@abtnode/core 1.8.36 → 1.8.38

package/lib/blocklet/manager/disk.js

@@ -13,6 +13,7 @@ const capitalize = require('lodash/capitalize');
 const { Throttle } = require('stream-throttle');
 const LRU = require('lru-cache');
 const joi = require('joi');
+const { isNFTExpired } = require('@abtnode/util/lib/nft');
 const { sign } = require('@arcblock/jwt');
 const { isValid: isValidDid } = require('@arcblock/did');
 const { verifyPresentation } = require('@arcblock/vc');
@@ -25,7 +26,12 @@ const logger = require('@abtnode/logger')('@abtnode/core:blocklet:manager');
 const downloadFile = require('@abtnode/util/lib/download-file');
 const Lock = require('@abtnode/util/lib/lock');
 const { getVcFromPresentation } = require('@abtnode/util/lib/vc');
-const { VC_TYPE_BLOCKLET_PURCHASE, WHO_CAN_ACCESS, SERVER_ROLES } = require('@abtnode/constant');
+const {
+  VC_TYPE_BLOCKLET_PURCHASE,
+  WHO_CAN_ACCESS,
+  SERVER_ROLES,
+  WHO_CAN_ACCESS_PREFIX_ROLES,
+} = require('@abtnode/constant');
 
 const getBlockletEngine = require('@blocklet/meta/lib/engine');
 const {
@@ -40,13 +46,21 @@ const {
   forEachChild,
   getComponentId,
   getComponentBundleId,
+  isPreferenceKey,
+  getRolesFromAuthConfig,
 } = require('@blocklet/meta/lib/util');
 const getComponentProcessId = require('@blocklet/meta/lib/get-component-process-id');
 const validateBlockletEntry = require('@blocklet/meta/lib/entry');
 const toBlockletDid = require('@blocklet/meta/lib/did');
 const { validateMeta } = require('@blocklet/meta/lib/validate');
 const { update: updateMetaFile } = require('@blocklet/meta/lib/file');
-const { titleSchema, descriptionSchema, mountPointSchema, logoSchema } = require('@blocklet/meta/lib/schema');
+const {
+  titleSchema,
+  descriptionSchema,
+  mountPointSchema,
+  logoSchema,
+  environmentNameSchema,
+} = require('@blocklet/meta/lib/schema');
 const hasReservedKey = require('@blocklet/meta/lib/has-reserved-key');
 
 const { toExternalBlocklet } = toBlockletDid;
@@ -109,6 +123,8 @@ const {
   ensureMeta,
   getBlocklet,
   ensureEnvDefault,
+  getConfigFromPreferences,
+  consumeServerlessNFT,
 } = require('../../util/blocklet');
 const StoreUtil = require('../../util/store');
 const states = require('../../states');
@@ -120,6 +136,7 @@ const runMigrationScripts = require('../migration');
 const hooks = require('../hooks');
 const { formatName } = require('../../util/get-domain-for-blocklet');
 const handleInstanceInStore = require('../../util/public-to-store');
+const { getNFTState } = require('../../util');
 
 const {
   isInProgress,
@@ -173,7 +190,7 @@ const getSkippedProcessIds = ({ newBlocklet, oldBlocklet, context = {} }) => {
 };
 
 const getBlockletIndex = (meta, controller) =>
-  controller ? toExternalBlocklet(meta.name, controller.id) : { did: meta.did, name: meta.name };
+  controller ? toExternalBlocklet(meta.name, controller.nftId) : { did: meta.did, name: meta.name };
 
 class BlockletManager extends BaseBlockletManager {
   /**
@@ -269,8 +286,8 @@ class BlockletManager extends BaseBlockletManager {
     }
 
     if (source === BlockletSource.registry) {
-      const { did, controller, sync, delay } = params;
-      return this._installFromStore({ did, controller, sync, delay }, context);
+      const { did, controller, sync, delay, storeUrl } = params;
+      return this._installFromStore({ did, controller, sync, delay, storeUrl }, context);
     }
 
     if (source === BlockletSource.custom) {
@@ -377,7 +394,7 @@ class BlockletManager extends BaseBlockletManager {
     return { meta, isFree, inStore, registryUrl };
   }
 
