@abtnode/util 1.17.3 → 1.17.4-beta-20251201-085909-4ab697bb

package/lib/security.js

@@ -13,6 +13,9 @@ const { promisify } = require('util');
 
 const cloneDeep = require('./deep-clone');
 
+const PAGES_KIT_DID = 'z8iZiDFg3vkkrPwsiba1TLXy3H9XHzFERsP8o';
+const ARCBLOCK_METRICS_DID = 'z8iZjMn7Hcyh93rKf8PqcSM94XnS8nRqSrPoP';
+
 const encrypt = (m, s, i) => AES.encrypt(m, crypto.pbkdf2Sync(i, s, 256, 32, 'sha512').toString('hex'));
 const decrypt = (m, s, i) => AES.decrypt(m, crypto.pbkdf2Sync(i, s, 256, 32, 'sha512').toString('hex'));
 
@@ -74,32 +77,35 @@ function findExecutable(executable) {
 }
 
 // 缓存 Node.js 版本对应的权限选项
-const permissionOptionCache = new Map();
+const nodeStableOptionCache = new Map();
 
-async function getPermissionOption() {
+/**
+ *
+ * @param {string} optionsKey, example: '--permission'
+ * @param {string[]} optionsValues, example: ['--permission', '--experimental-permission']
+ * @return {Promise<string>}
+ */
+async function getNodeStableOption({ optionsKey, optionsValues }) {
   // @note: 前端加载了整个文件，所以 execAsync 必须在这里创建
   const execAsync = promisify(exec);
   const nodeVersion = process.version;
+  const key = `${nodeVersion}.${optionsKey}`;
 
   // 检查缓存
-  if (permissionOptionCache.has(nodeVersion)) {
-    return permissionOptionCache.get(nodeVersion);
+  if (nodeStableOptionCache.has(key)) {
+    return nodeStableOptionCache.get(key);
   }
 
   try {
     const { stdout } = await execAsync('node -h');
 
-    let permissionOption;
-    if (stdout.includes('--permission')) {
-      permissionOption = '--permission';
-    } else if (stdout.includes('--experimental-permission')) {
-      permissionOption = '--experimental-permission';
-    } else {
-      throw new Error(`Can not get permission options for this Node.js version: ${nodeVersion}`);
+    const permissionOption = optionsValues.find((option) => stdout.includes(option));
+    if (!permissionOption) {
+      throw new Error(`Can not get permission option: ${optionsKey} for this Node.js version: ${nodeVersion}`);
     }
 
     // 缓存结果
-    permissionOptionCache.set(nodeVersion, permissionOption);
+    nodeStableOptionCache.set(key, permissionOption);
     return permissionOption;
   } catch (error) {
     console.error(error);
@@ -154,6 +160,7 @@ const getSecurityNodeOptions = async (blocklet, enableFileSystemIsolation = true
   }
 
   const pm2Path = getPm2Path();
+
   const meiliSearchPath = findExecutable('meilisearch');
   const meiliSearchPathAlt = '/data/bin/meilisearch';
   const blockletCliPath = findExecutable('blocklet');
@@ -164,7 +171,10 @@ const getSecurityNodeOptions = async (blocklet, enableFileSystemIsolation = true
     process.env.PNPM_HOME ? join(process.env.PNPM_HOME, 'global/') : '',
   ];
 
-  const permissionOption = await getPermissionOption();
+  const permissionOption = await getNodeStableOption({
+    optionsKey: '--permission',
+    optionsValues: ['--permission', '--experimental-permission'],
+  });
 
   options.push(
     permissionOption,
@@ -217,6 +227,15 @@ const getSecurityNodeOptions = async (blocklet, enableFileSystemIsolation = true
         .filter((x) => x !== sep)
         .map((dir) => `--allow-fs-read=${join(dir, '/*')}`)
     );
+
+    // 临时放行 pages-kit 和 arcblock-metrics 的 allow-worker 权限
+    if ([PAGES_KIT_DID, ARCBLOCK_METRICS_DID].includes(blocklet?.environmentObj?.BLOCKLET_COMPONENT_DID)) {
+      const allowWorkerOption = await getNodeStableOption({
+        optionsKey: '--allow-worker',
+        optionsValues: ['--allow-worker', '--experimental-worker'],
+      });
+      options.push(allowWorkerOption);
+    }
   }
 
   return uniq(options).join(' ').trim();

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.17.3",
+  "version": "1.17.4-beta-20251201-085909-4ab697bb",
   "description": "ArcBlock's JavaScript utility",
   "main": "lib/index.js",
   "files": [
@@ -18,14 +18,14 @@
   "author": "polunzh <polunzh@gmail.com> (http://github.com/polunzh)",
   "license": "Apache-2.0",
   "dependencies": {
-    "@abtnode/constant": "1.17.3",
-    "@abtnode/db-cache": "1.17.3",
+    "@abtnode/constant": "1.17.4-beta-20251201-085909-4ab697bb",
+    "@abtnode/db-cache": "1.17.4-beta-20251201-085909-4ab697bb",
     "@arcblock/did": "^1.27.12",
     "@arcblock/event-hub": "^1.27.12",
     "@arcblock/pm2": "^6.0.12",
-    "@blocklet/constant": "1.17.3",
+    "@blocklet/constant": "1.17.4-beta-20251201-085909-4ab697bb",
     "@blocklet/error": "^0.3.3",
-    "@blocklet/meta": "1.17.3",
+    "@blocklet/meta": "1.17.4-beta-20251201-085909-4ab697bb",
     "@blocklet/xss": "^0.3.10",
     "@ocap/client": "^1.27.12",
     "@ocap/mcrypto": "^1.27.12",
@@ -90,5 +90,5 @@
     "express": "^4.18.2",
     "fs-extra": "^11.2.0"
   },
-  "gitHead": "20fc4c3b0c0fdf05a91d995e3f6fda0f38fa1133"
+  "gitHead": "4a76a83d2c47b00686c1c0fdd7b78ffddd728f0e"
 }