@abtnode/core 1.8.68-beta-500af7e5 → 1.8.69-beta-e0666d0d

package/lib/blocklet/manager/disk.js

@@ -615,23 +615,23 @@ class BlockletManager extends BaseBlockletManager {
    * @memberof BlockletManager
    */
   // eslint-disable-next-line no-unused-vars
-  async backupToSpaces({ did }, context) {
+  async backupToSpaces({ appPid }, context) {
     // add to queue
     // const ticket = this.backupQueue.push({
     //   entity: 'blocklet',
     //   action: 'backup-to-space',
-    //   did,
+    //   appPid,
     //   context,
     // });
 
     // ticket.on('failed', async (err) => {
-    //   logger.error('backup failed', { entity: 'blocklet', did, error: err });
-    //   this.emit('blocklet.backup.failed', { did, err });
-    //   this._createNotification(did, {
+    //   logger.error('backup failed', { entity: 'blocklet', appPid, error: err });
+    //   this.emit('blocklet.backup.failed', { appPid, err });
+    //   this._createNotification(appPid, {
     //     title: 'Blocklet Backup Failed',
     //     description: `Blocklet backup failed with error: ${err.message || 'queue exception'}`,
     //     entityType: 'blocklet',
-    //     entityId: did,
+    //     entityId: appPid,
     //     severity: 'error',
     //   });
     // });
@@ -639,11 +639,10 @@ class BlockletManager extends BaseBlockletManager {
     const userDid = context.user.did;
     const { referrer } = context;
 
-    // FIXME: @yejianchao did should be renamed to appDid
-    const spacesBackup = new SpacesBackup({ did, event: this, userDid, referrer });
-    this.emit(BlockletEvents.backupProgress, { did, message: 'Start backup...', progress: 10 });
+    const spacesBackup = new SpacesBackup({ appPid, event: this, userDid, referrer });
+    this.emit(BlockletEvents.backupProgress, { appPid, message: 'Start backup...', progress: 10, completed: false });
     await spacesBackup.backup();
-    this.emit(BlockletEvents.backupProgress, { did, completed: true, progress: 100 });
+    this.emit(BlockletEvents.backupProgress, { appPid, completed: true, progress: 100 });
   }
 
   /**
@@ -654,8 +653,7 @@ class BlockletManager extends BaseBlockletManager {
    */
   // eslint-disable-next-line no-unused-vars
   async restoreFromSpaces(input, context) {
-    // FIXME: @yejianchao did should be renamed to appDid
-    this.emit(BlockletEvents.restoreProgress, { did: input.appDid, message: 'Start restore...' });
+    this.emit(BlockletEvents.restoreProgress, { appDid: input.appDid, message: 'Start restore...', completed: false });
 
     const userDid = context.user.did;
     const { referrer } = context;
@@ -663,14 +661,14 @@ class BlockletManager extends BaseBlockletManager {
     const spacesRestore = new SpacesRestore({ ...input, event: this, userDid, referrer });
     const params = await spacesRestore.restore();
 
-    this.emit(BlockletEvents.restoreProgress, { did: input.appDid, message: 'Installing blocklet...' });
+    this.emit(BlockletEvents.restoreProgress, { appDid: input.appDid, message: 'Installing blocklet...' });
     await this._installFromBackup({
-      url: `file://${spacesRestore.blockletRestoreDir}`,
+      url: `file://${spacesRestore.restoreDir}`,
       moveDir: true,
       ...merge(...params),
     });
 
-    this.emit(BlockletEvents.restoreProgress, { did: input.appDid, completed: true });
+    this.emit(BlockletEvents.restoreProgress, { appDid: input.appDid, completed: true });
   }
 
   async restart({ did }, context) {
@@ -1104,7 +1102,7 @@ class BlockletManager extends BaseBlockletManager {
     if (willAppSkChange) {
       const info = await states.node.read();
       const { wallet } = getBlockletInfo(blocklet, info.sk);
-      const migratedFrom = blocklet.migratedFrom || [];
+      const migratedFrom = Array.isArray(blocklet.migratedFrom) ? blocklet.migratedFrom : [];
       await states.blocklet.updateBlocklet(rootDid, {
         migratedFrom: [
           ...migratedFrom,
@@ -1113,6 +1111,11 @@ class BlockletManager extends BaseBlockletManager {
       });
     }
 
+    // Reload nginx to make sure did-space can embed content from this app
+    if (newConfigs.find((x) => x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SPACE_ENDPOINT)?.value) {
+      this.emit(BlockletEvents.spaceConnected, blocklet);
+    }
+
     // FIXME: @zhenqiang best way to handle the did document: allow all appDids to resolve
     if (willAppDidChange && !skipDidDocument) {
       await this._updateDidDocument(blocklet);
@@ -2117,7 +2120,7 @@ class BlockletManager extends BaseBlockletManager {
     // put BLOCKLET_APP_ID at root level for indexing
     blocklet.appDid = appSystemEnvironments.BLOCKLET_APP_ID;
 
-    if (!blocklet.migratedFrom) {
+    if (!Array.isArray(blocklet.migratedFrom)) {
       blocklet.migratedFrom = [];
     }
     // This can only be set once, can be used for indexing, will not change ever

package/lib/blocklet/manager/helper/install-from-backup.js

@@ -2,7 +2,7 @@ const fs = require('fs-extra');
 const path = require('path');
 const omit = require('lodash/omit');
 
-const { forEachBlockletSync } = require('@blocklet/meta/lib/util');
+const { forEachBlockletSync, getBlockletAppIdList } = require('@blocklet/meta/lib/util');
 const getBlockletInfo = require('@blocklet/meta/lib/info');
 
 const { BLOCKLET_CONFIGURABLE_KEY } = require('@blocklet/constant');
@@ -90,8 +90,9 @@ module.exports = async ({ url, appSk, moveDir, context = {}, states, manager } =
 
