@abtnode/blocklet-services 1.8.3 → 1.8.4

package/api/index.js

@@ -30,7 +30,8 @@ const { init: initAuth } = require('./services/auth');
 const StaticService = require('./services/static');
 const createEnvRoutes = require('./routes/env');
 const createBlockletRoutes = require('./routes/blocklet');
-const createConnectRelayRoutes = require('./routes/connect-relay');
+const createConnectRelayRoutes = require('./routes/connect/relay');
+const createConnectSessionRoutes = require('./routes/connect/session');
 const createDnsResolver = require('./routes/dns-resolver');
 const checkRunning = require('./middlewares/check-running');
 const checkAdminPermission = require('./middlewares/check-admin-permission');
@@ -199,6 +200,7 @@ module.exports = function createServer(node, serverOptions = {}) {
   // API: auth
   createEnvRoutes.init(server, node, options);
   createBlockletRoutes.init(server, node, options);
+  createConnectSessionRoutes.init(server, node, options);
   createConnectRelayRoutes.init(server, node, options, wsRouter);
   authRoutes.attachDidAuthHandlers(server);
   authRoutes.createPassportRoutes.init(server, node, options);

package/api/libs/connect/session.js

@@ -0,0 +1,456 @@
+// Holds shared logic for session-manager v1 and v2
+const get = require('lodash/get');
+const joinUrl = require('url-join');
+const formatContext = require('@abtnode/util/lib/format-context');
+const { extractUserAvatar } = require('@abtnode/util/lib/user-avatar');
+const {
+  messages,
+  getUser,
+  getVCFromClaims,
+  validatePassportStatus,
+  getPassportStatusEndpoint,
+} = require('@abtnode/auth/lib/auth');
+const {
+  NODE_SERVICES,
+  ROLES,
+  WELLKNOWN_SERVICE_PATH_PREFIX,
+  VC_TYPE_GENERAL_PASSPORT,
+  VC_TYPE_NODE_PASSPORT,
+  WHO_CAN_ACCESS,
+} = require('@abtnode/constant');
+const {
+  validatePassport,
+  isUserPassportRevoked,
+  getRoleFromLocalPassport,
+  getRoleFromExternalPassport,
+  createUserPassport,
+  createPassportVC,
+  createPassport,
+  upsertToPassports,
+} = require('@abtnode/auth/lib/passport');
+
+const logger = require('@abtnode/logger')(require('../../../package.json').name);
+
+const vcTypes = [VC_TYPE_GENERAL_PASSPORT, VC_TYPE_NODE_PASSPORT];
+
+/**
+ * @returns {Array} config
+ * @returns {Boolean} config[0] is invited user only
+ * @returns {String} config[1] default role
+ * @returns {Boolean} config[2] issue passport
+ */
+const isInvitedUserOnly = async (config, node, teamDid) => {
+  const count = await node.getUsersCount({ teamDid });
+
+  // issue owner passport for first login user
+  if (count === 0) {
+    return [false, ROLES.OWNER, true];
+  }
+
+  if ([WHO_CAN_ACCESS.OWNER, WHO_CAN_ACCESS.INVITED].includes(config.whoCanAccess)) {
+    return [true];
+  }
+
+  if ([WHO_CAN_ACCESS.ALL].includes(config.whoCanAccess)) {
+    return [false, ROLES.GUEST];
+  }
+
+  return [false, ROLES.GUEST];
+};
+
+module.exports = {
+  login: {
+    onConnect: async ({ node, request, userDid, locale, passportId = '' }) => {
+      const blocklet = await request.getBlocklet();
+      const config = await request.getServiceConfig(NODE_SERVICES.AUTH);
+      const { wallet, did: teamDid } = await request.getBlockletInfo();
+
+      const profileFields = get(config, 'profileFields');
+      const [invitedUserOnly] = await isInvitedUserOnly(config, node, teamDid);
+      const trustedPassports = (blocklet.trustedPassports || []).map((x) => x.issuerDid);
+      const trustedIssuers = [wallet.address, ...trustedPassports].filter(Boolean);
+
+      const claims = {
+        profile: {
+          type: 'profile',
+          description: messages.description[locale],
+          items: profileFields || ['fullName', 'avatar'],
+        },
+        verifiableCredential: {
+          type: 'verifiableCredential',
+          description: messages.requestPassport[locale],
+          item: vcTypes,
+          trustedIssuers,
+          optional: !invitedUserOnly,
+        },
+      };
+      if (passportId) {
+        claims.verifiableCredential.target = passportId;
+      }
+
+      const user = await node.getUser({ teamDid: blocklet.meta.did, user: { did: userDid } });
+      if (user) {
+        delete claims.profile;
+      }
+
+      return claims;
+    },
+
+    onApprove: async ({ node, request, locale, challenge, userDid, userPk, claims, baseUrl, createSessionToken }) => {
+      const blocklet = await request.getBlocklet();
+      const { wallet, name, passportColor, did: teamDid } = await request.getBlockletInfo();
+      const teamAppDid = wallet.address;
+
+      // check user approved
+      const user = await getUser(node, teamDid, userDid);
+      if (user && !user.approved) {
+        throw new Error(messages.notAllowed[locale]);
+      }
+
+      // Get passport
+      const trustedPassports = (blocklet.trustedPassports || []).map((x) => x.issuerDid);
+      const trustedIssuers = [teamAppDid, ...trustedPassports].filter(Boolean);
+      const { vc: inputVC } = await getVCFromClaims({
+        claims,
+        challenge,
+        trustedIssuers,
+        vcTypes,
+        locale,
+      });
+
+      let vc = inputVC;
+
+      const config = (await request.getServiceConfig(NODE_SERVICES.AUTH)) || {};
+      const [invitedUserOnly, defaultRole, issuePassport] = await isInvitedUserOnly(config, node, teamDid);
+
+      if (invitedUserOnly && !vc) {
+        throw new Error(messages.missingCredentialClaim[locale]);
+      }
+
+      // issue passport for the first login user in a invite-only team
