blockletInfo = getBlockletInfo(blocklet);
 
-  const { iat, exp, sig, version } = getSignData(
+  const { iat, exp, sig, version } = await getSignData(
     {
       data: {
         targets: filterTargets,

package/api/middlewares/check-federated.js

@@ -11,7 +11,7 @@ const logger = require('../libs/logger')('check-federated');
  * @param {Array<'pending'|'approved'|'rejected'|'revoked'>} options.allowStatus
  */
 function checkFederatedCall({ mode = 'all', allowStatus = ['approved', 'revoked'] } = {}) {
-  return (req, res, next) => {
+  return async (req, res, next) => {
     const { blocklet } = req;
     if (!blocklet) {
       res.status(400).send('blocklet not exists');
@@ -58,7 +58,7 @@ function checkFederatedCall({ mode = 'all', allowStatus = ['approved', 'revoked'
       return;
     }
 
-    const verified = verify(data, sig, {
+    const verified = await verify(data, sig, {
       appPk: sigPk,
     });
     if (!verified) {
@@ -76,7 +76,7 @@ function checkFederatedCall({ mode = 'all', allowStatus = ['approved', 'revoked'
 
 // DEPRECATED: @zhanghan 在 1.16.35 发布时移除旧版本的兼容
 function checkFederatedCallLegacy({ mode = 'all', allowStatus = ['approved', 'revoked'] } = {}) {
-  return (req, res, next) => {
+  return async (req, res, next) => {
     const { blocklet } = req;
     if (!blocklet) {
       res.status(400).send('blocklet not exists');
@@ -125,7 +125,7 @@ function checkFederatedCallLegacy({ mode = 'all', allowStatus = ['approved', 're
       return;
     }
 
-    if (!jwt.verify(data, validSite.pk)) {
+    if (!(await jwt.verify(data, validSite.pk))) {
       res.status(401).send('Invalid signature during federated call');
       return;
     }

package/api/middlewares/verify-sig.js

@@ -11,10 +11,11 @@ const verifySig = async (req, res, next) => {
       return;
     }
 
-    const verified = verify(data, sig, {
+    const verified = await verify(data, sig, {
       // NOTICE: blocklet-service 的运行环境中不包含以下环境变量，必须从 blocklet 信息中去获取并传递
       type: blocklet.environmentObj.BLOCKLET_APP_CHAIN_TYPE,
-      appSk: blocklet.environmentObj.BLOCKLET_APP_SK,
+      // Compatible with previous version where APP_ASK does not exist
+      appSk: blocklet.environmentObj.BLOCKLET_APP_ASK || blocklet.environmentObj.BLOCKLET_APP_SK,
     });
     if (!verified) {
       logger.error('verify sig failed', { data, sig });

package/api/routes/blocklet.js

@@ -251,7 +251,7 @@ module.exports = {
 
         // send notification to wallet
         const receiver = userDid;
-        const token = JWT.sign(wallet.address, wallet.secretKey);
+        const token = await JWT.sign(wallet.address, wallet.secretKey);
 
         // send passport to wallet if no passport for this user
         const role = ROLES.OWNER;

package/api/routes/federated.js

@@ -377,7 +377,7 @@ module.exports = {
         const { blocklet, verifySite } = req;
         const teamDid = blocklet.appPid;
         const { permanentWallet } = await req.getBlockletInfo();
-        const delegation = signV2(permanentWallet.address, permanentWallet.secretKey, {
+        const delegation = await signV2(permanentWallet.address, permanentWallet.secretKey, {
           // HACK: 钱包签名使用的始终是最新的，这里的 dalegation 也保持 agentDid 就是当前应用最新的 did(appId)
           agentDid: `did:abt:${verifySite.appId}`,
           permissions: [

package/api/routes/mcp.js

@@ -1,7 +1,7 @@
 const { WELLKNOWN_SERVICE_PATH_PREFIX, SECURITY_RULE_DEFAULT_ID } = require('@abtnode/constant');
 const { joinURL } = require('ufo');
 const get = require('lodash/get');
-const getBlockletInfo = require('@blocklet/meta/lib/info');
+const { getBlockletInfo } = require('@blocklet/meta/lib/info');
 const { checkPublicAccess } = require('@blocklet/meta/lib/util');
 // eslint-disable-next-line import/no-unresolved
 const { StreamableHTTPServerTransport } = require('@modelcontextprotocol/sdk/server/streamableHttp.js');