   // validate appDid
   const nodeInfo = await states.node.read();
+  const appIdList = getBlockletAppIdList(state);
   const { wallet } = getBlockletInfo({ meta: state.meta, configs: extra.configs, environments: [] }, nodeInfo.sk);
-  if (state.appDid !== wallet.address) {
+  if (appIdList.includes(wallet.address) === false) {
     throw new Error('blocklet appDid is different from the previous one');
   }
   await checkDuplicateAppSk({ sk: wallet.secretKey, states });

package/lib/blocklet/storage/backup/audit-log.js

@@ -19,8 +19,8 @@ class AuditLogBackup extends BaseBackup {
       scope: this.blocklet.meta.did,
     });
 
-    removeSync(join(this.blockletBackupDir, this.filename));
-    outputJsonSync(join(this.blockletBackupDir, this.filename), auditLogs);
+    removeSync(join(this.backupDir, this.filename));
+    outputJsonSync(join(this.backupDir, this.filename), auditLogs);
   }
 }
 

package/lib/blocklet/storage/backup/base.js

@@ -1,6 +1,5 @@
 class BaseBackup {
   /**
-   *
    * @type {import('./spaces').SpaceBackupInput}
    * @memberof BaseBackup
    */
@@ -18,15 +17,15 @@ class BaseBackup {
    * @type {string}
    * @memberof BaseBackup
    */
-  blockletBackupDir;
+  backupDir;
 
   /**
    *
    * @description spaces 的 endpoint
-   * @type {import('@ocap/wallet').WalletObject}
+   * @type {import('./spaces').SecurityContext}
    * @memberof BaseBackup
    */
-  blockletWallet;
+  securityContext;
 
   /**
    *
@@ -34,7 +33,7 @@ class BaseBackup {
    * @type {string}
    * @memberof BaseBackup
    */
-  serverDataDir;
+  serverDir;
 
   constructor(input) {
     this.input = input;
@@ -48,9 +47,9 @@ class BaseBackup {
    */
   ensureParams(spacesBackup) {
     this.blocklet = spacesBackup.blocklet;
-    this.serverDataDir = spacesBackup.serverDataDir;
-    this.blockletBackupDir = spacesBackup.blockletBackupDir;
-    this.blockletWallet = spacesBackup.blockletWallet;
+    this.serverDir = spacesBackup.serverDir;
+    this.backupDir = spacesBackup.backupDir;
+    this.securityContext = spacesBackup.securityContext;
   }
 
   async export() {

package/lib/blocklet/storage/backup/blocklet-extras.js

@@ -1,9 +1,8 @@
-const { removeSync, outputJsonSync, readFileSync } = require('fs-extra');
+const { removeSync, readFileSync, outputJsonSync } = require('fs-extra');
 const { isEmpty, cloneDeep } = require('lodash');
 const { join } = require('path');
-const { Hasher } = require('@ocap/mcrypto');
-const { toBuffer } = require('@ocap/util');
 const security = require('@abtnode/util/lib/security');
+
 const states = require('../../../states');
 const { BaseBackup } = require('./base');
 
@@ -12,8 +11,8 @@ class BlockletExtrasBackup extends BaseBackup {
 
   async export() {
     const blockletExtra = await this.getBlockletExtra();
-    removeSync(join(this.blockletBackupDir, this.filename));
-    outputJsonSync(join(this.blockletBackupDir, this.filename), blockletExtra);
+    removeSync(join(this.backupDir, this.filename));
+    outputJsonSync(join(this.backupDir, this.filename), blockletExtra);
   }
 
   /**
@@ -39,29 +38,29 @@ class BlockletExtrasBackup extends BaseBackup {
   /**
    *
    * @description 清理数据并加密
-   * @param {import('@abtnode/client').BlockletState} blockletExtraInput
-   * @return {Promise<void>}
+   * @param {import('@abtnode/client').BlockletState} raw
+   * @return {Promise<any>}
    * @memberof BlockletExtrasBackup
    */
-  async cleanData(blockletExtraInput) {
-    const blockletExtra = cloneDeep(blockletExtraInput);
+  async cleanData(raw) {
+    const blockletExtra = cloneDeep(raw);
 
     const queue = [blockletExtra];
     while (queue.length) {
-      const currentBlockletExtra = queue.pop();
+      const current = queue.pop();
 
       // 删除父 blocklet 的某些数据
-      if (currentBlockletExtra._id) {
-        delete currentBlockletExtra._id;
-        delete currentBlockletExtra.createdAt;
-        delete currentBlockletExtra.updatedAt;
+      if (current._id) {
+        delete current._id;
+        delete current.createdAt;
+        delete current.updatedAt;
       }
 
       // 加解密
-      this.encryptBlockletConfigs(currentBlockletExtra.configs);
+      this.encrypt(current.configs);
 
-      if (currentBlockletExtra?.children) {
-        queue.push(...currentBlockletExtra.children);
+      if (current?.children) {
+        queue.push(...current.children);
       }
     }
 
@@ -75,28 +74,16 @@ class BlockletExtrasBackup extends BaseBackup {
    * @return {void}
    * @memberof BlockletExtrasBackup
    */
-  encryptBlockletConfigs(configs) {
+  encrypt(configs) {
     if (isEmpty(configs)) {
       return;
     }
 