+      if (issuePassport) {
+        logger.info('issue passport to user at the login workflow', { role: defaultRole });
+        const profile = claims.find((x) => x.type === 'profile');
+        vc = createPassportVC({
+          issuerName: name,
+          issuerWallet: wallet,
+          ownerDid: userDid,
+          passport: await createPassport({
+            name: defaultRole,
+            node,
+            teamDid,
+            locale,
+            endpoint: baseUrl,
+          }),
+          endpoint: getPassportStatusEndpoint({
+            baseUrl: joinUrl(baseUrl, WELLKNOWN_SERVICE_PATH_PREFIX),
+            userDid,
+            teamDid,
+          }),
+          ownerProfile: profile,
+          preferredColor: passportColor,
+        });
+      }
+
+      // Get user passport from vc
+      let passport = vc ? createUserPassport(vc) : null;
+      if (user && passport && isUserPassportRevoked(user, passport)) {
+        throw new Error(messages.passportRevoked[locale](name));
+      }
+
+      // Get role
+      let role = ROLES.GUEST;
+      if (vc) {
+        await validatePassport(get(vc, 'credentialSubject.passport'));
+        const issuerId = get(vc, 'issuer.id');
+        if (issuerId === teamAppDid) {
+          role = getRoleFromLocalPassport(get(vc, 'credentialSubject.passport'));
+        } else {
+          // map external passport to local role
+          const { mappings = [] } = (blocklet.trustedPassports || []).find((x) => x.issuerDid === issuerId) || {};
+          role = await getRoleFromExternalPassport({
+            passport: get(vc, 'credentialSubject.passport'),
+            node,
+            teamDid,
+            locale,
+            mappings,
+          });
+
+          // check status of external passport if passport has an endpoint
+          const endpoint = get(vc, 'credentialStatus.id');
+          if (endpoint) {
+            await validatePassportStatus({ vcId: vc.id, endpoint, locale });
+          }
+        }
+      }
+
+      if (config.whoCanAccess === WHO_CAN_ACCESS.OWNER && role !== ROLES.OWNER) {
+        throw new Error(
+          {
+            zh: '你不是该应用的所有者',
+            en: 'You are not the owner of this application',
+          }[locale]
+        );
+      }
+
+      // Recreate passport with correct role
+      passport = vc ? createUserPassport(vc, { role }) : null;
+
+      // Update profile
+      const passportForLog = passport || { name: 'Guest', role: 'guest' };
+      if (user) {
+        // Update user
+        const doc = await node.updateUser({
+          teamDid,
+          user: {
+            did: userDid,
+            pk: userPk,
+            locale,
+            passports: upsertToPassports(user.passports || [], passport).filter(Boolean),
+            lastLoginAt: new Date().toISOString(),
+          },
+        });
+        await node.createAuditLog(
+          {
+            action: 'login',
+            args: { teamDid, userDid, passport: passportForLog },
+            context: formatContext(Object.assign(request, { user: doc })),
+            result: doc,
+          },
+          node
+        );
+      } else {
+        // Create user
+        const profile = claims.find((x) => x.type === 'profile');
+
+        const doc = await node.addUser({
+          teamDid,
+          user: {
+            ...profile,
+            avatar: await extractUserAvatar(get(profile, 'avatar'), {
+              dataDir: blocklet.env.dataDir,
+            }),
+            did: userDid,
+            pk: userPk,
+            approved: true,
+            locale,
+            passports: [passport].filter(Boolean),
+            firstLoginAt: new Date().toISOString(),
+            lastLoginAt: new Date().toISOString(),
+          },
+        });
+        await node.createAuditLog(
+          {
+            action: 'addUser',
+            args: { teamDid, userDid, reason: `first login as ${passportForLog.role}` },
+            context: formatContext(Object.assign(request, { user: doc })),
+            result: doc,
+          },
+          node
+        );
+      }
+
+      // Generate new session token that client can save to localStorage
+      const sessionToken = await createSessionToken(userDid, { passport, role });
+      logger.info('login.success', { userDid, role });
+
+      if (
+        // if user provides owner passport AND app does not have owner, set this user to owner
+        (inputVC && role === ROLES.OWNER && !blocklet.settings?.owner) ||
+        // if the user will receive a owner passport AND app does not have owner, set this user to owner
+        (issuePassport && defaultRole === ROLES.OWNER && !blocklet.settings?.owner)
+      ) {
+        logger.info('Bind owner for blocklet', { teamDid, userDid });
+        await node.setBlockletInitialized({ did: teamDid, owner: { did: userDid, pk: userPk } });
+      }
+
+      // issue passport for the first login user in a invite-only team
+      if (issuePassport) {
+        return {
+          disposition: 'attachment',
+          type: 'VerifiableCredential',
+          data: vc,
+          sessionToken,
+          nextWorkflowData: {
+            userDid,
+          },
+        };
+      }
+
+      return {
+        sessionToken,
+        nextWorkflowData: {
+          userDid,
+        },
+      };
+    },
+  },
+
+  switchProfile: {
+    onConnect: async ({ node, request, locale, userDid, previousUserDid }) => {
+      if (userDid && previousUserDid && userDid !== previousUserDid) {