-  async getBlockletByBundle({ did, name }, context) {
+  async getBlockletByBundle({ did, name, serverlessNftId }, context) {
     if (toBlockletDid(name) !== did) {
       throw new Error('did and name does not match');
     }
@@ -386,11 +403,15 @@ class BlockletManager extends BaseBlockletManager {
       throw new Error('user does not exist');
     }
 
+    if (context.user.role === SERVER_ROLES.EXTERNAL_BLOCKLET_CONTROLLER && !serverlessNftId) {
+      throw new Error('serverless nft id is required');
+    }
+
     let blockletDid = did;
     let isExternal = false;
 
-    if (context.user.role === SERVER_ROLES.EXTERNAL_BLOCKLET_CONTROLLER) {
-      blockletDid = toExternalBlocklet(name, context.user.did, { didOnly: true });
+    if (serverlessNftId) {
+      blockletDid = toExternalBlocklet(name, serverlessNftId, { didOnly: true });
       isExternal = true;
     }
 
@@ -512,7 +533,7 @@ class BlockletManager extends BaseBlockletManager {
       const error = Array.isArray(err) ? err[0] : err;
       logger.error('Failed to start blocklet', { error, did, name: blocklet.meta.name });
       const description = `Start blocklet ${blocklet.meta.name} failed with error: ${error.message}`;
-      states.notification.create({
+      this._createNotification(did, {
         title: 'Start Blocklet Failed',
         description,
         entityType: 'blocklet',
@@ -564,7 +585,12 @@ class BlockletManager extends BaseBlockletManager {
 
     if (updateStatus) {
       const res = await this.status(did, { forceSync: true });
+      // send notification to websocket channel
       this.emit(BlockletEvents.statusChange, res);
+
+      // send notification to wallet
+      this.emit(BlockletEvents.stopped, res);
+
       return res;
     }
 
@@ -585,7 +611,7 @@ class BlockletManager extends BaseBlockletManager {
       const state = await states.blocklet.setBlockletStatus(did, BlockletStatus.stopped);
       this.emit(BlockletEvents.statusChange, state);
 
-      states.notification.create({
+      this._createNotification(did, {
         title: 'Blocklet Restart Failed',
         description: `Blocklet ${did} restart failed with error: ${err.message || 'queue exception'}`,
         entityType: 'blocklet',
@@ -636,7 +662,7 @@ class BlockletManager extends BaseBlockletManager {
       });
 
       const doc = await this._deleteBlocklet({ did, keepData, keepLogsDir, keepConfigs }, context);
-      states.notification.create({
+      this._createNotification(doc.meta.did, {
         title: 'Blocklet Deleted',
         description: `Blocklet ${doc.meta.name}@${doc.meta.version} is deleted.`,
         entityType: 'blocklet',
@@ -650,7 +676,7 @@ class BlockletManager extends BaseBlockletManager {
         logger.info('blocklet is corrupted, will delete again', { did });
         const doc = await this._deleteBlocklet({ did, keepData, keepLogsDir, keepConfigs }, context);
 
-        states.notification.create({
+        this._createNotification(doc.meta.did, {
           title: 'Blocklet Deleted',
           description: `Blocklet ${doc.meta.name}@${doc.meta.version} is deleted.`,
           entityType: 'blocklet',
@@ -775,7 +801,7 @@ class BlockletManager extends BaseBlockletManager {
     const newBlocklet = await this.ensureBlocklet(rootDid);
     this.emit(BlockletEvents.upgraded, { blocklet: newBlocklet, context: { ...context, createAuditLog: false } }); // trigger router refresh
 
