@lifeready/core 1.1.15 → 1.1.17

package/bundles/lifeready-core.umd.js

@@ -953,7 +953,7 @@
 
     var WebCryptoService = /** @class */ (function () {
         function WebCryptoService() {
-            this.crypto = window.crypto;
+            this.kcCrypto = window.crypto;
         }
         WebCryptoService.prototype.toHex = function (buffer) {
             // Ref: https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest
@@ -969,7 +969,7 @@
                         case 0:
                             encoder = new TextEncoder();
                             data = encoder.encode(message);
-                            return [4 /*yield*/, this.crypto.subtle.digest(algorithm, data)];
+                            return [4 /*yield*/, this.kcCrypto.subtle.digest(algorithm, data)];
                         case 1:
                             hash = _a.sent();
                             return [2 /*return*/, this.toHex(hash)];
@@ -986,25 +986,6 @@
                 },] }
     ];
 
-    function sha256(message) {
-        return __awaiter(this, void 0, void 0, function () {
-            var msgBuffer, hashBuffer, hashArray, hashHex;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        msgBuffer = new TextEncoder().encode(message);
-                        return [4 /*yield*/, crypto.subtle.digest('SHA-256', msgBuffer)];
-                    case 1:
-                        hashBuffer = _a.sent();
-                        hashArray = Array.from(new Uint8Array(hashBuffer));
-                        hashHex = hashArray
-                            .map(function (b) { return ('00' + b.toString(16)).slice(-2); })
-                            .join('');
-                        return [2 /*return*/, hashHex];
-                }
-            });
-        });
-    }
     var KeyFactoryService = /** @class */ (function () {
         function KeyFactoryService(webCryptoService) {
             this.webCryptoService = webCryptoService;
@@ -1023,7 +1004,7 @@
             this.DEFAULT_PASS_IDP_PBKDF_ITER = this.MIN_PASS_IDP_PBKDF_ITER;
             this.DEFAULT_PASS_KEY_PBKDF_ITER = this.MIN_PASS_KEY_PBKDF_ITER;
             this.DEFAULT_LBOP_KEY_PBKDF_ITER = this.MIN_LBOP_KEY_PBKDF_ITER;
-            this.crypto = this.webCryptoService.crypto;
+            this.kcCrypto = this.webCryptoService.kcCrypto;
         }
         KeyFactoryService.asKey = function (key, form, extras) {
             // <AZ> Using a single global key store did not seem to improve speed.
@@ -1036,7 +1017,7 @@
             }
             var validChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
             var array = new Uint32Array(digits);
-            this.crypto.getRandomValues(array);
+            this.kcCrypto.getRandomValues(array);
             array = array.map(function (x) { return validChars.charCodeAt(x % validChars.length); });
             return String.fromCharCode.apply(null, array);
         };
@@ -1051,7 +1032,7 @@
                 throw new LrBadArgumentException('chooseN <= 0');
             }
             var values = new Uint32Array(chooseN);
-            this.crypto.getRandomValues(values);
+            this.kcCrypto.getRandomValues(values);
             var ret = [];
             values.forEach(function (v) { return ret.push(array[v % array.length]); });
             return ret;
@@ -1064,7 +1045,7 @@
                 var key, jwk;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.crypto.subtle.generateKey({
+                        case 0: return [4 /*yield*/, this.kcCrypto.subtle.generateKey({
                                 name: 'AES-GCM',
                                 length: 256,
                             }, true, // whether the key is extractable (i.e. can be used in exportKey)
@@ -1072,7 +1053,7 @@
                             )];
                         case 1:
                             key = _a.sent();
-                            return [4 /*yield*/, this.crypto.subtle.exportKey('jwk', key)];
+                            return [4 /*yield*/, this.kcCrypto.subtle.exportKey('jwk', key)];
                         case 2:
                             jwk = _a.sent();
                             // Removing the fields not needed by node-jose
@@ -1088,13 +1069,13 @@