+        throw new Error(messages.userMismatch[locale]);
+      }
+
+      const config = await request.getServiceConfig(NODE_SERVICES.AUTH);
+      if (get(config, 'allowSwitchProfile', true) === false) {
+        throw new Error(messages.actionForbidden[locale]);
+      }
+
+      const { did: teamDid } = await request.getBlockletInfo();
+      const user = await getUser(node, teamDid, userDid);
+
+      if (!user) {
+        throw new Error(messages.userNotFound[locale]);
+      }
+      if (!user.approved) {
+        throw new Error(messages.notAuthorized[locale]);
+      }
+
+      return {
+        profile: {
+          type: 'profile',
+          description: messages.description[locale],
+          items: get(config, 'profileFields') || ['fullName', 'avatar'],
+        },
+      };
+    },
+    onApprove: async ({ node, request, locale, profile, userDid }) => {
+      const blocklet = await request.getBlocklet();
+      const teamDid = blocklet.meta.did;
+
+      // check user approved
+      const user = await getUser(node, teamDid, userDid);
+      if (!user) {
+        throw new Error(messages.userNotFound[locale]);
+      }
+      if (!user.approved) {
+        throw new Error(messages.notAuthorized[locale]);
+      }
+
+      // Update user
+      const doc = await node.updateUser({
+        teamDid,
+        user: {
+          ...user,
+          ...profile,
+          avatar: await extractUserAvatar(get(profile, 'avatar'), {
+            dataDir: blocklet.env.dataDir,
+          }),
+          locale,
+        },
+      });
+      await node.createAuditLog(
+        {
+          action: 'switchProfile',
+          args: { teamDid, userDid, profile },
+          context: formatContext(Object.assign(request, { user })),
+          result: doc,
+        },
+        node
+      );
+    },
+  },
+
+  switchPassport: {
+    onConnect: async ({ node, request, locale, userDid, previousUserDid }) => {
+      if (userDid && previousUserDid && userDid !== previousUserDid) {
+        throw new Error(messages.userMismatch[locale]);
+      }
+
+      const { wallet, did: teamDid } = await request.getBlockletInfo();
+      const user = await getUser(node, teamDid, userDid);
+
+      if (!user) {
+        throw new Error(messages.userNotFound[locale]);
+      }
+      if (!user.approved) {
+        throw new Error(messages.notAuthorized[locale]);
+      }
+
+      const blocklet = await request.getBlocklet();
+      const trustedPassports = (blocklet.trustedPassports || []).map((x) => x.issuerDid);
+      const trustedIssuers = [wallet.address, ...trustedPassports].filter(Boolean);
+
+      return {
+        verifiableCredential: {
+          type: 'verifiableCredential',
+          description: messages.requestPassport[locale],
+          item: vcTypes,
+          trustedIssuers,
+          optional: false,
+        },
+      };
+    },
+    onApprove: async ({ node, request, locale, challenge, verifiableCredential, userDid, createSessionToken }) => {
+      const blocklet = await request.getBlocklet();
+      const { wallet, name, did: teamDid } = await request.getBlockletInfo();
+
+      // Validate user
+      const user = await getUser(node, teamDid, userDid);
+      if (!user) {
+        throw new Error(messages.userNotFound[locale]);
+      }
+      if (!user.approved) {
+        throw new Error(messages.notAuthorized[locale]);
+      }
+
+      // Get passport
+      const trustedPassports = (blocklet.trustedPassports || []).map((x) => x.issuerDid);
+      const trustedIssuers = [wallet.address, ...trustedPassports].filter(Boolean);
+      const { vc } = await getVCFromClaims({
+        claims: [verifiableCredential],
+        challenge,
+        trustedIssuers,
+        vcTypes,
+        locale,
+      });
+
+      // Get user passport from vc
+      let passport = createUserPassport(vc);
+      if (passport && isUserPassportRevoked(user, passport)) {
+        throw new Error(messages.passportRevoked[locale](name));
+      }
+
+      // Get role
+      let role = ROLES.GUEST;
+      await validatePassport(get(vc, 'credentialSubject.passport'));
+      const issuerId = get(vc, 'issuer.id');
+      if (issuerId === wallet.address) {
+        role = getRoleFromLocalPassport(get(vc, 'credentialSubject.passport'));
+      } else {
+        // map external passport to local role
+        const { mappings = [] } = (blocklet.trustedPassports || []).find((x) => x.issuerDid === issuerId) || {};
+        role = await getRoleFromExternalPassport({
+          passport: get(vc, 'credentialSubject.passport'),
+          node,
+          teamDid,
+          locale,
+          mappings,
+        });
+
+        // check status of external passport if passport has an endpoint
+        const endpoint = get(vc, 'credentialStatus.id');
+        if (endpoint) {
+          await validatePassportStatus({ vcId: vc.id, endpoint, locale });
+        }
+      }
+
+      // Recreate passport with correct role
+      passport = createUserPassport(vc, { role });
+      await node.createAuditLog(
+        {
+          action: 'switchPassport',
+          args: { teamDid, userDid, passport },
+          context: formatContext(Object.assign(request, { user })),
+          result: {},
+        },
+        node
+      );
+
+      // Generate new session token that client can save to localStorage
+      const sessionToken = await createSessionToken(userDid, { passport, role });
+      return sessionToken;
+    },
+  },
+};