-    const { secretKey, address } = this.blockletWallet;
-
-    // 准备加解密所需的参数
-    // @see: https://github.com/ArcBlock/blocklet-server/blob/f561ba7290285f2e23dccb6d5323eb4d43c3cc3e/core/state/lib/index.js#L59
-    const dk = readFileSync(join(this.serverDataDir, '.sock'));
-    const ek = toBuffer(Hasher.SHA3.hash256(Buffer.concat([secretKey, address].map(toBuffer))));
-
+    const dk = readFileSync(join(this.serverDir, '.sock'));
     for (const config of configs) {
       if (config.secure) {
-        // secure 为 true 的配置才需要被加密保存上次到 did spaces
-        const encryptByServer = config.value;
-        // 先从 blocklet server 解密
-        // @see https://github.com/ArcBlock/blocklet-server/blob/f40338168a66893f325464cea79ae54c43f623b1/core/state/lib/blocklet/extras.js#L139
-        const decrypted = security.decrypt(encryptByServer, this.blocklet.meta.did, dk);
-        // 再用 blocklet 信息加密，然后才可以上传到 spaces
-        const encrypted = security.encrypt(decrypted, address, ek);
-        config.value = encrypted;
+        const decrypted = security.decrypt(config.value, this.blocklet.meta.did, dk);
+        config.value = this.securityContext.encrypt(decrypted);
       }
     }
   }

package/lib/blocklet/storage/backup/blocklet.js

@@ -8,45 +8,62 @@ class BlockletBackup extends BaseBackup {
 
   async export() {
     const blocklet = await this.cleanData();
-    removeSync(join(this.blockletBackupDir, this.filename));
-    outputJsonSync(join(this.blockletBackupDir, this.filename), blocklet);
+    removeSync(join(this.backupDir, this.filename));
+    outputJsonSync(join(this.backupDir, this.filename), blocklet);
   }
 
   /**
    * @description 清理数据
    * @see blocklet.db 中需要删除哪些字段呢？ https://github.com/ArcBlock/blocklet-server/issues/6120#issuecomment-1383798348
-   * @return {Promise<void>}
+   * @return {Promise<import('@abtnode/client').BlockletState>}
    * @memberof BlockletBackup
    */
   async cleanData() {
-    const originalBlocklet = cloneDeep(this.blocklet);
+    const clone = cloneDeep(this.blocklet);
 
     /** @type {import('@abtnode/client').ComponentState[]} */
-    const queue = [originalBlocklet];
+    const queue = [clone];
 
     // 广度优先遍历
     while (queue.length) {
-      const currentBlocklet = queue.pop();
+      const current = queue.pop();
 
       // 父组件才需要删除的属性
-      if (currentBlocklet._id) {
-        delete currentBlocklet._id;
-        delete currentBlocklet.createdAt;
-        delete currentBlocklet.startedAt;
-        delete currentBlocklet.installedAt;
+      if (current._id) {
+        delete current._id;
+        delete current.createdAt;
+        delete current.startedAt;
+        delete current.installedAt;
       }
 
       // 子组件和父组件都需要删除的属性
-      delete currentBlocklet.status;
-      delete currentBlocklet.ports;
-      delete currentBlocklet.environments;
+      delete current.status;
+      delete current.ports;
+      delete current.environments;
 
-      if (currentBlocklet.children) {
-        queue.push(...currentBlocklet.children);
+      if (current.children) {
+        queue.push(...current.children);
       }
     }
 
-    return originalBlocklet;
+    return this.encrypt(clone);
+  }
+
+  /**
+   *
+   * @description 清理数据并加密
+   * @param {import('@abtnode/client').BlockletState} info
+   * @memberof BlockletExtrasBackup
+   */
+  encrypt(info) {
+    if (Array.isArray(info.migratedFrom)) {
+      info.migratedFrom = info.migratedFrom.map((x) => {
+        x.appSk = this.securityContext.encrypt(x.appSk);
+        return x;
+      });
+    }
+
+    return info;
   }
 }
 

package/lib/blocklet/storage/backup/blocklets.js

@@ -12,7 +12,7 @@ class BlockletsBackup extends BaseBackup {
    */
   async export() {
     const blockletMetas = this.getBlockletMetas(this.blocklet);
-    const serverBlockletsDir = join(this.serverDataDir, 'blocklets');
+    const serverBlockletsDir = join(this.serverDir, 'blocklets');
 
     const blockletMetasFromLocal = blockletMetas.filter(
       (b) => !validUrl.isHttpUri(b.tarball) && !validUrl.isHttpsUri(b.tarball)
@@ -21,7 +21,7 @@ class BlockletsBackup extends BaseBackup {
     const dirs = [];
     for (const blockletMeta of blockletMetasFromLocal) {
       const sourceDir = join(serverBlockletsDir, blockletMeta.name, blockletMeta.version);
-      const zipPath = join(this.blockletBackupDir, 'blocklets', blockletMeta.name, `${blockletMeta.version}.zip`);
+      const zipPath = join(this.backupDir, 'blocklets', blockletMeta.name, `${blockletMeta.version}.zip`);
       dirs.push({ sourceDir, zipPath });
     }
 

package/lib/blocklet/storage/backup/data.js

@@ -9,8 +9,8 @@ class DataBackup extends BaseBackup {
    * @memberof BlockletsBackup
    */
   async export() {
-    const blockletDataDir = join(this.serverDataDir, 'data', this.blocklet.meta.name);
-    const blockletBackupDataDir = join(this.blockletBackupDir, 'data');
+    const blockletDataDir = join(this.serverDir, 'data', this.blocklet.meta.name);
+    const blockletBackupDataDir = join(this.backupDir, 'data');
 
     await copy(blockletDataDir, blockletBackupDataDir, { overwrite: true });
   }

package/lib/blocklet/storage/backup/logs.js

@@ -5,10 +5,10 @@ const { BaseBackup } = require('./base');
 // note: 可以不需要备份
 class LogsBackup extends BaseBackup {
   async export() {
-    const sourceLogsDir = join(this.serverDataDir, 'logs', this.blocklet.meta.name);
+    const sourceLogsDir = join(this.serverDir, 'logs', this.blocklet.meta.name);
     ensureDirSync(sourceLogsDir);
 
