@blocklet/sdk 1.16.43-beta-20250422-042711-c40bec75 → 1.16.43-beta-20250424-125523-08a65a5c

package/lib/middlewares/auth.d.ts

@@ -1,4 +1,5 @@
 import { NextFunction, Request, Response } from 'express';
+import AuthService from '../service/auth';
 import { SessionUser, AuthMethod, KycMethod } from '../util/login';
 type AuthOptions = {
     roles?: string[];
@@ -7,7 +8,10 @@ type AuthOptions = {
     methods?: AuthMethod[];
     getClient?: Function;
 };
-declare const AuthMiddleware: ({ roles, permissions, kyc, methods, getClient }?: AuthOptions) => (req: Request & {
-    user?: SessionUser;
-}, res: Response, next: NextFunction) => Promise<void>;
+declare const AuthMiddleware: {
+    ({ roles, permissions, kyc, methods, getClient }?: AuthOptions): (req: Request & {
+        user?: SessionUser;
+    }, res: Response, next: NextFunction) => Promise<void>;
+    getServiceClient: () => AuthService;
+};
 export = AuthMiddleware;

package/lib/middlewares/auth.js

@@ -5,7 +5,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 const lru_cache_1 = require("lru-cache");
 const auth_1 = __importDefault(require("../service/auth"));
 const login_1 = require("../util/login");
-const cache = new lru_cache_1.LRUCache({ max: 10, ttl: 60 * 1000 });
 const clients = {};
 const getServiceClient = () => {
     const appId = process.env.BLOCKLET_APP_ID;
@@ -14,6 +13,7 @@ const getServiceClient = () => {
     }
     return clients[appId];
 };
+const cache = new lru_cache_1.LRUCache({ max: 10, ttl: 60 * 1000 });
 const getPermissionsByRole = async (getClient, role) => {
     if (!role) {
         return [];
@@ -75,4 +75,5 @@ const AuthMiddleware = ({ roles, permissions, kyc, methods, getClient = getServi
         next();
     };
 };
+AuthMiddleware.getServiceClient = getServiceClient;
 module.exports = AuthMiddleware;

package/lib/middlewares/index.d.ts

@@ -10,15 +10,18 @@ declare const _default: {
     user: () => (req: import("express").Request & {
         user?: import("../util/login").SessionUser;
     }, res: import("express").Response, next: import("express").NextFunction) => void;
-    auth: ({ roles, permissions, kyc, methods, getClient }?: {
-        roles?: string[];
-        permissions?: string[];
-        kyc?: import("../util/login").KycMethod[];
-        methods?: import("../util/login").AuthMethod[];
-        getClient?: Function;
-    }) => (req: import("express").Request & {
-        user?: import("../util/login").SessionUser;
-    }, res: import("express").Response, next: import("express").NextFunction) => Promise<void>;
+    auth: {
+        ({ roles, permissions, kyc, methods, getClient }?: {
+            roles?: string[];
+            permissions?: string[];
+            kyc?: import("../util/login").KycMethod[];
+            methods?: import("../util/login").AuthMethod[];
+            getClient?: Function;
+        }): (req: import("express").Request & {
+            user?: import("../util/login").SessionUser;
+        }, res: import("express").Response, next: import("express").NextFunction) => Promise<void>;
+        getServiceClient: () => import("..").AuthService;
+    };
     component: {
         verifySig: (req: import("express").Request, res: import("express").Response, next: import("express").NextFunction) => Promise<void | import("express").Response<any, Record<string, any>>>;
     };
@@ -79,6 +82,7 @@ declare const _default: {
         loginToken?: boolean;
         componentCall?: boolean;
         signedToken?: boolean;
+        accessKey?: boolean;
     }) => (req: import("express").Request & {
         user?: import("../util/login").SessionUser;
     }, res: import("express").Response, next: import("express").NextFunction) => Promise<void>;

package/lib/middlewares/session.d.ts

@@ -5,6 +5,7 @@ type SessionOptions = {
     loginToken?: boolean;
     componentCall?: boolean;
     signedToken?: boolean;
+    accessKey?: boolean;
 };
 declare const sessionMiddleware: (options?: SessionOptions) => (req: Request & {
     user?: SessionUser;