-    states.notification.create({
+    this._createNotification(newBlocklet.meta.did, {
       title: 'Component Deleted',
       description: `Component ${child.meta.name} of ${newBlocklet.meta.name} is successfully deleted.`,
       entityType: 'blocklet',
@@ -836,6 +862,7 @@ class BlockletManager extends BaseBlockletManager {
     return result;
   }
 
+  // Get blocklet by blockletDid or appDid
   async detail({ did, attachConfig = true, attachRuntimeInfo = true }, context) {
     if (!did) {
       throw new Error('did should not be empty');
@@ -931,69 +958,88 @@ class BlockletManager extends BaseBlockletManager {
     // run hook
     const nodeEnvironments = await states.node.getEnvironments();
     for (const x of newConfigs) {
-      if (BLOCKLET_CONFIGURABLE_KEY[x.key] && !!childDids.length) {
-        logger.error(`Cannot set ${x.key} to child blocklet`, [dids]);
-        throw new Error(`Cannot set ${x.key} to child blocklet`);
-      }
+      if (x.custom === true) {
+        // custom key
+        await environmentNameSchema.validateAsync(x.key);
+      } else if (BLOCKLET_CONFIGURABLE_KEY[x.key] && x.key.startsWith('BLOCKLET_')) {
+        // app key
+        if (childDids.length) {
+          logger.error(`Cannot set ${x.key} to child blocklet`, [dids]);
+          throw new Error(`Cannot set ${x.key} to child blocklet`);
+        }
 
-      if (x.key === 'BLOCKLET_APP_SK') {
-        try {
-          fromSecretKey(x.value);
-        } catch {
+        if (x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SK) {
           try {
-            fromSecretKey(x.value, 'eth');
+            fromSecretKey(x.value);
           } catch {
-            throw new Error('Invalid custom blocklet secret key');
+            try {
+              fromSecretKey(x.value, 'eth');
+            } catch {
+              throw new Error('Invalid custom blocklet secret key');
+            }
           }
-        }
 
-        // Ensure sk is not used by other blocklets, otherwise we may encounter appDid collision
-        const blocklets = await states.blocklet.getBlocklets({});
-        const others = blocklets.filter((b) => b.meta.did !== did);
-        if (others.some((b) => b.environments.find((e) => e.key === 'BLOCKLET_APP_SK').value === x.value)) {
-          throw new Error('Invalid custom blocklet secret key: already used by another blocklet');
+          // Ensure sk is not used by other blocklets, otherwise we may encounter appDid collision
+          const blocklets = await states.blocklet.getBlocklets({});
+          const others = blocklets.filter((b) => b.meta.did !== did);
+          if (
+            others.some(
+              (b) => b.environments.find((e) => e.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SK).value === x.value
+            )
+          ) {
+            throw new Error('Invalid custom blocklet secret key: already used by another blocklet');
+          }
         }
-      }
 
-      if (x.key === 'BLOCKLET_APP_NAME') {
-        x.value = await titleSchema.validateAsync(x.value);
-      }
-
-      if (x.key === 'BLOCKLET_APP_DESCRIPTION') {
-        x.value = await descriptionSchema.validateAsync(x.value);
-      }
+        if (x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_NAME) {
+          x.value = await titleSchema.validateAsync(x.value);
+        }
 
-      if (['BLOCKLET_APP_LOGO', 'BLOCKLET_APP_LOGO_SQUARE'].includes(x.key)) {
-        x.value = await logoSchema.validateAsync(x.value);
-      }
+        if (x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_DESCRIPTION) {
+          x.value = await descriptionSchema.validateAsync(x.value);
+        }
 
-      if (x.key === 'BLOCKLET_WALLET_TYPE') {
-        if (['default', 'eth'].includes(x.value) === false) {
-          throw new Error('Invalid blocklet wallet type, only "default" and "eth" are supported');
+        if (
+          [BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_LOGO, BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_LOGO_SQUARE].includes(
+            x.key
+          )
+        ) {
+          x.value = await logoSchema.validateAsync(x.value);
         }
-      }
 
