@abtnode/core 1.8.68-beta-500af7e5 → 1.8.68

package/lib/blocklet/downloader/bundle-downloader.js

@@ -2,7 +2,6 @@ const { EventEmitter } = require('events');
 const fs = require('fs-extra');
 const { fileURLToPath } = require('url');
 const path = require('path');
-const pick = require('lodash/pick');
 const cloneDeep = require('lodash/cloneDeep');
 const { toBase58 } = require('@ocap/util');
 
@@ -162,11 +161,7 @@ class BundleDownloader extends EventEmitter {
       }
       ctrlStore[rootDid].set(did, cancelCtrl);
 
-      const headers = pick(context.headers ? cloneDeep(context.headers) : {}, [
-        'x-server-did',
-        'x-server-public-key',
-        'x-server-signature',
-      ]);
+      const headers = context.headers ? cloneDeep(context.headers) : {};
       const exist = (context.downloadTokenList || []).find((x) => x.did === did);
       if (exist) {
         headers['x-download-token'] = exist.token;

package/lib/blocklet/manager/disk.js

@@ -4,7 +4,6 @@ const fs = require('fs-extra');
 const path = require('path');
 const flat = require('flat');
 const get = require('lodash/get');
-const merge = require('lodash/merge');
 const pick = require('lodash/pick');
 const cloneDeep = require('lodash/cloneDeep');
 const semver = require('semver');
@@ -16,18 +15,20 @@ const { isNFTExpired, getNftExpirationDate } = require('@abtnode/util/lib/nft');
 const didDocument = require('@abtnode/util/lib/did-document');
 const { sign } = require('@arcblock/jwt');
 const { isValid: isValidDid } = require('@arcblock/did');
+const { verifyPresentation } = require('@arcblock/vc');
 const { toSvg: createDidLogo } =
   process.env.NODE_ENV !== 'test' ? require('@arcblock/did-motif') : require('@arcblock/did-motif/dist/did-motif.cjs');
 const getBlockletInfo = require('@blocklet/meta/lib/info');
 const sleep = require('@abtnode/util/lib/sleep');
 
 const logger = require('@abtnode/logger')('@abtnode/core:blocklet:manager');
+const { getVcFromPresentation } = require('@abtnode/util/lib/vc');
 const {
+  VC_TYPE_BLOCKLET_PURCHASE,
   WHO_CAN_ACCESS,
   SERVER_ROLES,
   WHO_CAN_ACCESS_PREFIX_ROLES,
   BLOCKLET_INSTALL_TYPE,
-  NODE_MODES,
 } = require('@abtnode/constant');
 
 const getBlockletEngine = require('@blocklet/meta/lib/engine');
@@ -48,7 +49,7 @@ const getComponentProcessId = require('@blocklet/meta/lib/get-component-process-
 const toBlockletDid = require('@blocklet/meta/lib/did');
 const { validateMeta } = require('@blocklet/meta/lib/validate');
 const { update: updateMetaFile } = require('@blocklet/meta/lib/file');
-const { titleSchema, updateMountPointSchema, environmentNameSchema } = require('@blocklet/meta/lib/schema');
+const { titleSchema, mountPointSchema, environmentNameSchema } = require('@blocklet/meta/lib/schema');
 const hasReservedKey = require('@blocklet/meta/lib/has-reserved-key');
 const Lock = require('@abtnode/util/lib/lock');
 
@@ -110,10 +111,6 @@ const {
   validateAppConfig,
   checkDuplicateAppSk,
   checkDuplicateMountPoint,
-  validateStore,
-  validateInServerless,
-  isRotatingAppSk,
-  isRotatingAppDid,
 } = require('../../util/blocklet');
 const StoreUtil = require('../../util/store');
 const states = require('../../states');
@@ -196,14 +193,13 @@ class BlockletManager extends BaseBlockletManager {
   /**
    * @param {*} dataDirs generate by ../../util:getDataDirs
    */
-  constructor({ dataDirs, startQueue, installQueue, backupQueue, daemon = false, teamManager }) {
+  constructor({ dataDirs, startQueue, installQueue, daemon = false, teamManager }) {
     super();
 
     this.dataDirs = dataDirs;
     this.installDir = dataDirs.blocklets;
     this.startQueue = startQueue;
     this.installQueue = installQueue;
-    this.backupQueue = backupQueue;
     this.teamManager = teamManager;
 