package/api/libs/connect/v2.js

@@ -5,6 +5,8 @@ const createHandlers = require('@blocklet/sdk/lib/connect/handler');
 const { sendToUser } = require('@blocklet/sdk/lib/util/send-notification');
 const { WELLKNOWN_SERVICE_PATH_PREFIX } = require('@abtnode/constant');
 
+const logger = require('@abtnode/logger')(require('../../../package.json').name);
+
 const { appInfo, chainInfo } = require('./shared');
 
 module.exports = (node, opts) => {
@@ -18,6 +20,7 @@ module.exports = (node, opts) => {
   });
 
   const handlers = createHandlers({
+    logger,
     authenticator,
     storage: new NedbStorage({
       dbPath: path.join(opts.dataDir, 'sessions.db'),

package/api/routes/{connect-relay.js → connect/relay.js}

@@ -1,14 +1,14 @@
 const { WELLKNOWN_SERVICE_PATH_PREFIX } = require('@abtnode/constant');
 const { attachHandlers } = require('@did-connect/relay-adapter-express');
-const initConnectRelay = require('../libs/connect/v2');
+const initConnectRelay = require('../../libs/connect/v2');
 
 module.exports = {
-  init(server, node, opts, wsRouter) {
+  init(router, node, opts, wsRouter) {
     const { handlers } = initConnectRelay(node, opts);
     const prefix = `${WELLKNOWN_SERVICE_PATH_PREFIX}/api/connect/relay`;
 