-      if (x.key === 'BLOCKLET_DELETABLE') {
-        if (['yes', 'no'].includes(x.value) === false) {
-          throw new Error('BLOCKLET_DELETABLE must be either "yes" or "no"');
+        if (x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_WALLET_TYPE) {
+          if (['default', 'eth'].includes(x.value) === false) {
+            throw new Error('Invalid blocklet wallet type, only "default" and "eth" are supported');
+          }
         }
-      }
 
-      if (x.key === 'BLOCKLET_PASSPORT_COLOR') {
-        if (x.value && x.value !== 'auto') {
-          if (x.value.length !== 7 || !isHex(x.value.slice(-6))) {
-            throw new Error('BLOCKLET_PASSPORT_COLOR must be a hex encoded color, eg. #ffeeaa');
+        if (x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_DELETABLE) {
+          if (['yes', 'no'].includes(x.value) === false) {
+            throw new Error('BLOCKLET_DELETABLE must be either "yes" or "no"');
           }
         }
-      }
 
-      if (x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_STORAGE_ENDPOINT) {
-        if (isEmpty(x.value)) {
-          throw new Error(`${x.key} can not be empty`);
+        if (x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_PASSPORT_COLOR) {
+          if (x.value && x.value !== 'auto') {
+            if (x.value.length !== 7 || !isHex(x.value.slice(-6))) {
+              throw new Error('BLOCKLET_PASSPORT_COLOR must be a hex encoded color, eg. #ffeeaa');
+            }
+          }
         }
 
-        if (!urlHttp(x.value)) {
-          throw new Error(`${x.key}(${x.value}) is not a valid http address`);
+        if (x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SPACE_ENDPOINT) {
+          if (isEmpty(x.value)) {
+            throw new Error(`${x.key} can not be empty`);
+          }
+
+          if (!urlHttp(x.value)) {
+            throw new Error(`${x.key}(${x.value}) is not a valid http address`);
+          }
+        }
+      } else if (!BLOCKLET_CONFIGURABLE_KEY[x.key] && !isPreferenceKey(x)) {
+        if (!(blocklet.meta.environments || []).some((y) => y.name === x.key)) {
+          // forbid unknown format key
+          throw new Error(`unknown format key: ${x.key}`);
         }
       }
 
@@ -1035,18 +1081,53 @@ class BlockletManager extends BaseBlockletManager {
   }
 
   async updateWhoCanAccess({ did, whoCanAccess }) {
-    if (!(await this.hasBlocklet({ did }))) {
-      throw new Error('The blocklet does not exist');
-    }
+    const dids = Array.isArray(did) ? did : [did];
+
+    const [rootDid] = dids;
+
+    const isApp = dids.length === 1;
+
+    try {
+      // check exist
+      if (!(await this.hasBlocklet({ did: rootDid }))) {
+        throw new Error('The blocklet does not exist');
+      }
+
+      // validate input
+      if (
+        !whoCanAccess.startsWith(WHO_CAN_ACCESS_PREFIX_ROLES) &&
+        !Object.values(WHO_CAN_ACCESS).includes(whoCanAccess)
+      ) {
+        throw new Error(`The value of whoCanAccess is invalid: ${whoCanAccess}`);
+      } else if (whoCanAccess.startsWith(WHO_CAN_ACCESS_PREFIX_ROLES)) {
+        if (!whoCanAccess.substring(WHO_CAN_ACCESS_PREFIX_ROLES.length).trim()) {
+          throw new Error('Roles in whoCanAccess cannot be empty');
+        }
 
