@abtnode/core 1.16.28-beta-bfbab430 → 1.16.28-beta-641c9f13

package/lib/api/team.js

@@ -2,7 +2,7 @@ const { EventEmitter } = require('events');
 const pick = require('lodash/pick');
 const defaults = require('lodash/defaults');
 const cloneDeep = require('lodash/cloneDeep');
-const joinUrl = require('url-join');
+const { joinURL } = require('ufo');
 
 const logger = require('@abtnode/logger')('@abtnode/core:api:team');
 const {
@@ -511,7 +511,7 @@ class TeamAPI extends EventEmitter {
         role,
       }),
       endpoint: getPassportStatusEndpoint({
-        baseUrl: joinUrl(appUrl, WELLKNOWN_SERVICE_PATH_PREFIX),
+        baseUrl: joinURL(appUrl, WELLKNOWN_SERVICE_PATH_PREFIX),
         userDid,
         teamDid,
       }),
@@ -966,7 +966,7 @@ class TeamAPI extends EventEmitter {
             role,
           }),
           endpoint: getPassportStatusEndpoint({
-            baseUrl: joinUrl(appUrl, WELLKNOWN_SERVICE_PATH_PREFIX),
+            baseUrl: joinURL(appUrl, WELLKNOWN_SERVICE_PATH_PREFIX),
             userDid,
             teamDid,
           }),

package/lib/blocklet/hooks.js

@@ -1,11 +1,13 @@
 const get = require('lodash/get');
 const camelCase = require('lodash/camelCase');
 const runScript = require('@abtnode/util/lib/run-script');
+const { getSecurityNodeOptions } = require('@abtnode/util/lib/security');
 
 // eslint-disable-next-line global-require
 const logger = require('@abtnode/logger')(`${require('../../package.json').name}:blocklet:hooks`);
 
 const { getSafeEnv } = require('../util');
+const states = require('../states');
 
 const runUserHook = async (label, hookName, args) => {
   const {
@@ -27,10 +29,16 @@ const runUserHook = async (label, hookName, args) => {
     }
 
     logger.info(`run hook:${hookName}:`, { label, hook });
+
+    const nodeInfo = await states.node.read();
     // FIXME @linchen timeout 应该动态设置或不设置
     await runScript(hook, [label, hookName].join(':'), {
       cwd: appDir,
-      env: { ...getSafeEnv(env), BLOCKLET_HOOK_NAME: hookName },
+      env: {
+        ...getSafeEnv(env),
+        BLOCKLET_HOOK_NAME: hookName,
+        NODE_OPTIONS: getSecurityNodeOptions({ environmentObj: env, ...args }, nodeInfo.enableFileSystemIsolation),
+      },
       silent,
       output: outputFile,
       error: errorFile,

package/lib/blocklet/manager/disk.js

@@ -5,6 +5,7 @@ const path = require('path');
 const flat = require('flat');
 const LRU = require('lru-cache');
 const get = require('lodash/get');
+const uniq = require('lodash/uniq');
 const omit = require('lodash/omit');
 const merge = require('lodash/merge');
 const pick = require('lodash/pick');
@@ -15,7 +16,7 @@ const { sign } = require('@arcblock/jwt');
 const { isInServerlessMode } = require('@abtnode/util/lib/serverless');
 const sleep = require('@abtnode/util/lib/sleep');
 const getBlockletInfo = require('@blocklet/meta/lib/info');
-const joinUrl = require('url-join');
+const { joinURL } = require('ufo');
 const { sendToUser } = require('@blocklet/sdk/lib/util/send-notification');
 
 const logger = require('@abtnode/logger')('@abtnode/core:blocklet:manager');
@@ -614,7 +615,6 @@ class DiskBlockletManager extends BaseBlockletManager {
     if (!blocklet.children) {
       return componentDids;
     }
-
     const targetDid = !inputComponentDids?.length ? componentDids[0] : inputComponentDids[0];
 
     const canStartStatus = {
@@ -629,26 +629,37 @@ class DiskBlockletManager extends BaseBlockletManager {
       filter: (child) => atomic || canStartStatus[child.status],
     });
 
-    // 让当前的组件的状态提前变成 starting, 不然用户会很奇怪, 明明点了启动, 但是当前组件没变化.
-    const targetChild = blocklet.children.find((x) => x.meta.did === targetDid);
-    const doc = await states.blocklet.setBlockletStatus(blocklet.meta?.did, BlockletStatus.starting, {
-      componentDids: [targetDid],
+    logger.info('start required components', {
+      did: blocklet.meta.did,
+      targetDid,
+      componentDids,
+      inputComponentDids,
+      checkHealthImmediately,
+      requiredDidsLayers,
     });
-    targetChild.status = BlockletStatus.starting;
-    this.emit(BlockletEvents.statusChange, doc);
 