package/api/routes/sign.js

@@ -0,0 +1,388 @@
+const stableStringify = require('json-stable-stringify');
+const { fromSecretKey, WalletType } = require('@ocap/wallet');
+const { types } = require('@ocap/mcrypto');
+const { DidType, isEthereumType } = require('@arcblock/did');
+const { WELLKNOWN_SERVICE_PATH_PREFIX } = require('@abtnode/constant');
+const JWT = require('@arcblock/jwt');
+const { formatError } = require('@blocklet/error');
+const { fromAppDid } = require('@arcblock/did-ext');
+const formatContext = require('@abtnode/util/lib/format-context');
+const { getComponentApiKey } = require('@abtnode/util/lib/blocklet');
+const { findComponentByIdV2 } = require('@blocklet/meta/lib/util');
+
+const ensureBlocklet = require('../middlewares/ensure-blocklet');
+const logger = require('../libs/logger')('blocklet-services:sign');
+
+/**
+ * Middleware to ensure request comes from localhost only
+ */
+function ensureLocalhost(req, res, next) {
+  const ip = req.ip || req.connection.remoteAddress || req.socket.remoteAddress;
+
+  const isLocalhost = ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1' || ip === 'localhost';
+
+  // Check if the request is from private network (RFC 1918)
+  // 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
+  const isPrivateNetwork = /^10\./.test(ip) || /^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(ip) || /^192\.168\./.test(ip);
+
+  // Check if the request is from localhost
+  if (!isLocalhost && !isPrivateNetwork) {
+    logger.warn('Rejected non-localhost request to signing API', {
+      ip,
+      path: req.path,
+    });
+    res.status(403).json({ error: 'Signing API is only accessible from localhost' });
+    return;
+  }
+
+  next();
+}
+
+/**
+ * Middleware to verify component API key
+ */
+function ensureComponentApiKey(req, res, next) {
+  (async () => {
+    try {
+      const { blocklet } = req;
+      const { apiKey } = req.body || {};
+
+      // Get component ID from header
+      const componentId = req.headers['x-component-did'];
+      if (!componentId) {
+        res.status(400).json({ error: 'Missing x-component-did header' });
+        return;
+      }
+
+      // Find component in blocklet
+      const component = findComponentByIdV2(blocklet, componentId);
+      if (!component) {
+        logger.warn('Component not found', {
+          blockletDid: blocklet?.meta?.did,
+          componentId,
+        });
+        res.status(404).json({ error: 'Component not found' });
+        return;
+      }
+
+      const nodeInfo = await req.getNodeInfo();
+
+      // Calculate expected component API key
+      const componentApiKey = getComponentApiKey({
+        serverSk: nodeInfo.sk,
+        app: blocklet,
+        component,
+      });
+
+      // Verify API key
+      if (!apiKey || componentApiKey !== apiKey) {
+        logger.warn('Component API key verification failed', {
+          blockletDid: blocklet?.meta?.did,
+          componentId,
+        });
+        res.status(401).json({ error: 'Invalid component API key' });
+        return;
+      }
+
+      next();
+    } catch (error) {
+      logger.error('Component API key verification error', {
+        error,
+        blockletDid: req?.blocklet?.meta?.did,
+        componentId: req.headers['x-component-did'],
+      });
+      res.status(500).json({ error: 'Failed to verify component API key' });
+    }
+  })();
+}
+
+function toSignablePayload(payload) {
+  if (payload === null || payload === undefined) {
+    return stableStringify({});
+  }
+
+  if (payload && payload.__type === 'buffer' && typeof payload.data === 'string') {
+    return Buffer.from(payload.data, 'hex');
+  }
+
+  if (typeof payload === 'string') {
+    return payload;
+  }
+
+  if (Buffer.isBuffer(payload)) {
+    return payload;
+  }
+
+  if (typeof payload === 'object') {
+    return stableStringify(payload);
+  }
+
+  return String(payload);
+}
+
+/**
+ * Format message for audit log display
+ */
+function formatMessageForAudit(message) {
+  if (Buffer.isBuffer(message)) {
+    return message.toString('hex');
+  }
+
+  return String(message);
+}
+
+function getWalletFromBlocklet({ blocklet, options = {} }) {
+  const env = blocklet?.environmentObj || {};