-    const targetLogsDir = join(this.blockletBackupDir, 'logs');
+    const targetLogsDir = join(this.backupDir, 'logs');
 
     await copy(sourceLogsDir, targetLogsDir, {
       overwrite: true,

package/lib/blocklet/storage/backup/routing-rule.js

@@ -11,8 +11,8 @@ class RoutingRuleBackup extends BaseBackup {
       domain: `${this.blocklet.meta.did}.blocklet-domain-group`,
     });
 
-    removeSync(join(this.blockletBackupDir, this.filename));
-    outputJsonSync(join(this.blockletBackupDir, this.filename), routingRule);
+    removeSync(join(this.backupDir, this.filename));
+    outputJsonSync(join(this.backupDir, this.filename), routingRule);
   }
 }
 

package/lib/blocklet/storage/backup/spaces.js

@@ -1,19 +1,31 @@
 /**
  * @typedef {{
- *  did: string
+ *  appPid: string
  *  event: import('events').EventEmitter,
  *  userDid: string,
  *  referrer: string,
  * }} SpaceBackupInput
+ *
+ * @typedef {{
+ *  signer: import('@ocap/wallet').WalletObject
+ *  encrypt: (v: string) => string,
+ *  decrypt: (v: string) => string,
+ *  delegation: string,
+ * }} SecurityContext
  */
 
 const { isValid } = require('@arcblock/did');
 const { BLOCKLET_CONFIGURABLE_KEY, BlockletEvents } = require('@blocklet/constant');
-const { getBlockletInfo } = require('@blocklet/meta');
 const { SpaceClient, BackupBlockletCommand } = require('@did-space/client');
 const { ensureDirSync } = require('fs-extra');
 const { isEmpty } = require('lodash');
 const { join, basename } = require('path');
+const { signV2 } = require('@arcblock/jwt');
+const { Hasher } = require('@ocap/mcrypto');
+const { toBuffer } = require('@ocap/util');
+const { getAppName, getAppDescription } = require('@blocklet/meta/lib/util');
+const getBlockletInfo = require('@blocklet/meta/lib/info');
+const security = require('@abtnode/util/lib/security');
 
 const logger = require('@abtnode/logger')('@abtnode/core:storage:backup');
 
@@ -45,7 +57,7 @@ class SpacesBackup {
    * @type {string}
    * @memberof SpacesBackup
    */
-  blockletBackupDir;
+  backupDir;
 
   /**
    *
@@ -53,7 +65,7 @@ class SpacesBackup {
    * @type {string}
    * @memberof SpacesBackup
    */
-  serverDataDir;
+  serverDir;
 
   /**
    *
@@ -61,15 +73,15 @@ class SpacesBackup {
    * @type {string}
    * @memberof SpacesBackup
    */
-  spacesEndpoint;
+  spaceEndpoint;
 
   /**
    *
-   * @description spaces 的 endpoint
-   * @type {import('@ocap/wallet').WalletObject}
+   * @description spaces 安全相关的上下文
+   * @type SecurityContext
    * @memberof SpacesBackup
    */
-  blockletWallet;
+  securityContext;
 
   storages;
 
@@ -97,8 +109,8 @@ class SpacesBackup {
    * @memberof SpacesBackup
    */
   verify(input) {
-    if (isEmpty(input?.did) || !isValid(input?.did)) {
-      throw new Error(`input.did(${input?.did}) is not a valid did`);
+    if (isEmpty(input?.appPid) || !isValid(input?.appPid)) {
+      throw new Error(`input.appPid(${input?.appPid}) is not a valid did`);
     }
   }
 
@@ -114,33 +126,31 @@ class SpacesBackup {
   }
 
   async initialize() {
-    this.blocklet = await states.blocklet.findOne({
-      appDid: this.input.did,
-    });
+    this.blocklet = await states.blocklet.getBlocklet(this.input.appPid);
     if (isEmpty(this.blocklet)) {
       throw new Error('blocklet cannot be empty');
     }
 
-    this.serverDataDir = process.env.ABT_NODE_DATA_DIR;
+    this.serverDir = process.env.ABT_NODE_DATA_DIR;
+    this.backupDir = join(this.serverDir, 'tmp/backup', this.blocklet.appPid);
+    ensureDirSync(this.backupDir);
 
-    this.blockletBackupDir = join(process.env.ABT_NODE_DATA_DIR, 'tmp/backup', this.blocklet.meta.did);
-    ensureDirSync(this.blockletBackupDir);
-
-    this.spacesEndpoint = this.blocklet.environments.find(
+    this.spaceEndpoint = this.blocklet.environments.find(
       (e) => e.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SPACE_ENDPOINT
     )?.value;
-    if (isEmpty(this.spacesEndpoint)) {
-      throw new Error('spacesEndpoint cannot be empty');
+    if (isEmpty(this.spaceEndpoint)) {
+      throw new Error('spaceEndpoint cannot be empty');
     }
 
-    this.blockletWallet = await this.getBlockletWallet();
+    this.securityContext = await this.getSecurityContext();
   }
 
   async export() {
     this.input.event.emit(BlockletEvents.backupProgress, {
-      did: this.input.did,
+      appPid: this.input.appPid,
       message: 'Preparing data for backup...',
       progress: 15,
+      completed: false,
     });
     await Promise.all(
       this.storages.map((storage) => {
@@ -149,23 +159,28 @@ class SpacesBackup {
       })
     );
     this.input.event.emit(BlockletEvents.backupProgress, {
-      did: this.input.did,
+      appPid: this.input.appPid,
       message: 'Data ready, start backup...',
       progress: 20,
+      completed: false,
     });
   }
 
