@abtnode/blocklet-services 1.17.3-beta-20251119-034511-f26047c0 → 1.17.3-beta-20251119-102907-28b69b76

package/api/services/auth/session.js

@@ -30,6 +30,7 @@ const { createOrgValidators } = require('@abtnode/core/lib/util/org');
 const { isAllowedURL } = require('@abtnode/util/lib/ssrf-protector');
 
 const { getApplicationWallet } = require('@blocklet/meta/lib/wallet');
+const dayjs = require('@abtnode/util/lib/dayjs');
 const { createTokenFn, getDidConnectVersion } = require('../../util');
 const checkUser = require('../../middlewares/check-user');
 const cache = require('../../cache');
@@ -337,194 +338,213 @@ module.exports = {
       res.json({ success: true });
     });
 
-    router.post(`${WELLKNOWN_SERVICE_PATH_PREFIX}/api/did/refreshSession`, refreshBearerToken, async (req, res) => {
-      const token = req.refreshToken;
-      if (token) {
-        const teamDid = req.getBlockletDid();
-        const blocklet = await req.getBlocklet();
-        if (blocklet.settings?.session?.enableBlacklist) {
-          const cacheData = await cache.refreshToken.get(md5(token));
-          if (cacheData?.block) {
-            res.status(400).send(t('userSessionLogout', req.blockletLocale));
-            return;
+    router.post(
+      `${WELLKNOWN_SERVICE_PATH_PREFIX}/api/did/refreshSession`,
+      refreshBearerToken,
+      /**
+       * @description 刷新 session token
+       * @param {import('express').Request} req
+       * @param {import('express').Response} res
+       * @returns {Promise<void>}
+       *
+       */
+      async (req, res) => {
+        const token = req.refreshToken;
+        if (token) {
+          const teamDid = req.getBlockletDid();
+          const blocklet = await req.getBlocklet();
+          if (blocklet.settings?.session?.enableBlacklist) {
+            const cacheData = await cache.refreshToken.get(md5(token));
+            if (cacheData?.block) {
+              res.status(400).send(t('userSessionLogout', req.blockletLocale));
+              return;
+            }
           }
-        }
-        const visitorId = req.get('x-blocklet-visitor-id');
-        const ua = req.get('user-agent');
-        // FIXME: @zhanghan BlockletSDK 和 Aistro 来的请求暂时不需要检查 visitorId，需要在 aistro 适配新的逻辑
-        if (!(isAistroUserAgent(ua) || isBlockletSDKUserAgent(ua))) {
-          if (!visitorId) {
+          const visitorId = req.get('x-blocklet-visitor-id');
+          const ua = req.get('user-agent');
+          // FIXME: @zhanghan BlockletSDK 和 Aistro 来的请求暂时不需要检查 visitorId，需要在 aistro 适配新的逻辑
+          if (!(isAistroUserAgent(ua) || isBlockletSDKUserAgent(ua))) {
+            if (!visitorId) {
+              res.status(400).send(t('userSessionLogout', req.blockletLocale));
+              return;
+            }
+          }
+          const { appPid = teamDid } = req.query;
+          // FIXME: @zhanghan BlockletSDK 和 Aistro 来的请求暂时不需要检查 visitorId，需要在 aistro 适配新的逻辑
+          if (isAistroUserAgent(ua) || isBlockletSDKUserAgent(ua)) {
+            await req.ensureUser({ token, appPid });
+          } else {
+            await req.ensureUser({ token, visitorId, appPid });
+          }
+          if (!req.user) {
             res.status(400).send(t('userSessionLogout', req.blockletLocale));
             return;
           }
-        }
-        const { appPid = teamDid } = req.query;
-        // FIXME: @zhanghan BlockletSDK 和 Aistro 来的请求暂时不需要检查 visitorId，需要在 aistro 适配新的逻辑
-        if (isAistroUserAgent(ua) || isBlockletSDKUserAgent(ua)) {
-          await req.ensureUser({ token, appPid });
-        } else {
-          await req.ensureUser({ token, visitorId, appPid });
-        }
-        if (!req.user) {
-          res.status(400).send(t('userSessionLogout', req.blockletLocale));
-          return;
-        }
 