+  const appSk = env.BLOCKLET_APP_SK;
+  if (!appSk) {
+    throw new Error('BLOCKLET_APP_SK not found for blocklet');
+  }
+
+  const type = options.type || env.BLOCKLET_APP_CHAIN_TYPE || env.BLOCKLET_WALLET_TYPE;
+  let walletType;
+  let secretKey;
+
+  if (type && isEthereumType(DidType(type))) {
+    secretKey = appSk.slice(0, 66);
+    walletType = WalletType(type);
+  } else {
+    secretKey = appSk;
+    walletType = WalletType({
+      role: types.RoleType.ROLE_APPLICATION,
+      pk: types.KeyType.ED25519,
+      hash: types.HashType.SHA3,
+    });
+  }
+
+  return fromSecretKey(secretKey, walletType);
+}
+
+module.exports = {
+  // eslint-disable-next-line no-unused-vars
+  init(server, node, _options) {
+    server.post(
+      `${WELLKNOWN_SERVICE_PATH_PREFIX}/api/sign`,
+      ensureLocalhost,
+      ensureBlocklet(),
+      ensureComponentApiKey,
+      async (req, res) => {
+        try {
+          const { blocklet } = req;
+          const { payload } = req.body || {};
+
+          if (payload === undefined) {
+            res.status(400).json({ error: 'Payload is required' });
+            return;
+          }
+
+          const wallet = getWalletFromBlocklet({ blocklet });
+          const message = toSignablePayload(payload);
+          const signature = await wallet.sign(message);
+
+          // Create audit log asynchronously (don't block response)
+          const componentId = req.headers['x-component-did'];
+          node
+            .createAuditLog({
+              action: 'remoteSign',
+              args: {
+                teamDid: blocklet.meta.did,
+                componentId,
+                payloadType: typeof payload,
+                payloadContent: formatMessageForAudit(message),
+              },
+              context: {
+                ...formatContext(req),
+                user: {
+                  did: blocklet.meta.did,
+                  fullName: `Component: ${componentId || 'unknown'}`,
+                  role: 'blocklet',
+                  componentDid: componentId,
+                },
+              },
+              result: { publicKey: wallet.publicKey },
+            })
+            .catch((err) => logger.error('create remoteSign audit log failed', { error: err }));
+
+          res.json({ signature, publicKey: wallet.publicKey });
+        } catch (error) {
+          logger.error('Failed to sign payload', {
+            error,
+            blockletDid: req?.blocklet?.meta?.did,
+            componentId: req.headers['x-component-did'],
+          });
+          res.status(500).json({ error: formatError(error) });
+        }
+      }
+    );
+
+    server.post(
+      `${WELLKNOWN_SERVICE_PATH_PREFIX}/api/sign/jwt`,
+      ensureLocalhost,
+      ensureBlocklet(),
+      ensureComponentApiKey,
+      async (req, res) => {
+        try {
+          const { blocklet } = req;
+          const { payload, options } = req.body || {};
+
+          const wallet = getWalletFromBlocklet({ blocklet, options });
+          // Use doSign from options, default to true if not provided
+          const token = await JWT.sign(
+            wallet.address,
+            wallet.secretKey,
+            payload || {},
+            options?.doSign ?? true,
+            options?.version
+          );
+
+          const componentId = req.headers['x-component-did'];
+          node
+            .createAuditLog({
+              action: 'remoteSignJWT',
+              args: {
+                teamDid: blocklet.meta.did,
+                componentId,
+                jwtVersion: options?.version,
+                payloadContent: stableStringify(payload || {}),
+              },
+              context: {
+                ...formatContext(req),
+                user: {
+                  did: blocklet.meta.did,
+                  fullName: `Component: ${componentId || 'unknown'}`,
+                  role: 'blocklet',
+                  componentDid: componentId,
+                },
+              },
+              result: { publicKey: wallet.publicKey },
+            })
+            .catch((err) => logger.error('create remoteSignJWT audit log failed', { error: err }));
+