package/lib/middlewares/session.js

@@ -1,13 +1,14 @@
 "use strict";
 const get_token_from_req_1 = require("@abtnode/util/lib/get-token-from-req");
+const login_1 = require("../util/login");
 const verify_session_1 = require("../util/verify-session");
 const sessionMiddleware = (options = {}) => {
-    const { loginToken = true, componentCall = false, signedToken = '', strictMode = false } = options;
+    const { loginToken = true, componentCall = false, signedToken = '', strictMode = false, accessKey = false } = options;
     return async (req, res, next) => {
         let result = null;
         try {
             // authenticate by login token
-            if (loginToken) {
+            if (loginToken || accessKey) {
                 const { _duplicate, token: loginTokenValue } = await (0, get_token_from_req_1.getTokenFromReq)(req, {
                     cookie: {
                         key: 'login_token',
@@ -17,7 +18,12 @@ const sessionMiddleware = (options = {}) => {
                     res.status(400).send('Access token found in multiple locations');
                     return;
                 }
-                result = await (0, verify_session_1.verifyLoginToken)({ token: loginTokenValue, strictMode });
+                if ((0, login_1.isLoginToken)(loginTokenValue)) {
+                    result = await (0, verify_session_1.verifyLoginToken)({ token: loginTokenValue, strictMode });
+                }
+                if ((0, login_1.isAccessKey)(loginTokenValue) && accessKey) {
+                    result = await (0, verify_session_1.verifyAccessKey)({ token: loginTokenValue, strictMode });
+                }
             }
             // authenticate by component call
             if (!result && componentCall) {

package/lib/service/auth.d.ts

@@ -69,5 +69,9 @@ interface AuthService {
     getVault(): Promise<string>;
     updateUserAddress(args: OmitTeamDid<Client.RequestUpdateUserAddressInput>, options: RequestHeaders): Promise<Client.ResponseUser>;
     updateUserInfo(userInfo: ABTNodeClient.UserInfoInput, options: RequestHeaders): Promise<Client.ResponseUser>;
+    createAccessKey(params: OmitTeamDid<Client.RequestCreateAccessKeyInput>): Promise<Client.ResponseCreateAccessKey>;
+    verifyAccessKey(params: OmitTeamDid<Client.RequestVerifyAccessKeyInput>): Promise<Client.ResponseAccessKey>;
+    getAccessKeys(params: OmitTeamDid<Client.RequestAccessKeysInput>): Promise<Client.ResponseAccessKeys>;
+    getAccessKey(params: OmitTeamDid<Client.RequestAccessKeyInput>): Promise<Client.ResponseAccessKey>;
 }
 export = AuthService;

