@abtnode/core 1.17.4-beta-20251205-104405-28838df1 → 1.17.4-beta-20251206-081442-6f622450

package/lib/index.js

@@ -325,6 +325,7 @@ function ABTNode(options) {
     getSitesFromSnapshot,
     getRoutingCrons,
     ensureWildcardCerts,
+    ensureServerlessCerts,
     getRouterProvider,
     addRoutingSite,
     deleteRoutingSite,
@@ -730,6 +731,7 @@ function ABTNode(options) {
     getSitesFromSnapshot,
     ensureDashboardRouting,
     ensureWildcardCerts,
+    ensureServerlessCerts,
 
     addDomainAlias,
     deleteDomainAlias,

package/lib/router/helper.js

@@ -25,9 +25,12 @@ const md5 = require('@abtnode/util/lib/md5');
 const normalizePathPrefix = require('@abtnode/util/lib/normalize-path-prefix');
 const getTmpDir = require('@abtnode/util/lib/get-tmp-directory');
 const downloadFile = require('@abtnode/util/lib/download-file');
+const axios = require('@abtnode/util/lib/axios');
 const { getIpDnsDomainForBlocklet } = require('@abtnode/util/lib/get-domain-for-blocklet');
 const { forEachBlockletSync } = require('@blocklet/meta/lib/util');
 const { processLogByDate } = require('@abtnode/analytics');
+const pRetry = require('p-retry');
+const { buildLauncherUrl, buildRequestHeaders } = require('@abtnode/auth/lib/launcher');
 const {
   DOMAIN_FOR_DEFAULT_SITE,
   DOMAIN_FOR_IP_SITE_REGEXP,
@@ -52,6 +55,7 @@ const {
   EVENTS,
   DEFAULT_IP_DOMAIN,
   WELLKNOWN_BLACKLIST_PREFIX,
+  NODE_MODES,
 } = require('@abtnode/constant');
 const {
   BLOCKLET_DYNAMIC_PATH_PREFIX,
@@ -903,6 +907,133 @@ module.exports = function getRouterHelpers({
     ]);
   };
 