-    // start by dependency
-    for (const dids of requiredDidsLayers) {
-      if (atomic) {
-        await this._start({ blocklet, throwOnError, checkHealthImmediately, e2eMode, componentDids: dids }, context);
-      } else {
-        const tasks = dids.map(
-          (x) => () =>
-            this._start({ blocklet, throwOnError, checkHealthImmediately, e2eMode, componentDids: [x] }, context)
-        );
-        await pAll(tasks, { concurrency: 4 }).catch((err) => {
-          throw new Error(err.errors.join(', '));
-        });
+    // 让当前的组件的状态提前变成 starting, 不然用户会很奇怪, 明明点了启动, 但是当前组件没变化.
+    if (requiredDidsLayers.length) {
+      const targetChild = blocklet.children.find((x) => x.meta.did === targetDid);
+      const doc = await states.blocklet.setBlockletStatus(blocklet.meta?.did, BlockletStatus.starting, {
+        componentDids: [targetDid],
+      });
+      targetChild.status = BlockletStatus.starting;
+      this.emit(BlockletEvents.statusChange, doc);
+
+      // start by dependency
+      for (const dids of requiredDidsLayers) {
+        if (atomic) {
+          await this._start({ blocklet, throwOnError, checkHealthImmediately, e2eMode, componentDids: dids }, context);
+        } else {
+          const tasks = dids.map(
+            (x) => () =>
+              this._start({ blocklet, throwOnError, checkHealthImmediately, e2eMode, componentDids: [x] }, context)
+          );
+          await pAll(tasks, { concurrency: 4 }).catch((err) => {
+            throw new Error(err.errors.join(', '));
+          });
+        }
       }
     }
 
@@ -658,12 +669,13 @@ class DiskBlockletManager extends BaseBlockletManager {
   }
 
   async start(
-    { did, throwOnError, checkHealthImmediately = false, e2eMode = false, componentDids: _inputComponentDids, atomic },
+    { did, throwOnError, checkHealthImmediately = false, e2eMode = false, componentDids: inputComponentDids, atomic },
     context
   ) {
     const blocklet = await this.ensureBlocklet(did, { e2eMode });
-    const inputComponentDids = Array.from(new Set(_inputComponentDids || []));
-    let componentDids = inputComponentDids?.length ? inputComponentDids : blocklet.children.map((x) => x.meta.did);
+    let componentDids = uniq(
+      inputComponentDids?.length ? inputComponentDids : blocklet.children.map((x) => x.meta.did)
+    );
 
     // sync component config before at first to ensure resource component config is ready
     const serverSk = (await states.node.read()).sk;
@@ -2787,7 +2799,7 @@ class DiskBlockletManager extends BaseBlockletManager {
        * @type {import('@abtnode/client').NodeState}
        */
       const node = await states.node.read();
-      referrer = joinUrl(
+      referrer = joinURL(
         `https://${encode(node.did)}.${DEFAULT_DID_DOMAIN}`,
         node.routing.adminPath,
         `/blocklets/${did}/storage`
@@ -3637,11 +3649,17 @@ class DiskBlockletManager extends BaseBlockletManager {
         }
       }
       if (runningDids.length) {
-        try {
-          await this.start({ did, componentDids: runningDids }, context);
-          logger.info('started blocklet for upgrading', { did, version, runningDids });
-        } catch (error) {
-          logger.error('failed to start blocklet for upgrading', { did, version, runningDids, error });
+        const initialized = !!blocklet.settings?.initialized;
+        if (initialized) {
+          try {
+            await this.start({ did, componentDids: runningDids }, context);
+            logger.info('started blocklet for upgrading', { did, version, runningDids });
+          } catch (error) {
+            logger.error('failed to start blocklet for upgrading', { did, version, runningDids, error });
+          }
+        } else {
+          await states.blocklet.setBlockletStatus(did, BlockletStatus.stopped, { componentDids: runningDids });
+          logger.info('set blocklet as stopped since not initialized', { did, version, runningDids });
         }
       }
       if (stoppedDids.length) {
@@ -4468,7 +4486,7 @@ class FederatedBlockletManager extends DiskBlockletManager {
   async joinFederatedLogin({ appUrl, did }, context) {
     const url = new URL(appUrl);
     // master service api 的地址
-    url.pathname = joinUrl(WELLKNOWN_SERVICE_PATH_PREFIX, '/api/federated/join');
+    url.pathname = joinURL(WELLKNOWN_SERVICE_PATH_PREFIX, '/api/federated/join');
 