                 var key, jwk;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.crypto.subtle.generateKey({
+                        case 0: return [4 /*yield*/, this.kcCrypto.subtle.generateKey({
                                 name: 'HMAC',
                                 hash: { name: 'SHA-512' },
                             }, true, ['sign', 'verify'])];
                         case 1:
                             key = _a.sent();
-                            return [4 /*yield*/, this.crypto.subtle.exportKey('jwk', key)];
+                            return [4 /*yield*/, this.kcCrypto.subtle.exportKey('jwk', key)];
                         case 2:
                             jwk = _a.sent();
                             // Removing the fields not needed by node-jose
@@ -1110,7 +1091,7 @@
                 var key, jwk;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.crypto.subtle.generateKey({
+                        case 0: return [4 /*yield*/, this.kcCrypto.subtle.generateKey({
                                 name: 'RSA-OAEP',
                                 modulusLength: 2048,
                                 // As per suggestion: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
@@ -1121,7 +1102,7 @@
                             )];
                         case 1:
                             key = _a.sent();
-                            return [4 /*yield*/, this.crypto.subtle.exportKey('jwk', key.privateKey)];
+                            return [4 /*yield*/, this.kcCrypto.subtle.exportKey('jwk', key.privateKey)];
                         case 2:
                             jwk = _a.sent();
                             // Removing the fields not needed by node-jose
@@ -1137,7 +1118,7 @@
                 var key, jwk;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.crypto.subtle.generateKey({
+                        case 0: return [4 /*yield*/, this.kcCrypto.subtle.generateKey({
                                 name: 'RSASSA-PKCS1-v1_5',
                                 modulusLength: 2048,
                                 // As per suggestion: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
@@ -1148,7 +1129,7 @@
                             )];
                         case 1:
                             key = _a.sent();
-                            return [4 /*yield*/, this.crypto.subtle.exportKey('jwk', key.privateKey)];
+                            return [4 /*yield*/, this.kcCrypto.subtle.exportKey('jwk', key.privateKey)];
                         case 2:
                             jwk = _a.sent();
                             // Removing the fields not needed by node-jose
@@ -1159,33 +1140,37 @@
                 });
             });
         };
+        KeyFactoryService.prototype.importPassword = function (plainPassword) {
+            return __awaiter(this, void 0, void 0, function () {
+                var enc;
+                return __generator(this, function (_a) {
+                    enc = new TextEncoder();
+                    return [2 /*return*/, this.kcCrypto.subtle.importKey('raw', enc.encode(plainPassword), 'PBKDF2', false, ['deriveKey'])];
+                });
+            });
+        };
         KeyFactoryService.prototype.deriveKey = function (_a) {
             var password = _a.password, salt = _a.salt, iterations = _a.iterations, kid = _a.kid;
             return __awaiter(this, void 0, void 0, function () {
-                var enc, rawKey, passKey, passKeyJson, jwk;
+                var passKey, passKeyJson, jwk;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
-                        case 0:
-                            enc = new TextEncoder();
-                            return [4 /*yield*/, this.crypto.subtle.importKey('raw', enc.encode(password), 'PBKDF2', false, ['deriveBits', 'deriveKey'])];
+                        case 0: return [4 /*yield*/, this.kcCrypto.subtle.deriveKey({
+                                name: 'PBKDF2',
+                                salt: new TextEncoder().encode(salt),
+                                iterations: iterations,
+                                hash: 'SHA-256',
+                            }, password, { name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt'])];
                         case 1:
-                            rawKey = _a.sent();
