@blocklet/sdk 1.17.4-beta-20251203-225234-75da41dd → 1.17.4-beta-20251204-152224-243ff54f

package/lib/middlewares/blocklet.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyBlockletSig = void 0;
+const ufo_1 = require("ufo");
 const config_1 = __importDefault(require("../config"));
 const verify_sign_1 = require("../util/verify-sign");
 const verifyBlockletSig = async (req, res, next) => {
@@ -12,7 +13,11 @@ const verifyBlockletSig = async (req, res, next) => {
         if (!sig) {
             return res.status(400).json({ error: 'Bad Request' });
         }
-        const verified = await (0, verify_sign_1.verify)(data, sig);
+        const pathPrefix = req?.get('x-path-prefix');
+        let verified = await (0, verify_sign_1.verify)(data, sig);
+        if (!verified && pathPrefix && data?.url && !data.url?.startsWith(pathPrefix)) {
+            verified = await (0, verify_sign_1.verify)({ ...data, url: (0, ufo_1.joinURL)(pathPrefix, data.url) }, sig);
+        }
         if (!verified) {
             config_1.default.logger.error('verify blocklet sig failed', { data, sig });
             return res.status(401).json({ error: 'verify sig failed' });

package/lib/middlewares/component.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifySig = void 0;
+const ufo_1 = require("ufo");
 const config_1 = __importDefault(require("../config"));
 const verify_sign_1 = require("../util/verify-sign");
 const verifySig = async (req, res, next) => {
@@ -12,7 +13,11 @@ const verifySig = async (req, res, next) => {
         if (!sig) {
             return res.status(400).json({ error: 'Bad Request' });
         }
-        const verified = await (0, verify_sign_1.verify)(data, sig);
+        const pathPrefix = req?.get('x-path-prefix');
+        let verified = await (0, verify_sign_1.verify)(data, sig);
+        if (!verified && pathPrefix && data?.url && !data.url?.startsWith(pathPrefix)) {
+            verified = await (0, verify_sign_1.verify)({ ...data, url: (0, ufo_1.joinURL)(pathPrefix, data.url) }, sig);
+        }
         if (!verified) {
             config_1.default.logger.error('verify component sig failed', { data, sig });
             return res.status(401).json({ error: 'verify sig failed' });

package/lib/util/verify-session.js

@@ -12,6 +12,7 @@ const constant_1 = require("@blocklet/constant");
 const jwt_1 = require("@arcblock/jwt");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const mcrypto_1 = require("@ocap/mcrypto");
+const ufo_1 = require("ufo");
 const wallet_1 = require("../wallet");
 const auth_1 = require("../middlewares/auth");
 const login_1 = require("./login");
@@ -91,7 +92,14 @@ async function verifyComponentCall({ req, strictMode }) {
         // 所有请求都会调用 verifyComponentCall，所以需要确保 getVerifyData 抛错时，能继续执行后续逻辑
         return null;
     }
-    if ((await (0, verify_sign_1.verify)(data, sig, { appSk: process.env.BLOCKLET_APP_ASK || process.env.BLOCKLET_APP_SK })) === false) {
+    const pathPrefix = req?.get('x-path-prefix');
+    let verified = await (0, verify_sign_1.verify)(data, sig, { appSk: process.env.BLOCKLET_APP_ASK || process.env.BLOCKLET_APP_SK });
+    if (!verified && pathPrefix && data?.url && !data.url?.startsWith(pathPrefix)) {
+        verified = await (0, verify_sign_1.verify)({ ...data, url: (0, ufo_1.joinURL)(pathPrefix, data.url) }, sig, {
+            appSk: process.env.BLOCKLET_APP_ASK || process.env.BLOCKLET_APP_SK,
+        });
+    }
+    if (!verified) {
         if (strictMode) {
             throw new Error('Unauthorized: Invalid signature');
         }

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.17.4-beta-20251203-225234-75da41dd",
+  "version": "1.17.4-beta-20251204-152224-243ff54f",
   "description": "graphql client to read/write data on abt node",
   "homepage": "https://www.arcblock.io/docs/blocklet-sdk-nodejs",
   "main": "lib/index.js",
@@ -26,19 +26,19 @@
   "author": "linchen1987 <linchen.1987@foxmail.com> (http://github.com/linchen1987)",
   "license": "Apache-2.0",
   "dependencies": {
-    "@abtnode/constant": "1.17.4-beta-20251203-225234-75da41dd",
-    "@abtnode/db-cache": "1.17.4-beta-20251203-225234-75da41dd",
-    "@abtnode/util": "1.17.4-beta-20251203-225234-75da41dd",
+    "@abtnode/constant": "1.17.4-beta-20251204-152224-243ff54f",
+    "@abtnode/db-cache": "1.17.4-beta-20251204-152224-243ff54f",
+    "@abtnode/util": "1.17.4-beta-20251204-152224-243ff54f",
     "@arcblock/did": "^1.27.12",
     "@arcblock/did-connect-js": "^1.27.12",
     "@arcblock/did-ext": "^1.27.12",
     "@arcblock/jwt": "^1.27.12",
     "@arcblock/ws": "^1.27.12",
-    "@blocklet/constant": "1.17.4-beta-20251203-225234-75da41dd",
-    "@blocklet/env": "1.17.4-beta-20251203-225234-75da41dd",
+    "@blocklet/constant": "1.17.4-beta-20251204-152224-243ff54f",
+    "@blocklet/env": "1.17.4-beta-20251204-152224-243ff54f",
     "@blocklet/error": "^0.3.3",
-    "@blocklet/meta": "1.17.4-beta-20251203-225234-75da41dd",
-    "@blocklet/server-js": "1.17.4-beta-20251203-225234-75da41dd",
+    "@blocklet/meta": "1.17.4-beta-20251204-152224-243ff54f",
+    "@blocklet/server-js": "1.17.4-beta-20251204-152224-243ff54f",
     "@blocklet/theme": "^3.2.11",
     "@did-connect/authenticator": "^2.2.8",
     "@did-connect/handler": "^2.2.8",
@@ -82,5 +82,5 @@
     "ts-node": "^10.9.1",
     "typescript": "^5.6.3"
   },
-  "gitHead": "d9c14c9b2763e632d2cc8d818dcd288ab08046e7"
+  "gitHead": "090b2f960b834168dfa12b2a559b9256a98be312"
 }