-    if (!Object.values(WHO_CAN_ACCESS).includes(whoCanAccess)) {
-      logger.error(`The value of whoCanAccess is invalid: ${whoCanAccess}`);
-      throw new Error('the value is invalid');
+        if (whoCanAccess.length > 200) {
+          throw new Error('The length of whoCanAccess should not exceed 200');
+        }
+
+        const roleNames = (await this.teamManager.getRoles(rootDid)).map((x) => x.name);
+        const accessRoleNames = getRolesFromAuthConfig({ whoCanAccess });
+        const noExistNames = accessRoleNames.filter((x) => !roleNames.includes(x));
+        if (noExistNames.length) {
+          throw new Error(`Found no exist role names: ${noExistNames.join(',')}`);
+        }
+      }
+    } catch (error) {
+      logger.error(error.message);
+      throw error;
     }
 
-    await states.blockletExtras.setSettings(did, { whoCanAccess });
+    if (isApp) {
+      await states.blockletExtras.setSettings(rootDid, { whoCanAccess });
+    } else {
+      const configs = [{ key: BLOCKLET_CONFIGURABLE_KEY.COMPONENT_ACCESS_WHO, value: whoCanAccess }];
+      await states.blockletExtras.setConfigs(dids, configs);
+    }
 
-    const blocklet = await this.ensureBlocklet(did);
+    const blocklet = await this.ensureBlocklet(rootDid);
 
     this.emit(BlockletEvents.updated, { meta: { did: blocklet.meta.did } });
 
@@ -1130,23 +1211,23 @@ class BlockletManager extends BaseBlockletManager {
   /**
    * upgrade blocklet from registry
    */
-  async upgrade({ did, registryUrl, sync }, context) {
+  async upgrade({ did, storeUrl, sync }, context) {
     const blocklet = await states.blocklet.getBlocklet(did);
 
-    if (!registryUrl && blocklet.source === BlockletSource.url) {
+    if (!storeUrl && blocklet.source === BlockletSource.url) {
       return this._installFromUrl({ url: blocklet.deployedFrom }, context);
     }
 
-    // TODO: 查看了下目前页面中的升级按钮，都是会传 registryUrl 过来的，这个函数里的逻辑感觉需要在以后做一个简化
-    if (!registryUrl && blocklet.source !== BlockletSource.registry) {
-      throw new Error('Wrong upgrade source, empty registryUrl or not installed from blocklet registry');
+    // TODO: 查看了下目前页面中的升级按钮，都是会传 storeUrl 过来的，这个函数里的逻辑感觉需要在以后做一个简化
+    if (!storeUrl && blocklet.source !== BlockletSource.registry) {
+      throw new Error('Wrong upgrade source, empty storeUrl or not installed from blocklet registry');
     }
 
-    const upgradeFromRegistry = registryUrl || blocklet.deployedFrom;
+    const upgradeFromStore = storeUrl || blocklet.deployedFrom;
 
     let newVersionMeta = await StoreUtil.getBlockletMeta({
       did: blocklet.meta.bundleDid,
-      registryUrl: upgradeFromRegistry,
+      storeUrl: upgradeFromStore,
     });
     newVersionMeta = ensureMeta(newVersionMeta, { name: blocklet.meta.name, did: blocklet.meta.did });
 
@@ -1197,7 +1278,7 @@ class BlockletManager extends BaseBlockletManager {
     return this._upgrade({
       meta: newVersionMeta,
       source: BlockletSource.registry,
-      deployedFrom: upgradeFromRegistry,
+      deployedFrom: upgradeFromStore,
       context,
       sync,
     });
@@ -1358,7 +1439,7 @@ class BlockletManager extends BaseBlockletManager {
       logger.error('queue failed', { entity: 'blocklet', action, did, version, name, error: err });
       await this._rollback(action, did, oldBlocklet);
       this.emit(`blocklet.${action}.failed`, { did, version, err });
-      states.notification.create({
+      this._createNotification(did, {
         title: `Blocklet ${capitalize(action)} Failed`,
         description: `Blocklet ${name}@${version} ${action} failed with error: ${err.message || 'queue exception'}`,
         entityType: 'blocklet',
@@ -1382,7 +1463,7 @@ class BlockletManager extends BaseBlockletManager {
 