+          res.json({ token, publicKey: wallet.publicKey });
+        } catch (error) {
+          logger.error('Failed to sign JWT', {
+            error,
+            blockletDid: req?.blocklet?.meta?.did,
+            componentId: req.headers['x-component-did'],
+          });
+          res.status(500).json({ error: formatError(error) });
+        }
+      }
+    );
+
+    server.post(
+      `${WELLKNOWN_SERVICE_PATH_PREFIX}/api/sign/eth`,
+      ensureLocalhost,
+      ensureBlocklet(),
+      ensureComponentApiKey,
+      async (req, res) => {
+        try {
+          const { blocklet } = req;
+          const { data, hashBeforeSign, options } = req.body || {};
+
+          if (!data) {
+            res.status(400).json({ error: 'Data is required' });
+            return;
+          }
+
+          const wallet = getWalletFromBlocklet({ blocklet, options });
+          const signature = await wallet.ethSign(data, hashBeforeSign);
+
+          const componentId = req.headers['x-component-did'];
+          node
+            .createAuditLog({
+              action: 'remoteSignETH',
+              args: {
+                teamDid: blocklet.meta.did,
+                componentId,
+                hashBeforeSign: !!hashBeforeSign,
+                dataContent: data,
+              },
+              context: {
+                ...formatContext(req),
+                user: {
+                  did: blocklet.meta.did,
+                  fullName: `Component: ${componentId || 'unknown'}`,
+                  role: 'blocklet',
+                  componentDid: componentId,
+                },
+              },
+              result: { publicKey: wallet.publicKey },
+            })
+            .catch((err) => logger.error('create remoteSignETH audit log failed', { error: err }));
+
+          res.json({ signature, publicKey: wallet.publicKey });
+        } catch (error) {
+          logger.error('Failed to sign ETH', {
+            error,
+            blockletDid: req?.blocklet?.meta?.did,
+            componentId: req.headers['x-component-did'],
+          });
+          res.status(500).json({ error: formatError(error) });
+        }
+      }
+    );
+
+    server.post(
+      `${WELLKNOWN_SERVICE_PATH_PREFIX}/api/sign/derive`,
+      ensureLocalhost,
+      ensureBlocklet(),
+      ensureComponentApiKey,
+      (req, res) => {
+        try {
+          const { blocklet } = req;
+          const { sub, type, index } = req.body || {};
+
+          if (!sub) {
+            res.status(400).json({ error: 'Sub is required' });
+            return;
+          }
+
+          const wallet = getWalletFromBlocklet({ blocklet, options: { type } });
+          const userWallet = fromAppDid(sub, wallet.secretKey, type, index);
+
+          const componentId = req.headers['x-component-did'];
+          node
+            .createAuditLog({
+              action: 'remoteDeriveWallet',
+              args: {
+                teamDid: blocklet.meta.did,
+                componentId,
+                sub,
+                type,
+                index,
+              },
+              context: {
+                ...formatContext(req),
+                user: {
+                  did: blocklet.meta.did,
+                  fullName: `Component: ${componentId || 'unknown'}`,
+                  role: 'blocklet',
+                  componentDid: componentId,
+                },
+              },
+              result: {
+                address: userWallet.address,
+                publicKey: userWallet.publicKey,
+                type: userWallet.type,
+              },
+            })
+            .catch((err) => logger.error('create remoteDeriveWallet audit log failed', { error: err }));
+
+          res.json({
+            address: userWallet.address,
+            publicKey: userWallet.publicKey,
+            type: userWallet.type,
+          });
+        } catch (error) {
+          logger.error('Failed to create wallet from app DID', {
+            error,
+            blockletDid: req?.blocklet?.meta?.did,
+            componentId: req.headers['x-component-did'],
+          });
+          res.status(500).json({ error: formatError(error) });
+        }
+      }
+    );
+  },
+};