-        try {
-          const blockletInfo = await req.getBlockletInfo();
-
-          const refreshTokenType = 'refresh';
-          const {
-            did: userPid, // 从 token 拿到的 did 就是 userPid
-            role,
-            passport,
-            provider = LOGIN_PROVIDER.WALLET,
-            walletOS,
-            org, // 从 token 拿到的 orgId
-          } = await verifySessionToken(token, blockletInfo.secret, {
-            checkFromDb: true,
-            teamDid,
-            checkToken: (_token) => {
-              if (_token.tokenType !== refreshTokenType) {
-                throw new Error(`invalid token type ${_token.tokenType}`);
-              }
-            },
-            locale: req.blockletLocale,
-          });
+          try {
+            const blockletInfo = await req.getBlockletInfo();
+
+            const refreshTokenType = 'refresh';
+            const {
+              did: userPid, // 从 token 拿到的 did 就是 userPid
+              role,
+              passport,
+              provider = LOGIN_PROVIDER.WALLET,
+              walletOS,
+              org, // 从 token 拿到的 orgId
+            } = await verifySessionToken(token, blockletInfo.secret, {
+              checkFromDb: true,
+              teamDid,
+              checkToken: (_token) => {
+                if (_token.tokenType !== refreshTokenType) {
+                  throw new Error(`invalid token type ${_token.tokenType}`);
+                }
+              },
+              locale: req.blockletLocale,
+            });
 
-          const user = await node.getUser({ teamDid, user: { did: userPid } });
-
-          if (role) {
-            const rbac = await node.getRBAC(teamDid);
-            user.permissions = await rbac.getScope(role);
-            user.role = role;
-            // 根据 role 获取所在的 org 信息
-            const { getOrgSettings } = createOrgValidators(blocklet);
-            const orgSettings = getOrgSettings();
-            if (orgSettings?.enabled) {
-              try {
-                const roleInfo = await node.getRole({ teamDid, role: { name: user.role } });
-                if (roleInfo?.orgId) {
-                  const orgInfo = await node.getOrg({ teamDid, id: roleInfo?.orgId }, { user: req.user });
-                  user.org = orgInfo || null;
+            const user = await node.getUser({ teamDid, user: { did: userPid } });
+
+            if (role) {
+              const rbac = await node.getRBAC(teamDid);
+              user.permissions = await rbac.getScope(role);
+              user.role = role;
+              // 根据 role 获取所在的 org 信息
+              const { getOrgSettings } = createOrgValidators(blocklet);
+              const orgSettings = getOrgSettings();
+              if (orgSettings?.enabled) {
+                try {
+                  const roleInfo = await node.getRole({ teamDid, role: { name: user.role } });
+                  if (roleInfo?.orgId) {
+                    const orgInfo = await node.getOrg({ teamDid, id: roleInfo?.orgId }, { user: req.user });
+                    user.org = orgInfo || null;
+                  }
+                } catch (err) {
+                  logger.error('get role error', err);
                 }
-              } catch (err) {
-                logger.error('get role error', err);
               }
             }
-          }
 
-          if (user.avatar && user.avatar.startsWith(USER_AVATAR_URL_PREFIX)) {
-            user.avatar = `${WELLKNOWN_SERVICE_PATH_PREFIX}${USER_AVATAR_PATH_PREFIX}/${
-              user.avatar.split('/').slice(-1)[0]
-            }`;
+            if (user.avatar && user.avatar.startsWith(USER_AVATAR_URL_PREFIX)) {
+              user.avatar = `${WELLKNOWN_SERVICE_PATH_PREFIX}${USER_AVATAR_PATH_PREFIX}/${
+                user.avatar.split('/').slice(-1)[0]
+              }`;
 
-            if (req.get('x-avatar-host') === '1') {
-              const appUrl = blocklet.environmentObj.BLOCKLET_APP_URL;
-              user.avatar = joinURL(appUrl, user.avatar);
+              if (req.get('x-avatar-host') === '1') {
+                const appUrl = blocklet.environmentObj.BLOCKLET_APP_URL;
+                user.avatar = joinURL(appUrl, user.avatar);
+              }
             }
-          }
 
