@abtnode/core 1.16.14-beta-a898bfcb → 1.16.14-beta-0c29907f

package/lib/blocklet/manager/disk.js

@@ -1,3 +1,4 @@
+/* eslint-disable max-classes-per-file */
 /* eslint-disable no-underscore-dangle */
 /* eslint-disable no-await-in-loop */
 const fs = require('fs-extra');
@@ -25,6 +26,7 @@ const {
   APP_STRUCT_VERSION,
   BLOCKLET_CACHE_TTL,
   MONITOR_RECORD_INTERVAL_SEC,
+  INSTALL_ACTIONS,
 } = require('@abtnode/constant');
 
 const getBlockletEngine = require('@blocklet/meta/lib/engine');
@@ -45,7 +47,6 @@ const {
   forEachComponentV2Sync,
   findComponentByIdV2,
 } = require('@blocklet/meta/lib/util');
-const getComponentProcessId = require('@blocklet/meta/lib/get-component-process-id');
 const { update: updateMetaFile } = require('@blocklet/meta/lib/file');
 const { titleSchema, updateMountPointSchema, environmentNameSchema } = require('@blocklet/meta/lib/schema');
 const { emailConfigSchema } = require('@blocklet/sdk/lib/validators/email');
@@ -76,6 +77,12 @@ const {
   SUSPENDED_REASON,
 } = require('@blocklet/constant');
 const isUndefined = require('lodash/isUndefined');
+const { WELLKNOWN_SERVICE_PATH_PREFIX } = require('@abtnode/constant');
+const { signV2 } = require('@arcblock/jwt');
+const normalizePathPrefix = require('@abtnode/util/lib/normalize-path-prefix');
+const pLimit = require('p-limit');
+const pRetry = require('p-retry');
+
 const { consumeServerlessNFT, consumeLauncherSession } = require('../../util/launcher');
 const util = require('../../util');
 const {
@@ -118,7 +125,9 @@ const {
   shouldSkipComponent,
   exceedRedemptionPeriod,
   ensureAppPortsNotOccupied,
+  getComponentNamesWithVersion,
 } = require('../../util/blocklet');
+const { getDidDomainForBlocklet } = require('../../util/get-domain-for-blocklet');
 const states = require('../../states');
 const BaseBlockletManager = require('./base');
 const { get: getEngine } = require('./engine');
@@ -147,9 +156,12 @@ const { getBackupFilesUrlFromEndpoint, getBackupEndpoint, getSpaceNameByEndpoint
 const { validateAddSpaceGateway, validateUpdateSpaceGateway } = require('../../validators/space-gateway');
 const { sessionConfigSchema } = require('../../validators/util');
 
+const request = require('../../util/request');
+
 const { formatEnvironments, getBlockletMeta, validateOwner } = util;
 
 const statusLock = new Lock('blocklet-status-lock');
+const limitSync = pLimit(1);
 
 const getHooksOutputFiles = (blocklet) => ({
   output: path.join(blocklet.env.logsDir, 'output.log'),
@@ -168,57 +180,7 @@ const pm2StatusMap = {
  */
 const getBlockletEngineNameByPlatform = (blockletMeta) => getBlockletEngine(blockletMeta).interpreter;
 
