@lifeready/core 1.0.0 → 1.0.2

package/bundles/lifeready-core.umd.js

@@ -4179,16 +4179,22 @@
         };
         TpPasswordResetProcessorService.prototype.processTpPasswordResetUserApprovalNode = function (approval, pxk) {
             return __awaiter(this, void 0, void 0, function () {
-                var ret;
-                return __generator(this, function (_b) {
-                    ret = Object.assign({}, approval);
-                    if (approval.receiverCipher) {
-                        ret.receiverCipherClearJson = this.keyGraph.decryptFromString(pxk, approval.receiverCipher);
-                    }
-                    if (approval.receiverCipherPartialAssemblyKey) {
-                        ret.receiverCipherPartialAssemblyKeyClearJson = this.keyGraph.decryptFromString(pxk, approval.receiverCipherPartialAssemblyKey);
+                var ret, _b;
+                return __generator(this, function (_c) {
+                    switch (_c.label) {
+                        case 0:
+                            ret = Object.assign({}, approval);
+                            if (approval.receiverCipher) {
+                                ret.receiverCipherClearJson = this.keyGraph.decryptFromString(pxk, approval.receiverCipher);
+                            }
+                            if (!approval.receiverCipherPartialAssemblyKey) return [3 /*break*/, 2];
+                            _b = ret;
+                            return [4 /*yield*/, this.keyGraph.decryptFromString(pxk, approval.receiverCipherPartialAssemblyKey)];
+                        case 1:
+                            _b.receiverCipherPartialAssemblyKeyClearJson = _c.sent();
+                            _c.label = 2;
+                        case 2: return [2 /*return*/, ret];
                     }
-                    return [2 /*return*/, ret];
                 });
             });
         };
@@ -4204,7 +4210,7 @@
                                 ret = Object.assign({}, field);
                                 if (!field.assembly) return [3 /*break*/, 2];
                                 if (field.applied == null) {
-                                    throw new LrBadRequestException('If you request for field "assembly" in the TpPasswordResetNode, then you must also request the "applied" field');
+                                    throw new LrBadRequestException('If you request for field \'assembly\' in the TpPasswordResetNode, then you must also request the \'applied\' field');
                                 }
                                 _b = ret;
                                 return [4 /*yield*/, this.processTpAssemblyNode(field.assembly, field.applied)];
@@ -5032,113 +5038,421 @@
         return LrService;
     }());
 
-    var initialiseAuth = function (authService) {
-        return function () { return authService.initialise(); };
-    };
-    var LifeReadyAuthService = /** @class */ (function () {
-        function LifeReadyAuthService(config, auth, keyFactory, keyService, profileService, keyGraphService, passwordService, idleService, lrGraphQL, tpPasswordResetProcessorService, persistService) {
-            this.config = config;
-            this.auth = auth;
-            this.keyFactory = keyFactory;
-            this.keyService = keyService;
-            this.profileService = profileService;
-            this.keyGraphService = keyGraphService;
-            this.passwordService = passwordService;
-            this.idleService = idleService;
-            this.lrGraphQL = lrGraphQL;
-            this.tpPasswordResetProcessorService = tpPasswordResetProcessorService;
-            this.persistService = persistService;
-            this.hubSubject = new rxjs.ReplaySubject(1);
+    // ------------------------------------------------------
+    // Basic types
+    // ------------------------------------------------------
+    // These types map directory to types of the same name in graphql.
+    // We use these aliases in case in the future we wish to reify the types and do
+    // additional automated conversion.
+
+    var AccessRoleChoice;
+    (function (AccessRoleChoice) {
+        AccessRoleChoice["READER"] = "READER";
+        AccessRoleChoice["WRITER"] = "WRITER";
+        AccessRoleChoice["ADMIN"] = "ADMIN";
+        AccessRoleChoice["DENY"] = "DENY";
+        AccessRoleChoice["OWNER"] = "OWNER";
+    })(AccessRoleChoice || (AccessRoleChoice = {}));
+    var AccessRoleMethod;
+    (function (AccessRoleMethod) {
+        AccessRoleMethod["inherited"] = "inherited";
+        AccessRoleMethod["direct"] = "direct";
+    })(AccessRoleMethod || (AccessRoleMethod = {}));
+    var FileVersionOperation;
+    (function (FileVersionOperation) {
+        FileVersionOperation["CREATE"] = "CREATE";
+        FileVersionOperation["READ"] = "READ";
+        FileVersionOperation["UPDATE"] = "UPDATE";
+        FileVersionOperation["REVERT"] = "REVERT";
+        FileVersionOperation["DELETE"] = "DELETE";
+    })(FileVersionOperation || (FileVersionOperation = {}));
+    var KeyExchangeOtkState;
+    (function (KeyExchangeOtkState) {
+        KeyExchangeOtkState["OTK_INITIATED"] = "OTK_INITIATED";
+        KeyExchangeOtkState["OTK_ACCEPTED"] = "OTK_ACCEPTED";
+        KeyExchangeOtkState["OTK_COMPLETED"] = "OTK_COMPLETED";
+    })(KeyExchangeOtkState || (KeyExchangeOtkState = {}));
+    var KeyExchangeState;
+    (function (KeyExchangeState) {
+        KeyExchangeState["IN_PROGRESS"] = "IN_PROGRESS";
+        KeyExchangeState["COMPLETED"] = "COMPLETED";
+        KeyExchangeState["DECLINED"] = "DECLINED";
+        KeyExchangeState["CANCELLED"] = "CANCELLED";
+        KeyExchangeState["DELETED"] = "DELETED";
+    })(KeyExchangeState || (KeyExchangeState = {}));
+    var KeyExchangeMode;
+    (function (KeyExchangeMode) {
+        KeyExchangeMode["OTK"] = "OTK";
+    })(KeyExchangeMode || (KeyExchangeMode = {}));
+    var TpAssemblyState;
+    (function (TpAssemblyState) {
+        TpAssemblyState["DISABLED"] = "DISABLED";
+        TpAssemblyState["ENABLED"] = "ENABLED";
+        TpAssemblyState["CLAIMED"] = "CLAIMED";
+        TpAssemblyState["APPROVED"] = "APPROVED";
+        TpAssemblyState["REJECTED"] = "REJECTED";
+        TpAssemblyState["EXPIRED"] = "EXPIRED";
+        TpAssemblyState["CANCELLED"] = "CANCELLED";
+        TpAssemblyState["RESET"] = "RESET";
+    })(TpAssemblyState || (TpAssemblyState = {}));
+    var TpClaimState;
+    (function (TpClaimState) {
+        TpClaimState["CLAIMED"] = "CLAIMED";
+        TpClaimState["APPROVED"] = "APPROVED";
+        TpClaimState["REJECTED"] = "REJECTED";
+        TpClaimState["EXPIRED"] = "EXPIRED";
+        TpClaimState["CANCELLED"] = "CANCELLED";
+        TpClaimState["RESET"] = "RESET";
+    })(TpClaimState || (TpClaimState = {}));
+    var TpClaimApproverState;
+    (function (TpClaimApproverState) {
+        TpClaimApproverState["CLAIMED"] = "CLAIMED";
+        TpClaimApproverState["APPROVED"] = "APPROVED";
+        TpClaimApproverState["REJECTED"] = "REJECTED";
+    })(TpClaimApproverState || (TpClaimApproverState = {}));
+    var LockState;
+    (function (LockState) {
+        LockState["UNLOCKED"] = "UNLOCKED";
+        LockState["MUTEX_LOCKED"] = "MUTEX_LOCKED";
+    })(LockState || (LockState = {}));
+
+    var SecretShare = /** @class */ (function () {
+        function SecretShare(assembly, subAssembly, mnemonics) {
+            if (assembly === void 0) { assembly = 0; }
+            if (subAssembly === void 0) { subAssembly = 0; }
+            if (mnemonics === void 0) { mnemonics = ''; }
+            this.assembly = assembly;
+            this.subAssembly = subAssembly;
+            this.mnemonics = mnemonics;
         }
-        LifeReadyAuthService.prototype.initialise = function () {
-            return __awaiter(this, void 0, void 0, function () {
-                var _this = this;
-                return __generator(this, function (_a) {
-                    core$1.Hub.listen('auth', function (data) { return _this.hubSubject.next(data.payload); });
-                    return [2 /*return*/];
-                });
+        return SecretShare;
+    }());
+    var SubAssembly = /** @class */ (function () {
+        function SubAssembly(index, threshold, size) {
+            if (threshold === void 0) { threshold = 0; }
+            if (size === void 0) { size = 0; }
+            this.index = index;
+            this.threshold = threshold;
+            this.size = size;
+            this.clearShares();
+        }
+        SubAssembly.prototype.clearShares = function () {
+            this.shares = Array();
+        };
+        SubAssembly.prototype.addShare = function (share) {
+            this.shares.push(share);
+        };
+        return SubAssembly;
+    }());
+    var Assembly = /** @class */ (function () {
+        function Assembly(threshold) {
+            if (threshold === void 0) { threshold = 0; }
+            this.threshold = threshold;
+            this.clearSubAssemblies();
+        }
+        Assembly.prototype.size = function () {
+            return this.subAssemblies.length;
+        };
+        Assembly.prototype.clearSubAssemblies = function () {
+            this.subAssemblies = new Array();
+        };
+        Assembly.prototype.addSubAssembly = function (subAssembly) {
+            this.subAssemblies.push(subAssembly);
+        };
+        return Assembly;
+    }());
+    var SubQuorum = /** @class */ (function () {
+        function SubQuorum(subAssemblyIndex) {
+            this.subAssemblyIndex = subAssemblyIndex;
+            this.clearShares();
+        }
+        SubQuorum.prototype.clearShares = function () {
+            this.shares = new Array();
+        };
+        SubQuorum.prototype.addShare = function (share) {
+            this.shares.push(share);
+        };
+        return SubQuorum;
+    }());
+    var Quorum = /** @class */ (function () {
+        function Quorum() {
+            this.clearSubQuora();
+        }
+        Quorum.prototype.clearSubQuora = function () {
+            this.subQuora = new Array();
+        };
+        Quorum.prototype.addSubQuorum = function (subQuorum) {
+            this.subQuora.push(subQuorum);
+        };
+        Quorum.prototype.serialiseShares = function () {
+            var shares = [];
+            this.subQuora.forEach(function (subQuorum) {
+                shares = shares.concat(subQuorum.shares);
             });
+            return shares;
         };
-        LifeReadyAuthService.prototype.loginIdpImpl = function (emailOrPhone, password, passIdpParams, recoveryStatus) {
+        return Quorum;
+    }());
+    var Slip39Service = /** @class */ (function () {
+        function Slip39Service() {
+        }
+        Slip39Service.prototype.generateShares = function (secret, passphrase, assembly) {
             return __awaiter(this, void 0, void 0, function () {
-                var passIdpResult, user;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.keyFactory.derivePassIdp(Object.assign({ password: password }, passIdpParams))];
+                var ems, groups, _a, _b, sa, slip;
+                var e_1, _c;
+                return __generator(this, function (_d) {
+                    switch (_d.label) {
+                        case 0:
+                            ems = btoa(secret);
+                            ems = slip39.Slip39Helper.slip39EncodeHex(ems);
+                            groups = [];
+                            try {
+                                for (_a = __values(assembly.subAssemblies), _b = _a.next(); !_b.done; _b = _a.next()) {
+                                    sa = _b.value;
+                                    groups.push([sa.threshold, sa.size]);
+                                }
+                            }
+                            catch (e_1_1) { e_1 = { error: e_1_1 }; }
+                            finally {
+                                try {
+                                    if (_b && !_b.done && (_c = _a.return)) _c.call(_a);
+                                }
+                                finally { if (e_1) throw e_1.error; }
+                            }
+                            return [4 /*yield*/, slip39.Slip39.fromArray(ems, {
+                                    passphrase: passphrase,
+                                    threshold: assembly.threshold,
+                                    groups: groups,
+                                    title: '',
+                                })];
                         case 1:
-                            passIdpResult = _a.sent();
-                            return [4 /*yield*/, this.auth.signIn(emailOrPhone, this.passwordService.getPassIdpString(passIdpResult.jwk))];
-                        case 2:
-                            user = _a.sent();
-                            user.recoveryStatus = recoveryStatus;
-                            return [2 /*return*/, user];
+                            slip = _d.sent();
+                            // Extract shares
+                            assembly.subAssemblies.forEach(function (sa, isa) {
+                                // Remove any existing shares
+                                sa.clearShares();
+                                for (var im = 0; im < sa.size; im++) {
+                                    // Construct the path to the share, formatted as "r/<subassembly index>/<member index>"
+                                    // with <subassembly index> and <member index> being two-digit, zero-padded integers.