     // cached installed blocklets for performance
@@ -246,8 +242,6 @@ class BlockletManager extends BaseBlockletManager {
    *  did: string;
    *  title: string;
    *  description: string;
-   *  storeUrl: string;
-   *  appSk: string;
    *  sync: boolean = false; // download synchronously, not use queue
    *  delay: number; // push download task to queue after a delay
    *  downloadTokenList: Array<{did: string, token: string}>;
@@ -270,7 +264,6 @@ class BlockletManager extends BaseBlockletManager {
 
     const info = await states.node.read();
 
-    // Note: if you added new header here, please change core/state/lib/blocklet/downloader/bundle-downloader.js to use that header
     context.headers = Object.assign(context?.headers || {}, {
       'x-server-did': info.did,
       'x-server-public-key': info.pk,
@@ -285,31 +278,28 @@ class BlockletManager extends BaseBlockletManager {
       context.startImmediately = !!params.startImmediately;
     }
 
-    const { appSk } = params;
-
     if (type === BLOCKLET_INSTALL_TYPE.URL) {
       const { url, controller, sync, delay } = params;
-      return this._installFromUrl({ url, controller, sync, delay, appSk }, context);
+      return this._installFromUrl({ url, controller, sync, delay }, context);
     }
 
     if (type === BLOCKLET_INSTALL_TYPE.UPLOAD) {
       const { file, did, diffVersion, deleteSet } = params;
-      return this._installFromUpload({ file, did, diffVersion, deleteSet, appSk }, context);
+      return this._installFromUpload({ file, did, diffVersion, deleteSet, context });
     }
 
     if (type === BLOCKLET_INSTALL_TYPE.STORE) {
       const { did, controller, sync, delay, storeUrl } = params;
-      return this._installFromStore({ did, controller, sync, delay, storeUrl, appSk }, context);
+      return this._installFromStore({ did, controller, sync, delay, storeUrl }, context);
     }
 
     if (type === BLOCKLET_INSTALL_TYPE.CREATE) {
-      const { title, description } = params;
-      return this._installFromCreate({ title, description, appSk }, context);
+      return this._installFromCreate({ title: params.title, description: params.description }, context);
     }
 
     if (type === BLOCKLET_INSTALL_TYPE.RESTORE) {
-      const { url } = params;
-      return this._installFromBackup({ url, appSk }, context);
+      const { url, blockletSecretKey } = params;
+      return this._installFromBackup({ url, blockletSecretKey }, context);
     }
 
     // should not be here
@@ -353,16 +343,10 @@ class BlockletManager extends BaseBlockletManager {
     },
     context = {}
   ) {
-    const mountPoint = await updateMountPointSchema.validateAsync(tmpMountPoint);
+    const mountPoint = await mountPointSchema.validateAsync(tmpMountPoint);
     logger.debug('start install component', { rootDid, mountPoint, url });
 
     if (file) {
-      // TODO: 如何触发这种场景？
-      const info = await states.node.read();
-      if (info.mode === NODE_MODES.SERVERLESS) {
-        throw new Error("Can't install component in serverless-mode server via upload");
-      }
-
       return this._installComponentFromUpload({
         rootDid,
         mountPoint,
@@ -376,11 +360,6 @@ class BlockletManager extends BaseBlockletManager {
     }
 
     if (url) {
-      const info = await states.node.read();
-      if (info.mode === NODE_MODES.SERVERLESS) {
-        validateStore(info, url);
-      }
-
       return this._installComponentFromUrl({
         rootDid,
         mountPoint,
@@ -452,6 +431,25 @@ class BlockletManager extends BaseBlockletManager {
     return { isInstalled: !!blocklet, isRunning, blockletDid, isExternal };
   }
 