-/**
- * @param {{
- *   newBlocklet,
- *   oldBlocklet,
- *   context: { forceStartProcessIds?: string[] },
- * }}
- * @returns {{ installedComponentNames: string[], skippedProcessIds: string[] }}
- */
-const getComponentChangedInfoForUpgrade = ({ newBlocklet, oldBlocklet, context = {} }) => {
-  const { forceStartProcessIds = [] } = context;
-  const idMap = {};
-  const skippedProcessIds = [];
-  const installedComponentNames = [];
-
-  forEachBlockletSync(oldBlocklet, (b, { ancestors }) => {
-    if (b.meta.dist?.integrity) {
-      idMap[getComponentProcessId(b, ancestors)] = b.meta.dist?.integrity;
-    }
-  });
-
-  forEachBlockletSync(newBlocklet, (b, { ancestors }) => {
-    const id = getComponentProcessId(b, ancestors);
-    if (forceStartProcessIds.includes(id)) {
-      installedComponentNames.push(b.meta.title);
-      return;
-    }
-
-    if (!b.meta.dist?.integrity || b.meta.dist.integrity === idMap[id]) {
-      skippedProcessIds.push(id);
-    } else {
-      installedComponentNames.push(b.meta.title);
-    }
-  });
-
-  return { skippedProcessIds, installedComponentNames };
-};
-
-class BlockletManager extends BaseBlockletManager {
-  /**
-   * Creates an instance of BlockletManager.
-   * @param {{
-   *  dataDirs: ReturnType<typeof import('../../util/index').getDataDirs>,
-   *  startQueue: ReturnType<typeof import('../../util/queue')>,
-   *  installQueue: ReturnType<typeof import('../../util/queue')>,
-   *  backupQueue: ReturnType<typeof import('../../util/queue')>,
-   *  restoreQueue: ReturnType<typeof import('../../util/queue')>,
-   *  daemon: boolean
-   *  teamManager: import('../../team/manager.js')
-   * }} { dataDirs, startQueue, installQueue, backupQueue, restoreQueue, daemon = false, teamManager }
-   * @memberof BlockletManager
-   */
+class DiskBlockletManager extends BaseBlockletManager {
   constructor({ dataDirs, startQueue, installQueue, backupQueue, restoreQueue, daemon = false, teamManager }) {
     super();
 
@@ -469,7 +431,7 @@ class BlockletManager extends BaseBlockletManager {
     const componentDids = inputComponentDids?.length ? inputComponentDids : blocklet.children.map((x) => x.meta.did);
 
     const tasks = componentDids.map((componentDid) =>
-      this._start({ did, throwOnError, checkHealthImmediately, e2eMode, componentDids: [componentDid] }, context)
+      this._start({ blocklet, throwOnError, checkHealthImmediately, e2eMode, componentDids: [componentDid] }, context)
     );
 
     return Promise.any(tasks).catch((err) => {
@@ -485,6 +447,8 @@ class BlockletManager extends BaseBlockletManager {
     // should check blocklet integrity
     const blocklet1 = inputBlocklet || (await this.ensureBlocklet(did, { e2eMode }));
 
+    did = blocklet1.meta.did; // eslint-disable-line no-param-reassign
+
     await this.checkControllerStatus(blocklet1, 'start');
 
     // validate requirement and engine
@@ -507,7 +471,9 @@ class BlockletManager extends BaseBlockletManager {
       // blocklet may be manually stopped durning starting
       // so error message would not be sent if blocklet is stopped
       // so we need update status first
-      const doc1 = await states.blocklet.setBlockletStatus(did, BlockletStatus.starting, { componentDids });
+      const doc1 = await states.blocklet.setBlockletStatus(did, BlockletStatus.starting, {
+        componentDids,
+      });
       blocklet1.status = BlockletStatus.starting;
       this.emit(BlockletEvents.statusChange, doc1);
 
@@ -579,9 +545,11 @@ class BlockletManager extends BaseBlockletManager {
 
       const error = Array.isArray(err) ? err[0] : err;
       logger.error('Failed to start blocklet', { error, did, title: blocklet1.meta.title });
-      const description = `Start blocklet ${blocklet1.meta.title} failed with error: ${error.message}`;
+      const description = `${getComponentNamesWithVersion(blocklet1, componentDids)} start failed for ${
+        blocklet1.meta.title
+      }: ${error.message}`;
       this._createNotification(did, {
-        title: 'Start Blocklet Failed',
+        title: '',
         description,
         entityType: 'blocklet',
         entityId: did,
@@ -590,7 +558,7 @@ class BlockletManager extends BaseBlockletManager {
 
       await this.deleteProcess({ did, componentDids });
       const res = await states.blocklet.setBlockletStatus(did, BlockletStatus.error, { componentDids });
-      this.emit(BlockletEvents.startFailed, { ...res, error: { message: error.message } });
+      this.emit(BlockletEvents.startFailed, { ...res, componentDids, error: { message: error.message } });
       this.emit(BlockletEvents.statusChange, { ...res, error: { message: error.message } });
 
       if (throwOnError) {
@@ -647,7 +615,7 @@ class BlockletManager extends BaseBlockletManager {
       this.emit(BlockletEvents.statusChange, res);
 