-                            return [4 /*yield*/, crypto.subtle.deriveKey({
-                                    name: 'PBKDF2',
-                                    salt: new TextEncoder().encode(salt),
-                                    iterations: iterations,
-                                    hash: 'SHA-256',
-                                }, rawKey, { name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt'])];
-                        case 2:
                             passKey = _a.sent();
-                            return [4 /*yield*/, crypto.subtle.exportKey('jwk', passKey)];
-                        case 3:
+                            return [4 /*yield*/, this.kcCrypto.subtle.exportKey('jwk', passKey)];
+                        case 2:
                             passKeyJson = _a.sent();
                             if (kid) {
                                 passKeyJson.kid = kid;
                             }
                             return [4 /*yield*/, KeyFactoryService.asKey(passKeyJson)];
-                        case 4:
+                        case 3:
                             jwk = _a.sent();
                             return [2 /*return*/, { jwk: jwk }];
                     }
@@ -5049,30 +5034,30 @@
             this.idleService = idleService;
             this.CLIENT_NONCE_LENGTH = 32;
         }
-        PasswordService.prototype.checkPassword = function (password) {
+        PasswordService.prototype.checkPassword = function (plainPassword) {
             return __awaiter(this, void 0, void 0, function () {
                 var years, _a;
                 return __generator(this, function (_b) {
                     switch (_b.label) {
                         case 0:
-                            years = this.passwordStrength(password).years;
+                            years = this.passwordStrength(plainPassword).years;
                             _a = {
-                                length: password.length,
+                                length: plainPassword.length,
                                 timeToCrack: moment$1.duration({ years: years })
                             };
-                            return [4 /*yield*/, this.getExposureCount(password)];
+                            return [4 /*yield*/, this.getExposureCount(plainPassword)];
                         case 1: return [2 /*return*/, (_a.passwordExposed = _b.sent(),
                                 _a)];
                     }
                 });
             });
         };
-        PasswordService.prototype.getExposureCount = function (password) {
+        PasswordService.prototype.getExposureCount = function (plainPassword) {
             return __awaiter(this, void 0, void 0, function () {
                 var sha1Password, first5sha1, response, results;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.webCryptoService.stringDigest('SHA-1', password)];
+                        case 0: return [4 /*yield*/, this.webCryptoService.stringDigest('SHA-1', plainPassword)];
                         case 1:
                             sha1Password = _a.sent();
                             first5sha1 = sha1Password.substring(0, 5);
@@ -5424,6 +5409,10 @@
         { type: IdleService }
     ]; };
 
+    var TP_PASSWORD_RESET_CLIENT_NONCE_LENGTH = 32;
+    var TP_PASSWORD_RESET_SLIP39_PASSPHRASE = 'lifeready';
+    var TP_PASSWORD_RESET_USERNAME_SUFFIX = '.tp_password_reset';
+
     var SecretShare = /** @class */ (function () {
         function SecretShare(assembly, subAssembly, mnemonics) {
             if (assembly === void 0) { assembly = 0; }
@@ -5647,10 +5636,6 @@
                 },] }
     ];
 
-    var TP_PASSWORD_RESET_CLIENT_NONCE_LENGTH = 32;
-    var TP_PASSWORD_RESET_SLIP39_PASSPHRASE = 'lifeready';
-    var TP_PASSWORD_RESET_USERNAME_SUFFIX = '.tp_password_reset';
-
     var TpsKeysQuery = gqlTyped(templateObject_1$9 || (templateObject_1$9 = __makeTemplateObject(["\nquery TpsKeysQuery($ids: [ID]) {\n  tps(id_In: $ids) {\n    edges {\n      node {\n        id\n        currentUserSharedKey {\n          userSharedKey {\n            sharedKey {\n              id\n            }\n            mkSharedKey {\n              id\n            }\n          }\n        }\n      }\n    }\n  }\n}"], ["\nquery TpsKeysQuery($ids: [ID]) {\n  tps(id_In: $ids) {\n    edges {\n      node {\n        id\n        currentUserSharedKey {\n          userSharedKey {\n            sharedKey {\n              id\n            }\n            mkSharedKey {\n              id\n            }\n          }\n        }\n      }\n    }\n  }\n}"])));