     const meta = getBlockletMeta(folder);
     if (meta.group !== 'static' && (!meta.scripts || !meta.scripts.dev)) {
-      throw new Error('Incorrect blocklet manifest: missing `scripts.dev` field');
+      throw new Error('Incorrect blocklet.yml: missing `scripts.dev` field');
     }
 
     if (rootDid) {
@@ -1757,7 +1838,7 @@ class BlockletManager extends BaseBlockletManager {
           message: err.message,
         },
       });
-      states.notification.create({
+      this._createNotification(did, {
         title: 'Blocklet Download Failed',
         description: `Blocklet ${name}@${version} download failed with error: ${err.message}`,
         entityType: 'blocklet',
@@ -1895,7 +1976,7 @@ class BlockletManager extends BaseBlockletManager {
       await this.deleteProcess({ did }, context);
       await states.blocklet.setBlockletStatus(did, BlockletStatus.error);
 
-      states.notification.create({
+      this._createNotification(did, {
         title: 'Blocklet Start Failed',
         description: `Blocklet ${name} start failed: ${error.message}`,
         entityType: 'blocklet',
@@ -1975,16 +2056,19 @@ class BlockletManager extends BaseBlockletManager {
    * @memberof BlockletManager
    */
   async _installFromStore(params, context) {
-    const { did, registry, sync, delay, controller } = params;
+    const { did, storeUrl, sync, delay, controller } = params;
 
     logger.debug('start install blocklet', { did });
     if (!isValidDid(did)) {
       throw new Error('Blocklet did is invalid');
     }
 
-    const registryUrl = registry || (await states.node.getBlockletRegistry());
-    const info = await StoreUtil.getRegistryMeta(registryUrl);
-    const meta = await StoreUtil.getBlockletMeta({ did, registryUrl });
+    if (!storeUrl) {
+      throw new Error('registry url should not be empty');
+    }
+
+    const info = await StoreUtil.getRegistryMeta(storeUrl);
+    const meta = await StoreUtil.getBlockletMeta({ did, storeUrl });
     if (!meta) {
       throw new Error('Can not install blocklet that not found in registry');
     }
@@ -2013,7 +2097,7 @@ class BlockletManager extends BaseBlockletManager {
     return this._install({
       meta: ensureMeta(meta, { did: blockletDid, name: blockletName }),
       source: BlockletSource.registry,
-      deployedFrom: info.cdnUrl || registryUrl,
+      deployedFrom: info.cdnUrl || storeUrl,
       sync,
       delay,
       controller,
@@ -2056,10 +2140,10 @@ class BlockletManager extends BaseBlockletManager {
     if (inStore) {
       const exist = await states.blocklet.getBlocklet(blockletDid);
       if (exist) {
-        return this.upgrade({ did: blockletDid, registryUrl, sync, delay }, context);
+        return this.upgrade({ did: blockletDid, storeUrl: registryUrl, sync, delay }, context);
       }
 
-      return this._installFromStore({ did: bundleDid, registry: registryUrl, controller, sync, delay }, context);
+      return this._installFromStore({ did: bundleDid, storeUrl: registryUrl, controller, sync, delay }, context);
     }
 
     const meta = ensureMeta(bundleMeta, { name: blockletName, did: blockletDid });
@@ -2514,6 +2598,11 @@ class BlockletManager extends BaseBlockletManager {
           await refreshAccessibleExternalNodeIp(nodeInfo);
         },
       },
+      {
+        name: 'delete-expired-external-blocklet',
+        time: '0 */30 * * * *', // 30min
+        fn: () => this._deleteExpiredExternalBlocklet(),
+      },
     ];
   }
 
@@ -2633,7 +2722,7 @@ class BlockletManager extends BaseBlockletManager {
             logger.error('failed to remove blocklet on install error', { did: meta.did, error: e });
           }
 