       // send notification to wallet
-      this.emit(BlockletEvents.stopped, res);
+      this.emit(BlockletEvents.stopped, { ...res, componentDids });
 
       this.emit(BlockletInternalEvents.componentsUpdated, {
         appDid: blocklet.appDid,
@@ -739,9 +707,12 @@ class BlockletManager extends BaseBlockletManager {
       const state = await states.blocklet.setBlockletStatus(did, BlockletStatus.stopped, { componentDids });
       this.emit(BlockletEvents.statusChange, state);
 
+      const description = `${getComponentNamesWithVersion(result, componentDids)} restart failed for ${
+        result.meta.title
+      }: ${err.message || 'queue exception'}`;
       this._createNotification(did, {
-        title: 'Blocklet Restart Failed',
-        description: `Blocklet ${result.meta.title} restart failed with error: ${err.message || 'queue exception'}`,
+        title: '',
+        description,
         entityType: 'blocklet',
         entityId: did,
         severity: 'error',
@@ -941,23 +912,33 @@ class BlockletManager extends BaseBlockletManager {
 
     await this._updateDependents(rootDid);
 
+    // support edge case
+    if (newBlocklet.children.length === 0) {
+      await states.blocklet.setBlockletStatus(newBlocklet.meta.did, BlockletStatus.stopped);
+    }
+
     this.emit(BlockletEvents.upgraded, { blocklet: newBlocklet, context: { ...context, createAuditLog: false } }); // trigger router refresh
 
     this._createNotification(newBlocklet.meta.did, {
-      title: 'Component Deleted',
-      description: `Component ${child.meta.title} of ${newBlocklet.meta.title} is successfully deleted.`,
+      title: '',
+      description: `${child.meta.title} is successfully deleted for ${newBlocklet.meta.title}.`,
       entityType: 'blocklet',
       entityId: newBlocklet.meta.did,
       severity: 'success',
       action: `/blocklets/${newBlocklet.meta.did}/components`,
     });
 
+    this.emit(BlockletEvents.componentRemoved, {
+      ...blocklet,
+      componentDids: [child.meta.did],
+    });
+
     this.emit(BlockletInternalEvents.componentsUpdated, {
       appDid: blocklet.appDid,
       components: getComponentsInternalInfo(newBlocklet),
     });
 
-    return newBlocklet;
+    return { ...newBlocklet, deletedComponent: child };
   }
 
   async cancelDownload({ did: inputDid }) {
@@ -1346,6 +1327,8 @@ class BlockletManager extends BaseBlockletManager {
     return newState;
   }
 
+  // -------------------------------------
+
   // TODO: this method can be removed if title is not changed anymore
   async updateComponentTitle({ did, rootDid: inputRootDid, title }) {
     await titleSchema.validateAsync(title);
@@ -1784,7 +1767,7 @@ class BlockletManager extends BaseBlockletManager {
    * @param {{
    *  blocklet: {},
    *  context: {},
-   *  postAction: 'install' | 'upgrade',
+   *  postAction: 'install' | 'upgradeComponent' | 'installComponent',
    *  oldBlocklet: {},
    *  throwOnError: Error,
    *  skipCheckStatusBeforeDownload: boolean,
@@ -1835,18 +1818,19 @@ class BlockletManager extends BaseBlockletManager {
     }
 
     // download bundle
+    const childrenToDownload = (blocklet.children || []).filter((x) => {
+      if (componentDids?.length) {
+        return componentDids.includes(x.meta.did);
+      }
+      return x;
+    });
+
     try {
-      const blockletForDownload = {
-        ...blocklet,
-        children: (blocklet.children || []).filter((x) => {
-          if (componentDids?.length) {
-            return componentDids.includes(x.meta.did);
-          }
-          return x;
-        }),
-      };
       const { isCancelled } = await this._downloadBlocklet(
-        blockletForDownload,
+        {
+          ...blocklet,
+          children: childrenToDownload,
+        },
         Object.assign({}, context, { skipCheckIntegrity })
       );
 
