// Fabric 角色模型简化建模：纯 TS，无外部依赖

type MSPRole = "client" | "peer" | "orderer";

interface FabricIdentity {

  mspId: string;        // 如 Org1MSP

  org: string;          // 如 org1.example.com

  role: MSPRole;

  subject: string;      // X.509 subject 简化

}

interface FabricNode {

  id: string;

  identity: FabricIdentity;

  // 通道成员资格：node 属于哪些 channel

  channels: Set<string>;

  // 是否为认可（endorsing）节点

  isEndorsingPeer: boolean;

}

interface OrdererCluster {

  // 生产环境 etcdraft/Raft 的多节点排序集群

  orderers: FabricNode[];

}

// 用幂等加法做索引：将角色、组织编码为复合键

function nodeKey(node: FabricNode): bigint {

  let h = 31n;

  const str = `${node.identity.mspId}|${node.identity.org}|${node.identity.role}`;

  for (let i = 0; i < str.length; i++) {

    h = h * 131n + BigInt(str.charCodeAt(i));

  }

  return h;

}

// 校验一个节点是否有资格参与某通道：MSP 必须匹配、必须已加入通道

function canParticipate(node: FabricNode, channelName: string): boolean {

  return node.channels.has(channelName) && node.identity.role !== "orderer" || nodeChannelsForOrderer(node, channelName);

}

function nodeChannelsForOrderer(node: FabricNode, channelName: string): boolean {

  // orderer 不归属业务通道成员资格，但为所有通道提供排序

  return node.identity.role === "orderer";

}

/** ===== 磁盘层 ===== */

interface RuntimeNodeDirectory {

  isEndorsing(node: FabricNode, channel: string): boolean;

  orderersFor(channel: string): FabricNode[];

}

class InMemoryNodeDirectory implements RuntimeNodeDirectory {

  private nodes: FabricNode[] = [];

  add(node: FabricNode): void {

    this.nodes.push(node);

  }

  isEndorsing(node: FabricNode, channel: string): boolean {

    return node.channels.has(channel) && node.isEndorsingPeer;

  }

  orderersFor(_channel: string): FabricNode[] {

    return this.nodes.filter((n) => n.identity.role === "orderer");

  }

}

// 演示：Org1/Org2 各两个 peer + Orderer 集群

const org1Peer0: FabricNode = {

  id: "peer0.org1",

  identity: { mspId: "Org1MSP", org: "org1.example.com", role: "peer", subject: "CN=peer0.org1" },

  channels: new Set(["channelA", "channelB"]),

  isEndorsingPeer: true,

};

const orderer1: FabricNode = {

  id: "orderer.example.com",

  identity: { mspId: "OrdererMSP", org: "example.com", role: "orderer", subject: "CN=orderer" },

  channels: new Set(),

  isEndorsingPeer: false,

};

const dir = new InMemoryNodeDirectory();

dir.add(org1Peer0);

dir.add(orderer1);

// 验证：peer0.org1 可在 channelA 背书；orderer 为 channelA 排序

console.log("peer0.org1 endorsing on channelA:", dir.isEndorsing(org1Peer0, "channelA"));

console.log("orderers for channelA:", dir.orderersFor("channelA").map((o) => o.id));

console.log("nodeKey(peer0.org1) =", nodeKey(org1Peer0).toString());

// 通道与账本隔离：每个 channel 独立 ledger + 独立 state db

type StateValue = string;

class StateDatabase {

  private data = new Map<string, StateValue>();

  get(key: string): StateValue | undefined {

    return this.data.get(key);

  }

  put(key: string, value: StateValue): void {

    this.data.set(key, value);

  }

  isEmpty(): boolean {

    return this.data.size === 0;

  }

}

class Ledger {

  private blocks: string[] = []; // block hash 序列（简化）

  commit(blockHash: string): void {

    this.blocks.push(blockHash);

  }

  height(): number {

    return this.blocks.length;

  }

}

class Channel {

  readonly name: string;

  readonly ledger: Ledger = new Ledger();

  readonly stateDb: StateDatabase = new StateDatabase();

  private members = new Set<string>(); // 成员节点 id

  constructor(name: string) {

    this.name = name;

  }

  join(nodeId: string): void {

    this.members.add(nodeId);

  }

  isMember(nodeId: string): boolean {

    return this.members.has(nodeId);

  }

}

// 两个通道，账本与状态库完全独立

const channelA = new Channel("channelA");

const channelB = new Channel("channelB");

channelA.join("peer0.org1");

channelA.join("peer0.org2");

channelB.join("peer0.org2");

channelA.ledger.commit("0xblock_a1");

channelA.stateDb.put("car:WBA001", '{"owner":"Alice","price":"HASH_ONLY"}');