+  const ensureServerlessCerts = async () => {
+    const info = await nodeState.read();
+
+    if (info.mode !== NODE_MODES.SERVERLESS) {
+      logger.warn('ensureServerlessCerts: not in serverless mode', { mode: info.mode });
+      return;
+    }
+
+    const launcherUrl = process.env.ABT_NODE_BLOCKLET_LAUNCHER_URL || info.registerUrl;
+    const provisionToken = process.env.ABT_NODE_PROVISION_TOKEN;
+
+    if (!launcherUrl) {
+      logger.warn('ensureServerlessCerts: missing launcher URL');
+      return;
+    }
+
+    let authHeaders = {};
+    let authType = 'none';
+
+    const payload = {
+      did: info.did,
+      version: info.version,
+    };
+
+    if (provisionToken) {
+      authHeaders = { Authorization: `Bearer ${provisionToken}` };
+      authType = 'bearer';
+    } else if (info.sk) {
+      try {
+        authHeaders = await buildRequestHeaders(info.sk, payload);
+        authType = 'signature';
+      } catch (error) {
+        logger.error('ensureServerlessCerts: failed to create signature', { error });
+        return;
+      }
+    } else {
+      logger.warn('ensureServerlessCerts: no authentication method available');
+      return;
+    }
+
+    const fn = async () => {
+      const provisionUrl = await buildLauncherUrl(launcherUrl, '/api/serverless/provision');
+      const destFolder = getTmpDir(path.join(`serverless-cert-${Date.now()}`));
+
+      logger.info('download serverless certificate start', { provisionUrl, destFolder, authType });
+
+      try {
+        const filename = path.join(destFolder, 'certificate.tar.gz');
+        fs.ensureDirSync(destFolder);
+
+        const { data } = await axios({
+          method: 'post',
+          url: provisionUrl,
+          headers: authHeaders,
+          responseType: 'stream',
+          data: payload,
+        });
+
+        const fileStream = data.pipe(fs.createWriteStream(filename));
+        await new Promise((resolve, reject) => {
+          fileStream.on('finish', resolve);
+          fileStream.on('error', reject);
+        });
+
+        await decompressCertificates(filename, destFolder);
+
+        const certificateFilePath = path.join(destFolder, 'cert.pem');
+        const privateKeyFilePath = path.join(destFolder, 'privkey.pem');
+
+        if (!fs.existsSync(certificateFilePath)) {
+          throw new Error('serverless certificate invalid: cert.pem does not exist');
+        }
+
+        if (!fs.existsSync(privateKeyFilePath)) {
+          throw new Error('serverless certificate invalid: privkey.pem does not exist');
+        }
+
+        const certificate = fs.readFileSync(certificateFilePath).toString();
+        const privateKey = fs.readFileSync(privateKeyFilePath).toString();
+
+        const certInfo = getHttpsCertInfo(certificate);
+        const domain = certInfo.sans?.[0] || certInfo.domain;
+
+        if (!domain) {
+          throw new Error('serverless certificate invalid: no domain found');
+        }
+
+        await certManager.upsertByDomain({
+          domain,
+          privateKey,
+          certificate,
+          isProtected: false,
+        });
+
+        logger.info('serverless certificate updated', { domain, authType });
+        return domain;
+      } catch (error) {
+        logger.error('serverless certificate download failed', { error, authType });
+        throw error;
+      } finally {
+        fs.removeSync(destFolder);
+        logger.info('remove serverless certificate dest folder', { destFolder });
+      }
+    };
+
+    const delay = 10 * 1000;
+    try {
+      await pRetry(fn, {
+        retries: 3,
+        minTimeout: delay,
+        maxTimeout: delay,
+        onFailedAttempt: (error) => {
+          logger.error('serverless certificate download retry', {
+            error,
+            attempt: error.attemptNumber,
+            retriesLeft: error.retriesLeft,
+          });
+          if (error.response && error.response.status >= 400 && error.response.status < 500) {
+            throw error;
+          }
+        },
+      });
+    } catch (error) {
+      logger.error('serverless certificate update failed', { error, authType });
+    }
+  };
+
   const upsertSiteRule = async ({ site, rule }, context) => {
     const findExistingRule = (prefix) => site.rules.find((r) => r.from.pathPrefix === normalizePathPrefix(prefix));
 
@@ -2040,6 +2171,7 @@ module.exports = function getRouterHelpers({
     getSitesFromSnapshot,
     getCertificates,
     ensureWildcardCerts,
+    ensureServerlessCerts,
     addWellknownSite,
     upsertSiteRule,
     getRouterProvider: (name) => providers[name],
@@ -2052,6 +2184,12 @@ module.exports = function getRouterHelpers({
         fn: () => updateDashboardCertificates(),
         options: { runOnInit: true },
       },
+      {
+        name: 'update-serverless-certificate',
+        time: '0 10 */6 * * *', // refetch on 0:10, 6:10, etc. (offset from dashboard cert update)
+        fn: () => ensureServerlessCerts(),
+        options: { runOnInit: false },
+      },
       {
         name: 'rotate-log-files',
         time: '1 0 0 * * *', // rotate at 00:00:01 every day