+                                    var path = 'r/' +
+                                        isa.toString().padStart(2, '0') +
+                                        '/' +
+                                        im.toString().padStart(2, '0');
+                                    var mnemonics = slip.fromPath(path).mnemonics[0];
+                                    var share = new SecretShare(isa, im, mnemonics);
+                                    sa.addShare(share);
+                                }
+                            });
+                            return [2 /*return*/];
                     }
                 });
             });
         };
-        LifeReadyAuthService.prototype.loginIdp = function (emailOrPhone, password) {
-            return __awaiter(this, void 0, void 0, function () {
-                var passIdpApiResult, user, error_1, user, error_2, reset, ret, err_1;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.profileService.getPassIdpParams(emailOrPhone)];
-                        case 1:
-                            passIdpApiResult = _a.sent();
-                            if (passIdpApiResult.passwordChangeStatus === exports.PasswordChangeStatus.InProgress) {
-                                throw new LrConcurrentAccessException('A password change is in progress');
-                            }
-                            if (!(passIdpApiResult.passwordChangeStatus === exports.PasswordChangeStatus.Recovery)) return [3 /*break*/, 8];
+        // Remove all redundant shares. i.e. keep only enough members and groups to satisfy the thresholds.
+        Slip39Service.prototype.minimalSet = function (mnemonics) {
+            var e_2, _a, e_3, _b;
+            // Decode the mnemonics and sort then into groups.
+            var groupThresh = null;
+            var groups = new Map();
+            try {
+                for (var mnemonics_1 = __values(mnemonics), mnemonics_1_1 = mnemonics_1.next(); !mnemonics_1_1.done; mnemonics_1_1 = mnemonics_1.next()) {
+                    var mnemonic = mnemonics_1_1.value;
+                    var decoded = slip39.Slip39Helper.decodeMnemonic(mnemonic);
+                    if (groupThresh && groupThresh !== decoded.groupThreshold) {
+                        throw new Error('groupThreshold is different in mnemonics');
+                    }
+                    groupThresh = decoded.groupThreshold;
+                    // Note that Slip39.recoverSecret() will do all the error checking again. So it's not critical
+                    // that we error check here. So we just optimistically assume it's all good.
+                    var g = groups.get(decoded.groupIndex);
+                    if (g == null) {
+                        g = {
+                            memberThreshold: decoded.memberThreshold,
+                            members: [],
+                        };
+                        groups.set(decoded.groupIndex, g);
+                    }
+                    g.members.push({
+                        mnemonic: mnemonic,
+                        decoded: decoded,
+                    });
+                }
+            }
+            catch (e_2_1) { e_2 = { error: e_2_1 }; }
+            finally {
+                try {
+                    if (mnemonics_1_1 && !mnemonics_1_1.done && (_a = mnemonics_1.return)) _a.call(mnemonics_1);
+                }
+                finally { if (e_2) throw e_2.error; }
+            }
+            // Keep the minimum set of groups that meet threshold.
+            var mnemonicsMinSet = [];
+            var groupCount = 0;
+            try {
+                for (var _c = __values(groups.values()), _d = _c.next(); !_d.done; _d = _c.next()) {
+                    var g = _d.value;
+                    // Keep only groups that meet threshold
+                    if (g.members.length < g.memberThreshold) {
+                        continue;
+                    }
+                    // Keep minimum number of approvals needed for group
+                    g.members.slice(0, g.memberThreshold).forEach(function (member) {
+                        mnemonicsMinSet.push(member.mnemonic);
+                    });
+                    ++groupCount;
+                    if (groupCount >= groupThresh) {
+                        break;
+                    }
+                }
+            }
+            catch (e_3_1) { e_3 = { error: e_3_1 }; }
+            finally {
+                try {
+                    if (_d && !_d.done && (_b = _c.return)) _b.call(_c);
+                }
+                finally { if (e_3) throw e_3.error; }
+            }
+            return mnemonicsMinSet;
+        };
+        Slip39Service.prototype.recoverSecret = function (shares, passphrase) {
+            return __awaiter(this, void 0, void 0, function () {
+                var recovered, secret;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            shares = this.minimalSet(shares);
+                            return [4 /*yield*/, slip39.Slip39.recoverSecret(shares, passphrase)];
+                        case 1:
+                            recovered = _a.sent();
+                            secret = slip39.Slip39Helper.slip39DecodeHex(recovered);
+                            return [2 /*return*/, atob(secret)];
+                    }
+                });
+            });
+        };
+        return Slip39Service;
+    }());
+    Slip39Service.ɵprov = i0.ɵɵdefineInjectable({ factory: function Slip39Service_Factory() { return new Slip39Service(); }, token: Slip39Service, providedIn: "root" });
+    Slip39Service.decorators = [
+        { type: i0.Injectable, args: [{
+                    providedIn: 'root',
+                },] }
+    ];
+    Slip39Service.ctorParameters = function () { return []; };
+
+    var TP_PASSWORD_RESET_CLIENT_NONCE_LENGTH = 32;
+    var TP_PASSWORD_RESET_SLIP39_PASSPHRASE = 'lifeready';
+    var TP_PASSWORD_RESET_USERNAME_SUFFIX = '.tp_password_reset';
+
+    var initialiseAuth = function (authService) {
+        return function () { return authService.initialise(); };
+    };
+    var LifeReadyAuthService = /** @class */ (function () {
+        function LifeReadyAuthService(config, auth, keyFactory, keyService, profileService, keyGraphService, passwordService, idleService, lrGraphQL, tpPasswordResetProcessorService, persistService, encryptionService, slip39Service) {
+            this.config = config;
+            this.auth = auth;
+            this.keyFactory = keyFactory;
+            this.keyService = keyService;
+            this.profileService = profileService;
+            this.keyGraphService = keyGraphService;
+            this.passwordService = passwordService;
+            this.idleService = idleService;
+            this.lrGraphQL = lrGraphQL;
+            this.tpPasswordResetProcessorService = tpPasswordResetProcessorService;
+            this.persistService = persistService;
+            this.encryptionService = encryptionService;
+            this.slip39Service = slip39Service;
+            this.hubSubject = new rxjs.ReplaySubject(1);
+        }
+        LifeReadyAuthService.prototype.initialise = function () {
+            return __awaiter(this, void 0, void 0, function () {
+                var _this = this;
+                return __generator(this, function (_b) {
+                    core$1.Hub.listen('auth', function (data) { return _this.hubSubject.next(data.payload); });
+                    return [2 /*return*/];
+                });
+            });
+        };
+        LifeReadyAuthService.prototype.loginIdpImpl = function (emailOrPhone, password, passIdpParams, recoveryStatus) {
+            return __awaiter(this, void 0, void 0, function () {
+                var passIdpResult, user;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
+                        case 0: return [4 /*yield*/, this.keyFactory.derivePassIdp(Object.assign({ password: password }, passIdpParams))];
+                        case 1:
+                            passIdpResult = _b.sent();
+                            return [4 /*yield*/, this.auth.signIn(emailOrPhone, this.passwordService.getPassIdpString(passIdpResult.jwk))];
+                        case 2:
+                            user = _b.sent();
+                            user.recoveryStatus = recoveryStatus;
+                            return [2 /*return*/, user];
+                    }
+                });
+            });
+        };
+        LifeReadyAuthService.prototype.loginIdp = function (emailOrPhone, password) {
+            return __awaiter(this, void 0, void 0, function () {
+                var passIdpApiResult, user, error_1, user, error_2, reset, ret, err_1;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
+                        case 0: return [4 /*yield*/, this.profileService.getPassIdpParams(emailOrPhone)];
+                        case 1:
+                            passIdpApiResult = _b.sent();
+                            if (passIdpApiResult.passwordChangeStatus === exports.PasswordChangeStatus.InProgress) {
+                                throw new LrConcurrentAccessException('A password change is in progress');
+                            }
+                            if (!(passIdpApiResult.passwordChangeStatus === exports.PasswordChangeStatus.Recovery)) return [3 /*break*/, 8];
                             console.log('In recovery mode.');
-                            _a.label = 2;
+                            _b.label = 2;
                         case 2:
-                            _a.trys.push([2, 4, , 5]);
+                            _b.trys.push([2, 4, , 5]);
                             return [4 /*yield*/, this.loginIdpImpl(emailOrPhone, password, passIdpApiResult.newPassIdpParams, exports.RecoveryStatus.NEW_PASSWORD)];
                         case 3:
-                            user = _a.sent();
+                            user = _b.sent();
                             // New password worked. Let's set to the current password
                             // --Potential Failure Point 1--
                             // if changePasswordComplete() doesn't get called, then it should remain
                             console.log('New password works!');
                             return [2 /*return*/, user];
                         case 4:
-                            error_1 = _a.sent();
+                            error_1 = _b.sent();
                             // Just bubble up any other type of error.