package/lib/service/auth.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -8,7 +41,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 const pickBy_1 = __importDefault(require("lodash/pickBy"));
 const ufo_1 = require("ufo");
 const client_1 = __importDefault(require("@abtnode/client"));
-const constant_1 = __importDefault(require("@abtnode/constant"));
+const constant_1 = __importStar(require("@abtnode/constant"));
 const util_1 = require("@ocap/util");
 const constant_2 = require("@blocklet/constant");
 const util_2 = require("@blocklet/meta/lib/util");
@@ -122,8 +155,10 @@ class AuthService {
             'createAccessKey',
             'verifyAccessKey',
             'getAccessKeys',
+            'getAccessKey',
         ];
         const teamDid = process.env.BLOCKLET_DID;
+        const componentDid = process.env.BLOCKLET_COMPONENT_DID;
         const apiFallback = (fn) => (params = {}, ...args) => fn({ input: { ...params, teamDid }, ...args });
         // const apiConvertDid = (fn: Function) => (did: string) => fn({ input: { user: { did }, teamDid } });
         const apiFnMap = {
@@ -153,9 +188,19 @@ class AuthService {
             deletePermission: (fn) => (name) => fn({ input: { name, teamDid } }),
             hasPermission: (fn) => (role, permission) => fn({ input: { teamDid, role, permission } }),
             getBlocklet: (fn) => (attachRuntimeInfo = false) => fn({ input: { did: teamDid, attachRuntimeInfo } }, { ignoreFields: ['blocklet.settings.navigations'] }),
-            createAccessKey: (fn) => (params) => fn({ input: { teamDid, authType: 'simple', createdVia: 'sdk', passport: 'guest', ...params } }),
+            createAccessKey: (fn) => (params) => fn({
+                input: {
+                    teamDid,
+                    authType: 'simple',
+                    createdVia: 'sdk',
+                    passport: constant_1.SERVER_ROLES.GUEST,
+                    ...params,
+                    componentDid,
+                },
+            }),
             verifyAccessKey: (fn) => (params) => fn({ input: { teamDid, ...params } }),
-            getAccessKeys: (fn) => (params) => fn({ input: { teamDid, ...params } }),
+            getAccessKeys: (fn) => (params) => fn({ input: { teamDid, ...params, componentDid } }),
+            getAccessKey: (fn) => (params) => fn({ input: { teamDid, ...params } }),
         };
         apiList.forEach((api) => {
             const fn = client[api];
@@ -176,9 +221,7 @@ class AuthService {
         };
         this.refreshSession = async (data) => {
             try {
-                const { data: resData } = await service_api_1.default.post('/api/did/refreshSession', {
-                    refresh_token: data.refreshToken,
-                });
+                const { data: resData } = await service_api_1.default.post('/api/did/refreshSession', {}, { headers: { Authorization: `Bearer ${data.refreshToken}` } });
                 if (resData?.user) {
                     fixAvatar(resData.user);
                 }

package/lib/util/login.d.ts

@@ -7,7 +7,7 @@ export declare const decodeKycStatus: (status: number) => {
     phoneVerified: boolean;
 };
 export type KycMethod = LiteralUnion<'email' | 'phone', string>;
-export type AuthMethod = LiteralUnion<'loginToken' | 'componentCall' | 'signedToken', string>;
+export type AuthMethod = LiteralUnion<'loginToken' | 'componentCall' | 'signedToken' | 'accessKey', string>;
 export type SessionUser = {
     did: string;
     role: string | undefined;
@@ -20,3 +20,5 @@ export type SessionUser = {
     kyc?: number;
     [key: string]: any;
 };
+export declare const isLoginToken: (token: string) => boolean;
+export declare const isAccessKey: (token: string) => boolean;

package/lib/util/login.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decodeKycStatus = exports.encodeKycStatus = void 0;
+exports.isAccessKey = exports.isLoginToken = exports.decodeKycStatus = exports.encodeKycStatus = void 0;
 exports.getLoginProvider = getLoginProvider;
 exports.getSourceAppPid = getSourceAppPid;
 /* eslint-disable import/prefer-default-export */
@@ -31,3 +31,11 @@ const decodeKycStatus = (status) => {
     };
 };
 exports.decodeKycStatus = decodeKycStatus;
+const isLoginToken = (token) => {
+    return typeof token === 'string' && token.split('.').length === 3;
+};
+exports.isLoginToken = isLoginToken;
+const isAccessKey = (token) => {
+    return typeof token === 'string' && token.split('.').length === 1 && token.startsWith('blocklet-');
+};
+exports.isAccessKey = isAccessKey;

package/lib/util/verify-session.d.ts

@@ -4,6 +4,10 @@ export declare function verifyLoginToken({ token, strictMode }: {
     token: any;
     strictMode: any;
 }): Promise<SessionUser | null>;
+export declare function verifyAccessKey({ token, strictMode }: {
+    token: any;
+    strictMode: any;
+}): Promise<SessionUser | null>;
 export declare function verifyComponentCall({ req, strictMode }: {
     req: any;
     strictMode: any;

