@blocklet/sdk 1.16.32-beta-f35ca4b8 → 1.16.32-beta-76103be3

package/lib/middlewares/auth.d.ts

@@ -1,9 +1,13 @@
 import { NextFunction, Request, Response } from 'express';
-type MiddlewareParams = {
+import { SessionUser, AuthMethod, KycMethod } from '../util/login';
+type AuthOptions = {
     roles?: string[];
     permissions?: string[];
-    kyc?: string[];
+    kyc?: KycMethod[];
+    methods?: AuthMethod[];
     getClient?: Function;
 };
-declare const AuthMiddleware: ({ roles, permissions, kyc, getClient }?: MiddlewareParams) => (req: Request, res: Response, next: NextFunction) => Promise<void>;
+declare const AuthMiddleware: ({ roles, permissions, kyc, methods, getClient }?: AuthOptions) => (req: Request & {
+    user?: SessionUser;
+}, res: Response, next: NextFunction) => Promise<void>;
 export = AuthMiddleware;

package/lib/middlewares/auth.js

@@ -26,7 +26,7 @@ const getPermissionsByRole = async (getClient, role) => {
     cache.set(role, res);
     return res;
 };
-const AuthMiddleware = ({ roles, permissions, kyc, getClient = getServiceClient } = {}) => {
+const AuthMiddleware = ({ roles, permissions, kyc, methods, getClient = getServiceClient } = {}) => {
     if (roles && !Array.isArray(roles)) {
         throw new Error('roles must be array');
     }
@@ -36,29 +36,42 @@ const AuthMiddleware = ({ roles, permissions, kyc, getClient = getServiceClient
     if (kyc && !Array.isArray(kyc)) {
         throw new Error('kyc must be array');
     }
+    if (methods && !Array.isArray(methods)) {
+        throw new Error('auth methods must be array');
+    }
     return async (req, res, next) => {
-        if (!req.headers['x-user-did']) {
+        const userDid = req.user?.did || req.headers['x-user-did'];
+        const userRole = req.user?.role || req.headers['x-user-role'];
+        const userKyc = req.user?.kyc || req.headers['x-user-kyc'];
+        const userMethod = req.user?.method || 'loginToken';
+        if (!userDid) {
             res.status(401).json({ code: 'forbidden', error: 'not authorized' });
             return;
         }
-        if (roles && !roles.includes(req.headers['x-user-role'])) {
+        if (roles && !roles.includes(userRole)) {
             res.status(403).json({ code: 'forbidden', error: 'no permission' });
             return;
         }
         if (permissions) {
-            const { permissions: list } = await getPermissionsByRole(getClient, req.headers['x-user-role']);
+            const { permissions: list } = await getPermissionsByRole(getClient, userRole);
             if (!permissions.some((x) => (list || []).some((y) => y.name === x))) {
                 res.status(403).json({ code: 'forbidden', error: 'no permission' });
                 return;
             }
         }
         if (kyc) {
-            const kycStatus = (0, login_1.decodeKycStatus)(Number(req.headers['x-user-kyc']) || 0);
+            const kycStatus = (0, login_1.decodeKycStatus)(Number(userKyc) || 0);
             if (kyc.some((x) => !kycStatus[`${x}Verified`])) {
                 res.status(403).json({ code: 'forbidden', error: 'kyc required' });
                 return;
             }
         }
+        if (methods) {
+            if (!methods.includes(userMethod)) {
+                res.status(403).json({ code: 'forbidden', error: 'auth method not allowed' });
+                return;
+            }
+        }
         next();
     };
 };

package/lib/middlewares/index.d.ts

@@ -3,31 +3,22 @@ import auth from './auth';
 import component from './component';
 import fallback from './fallback';
 import sitemap from './sitemap';
+import session from './session';
 import { csrf } from './csrf';
-export { user };
-export { auth };
-export { component };
-export { fallback };
-export { sitemap };
-export { csrf };
+export { user, auth, component, fallback, sitemap, csrf, session };
 declare const _default: {
     user: () => (req: import("express").Request & {
-        user?: {
-            did: string;
-            role: string | undefined;
-            provider: string;
-            fullName: string;
-            walletOS: string;
-            emailVerified: boolean;
-            phoneVerified: boolean;
-        };
+        user?: import("../util/login").SessionUser;
     }, res: import("express").Response, next: import("express").NextFunction) => void;
-    auth: ({ roles, permissions, kyc, getClient }?: {
+    auth: ({ roles, permissions, kyc, methods, getClient }?: {
         roles?: string[];
         permissions?: string[];
-        kyc?: string[];
+        kyc?: import("../util/login").KycMethod[];
+        methods?: import("../util/login").AuthMethod[];
         getClient?: Function;
-    }) => (req: import("express").Request, res: import("express").Response, next: import("express").NextFunction) => Promise<void>;
+    }) => (req: import("express").Request & {
+        user?: import("../util/login").SessionUser;
+    }, res: import("express").Response, next: import("express").NextFunction) => Promise<void>;
     component: {
         verifySig: (req: import("express").Request, res: import("express").Response, next: import("express").NextFunction) => void | import("express").Response<any, Record<string, any>>;
     };
@@ -75,5 +66,12 @@ declare const _default: {
         };
     }) => void, req?: import("express").Request) => Promise<void>) => (req: import("express").Request, res: import("express").Response) => Promise<void>;
     csrf: typeof csrf;
+    session: (options?: {
+        loginToken?: boolean;
+        componentCall?: boolean;
+        signedToken?: boolean;
+    }) => (req: import("express").Request & {
+        user?: import("../util/login").SessionUser;
+    }, res: import("express").Response, next: import("express").NextFunction) => void | import("express").Response<any, Record<string, any>>;
 };
 export default _default;