package/api/routes/user.js

@@ -1217,7 +1217,7 @@ module.exports = {
         const blockletInfo = await req.getBlockletInfo();
         const doc = await node.createVerifyCode({ teamDid, subject, purpose: 'login' });
         const now = Math.floor(Date.now() / 1000);
-        const magicLinkToken = JWT.signV2(blockletInfo.wallet.address, blockletInfo.wallet.secretKey, {
+        const magicLinkToken = await JWT.signV2(blockletInfo.wallet.address, blockletInfo.wallet.secretKey, {
           exp: String(now + VERIFY_CODE_TTL),
           data: {
             id: doc.id,

package/api/services/auth/connect/receive-transfer-app-owner.js

@@ -14,7 +14,7 @@ const {
   createUserPassport,
   getRoleFromLocalPassport,
 } = require('@abtnode/auth/lib/passport');
-const getBlockletWallet = require('@blocklet/meta/lib/wallet');
+const { getApplicationWallet: getBlockletWallet } = require('@blocklet/meta/lib/wallet');
 const getRequestIP = require('@abtnode/util/lib/get-request-ip');
 const { getBlockletChainInfo, isInProgress } = require('@blocklet/meta/lib/util');
 const { ROLES, MAIN_CHAIN_ENDPOINT } = require('@abtnode/constant');
@@ -210,7 +210,7 @@ module.exports = function createRoutes(node, _, createSessionToken) {
         dataDir,
         secret,
         logo,
-      } = await getApplicationInfo({ node, teamDid: appPid, baseUrl });
+      } = await getApplicationInfo({ node, nodeInfo: await node.getNodeInfo(), teamDid: appPid, baseUrl });
 
       const statusEndpointBaseUrl = baseUrl;
       const endpoint = baseUrl;

package/api/services/auth/session.js

@@ -245,7 +245,7 @@ module.exports = {
           unReadCount = await getUnreadNotificationCount({ teamDid, receiver: req.user.did }, node);
         }
         // FIXME: @zhanghan 待各应用更新完新版，移除这个签名的处理
-        res.json(signResponse({ unReadCount }, wallet));
+        res.json(await signResponse({ unReadCount }, wallet));
       } catch (err) {
         res.status(500).json({ error: 'Internal Server Error' });
       }
@@ -505,7 +505,7 @@ module.exports = {
           });
 
           res.json(
-            signResponse(
+            await signResponse(
               {
                 user: omit(user, ['extra']),
                 nextToken: sessionToken,

package/api/services/notification/blocklet-events-notifier.js

@@ -177,7 +177,7 @@ const init = ({ node, notificationService }) => {
           return;
         }
 
-        const token = JWT.sign(wallet.address, wallet.secretKey);
+        const token = await JWT.sign(wallet.address, wallet.secretKey);
         const sender = { token, appDid: wallet.address };
 
         const message = messages[eventName]({ data, blockletInfo, error });

package/api/services/notification/queue.js

@@ -172,7 +172,7 @@ const init = ({ node, notificationService }) => {
         const now = Math.floor(Date.now() / 1000);
         const unsubscribeToken =
           wallet && allowUnsubscribe
-            ? JWT.signV2(wallet.address, wallet.secretKey, {
+            ? await JWT.signV2(wallet.address, wallet.secretKey, {
                 userDid: userInfo.did,
                 channel: 'email',
                 exp: String(now + 30 * 24 * 60 * 60), // 30 days
@@ -687,6 +687,7 @@ const init = ({ node, notificationService }) => {
         data.sender ??
         Object.freeze({
           appDid: teamDid || nodeInfo.did,
+          appSk: nodeInfo.sk,
           verified: true,
           type: 'server',
         });

package/api/socket/channel/component.js

@@ -91,7 +91,7 @@ const sendToAppComponents = async ({ event, appDid, componentDid: inputComponent
     sender: {
       did: senderInfo.wallet.address,
       pk: senderInfo.wallet.publicKey,
-      token: JWT.sign(senderInfo.wallet.address, senderInfo.wallet.secretKey),
+      token: await JWT.sign(senderInfo.wallet.address, senderInfo.wallet.secretKey),
       name: senderInfo.name,
     },
   };

package/api/socket/channel/did.js

@@ -261,7 +261,7 @@ const sendToAppDid = async ({
   _notification.sender = {
     did: senderInfo.wallet.address,
     pk: senderInfo.wallet.publicKey,
-    token: JWT.sign(senderInfo.wallet.address, senderInfo.wallet.secretKey),
+    token: await JWT.sign(senderInfo.wallet.address, senderInfo.wallet.secretKey),
     name: senderInfo.name,
   };