package/lib/util/verify-session.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getSessionSecret = void 0;
 exports.verifyLoginToken = verifyLoginToken;
+exports.verifyAccessKey = verifyAccessKey;
 exports.verifyComponentCall = verifyComponentCall;
 exports.verifySignedToken = verifySignedToken;
 const constant_1 = require("@blocklet/constant");
@@ -12,6 +13,7 @@ const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const mcrypto_1 = require("@ocap/mcrypto");
 const jwt_1 = require("@arcblock/jwt");
 const wallet_1 = __importDefault(require("../wallet"));
+const auth_1 = __importDefault(require("../middlewares/auth"));
 const login_1 = require("./login");
 const config_1 = require("../config");
 const verify_sign_1 = require("./verify-sign");
@@ -46,6 +48,30 @@ function verifyLoginToken({ token, strictMode }) {
         });
     });
 }
+async function verifyAccessKey({ token, strictMode }) {
+    if (!token)
+        return null;
+    try {
+        const client = auth_1.default.getServiceClient();
+        const result = await client.verifyAccessKey({ accessKeyId: token });
+        const { createdBy, accessKeyId, passport = 'guest', remark = '' } = result.data;
+        return {
+            did: createdBy,
+            role: passport.replace('blocklet-', ''),
+            fullName: remark || accessKeyId,
+            provider: 'accessKey',
+            walletOS: 'embed',
+            method: 'accessKey',
+        };
+    }
+    catch (err) {
+        console.error('verifyAccessKey', err);
+        if (strictMode) {
+            throw new Error('Unauthorized: Invalid access key');
+        }
+        return null;
+    }
+}
 async function verifyComponentCall({ req, strictMode }) {
     const { sig, data } = (0, verify_sign_1.getVerifyData)(req);
     if (!sig)

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.16.43-beta-20250422-042711-c40bec75",
+  "version": "1.16.43-beta-20250424-125523-08a65a5c",
   "description": "graphql client to read/write data on abt node",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",
@@ -27,23 +27,23 @@
   "author": "linchen1987 <linchen.1987@foxmail.com> (http://github.com/linchen1987)",
   "license": "Apache-2.0",
   "dependencies": {
-    "@abtnode/client": "1.16.43-beta-20250422-042711-c40bec75",
-    "@abtnode/constant": "1.16.43-beta-20250422-042711-c40bec75",
-    "@abtnode/util": "1.16.43-beta-20250422-042711-c40bec75",
-    "@arcblock/did": "1.20.1",
-    "@arcblock/did-auth": "1.20.1",
-    "@arcblock/jwt": "1.20.1",
-    "@arcblock/ws": "1.20.1",
-    "@blocklet/constant": "1.16.43-beta-20250422-042711-c40bec75",
-    "@blocklet/env": "1.16.43-beta-20250422-042711-c40bec75",
+    "@abtnode/client": "1.16.43-beta-20250424-125523-08a65a5c",
+    "@abtnode/constant": "1.16.43-beta-20250424-125523-08a65a5c",
+    "@abtnode/util": "1.16.43-beta-20250424-125523-08a65a5c",
+    "@arcblock/did": "1.20.2",
+    "@arcblock/did-auth": "1.20.2",
+    "@arcblock/jwt": "1.20.2",
+    "@arcblock/ws": "1.20.2",
+    "@blocklet/constant": "1.16.43-beta-20250424-125523-08a65a5c",
+    "@blocklet/env": "1.16.43-beta-20250424-125523-08a65a5c",
     "@blocklet/error": "^0.2.4",
-    "@blocklet/meta": "1.16.43-beta-20250422-042711-c40bec75",
+    "@blocklet/meta": "1.16.43-beta-20250424-125523-08a65a5c",
     "@did-connect/authenticator": "^2.2.7",
     "@did-connect/handler": "^2.2.7",
     "@nedb/core": "^2.1.5",
-    "@ocap/mcrypto": "1.20.1",
-    "@ocap/util": "1.20.1",
-    "@ocap/wallet": "1.20.1",
+    "@ocap/mcrypto": "1.20.2",
+    "@ocap/util": "1.20.2",
+    "@ocap/wallet": "1.20.2",
     "axios": "^1.7.9",
     "cheerio": "1.0.0-rc.12",
     "debug": "^4.3.7",
@@ -83,5 +83,5 @@
     "ts-node": "^10.9.1",
     "typescript": "^5.6.3"
   },
-  "gitHead": "836a400c1f953f421a8e95dc9a32ba883ac2586d"
+  "gitHead": "499de9f28770298a819122ba16a7f2b3cc78c7ee"
 }