                             if (error_1.code !== 'NotAuthorizedException') {
                                 throw error_1;
                             }
                             return [3 /*break*/, 5];
                         case 5:
-                            _a.trys.push([5, 7, , 8]);
+                            _b.trys.push([5, 7, , 8]);
                             return [4 /*yield*/, this.loginIdpImpl(emailOrPhone, password, passIdpApiResult.currentPassIdpParams, exports.RecoveryStatus.OLD_PASSWORD)];
                         case 6:
-                            user = _a.sent();
+                            user = _b.sent();
                             // Old password worked.
                             console.log('Old password works!');
                             return [2 /*return*/, user];
                         case 7:
-                            error_2 = _a.sent();
+                            error_2 = _b.sent();
                             // Just bubble up any other type of error.
                             throw error_2.code === 'NotAuthorizedException'
                                 ? new LrBadRequestException('The password change request was interrupted, please try to login with both your new and old password')
                                 : error_2;
                         case 8:
                             if (!passIdpApiResult.tpPasswordReset) return [3 /*break*/, 12];
-                            _a.label = 9;
+                            _b.label = 9;
                         case 9:
-                            _a.trys.push([9, 11, , 12]);
+                            _b.trys.push([9, 11, , 12]);
                             reset = passIdpApiResult.tpPasswordReset;
                             return [4 /*yield*/, this.loginIdpImpl(reset.resetUsername, password, reset.passIdpParams, exports.RecoveryStatus.NONE)];
                         case 10:
-                            ret = _a.sent();
+                            ret = _b.sent();
                             ret.isTpPasswordResetUser = true;
                             return [2 /*return*/, ret];
                         case 11:
-                            err_1 = _a.sent();
+                            err_1 = _b.sent();
                             return [3 /*break*/, 12];
                         case 12: return [4 /*yield*/, this.loginIdpImpl(emailOrPhone, password, passIdpApiResult.currentPassIdpParams, exports.RecoveryStatus.NONE)];
                         case 13: 
                         // Login as regular user
-                        return [2 /*return*/, _a.sent()];
+                        return [2 /*return*/, _b.sent()];
                     }
                 });
             });
@@ -5146,8 +5460,8 @@
         LifeReadyAuthService.prototype.handleSessionEncryptionKey = function () {
             return __awaiter(this, void 0, void 0, function () {
                 var msg, sessionEncryptionKey;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
                             if (!this.config.disableSessionEncryptionKey) return [3 /*break*/, 1];
                             if (!i0.isDevMode()) {
@@ -5161,7 +5475,7 @@
                             return [3 /*break*/, 4];
                         case 1: return [4 /*yield*/, this.keyFactory.createKey()];
                         case 2:
-                            sessionEncryptionKey = _a.sent();
+                            sessionEncryptionKey = _b.sent();
                             return [4 /*yield*/, this.lrGraphQL.lrMutate(new LrMutation({
                                     mutation: SetSessionEncryptionKeyMutation,
                                     variables: {
@@ -5173,9 +5487,9 @@
                                     includeKeyGraph: false,
                                 })];
                         case 3:
-                            _a.sent();
+                            _b.sent();
                             this.persistService.setServerSessionEncryptionKey(sessionEncryptionKey);
-                            _a.label = 4;
+                            _b.label = 4;
                         case 4: return [2 /*return*/];
                     }
                 });
@@ -5183,45 +5497,72 @@
         };
         LifeReadyAuthService.prototype.handlePostAuth = function (cognitoUser) {
             return __awaiter(this, void 0, void 0, function () {
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0: return [4 /*yield*/, this.handlePasswordRecovery(cognitoUser)];
                         case 1:
-                            _a.sent();
+                            _b.sent();
                             return [4 /*yield*/, this.handleSessionEncryptionKey()];
                         case 2:
-                            _a.sent();
+                            _b.sent();
                             return [2 /*return*/];
                     }
                 });
             });
         };
-        LifeReadyAuthService.prototype.login = function (emailOrPhone, password) {
+        LifeReadyAuthService.prototype.login = function (emailOrPhone, password, _b) {
+            var _c = (_b === void 0 ? {} : _b).tpPasswordResetAutoComplete, tpPasswordResetAutoComplete = _c === void 0 ? true : _c;
+            var _a;
+            return __awaiter(this, void 0, void 0, function () {
+                var loginResult;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
+                        case 0: return [4 /*yield*/, this.loginImpl(emailOrPhone, password)];
+                        case 1:
+                            loginResult = _b.sent();
+                            if (!(tpPasswordResetAutoComplete &&
+                                ((_a = loginResult.resetUser) === null || _a === void 0 ? void 0 : _a.state) === TpClaimState.APPROVED)) return [3 /*break*/, 4];
+                            return [4 /*yield*/, this.completeRequest(password)];
+                        case 2:
+                            _b.sent();
+                            return [4 /*yield*/, this.loginImpl(emailOrPhone, password)];
+                        case 3:
+                            loginResult = _b.sent();
+                            _b.label = 4;
+                        case 4: return [2 /*return*/, loginResult];
+                    }
+                });
+            });
+        };
+        LifeReadyAuthService.prototype.loginImpl = function (emailOrPhone, password) {
             return __awaiter(this, void 0, void 0, function () {
                 var cognitoUser, resetUser, user;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.loginIdp(emailOrPhone, password)];
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
+                        case 0: return [4 /*yield*/, this.logout()];
                         case 1:
-                            cognitoUser = _a.sent();
+                            _b.sent();
+                            return [4 /*yield*/, this.loginIdp(emailOrPhone, password)];
+                        case 2:
+                            cognitoUser = _b.sent();
                             // todo: Meet MFA challenges.
                             if (['SMS_MFA', 'SOFTWARE_TOKEN_MFA'].includes(cognitoUser.challengeName)) {
                                 return [2 /*return*/, { hasChallenge: true, challenge: cognitoUser }];
                             }
                             return [4 /*yield*/, this.handlePostAuth(cognitoUser)];
-                        case 2:
-                            _a.sent();
-                            if (!cognitoUser.isTpPasswordResetUser) return [3 /*break*/, 4];
-                            return [4 /*yield*/, this.loadResetUser(password)];
                         case 3:
-                            resetUser = _a.sent();
+                            _b.sent();
+                            if (!cognitoUser.isTpPasswordResetUser) return [3 /*break*/, 5];
+                            return [4 /*yield*/, this.loadResetUser(password)];
+                        case 4:
+                            resetUser = _b.sent();
                             return [2 /*return*/, { hasChallenge: false, resetUser: resetUser }];
-                        case 4: return [4 /*yield*/, this.loadUser(cognitoUser, password)];
-                        case 5:
-                            user = _a.sent();
-                            return [4 /*yield*/, this.idleService.start()];
+                        case 5: return [4 /*yield*/, this.loadUser(cognitoUser, password)];
                         case 6:
-                            _a.sent(); // Run idleService whenever user is logged in.
+                            user = _b.sent();
+                            return [4 /*yield*/, this.idleService.start()];
+                        case 7:
+                            _b.sent(); // Run idleService whenever user is logged in.