-          const sessionConfig = blocklet.settings?.session || {};
-          let userOrg = org;
-          if (!userOrg) {
-            userOrg = await req.getUserOrg(role);
-          }
-          const { sessionToken, refreshToken } = createToken(
-            userPid,
-            {
-              secret: blockletInfo.secret,
-              passport,
-              role,
-              fullName: user.fullName,
-              provider,
-              walletOS,
-              emailVerified: !!user?.emailVerified,
-              phoneVerified: !!user?.phoneVerified,
-              org: userOrg,
-            },
-            { ...sessionConfig, didConnectVersion: getDidConnectVersion(req) }
-          );
-          const lastLoginIp = getRequestIP(req);
-          const deviceData = getDeviceData({ req });
-          const userSession = await node.upsertUserSession({
-            visitorId,
-            teamDid,
-            userDid: userPid,
-            appPid: teamDid,
-            status: USER_SESSION_STATUS.ONLINE,
-            // refreshSession 时更新 ua 可以解决浏览器升级导致 ua 变化产生的问题
-            ua,
-            lastLoginIp,
-            extra: {
-              walletOS,
-              device: deviceData,
-            },
-            origin: await getOrigin({ req }),
-          });
-          if (user?.sourceAppPid) {
-            await node.syncUserSession({
+            const sessionConfig = blocklet.settings?.session || {};
+            let userOrg = org;
+            if (!userOrg) {
+              userOrg = await req.getUserOrg(role);
+            }
+            const { sessionToken, refreshToken } = createToken(
+              userPid,
+              {
+                secret: blockletInfo.secret,
+                passport,
+                role,
+                fullName: user.fullName,
+                provider,
+                walletOS,
+                emailVerified: !!user?.emailVerified,
+                phoneVerified: !!user?.phoneVerified,
+                org: userOrg,
+              },
+              { ...sessionConfig, didConnectVersion: getDidConnectVersion(req) }
+            );
+            const lastLoginIp = getRequestIP(req);
+            const deviceData = getDeviceData({ req });
+            const userSession = await node.upsertUserSession({
+              visitorId,
               teamDid,
-              userDid: userSession.userDid,
-              visitorId: userSession.visitorId,
-              targetAppPid: user.sourceAppPid,
+              userDid: userPid,
+              appPid: teamDid,
+              status: USER_SESSION_STATUS.ONLINE,
+              // refreshSession 时更新 ua 可以解决浏览器升级导致 ua 变化产生的问题
               ua,
               lastLoginIp,
               extra: {
                 walletOS,
                 device: deviceData,
               },
+              origin: await getOrigin({ req }),
             });
-          }
+            if (user?.sourceAppPid) {
+              await node.syncUserSession({
+                teamDid,
+                userDid: userSession.userDid,
+                visitorId: userSession.visitorId,
+                targetAppPid: user.sourceAppPid,
+                ua,
+                lastLoginIp,
+                extra: {
+                  walletOS,
+                  device: deviceData,
+                },
+              });
+            }
 
-          // 颁发新的 token 前，将原有的 token 和 refreshToken 拉黑
-          // req.token 无法正确获得 login_token，所以需要通过 getTokenFromReq 获取
-          const { token: requestSessionToken } = getTokenFromReq(req, {
-            cookie: {
-              key: 'login_token',
-            },
-            headerKey: false,
-          });
-          if (requestSessionToken) {
-            const sessionTtl = jwtDecode(requestSessionToken).exp * 1000 - Date.now();
-            if (sessionTtl > 0) {
-              await cache.sessionToken.set(md5(requestSessionToken), { block: true }, { ttl: sessionTtl });
+            // 颁发新的 token 前，将原有的 token 和 refreshToken 拉黑
+            // req.token 无法正确获得 login_token，所以需要通过 getTokenFromReq 获取
+            const { token: requestSessionToken } = getTokenFromReq(req, {
+              cookie: {
+                key: 'login_token',
+              },
+              headerKey: false,
+            });
+            if (requestSessionToken) {
+              const sessionTtl = jwtDecode(requestSessionToken).exp * 1000 - Date.now();
+              if (sessionTtl > 0) {
+                await cache.sessionToken.set(md5(requestSessionToken), { block: true }, { ttl: sessionTtl });
+              }
             }
-          }
-          if (req.refreshToken) {
-            const refreshTtl = jwtDecode(req.refreshToken).exp * 1000 - Date.now();
-            if (refreshTtl > 0) {
-              await cache.refreshToken.set(md5(req.refreshToken), { block: true }, { ttl: refreshTtl });
+            if (req.refreshToken) {
+              const refreshTtl = jwtDecode(req.refreshToken).exp * 1000 - Date.now();
+              if (refreshTtl > 0) {
+                await cache.refreshToken.set(md5(req.refreshToken), { block: true }, { ttl: refreshTtl });
+              }
             }
-          }
 