     const blocklet = await this.getBlocklet(did);
     const nodeInfo = await states.node.read();
@@ -4485,7 +4503,7 @@ class FederatedBlockletManager extends DiskBlockletManager {
       aliasDomain: domainAliases.map((x) => x.value),
       appLogo:
         blocklet.environmentObj.BLOCKLET_APP_LOGO ||
-        normalizePathPrefix(joinUrl(WELLKNOWN_SERVICE_PATH_PREFIX, '/blocklet/logo')) ||
+        normalizePathPrefix(joinURL(WELLKNOWN_SERVICE_PATH_PREFIX, '/blocklet/logo')) ||
         '/',
       appLogoRect: blocklet.environmentObj.BLOCKLET_APP_LOGO_RECT,
       did: permanentWallet.address,

package/lib/blocklet/manager/helper/install-component-from-upload.js

@@ -1,6 +1,7 @@
 const path = require('path');
 
 const logger = require('@abtnode/logger')('@abtnode/core:install-component-upload');
+const uniq = require('lodash/uniq');
 const getComponentProcessId = require('@blocklet/meta/lib/get-component-process-id');
 const { isInProgress, hasStartEngine } = require('@blocklet/meta/lib/util');
 
@@ -119,7 +120,7 @@ const installComponentFromUpload = async ({
   // backup rollback data
   await manager._rollbackCache.backup({ did: newBlocklet.meta.did, action, oldBlocklet });
 
-  const componentDids = [newChild.meta.did, ...newChildren.map((x) => x.meta.did)];
+  const componentDids = uniq([newChild.meta.did, ...newChildren.map((x) => x.meta.did)]);
 
   await manager._downloadAndInstall({
     blocklet: newBlocklet,

package/lib/blocklet/manager/helper/install-component-from-url.js

@@ -1,7 +1,7 @@
 const { sign } = require('@arcblock/jwt');
 
 const logger = require('@abtnode/logger')('@abtnode/core:install-component-url');
-
+const uniq = require('lodash/uniq');
 const { isFreeBlocklet, hasStartEngine } = require('@blocklet/meta/lib/util');
 const { titleSchema, updateMountPointSchema } = require('@blocklet/meta/lib/schema');
 const hasReservedKey = require('@blocklet/meta/lib/has-reserved-key');
@@ -141,7 +141,7 @@ const installComponentFromUrl = async ({
     throw err;
   }
 
-  const componentDids = [newChild.meta.did, ...newChildren.map((x) => x.meta.did)];
+  const componentDids = uniq([newChild.meta.did, ...newChildren.map((x) => x.meta.did)]);
 
   // new blocklet
   const newBlocklet = await states.blocklet.setBlockletStatus(rootDid, BlockletStatus.waiting, { componentDids });

package/lib/monitor/blocklet-runtime-monitor.js

@@ -1,4 +1,4 @@
-const EventEmitter = require('events');
+const { EventEmitter } = require('events');
 
 const cloneDeep = require('lodash/cloneDeep');
 const pLimit = require('p-limit');

package/lib/monitor/node-runtime-monitor.js

@@ -1,4 +1,4 @@
-const EventEmitter = require('events');
+const { EventEmitter } = require('events');
 const dayjs = require('@abtnode/util/lib/dayjs');
 const pick = require('lodash/pick');
 const cloneDeep = require('lodash/cloneDeep');

package/lib/router/helper.js

@@ -10,7 +10,7 @@ const get = require('lodash/get');
 const cloneDeep = require('lodash/cloneDeep');
 const groupBy = require('lodash/groupBy');
 const isEqual = require('lodash/isEqual');
-const joinUrl = require('url-join');
+const { joinURL } = require('ufo');
 const {
   replaceSlotToIp,
   findComponentById,
@@ -288,7 +288,7 @@ const ensureLatestInterfaceInfo = async (sites = []) => {
       if (rule.isProtected && rule.to.target === WELLKNOWN_SERVICE_PATH_PREFIX) {
         return rule;
       }
-      if (rule.isProtected && rule.to.target === joinUrl(WELLKNOWN_SERVICE_PATH_PREFIX, USER_AVATAR_PATH_PREFIX)) {
+      if (rule.isProtected && rule.to.target === joinURL(WELLKNOWN_SERVICE_PATH_PREFIX, USER_AVATAR_PATH_PREFIX)) {
         return rule;
       }
 
@@ -359,7 +359,7 @@ const ensureWellknownRule = async (sites = []) => {
       const rule = grouped[groupPathPrefix][0];
 
       // Serve blocklet service always
-      const servicePathPrefix = joinUrl(groupPathPrefix, WELLKNOWN_SERVICE_PATH_PREFIX);
+      const servicePathPrefix = joinURL(groupPathPrefix, WELLKNOWN_SERVICE_PATH_PREFIX);
       if (!site.rules.some((x) => x.from.pathPrefix === servicePathPrefix)) {
         site.rules.push({
           id: rule.id,
@@ -380,7 +380,7 @@ const ensureWellknownRule = async (sites = []) => {
       }
 