                             return [2 /*return*/, { hasChallenge: false, user: user }];
                     }
                 });
@@ -5231,20 +5572,20 @@
         LifeReadyAuthService.prototype.verifyLogin = function (challenge, password, rememberMe, code) {
             return __awaiter(this, void 0, void 0, function () {
                 var cognitoUser, user;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0: return [4 /*yield*/, this.auth.confirmSignIn(challenge, code, challenge.challengeName)];
                         case 1:
-                            _a.sent();
+                            _b.sent();
                             return [4 /*yield*/, this.auth.currentAuthenticatedUser()];
                         case 2:
-                            cognitoUser = _a.sent();
+                            cognitoUser = _b.sent();
                             return [4 /*yield*/, this.handlePostAuth(challenge)];
                         case 3:
-                            _a.sent();
+                            _b.sent();
                             return [4 /*yield*/, this.loadUser(cognitoUser, password)];
                         case 4:
-                            user = _a.sent();
+                            user = _b.sent();
                             if (rememberMe) {
                                 cognitoUser.setDeviceStatusRemembered({
                                     onSuccess: function () { },
@@ -5259,8 +5600,8 @@
         LifeReadyAuthService.prototype.handlePasswordRecovery = function (user) {
             return __awaiter(this, void 0, void 0, function () {
                 var jwtToken;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
                             if (!(user.recoveryStatus !== exports.RecoveryStatus.NONE)) return [3 /*break*/, 2];
                             jwtToken = user
@@ -5269,33 +5610,75 @@
                                 .getJwtToken();
                             return [4 /*yield*/, this.passwordService.changePasswordComplete(jwtToken, user.recoveryStatus === exports.RecoveryStatus.NEW_PASSWORD)];
                         case 1:
-                            _a.sent();
-                            _a.label = 2;
+                            _b.sent();
+                            _b.label = 2;
                         case 2: return [2 /*return*/];
                     }
                 });
             });
         };
-        LifeReadyAuthService.prototype.getUser = function (reload) {
+        LifeReadyAuthService.prototype.getUserOrResetUser = function (reload) {
             if (reload === void 0) { reload = false; }
             return __awaiter(this, void 0, void 0, function () {
-                var _a, _b;
+                var cognitoUser;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
+                        case 0: return [4 /*yield*/, this.auth.currentAuthenticatedUser()];
+                        case 1:
+                            cognitoUser = _b.sent();
+                            if (cognitoUser.getUsername().endsWith(TP_PASSWORD_RESET_USERNAME_SUFFIX)) {
+                                return [2 /*return*/, this.getResetUser(reload)];
+                            }
+                            else {
+                                return [2 /*return*/, this.getUser(reload)];
+                            }
+                            return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        LifeReadyAuthService.prototype.getResetUser = function (reload) {
+            if (reload === void 0) { reload = false; }
+            return __awaiter(this, void 0, void 0, function () {
+                var _b;
                 return __generator(this, function (_c) {
                     switch (_c.label) {
+                        case 0:
+                            if (!reload && this.currentResetUser) {
+                                return [2 /*return*/, this.currentResetUser];
+                            }
+                            _b = this;
+                            return [4 /*yield*/, this.loadResetUser()];
+                        case 1:
+                            _b.currentResetUser = _c.sent();
+                            return [4 /*yield*/, this.idleService.start()];
+                        case 2:
+                            _c.sent(); // Run idleService whenever user is logged in.
+                            return [2 /*return*/, this.currentResetUser];
+                    }
+                });
+            });
+        };
+        LifeReadyAuthService.prototype.getUser = function (reload) {
+            if (reload === void 0) { reload = false; }
+            return __awaiter(this, void 0, void 0, function () {
+                var _b, _c;
+                return __generator(this, function (_d) {
+                    switch (_d.label) {
                         case 0:
                             if (!reload && this.currentUser) {
                                 return [2 /*return*/, this.currentUser];
                             }
-                            _a = this;
-                            _b = this.loadUser;
+                            _b = this;
+                            _c = this.loadUser;
                             return [4 /*yield*/, this.auth.currentAuthenticatedUser()];
-                        case 1: return [4 /*yield*/, _b.apply(this, [_c.sent()])];
+                        case 1: return [4 /*yield*/, _c.apply(this, [_d.sent()])];
                         case 2:
-                            _a.currentUser = _c.sent();
+                            _b.currentUser = _d.sent();
                             console.log('Starting idle service.');
                             return [4 /*yield*/, this.idleService.start()];
                         case 3:
-                            _c.sent(); // Run idleService whenever user is logged in.
+                            _d.sent(); // Run idleService whenever user is logged in.
                             return [2 /*return*/, this.currentUser];
                     }
                 });
@@ -5308,35 +5691,35 @@
         };
         LifeReadyAuthService.prototype.loadUser = function (cognitoUser, password) {
             return __awaiter(this, void 0, void 0, function () {
-                var _a, currentUser, contactCard, userPlans, _b, _c, userAttributes, passKey, _d, _e, _f, _g, _h, _j;
-                return __generator(this, function (_k) {
-                    switch (_k.label) {
+                var _b, currentUser, contactCard, userPlans, _c, _d, userAttributes, passKey, _e, _f, _g, _h, _j, _k;
+                return __generator(this, function (_l) {
+                    switch (_l.label) {
                         case 0: return [4 /*yield*/, this.profileService.getCurrentUser()];
                         case 1:
-                            _a = _k.sent(), currentUser = _a.currentUser, contactCard = _a.contactCard, userPlans = _a.userPlans;
+                            _b = _l.sent(), currentUser = _b.currentUser, contactCard = _b.contactCard, userPlans = _b.userPlans;
                             if (!currentUser.sessionEncryptionKey) return [3 /*break*/, 3];
-                            _c = (_b = this.persistService).setServerSessionEncryptionKey;
+                            _d = (_c = this.persistService).setServerSessionEncryptionKey;
                             return [4 /*yield*/, nodeJose.JWK.asKey(currentUser.sessionEncryptionKey)];
                         case 2:
-                            _c.apply(_b, [_k.sent()]);
-                            _k.label = 3;
+                            _d.apply(_c, [_l.sent()]);
+                            _l.label = 3;
                         case 3: return [4 /*yield*/, this.auth.userAttributes(cognitoUser)];
                         case 4:
-                            userAttributes = _k.sent();
+                            userAttributes = _l.sent();
                             if (!password) return [3 /*break*/, 8];
                             return [4 /*yield*/, this.keyFactory.derivePassKey(Object.assign({ password: password }, currentUser.currentUserKey.passKey.passKeyParams))];
                         case 5:
-                            passKey = (_k.sent()).jwk;
-                            _e = (_d = this.idleService).persistMasterKey;
+                            passKey = (_l.sent()).jwk;
+                            _f = (_e = this.idleService).persistMasterKey;
                             return [4 /*yield*/, this.keyGraphService.unwrapWithPassKey(currentUser.currentUserKey.passKey.id, passKey, currentUser.currentUserKey.masterKey.id)];
-                        case 6: return [4 /*yield*/, _e.apply(_d, [_k.sent()])];
+                        case 6: return [4 /*yield*/, _f.apply(_e, [_l.sent()])];
                         case 7:
-                            _k.sent();
-                            _k.label = 8;
+                            _l.sent();
+                            _l.label = 8;
                         case 8: return [4 /*yield*/, this.keyGraphService.populateKeys(currentUser.currentUserKey)];
                         case 9:
-                            _k.sent();
-                            _f = {
+                            _l.sent();
+                            _g = {
                                 id: currentUser.id,
                                 sub: this.getUserAttribute('sub', userAttributes),
                                 username: currentUser.username,
@@ -5348,16 +5731,16 @@
                                 phoneVerified: this.getUserAttribute('phone_number_verified', userAttributes) ===
                                     'true'
                             };
-                            _h = (_g = Object).assign;
-                            _j = [{}];
+                            _j = (_h = Object).assign;
+                            _k = [{}];
                             return [4 /*yield*/, this.profileService.decryptContactCard(contactCard)];
-                        case 10: return [2 /*return*/, (_f.contactCard = _h.apply(_g, _j.concat([(_k.sent())])),
-                                _f.userDelete = currentUser.userDelete,
-                                _f.userPlans = userPlans,
-                                _f.hasTPVaultAccess = this.mapTPVaultAccess(currentUser.features),
-                                _f.features = currentUser.features,
-                                _f.sessionEncryptionKey = currentUser.sessionEncryptionKey,
-                                _f)];
+                        case 10: return [2 /*return*/, (_g.contactCard = _j.apply(_h, _k.concat([(_l.sent())])),
+                                _g.userDelete = currentUser.userDelete,
+                                _g.userPlans = userPlans,
+                                _g.hasTPVaultAccess = this.mapTPVaultAccess(currentUser.features),
+                                _g.features = currentUser.features,
+                                _g.sessionEncryptionKey = currentUser.sessionEncryptionKey,
+                                _g)];
                     }
                 });
             });
@@ -5367,15 +5750,15 @@
         };
         LifeReadyAuthService.prototype.logout = function () {
             return __awaiter(this, void 0, void 0, function () {
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
                             this.currentUser = null;
                             this.keyService.purgeKeys();
                             this.keyGraphService.purgeKeys();
                             return [4 /*yield*/, Promise.all([this.auth.signOut(), this.profileService.signOut()])];
                         case 1:
-                            _a.sent();
+                            _b.sent();
                             return [2 /*return*/];
                     }
                 });
@@ -5387,31 +5770,31 @@
         };
         LifeReadyAuthService.prototype.loadResetUser = function (password) {
             return __awaiter(this, void 0, void 0, function () {
-                var resetUser, _a, _b, passKey, _c, _d, userAttributes, _e, _f, sub, _g, _h, _j, _k, _l;
-                return __generator(this, function (_m) {
-                    switch (_m.label) {
+                var resetUser, _b, _c, passKey, _d, _e, userAttributes, _f, _g, sub, _h, _j, _k, _l, _m;
+                return __generator(this, function (_o) {
+                    switch (_o.label) {