-          // 刷新 csrf token
-          const nodeInfo = await node.getNodeInfo();
-          const accessWallet = getApplicationWallet(blocklet.appDid || blocklet.meta.did, nodeInfo.sk, undefined, 2);
-          const csrfToken = await sign(accessWallet.secretKey, sessionToken);
-          res.cookie('x-csrf-token', csrfToken, {
-            sameSite: 'strict',
-            secure: true,
-          });
+            // 刷新 csrf token
+            const nodeInfo = await node.getNodeInfo();
+            const accessWallet = getApplicationWallet(blocklet.appDid || blocklet.meta.did, nodeInfo.sk, undefined, 2);
+            const csrfToken = await sign(accessWallet.secretKey, sessionToken);
+            // @note: 同时设置 token
+            res.cookie('x-csrf-token', csrfToken, {
+              sameSite: 'strict',
+              secure: true,
+            });
+            res.cookie('login_token', sessionToken, {
+              sameSite: 'lax',
+              secure: true,
+              expires: dayjs()
+                .add(blocklet?.settings?.session?.cacheTtl || 3600, 's')
+                .toDate(),
+            });
 
-          res.json(
-            await signResponse(
-              {
-                user: omit(user, ['extra']),
-                nextToken: sessionToken,
-                nextRefreshToken: refreshToken,
-                provider,
-                walletOS,
-              },
-              blockletInfo.wallet
-            )
-          );
-        } catch (err) {
-          res.status(400).send(err.message);
+            res.json(
+              await signResponse(
+                {
+                  user: omit(user, ['extra']),
+                  nextToken: sessionToken,
+                  nextRefreshToken: refreshToken,
+                  provider,
+                  walletOS,
+                },
+                blockletInfo.wallet
+              )
+            );
+          } catch (err) {
+            res.status(400).send(err.message);
+          }
+        } else {
+          res.status(400).send(t('emptyRefreshToken', req.blockletLocale));
         }
-      } else {
-        res.status(400).send(t('emptyRefreshToken', req.blockletLocale));
       }
-    });
+    );
   },
 };