       // Cache user avatar from gateway
-      const avatarPathPrefix = joinUrl(servicePathPrefix, USER_AVATAR_PATH_PREFIX);
+      const avatarPathPrefix = joinURL(servicePathPrefix, USER_AVATAR_PATH_PREFIX);
       if (!site.rules.some((x) => x.from.pathPrefix === avatarPathPrefix)) {
         site.rules.push({
           id: rule.id,
@@ -492,7 +492,7 @@ const ensureBlockletWellknownRules = (sites, blocklets) => {
 
     const tmpMountPoint = mountPoint || blocklet.mountPoint;
     if (tmpMountPoint) {
-      pathPrefix = joinUrl(tmpMountPoint, pathPrefix);
+      pathPrefix = joinURL(tmpMountPoint, pathPrefix);
     }
 
     const port = findInterfacePortByName(blocklet, tmpInterface.name);
@@ -585,7 +585,7 @@ const expandComponentRules = (sites = [], blocklets) => {
             newRule.from.pathPrefix = baseRule.from.pathPrefix;
             newRule.to.pageGroup = baseRule.to.pageGroup;
           } else {
-            newRule.from.pathPrefix = joinUrl(baseRule.from.pathPrefix, x.mountPoint);
+            newRule.from.pathPrefix = joinURL(baseRule.from.pathPrefix, x.mountPoint);
           }
 
           expandedRules.push(newRule);
@@ -633,7 +633,7 @@ const ensureBlockletCache = (sites = [], blocklets) => {
           const cacheable = get(findWebInterface(component), 'cacheable', []);
           cacheable.forEach((cachePrefix) => {
             const clone = cloneDeep(rule);
-            clone.from.pathPrefix = joinUrl(rule.from.pathPrefix, cachePrefix);
+            clone.from.pathPrefix = joinURL(rule.from.pathPrefix, cachePrefix);
             clone.to.cacheGroup = isServiceFeDevelopment ? '' : 'blockletProxy';
             clone.to.targetPrefix = cachePrefix;
             clone.dynamic = true; // mark as dynamic to avoid redundant generated rules
@@ -674,7 +674,7 @@ const decompressCertificates = async (source, dest) => {
   return dest;
 };
 
-const joinCertDownUrl = (baseUrl, name) => joinUrl(baseUrl, '/certs', name);
+const joinCertDownUrl = (baseUrl, name) => joinURL(baseUrl, '/certs', name);
 
 const getIpEchoCertDownloadUrl = (baseUrl) => joinCertDownUrl(baseUrl, 'ip-abtnet-io.tar.gz');
 const getDidDomainCertDownloadUrl = (baseUrl) => joinCertDownUrl(baseUrl, 'did-abtnet-io.tar.gz');

package/lib/router/manager.js

@@ -13,7 +13,7 @@ const toLower = require('lodash/toLower');
 const { EventEmitter } = require('events');
 const uuid = require('uuid');
 const isUrl = require('is-url');
-const joinUrl = require('url-join');
+const { joinURL } = require('ufo');
 const cloneDeep = require('lodash/cloneDeep');
 const normalizePathPrefix = require('@abtnode/util/lib/normalize-path-prefix');
 const logger = require('@abtnode/logger')('@abtnode/core:router:manager');
@@ -704,7 +704,7 @@ class RouterManager extends EventEmitter {
     const blockletPrefix = normalizePathPrefix(rawRule.from.pathPrefix);
 
     // root component's mountPoint may not be '/'
-    const rootComponentPrefix = joinUrl(blockletPrefix, blocklet.mountPoint || '/');
+    const rootComponentPrefix = joinURL(blockletPrefix, blocklet.mountPoint || '/');
     rawRule.from.pathPrefix = normalizePathPrefix(rootComponentPrefix);
 
     const isOccupiable = isGatewayBlocklet(blocklet.meta);

package/lib/states/audit-log.js

@@ -3,7 +3,7 @@
 const pick = require('lodash/pick');
 const get = require('lodash/get');
 const uniq = require('lodash/uniq');
-const joinUrl = require('url-join');
+const { joinURL } = require('ufo');
 const { getDisplayName } = require('@blocklet/meta/lib/util');
 const { BLOCKLET_SITE_GROUP_SUFFIX, NODE_SERVICES } = require('@abtnode/constant');
 const logger = require('@abtnode/logger')('@abtnode/core:states:audit-log');
@@ -12,7 +12,7 @@ const BaseState = require('./base');
 
 const { parse } = require('../util/ua');
 