   async syncToSpaces() {
-    const wallet = await this.getBlockletWallet();
     const spaceClient = new SpaceClient({
-      endpoint: this.spacesEndpoint,
-      wallet,
+      endpoint: this.spaceEndpoint,
+      wallet: this.securityContext.signer,
+      delegation: this.securityContext.delegation,
     });
 
     const { errorCount, message } = await spaceClient.send(
       new BackupBlockletCommand({
-        appDid: this.blocklet.appDid,
-        source: join(this.blockletBackupDir, '/'),
+        appDid: this.blocklet.appPid,
+        appName: getAppName(this.blocklet),
+        appDescription: getAppDescription(this.blocklet),
+        userDid: this.input.userDid,
+        referrer: this.input.referrer,
+        source: join(this.backupDir, '/'),
         debug: true,
         concurrency: 32,
         retryCount: 10,
@@ -174,30 +189,53 @@ class SpacesBackup {
           return object.name !== '.DS_Store';
         },
         onProgress: (data) => {
-          logger.info('backup progress', { appDid: this.input.did, data });
+          logger.info('backup progress', { appDid: this.input.appPid, data });
           const percent = (data.completed * 100) / data.total;
           this.input.event.emit(BlockletEvents.backupProgress, {
-            did: this.input.did,
+            appPid: this.input.appPid,
             message: `Uploaded file ${basename(data.key)} (${data.completed}/${data.total})`,
             // 0.8 是因为上传文件到 spaces 占进度的 80%，+ 20 是因为需要累加之前的进度
             progress: +Math.ceil(percent * 0.8).toFixed(2) + 20,
+            completed: false,
           });
         },
-        userDid: this.input.userDid,
-        referrer: this.input.referrer,
       })
     );
 
     if (errorCount !== 0) {
-      throw new Error(`Sync to spaces encountered ${errorCount} error: ${message}`);
+      throw new Error(`Sync to spaces encountered error: ${message}`);
     }
   }
 
-  async getBlockletWallet() {
-    const blockletInfo = await states.blocklet.getBlocklet(this.input.did);
+  async getSecurityContext() {
+    const blocklet = await states.blocklet.getBlocklet(this.input.appPid);
     const nodeInfo = await states.node.read();
-    const { wallet } = getBlockletInfo(blockletInfo, nodeInfo.sk);
-    return wallet;
+
+    const { wallet, permanentWallet } = getBlockletInfo(blocklet, nodeInfo.sk);
+
+    // FIXME: @wangshijun migrated apps can not be restored, need to change core/webapp/api/routes/auth/verify-app-ownership.js
+    const { secretKey, address } = wallet; // we encrypt using latest wallet, not the permanent wallet
+    const password = toBuffer(Hasher.SHA3.hash256(Buffer.concat([secretKey, address].map(toBuffer))));
+    const encrypt = (v) => security.encrypt(v, address, password);
+    const decrypt = (v) => security.decrypt(v, address, password);
+
+    const delegation =
+      permanentWallet.address !== wallet.address
+        ? signV2(permanentWallet.address, permanentWallet.secretKey, {
+            from: permanentWallet.address,
+            to: wallet.address,
+            userPk: permanentWallet.publicKey,
+            permissions: [{ role: 'DIDSpaceAgent', spaces: ['*'] }],
+            exp: Math.floor(new Date().getTime() / 1000) + 60 * 60,
+          })
+        : '';
+
+    return {
+      signer: wallet,
+      delegation,
+      encrypt,
+      decrypt,
+    };
   }
 }
 

package/lib/blocklet/storage/restore/base.js

@@ -11,7 +11,7 @@ class BaseRestore {
    * @type {string}
    * @memberof BaseRestore
    */
-  blockletRestoreDir;
+  restoreDir;
 
   /**
    *
@@ -19,7 +19,7 @@ class BaseRestore {
    * @type {string}
    * @memberof BaseRestore
    */
-  serverDataDir;
+  serverDir;
 
   constructor(input) {
     this.input = input;
@@ -32,11 +32,12 @@ class BaseRestore {
    * @memberof BaseRestore
    */
   ensureParams(spaces) {
-    this.blockletRestoreDir = spaces.blockletRestoreDir;
-    this.serverDataDir = spaces.serverDataDir;
+    this.restoreDir = spaces.restoreDir;
+    this.serverDir = spaces.serverDir;
   }
 
-  async import() {
+  // eslint-disable-next-line
+  async import(params) {
     throw new Error('not implemented');
   }
 
@@ -49,6 +50,16 @@ class BaseRestore {
   getInstallParams() {
     return {};
   }
+
+  /**
+   * Generate params for other restorers
+   *
+   * @return {object}
+   * @memberof BaseRestore
+   */
+  getImportParams() {
+    return {};
+  }
 }
 
 module.exports = {

package/lib/blocklet/storage/restore/blocklet-extras.js

@@ -1,5 +1,5 @@
 const { removeSync, outputJsonSync, readJSONSync } = require('fs-extra');
-const { cloneDeep, isArray } = require('lodash');
+const { cloneDeep, isEmpty } = require('lodash');
 const { join } = require('path');
 const security = require('@abtnode/util/lib/security');
 const { BLOCKLET_CONFIGURABLE_KEY } = require('@blocklet/constant');
@@ -8,77 +8,72 @@ const { BaseRestore } = require('./base');
 class BlockletExtrasRestore extends BaseRestore {
   filename = 'blocklet-extras.json';
 
-  async import() {
-    const blockletExtra = await this.getBlockletExtra();
-    removeSync(join(this.blockletRestoreDir, this.filename));
-    outputJsonSync(join(this.blockletRestoreDir, this.filename), blockletExtra);
+  async import(params) {
+    const extras = this.getExtras();
+    this.cleanExtras(extras, params);
+    removeSync(join(this.restoreDir, this.filename));
+    outputJsonSync(join(this.restoreDir, this.filename), extras);
   }
 