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.17.3-beta-20251119-034511-f26047c0",
+  "version": "1.17.3-beta-20251119-102907-28b69b76",
   "description": "Provide unified services for every blocklet",
   "main": "api/index.js",
   "files": [
@@ -32,17 +32,17 @@
   "author": "wangshijun <wangshijun2010@gmail.com> (http://github.com/wangshijun)",
   "license": "Apache-2.0",
   "dependencies": {
-    "@abtnode/analytics": "1.17.3-beta-20251119-034511-f26047c0",
-    "@abtnode/auth": "1.17.3-beta-20251119-034511-f26047c0",
-    "@abtnode/connect-storage": "1.17.3-beta-20251119-034511-f26047c0",
-    "@abtnode/constant": "1.17.3-beta-20251119-034511-f26047c0",
-    "@abtnode/core": "1.17.3-beta-20251119-034511-f26047c0",
-    "@abtnode/cron": "1.17.3-beta-20251119-034511-f26047c0",
-    "@abtnode/db-cache": "1.17.3-beta-20251119-034511-f26047c0",
-    "@abtnode/logger": "1.17.3-beta-20251119-034511-f26047c0",
-    "@abtnode/models": "1.17.3-beta-20251119-034511-f26047c0",
-    "@abtnode/router-templates": "1.17.3-beta-20251119-034511-f26047c0",
-    "@abtnode/util": "1.17.3-beta-20251119-034511-f26047c0",
+    "@abtnode/analytics": "1.17.3-beta-20251119-102907-28b69b76",
+    "@abtnode/auth": "1.17.3-beta-20251119-102907-28b69b76",
+    "@abtnode/connect-storage": "1.17.3-beta-20251119-102907-28b69b76",
+    "@abtnode/constant": "1.17.3-beta-20251119-102907-28b69b76",
+    "@abtnode/core": "1.17.3-beta-20251119-102907-28b69b76",
+    "@abtnode/cron": "1.17.3-beta-20251119-102907-28b69b76",
+    "@abtnode/db-cache": "1.17.3-beta-20251119-102907-28b69b76",
+    "@abtnode/logger": "1.17.3-beta-20251119-102907-28b69b76",
+    "@abtnode/models": "1.17.3-beta-20251119-102907-28b69b76",
+    "@abtnode/router-templates": "1.17.3-beta-20251119-102907-28b69b76",
+    "@abtnode/util": "1.17.3-beta-20251119-102907-28b69b76",
     "@arcblock/did": "^1.27.7",
     "@arcblock/did-connect-js": "^1.27.7",
     "@arcblock/did-ext": "^1.27.7",
@@ -52,18 +52,18 @@
     "@arcblock/jwt": "^1.27.7",
     "@arcblock/validator": "^1.27.7",
     "@arcblock/ws": "^1.27.7",
-    "@blocklet/constant": "1.17.3-beta-20251119-034511-f26047c0",
+    "@blocklet/constant": "1.17.3-beta-20251119-102907-28b69b76",
     "@blocklet/dbhub": "^0.2.9",
-    "@blocklet/env": "1.17.3-beta-20251119-034511-f26047c0",
+    "@blocklet/env": "1.17.3-beta-20251119-102907-28b69b76",
     "@blocklet/error": "^0.3.3",
     "@blocklet/form-builder": "^0.1.12",
     "@blocklet/form-collector": "^0.1.8",
-    "@blocklet/images": "1.17.3-beta-20251119-034511-f26047c0",
-    "@blocklet/js-sdk": "1.17.3-beta-20251119-034511-f26047c0",
-    "@blocklet/meta": "1.17.3-beta-20251119-034511-f26047c0",
-    "@blocklet/rate-limit": "1.17.3-beta-20251119-034511-f26047c0",
-    "@blocklet/sdk": "1.17.3-beta-20251119-034511-f26047c0",
-    "@blocklet/server-js": "1.17.3-beta-20251119-034511-f26047c0",
+    "@blocklet/images": "1.17.3-beta-20251119-102907-28b69b76",
+    "@blocklet/js-sdk": "1.17.3-beta-20251119-102907-28b69b76",
+    "@blocklet/meta": "1.17.3-beta-20251119-102907-28b69b76",
+    "@blocklet/rate-limit": "1.17.3-beta-20251119-102907-28b69b76",
+    "@blocklet/sdk": "1.17.3-beta-20251119-102907-28b69b76",
+    "@blocklet/server-js": "1.17.3-beta-20251119-102907-28b69b76",
     "@blocklet/theme": "^3.2.6",
     "@blocklet/theme-builder": "0.4.8",
     "@blocklet/uploader-server": "^0.3.11",
@@ -123,7 +123,7 @@
     "whatwg-url": "14.0.0"
   },
   "devDependencies": {
-    "@abtnode/ux": "1.17.3-beta-20251119-034511-f26047c0",
+    "@abtnode/ux": "1.17.3-beta-20251119-102907-28b69b76",
     "@arcblock/bridge": "^3.2.6",
     "@arcblock/did-connect-react": "^3.2.6",
     "@arcblock/icons": "^3.2.6",
@@ -133,7 +133,7 @@
     "@blocklet/did-space-react": "^1.2.4",
     "@blocklet/launcher-layout": "^3.2.6",
     "@blocklet/payment-react": "^1.22.14",
-    "@blocklet/tracker": "1.17.3-beta-20251119-034511-f26047c0",
+    "@blocklet/tracker": "1.17.3-beta-20251119-102907-28b69b76",
     "@blocklet/ui-react": "^3.2.6",
     "@blocklet/uploader": "^0.3.11",
     "@emotion/react": "^11.14.0",
@@ -213,5 +213,5 @@
     "url": "https://github.com/ArcBlock/blocklet-server/issues",
     "email": "shijun@arcblock.io"
   },
-  "gitHead": "7ab331f3b29e171a1e02aca80e73f35b6a161b86"
+  "gitHead": "6ae74784386f183ac410a226b6b9334c0f722fcc"
 }