-const getServerInfo = (info) => `[${info.name}](${joinUrl(info.routing.adminPath, '/settings/about')})`;
+const getServerInfo = (info) => `[${info.name}](${joinURL(info.routing.adminPath, '/settings/about')})`;
 /**
  * @description
  * @param {import('@abtnode/client').BlockletState} blocklet
@@ -21,7 +21,7 @@ const getServerInfo = (info) => `[${info.name}](${joinUrl(info.routing.adminPath
  * }} info
  * @returns {string}
  */
-const getBlockletInfo = (blocklet, info) => `[${getDisplayName(blocklet)}](${joinUrl(info.routing.adminPath, '/blocklets/', blocklet.meta.did, '/overview')})`; // prettier-ignore
+const getBlockletInfo = (blocklet, info) => `[${getDisplayName(blocklet)}](${joinURL(info.routing.adminPath, '/blocklets/', blocklet.meta.did, '/overview')})`; // prettier-ignore
 const componentOrApplication = (componentDids) => (componentDids?.length ? 'component' : 'application');
 const getComponentNames = (blocklet, componentDids, withVersion) =>
   uniq(componentDids || [])
@@ -82,10 +82,10 @@ const expandUser = async (teamDid, userDid, passportId, info, node) => {
   const passport = user.passports.find((x) => x.id === passportId);
 
   if (teamDid === info.did) {
-    return [`[${user.fullName}](${joinUrl(info.routing.adminPath, '/team/members')})`, passport ? passport.name : ''];
+    return [`[${user.fullName}](${joinURL(info.routing.adminPath, '/team/members')})`, passport ? passport.name : ''];
   }
 
-  return [`[${user.fullName}](${joinUrl(info.routing.adminPath, '/blocklets/', teamDid, '/members')})`, passport ? passport.name : '']; // prettier-ignore
+  return [`[${user.fullName}](${joinURL(info.routing.adminPath, '/blocklets/', teamDid, '/members')})`, passport ? passport.name : '']; // prettier-ignore
 };
 
 /**

package/lib/states/user.js

@@ -393,6 +393,7 @@ class User extends ExtendBase {
         'email',
         'avatar',
         'role',
+
         'locale',
         'extra',
         'lastLoginIp',
@@ -413,6 +414,8 @@ class User extends ExtendBase {
       if (updates.sourceAppPid) {
         delete updates.sourceAppPid;
       }
+      // 登录不再更新 locale
+      delete updates.locale;
       // update user, connectedAccount, passport
       updates.connectedAccounts = updateConnectedAccount(exist.connectedAccounts, user.connectedAccount);
       updated = await this.updateUser(exist.did, updates);

package/lib/util/blocklet.js

@@ -1,3 +1,4 @@
+/* eslint-disable camelcase */
 /* eslint-disable no-await-in-loop */
 
 const fs = require('fs-extra');
@@ -27,7 +28,7 @@ const logger = require('@abtnode/logger')('@abtnode/core:util:blocklet');
 const pm2 = require('@abtnode/util/lib/async-pm2');
 const sleep = require('@abtnode/util/lib/sleep');
 const getPm2ProcessInfo = require('@abtnode/util/lib/get-pm2-process-info');
-const { formatEnv } = require('@abtnode/util/lib/security');
+const { formatEnv, getSecurityNodeOptions } = require('@abtnode/util/lib/security');
 const ensureEndpointHealthy = require('@abtnode/util/lib/ensure-endpoint-healthy');
 const getFolderSize = require('@abtnode/util/lib/get-folder-size');
 const normalizePathPrefix = require('@abtnode/util/lib/normalize-path-prefix');
@@ -180,7 +181,9 @@ const getComponentDirs = (component, { dataDirs, ensure = false, ancestors = []
 };
 
 /**
- * @returns { cwd, script, args, environmentObj, interpreter, interpreterArgs }
+ * @param component {import('@abtnode/client').ComponentState & { environmentObj: {[key: string]: string } } }
+ * @returns {{cwd, script, args, environmentObj, interpreter, interpreterArgs}: { args: []}}
+ * @return {*}
  */
 const getComponentStartEngine = (component, { e2eMode = false } = {}) => {
   if (!hasStartEngine(component.meta)) {
@@ -208,14 +211,14 @@ const getComponentStartEngine = (component, { e2eMode = false } = {}) => {
   }
 
   let script = null;
-  let interpreter = '';
-  let interpreterArgs = '';
+  let interpreter;
+  let interpreterArgs = [];
   const environmentObj = {};
   let args = [];
 
   if (startFromDevEntry) {
     script = startFromDevEntry;
-  } else if (group === 'dapp' || group === 'engine') {
+  } else if (group === 'dapp') {
     script = blockletEngineInfo.source || BLOCKLET_ENTRY_FILE;
     args = blockletEngineInfo.args || [];
   } else if (group === 'static') {
@@ -226,11 +229,18 @@ const getComponentStartEngine = (component, { e2eMode = false } = {}) => {
 
   if (component.mode !== BLOCKLET_MODES.DEVELOPMENT) {
     const engine = getEngine(blockletEngineInfo.interpreter);
-    interpreter = engine.interpreter === 'node' ? '' : engine.interpreter;
-    interpreterArgs = engine.args || '';
+    interpreter = engine.interpreter === 'node' ? undefined : engine.interpreter;
+    interpreterArgs = interpreterArgs.concat(engine.args ? [engine.args] : []);
   }
 