-          states.notification.create({
+          this._createNotification(did, {
             title: 'Blocklet Install Failed',
             description: `Blocklet ${name}@${version} install failed with error: ${err.message || 'queue exception'}`,
             entityType: 'blocklet',
@@ -2646,7 +2735,7 @@ class BlockletManager extends BaseBlockletManager {
       return blocklet1;
     } catch (err) {
       logger.error('failed to install blocklet', { name, did, version, error: err });
-      states.notification.create({
+      this._createNotification(did, {
         title: 'Blocklet Install Failed',
         description: `Blocklet ${name}@${version} install failed with error: ${err.message || 'queue exception'}`,
         entityType: 'blocklet',
@@ -2744,7 +2833,7 @@ class BlockletManager extends BaseBlockletManager {
         downgrade: BlockletEvents.downgradeFailed,
       };
       this.emit(eventNames[action], { blocklet: oldBlocklet, context });
-      states.notification.create({
+      this._createNotification(did, {
         title: `Blocklet ${capitalize(action)} Failed`,
         description: `Blocklet ${name}@${version} ${action} failed with error: ${err.message || 'queue exception'}`,
         entityType: 'blocklet',
@@ -2935,7 +3024,12 @@ class BlockletManager extends BaseBlockletManager {
         });
       }
 
-      states.notification.create({
+      if (blocklet.controller && process.env.NODE_ENV !== 'test') {
+        const nodeInfo = await states.node.read();
+        await consumeServerlessNFT({ nftId: blocklet.controller.nftId, nodeInfo, blocklet });
+      }
+
+      this._createNotification(did, {
         title: 'Blocklet Installed',
         description: `Blocklet ${meta.name}@${meta.version} is installed successfully. (Source: ${
           deployedFrom || fromBlockletSource(source)
@@ -2958,7 +3052,7 @@ class BlockletManager extends BaseBlockletManager {
             message: err.message,
           },
         });
-        states.notification.create({
+        this._createNotification(did, {
           title: 'Blocklet Install Failed',
           description: `Blocklet ${meta.name}@${meta.version} install failed with error: ${err.message}`,
           entityType: 'blocklet',
@@ -3053,7 +3147,7 @@ class BlockletManager extends BaseBlockletManager {
           downgrade: BlockletEvents.downgraded,
         };
         this.emit(eventNames[action], { blocklet, context });
-        states.notification.create({
+        this._createNotification(did, {
           title: `Blocklet ${capitalize(action)} Success`,
           description: `Blocklet ${name}@${version} ${action} successfully. (Source: ${
             deployedFrom || fromBlockletSource(source)
@@ -3081,9 +3175,9 @@ class BlockletManager extends BaseBlockletManager {
         upgrade: BlockletEvents.upgradeFailed,
         downgrade: BlockletEvents.downgradeFailed,
       };
-      this.emit(eventNames[action], { blocklet: oldBlocklet, context });
+      this.emit(eventNames[action], { blocklet: { ...oldBlocklet, error: { message: err.message } }, context });
 
-      states.notification.create({
+      this._createNotification(did, {
         title: `Blocklet ${capitalize(action)} Failed`,
         description: `Blocklet ${name}@${version} ${action} failed with error: ${err.message}`,
         entityType: 'blocklet',
@@ -3490,11 +3584,11 @@ class BlockletManager extends BaseBlockletManager {
   }
 
   async _setConfigsFromMeta(did, childDid) {
-    const blocklet = await states.blocklet.getBlocklet(did);
+    const blocklet = await getBlocklet({ states, dataDirs: this.dataDirs, did, validateEnv: false, ensureDirs: false });
 
     if (!childDid) {
       await forEachBlocklet(blocklet, async (b, { ancestors }) => {
-        const environments = get(b.meta, 'environments', []);
+        const environments = [...get(b.meta, 'environments', []), ...getConfigFromPreferences(b)];
 