+  async installBlockletFromVc({ vcPresentation, challenge }, context) {
+    logger.info('Install from vc');
+    const vc = getVcFromPresentation(vcPresentation);
+
+    // FIXME: 这里的 trustedIssuers 相当于相信任何 VC，需要想更安全的方法
+    verifyPresentation({ presentation: vcPresentation, trustedIssuers: [get(vc, 'issuer.id')], challenge });
+
+    if (!vc.type.includes(VC_TYPE_BLOCKLET_PURCHASE)) {
+      throw new Error(`Expect ${VC_TYPE_BLOCKLET_PURCHASE} VC type`);
+    }
+
+    const blockletUrl = get(vc, 'credentialSubject.purchased.blocklet.url');
+    const urlObject = new URL(blockletUrl);
+    const did = get(vc, 'credentialSubject.purchased.blocklet.id');
+    const registry = urlObject.origin;
+
+    return this._installFromStore({ did, registry }, context);
+  }
+
   async start({ did, throwOnError, checkHealthImmediately = false, e2eMode = false }, context) {
     logger.info('start blocklet', { did });
     // should check blocklet integrity
@@ -610,67 +608,32 @@ class BlockletManager extends BaseBlockletManager {
   }
 
   /**
-   * FIXME: @wangshijun create audit log for this
-   * @param {import('@abtnode/client').RequestBackupToSpacesInput} input
+   *
+   *
+   * @param {import('@abtnode/client').BackupToSpacesParams} input
    * @memberof BlockletManager
    */
-  // eslint-disable-next-line no-unused-vars
-  async backupToSpaces({ did }, context) {
-    // add to queue
-    // const ticket = this.backupQueue.push({
-    //   entity: 'blocklet',
-    //   action: 'backup-to-space',
-    //   did,
-    //   context,
-    // });
-
-    // ticket.on('failed', async (err) => {
-    //   logger.error('backup failed', { entity: 'blocklet', did, error: err });
-    //   this.emit('blocklet.backup.failed', { did, err });
-    //   this._createNotification(did, {
-    //     title: 'Blocklet Backup Failed',
-    //     description: `Blocklet backup failed with error: ${err.message || 'queue exception'}`,
-    //     entityType: 'blocklet',
-    //     entityId: did,
-    //     severity: 'error',
-    //   });
-    // });
-
-    const userDid = context.user.did;
-    const { referrer } = context;
-
-    // FIXME: @yejianchao did should be renamed to appDid
-    const spacesBackup = new SpacesBackup({ did, event: this, userDid, referrer });
-    this.emit(BlockletEvents.backupProgress, { did, message: 'Start backup...', progress: 10 });
+  async backupToSpaces(input) {
+    const spacesBackup = new SpacesBackup(input);
     await spacesBackup.backup();
-    this.emit(BlockletEvents.backupProgress, { did, completed: true, progress: 100 });
   }
 
   /**
-   * FIXME: @linchen support cancel
-   * FIXME: @wangshijun create audit log for this
+   *
+   *
    * @param {import('@abtnode/client').RequestRestoreFromSpacesInput} input
    * @memberof BlockletManager
    */
-  // eslint-disable-next-line no-unused-vars
-  async restoreFromSpaces(input, context) {
-    // FIXME: @yejianchao did should be renamed to appDid
-    this.emit(BlockletEvents.restoreProgress, { did: input.appDid, message: 'Start restore...' });
-
-    const userDid = context.user.did;
-    const { referrer } = context;
+  async restoreFromSpaces(input) {
+    const spacesRestore = new SpacesRestore(input);
+    await spacesRestore.restore();
 
-    const spacesRestore = new SpacesRestore({ ...input, event: this, userDid, referrer });
-    const params = await spacesRestore.restore();
-
-    this.emit(BlockletEvents.restoreProgress, { did: input.appDid, message: 'Installing blocklet...' });
+    // FIXME: 需要改成队列执行，本次失败，下次还需要重试，页面刷新后也能知道最新的状态
     await this._installFromBackup({
       url: `file://${spacesRestore.blockletRestoreDir}`,
+      blockletSecretKey: spacesRestore.blockletWallet.secretKey,
       moveDir: true,
-      ...merge(...params),
     });
-
-    this.emit(BlockletEvents.restoreProgress, { did: input.appDid, completed: true });
   }
 
   async restart({ did }, context) {
@@ -1040,9 +1003,8 @@ class BlockletManager extends BaseBlockletManager {
     return blocklets;
   }
 