-  return { cwd, script, args, environmentObj, interpreter, interpreterArgs };
+  return {
+    cwd,
+    script,
+    args,
+    environmentObj,
+    interpreter,
+    interpreterArgs: interpreterArgs.join(' ').trim(),
+  };
 };
 
 const getBlockletConfigObj = (blocklet, { excludeSecure } = {}) => {
@@ -248,7 +258,6 @@ const getBlockletConfigObj = (blocklet, { excludeSecure } = {}) => {
 
   return obj;
 };
-
 /**
  * set 'configs', configObj', 'environmentObj' to blocklet TODO
  * @param {*} blocklet
@@ -531,6 +540,12 @@ const startBlockletProcess = async (
 
   await forEachBlocklet(
     blocklet,
+    /**
+     *
+     * @param {import('@abtnode/client').BlockletState} b
+     * @param {*} param1
+     * @returns
+     */
     async (b, { ancestors }) => {
       if (b.meta.group === BlockletGroup.gateway) {
         return;
@@ -572,10 +587,10 @@ const startBlockletProcess = async (
       await installExternalDependencies({ appDir: env?.BLOCKLET_APP_DIR });
 
       // run hook
-      await preFlight(b, { env });
+      await preFlight(b, { env: { ...env } });
 
       // run hook
-      await preStart(b, { env });
+      await preStart(b, { env: { ...env } });
 
       // kill process if port is occupied
       try {
@@ -588,6 +603,9 @@ const startBlockletProcess = async (
       // start process
       const maxMemoryRestart = get(nodeInfo, 'runtimeConfig.blockletMaxMemoryLimit', BLOCKLET_MAX_MEM_LIMIT_IN_MB);
 
+      /**
+       * @type {pm2.StartOptions}
+       */
       const options = {
         namespace: 'blocklets',
         name: processId,
@@ -606,6 +624,7 @@ const startBlockletProcess = async (
           ...env,
           NODE_ENV: 'production',
           BLOCKLET_START_AT: now,
+          NODE_OPTIONS: getSecurityNodeOptions(b, nodeInfo.enableFileSystemIsolation),
         },
         script,
         args,

package/lib/util/get-accessible-external-node-ip.js

@@ -1,4 +1,4 @@
-const joinUrl = require('url-join');
+const { joinURL } = require('ufo');
 const axios = require('@abtnode/util/lib/axios');
 const { DEFAULT_IP_DOMAIN, WELLKNOWN_SERVER_ADMIN_PATH } = require('@abtnode/constant');
 const logger = require('@abtnode/logger')('@abtnode/core:util:get-accessible-external-node-ip');
@@ -15,7 +15,7 @@ const timeout = process.env.NODE_ENV === 'test' ? 500 : 5000;
 const checkConnected = async ({ ip, info }) => {
   const { adminPath = WELLKNOWN_SERVER_ADMIN_PATH } = info.routing || {};
   const origin = `https://${getNodeDomain(ip)}`;
-  const endpoint = joinUrl(origin, adminPath);
+  const endpoint = joinURL(origin, adminPath);
   await axios.get(endpoint, { timeout });
 };
 

package/lib/util/index.js

@@ -8,7 +8,7 @@ const camelCase = require('lodash/camelCase');
 const get = require('lodash/get');
 const pickBy = require('lodash/pickBy');
 const { isFromPublicKey } = require('@arcblock/did');
-const joinUrl = require('url-join');
+const { joinURL } = require('ufo');
 const { Certificate } = require('@fidm/x509');
 const getPortLib = require('get-port');
 const v8 = require('v8');
@@ -362,7 +362,7 @@ const getStateCrons = (states) => [
 
 const getDelegateState = async (chainHost, address) => {
   const result = await axios.post(
-    joinUrl(chainHost, '/gql/'),
+    joinURL(chainHost, '/gql/'),
     JSON.stringify({
       query: `{
         getDelegateState(address: "${address}") {
@@ -388,7 +388,7 @@ const getDelegateState = async (chainHost, address) => {
 };
 
 const getNFTState = async (chainHost, nftId) => {
-  const url = joinUrl(new URL(chainHost).origin, '/api/gql/');
+  const url = joinURL(new URL(chainHost).origin, '/api/gql/');
 