@@ -1876,8 +1860,10 @@ class BlockletManager extends BaseBlockletManager {
         },
       });
       this._createNotification(did, {
-        title: 'Blocklet Download Failed',
-        description: `Blocklet ${title} download failed with error: ${err.message}`,
+        title: '',
+        description: `${childrenToDownload
+          .map((x) => `${x.meta.title}@${x.meta.version}`)
+          .join(', ')} download failed for ${title}: ${err.message}`,
         entityType: 'blocklet',
         entityId: did,
         severity: 'error',
@@ -1910,12 +1896,18 @@ class BlockletManager extends BaseBlockletManager {
         throw new Error('blocklet status changed durning download');
       }
 
-      if (postAction === 'install') {
+      if (postAction === INSTALL_ACTIONS.INSTALL) {
         const state = await states.blocklet.setBlockletStatus(did, BlockletStatus.installing, { componentDids });
         this.emit(BlockletEvents.statusChange, state);
       }
 
-      if (postAction === 'upgrade') {
+      if (
+        [
+          INSTALL_ACTIONS.INSTALL_COMPONENT,
+          INSTALL_ACTIONS.UPGRADE_COMPONENT,
+          'upgrade', // for backward compatibility
+        ].includes(postAction)
+      ) {
         const state = await states.blocklet.setBlockletStatus(did, BlockletStatus.upgrading, { componentDids });
         this.emit(BlockletEvents.statusChange, state);
       }
@@ -1929,14 +1921,32 @@ class BlockletManager extends BaseBlockletManager {
     // install
     try {
       // install blocklet
-      if (postAction === 'install') {
+      if (postAction === INSTALL_ACTIONS.INSTALL) {
         await this._onInstall({ blocklet, componentDids, context, oldBlocklet });
         return;
       }
 
       // upgrade blocklet
-      if (postAction === 'upgrade') {
-        await this._onUpgrade({ oldBlocklet, componentDids, newBlocklet: blocklet, context });
+      if (
+        [
+          INSTALL_ACTIONS.INSTALL_COMPONENT,
+          INSTALL_ACTIONS.UPGRADE_COMPONENT,
+          'upgrade', // for backward compatibility
+        ].includes(postAction)
+      ) {
+        logger.info('do upgrade blocklet', { did, version, postAction, componentDids });
+
+        try {
+          await this._upgradeBlocklet({
+            newBlocklet: blocklet,
+            oldBlocklet,
+            componentDids,
+            context,
+            action: postAction,
+          });
+        } catch (err) {
+          logger.error('blocklet onUpgrade error', { error: err });
+        }
       }
     } catch (error) {
       if (throwOnError) {
@@ -1974,22 +1984,6 @@ class BlockletManager extends BaseBlockletManager {
     }
   }
 
-  async _onUpgrade({ oldBlocklet, newBlocklet, componentDids, context }) {
-    const { version, did } = newBlocklet.meta;
-    logger.info('do upgrade blocklet', { did, version });
-
-    try {
-      await this._upgradeBlocklet({
-        newBlocklet,
-        oldBlocklet,
-        componentDids,
-        context,
-      });
-    } catch (err) {
-      logger.error('blocklet onUpgrade error', { error: err });
-    }
-  }
-
   async _onRestart({ did, componentDids, context }) {
     await this.stop({ did, componentDids, updateStatus: false }, context);
     await this.start({ did, componentDids }, context);
@@ -2018,7 +2012,7 @@ class BlockletManager extends BaseBlockletManager {
       });
 
       this.emit(BlockletEvents.statusChange, res);
-      this.emit(BlockletEvents.started, res);
+      this.emit(BlockletEvents.started, { ...res, componentDids });
       logger.info('blocklet healthy', { did, name, time: Date.now() - startedAt });
     } catch (error) {
       const status = await states.blocklet.getBlockletStatus(did);
@@ -2032,15 +2026,19 @@ class BlockletManager extends BaseBlockletManager {
       await this.deleteProcess({ did, componentDids }, context);
       const doc = await states.blocklet.setBlockletStatus(did, BlockletStatus.error, { componentDids });
 