package/lib/middlewares/index.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.csrf = exports.sitemap = exports.fallback = exports.component = exports.auth = exports.user = void 0;
+exports.session = exports.csrf = exports.sitemap = exports.fallback = exports.component = exports.auth = exports.user = void 0;
 const user_1 = __importDefault(require("./user"));
 exports.user = user_1.default;
 const auth_1 = __importDefault(require("./auth"));
@@ -14,6 +14,8 @@ const fallback_1 = __importDefault(require("./fallback"));
 exports.fallback = fallback_1.default;
 const sitemap_1 = __importDefault(require("./sitemap"));
 exports.sitemap = sitemap_1.default;
+const session_1 = __importDefault(require("./session"));
+exports.session = session_1.default;
 const csrf_1 = require("./csrf");
 Object.defineProperty(exports, "csrf", { enumerable: true, get: function () { return csrf_1.csrf; } });
 exports.default = {
@@ -23,4 +25,5 @@ exports.default = {
     fallback: fallback_1.default,
     sitemap: sitemap_1.default,
     csrf: csrf_1.csrf,
+    session: session_1.default,
 };

package/lib/middlewares/session.d.ts

@@ -0,0 +1,11 @@
+import { NextFunction, Request, Response } from 'express';
+import { SessionUser } from '../util/login';
+type SessionOptions = {
+    loginToken?: boolean;
+    componentCall?: boolean;
+    signedToken?: boolean;
+};
+declare const sessionMiddleware: (options?: SessionOptions) => (req: Request & {
+    user?: SessionUser;
+}, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
+export = sessionMiddleware;

package/lib/middlewares/session.js

@@ -0,0 +1,86 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const constant_1 = require("@blocklet/constant");
+const mcrypto_1 = require("@ocap/mcrypto");
+const jwt_1 = require("@arcblock/jwt");
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const login_1 = require("../util/login");
+const verify_sign_1 = require("../util/verify-sign");
+const wallet_1 = __importDefault(require("../wallet"));
+const sessionMiddleware = (options = {}) => {
+    const wallet = (0, wallet_1.default)();
+    const secret = mcrypto_1.Hasher.SHA3.hash256(Buffer.concat([wallet.secretKey, wallet.address].map((v) => Buffer.from(v))));
+    const { loginToken = true, componentCall = false, signedToken = '' } = options;
+    return (req, res, next) => {
+        // authenticate by login token
+        if (loginToken) {
+            const token = req.cookies.login_token;
+            if (token) {
+                return jsonwebtoken_1.default.verify(token, secret, (err, decoded) => {
+                    if (err) {
+                        res.status(401).json({ message: 'Unauthorized: Invalid login token' });
+                    }
+                    else {
+                        const { did, role, fullName, provider = constant_1.LOGIN_PROVIDER.WALLET, walletOS, kyc = 0 } = decoded;
+                        req.user = {
+                            did,
+                            role,
+                            fullName,
+                            provider,
+                            walletOS,
+                            ...(0, login_1.decodeKycStatus)(Number(kyc) || 0),
+                            method: 'loginToken',
+                        };
+                        next();
+                    }
+                });
+            }
+        }
+        // authenticate by component call
+        if (componentCall) {
+            const signature = req.get('x-component-sig');
+            if (signature) {
+                // FIXME: @zhanghan please check this
+                const data = typeof req.body === 'undefined' ? {} : req.body;
+                if ((0, verify_sign_1.verify)(data, signature) === false) {
+                    return res.status(401).json({ error: 'Unauthorized: Invalid signature' });
+                }
+                req.user = {
+                    did: req.get('x-component-did'),
+                    role: 'component',
+                    provider: 'wallet',
+                    fullName: req.get('x-component-did'),
+                    walletOS: 'embed',
+                    emailVerified: false,
+                    phoneVerified: false,
+                    method: 'componentCall',
+                };
+                return next();
+            }
+        }
+        // authenticate by signed tmp token: which expires in 5 minutes
+        if (signedToken) {
+            const token = req.query.__jwt || '';
+            if (token) {
+                if ((0, jwt_1.verify)(token, secret) === false) {
+                    return res.status(401).json({ error: 'Unauthorized: Invalid signed token' });
+                }
+                req.user = {
+                    did: wallet.address,
+                    role: 'component',
+                    provider: 'wallet',
+                    fullName: wallet.address,
+                    walletOS: 'embed',
+                    emailVerified: false,
+                    phoneVerified: false,
+                    method: 'signedToken',
+                };
+                return next();
+            }
+        }
+        return next();
+    };
+};
+module.exports = sessionMiddleware;