-  // CAUTION: this method currently only support config by blocklet.meta.did
   // eslint-disable-next-line no-unused-vars
-  async config({ did, configs: newConfigs, skipHook, skipDidDocument }, context) {
+  async config({ did, configs: newConfigs, skipHook }, context) {
     if (!Array.isArray(newConfigs)) {
       throw new Error('configs list is not an array');
     }
@@ -1072,7 +1034,7 @@ class BlockletManager extends BaseBlockletManager {
           throw new Error(`Cannot set ${x.key} to child blocklet`);
         }
 
-        await validateAppConfig(x, states);
+        await validateAppConfig(x, rootDid, states);
       } else if (!BLOCKLET_CONFIGURABLE_KEY[x.key] && !isPreferenceKey(x)) {
         if (!(blocklet.meta.environments || []).some((y) => y.name === x.key)) {
           // forbid unknown format key
@@ -1095,26 +1057,14 @@ class BlockletManager extends BaseBlockletManager {
       });
     }
 
-    const willAppSkChange = isRotatingAppSk(newConfigs, blocklet.configs, blocklet.externalSk);
-    const willAppDidChange = isRotatingAppDid(newConfigs, blocklet.configs, blocklet.externalSk);
-
     // update db
     await states.blockletExtras.setConfigs(dids, newConfigs);
 
-    if (willAppSkChange) {
-      const info = await states.node.read();
-      const { wallet } = getBlockletInfo(blocklet, info.sk);
-      const migratedFrom = blocklet.migratedFrom || [];
-      await states.blocklet.updateBlocklet(rootDid, {
-        migratedFrom: [
-          ...migratedFrom,
-          { appSk: wallet.secretKey, appDid: wallet.address, at: new Date().toISOString() },
-        ],
-      });
-    }
+    const isSkOrWalletTypeChanged = newConfigs.find((item) =>
+      [BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SK, BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_WALLET_TYPE].includes(item.key)
+    );
 
-    // FIXME: @zhenqiang best way to handle the did document: allow all appDids to resolve
-    if (willAppDidChange && !skipDidDocument) {
+    if (isSkOrWalletTypeChanged) {
       await this._updateDidDocument(blocklet);
     }
 
@@ -1248,7 +1198,7 @@ class BlockletManager extends BaseBlockletManager {
   }
 
   async updateComponentMountPoint({ did, rootDid: inputRootDid, mountPoint: tmpMountPoint }, context) {
-    const mountPoint = await updateMountPointSchema.validateAsync(tmpMountPoint);
+    const mountPoint = await mountPointSchema.validateAsync(tmpMountPoint);
 
     const blocklet = await states.blocklet.getBlocklet(inputRootDid);
 
@@ -1729,13 +1679,13 @@ class BlockletManager extends BaseBlockletManager {
    *  /blocklet.json
    *  /blocklet_extras.json
    * @see Blocklet 端到端备份方案的设计与实现（一期） https://team.arcblock.io/comment/discussions/e62084d5-fafa-489e-91d5-defcd6e93223
-   * @param {{ url: string, appSk: string, moveDir: boolean}} [{ url }={}]
+   * @param {{ url: string, blockletSecretKey: string, moveDir: boolean}} [{ url }={}]
    * @param {Record<string, string>} [context={}]
    * @return {Promise<any>}
    * @memberof BlockletManager
    */
-  async _installFromBackup({ url, appSk, moveDir } = {}, context = {}) {
-    return installFromBackup({ url, appSk, moveDir, context, manager: this, states });
+  async _installFromBackup({ url, blockletSecretKey, moveDir } = {}, context = {}) {
+    return installFromBackup({ url, blockletSecretKey, moveDir, context, manager: this, states });
   }
 
   async ensureBlocklet(did, opts = {}) {
@@ -2117,14 +2067,6 @@ class BlockletManager extends BaseBlockletManager {
     // put BLOCKLET_APP_ID at root level for indexing
     blocklet.appDid = appSystemEnvironments.BLOCKLET_APP_ID;
 