     // attach http handlers
-    attachHandlers(server, handlers, prefix);
+    attachHandlers(router, handlers, prefix);
 
     // attach ws handlers
     wsRouter.use(`${prefix}/websocket`, handlers.wsServer.onConnect.bind(handlers.wsServer));

package/api/routes/connect/session.js

@@ -0,0 +1,120 @@
+const { WELLKNOWN_SERVICE_PATH_PREFIX } = require('@abtnode/constant');
+const { switchProfile, switchPassport, login } = require('../../libs/connect/session');
+const initJwt = require('../../libs/jwt');
+
+module.exports = {
+  init(server, node, options) {
+    const prefix = `${WELLKNOWN_SERVICE_PATH_PREFIX}/api/connect/relay`;
+
+    // api for login
+    server.post(`${prefix}/login/connect`, async (req, res) => {
+      try {
+        const { locale, currentConnected } = req.body;
+        const claim = await login.onConnect({
+          node,
+          request: req,
+          locale,
+          userDid: currentConnected.userDid,
+          userPk: currentConnected.userPk,
+          passportId: req.query.passportId || '',
+        });
+        res.json([[claim.profile, claim.verifiableCredential].filter(Boolean)]);
+      } catch (err) {
+        console.error(err);
+        res.json({ error: err.message });
+      }
+    });
+    server.post(`${prefix}/login/approve`, async (req, res) => {
+      try {
+        const { locale, currentStep, challenge, authUrl, currentConnected, responseClaims } = req.body;
+        const { createSessionToken } = initJwt(node, options);
+        const result = await login.onApprove({
+          node,
+          request: req,
+          locale,
+          challenge,
+          claims: responseClaims[currentStep],
+          userDid: currentConnected.userDid,
+          userPk: currentConnected.userPk,
+          baseUrl: new URL(authUrl).origin,
+          createSessionToken,
+        });
+        res.json(result);
+      } catch (err) {
+        console.error(err);
+        res.json({ error: err.message });
+      }
+    });
+
+    // api for switch profile
+    server.post(`${prefix}/switch-profile/connect`, async (req, res) => {
+      try {
+        const { locale, currentConnected, previousConnected } = req.body;
+        const claim = await switchProfile.onConnect({
+          node,
+          request: req,
+          locale,
+          userDid: currentConnected.userDid,
+          previousUserDid: previousConnected?.userDid,
+        });
+        res.json([[{ type: 'profile', ...claim.profile }]]);
+      } catch (err) {
+        console.error(err);
+        res.json({ error: err.message });
+      }
+    });
+    server.post(`${prefix}/switch-profile/approve`, async (req, res) => {
+      try {
+        const { locale, currentConnected, responseClaims, currentStep } = req.body;
+        const result = await switchProfile.onApprove({
+          node,
+          request: req,
+          locale,
+          profile: responseClaims[currentStep].find((x) => x.type === 'profile'),
+          userDid: currentConnected.userDid,
+        });
+        res.json(result);
+      } catch (err) {
+        console.error(err);
+        res.json({ error: err.message });
+      }
+    });
+
+    // api for switch passport
+    server.post(`${prefix}/switch-passport/connect`, async (req, res) => {
+      try {
+        const { locale, currentConnected, previousConnected } = req.body;
+        const claim = await switchPassport.onConnect({
+          node,
+          request: req,
+          locale,
+          userDid: currentConnected.userDid,
+          previousUserDid: previousConnected?.userDid,
+        });
+        res.json([[{ type: 'verifiableCredential', ...claim.verifiableCredential }]]);
+      } catch (err) {
+        console.error(err);
+        res.json({ error: err.message });
+      }
+    });
+    server.post(`${prefix}/switch-passport/approve`, async (req, res) => {
+      try {
+        const { locale, currentConnected, responseClaims, challenge, currentStep } = req.body;
+        const { createSessionToken } = initJwt(node, options);
+        const sessionToken = await switchPassport.onApprove({
+          node,
+          request: req,
+          locale,
+          challenge,
+          verifiableCredential: responseClaims[currentStep].find((x) => x.type === 'verifiableCredential'),
+          userDid: currentConnected.userDid,
+          createSessionToken,
+        });
+        res.json({ sessionToken });
+      } catch (err) {
+        console.error(err);
+        res.json({ error: err.message });
+      }
+    });
+  },
+};