package/lib/middlewares/user.d.ts

@@ -1,14 +1,6 @@
 import { NextFunction, Request, Response } from 'express';
-type User = {
-    did: string;
-    role: string | undefined;
-    provider: string;
-    fullName: string;
-    walletOS: string;
-    emailVerified: boolean;
-    phoneVerified: boolean;
-};
+import { SessionUser } from '../util/login';
 declare const userMiddleware: () => (req: Request & {
-    user?: User;
+    user?: SessionUser;
 }, res: Response, next: NextFunction) => void;
 export = userMiddleware;

package/lib/middlewares/user.js

@@ -1,7 +1,8 @@
 "use strict";
+const util_1 = require("util");
 const login_1 = require("../util/login");
-const userMiddleware = () => (req, res, next) => {
-    if (req.headers['x-user-did']) {
+const userMiddleware = (0, util_1.deprecate)(() => (req, res, next) => {
+    if (!req.user && req.headers['x-user-did']) {
         req.user = {
             did: req.headers['x-user-did'],
             role: req.headers['x-user-role'],
@@ -12,5 +13,5 @@ const userMiddleware = () => (req, res, next) => {
         };
     }
     next();
-};
+}, 'user middleware is deprecated, please use session middleware for better security');
 module.exports = userMiddleware;

package/lib/util/login.d.ts

@@ -1,3 +1,4 @@
+import type { LiteralUnion } from 'type-fest';
 export declare function getLoginProvider(request: any): any;
 export declare function getSourceAppPid(request: any): any;
 export declare const encodeKycStatus: (emailVerified: boolean, phoneVerified: boolean) => number;
@@ -5,3 +6,17 @@ export declare const decodeKycStatus: (status: number) => {
     emailVerified: boolean;
     phoneVerified: boolean;
 };
+export type KycMethod = LiteralUnion<'email' | 'phone', string>;
+export type AuthMethod = LiteralUnion<'loginToken' | 'componentCall' | 'signedToken', string>;
+export type SessionUser = {
+    did: string;
+    role: string | undefined;
+    provider: string;
+    fullName: string;
+    walletOS: string;
+    emailVerified: boolean;
+    phoneVerified: boolean;
+    method?: AuthMethod;
+    kyc?: number;
+    [key: string]: any;
+};

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.16.32-beta-f35ca4b8",
+  "version": "1.16.32-beta-76103be3",
   "description": "graphql client to read/write data on abt node",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",
@@ -27,15 +27,15 @@
   "author": "linchen1987 <linchen.1987@foxmail.com> (http://github.com/linchen1987)",
   "license": "Apache-2.0",
   "dependencies": {
-    "@abtnode/client": "1.16.32-beta-f35ca4b8",
-    "@abtnode/constant": "1.16.32-beta-f35ca4b8",
+    "@abtnode/client": "1.16.32-beta-76103be3",
+    "@abtnode/constant": "1.16.32-beta-76103be3",
     "@arcblock/did": "1.18.135",
     "@arcblock/did-auth": "1.18.135",
     "@arcblock/jwt": "1.18.135",
     "@arcblock/ws": "1.18.135",
-    "@blocklet/constant": "1.16.32-beta-f35ca4b8",
-    "@blocklet/env": "1.16.32-beta-f35ca4b8",
-    "@blocklet/meta": "1.16.32-beta-f35ca4b8",
+    "@blocklet/constant": "1.16.32-beta-76103be3",
+    "@blocklet/env": "1.16.32-beta-76103be3",
+    "@blocklet/meta": "1.16.32-beta-76103be3",
     "@did-connect/authenticator": "^2.2.4",
     "@did-connect/handler": "^2.2.4",
     "@nedb/core": "^2.1.5",
@@ -46,6 +46,7 @@
     "fs-extra": "^11.2.0",
     "joi": "17.12.2",
     "json-stable-stringify": "^1.0.1",
+    "jsonwebtoken": "^9.0.0",
     "lodash": "^4.17.21",
     "lru-cache": "^6.0.0",
     "semver": "^7.6.3",
@@ -75,5 +76,5 @@
     "ts-node": "^10.9.1",
     "typescript": "^5.0.4"
   },
-  "gitHead": "061103ce2e5a200eb4c318b41ccb7ea92b6c4ca3"
+  "gitHead": "6d7afe107a349b1267b29e7f2216db9997085015"
 }