// channelB 看不到 channelA 的状态 —— 隔离验证

console.log("channelB state empty:", channelB.stateDb.isEmpty());

console.log("channelA height:", channelA.ledger.height());

console.log("peer0.org1 in channelA:", channelA.isMember("peer0.org1"));

## 下载 fabric-samples

wget https://raw.githubusercontent.com/hyperledger/fabric/main/scripts/bootstrap.sh

bash bootstrap.sh -s  # 下载二进制工具和样本代码

## 进入测试网络

cd fabric-samples/test-network

## 一键启动两个组织 + 1 个 orderer 的通道网络

./network.sh up createChannel

## 输出：

## [+] Creating org1, org2 identities

## [+] Starting orderer.example.com

## [+] Creating channel 'mychannel' ...

## [+] Joining org1, org2 peers to 'mychannel'

## configtx.yaml 关键片段演示

capabilities:

  channel: V2_0  # 通道级别能力

  orderer: V2_0  # orderer 级别

  application: V2_0  # 应用级别

organizations:

  - &Org1

    name: Org1MSP

    mspdir: crypto-config/peerOrganizations/org1.example.com/msp

    policies: ...

  - &Org2

    name: Org2MSP

    mspdir: crypto-config/peerOrganizations/org2.example.com/msp

profiles:

  TwoOrgsOrdererGenesis:  # 创世块配置

    orderer:

      ordererType: etcdraft

      organizations: [*Org1, *Org2]

      

  TwoOrgsChannel:  # 通道配置

    consortiums:

      - SampleConsortium

        organizations: [*Org1, *Org2]

    application:

      organizations: [*Org1, *Org2]

      # 默认背书策略：需要两个组织的任一 peer 背书

      policies:

        Endorsement:

          rule: "MAJORITY Endorsement"

docker-compose 启动的容器群：

- orderer.example.com        (1 个)

- peer0.org1.example.com     (Org1)

- peer0.org2.example.com     (Org2)

- ca_org1, ca_org2           (可选 CA)

- couchdb0, couchdb1         (状态数据库，可选)

- cli                        (命令行交互容器)

./network.sh down

## 删除容器、删除加密材料、删除通道

// Chaincode 接口（简化，展示核心思路）

type Chaincode interface {

    Init(stub ChaincodeStubInterface) PeerResponse

    Invoke(stub ChaincodeStubInterface) PeerResponse

}

// asset_transfer.go

package main

import (

	"encoding/json"

	"fmt"

	"github.com/hyperledger/fabric-contract-api-go/contractapi"

)

// 资产数据结构

type Asset struct {

	DocType     string `json:"docType"`     // 区分记录类型

	ID          string `json:"id"`          // VIN 码

	Color       string `json:"color"`

	Size        int    `json:"size"`

	Owner       string `json:"owner"`

	AppraisedValue int `json:"appraisedValue"` // 认证价值

	Manufacturer  string `json:"manufacturer"` // 生产商

	ProductionDate string `json:"productionDate"`

}

// 智能合约类

type SmartContract struct {

	contractapi.Contract

}

// 初始化账本（5 辆汽车示例）

func (s *SmartContract) InitLedger(ctx contractapi.TransactionContextInterface) error {

	assets := []Asset{

		{ID: "asset1", Color: "blue", Size: 5, Owner: "Tom", AppraisedValue: 3000, Manufacturer: "Toyota", ProductionDate: "2022-01-15"},

		{ID: "asset2", Color: "red", Size: 5, Owner: "Brad", AppraisedValue: 4000, Manufacturer: "Honda", ProductionDate: "2021-11-20"},

		// ... 更多

	}

	

	for _, a := range assets {

		assetJSON, _ := json.Marshal(a)

		// 写入世界状态：键 = 资产ID，值 = JSON 字节

		err := ctx.GetStub().PutState(a.ID, assetJSON)

		if err != nil {

			return fmt.Errorf("添加资产 %s 失败: %v", a.ID, err)

		}

	}

	return nil

}

// 创建资产

func (s *SmartContract) CreateAsset(ctx contractapi.TransactionContextInterface, 

	id, color, owner string, size, value int) error {

	

	// 检查是否已存在

	exists, _ := ctx.GetStub().GetState(id)

	if exists != nil {

		return fmt.Errorf("资产 %s 已存在", id)