   const result = await axios.post(
     url,

package/lib/util/launcher.js

@@ -1,6 +1,6 @@
 const path = require('path');
 const fs = require('fs-extra');
-const joinUrl = require('url-join');
+const { joinURL } = require('ufo');
 const dayjs = require('@abtnode/util/lib/dayjs');
 const pick = require('lodash/pick');
 const uniq = require('lodash/uniq');
@@ -206,7 +206,7 @@ const setupAppOwner = async (node, sessionId) => {
       throw new Error(`Owner user not found from launcher: ${launcherUrl}`);
     }
     appOwnerProfile = pick(user, ['fullName', 'email', 'avatar']);
-    const avatarBase64 = await getAvatarByUrl(joinUrl(launcherUrl, user.avatar));
+    const avatarBase64 = await getAvatarByUrl(joinURL(launcherUrl, user.avatar));
     appOwnerProfile.avatar = await extractUserAvatar(avatarBase64, { dataDir });
     logger.info('Create owner from launcher for blocklet', { appDid, ownerDid, ownerPk, sessionId, appOwnerProfile });
   } else {
@@ -242,7 +242,7 @@ const setupAppOwner = async (node, sessionId) => {
       endpoint: appUrl,
     }),
     endpoint: getPassportStatusEndpoint({
-      baseUrl: joinUrl(appUrl, WELLKNOWN_SERVICE_PATH_PREFIX),
+      baseUrl: joinURL(appUrl, WELLKNOWN_SERVICE_PATH_PREFIX),
       userDid: ownerDid,
       teamDid: appDid,
     }),

package/lib/util/spaces.js

@@ -3,7 +3,7 @@ const { default: axios } = require('axios');
 const isUrl = require('is-url');
 const isArray = require('lodash/isArray');
 const isEmpty = require('lodash/isEmpty');
-const joinUrl = require('url-join');
+const { joinURL, withQuery } = require('ufo');
 
 /**
  * @description
@@ -35,7 +35,9 @@ function getBackupFilesUrlFromEndpoint(endpoint) {
   const spaceDid = strArray.at(-4);
   const appDid = strArray.at(-2);
 
-  return joinUrl(prefix, 'space', spaceDid, 'apps', appDid, 'explorer', `?key=/apps/${appDid}/.did-objects/${appDid}/`);
+  return withQuery(joinURL(prefix, 'space', spaceDid, 'apps', appDid, 'explorer'), {
+    key: `/apps/${appDid}/.did-objects/${appDid}/`,
+  });
 }
 
 function getDIDSpacesUrlFromEndpoint(endpoint) {

package/lib/util/store.js

@@ -1,4 +1,4 @@
-const joinUrl = require('url-join');
+const { joinURL, withQuery } = require('ufo');
 const pick = require('lodash/pick');
 const isBase64 = require('is-base64');
 
@@ -48,7 +48,9 @@ const fixAndVerifyMetaFromStore = (meta) => {
 
 const getStoreMeta = async (registry) => {
   try {
-    const url = joinUrl(registry, BLOCKLET_STORE_META_PATH, `?__t__=${Date.now()}`);
+    const url = withQuery(joinURL(registry, BLOCKLET_STORE_META_PATH), {
+      __t__: Date.now(),
+    });
     const { data } = await request.get(url);
 
     if (!data) {
@@ -69,7 +71,7 @@ const getStoreMeta = async (registry) => {
       } else if (isBase64(logoUrl, { allowMime: true })) {
         result.logoUrl = logoUrl;
       } else {
-        result.logoUrl = joinUrl(registry, logoUrl);
+        result.logoUrl = joinURL(registry, logoUrl);
       }
     }
 
@@ -124,14 +126,14 @@ const resolveTarballURL = ({ did, tarball = '', storeUrl = '' }) => {
     return '';
   }
 
-  return joinUrl(storeUrl, 'api', 'blocklets', did, tarball);
+  return joinURL(storeUrl, 'api', 'blocklets', did, tarball);
 };
 
 const getBlockletMetaUrl = ({ did, storeUrl }) =>
-  joinUrl(storeUrl, BLOCKLET_STORE_API_PREFIX, `/blocklets/${did}/blocklet.json`);
+  joinURL(storeUrl, BLOCKLET_STORE_API_PREFIX, `/blocklets/${did}/blocklet.json`);
 
 const getBlockletMeta = async ({ did, storeUrl }) => {
-  const url = joinUrl(storeUrl, BLOCKLET_STORE_API_PREFIX, `/blocklets/${did}/blocklet.json?__t__=${Date.now()}`);
+  const url = joinURL(storeUrl, BLOCKLET_STORE_API_PREFIX, `/blocklets/${did}/blocklet.json?__t__=${Date.now()}`);
 
   const { data } = await request.get(url);
   try {

package/lib/validators/node.js

@@ -39,6 +39,7 @@ const nodeInfoSchema = Joi.object({
     }),
   autoUpgrade: Joi.boolean(),
   enableWelcomePage: Joi.boolean(),
+  enableFileSystemIsolation: Joi.boolean(),
   diskAlertThreshold: Joi.number()
     .label('disk alarm threshold')
     .max(99)