                         case 0: return [4 /*yield*/, this.lrGraphQL.query({
                                 query: TpPasswordResetUserQuery,
                             })];
                         case 1:
-                            resetUser = (_m.sent()).tpPasswordResetUser;
+                            resetUser = (_o.sent()).tpPasswordResetUser;
                             if (!resetUser.sessionEncryptionKey) return [3 /*break*/, 3];
-                            _b = (_a = this.persistService).setServerSessionEncryptionKey;
+                            _c = (_b = this.persistService).setServerSessionEncryptionKey;
                             return [4 /*yield*/, nodeJose.JWK.asKey(resetUser.sessionEncryptionKey)];
                         case 2:
-                            _b.apply(_a, [_m.sent()]);
-                            _m.label = 3;
+                            _c.apply(_b, [_o.sent()]);
+                            _o.label = 3;
                         case 3:
                             if (!password) return [3 /*break*/, 7];
                             return [4 /*yield*/, this.keyFactory.derivePassKey(Object.assign({ password: password }, resetUser.passKey.passKeyParams))];
                         case 4:
-                            passKey = (_m.sent()).jwk;
-                            _d = (_c = this.idleService).persistMasterKey;
+                            passKey = (_o.sent()).jwk;
+                            _e = (_d = this.idleService).persistMasterKey;
                             return [4 /*yield*/, this.keyGraphService.unwrapWithPassKey(resetUser.passKey.id, passKey, resetUser.masterKey.id)];
-                        case 5: return [4 /*yield*/, _d.apply(_c, [_m.sent()])];
+                        case 5: return [4 /*yield*/, _e.apply(_d, [_o.sent()])];
                         case 6:
-                            _m.sent();
-                            _m.label = 7;
+                            _o.sent();
+                            _o.label = 7;
                         case 7:
                             this.keyService.populateKeys({
                                 passKey: {
@@ -5421,17 +5804,17 @@
                                     id: resetUser.masterKey.id,
                                 },
                             });
-                            _f = (_e = this.auth).userAttributes;
+                            _g = (_f = this.auth).userAttributes;
                             return [4 /*yield*/, this.auth.currentAuthenticatedUser()];
-                        case 8: return [4 /*yield*/, _f.apply(_e, [_m.sent()])];
+                        case 8: return [4 /*yield*/, _g.apply(_f, [_o.sent()])];
                         case 9:
-                            userAttributes = _m.sent();
+                            userAttributes = _o.sent();
                             sub = this.getUserAttribute('sub', userAttributes);
-                            _h = (_g = Object).assign;
-                            _k = (_j = Object).assign;
-                            _l = [{}];
+                            _j = (_h = Object).assign;
+                            _l = (_k = Object).assign;
+                            _m = [{}];
                             return [4 /*yield*/, this.tpPasswordResetProcessorService.processTpPasswordResetUserNode(resetUser)];
-                        case 10: return [2 /*return*/, _h.apply(_g, [_k.apply(_j, _l.concat([(_m.sent())])), { sub: sub }])];
+                        case 10: return [2 /*return*/, _j.apply(_h, [_l.apply(_k, _m.concat([(_o.sent())])), { sub: sub }])];
                     }
                 });
             });
@@ -5439,11 +5822,11 @@
         LifeReadyAuthService.prototype.refreshAccessToken = function () {
             return __awaiter(this, void 0, void 0, function () {
                 var cognitoUser, refreshToken;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0: return [4 /*yield*/, this.auth.currentAuthenticatedUser()];
                         case 1:
-                            cognitoUser = _a.sent();
+                            cognitoUser = _b.sent();
                             refreshToken = cognitoUser.getSignInUserSession().getRefreshToken();
                             return [2 /*return*/, new Promise(function (resolve, reject) {
                                     cognitoUser.refreshSession(refreshToken, function (err, data) {
@@ -5456,14 +5839,175 @@
                                             resolve(0);
                                         }
                                     });
-                                })];
+                                })];
+                    }
+                });
+            });
+        };
+        LifeReadyAuthService.prototype.completeRequest = function (newPassword) {
+            return __awaiter(this, void 0, void 0, function () {
+                var resetUser, assemblyKey, rootKey, rootKeyJwk, masterKey, masterKeyWrappedRootKey, newPassIdpResult, newIdpPassword, challenge, assemblyKeyVerifierPrk, signedChallenge, tempIdpPassword, retPromise, user;
+                var _this = this;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
+                        case 0: return [4 /*yield*/, this.getResetUser(true)];
+                        case 1:
+                            resetUser = _b.sent();
+                            if (resetUser.state !== TpClaimState.APPROVED) {
+                                throw new LrBadStateException('Password reset request has not been approved.');
+                            }
+                            return [4 /*yield*/, this.recoverAssemblyKey(resetUser)];
+                        case 2:
+                            assemblyKey = _b.sent();
+                            return [4 /*yield*/, this.encryptionService.decrypt(assemblyKey, resetUser.assemblyCipherData)];
+                        case 3:
+                            rootKey = (_b.sent()).rootKey;
+                            console.log(rootKey);
+                            return [4 /*yield*/, nodeJose.JWK.asKey(rootKey)];
+                        case 4:
+                            rootKeyJwk = _b.sent();
+                            return [4 /*yield*/, this.keyGraphService.getKey(resetUser.masterKey.id)];
+                        case 5:
+                            masterKey = _b.sent();
+                            return [4 /*yield*/, this.encryptionService.encryptToString(masterKey.jwk, rootKeyJwk.toJSON(true))];
+                        case 6:
+                            masterKeyWrappedRootKey = _b.sent();
+                            return [4 /*yield*/, this.keyFactory.derivePassIdp(Object.assign({ password: newPassword }, resetUser.passKey.passIdpParams))];
+                        case 7:
+                            newPassIdpResult = _b.sent();
+                            newIdpPassword = this.passwordService.getPassIdpString(newPassIdpResult.jwk);
+                            return [4 /*yield*/, this.lrGraphQL.lrMutate(new LrMutation({
+                                    mutation: CreateTpAssemblyKeyChallengeMutation,
+                                    variables: {
+                                        input: {},
+                                    },
+                                }), {
+                                    includeKeyGraph: false,
+                                })];
+                        case 8:
+                            challenge = (_b.sent()).createTpAssemblyKeyChallenge.challenge;
+                            console.log(challenge);
+                            // Sign the challenge
+                            // Generate a client side nonce that's no in the server's control.
+                            challenge.clientNonce = this.keyFactory.randomString(TP_PASSWORD_RESET_CLIENT_NONCE_LENGTH);
+                            console.log(challenge);
+                            return [4 /*yield*/, this.encryptionService.decrypt(assemblyKey, resetUser.wrappedAssemblyKeyVerifierPrk)];
+                        case 9:
+                            assemblyKeyVerifierPrk = _b.sent();
+                            return [4 /*yield*/, this.encryptionService.sign(assemblyKeyVerifierPrk, challenge)];
+                        case 10:
+                            signedChallenge = _b.sent();
+                            return [4 /*yield*/, this.lrGraphQL.lrMutate(new LrMutation({
+                                    mutation: PreCompleteTpPasswordResetRequestMutation,
+                                    variables: {
+                                        input: {
+                                            signedChallenge: JSON.stringify(signedChallenge),
+                                        },
+                                    },
+                                }), {
+                                    includeKeyGraph: false,
+                                })];
+                        case 11:
+                            tempIdpPassword = (_b.sent()).preCompleteTpPasswordResetRequest.idpPassword;
+                            retPromise = new Promise(function (resolve) {
+                                var listener = function (data) { return __awaiter(_this, void 0, void 0, function () {
+                                    return __generator(this, function (_b) {
+                                        switch (_b.label) {
+                                            case 0:
+                                                if (data.payload.event !== 'signIn') {
+                                                    return [2 /*return*/];
+                                                }
+                                                core$1.Hub.remove('auth', listener);
+                                                console.log(data.payload);
+                                                return [4 /*yield*/, this.auth.signIn(resetUser.username, newIdpPassword)];
+                                            case 1:
+                                                _b.sent();
+                                                // Switch over to the new set of keys
+                                                return [4 /*yield*/, this.lrGraphQL.lrMutate(new LrMutation({
+                                                        mutation: CompleteTpPasswordResetRequestMutation,
+                                                        variables: {
+                                                            input: {
+                                                                masterKeyWrappedRootKey: masterKeyWrappedRootKey,
+                                                                masterKeyId: masterKey.id,
+                                                            },
+                                                        },
+                                                    }))];
+                                            case 2:
+                                                // Switch over to the new set of keys
+                                                _b.sent();
+                                                resolve();
+                                                return [2 /*return*/];
+                                        }
+                                    });
+                                }); };
+                                core$1.Hub.listen('auth', listener);
+                            });
+                            return [4 /*yield*/, this.auth.signIn(resetUser.username, tempIdpPassword, {
+                                    noProxy: 'true',
+                                })];
+                        case 12:
+                            user = _b.sent();
+                            if (user.challengeName !== 'NEW_PASSWORD_REQUIRED') {
+                                throw new LrException({
+                                    message: 'Internal error. Expecting Cognito to have done a password reset after call to PreCompleteTpPasswordResetRequestMutation.',
+                                });
+                            }
+                            return [4 /*yield*/, this.auth.completeNewPassword(user, newIdpPassword, {})];
+                        case 13:
+                            // Set new password on Idp
+                            // the awsFetch() function passes NEW_PASSWORD_REQUIRED directly to AWS without
+                            // going through the proxy.