     var templateObject_1$9;
 
@@ -6152,7 +6137,7 @@
         return TpAssemblyController;
     }());
 
-    exports.ɵj = /** @class */ (function (_super) {
+    exports.ɵi = /** @class */ (function (_super) {
         __extends(TpPasswordResetAssemblyController, _super);
         function TpPasswordResetAssemblyController(ngZone, injector) {
             var _this = _super.call(this, injector) || this;
@@ -6166,21 +6151,21 @@
         };
         return TpPasswordResetAssemblyController;
     }(TpAssemblyController));
-    exports.ɵj.ɵprov = i0.ɵɵdefineInjectable({ factory: function TpPasswordResetAssemblyController_Factory() { return new exports.ɵj(i0.ɵɵinject(i0.NgZone), i0.ɵɵinject(i0.INJECTOR)); }, token: exports.ɵj, providedIn: "root" });
-    exports.ɵj.decorators = [
+    exports.ɵi.ɵprov = i0.ɵɵdefineInjectable({ factory: function TpPasswordResetAssemblyController_Factory() { return new exports.ɵi(i0.ɵɵinject(i0.NgZone), i0.ɵɵinject(i0.INJECTOR)); }, token: exports.ɵi, providedIn: "root" });
+    exports.ɵi.decorators = [
         { type: i0.Injectable, args: [{
                     providedIn: 'root',
                 },] }
     ];
-    exports.ɵj.ctorParameters = function () { return [
+    exports.ɵi.ctorParameters = function () { return [
         { type: i0.NgZone },
         { type: i0.Injector }
     ]; };
-    exports.ɵj = __decorate([
+    exports.ɵi = __decorate([
         RunOutsideAngular({
             ngZoneName: 'ngZone',
         })
-    ], exports.ɵj);
+    ], exports.ɵi);
 
     var CancelTpPasswordResetRequestMutation = gqlTyped(templateObject_1$a || (templateObject_1$a = __makeTemplateObject(["\nmutation CancelTpPasswordResetRequestMutation {\n  cancelTpPasswordResetRequest(input: {}) {\n    id\n  }\n}"], ["\nmutation CancelTpPasswordResetRequestMutation {\n  cancelTpPasswordResetRequest(input: {}) {\n    id\n  }\n}"])));
     var CreateTpAssemblyKeyChallengeMutation = gqlTyped(templateObject_2$7 || (templateObject_2$7 = __makeTemplateObject(["\nmutation CreateTpAssemblyKeyChallengeMutation(\n  $input: CreateTpAssemblyKeyChallengeInput!\n) {\n  createTpAssemblyKeyChallenge(input: $input) {\n    challenge\n  }\n}"], ["\nmutation CreateTpAssemblyKeyChallengeMutation(\n  $input: CreateTpAssemblyKeyChallengeInput!\n) {\n  createTpAssemblyKeyChallenge(input: $input) {\n    challenge\n  }\n}"])));
@@ -6208,7 +6193,7 @@
         return function () { return authService.initialise(); };
     };
     var LifeReadyAuthService = /** @class */ (function () {
-        function LifeReadyAuthService(config, auth, keyFactory, keyService, profileService, keyGraphService, passwordService, idleService, lrGraphQL, tpPasswordResetProcessorService, persistService, encryptionService, slip39Service, assemblyController) {
+        function LifeReadyAuthService(config, auth, keyFactory, keyService, profileService, keyGraphService, passwordService, idleService, lrGraphQL, tpPasswordResetProcessorService, persistService, encryptionService, assemblyController) {
             this.config = config;
             this.auth = auth;
             this.keyFactory = keyFactory;
@@ -6221,7 +6206,6 @@
             this.tpPasswordResetProcessorService = tpPasswordResetProcessorService;
             this.persistService = persistService;
             this.encryptionService = encryptionService;
-            this.slip39Service = slip39Service;
             this.assemblyController = assemblyController;
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
             this.hubSubject = new rxjs.ReplaySubject(1);
@@ -6238,6 +6222,9 @@
                 });
             });
         };
+        LifeReadyAuthService.prototype.importPassword = function (plainPassword) {
+            return this.keyFactory.importPassword(plainPassword);
+        };
         LifeReadyAuthService.prototype.addLogoutListener = function (callback) {
             this.logoutListeners.add(callback);
         };
@@ -6858,7 +6845,7 @@
         };