   /**
    *
    * @description
-   * @return {Promise<import('@abtnode/client').BlockletState>}
+   * @return {import('@abtnode/client').BlockletState}
    * @memberof BlockletExtrasRestore
    */
-  async getBlockletExtra() {
+  getExtras() {
     /**
      * @type {import('@abtnode/client').BlockletState}
      */
-    const blockletExtra = readJSONSync(join(this.blockletRestoreDir, this.filename));
-    return this.cleanData(blockletExtra);
+    return readJSONSync(join(this.restoreDir, this.filename));
   }
 
   /**
    *
    * @description 清理数据并加密
-   * @param {import('@abtnode/client').BlockletState} blockletExtraInput
+   * @param {import('@abtnode/client').BlockletState} raw
    * @memberof BlockletExtrasRestore
    */
-  async cleanData(blockletExtraInput) {
-    const blockletExtra = cloneDeep(blockletExtraInput);
+  async cleanExtras(raw, params) {
+    const blockletExtra = cloneDeep(raw);
 
     const queue = [blockletExtra];
     while (queue.length) {
-      const currentBlockletExtra = queue.pop();
+      const current = queue.pop();
 
       // 加解密
-      this.decrypt(currentBlockletExtra.configs);
+      this.decryptConfigs(current.configs, params);
 
-      if (currentBlockletExtra?.children) {
-        queue.push(...currentBlockletExtra.children);
+      if (current?.children) {
+        queue.push(...current.children);
       }
     }
-
-    return blockletExtra;
   }
 
   /**
    *
    * @description 解密加密的数据
    * @param {import('@abtnode/client').ConfigEntry[]} configs
+   * @param {object} params
    * @return {void}
    * @memberof BlockletExtrasRestore
    */
-  decrypt(configs) {
-    if (!configs || !isArray(configs)) {
+  decryptConfigs(configs, params) {
+    if (isEmpty(configs)) {
       return;
     }
 
-    const { appDid, password } = this.input;
+    const { password } = this.input;
     for (const config of configs) {
       if (config.secure) {
-        const encrypted = config.value;
-        const decrypted = security.decrypt(encrypted, appDid, Buffer.from(password));
-        config.value = decrypted;
+        config.value = security.decrypt(config.value, params.salt, password);
       }
     }
 
-    const config = configs.find((x) => x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SK);
-    if (!config) {
-      throw new Error(`Invalid blocklet backup file, no ${BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SK} found`);
+    const skConfig = configs.find((x) => x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SK);
+    if (skConfig) {
+      this.appSk = skConfig.value;
     }
-
-    this.appSk = config.value;
   }
 
   getInstallParams() {

package/lib/blocklet/storage/restore/blocklet.js

@@ -0,0 +1,49 @@
+const { removeSync, outputJsonSync, readJSONSync } = require('fs-extra');
+const { join } = require('path');
+const security = require('@abtnode/util/lib/security');
+const { BaseRestore } = require('./base');
+
+class BlockletRestore extends BaseRestore {
+  filename = 'blocklet.json';
+
+  async import(params) {
+    const blocklet = this.decrypt(this.getBlocklet(), params);
+    removeSync(join(this.restoreDir, this.filename));
+    outputJsonSync(join(this.restoreDir, this.filename), blocklet);
+  }
+
+  /**
+   *
+   * @description
+   * @return {import('@abtnode/client').BlockletState}
+   * @memberof BlockletRestore
+   */
+  getBlocklet() {
+    return readJSONSync(join(this.restoreDir, this.filename));
+  }
+
+  /**
+   *
+   * @description 解密加密的数据
+   * @param {import('@abtnode/client').BlockletState} blocklet
+   * @return {import('@abtnode/client').BlockletState}
+   * @memberof BlockletRestore
+   */
+  decrypt(blocklet, params) {
+    const { password } = this.input;
+    if (Array.isArray(blocklet.migratedFrom)) {
+      blocklet.migratedFrom = blocklet.migratedFrom.map((x) => {
+        x.appSk = security.decrypt(x.appSk, params.salt, password);
+        return x;
+      });
+    }
+
+    return blocklet;
+  }
+
+  getImportParams() {
+    return { salt: this.getBlocklet().appDid };
+  }
+}
+
+module.exports = { BlockletRestore };

package/lib/blocklet/storage/restore/blocklets.js

@@ -8,7 +8,7 @@ class BlockletsRestore extends BaseRestore {
   filename = 'blocklets';
 
   async import() {
-    const blockletsDir = join(this.blockletRestoreDir, this.filename);
+    const blockletsDir = join(this.restoreDir, this.filename);
 
     // blockletsDir 可以不存在, 因为还原的 blocklet 可能所有的组件都是来自 store 的
     if (!existsSync(blockletsDir)) {

package/lib/blocklet/storage/restore/logs.js

@@ -7,13 +7,13 @@ class LogsRestore extends BaseRestore {
   filename = 'logs.zip';
 
   async import() {
-    const blockletZipPath = join(this.blockletRestoreDir, this.filename);
+    const blockletZipPath = join(this.restoreDir, this.filename);
 
     if (!existsSync(blockletZipPath)) {
       throw new Error(`file not found: ${blockletZipPath}`);
     }
 
-    await zipToDir(blockletZipPath, join(this.blockletRestoreDir, 'logs'));
+    await zipToDir(blockletZipPath, join(this.restoreDir, 'logs'));
     removeSync(blockletZipPath);
   }
 }

package/lib/blocklet/storage/restore/spaces.js

@@ -12,6 +12,7 @@
  */
 
 const validUrl = require('valid-url');
+const merge = require('lodash/merge');
 const { BlockletEvents } = require('@blocklet/constant');
 const { SpaceClient, RestoreBlockletCommand } = require('@did-space/client');
 const { ensureDirSync, existsSync, rmdirSync } = require('fs-extra');
@@ -20,6 +21,7 @@ const { join, basename } = require('path');
 const logger = require('@abtnode/logger')('@abtnode/core:storage:restore');
 
 const { BlockletExtrasRestore } = require('./blocklet-extras');
+const { BlockletRestore } = require('./blocklet');
 const { BlockletsRestore } = require('./blocklets');
 
 class SpacesRestore {
@@ -35,7 +37,7 @@ class SpacesRestore {
    * @type {string}
    * @memberof SpacesRestore
    */
-  blockletRestoreDir;
+  restoreDir;
 