-    if (!blocklet.migratedFrom) {
-      blocklet.migratedFrom = [];
-    }
-    // This can only be set once, can be used for indexing, will not change ever
-    if (!blocklet.appPid) {
-      blocklet.appPid = appSystemEnvironments.BLOCKLET_APP_PID;
-    }
-
     // update state to db
     return states.blocklet.updateBlocklet(did, blocklet);
   }
@@ -2142,18 +2084,17 @@ class BlockletManager extends BaseBlockletManager {
    *
    * @param {{
    *  did: string;
+   *  registry: string;
    *  sync: boolean;
    *  delay: number;
    *  controller: Controller;
-   *  appSk: string;
-   *  storeUrl: string;
    * }} params
    * @param {*} context
    * @return {*}
    * @memberof BlockletManager
    */
   async _installFromStore(params, context) {
-    const { did, storeUrl, sync, delay, controller, appSk } = params;
+    const { did, storeUrl, sync, delay, controller } = params;
 
     logger.debug('start install blocklet', { did });
     if (!isValidDid(did)) {
@@ -2197,7 +2138,6 @@ class BlockletManager extends BaseBlockletManager {
       sync,
       delay,
       controller,
-      appSk,
       context,
     });
   }
@@ -2214,14 +2154,13 @@ class BlockletManager extends BaseBlockletManager {
    *  sync: boolean;
    *  delay: number;
    *  controller: Controller;
-   *  appSk: string;
    * }} params
    * @param {{}} context
    * @return {*}
    * @memberof BlockletManager
    */
   async _installFromUrl(params, context) {
-    const { url, sync, delay, controller, appSk } = params;
+    const { url, sync, delay, controller } = params;
 
     logger.debug('start install blocklet', { url });
 
@@ -2235,18 +2174,13 @@ class BlockletManager extends BaseBlockletManager {
 
     // install from store if url is a store url
     const { inStore, registryUrl, blockletDid: bundleDid } = await StoreUtil.parseSourceUrl(url, controller);
-
-    const nodeInfo = await states.node.read();
-
-    await validateStore(nodeInfo, registryUrl);
-
     if (inStore) {
       const exist = await states.blocklet.getBlocklet(blockletDid);
       if (exist) {
         return this.upgrade({ did: blockletDid, storeUrl: registryUrl, sync, delay }, context);
       }
 
-      return this._installFromStore({ did: bundleDid, storeUrl: registryUrl, controller, sync, delay, appSk }, context);
+      return this._installFromStore({ did: bundleDid, storeUrl: registryUrl, controller, sync, delay }, context);
     }
 
     const meta = ensureMeta(bundleMeta, { name: blockletName, did: blockletDid });
@@ -2272,7 +2206,6 @@ class BlockletManager extends BaseBlockletManager {
       sync,
       delay,
       controller,
-      appSk,
       context,
     });
   }
@@ -2377,7 +2310,7 @@ class BlockletManager extends BaseBlockletManager {
     );
   }
 
-  async _installFromCreate({ title, description, appSk }, context = {}) {
+  async _installFromCreate({ title, description }, context = {}) {
     logger.debug('create blocklet', { title, description });
 
     await joi.string().label('title').max(20).required().validateAsync(title);
@@ -2405,9 +2338,11 @@ class BlockletManager extends BaseBlockletManager {
     };
     const meta = validateMeta(rawMeta);
 
-    await states.blocklet.addBlocklet({ meta, source: BlockletSource.custom, externalSk: !!appSk });
+    await states.blocklet.addBlocklet({
+      meta,
+      source: BlockletSource.custom,
+    });
     await this._setConfigsFromMeta(did);
-    await this._setAppSk(did, appSk);
 
     // check duplicate appSk
     await checkDuplicateAppSk({ did, states });
@@ -2447,7 +2382,7 @@ class BlockletManager extends BaseBlockletManager {
     return { cwd, tarFile };
   }
 
-  async _installFromUpload({ file, did, diffVersion, deleteSet, appSk }, context) {
+  async _installFromUpload({ file, did, diffVersion, deleteSet, context }) {
     logger.info('install blocklet', { from: 'upload file' });
     const { tarFile } = await this._downloadFromUpload(file);
 