         return LifeReadyAuthService;
     }());
-    LifeReadyAuthService.ɵprov = i0.ɵɵdefineInjectable({ factory: function LifeReadyAuthService_Factory() { return new LifeReadyAuthService(i0.ɵɵinject(LR_CONFIG), i0.ɵɵinject(i4.AuthClass), i0.ɵɵinject(KeyFactoryService), i0.ɵɵinject(KeyService), i0.ɵɵinject(ProfileService), i0.ɵɵinject(KeyGraphService), i0.ɵɵinject(PasswordService), i0.ɵɵinject(IdleService), i0.ɵɵinject(exports.ɵf), i0.ɵɵinject(exports.ɵg), i0.ɵɵinject(PersistService), i0.ɵɵinject(EncryptionService), i0.ɵɵinject(Slip39Service), i0.ɵɵinject(exports.ɵj)); }, token: LifeReadyAuthService, providedIn: "root" });
+    LifeReadyAuthService.ɵprov = i0.ɵɵdefineInjectable({ factory: function LifeReadyAuthService_Factory() { return new LifeReadyAuthService(i0.ɵɵinject(LR_CONFIG), i0.ɵɵinject(i4.AuthClass), i0.ɵɵinject(KeyFactoryService), i0.ɵɵinject(KeyService), i0.ɵɵinject(ProfileService), i0.ɵɵinject(KeyGraphService), i0.ɵɵinject(PasswordService), i0.ɵɵinject(IdleService), i0.ɵɵinject(exports.ɵf), i0.ɵɵinject(exports.ɵg), i0.ɵɵinject(PersistService), i0.ɵɵinject(EncryptionService), i0.ɵɵinject(exports.ɵi)); }, token: LifeReadyAuthService, providedIn: "root" });
     LifeReadyAuthService.decorators = [
         { type: i0.Injectable, args: [{
                     providedIn: 'root',
@@ -6877,8 +6864,7 @@
         { type: exports.ɵg },
         { type: PersistService },
         { type: EncryptionService },
-        { type: Slip39Service },
-        { type: exports.ɵj }
+        { type: exports.ɵi }
     ]; };
 
     (function (FileType) {
@@ -10460,16 +10446,16 @@
         LbopService.prototype.create = function (_a) {
             var name = _a.name;
             return __awaiter(this, void 0, void 0, function () {
-                var lbops, lbopString, _loop_1, this_1, state_1, lbopKeyParams, lbopKey, lbopKeyVerifier, wrappedLbopKeyVerifier, currentUser, masterKey, wrappedMasterKey, meta, cipherMeta, res;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                var lbops, lbopString, _loop_1, this_1, state_1, lbopKeyParams, lbopKey, _a, _b, _c, _d, _e, lbopKeyVerifier, wrappedLbopKeyVerifier, currentUser, masterKey, wrappedMasterKey, meta, cipherMeta, res;
+                return __generator(this, function (_f) {
+                    switch (_f.label) {
                         case 0:
                             if (slip39.Slip39Helper.WORD_LIST.length !== 1024) {
                                 throw new LrBadLogicException('Slip39Helper.WORD_LIST.length != 1024');
                             }
                             return [4 /*yield*/, this.list()];
                         case 1:
-                            lbops = _a.sent();
+                            lbops = _f.sent();
                             _loop_1 = function () {
                                 lbopString = this_1.keyFactory
                                     .randomChoices(slip39.Slip39Helper.WORD_LIST, this_1.LBOP_WORDS)
@@ -10488,29 +10474,33 @@
                             }
                             return [4 /*yield*/, this.keyFactory.createLbopKeyParams()];
                         case 2:
-                            lbopKeyParams = _a.sent();
-                            return [4 /*yield*/, this.keyFactory.deriveLbopKey(Object.assign({ password: lbopString }, lbopKeyParams))];
-                        case 3:
-                            lbopKey = (_a.sent()).jwk;
-                            return [4 /*yield*/, this.keyFactory.createSignKey()];
+                            lbopKeyParams = _f.sent();
+                            _b = (_a = this.keyFactory).deriveLbopKey;
+                            _d = (_c = Object).assign;
+                            _e = {};
+                            return [4 /*yield*/, this.keyFactory.importPassword(lbopString)];
+                        case 3: return [4 /*yield*/, _b.apply(_a, [_d.apply(_c, [(_e.password = _f.sent(), _e), lbopKeyParams])])];
                         case 4:
-                            lbopKeyVerifier = _a.sent();
-                            return [4 /*yield*/, this.encryptionService.encrypt(lbopKey, lbopKeyVerifier.toJSON(true))];
+                            lbopKey = (_f.sent()).jwk;
+                            return [4 /*yield*/, this.keyFactory.createSignKey()];