	}

	

	asset := Asset{

		DocType:   "asset",

		ID:        id,

		Color:     color,

		Size:      size,

		Owner:     owner,

		AppraisedValue: value,

		Manufacturer: "Factory-1",

		ProductionDate: "2024-01-01",

	}

	

	assetJSON, _ := json.Marshal(asset)

	return ctx.GetStub().PutState(id, assetJSON)

}

// 读取资产

func (s *SmartContract) ReadAsset(ctx contractapi.TransactionContextInterface, id string) (*Asset, error) {

	assetJSON, err := ctx.GetStub().GetState(id)

	if err != nil || assetJSON == nil {

		return nil, fmt.Errorf("资产 %s 不存在", id)

	}

	var asset Asset

	err = json.Unmarshal(assetJSON, &asset)

	return &asset, err

}

// 转移所有权

func (s *SmartContract) TransferAsset(ctx contractapi.TransactionContextInterface, 

	id string, newOwner string) error {

	

	asset, err := s.ReadAsset(ctx, id)

	if err != nil {

		return err

	}

	asset.Owner = newOwner

	assetJSON, _ := json.Marshal(asset)

	return ctx.GetStub().PutState(id, assetJSON)

}

// 查询某人的所有资产

func (s *SmartContract) QueryAssetsByOwner(ctx contractapi.TransactionContextInterface, 

	owner string) ([]*Asset, error) {

	

	// 在链码中简单遍历（仅小规模数据）

	// 大规模需配合 CouchDB 富查询

	results := []*Asset{}

	

	// 使用 GetStateByRange 或 Rich Query

	// 注意：遍历全状态范围在生产中性能差

	// 生产上使用 CouchDB 的 JSON 查询

	

	return results, nil

}

func main() {

	chaincode, _ := contractapi.NewChaincode(&SmartContract{})

	chaincode.Start()

}

## 安装到两个组织的 peer

peer chaincode install -n assettransfer -v 1.0 -p ./

## 批准（每个组织执行一次）

peer lifecycle chaincode approveformyorg \

  -o orderer.example.com:7050 \

  --channelID mychannel \

  --name assettransfer \

  --version 1.0 \

  --package-id $PACKAGE_ID \

  --sequence 1 \

  --signature-policy "OR('Org1MSP.peer', 'Org2MSP.peer')"

  # 即：组织1或组织2的任一peer背书即可

## 提交（任意一个组织提交，当足够多组织已批准）

peer lifecycle chaincode commit ...

## 1. 打包新版本的链码

peer chaincode package assettransfer_v2.tar.gz -p ./ -l golang

## 2. 在所有组织的 peer 上安装

peer chaincode install assettransfer_v2.tar.gz

## 3. 各组织批准新版本（sequence 增加）

peer lifecycle chaincode approveformyorg \

  --name assettransfer \

  --version 2.0 \                    # 语义版本

  --package-id $NEW_PACKAGE_ID \

  --sequence 2 \                     # 序列号必须递增

  --channelID mychannel \

  --signature-policy "OR('Org1MSP.peer','Org2MSP.peer')"

## 4. 检查足够多组织已批准

peer lifecycle chaincode checkcommitreadiness \

  --channelID mychannel \

  --name assettransfer \

  --version 2.0 \

  --sequence 2

## 5. 提交升级（任何组织可以执行）

peer lifecycle chaincode commit \

  --name assettransfer \

  --version 2.0 \

  --sequence 2

// 升级后的 Asset 结构可以添加新字段

// 但必须兼容旧 JSON

// 策略：新版本读取旧数据时填充默认值

type AssetV2 struct {

    // 原有字段保留

    ID          string `json:"id"`

    Color       string `json:"color"`

    // ...

    // 新增字段，omitempty 兼容旧数据

    LastService  string `json:"lastService,omitempty"`

    Status       string `json:"status,omitempty"`

}

## 如果升级后的链码有 bug，影响无法 Invoke

## 可回滚到旧版本（降级）

peer lifecycle chaincode approveformyorg \

  --name assettransfer \

  --version 1.0 --sequence 3  # 降回旧版本，sequence 继续递增

  # ... 然后 commit

/**

 * Fabric Gateway Node.js 后端

 * 将链码调用映射为 REST API

 */

import { Gateway, Wallets, Contract } from 'fabric-gateway';

import * as grpc from '@grpc/grpc-js';

import { readFileSync } from 'fs';

interface ConnectionProfile {

  url: string;

  tlsCACert: string;

  peerName: string;

}

class FabricClientService {

  private gateway: Gateway;

  private contract: Contract;

