@abtnode/core 1.17.8-beta-20260119-102944-6ba93a16 → 1.17.8-beta-20260125-093329-64b43854

package/lib/api/team/org-crud-manager.js

@@ -2,6 +2,8 @@ const logger = require('@abtnode/logger')('@abtnode/core:api:team:org-crud');
 const { CustomError } = require('@blocklet/error');
 const md5 = require('@abtnode/util/lib/md5');
 const { sanitizeTag } = require('@abtnode/util/lib/sanitize');
+const path = require('path');
+const fs = require('fs-extra');
 
 const { createOrgValidators } = require('../../util/org');
 const { createOrgInputSchema, updateOrgInputSchema } = require('../../validators/org');
@@ -159,7 +161,33 @@ async function updateOrg(api, { teamDid, org }, context) {
     }
 
     const state = await api.getOrgState(teamDid);
-    return state.updateOrg({ org: sanitizedOrg }, context);
+
+    // 获取旧的 org 数据，用于比对 avatar 是否发生变化
+    const oldOrg = await state.getOrg(org.id);
+
+    const result = await state.updateOrg({ org: sanitizedOrg }, context);
+
+    // 如果 avatar 发生变化，删除旧的 avatar 文件（不影响主流程）
+    try {
+      if (oldOrg?.avatar && result.avatar && oldOrg.avatar !== result.avatar) {
+        const blocklet = await getBlocklet({
+          did: teamDid,
+          states: api.states,
+          dataDirs: api.dataDirs,
+          useCache: true,
+        });
+
+        const oldAvatarPath = path.resolve(blocklet.env.dataDir, 'orgs', oldOrg.avatar);
+        if (fs.existsSync(oldAvatarPath)) {
+          await fs.remove(oldAvatarPath);
+          logger.info('Successfully removed old org avatar', { teamDid, orgId: result.id, oldAvatar: oldOrg.avatar });
+        }
+      }
+    } catch (err) {
+      logger.error('remove org avatar file', { err, teamDid, orgId: result.id, avatar: result.avatar });
+    }
+
+    return result;
   } catch (err) {
     logger.error('Failed to update org', { err, teamDid });
     throw err;

package/lib/api/team/user-query-manager.js

@@ -99,6 +99,7 @@ async function getUsers(api, { teamDid, query, paging: inputPaging, sort, dids }
 
         'metadata',
         'isFollowing',
+        'name',
       ]);
 
       return {

package/lib/blocklet/manager/disk/settings-manager.js

@@ -65,7 +65,11 @@ async function getBlockletBlurhash(manager, { did }) {
  * @param {Object} context
  * @returns {Promise<Object>}
  */
-async function updateBlockletSettings(manager, { did, enableSessionHardening, invite, gateway, aigne, org }, context) {
+async function updateBlockletSettings(
+  manager,
+  { did, enableSessionHardening, invite, gateway, aigne, org, subService },
+  context
+) {
   const params = {};
   if (!isNil(enableSessionHardening)) {
     params.enableSessionHardening = enableSessionHardening;
@@ -98,6 +102,37 @@ async function updateBlockletSettings(manager, { did, enableSessionHardening, in
     };
   }
 
+  if (!isNil(subService)) {
+    // Security: Validate subService configuration to prevent path traversal
+    const SUB_SERVICE_SCHEMA = Joi.object({
+      enabled: Joi.boolean().required(),
+      domain: Joi.when('enabled', {
+        is: true,
+        then: Joi.string().required(),
+        otherwise: Joi.string().optional().allow(''),
+      }),
+      staticRoot: Joi.when('enabled', {
+        is: true,
+        then: Joi.string()
+          .required()
+          // Reject paths containing ".." or starting with "/"
+          .pattern(/^[^/]/, { name: 'no-absolute-path' })
+          .pattern(/^(?!.*\.\.).*$/, { name: 'no-parent-reference' })
+          .messages({
+            'string.pattern.name': 'Invalid path. Path cannot contain ".." or start with "/"',
+          }),
+        otherwise: Joi.string().optional().allow(''),
+      }),
+    });
+
+    const { error } = SUB_SERVICE_SCHEMA.validate(subService);
+    if (error) {
+      throw new CustomError(400, error.message);
+    }
+
+    params.subService = subService;
+  }
+
   let shouldRotateSession = false;
   if (!isNil(org)) {
     const ORG_SCHEMA = Joi.object({

package/lib/blocklet/manager/disk.js

@@ -826,10 +826,10 @@ class DiskBlockletManager extends BaseBlockletManager {
     return summary;
   }
 
-  updateBlockletSettings({ did, enableSessionHardening, invite, gateway, aigne, org }, context) {
+  updateBlockletSettings({ did, enableSessionHardening, invite, gateway, aigne, org, subService }, context) {
     return settingsManager.updateBlockletSettings(
       this,
-      { did, enableSessionHardening, invite, gateway, aigne, org },
+      { did, enableSessionHardening, invite, gateway, aigne, org, subService },
       context
     );
   }