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.17.4-beta-20251205-104405-28838df1",
+  "version": "1.17.4-beta-20251206-081442-6f622450",
   "description": "",
   "main": "lib/index.js",
   "files": [
@@ -17,21 +17,21 @@
   "author": "wangshijun <wangshijun2010@gmail.com> (http://github.com/wangshijun)",
   "license": "Apache-2.0",
   "dependencies": {
-    "@abtnode/analytics": "1.17.4-beta-20251205-104405-28838df1",
-    "@abtnode/auth": "1.17.4-beta-20251205-104405-28838df1",
-    "@abtnode/certificate-manager": "1.17.4-beta-20251205-104405-28838df1",
-    "@abtnode/constant": "1.17.4-beta-20251205-104405-28838df1",
-    "@abtnode/cron": "1.17.4-beta-20251205-104405-28838df1",
-    "@abtnode/db-cache": "1.17.4-beta-20251205-104405-28838df1",
-    "@abtnode/docker-utils": "1.17.4-beta-20251205-104405-28838df1",
-    "@abtnode/logger": "1.17.4-beta-20251205-104405-28838df1",
-    "@abtnode/models": "1.17.4-beta-20251205-104405-28838df1",
-    "@abtnode/queue": "1.17.4-beta-20251205-104405-28838df1",
-    "@abtnode/rbac": "1.17.4-beta-20251205-104405-28838df1",
-    "@abtnode/router-provider": "1.17.4-beta-20251205-104405-28838df1",
-    "@abtnode/static-server": "1.17.4-beta-20251205-104405-28838df1",
-    "@abtnode/timemachine": "1.17.4-beta-20251205-104405-28838df1",
-    "@abtnode/util": "1.17.4-beta-20251205-104405-28838df1",
+    "@abtnode/analytics": "1.17.4-beta-20251206-081442-6f622450",
+    "@abtnode/auth": "1.17.4-beta-20251206-081442-6f622450",
+    "@abtnode/certificate-manager": "1.17.4-beta-20251206-081442-6f622450",
+    "@abtnode/constant": "1.17.4-beta-20251206-081442-6f622450",
+    "@abtnode/cron": "1.17.4-beta-20251206-081442-6f622450",
+    "@abtnode/db-cache": "1.17.4-beta-20251206-081442-6f622450",
+    "@abtnode/docker-utils": "1.17.4-beta-20251206-081442-6f622450",
+    "@abtnode/logger": "1.17.4-beta-20251206-081442-6f622450",
+    "@abtnode/models": "1.17.4-beta-20251206-081442-6f622450",
+    "@abtnode/queue": "1.17.4-beta-20251206-081442-6f622450",
+    "@abtnode/rbac": "1.17.4-beta-20251206-081442-6f622450",
+    "@abtnode/router-provider": "1.17.4-beta-20251206-081442-6f622450",
+    "@abtnode/static-server": "1.17.4-beta-20251206-081442-6f622450",
+    "@abtnode/timemachine": "1.17.4-beta-20251206-081442-6f622450",
+    "@abtnode/util": "1.17.4-beta-20251206-081442-6f622450",
     "@aigne/aigne-hub": "^0.10.10",
     "@arcblock/did": "^1.27.12",
     "@arcblock/did-connect-js": "^1.27.12",
@@ -43,15 +43,15 @@
     "@arcblock/pm2-events": "^0.0.5",
     "@arcblock/validator": "^1.27.12",
     "@arcblock/vc": "^1.27.12",
-    "@blocklet/constant": "1.17.4-beta-20251205-104405-28838df1",
+    "@blocklet/constant": "1.17.4-beta-20251206-081442-6f622450",
     "@blocklet/did-space-js": "^1.2.6",
-    "@blocklet/env": "1.17.4-beta-20251205-104405-28838df1",
+    "@blocklet/env": "1.17.4-beta-20251206-081442-6f622450",
     "@blocklet/error": "^0.3.3",
-    "@blocklet/meta": "1.17.4-beta-20251205-104405-28838df1",
-    "@blocklet/resolver": "1.17.4-beta-20251205-104405-28838df1",
-    "@blocklet/sdk": "1.17.4-beta-20251205-104405-28838df1",
-    "@blocklet/server-js": "1.17.4-beta-20251205-104405-28838df1",
-    "@blocklet/store": "1.17.4-beta-20251205-104405-28838df1",
+    "@blocklet/meta": "1.17.4-beta-20251206-081442-6f622450",
+    "@blocklet/resolver": "1.17.4-beta-20251206-081442-6f622450",
+    "@blocklet/sdk": "1.17.4-beta-20251206-081442-6f622450",
+    "@blocklet/server-js": "1.17.4-beta-20251206-081442-6f622450",
+    "@blocklet/store": "1.17.4-beta-20251206-081442-6f622450",
     "@blocklet/theme": "^3.2.11",
     "@fidm/x509": "^1.2.1",
     "@ocap/mcrypto": "^1.27.12",
@@ -116,5 +116,5 @@
     "express": "^4.18.2",
     "unzipper": "^0.10.11"
   },
-  "gitHead": "f8e18c8b32b19fd98de3d292a0036e628e59d474"
+  "gitHead": "37b0b1147d40a5cf787cba5d111a63a2b6259790"
 }