+      const description = `${getComponentNamesWithVersion(blocklet, componentDids)} start failed for ${title}: ${
+        error.message
+      }`;
+
       this._createNotification(did, {
-        title: 'Blocklet Start Failed',
-        description: `Blocklet ${title} start failed: ${error.message}`,
+        title: '',
+        description,
         entityType: 'blocklet',
         entityId: did,
         severity: 'error',
       });
 
-      this.emit(BlockletEvents.startFailed, { meta, error });
+      this.emit(BlockletEvents.startFailed, { ...doc, componentDids, error: { message: error.message } });
       this.emit(BlockletEvents.statusChange, { ...doc, error });
 
       if (throwOnError) {
@@ -2516,7 +2514,7 @@ class BlockletManager extends BaseBlockletManager {
       const { name, version } = meta;
       logger.error('failed to install blocklet', { name, did, version, error: err });
       try {
-        await this._rollback('install', did, oldBlocklet);
+        await this._rollback(INSTALL_ACTIONS.INSTALL, did, oldBlocklet);
         this.emit(BlockletEvents.installFailed, {
           meta: { did },
           error: {
@@ -2538,18 +2536,10 @@ class BlockletManager extends BaseBlockletManager {
     }
   }
 
-  async _upgradeBlocklet({ newBlocklet, oldBlocklet, componentDids, context = {} }) {
+  async _upgradeBlocklet({ newBlocklet, oldBlocklet, componentDids, action, context = {} }) {
     const { meta, source, deployedFrom, children } = newBlocklet;
     const { did, version, name, title } = meta;
 
-    // ids
-    const { skippedProcessIds, installedComponentNames } = getComponentChangedInfoForUpgrade({
-      newBlocklet,
-      oldBlocklet,
-      context,
-    });
-    context.skippedProcessIds = skippedProcessIds;
-
     try {
       // delete old process
       try {
@@ -2622,10 +2612,22 @@ class BlockletManager extends BaseBlockletManager {
       this.refreshListCache();
 
       try {
-        this.emit(BlockletEvents.upgraded, { blocklet, context });
+        this.emit(BlockletEvents.upgraded, { blocklet, context }); // trigger router refresh
+
+        const notificationEvent =
+          action === INSTALL_ACTIONS.INSTALL_COMPONENT
+            ? BlockletEvents.componentInstalled
+            : BlockletEvents.componentUpgraded;
+        const actionName = action === INSTALL_ACTIONS.INSTALL_COMPONENT ? 'installed' : 'upgraded';
+
+        this.emit(notificationEvent, { ...blocklet, componentDids, context });
+
         this._createNotification(did, {
-          title: 'Blocklet Upgrade Success',
-          description: `Blocklet ${title} upgrade successfully. (Component: ${installedComponentNames.join(', ')})`,
+          title: '',
+          description: `${getComponentNamesWithVersion(
+            newBlocklet,
+            componentDids
+          )} is ${actionName} successfully for ${title}`,
           action: `/blocklets/${did}/overview`,
           entityType: 'blocklet',
           entityId: did,
@@ -2647,21 +2649,27 @@ class BlockletManager extends BaseBlockletManager {
 
       return blocklet;
     } catch (err) {
-      const b = await this._rollback('upgrade', did, oldBlocklet);
+      const b = await this._rollback(action, did, oldBlocklet);
       logger.error('failed to upgrade blocklet', { did, version, name, error: err });
 
       this.emit(BlockletEvents.updated, b);
 
-      this.emit(BlockletEvents.upgradeFailed, {
-        blocklet: { ...oldBlocklet, error: { message: err.message } },
+      const actionName = action === INSTALL_ACTIONS.INSTALL_COMPONENT ? 'install' : 'upgrade';
+      const notificationEvent =
+        action === INSTALL_ACTIONS.INSTALL_COMPONENT
+          ? BlockletEvents.componentInstallFailed
+          : BlockletEvents.componentUpgradeFailed;
+
+      this.emit(notificationEvent, {
+        blocklet: { ...oldBlocklet, componentDids, error: { message: err.message } },
         context,
       });
 
       this._createNotification(did, {
-        title: 'Blocklet Upgrade Failed',
-        description: `Blocklet ${title} upgrade failed with error: ${
+        title: '',
+        description: `${getComponentNamesWithVersion(newBlocklet, componentDids)} ${actionName} failed for ${title}: ${
           err.message
-        }. (Component: ${installedComponentNames.join(', ')})`,
+        }.`,
         entityType: 'blocklet',
         entityId: did,
         severity: 'error',
@@ -2735,12 +2743,12 @@ class BlockletManager extends BaseBlockletManager {
   }
 