   /**
    *
@@ -43,7 +45,7 @@ class SpacesRestore {
    * @type {string}
    * @memberof SpacesRestore
    */
-  serverDataDir;
+  serverDir;
 
   storages;
 
@@ -55,7 +57,11 @@ class SpacesRestore {
   constructor(input) {
     this.verify(input);
     this.input = input;
-    this.storages = [new BlockletExtrasRestore(this.input), new BlockletsRestore(this.input)];
+    this.storages = [
+      new BlockletExtrasRestore(this.input),
+      new BlockletRestore(this.input),
+      new BlockletsRestore(this.input),
+    ];
   }
 
   /**
@@ -68,26 +74,28 @@ class SpacesRestore {
     if (!validUrl.isWebUri(input.endpoint)) {
       throw new Error(`endpoint(${input.endpoint}) must be a WebUri`);
     }
+    if (!input.endpoint.includes(input.appDid)) {
+      throw new Error(`endpoint and blocklet.appDid(${input.appDid}) do not match`);
+    }
   }
 
   async initialize() {
-    this.serverDataDir = process.env.ABT_NODE_DATA_DIR;
-
-    if (!this.input.endpoint.includes(this.input.appDid)) {
-      throw new Error(`endpoint and blocklet.appDid(${this.input.appDid}) do not match`);
+    this.serverDir = process.env.ABT_NODE_DATA_DIR;
+    this.restoreDir = join(this.serverDir, 'tmp/restore', this.input.appDid);
+    if (existsSync(this.restoreDir)) {
+      rmdirSync(this.restoreDir, { recursive: true });
     }
+    ensureDirSync(this.restoreDir);
 
-    this.blockletRestoreDir = join(process.env.ABT_NODE_DATA_DIR, 'tmp/restore', this.input.appDid);
-    if (existsSync(this.blockletRestoreDir)) {
-      rmdirSync(this.blockletRestoreDir, { recursive: true });
-    }
-    ensureDirSync(this.blockletRestoreDir);
+    this.storages.map((x) => x.ensureParams(this));
   }
 
   async restore() {
     await this.initialize();
     await this.syncFromSpaces();
-    await this.import();
+
+    const params = await Promise.all(this.storages.map((x) => x.getImportParams()));
+    await this.import(merge(...params));
 
     return this.storages.map((x) => x.getInstallParams());
   }
@@ -104,14 +112,14 @@ class SpacesRestore {
     const { errorCount, message } = await spaceClient.send(
       new RestoreBlockletCommand({
         appDid: this.input.appDid,
-        target: join(this.blockletRestoreDir, '/'),
+        target: join(this.restoreDir, '/'),
         debug: true,
         concurrency: 32,
         retryCount: 10,
         onProgress: (data) => {
           logger.info('restore progress', { appDid: this.input.appDid, data });
           this.input.event.emit(BlockletEvents.restoreProgress, {
-            did: this.input.appDid,
+            appDid: this.input.appDid,
             message: `Downloaded file ${basename(data.key)} (${data.completed}/${data.total})`,
           });
         },
@@ -122,23 +130,22 @@ class SpacesRestore {
     );
 
     if (errorCount !== 0) {
-      throw new Error(`Sync from spaces encountered ${errorCount} error: ${message}`);
+      throw new Error(`Sync from spaces encountered error: ${message}`);
     }
   }
 
-  async import() {
+  async import(params) {
     this.input.event.emit(BlockletEvents.restoreProgress, {
-      did: this.input.appDid,
+      appDid: this.input.appDid,
       message: 'Preparing to import data...',
     });
     await Promise.all(
       this.storages.map((storage) => {
-        storage.ensureParams(this);
-        return storage.import();
+        return storage.import(params);
       })
     );
     this.input.event.emit(BlockletEvents.restoreProgress, {
-      did: this.input.appDid,
+      appDid: this.input.appDid,
       message: 'Importing data successfully...',
     });
   }

package/lib/event.js

@@ -242,6 +242,14 @@ module.exports = ({
       );
 
       logger.info('take snapshot after updated blocklet app', { event: eventName, did: blocklet.meta.did, hash });
+    } else if (BlockletEvents.spaceConnected === eventName) {
+      nodeState
+        .read()
+        .then((info) => handleRouting(info))
+        .catch((err) => {
+          logger.error('Reload gateway failed on blocklet.connectedSpace', { error: err });
+        });
+      logger.info('Reload gateway after blocklet connected to space', { event: eventName, did: blocklet.appDid });
     }
 
     if (
@@ -307,6 +315,8 @@ module.exports = ({
 
     BlockletEvents.backupProgress,
     BlockletEvents.restoreProgress,
+
+    BlockletEvents.spaceConnected,
   ].forEach((eventName) => {
     listen(blockletManager, eventName, handleBlockletEvent);
   });

package/lib/router/helper.js

@@ -3,6 +3,7 @@
 const fs = require('fs-extra');
 const path = require('path');
 const tar = require('tar');
+const isUrl = require('is-url');
 const get = require('lodash/get');
 const cloneDeep = require('lodash/cloneDeep');
 const isEqual = require('lodash/isEqual');
@@ -43,6 +44,7 @@ const {
   BLOCKLET_INTERFACE_PUBLIC,
   BLOCKLET_INTERFACE_WELLKNOWN,
   BLOCKLET_INTERFACE_TYPE_WELLKNOWN,
+  BLOCKLET_CONFIGURABLE_KEY,
   BlockletEvents,
   BLOCKLET_MODES,
 } = require('@blocklet/constant');
@@ -122,7 +124,7 @@ const addCorsToSite = (site, rawUrl) => {
       site.corsAllowedOrigins.push(url.hostname);
     }
   } catch (err) {
-    // Do nothing
+    console.error('addCorsToSite', err);
   }
 };
 