  

  async connect(profile: ConnectionProfile, userId: string, org: string) {

    // 加载 TLS 根证书

    const tlsRootCert = readFileSync(profile.tlsCACert);

    const client = new grpc.Channel(profile.url, grpc.credentials.createSsl(Buffer.from(tlsRootCert)));

    

    // 加载用户身份钱包

    const wallet = await Wallets.newFileSystemWallet('./wallet');

    const identity = await wallet.get(userId);

    if (!identity) throw new Error(`身份 ${userId} 不存在于钱包`);

    

    // 建立 Gateway 连接

    const gateway = new Gateway()// 内部使用 gRPC

    // 通过 gateway 获取网络与合约

    this.gateway = gateway;

    const network = gateway.getNetwork('mychannel');

    this.contract = network.getContract('assettransfer');

  }

  

  // === 只读查询：evaluate（单个 peer）

  async getAsset(id: string): Promise<Asset> {

    const result = await this.contract.evaluateTransaction('ReadAsset', id);

    return JSON.parse(Buffer.from(result).toString());

  }

  

  // === 写入交易：submit（完整背书→排序→提交）

  async createAsset(asset: Asset): Promise<string> {

    const result = await this.contract.submitTransaction(

      'CreateAsset',

      asset.id,

      asset.color,

      asset.owner,

      asset.size.toString(),

      asset.appraisedValue.toString(),

    );

    // 返回交易 ID

    return Buffer.from(result).toString();

  }

  

  // 转移（需要写交易）

  async transferAsset(id: string, newOwner: string): Promise<string> {

    return this.contract.submitTransaction('TransferAsset', id, newOwner)

      .then(r => Buffer.from(r).toString());

  }

  

  async disconnect() {

    this.gateway.close();

  }

}

// Express REST API 封装

import express from 'express';

const app = express();

const fabric = new FabricClientService();

app.get('/assets/:id', async (req, res) => {

  const asset = await fabric.getAsset(req.params.id);

  res.json(asset);

});

app.post('/assets', async (req, res) => {

  const txId = await fabric.createAsset(req.body);

  res.json({ transactionId: txId, status: 'submitted' });

});

app.put('/assets/:id/transfer', async (req, res) => {

  const txId = await fabric.transferAsset(req.params.id, req.body.newOwner);

  res.json({ transactionId: txId });

});

// 对比：公链中用户用 MetaMask 签名

// 联盟链中后端代签（因为是服务端服务）

// 后端持有用户注册的钱包密钥（或 HSM 托管）

/**

 * Express 路由：资产溯源 API

 */

import express from 'express';

import { FabricClientService } from '../fabric-client';

const router = express.Router();

// 资产 CRUD

router.get('/assets/:id', async (req, res) => {

  const asset = await fabric.getAsset(req.params.id);

  res.json(asset);

});

router.post('/assets', authenticate, authorize('admin'), async (req, res) => {

  const { id, color, size, owner } = req.body;

  const txId = await fabric.createAsset({ id, color, size, owner, appraisedValue: 0 });

  res.status(201).json({ transactionId: txId, status: 'submitted' });

});

router.put('/assets/:id/transfer', async (req, res) => {

  const { newOwner, reason } = req.body;

  const txId = await fabric.transferAsset(req.params.id, newOwner);

  res.json({ transactionId: txId, newOwner, reason });

});

// 溯源查询：时间线

router.get('/assets/:id/history', async (req, res) => {

  const history = await fabric.getAssetHistory(req.params.id);

  // 返回按时间排序的变更事件

  res.json(history.map(h => ({

    txId: h.txId,

    timestamp: h.timestamp,

    owner: h.value.owner,

    change: h.isDelete ? 'deleted' : 'modified',

  })));

});

## collections_config.json

[

  {

    "name": "assetPrivateDetails",

    "policy": "OR('Org1MSP.member')",

    "requiredPeerCount": 1,

    "maxPeerCount": 1,

    "blockToLive": 0,

    "memberOnlyRead": true,

    "endorsementPolicy": {

      "signaturePolicy": "OR('Org1MSP.peer', 'Org2MSP.peer')"

    }

  }

]

// 链码层检查

func (s *SmartContract) ConfidentialOperation(ctx contractapi.TransactionContextInterface, ...) error {

    mspID, _ := ctx.GetClientIdentity().GetMSPID()

    

    if mspID != "Org1MSP" && mspID != "Org2MSP" {

        return fmt.Errorf("unauthorized: %s", mspID)

    }

    

    // 继续执行...

    return nil

}