@@ -2539,14 +2474,12 @@ class BlockletManager extends BaseBlockletManager {
       source: BlockletSource.upload,
       deployedFrom: `Upload by ${context.user.fullName}`,
       children,
-      externalSk: !!appSk,
     });
 
     const action = 'install';
     const oldState = { extraState: oldExtraState };
     try {
       await this._setConfigsFromMeta(meta.did);
-      await this._setAppSk(appSk);
       await validateBlocklet(blocklet);
 
       // check duplicate appSk
@@ -2843,7 +2776,6 @@ class BlockletManager extends BaseBlockletManager {
    *  meta: {}; // blocklet meta
    *  source: number; // example: BlockletSource.registry,
    *  deployedFrom: string;
-   *  appSk: string;
    *  context: {}
    *  sync: boolean = false;
    *  delay: number;
@@ -2853,15 +2785,10 @@ class BlockletManager extends BaseBlockletManager {
    * @memberof BlockletManager
    */
   async _install(params) {
-    const { meta, source, deployedFrom, context, sync, delay, controller, appSk } = params;
+    const { meta, source, deployedFrom, context, sync, delay, controller } = params;
 
     validateBlockletMeta(meta, { ensureDist: true });
 
-    const info = await states.node.read();
-    if (info.mode === NODE_MODES.SERVERLESS) {
-      validateInServerless({ blockletMeta: meta });
-    }
-
     const { name, did, version } = meta;
 
     const oldExtraState = await states.blockletExtras.findOne({ did: meta.did });
@@ -2874,7 +2801,6 @@ class BlockletManager extends BaseBlockletManager {
         source,
         deployedFrom,
         children,
-        externalSk: !!appSk,
       });
 
       await validateBlocklet(blocklet);
@@ -2882,7 +2808,6 @@ class BlockletManager extends BaseBlockletManager {
       await states.blockletExtras.addMeta({ did, meta: { did, name }, controller });
 
       await this._setConfigsFromMeta(did);
-      await this._setAppSk(did, appSk);
 
       // check duplicate appSk
       await checkDuplicateAppSk({ did, states });
@@ -3480,31 +3405,12 @@ class BlockletManager extends BaseBlockletManager {
     }
   }
 
-  async _setAppSk(did, appSk, context) {
-    if (process.env.NODE_ENV === 'production' && !appSk) {
-      throw new Error(`appSk for blocklet ${did} is required`);
-    }
-
-    if (appSk) {
-      await this.config(
-        {
-          did,
-          configs: [{ key: 'BLOCKLET_APP_SK', value: appSk, secure: true }],
-          skipHook: true,
-          skipDidDocument: true,
-        },
-        context
-      );
-    }
-  }
-
   async _findNextCustomBlockletName(leftTimes = 10) {
     if (leftTimes <= 0) {
       throw new Error('Generate custom blocklet did too many times');
     }
     const number = await states.node.increaseCustomBlockletNumber();
     const name = `custom-${number}`;
-    // MEMO: 空壳 APP可以保留原有的 did 生成逻辑
     const did = toBlockletDid(name);
     const blocklet = await states.blocklet.getBlocklet(did);
     if (blocklet) {

package/lib/blocklet/manager/helper/install-from-backup.js

@@ -19,7 +19,7 @@ const { validateBlocklet, checkDuplicateAppSk, getAppDirs } = require('../../../
  * }} param0
  * @returns
  */
-module.exports = async ({ url, appSk, moveDir, context = {}, states, manager } = {}) => {
+module.exports = async ({ url, blockletSecretKey, moveDir, context = {}, states, manager } = {}) => {
   // TODO: support more url schema feature (http, did-spaces)
   if (!url.startsWith('file://')) {
     throw new Error('url must starts with file://');
@@ -71,17 +71,17 @@ module.exports = async ({ url, appSk, moveDir, context = {}, states, manager } =
     throw new Error('blocklet is already exist');
   }
 