+                            user = _b.sent();
+                            return [2 /*return*/, retPromise];
+                    }
+                });
+            });
+        };
+        LifeReadyAuthService.prototype.recoverAssemblyKey = function (resetUser) {
+            return __awaiter(this, void 0, void 0, function () {
+                var assemblyKeyParams, prk, shares, rawAssemblyKey;
+                var _this = this;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
+                        case 0: return [4 /*yield*/, this.keyGraphService.getKey(resetUser.pxk.id)];
+                        case 1:
+                            prk = _b.sent();
+                            return [4 /*yield*/, Promise.all(resetUser.approvals
+                                    .filter(function (approval) { return !!approval.receiverCipherPartialAssemblyKey; })
+                                    .map(function (approval) { return __awaiter(_this, void 0, void 0, function () {
+                                    var partialAssemblyKey;
+                                    return __generator(this, function (_b) {
+                                        switch (_b.label) {
+                                            case 0: return [4 /*yield*/, this.encryptionService.decrypt(prk, approval.receiverCipherPartialAssemblyKey)];
+                                            case 1:
+                                                partialAssemblyKey = _b.sent();
+                                                if (assemblyKeyParams) {
+                                                    if (JSON.stringify(assemblyKeyParams) !==
+                                                        JSON.stringify(partialAssemblyKey.assemblyKeyParams)) {
+                                                        throw new LrBadStateException('The assembly key parameters are different between the approvals.');
+                                                    }
+                                                }
+                                                else {
+                                                    assemblyKeyParams = partialAssemblyKey.assemblyKeyParams;
+                                                }
+                                                return [2 /*return*/, partialAssemblyKey.slip39.share.mnemonics];
+                                        }
+                                    });
+                                }); }))];
+                        case 2:
+                            shares = _b.sent();
+                            console.log('recoverAssemblyKey()', shares);
+                            return [4 /*yield*/, this.slip39Service.recoverSecret(shares, TP_PASSWORD_RESET_SLIP39_PASSPHRASE)];
+                        case 3:
+                            rawAssemblyKey = _b.sent();
+                            return [2 /*return*/, nodeJose.JWK.asKey(Object.assign(Object.assign({}, assemblyKeyParams), { k: rawAssemblyKey }))];
                     }
                 });
             });
         };
         return LifeReadyAuthService;
     }());
-    LifeReadyAuthService.ɵprov = i0.ɵɵdefineInjectable({ factory: function LifeReadyAuthService_Factory() { return new LifeReadyAuthService(i0.ɵɵinject(LR_CONFIG), i0.ɵɵinject(i4.AuthClass), i0.ɵɵinject(KeyFactoryService), i0.ɵɵinject(KeyService), i0.ɵɵinject(ProfileService), i0.ɵɵinject(KeyGraphService), i0.ɵɵinject(PasswordService), i0.ɵɵinject(IdleService), i0.ɵɵinject(exports.ɵb), i0.ɵɵinject(exports.ɵc), i0.ɵɵinject(PersistService)); }, token: LifeReadyAuthService, providedIn: "root" });
+    LifeReadyAuthService.ɵprov = i0.ɵɵdefineInjectable({ factory: function LifeReadyAuthService_Factory() { return new LifeReadyAuthService(i0.ɵɵinject(LR_CONFIG), i0.ɵɵinject(i4.AuthClass), i0.ɵɵinject(KeyFactoryService), i0.ɵɵinject(KeyService), i0.ɵɵinject(ProfileService), i0.ɵɵinject(KeyGraphService), i0.ɵɵinject(PasswordService), i0.ɵɵinject(IdleService), i0.ɵɵinject(exports.ɵb), i0.ɵɵinject(exports.ɵc), i0.ɵɵinject(PersistService), i0.ɵɵinject(EncryptionService), i0.ɵɵinject(Slip39Service)); }, token: LifeReadyAuthService, providedIn: "root" });
     LifeReadyAuthService.decorators = [
         { type: i0.Injectable, args: [{
                     providedIn: 'root',
@@ -5480,7 +6024,9 @@
         { type: IdleService },
         { type: exports.ɵb },
         { type: exports.ɵc },
-        { type: PersistService }
+        { type: PersistService },
+        { type: EncryptionService },
+        { type: Slip39Service }
     ]; };
 
     var FileService = /** @class */ (function () {
@@ -7313,257 +7859,33 @@
                 });
             });
         };
-        TwoFactorService.prototype.verifySoftwareToken = function (totpCode) {
-            return __awaiter(this, void 0, void 0, function () {
-                var cognitoUser;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.auth.currentAuthenticatedUser()];
-                        case 1:
-                            cognitoUser = _a.sent();
-                            return [4 /*yield*/, this.auth.verifyTotpToken(cognitoUser, totpCode)];
-                        case 2:
-                            _a.sent();
-                            return [2 /*return*/];
-                    }
-                });
-            });
-        };
-        return TwoFactorService;
-    }());
-    TwoFactorService.ɵprov = i0.ɵɵdefineInjectable({ factory: function TwoFactorService_Factory() { return new TwoFactorService(i0.ɵɵinject(i4.AuthClass)); }, token: TwoFactorService, providedIn: "root" });
-    TwoFactorService.decorators = [
-        { type: i0.Injectable, args: [{
-                    providedIn: 'root',
-                },] }
-    ];
-    TwoFactorService.ctorParameters = function () { return [
-        { type: i4.AuthClass }
-    ]; };
-
-    var SecretShare = /** @class */ (function () {
-        function SecretShare(assembly, subAssembly, mnemonics) {
-            if (assembly === void 0) { assembly = 0; }
-            if (subAssembly === void 0) { subAssembly = 0; }
-            if (mnemonics === void 0) { mnemonics = ''; }
-            this.assembly = assembly;
-            this.subAssembly = subAssembly;
-            this.mnemonics = mnemonics;
-        }
-        return SecretShare;
-    }());
-    var SubAssembly = /** @class */ (function () {
-        function SubAssembly(index, threshold, size) {
-            if (threshold === void 0) { threshold = 0; }
-            if (size === void 0) { size = 0; }
-            this.index = index;
-            this.threshold = threshold;
-            this.size = size;
-            this.clearShares();
-        }
-        SubAssembly.prototype.clearShares = function () {
-            this.shares = Array();
-        };
-        SubAssembly.prototype.addShare = function (share) {
-            this.shares.push(share);
-        };
-        return SubAssembly;
-    }());
-    var Assembly = /** @class */ (function () {
-        function Assembly(threshold) {
-            if (threshold === void 0) { threshold = 0; }
-            this.threshold = threshold;
-            this.clearSubAssemblies();
-        }
-        Assembly.prototype.size = function () {
-            return this.subAssemblies.length;
-        };
-        Assembly.prototype.clearSubAssemblies = function () {
-            this.subAssemblies = new Array();
-        };
-        Assembly.prototype.addSubAssembly = function (subAssembly) {
-            this.subAssemblies.push(subAssembly);
-        };
-        return Assembly;
-    }());
-    var SubQuorum = /** @class */ (function () {
-        function SubQuorum(subAssemblyIndex) {
-            this.subAssemblyIndex = subAssemblyIndex;
-            this.clearShares();
-        }
-        SubQuorum.prototype.clearShares = function () {
-            this.shares = new Array();
-        };
-        SubQuorum.prototype.addShare = function (share) {
-            this.shares.push(share);
-        };
-        return SubQuorum;
-    }());
-    var Quorum = /** @class */ (function () {
-        function Quorum() {
-            this.clearSubQuora();
-        }
-        Quorum.prototype.clearSubQuora = function () {
-            this.subQuora = new Array();
-        };
-        Quorum.prototype.addSubQuorum = function (subQuorum) {
-            this.subQuora.push(subQuorum);
-        };
-        Quorum.prototype.serialiseShares = function () {
-            var shares = [];
-            this.subQuora.forEach(function (subQuorum) {
-                shares = shares.concat(subQuorum.shares);
-            });
-            return shares;
-        };
-        return Quorum;
-    }());
-    var Slip39Service = /** @class */ (function () {
-        function Slip39Service() {
-        }
-        Slip39Service.prototype.generateShares = function (secret, passphrase, assembly) {
-            return __awaiter(this, void 0, void 0, function () {
-                var ems, groups, _a, _b, sa, slip;
-                var e_1, _c;
-                return __generator(this, function (_d) {
-                    switch (_d.label) {
-                        case 0:
-                            ems = btoa(secret);
-                            ems = slip39.Slip39Helper.slip39EncodeHex(ems);
-                            groups = [];
-                            try {
-                                for (_a = __values(assembly.subAssemblies), _b = _a.next(); !_b.done; _b = _a.next()) {
-                                    sa = _b.value;
-                                    groups.push([sa.threshold, sa.size]);
-                                }
-                            }
-                            catch (e_1_1) { e_1 = { error: e_1_1 }; }
-                            finally {
-                                try {
-                                    if (_b && !_b.done && (_c = _a.return)) _c.call(_a);
-                                }
-                                finally { if (e_1) throw e_1.error; }
-                            }
-                            return [4 /*yield*/, slip39.Slip39.fromArray(ems, {
-                                    passphrase: passphrase,
-                                    threshold: assembly.threshold,
-                                    groups: groups,
-                                    title: '',
-                                })];
-                        case 1:
-                            slip = _d.sent();
-                            // Extract shares
-                            assembly.subAssemblies.forEach(function (sa, isa) {
-                                // Remove any existing shares
-                                sa.clearShares();
-                                for (var im = 0; im < sa.size; im++) {
-                                    // Construct the path to the share, formatted as "r/<subassembly index>/<member index>"
-                                    // with <subassembly index> and <member index> being two-digit, zero-padded integers.
-                                    var path = 'r/' +
-                                        isa.toString().padStart(2, '0') +
-                                        '/' +
-                                        im.toString().padStart(2, '0');
-                                    var mnemonics = slip.fromPath(path).mnemonics[0];
-                                    var share = new SecretShare(isa, im, mnemonics);
-                                    sa.addShare(share);
-                                }
-                            });
-                            return [2 /*return*/];
-                    }
-                });
-            });
-        };
-        // Remove all redundant shares. i.e. keep only enough members and groups to satisfy the thresholds.
-        Slip39Service.prototype.minimalSet = function (mnemonics) {
-            var e_2, _a, e_3, _b;
-            // Decode the mnemonics and sort then into groups.
-            var groupThresh = null;
-            var groups = new Map();
-            try {
-                for (var mnemonics_1 = __values(mnemonics), mnemonics_1_1 = mnemonics_1.next(); !mnemonics_1_1.done; mnemonics_1_1 = mnemonics_1.next()) {
-                    var mnemonic = mnemonics_1_1.value;
-                    var decoded = slip39.Slip39Helper.decodeMnemonic(mnemonic);
-                    if (groupThresh && groupThresh !== decoded.groupThreshold) {
-                        throw new Error('groupThreshold is different in mnemonics');
-                    }
-                    groupThresh = decoded.groupThreshold;
-                    // Note that Slip39.recoverSecret() will do all the error checking again. So it's not critical
-                    // that we error check here. So we just optimistically assume it's all good.
-                    var g = groups.get(decoded.groupIndex);
-                    if (g == null) {
-                        g = {
-                            memberThreshold: decoded.memberThreshold,
-                            members: [],
-                        };
-                        groups.set(decoded.groupIndex, g);
-                    }
-                    g.members.push({
-                        mnemonic: mnemonic,
-                        decoded: decoded,
-                    });
-                }
-            }
-            catch (e_2_1) { e_2 = { error: e_2_1 }; }
-            finally {
-                try {
-                    if (mnemonics_1_1 && !mnemonics_1_1.done && (_a = mnemonics_1.return)) _a.call(mnemonics_1);
-                }
-                finally { if (e_2) throw e_2.error; }
-            }
-            // Keep the minimum set of groups that meet threshold.