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.16.28-beta-bfbab430",
+  "version": "1.16.28-beta-641c9f13",
   "description": "",
   "main": "lib/index.js",
   "files": [
@@ -19,19 +19,19 @@
   "author": "wangshijun <wangshijun2010@gmail.com> (http://github.com/wangshijun)",
   "license": "Apache-2.0",
   "dependencies": {
-    "@abtnode/analytics": "1.16.28-beta-bfbab430",
-    "@abtnode/auth": "1.16.28-beta-bfbab430",
-    "@abtnode/certificate-manager": "1.16.28-beta-bfbab430",
-    "@abtnode/constant": "1.16.28-beta-bfbab430",
-    "@abtnode/cron": "1.16.28-beta-bfbab430",
-    "@abtnode/logger": "1.16.28-beta-bfbab430",
-    "@abtnode/models": "1.16.28-beta-bfbab430",
-    "@abtnode/queue": "1.16.28-beta-bfbab430",
-    "@abtnode/rbac": "1.16.28-beta-bfbab430",
-    "@abtnode/router-provider": "1.16.28-beta-bfbab430",
-    "@abtnode/static-server": "1.16.28-beta-bfbab430",
-    "@abtnode/timemachine": "1.16.28-beta-bfbab430",
-    "@abtnode/util": "1.16.28-beta-bfbab430",
+    "@abtnode/analytics": "1.16.28-beta-641c9f13",
+    "@abtnode/auth": "1.16.28-beta-641c9f13",
+    "@abtnode/certificate-manager": "1.16.28-beta-641c9f13",
+    "@abtnode/constant": "1.16.28-beta-641c9f13",
+    "@abtnode/cron": "1.16.28-beta-641c9f13",
+    "@abtnode/logger": "1.16.28-beta-641c9f13",
+    "@abtnode/models": "1.16.28-beta-641c9f13",
+    "@abtnode/queue": "1.16.28-beta-641c9f13",
+    "@abtnode/rbac": "1.16.28-beta-641c9f13",
+    "@abtnode/router-provider": "1.16.28-beta-641c9f13",
+    "@abtnode/static-server": "1.16.28-beta-641c9f13",
+    "@abtnode/timemachine": "1.16.28-beta-641c9f13",
+    "@abtnode/util": "1.16.28-beta-641c9f13",
     "@arcblock/did": "1.18.123",
     "@arcblock/did-auth": "1.18.123",
     "@arcblock/did-ext": "^1.18.123",
@@ -42,20 +42,20 @@
     "@arcblock/pm2-events": "^0.0.5",
     "@arcblock/validator": "^1.18.123",
     "@arcblock/vc": "1.18.123",
-    "@blocklet/constant": "1.16.28-beta-bfbab430",
-    "@blocklet/env": "1.16.28-beta-bfbab430",
-    "@blocklet/meta": "1.16.28-beta-bfbab430",
-    "@blocklet/resolver": "1.16.28-beta-bfbab430",
-    "@blocklet/sdk": "1.16.28-beta-bfbab430",
-    "@blocklet/store": "1.16.28-beta-bfbab430",
-    "@did-space/client": "^0.4.20",
+    "@blocklet/constant": "1.16.28-beta-641c9f13",
+    "@blocklet/env": "1.16.28-beta-641c9f13",
+    "@blocklet/meta": "1.16.28-beta-641c9f13",
+    "@blocklet/resolver": "1.16.28-beta-641c9f13",
+    "@blocklet/sdk": "1.16.28-beta-641c9f13",
+    "@blocklet/store": "1.16.28-beta-641c9f13",
+    "@did-space/client": "^0.5.1",
     "@fidm/x509": "^1.2.1",
     "@ocap/mcrypto": "1.18.123",
     "@ocap/util": "1.18.123",
     "@ocap/wallet": "1.18.123",
     "@slack/webhook": "^5.0.4",
     "archiver": "^7.0.1",
-    "axios": "^0.27.2",
+    "axios": "^1.7.2",
     "axon": "^2.0.3",
     "chalk": "^4.1.2",
     "cross-spawn": "^7.0.3",
@@ -92,7 +92,7 @@
     "tar": "^6.1.11",
     "transliteration": "^2.3.5",
     "ua-parser-js": "^1.0.2",
-    "url-join": "^4.0.1",
+    "ufo": "^1.5.3",
     "uuid": "^9.0.1",
     "valid-url": "^1.0.9",
     "xbytes": "^1.8.0"
@@ -103,5 +103,5 @@
     "jest": "^29.7.0",
     "unzipper": "^0.10.11"
   },
-  "gitHead": "f1fbf0752de46be00d1faa0d54eb7d28016e0bb9"
+  "gitHead": "eb1fa63e4ed26fe5ba230845a318faa29408138b"
 }