-  if (appSk) {
+  if (blockletSecretKey) {
     extra.configs = extra.configs || [];
     const skConfig = extra.configs.find((x) => x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SK);
     if (skConfig) {
-      skConfig.value = appSk;
+      skConfig.value = blockletSecretKey;
       skConfig.secure = true;
       skConfig.shared = false;
     } else {
       extra.configs.push({
         key: BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SK,
-        value: appSk,
+        value: blockletSecretKey,
         secure: true,
         shared: false,
       });

package/lib/blocklet/storage/backup/blocklet-extras.js

@@ -1,9 +1,8 @@
 const { removeSync, outputJsonSync, readFileSync } = require('fs-extra');
 const { isEmpty, cloneDeep } = require('lodash');
 const { join } = require('path');
-const { Hasher } = require('@ocap/mcrypto');
-const { toBuffer } = require('@ocap/util');
 const security = require('@abtnode/util/lib/security');
+const { BLOCKLET_CONFIGURABLE_KEY } = require('@blocklet/constant');
 const states = require('../../../states');
 const { BaseBackup } = require('./base');
 
@@ -33,7 +32,7 @@ class BlockletExtrasBackup extends BaseBackup {
       throw new Error('blockletExtra cannot be empty');
     }
 
-    return this.cleanData(blockletExtra);
+    return this.cleanDate(blockletExtra);
   }
 
   /**
@@ -43,7 +42,7 @@ class BlockletExtrasBackup extends BaseBackup {
    * @return {Promise<void>}
    * @memberof BlockletExtrasBackup
    */
-  async cleanData(blockletExtraInput) {
+  async cleanDate(blockletExtraInput) {
     const blockletExtra = cloneDeep(blockletExtraInput);
 
     const queue = [blockletExtra];
@@ -58,7 +57,7 @@ class BlockletExtrasBackup extends BaseBackup {
       }
 
       // 加解密
-      this.encryptBlockletConfigs(currentBlockletExtra.configs);
+      this.useBlockletEncryptConfigs(currentBlockletExtra.configs);
 
       if (currentBlockletExtra?.children) {
         queue.push(...currentBlockletExtra.children);
@@ -75,28 +74,33 @@ class BlockletExtrasBackup extends BaseBackup {
    * @return {void}
    * @memberof BlockletExtrasBackup
    */
-  encryptBlockletConfigs(configs) {
+  useBlockletEncryptConfigs(configs) {
     if (isEmpty(configs)) {
       return;
     }
 
-    const { secretKey, address } = this.blockletWallet;
-
     // 准备加解密所需的参数
     // @see: https://github.com/ArcBlock/blocklet-server/blob/f561ba7290285f2e23dccb6d5323eb4d43c3cc3e/core/state/lib/index.js#L59
-    const dk = readFileSync(join(this.serverDataDir, '.sock'));
-    const ek = toBuffer(Hasher.SHA3.hash256(Buffer.concat([secretKey, address].map(toBuffer))));
+    const dek = readFileSync(join(this.serverDataDir, '.sock'));
 
     for (const config of configs) {
-      if (config.secure) {
+      // 置空 blocklet 的密钥，但是保留其他属性，这很重要
+      if (config.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SK) {
+        config.value = '';
+      } else if (config.secure) {
         // secure 为 true 的配置才需要被加密保存上次到 did spaces
+
         const encryptByServer = config.value;
         // 先从 blocklet server 解密
         // @see https://github.com/ArcBlock/blocklet-server/blob/f40338168a66893f325464cea79ae54c43f623b1/core/state/lib/blocklet/extras.js#L139
-        const decrypted = security.decrypt(encryptByServer, this.blocklet.meta.did, dk);
-        // 再用 blocklet 信息加密，然后才可以上传到 spaces
-        const encrypted = security.encrypt(decrypted, address, ek);
-        config.value = encrypted;
+        const decryptByServer = security.decrypt(encryptByServer, this.blocklet.meta.did, dek);
+        // 再用 blocklet secret 加密，然后才可以上传到 spaces
+        const encryptByBlocklet = security.encrypt(
+          decryptByServer,
+          this.blockletWallet.address,
+          Buffer.from(this.blockletWallet.secretKey)
+        );
+        config.value = encryptByBlocklet;
       }
     }
   }