-            var mnemonicsMinSet = [];
-            var groupCount = 0;
-            try {
-                for (var _c = __values(groups.values()), _d = _c.next(); !_d.done; _d = _c.next()) {
-                    var g = _d.value;
-                    // Keep only groups that meet threshold
-                    if (g.members.length < g.memberThreshold) {
-                        continue;
-                    }
-                    // Keep minimum number of approvals needed for group
-                    g.members.slice(0, g.memberThreshold).forEach(function (member) {
-                        mnemonicsMinSet.push(member.mnemonic);
-                    });
-                    ++groupCount;
-                    if (groupCount >= groupThresh) {
-                        break;
-                    }
-                }
-            }
-            catch (e_3_1) { e_3 = { error: e_3_1 }; }
-            finally {
-                try {
-                    if (_d && !_d.done && (_b = _c.return)) _b.call(_c);
-                }
-                finally { if (e_3) throw e_3.error; }
-            }
-            return mnemonicsMinSet;
-        };
-        Slip39Service.prototype.recoverSecret = function (shares, passphrase) {
+        TwoFactorService.prototype.verifySoftwareToken = function (totpCode) {
             return __awaiter(this, void 0, void 0, function () {
-                var recovered, secret;
+                var cognitoUser;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
-                        case 0:
-                            shares = this.minimalSet(shares);
-                            return [4 /*yield*/, slip39.Slip39.recoverSecret(shares, passphrase)];
+                        case 0: return [4 /*yield*/, this.auth.currentAuthenticatedUser()];
                         case 1:
-                            recovered = _a.sent();
-                            secret = slip39.Slip39Helper.slip39DecodeHex(recovered);
-                            return [2 /*return*/, atob(secret)];
+                            cognitoUser = _a.sent();
+                            return [4 /*yield*/, this.auth.verifyTotpToken(cognitoUser, totpCode)];
+                        case 2:
+                            _a.sent();
+                            return [2 /*return*/];
                     }
                 });
             });
         };
-        return Slip39Service;
+        return TwoFactorService;
     }());
-    Slip39Service.ɵprov = i0.ɵɵdefineInjectable({ factory: function Slip39Service_Factory() { return new Slip39Service(); }, token: Slip39Service, providedIn: "root" });
-    Slip39Service.decorators = [
+    TwoFactorService.ɵprov = i0.ɵɵdefineInjectable({ factory: function TwoFactorService_Factory() { return new TwoFactorService(i0.ɵɵinject(i4.AuthClass)); }, token: TwoFactorService, providedIn: "root" });
+    TwoFactorService.decorators = [
         { type: i0.Injectable, args: [{
                     providedIn: 'root',
                 },] }
     ];
-    Slip39Service.ctorParameters = function () { return []; };
+    TwoFactorService.ctorParameters = function () { return [
+        { type: i4.AuthClass }
+    ]; };
 
     (function (FileType) {
         FileType["RecordContent"] = "record-content";
@@ -14625,7 +14947,6 @@
         })
     ], exports.TrustedParty2Service);
 
-    var TpPasswordResetService_1;
     var CreateSubAssembliesInput = /** @class */ (function () {
         function CreateSubAssembliesInput() {
         }
@@ -14650,7 +14971,7 @@
         }
         return UpdateTpPasswordResetInput;
     }(CreateTpPasswordResetInput));
-    exports.TpPasswordResetService = TpPasswordResetService_1 = /** @class */ (function (_super) {
+    exports.TpPasswordResetService = /** @class */ (function (_super) {
         __extends(TpPasswordResetService, _super);
         function TpPasswordResetService(ngZone, injector, keyService, keyFactory, encryptionService, keyGraph, slip39Service) {
             var _this = _super.call(this, injector) || this;
@@ -14919,7 +15240,7 @@
                                 }
                                 slipAssembly.addSubAssembly(new SubAssembly(index, sa.quorum, approverCount));
                             });
-                            return [4 /*yield*/, this.slip39Service.generateShares(rawAssemblyKey, TpPasswordResetService_1.SLIP39_PASSPHRASE, slipAssembly)];
+                            return [4 /*yield*/, this.slip39Service.generateShares(rawAssemblyKey, TP_PASSWORD_RESET_SLIP39_PASSPHRASE, slipAssembly)];
                         case 1:
                             _b.sent();
                             return [2 /*return*/, slipAssembly];
@@ -15025,7 +15346,6 @@
         };
         return TpPasswordResetService;
     }(LrService));
-    exports.TpPasswordResetService.SLIP39_PASSPHRASE = 'lifeready';
     exports.TpPasswordResetService.ɵprov = i0.ɵɵdefineInjectable({ factory: function TpPasswordResetService_Factory() { return new exports.TpPasswordResetService(i0.ɵɵinject(i0.NgZone), i0.ɵɵinject(i0.INJECTOR), i0.ɵɵinject(KeyService), i0.ɵɵinject(KeyFactoryService), i0.ɵɵinject(EncryptionService), i0.ɵɵinject(KeyGraphService), i0.ɵɵinject(Slip39Service)); }, token: exports.TpPasswordResetService, providedIn: "root" });
     exports.TpPasswordResetService.decorators = [
         { type: i0.Injectable, args: [{
@@ -15041,90 +15361,12 @@
         { type: KeyGraphService },
         { type: Slip39Service }
     ]; };
-    exports.TpPasswordResetService = TpPasswordResetService_1 = __decorate([
+    exports.TpPasswordResetService = __decorate([
         RunOutsideAngular({
             ngZoneName: 'ngZone',
         })
     ], exports.TpPasswordResetService);
 
-    // ------------------------------------------------------
-    // Basic types
-    // ------------------------------------------------------
-    // These types map directory to types of the same name in graphql.
-    // We use these aliases in case in the future we wish to reify the types and do
-    // additional automated conversion.
-
-    var AccessRoleChoice;
-    (function (AccessRoleChoice) {
-        AccessRoleChoice["READER"] = "READER";
-        AccessRoleChoice["WRITER"] = "WRITER";
-        AccessRoleChoice["ADMIN"] = "ADMIN";
-        AccessRoleChoice["DENY"] = "DENY";
-        AccessRoleChoice["OWNER"] = "OWNER";
-    })(AccessRoleChoice || (AccessRoleChoice = {}));
-    var AccessRoleMethod;
-    (function (AccessRoleMethod) {
-        AccessRoleMethod["inherited"] = "inherited";
-        AccessRoleMethod["direct"] = "direct";
-    })(AccessRoleMethod || (AccessRoleMethod = {}));
-    var FileVersionOperation;
-    (function (FileVersionOperation) {
-        FileVersionOperation["CREATE"] = "CREATE";
-        FileVersionOperation["READ"] = "READ";
-        FileVersionOperation["UPDATE"] = "UPDATE";
-        FileVersionOperation["REVERT"] = "REVERT";
-        FileVersionOperation["DELETE"] = "DELETE";
-    })(FileVersionOperation || (FileVersionOperation = {}));
-    var KeyExchangeOtkState;
-    (function (KeyExchangeOtkState) {
-        KeyExchangeOtkState["OTK_INITIATED"] = "OTK_INITIATED";
-        KeyExchangeOtkState["OTK_ACCEPTED"] = "OTK_ACCEPTED";
-        KeyExchangeOtkState["OTK_COMPLETED"] = "OTK_COMPLETED";
-    })(KeyExchangeOtkState || (KeyExchangeOtkState = {}));
-    var KeyExchangeState;
-    (function (KeyExchangeState) {
-        KeyExchangeState["IN_PROGRESS"] = "IN_PROGRESS";
-        KeyExchangeState["COMPLETED"] = "COMPLETED";
-        KeyExchangeState["DECLINED"] = "DECLINED";
-        KeyExchangeState["CANCELLED"] = "CANCELLED";
-        KeyExchangeState["DELETED"] = "DELETED";
-    })(KeyExchangeState || (KeyExchangeState = {}));
-    var KeyExchangeMode;
-    (function (KeyExchangeMode) {
-        KeyExchangeMode["OTK"] = "OTK";
-    })(KeyExchangeMode || (KeyExchangeMode = {}));
-    var TpAssemblyState;
-    (function (TpAssemblyState) {
-        TpAssemblyState["DISABLED"] = "DISABLED";
-        TpAssemblyState["ENABLED"] = "ENABLED";
-        TpAssemblyState["CLAIMED"] = "CLAIMED";
-        TpAssemblyState["APPROVED"] = "APPROVED";
-        TpAssemblyState["REJECTED"] = "REJECTED";
-        TpAssemblyState["EXPIRED"] = "EXPIRED";
-        TpAssemblyState["CANCELLED"] = "CANCELLED";
-        TpAssemblyState["RESET"] = "RESET";
-    })(TpAssemblyState || (TpAssemblyState = {}));
-    var TpClaimState;
-    (function (TpClaimState) {
-        TpClaimState["CLAIMED"] = "CLAIMED";
-        TpClaimState["APPROVED"] = "APPROVED";
-        TpClaimState["REJECTED"] = "REJECTED";
-        TpClaimState["EXPIRED"] = "EXPIRED";
-        TpClaimState["CANCELLED"] = "CANCELLED";
-        TpClaimState["RESET"] = "RESET";
-    })(TpClaimState || (TpClaimState = {}));
-    var TpClaimApproverState;
-    (function (TpClaimApproverState) {
-        TpClaimApproverState["CLAIMED"] = "CLAIMED";
-        TpClaimApproverState["APPROVED"] = "APPROVED";
-        TpClaimApproverState["REJECTED"] = "REJECTED";
-    })(TpClaimApproverState || (TpClaimApproverState = {}));
-    var LockState;
-    (function (LockState) {
-        LockState["UNLOCKED"] = "UNLOCKED";
-        LockState["MUTEX_LOCKED"] = "MUTEX_LOCKED";
-    })(LockState || (LockState = {}));
-
     exports.TpPasswordResetUserService = /** @class */ (function (_super) {
         __extends(TpPasswordResetUserService, _super);
         function TpPasswordResetUserService(ngZone, injector, config, keyFactory, encryptionService, keyGraphService, slip39Service, passwordService, http, auth, lrAuth) {
@@ -15140,7 +15382,6 @@
             _this.http = http;
             _this.auth = auth;
             _this.lrAuth = lrAuth;
-            _this.CLIENT_NONCE_LENGTH = 32;
             return _this;
         }
         TpPasswordResetUserService.prototype.verifyEmailContact = function (email) {
@@ -15232,184 +15473,6 @@
                 });
             });
         };
-        TpPasswordResetUserService.prototype.getResetUser = function (reload) {
-            if (reload === void 0) { reload = false; }
-            return __awaiter(this, void 0, void 0, function () {
-                var _a;
-                return __generator(this, function (_b) {
-                    switch (_b.label) {
-                        case 0:
-                            if (!reload && this.resetUser) {
-                                return [2 /*return*/, this.resetUser];
-                            }
-                            _a = this;
-                            return [4 /*yield*/, this.lrAuth.loadResetUser()];
-                        case 1:
-                            _a.resetUser = _b.sent();
-                            return [2 /*return*/, this.resetUser];
-                    }
-                });
-            });
-        };
-        TpPasswordResetUserService.prototype.recoverAssemblyKey = function (resetUser) {
-            return __awaiter(this, void 0, void 0, function () {