         // remove default if ancestors has a value
         ensureEnvDefault(environments, ancestors);
@@ -3507,7 +3601,7 @@ class BlockletManager extends BaseBlockletManager {
       await forEachBlocklet(child, async (b, { ancestors }) => {
         await states.blockletExtras.setConfigs(
           [blocklet.meta.did, ...ancestors.map((x) => x.meta.did), b.meta.did],
-          get(b.meta, 'environments', [])
+          [...get(b.meta, 'environments', []), ...getConfigFromPreferences(child)]
         );
       });
     }
@@ -3556,13 +3650,13 @@ class BlockletManager extends BaseBlockletManager {
   }
 
   async _getLatestBlockletVersionFromStore({ blocklet, version }) {
-    const { deployedFrom: registryUrl } = blocklet;
+    const { deployedFrom: storeUrl } = blocklet;
     const { did, bundleDid } = blocklet.meta;
 
     let versions = this.cachedBlockletVersions.get(did);
 
     if (!versions) {
-      const item = await StoreUtil.getBlockletMeta({ did: bundleDid, registryUrl });
+      const item = await StoreUtil.getBlockletMeta({ did: bundleDid, storeUrl });
 
       if (!item) {
         return null;
@@ -3579,23 +3673,7 @@ class BlockletManager extends BaseBlockletManager {
       return null;
     }
 
-    // When new version found from the store where the blocklet was installed from, we should use that store first
-    if (blocklet.source === BlockletSource.registry && blocklet.deployedFrom) {
-      const latestFromSameRegistry = versions.find((x) => x.registryUrl === blocklet.deployedFrom);
-      if (latestFromSameRegistry) {
-        return latestFromSameRegistry;
-      }
-    }
-
-    // Otherwise try upgrading from other store
-    let latestBlockletVersion = versions[0];
-    versions.forEach((item) => {
-      if (semver.lt(latestBlockletVersion.version, item.version)) {
-        latestBlockletVersion = item;
-      }
-    });
-
-    return latestBlockletVersion;
+    return versions[0];
   }
 
   async _getLatestBlockletVersionFromUrl({ blocklet, version }) {
@@ -3654,6 +3732,64 @@ class BlockletManager extends BaseBlockletManager {
 
     await forEachBlocklet(blocklet, postInstall, { parallel: true });
   }
+
+  async _createNotification(did, notification) {
+    try {
+      const isExternal = await states.blocklet.isExternalBlocklet(did);
+
+      if (isExternal) {
+        return;
+      }
+
+      await states.notification.create(notification);
+    } catch (error) {
+      logger.error('create notification failed', { error });
+    }
+  }
+
+  async _deleteExpiredExternalBlocklet() {
+    try {
+      logger.info('start check expired external blocklet');
+      const blocklets = await states.blocklet.getBlocklets({
+        controller: {
+          $exists: true,
+        },
+      });
+
+      const nodeInfo = await states.node.read();
+
+      const tasks = blocklets.map(async (blocklet) => {
+        try {
+          const assetState = await getNFTState(nodeInfo.launcher.chainHost, blocklet.controller.nftId);
+          const isExpired = isNFTExpired(assetState);
+          if (isExpired) {
+            logger.info('the blocklet already expired', {
+              blockletId: blocklet._id,
+              nftId: blocklet.controller.nftId,
+            });
+
+            // FIXME: 后面需要考虑将数据保留一段时间
+            await this.delete({ did: blocklet.meta.did, keepData: false, keepConfigs: false, keepLogsDir: false });
+            logger.info('the expired blocklet already deleted', {
+              blockletId: blocklet._id,
+              nftId: blocklet.controller.nftId,
+            });
+          }
+        } catch (error) {
+          logger.error('get asset state failed when check expired external blocklet', {
+            blockletId: blocklet._id,
+            nftId: blocklet.controller.nftId,
+          });
+        }
+      });
+
+      await Promise.all(tasks);
+
+      logger.info('check expired external blocklet end');
+    } catch (error) {
+      logger.info('check expired external blocklet failed', { error });
+    }
+  }
 }
 
 module.exports = BlockletManager;