   /**
-   * @param {string} action install, upgrade, downgrade
+   * @param {string} action install, upgrade, installComponent, upgradeComponent
    * @param {string} did
    * @param {object} oldBlocklet
    */
   async _rollback(action, did, oldBlocklet) {
-    if (action === 'install') {
+    if (action === INSTALL_ACTIONS.INSTALL) {
       const extraState = oldBlocklet?.extraState;
 
       // rollback blocklet extra state
@@ -2754,7 +2762,13 @@ class BlockletManager extends BaseBlockletManager {
       return this._deleteBlocklet({ did, keepData: true });
     }
 
-    if (['upgrade', 'downgrade'].includes(action)) {
+    if (
+      [
+        INSTALL_ACTIONS.INSTALL_COMPONENT,
+        INSTALL_ACTIONS.UPGRADE_COMPONENT,
+        'upgrade', // for backward compatibility
+      ].includes(action)
+    ) {
       const { extraState, ...blocklet } = oldBlocklet;
       // rollback blocklet state
       const result = await states.blocklet.updateBlocklet(did, blocklet);
@@ -2945,7 +2959,19 @@ class BlockletManager extends BaseBlockletManager {
         return;
       }
 
-      await states.notification.create(notification);
+      let blockletUrl;
+      try {
+        const blocklet = await this.getBlocklet(did);
+        if (blocklet) {
+          const urls = blocklet.site?.domainAliases || [];
+          const customUrl = urls.find((x) => !x.isProtected)?.value;
+          blockletUrl = `http://${customUrl || getDidDomainForBlocklet({ appPid: blocklet.appPid })}`;
+        }
+      } catch (error) {
+        logger.error('[_createNotification] get blocklet url failed', { error });
+      }
+
+      await states.notification.create({ ...notification, blockletUrl });
     } catch (error) {
       logger.error('create notification failed', { error });
     }
@@ -3259,7 +3285,7 @@ class BlockletManager extends BaseBlockletManager {
     );
   }
 
-  async _restoreFromDisk(input) {
+  async _restoreFromDisk(input, context) {
     if (input.delay) {
       await sleep(input.delay);
     }
@@ -3283,6 +3309,7 @@ class BlockletManager extends BaseBlockletManager {
         states,
         move: true,
         sync: false, // use queue to download and install application
+        context,
       });
       removeRestoreDir();
     } catch (error) {
@@ -3366,4 +3393,151 @@ class BlockletManager extends BaseBlockletManager {
   }
 }
 