-                var assemblyKeyParams, prk, shares, rawAssemblyKey;
-                var _this = this;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.keyGraphService.getKey(resetUser.pxk.id)];
-                        case 1:
-                            prk = _a.sent();
-                            return [4 /*yield*/, Promise.all(resetUser.approvals.map(function (approval) { return __awaiter(_this, void 0, void 0, function () {
-                                    var partialAssemblyKey;
-                                    return __generator(this, function (_a) {
-                                        switch (_a.label) {
-                                            case 0: return [4 /*yield*/, this.encryptionService.decrypt(prk, approval.receiverCipherPartialAssemblyKey)];
-                                            case 1:
-                                                partialAssemblyKey = _a.sent();
-                                                if (assemblyKeyParams) {
-                                                    if (JSON.stringify(assemblyKeyParams) !==
-                                                        JSON.stringify(partialAssemblyKey.assemblyKeyParams)) {
-                                                        throw new LrBadStateException('The assembly key parameters are different between the approvals.');
-                                                    }
-                                                }
-                                                else {
-                                                    assemblyKeyParams = partialAssemblyKey.assemblyKeyParams;
-                                                }
-                                                return [2 /*return*/, partialAssemblyKey.slip39.share.mnemonics];
-                                        }
-                                    });
-                                }); }))];
-                        case 2:
-                            shares = _a.sent();
-                            console.log('recoverAssemblyKey()', shares);
-                            return [4 /*yield*/, this.slip39Service.recoverSecret(shares, exports.TpPasswordResetService.SLIP39_PASSPHRASE)];
-                        case 3:
-                            rawAssemblyKey = _a.sent();
-                            return [2 /*return*/, nodeJose.JWK.asKey(Object.assign(Object.assign({}, assemblyKeyParams), { k: rawAssemblyKey }))];
-                    }
-                });
-            });
-        };
-        TpPasswordResetUserService.prototype.completeRequest = function (newPassword) {
-            return __awaiter(this, void 0, void 0, function () {
-                var resetUser, assemblyKey, rootKey, rootKeyJwk, masterKey, masterKeyWrappedRootKey, newPassIdpResult, newIdpPassword, challenge, assemblyKeyVerifierPrk, signedChallenge, tempIdpPassword, retPromise, user;
-                var _this = this;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.getResetUser(true)];
-                        case 1:
-                            resetUser = _a.sent();
-                            if (resetUser.state !== TpClaimState.APPROVED) {
-                                throw new LrBadStateException('Password reset request has not been approved.');
-                            }
-                            return [4 /*yield*/, this.recoverAssemblyKey(resetUser)];
-                        case 2:
-                            assemblyKey = _a.sent();
-                            return [4 /*yield*/, this.encryptionService.decrypt(assemblyKey, resetUser.assemblyCipherData)];
-                        case 3:
-                            rootKey = (_a.sent()).rootKey;
-                            console.log(rootKey);
-                            return [4 /*yield*/, nodeJose.JWK.asKey(rootKey)];
-                        case 4:
-                            rootKeyJwk = _a.sent();
-                            return [4 /*yield*/, this.keyGraphService.getKey(resetUser.masterKey.id)];
-                        case 5:
-                            masterKey = _a.sent();
-                            return [4 /*yield*/, this.encryptionService.encryptToString(masterKey.jwk, rootKeyJwk.toJSON(true))];
-                        case 6:
-                            masterKeyWrappedRootKey = _a.sent();
-                            return [4 /*yield*/, this.keyFactory.derivePassIdp(Object.assign({ password: newPassword }, resetUser.passKey.passIdpParams))];
-                        case 7:
-                            newPassIdpResult = _a.sent();
-                            newIdpPassword = this.passwordService.getPassIdpString(newPassIdpResult.jwk);
-                            return [4 /*yield*/, this.mutate(new LrMutation({
-                                    mutation: CreateTpAssemblyKeyChallengeMutation,
-                                    variables: {
-                                        input: {},
-                                    },
-                                }), {
-                                    includeKeyGraph: false,
-                                })];
-                        case 8:
-                            challenge = (_a.sent()).createTpAssemblyKeyChallenge.challenge;
-                            console.log(challenge);
-                            // Sign the challenge
-                            // Generate a client side nonce that's no in the server's control.
-                            challenge.clientNonce = this.keyFactory.randomString(this.CLIENT_NONCE_LENGTH);
-                            console.log(challenge);
-                            return [4 /*yield*/, this.encryptionService.decrypt(assemblyKey, resetUser.wrappedAssemblyKeyVerifierPrk)];
-                        case 9:
-                            assemblyKeyVerifierPrk = _a.sent();
-                            return [4 /*yield*/, this.encryptionService.sign(assemblyKeyVerifierPrk, challenge)];
-                        case 10:
-                            signedChallenge = _a.sent();
-                            return [4 /*yield*/, this.mutate(new LrMutation({
-                                    mutation: PreCompleteTpPasswordResetRequestMutation,
-                                    variables: {
-                                        input: {
-                                            signedChallenge: JSON.stringify(signedChallenge),
-                                        },
-                                    },
-                                }), {
-                                    includeKeyGraph: false,
-                                })];
-                        case 11:
-                            tempIdpPassword = (_a.sent()).preCompleteTpPasswordResetRequest.idpPassword;
-                            retPromise = new Promise(function (resolve) {
-                                var listener = function (data) { return __awaiter(_this, void 0, void 0, function () {
-                                    return __generator(this, function (_a) {
-                                        switch (_a.label) {
-                                            case 0:
-                                                if (data.payload.event !== 'signIn') {
-                                                    return [2 /*return*/];
-                                                }
-                                                core$1.Hub.remove('auth', listener);
-                                                console.log(data.payload);
-                                                return [4 /*yield*/, this.auth.signIn(resetUser.username, newIdpPassword)];
-                                            case 1:
-                                                _a.sent();
-                                                // Switch over to the new set of keys
-                                                return [4 /*yield*/, this.mutate(new LrMutation({
-                                                        mutation: CompleteTpPasswordResetRequestMutation,
-                                                        variables: {
-                                                            input: {
-                                                                masterKeyWrappedRootKey: masterKeyWrappedRootKey,
-                                                                masterKeyId: masterKey.id,
-                                                            },
-                                                        },
-                                                    }))];
-                                            case 2:
-                                                // Switch over to the new set of keys
-                                                _a.sent();
-                                                resolve();
-                                                return [2 /*return*/];
-                                        }
-                                    });
-                                }); };
-                                core$1.Hub.listen('auth', listener);
-                            });
-                            return [4 /*yield*/, this.auth.signIn(resetUser.username, tempIdpPassword, {
-                                    noProxy: 'true',
-                                })];
-                        case 12:
-                            user = _a.sent();
-                            if (user.challengeName !== 'NEW_PASSWORD_REQUIRED') {
-                                throw new LrException({
-                                    message: 'Internal error. Expecting Cognito to have done a password reset after call to PreCompleteTpPasswordResetRequestMutation.',
-                                });
-                            }
-                            return [4 /*yield*/, this.auth.completeNewPassword(user, newIdpPassword, {})];
-                        case 13:
-                            // Set new password on Idp
-                            // the awsFetch() function passes NEW_PASSWORD_REQUIRED directly to AWS without
-                            // going through the proxy.
-                            user = _a.sent();
-                            return [2 /*return*/, retPromise];
-                    }
-                });
-            });
-        };
         return TpPasswordResetUserService;
     }(LrService));
     exports.TpPasswordResetUserService.ɵprov = i0.ɵɵdefineInjectable({ factory: function TpPasswordResetUserService_Factory() { return new exports.TpPasswordResetUserService(i0.ɵɵinject(i0.NgZone), i0.ɵɵinject(i0.INJECTOR), i0.ɵɵinject(LR_CONFIG), i0.ɵɵinject(KeyFactoryService), i0.ɵɵinject(EncryptionService), i0.ɵɵinject(KeyGraphService), i0.ɵɵinject(Slip39Service), i0.ɵɵinject(PasswordService), i0.ɵɵinject(i2.HttpClient), i0.ɵɵinject(i4.AuthClass), i0.ɵɵinject(LifeReadyAuthService)); }, token: exports.TpPasswordResetUserService, providedIn: "root" });