@@ -336,6 +338,22 @@ const ensureCorsForWebWallet = async (sites) => {
   return sites;
 };
 
+const ensureCorsForDidSpace = async (sites = [], blocklets) => {
+  return sites.map((site) => {
+    const blocklet = blocklets.find((x) => x.meta.did === site.blockletDid);
+    if (blocklet) {
+      const endpoint = blocklet.environments.find(
+        (x) => x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SPACE_ENDPOINT
+      );
+      if (endpoint && isUrl(endpoint.value)) {
+        addCorsToSite(site, endpoint.value);
+      }
+    }
+
+    return site;
+  });
+};
+
 const filterSitesForRemovedBlocklets = async (sites = [], blocklets) => {
   return sites.filter((site) => {
     if (!site.domain.endsWith(BLOCKLET_SITE_GROUP_SUFFIX)) {
@@ -407,6 +425,7 @@ const ensureLatestInfo = async (sites = [], { withDefaultCors = true } = {}) =>
   result = await ensureBlockletCache(result, blocklets);
   result = await ensureWellknownRule(result);
   result = await ensureCorsForWebWallet(result);
+  result = await ensureCorsForDidSpace(result, blocklets);
   result = await ensureLatestInterfaceInfo(result);
 
   return result;

package/lib/states/blocklet.js

@@ -49,7 +49,7 @@ const formatBlocklet = (blocklet, phase, dek) => {
       return;
     }
 
-    (b.migratedFrom || []).forEach((x) => {
+    (Array.isArray(b.migratedFrom) ? b.migratedFrom : []).forEach((x) => {
       if (phase === 'onUpdate' && isHex(x.appSk) === true) {
         x.appSk = security.encrypt(x.appSk, b.meta.did, dek);
       }

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.8.68-beta-500af7e5",
+  "version": "1.8.69-beta-e0666d0d",
   "description": "",
   "main": "lib/index.js",
   "files": [
@@ -19,18 +19,18 @@
   "author": "wangshijun <wangshijun2010@gmail.com> (http://github.com/wangshijun)",
   "license": "MIT",
   "dependencies": {
-    "@abtnode/auth": "1.8.68-beta-500af7e5",
-    "@abtnode/certificate-manager": "1.8.68-beta-500af7e5",
-    "@abtnode/constant": "1.8.68-beta-500af7e5",
-    "@abtnode/cron": "1.8.68-beta-500af7e5",
-    "@abtnode/db": "1.8.68-beta-500af7e5",
-    "@abtnode/logger": "1.8.68-beta-500af7e5",
-    "@abtnode/queue": "1.8.68-beta-500af7e5",
-    "@abtnode/rbac": "1.8.68-beta-500af7e5",
-    "@abtnode/router-provider": "1.8.68-beta-500af7e5",
-    "@abtnode/static-server": "1.8.68-beta-500af7e5",
-    "@abtnode/timemachine": "1.8.68-beta-500af7e5",
-    "@abtnode/util": "1.8.68-beta-500af7e5",
+    "@abtnode/auth": "1.8.69-beta-e0666d0d",
+    "@abtnode/certificate-manager": "1.8.69-beta-e0666d0d",
+    "@abtnode/constant": "1.8.69-beta-e0666d0d",
+    "@abtnode/cron": "1.8.69-beta-e0666d0d",
+    "@abtnode/db": "1.8.69-beta-e0666d0d",
+    "@abtnode/logger": "1.8.69-beta-e0666d0d",
+    "@abtnode/queue": "1.8.69-beta-e0666d0d",
+    "@abtnode/rbac": "1.8.69-beta-e0666d0d",
+    "@abtnode/router-provider": "1.8.69-beta-e0666d0d",
+    "@abtnode/static-server": "1.8.69-beta-e0666d0d",
+    "@abtnode/timemachine": "1.8.69-beta-e0666d0d",
+    "@abtnode/util": "1.8.69-beta-e0666d0d",
     "@arcblock/did": "1.18.57",
     "@arcblock/did-motif": "^1.1.10",
     "@arcblock/did-util": "1.18.57",
@@ -38,10 +38,10 @@
     "@arcblock/jwt": "^1.18.57",
     "@arcblock/pm2-events": "^0.0.5",
     "@arcblock/vc": "1.18.57",
-    "@blocklet/constant": "1.8.68-beta-500af7e5",
-    "@blocklet/meta": "1.8.68-beta-500af7e5",
-    "@blocklet/sdk": "1.8.68-beta-500af7e5",
-    "@did-space/client": "0.1.87-beta-1",
+    "@blocklet/constant": "1.8.69-beta-e0666d0d",
+    "@blocklet/meta": "1.8.69-beta-e0666d0d",
+    "@blocklet/sdk": "1.8.69-beta-e0666d0d",
+    "@did-space/client": "0.2.25",
     "@fidm/x509": "^1.2.1",
     "@ocap/mcrypto": "1.18.57",
     "@ocap/util": "1.18.57",
@@ -89,5 +89,5 @@
     "express": "^4.18.2",
     "jest": "^27.5.1"
   },
-  "gitHead": "9070621373f317a10ff0d289323bf725e30d3521"
+  "gitHead": "acf0373591eaa3aff76483edc4e648afc543f1f7"
 }