+class FederatedBlockletManager extends DiskBlockletManager {
+  /**
+   * Joins federated login.
+   * @param {{appUrl: string, did: string;}} options - The federated login appUrl.
+   * @returns {Promise<any>} The data received from the appUrl.
+   */
+  async joinFederatedLogin({ appUrl, did }) {
+    const url = new URL(appUrl);
+    url.pathname = `${WELLKNOWN_SERVICE_PATH_PREFIX}/api/federated/join`;
+
+    const blocklet = await this.getBlocklet(did);
+    const nodeInfo = await states.node.read();
+    const blockletInfo = getBlockletInfo(blocklet, nodeInfo.sk);
+    const { permanentWallet, wallet } = blockletInfo;
+    const memberSite = {
+      appId: wallet.address,
+      appPid: permanentWallet.address,
+      migratedFrom: blocklet.migratedFrom || [],
+      appName: blockletInfo.name,
+      appDescription: blockletInfo.description,
+      appUrl: blockletInfo.appUrl,
+      appLogo:
+        blocklet.environmentObj.BLOCKLET_APP_LOGO ||
+        normalizePathPrefix(`${WELLKNOWN_SERVICE_PATH_PREFIX}/blocklet/logo`) ||
+        '/',
+      appLogoRect: blocklet.environmentObj.BLOCKLET_APP_LOGO_RECT,
+      did: blockletInfo.did,
+      pk: permanentWallet.publicKey,
+      serverId: nodeInfo.did,
+      serverVersion: nodeInfo.version,
+      version: blockletInfo.version,
+    };
+
+    const { data } = await request.post(url.href, {
+      // 初次申请时，member 不在站点群中，不需要对数据进行加密
+      site: memberSite,
+    });
+    await states.blockletExtras.setSettings(blocklet.meta.did, {
+      federated: {
+        config: {
+          appId: blocklet.appDid,
+          appPid: blocklet.appPid || blocklet.appDid,
+          isMaster: false,
+        },
+        sites: data.sites,
+      },
+    });
+
+    const newState = await this.getBlocklet(did);
+    this.emit(BlockletEvents.updated, newState);
+    return newState;
+  }
+
+  async setFederated({ did, config }) {
+    await states.blockletExtras.setSettings(did, { federated: config });
+
+    const newState = await this.getBlocklet(did);
+    this.emit(BlockletEvents.updated, newState);
+    return newState;
+  }
+
+  async configFederated({ did, autoLogin = false }) {
+    const blocklet = await this.getBlocklet(did);
+    const federated = cloneDeep(blocklet.settings.federated || {});
+    federated.config.autoLogin = autoLogin;
+    await states.blockletExtras.setSettings(did, { federated });
+
+    const newState = await this.getBlocklet(did);
+    this.emit(BlockletEvents.updated, newState);
+    return newState;
+  }
+
+  async auditFederatedLogin({ appId, did, status }) {
+    const blocklet = await this.getBlocklet(did);
+
+    const federated = cloneDeep(blocklet.settings.federated || {});
+    const memberSite = federated.sites.find((item) => item.appId === appId);
+    memberSite.status = status;
+    if ([null, undefined].includes(federated.config.isMaster)) {
+      const masterSite = federated.sites.find((item) => item.appId === blocklet.meta.did);
+
+      masterSite.isMaster = true;
+      federated.config.isMaster = true;
+    }
+    // 有审批操作的一方，自动成为 master
+    const newState = await this.setFederated({
+      did: blocklet.meta.did,
+      config: federated,
+    });
+    const nodeInfo = await states.node.read();
+    const { permanentWallet } = getBlockletInfo(blocklet, nodeInfo.sk);
+    let delegation;
+    let roles = [];
+    if (status === 'approved') {
+      delegation = signV2(permanentWallet.address, permanentWallet.secretKey, {
+        agentDid: `did:abt:${memberSite.appPid}`,
+        permissions: [
+          {
+            role: 'DIDConnectAgent',
+            claims: [
+              'authPrincipal',
+              'profile',
+              'signature',
+              'prepareTx',
+              'agreement',
+              'verifiableCredential',
+              'asset',
+              // 'keyPair',
+              // 'encryptionKey',
+            ],
+          },
+        ],
+        exp: Math.floor(new Date().getTime() / 1000) + 86400 * 365 * 100, // valid for 100 year
+      });
+      roles = await this.teamManager.getRoles(blocklet.meta.did);
+    }
+
+    await request.post(`${memberSite.appUrl}/${WELLKNOWN_SERVICE_PATH_PREFIX}/api/federated/audit-res`, {
+      signer: permanentWallet.address,
+      data: signV2(permanentWallet.address, permanentWallet.secretKey, {
+        appId: blocklet.meta.did,
+        status,
+        delegation,
+        roles: roles.map((item) => pick(item, ['name', 'title', 'description'])),
+      }),
+    });
+    const waitingList = federated.sites
+      .filter((item) => item.appId !== federated.config.appId)
+      .map((item) => {
+        return limitSync(() =>
+          pRetry(
+            () =>
+              request.post(`${item.appUrl}/${WELLKNOWN_SERVICE_PATH_PREFIX}/api/federated/sync`, {
+                signer: permanentWallet.address,
+                data: signV2(permanentWallet.address, permanentWallet.secretKey, { sites: federated.sites }),
+              }),
+            { retries: 3 }
+          )
+        );
+      });
+    await Promise.all(waitingList);
+    return newState;
+  }
+}
+
+class BlockletManager extends FederatedBlockletManager {}
+
 module.exports = BlockletManager;