                         case 5:
-                            wrappedLbopKeyVerifier = _a.sent();
-                            return [4 /*yield*/, this.authService.getUser()];
+                            lbopKeyVerifier = _f.sent();
+                            return [4 /*yield*/, this.encryptionService.encrypt(lbopKey, lbopKeyVerifier.toJSON(true))];
                         case 6:
-                            currentUser = _a.sent();
-                            return [4 /*yield*/, this.keyGraph.getKey(currentUser.currentUserKey.masterKey.id)];
+                            wrappedLbopKeyVerifier = _f.sent();
+                            return [4 /*yield*/, this.authService.getUser()];
                         case 7:
-                            masterKey = _a.sent();
-                            return [4 /*yield*/, this.encryptionService.encrypt(lbopKey, masterKey.jwk.toJSON(true))];
+                            currentUser = _f.sent();
+                            return [4 /*yield*/, this.keyGraph.getKey(currentUser.currentUserKey.masterKey.id)];
                         case 8:
-                            wrappedMasterKey = _a.sent();
+                            masterKey = _f.sent();
+                            return [4 /*yield*/, this.encryptionService.encrypt(lbopKey, masterKey.jwk.toJSON(true))];
+                        case 9:
+                            wrappedMasterKey = _f.sent();
                             meta = Object.assign(Object.assign({}, (name && { name: name })), { partial: this.getPartial(lbopString) });
                             return [4 /*yield*/, this.encryptionService.encrypt(masterKey.jwk, meta)];
-                        case 9:
-                            cipherMeta = _a.sent();
+                        case 10:
+                            cipherMeta = _f.sent();
                             return [4 /*yield*/, this.lrApollo.mutate({
                                     mutation: CreateLbopQuery,
                                     variables: {
@@ -10524,8 +10514,8 @@
                                         },
                                     },
                                 })];
-                        case 10:
-                            res = _a.sent();
+                        case 11:
+                            res = _f.sent();
                             return [2 /*return*/, Object.assign(Object.assign({}, res.createLbop.lbop), { lbopString: lbopString })];
                     }
                 });
@@ -10548,59 +10538,63 @@
         // --------------------------------------------------------------------------------------------------------------------
         LbopService.prototype.verifyLbops = function (challengeResult, lbopString) {
             return __awaiter(this, void 0, void 0, function () {
-                var clientNonce, _a, _b, lbop, lbopKey, lbopKeyVerifier, serverNonce, signedChallenge, error_1, e_1_1;
-                var e_1, _c;
-                return __generator(this, function (_d) {
-                    switch (_d.label) {
+                var clientNonce, _a, _b, lbop, lbopKey, _c, _d, _e, _f, _g, lbopKeyVerifier, serverNonce, signedChallenge, error_1, e_1_1;
+                var e_1, _h;
+                return __generator(this, function (_j) {
+                    switch (_j.label) {
                         case 0:
                             clientNonce = this.keyFactory.randomString(this.CLIENT_NONCE_LENGTH);
-                            _d.label = 1;
+                            _j.label = 1;
                         case 1:
-                            _d.trys.push([1, 10, 11, 12]);
+                            _j.trys.push([1, 11, 12, 13]);
                             _a = __values(challengeResult.lbops), _b = _a.next();
-                            _d.label = 2;
+                            _j.label = 2;
                         case 2:
-                            if (!!_b.done) return [3 /*break*/, 9];
+                            if (!!_b.done) return [3 /*break*/, 10];
                             lbop = _b.value;
-                            return [4 /*yield*/, this.keyFactory.deriveLbopKey(Object.assign({ password: lbopString }, lbop.lbopKeyParams))];
-                        case 3:
-                            lbopKey = (_d.sent()).jwk;
-                            _d.label = 4;
+                            _d = (_c = this.keyFactory).deriveLbopKey;
+                            _f = (_e = Object).assign;
+                            _g = {};
+                            return [4 /*yield*/, this.keyFactory.importPassword(lbopString)];
+                        case 3: return [4 /*yield*/, _d.apply(_c, [_f.apply(_e, [(_g.password = _j.sent(), _g), lbop.lbopKeyParams])])];
                         case 4:
-                            _d.trys.push([4, 7, , 8]);
-                            return [4 /*yield*/, this.encryptionService.decrypt(lbopKey, lbop.wrappedLbopKeyVerifier)];
+                            lbopKey = (_j.sent()).jwk;
+                            _j.label = 5;
                         case 5:
-                            lbopKeyVerifier = (_d.sent());
+                            _j.trys.push([5, 8, , 9]);
+                            return [4 /*yield*/, this.encryptionService.decrypt(lbopKey, lbop.wrappedLbopKeyVerifier)];
+                        case 6:
+                            lbopKeyVerifier = (_j.sent());
                             serverNonce = challengeResult.challenge.serverNonce;
                             return [4 /*yield*/, this.encryptionService.sign(lbopKeyVerifier, {
                                     serverNonce: serverNonce,
                                     clientNonce: clientNonce,
                                 })];
-                        case 6:
-                            signedChallenge = _d.sent();
+                        case 7:
+                            signedChallenge = _j.sent();
                             return [2 /*return*/, {
                                     lbop: lbop,
                                     signedChallenge: signedChallenge,
                                     lbopKey: lbopKey,
                                 }];
-                        case 7:
-                            error_1 = _d.sent();
-                            return [3 /*break*/, 8];
                         case 8:
+                            error_1 = _j.sent();
+                            return [3 /*break*/, 9];
+                        case 9:
                             _b = _a.next();
                             return [3 /*break*/, 2];
-                        case 9: return [3 /*break*/, 12];
-                        case 10:
-                            e_1_1 = _d.sent();
-                            e_1 = { error: e_1_1 };
-                            return [3 /*break*/, 12];
+                        case 10: return [3 /*break*/, 13];
                         case 11:
+                            e_1_1 = _j.sent();
+                            e_1 = { error: e_1_1 };
+                            return [3 /*break*/, 13];
+                        case 12:
                             try {
-                                if (_b && !_b.done && (_c = _a.return)) _c.call(_a);
+                                if (_b && !_b.done && (_h = _a.return)) _h.call(_a);
                             }
                             finally { if (e_1) throw e_1.error; }
                             return [7 /*endfinally*/];
-                        case 12: throw new LrException({
+                        case 13: throw new LrException({
                             source: 'LBOP',
                             code: 'INVALID_PASSPHRASE',
                             message: 'Invalid passphrase.',
@@ -12866,7 +12860,7 @@
 
     var SCENARIO_SLIP39_PASSPHRASE = 'lifeready';
 
-    exports.ɵo = /** @class */ (function (_super) {
+    exports.ɵn = /** @class */ (function (_super) {
         __extends(ScenarioAssemblyController, _super);
         function ScenarioAssemblyController(ngZone, injector) {
             var _this = _super.call(this, injector) || this;
@@ -12880,21 +12874,21 @@
         };
         return ScenarioAssemblyController;
     }(TpAssemblyController));
-    exports.ɵo.ɵprov = i0.ɵɵdefineInjectable({ factory: function ScenarioAssemblyController_Factory() { return new exports.ɵo(i0.ɵɵinject(i0.NgZone), i0.ɵɵinject(i0.INJECTOR)); }, token: exports.ɵo, providedIn: "root" });
-    exports.ɵo.decorators = [
+    exports.ɵn.ɵprov = i0.ɵɵdefineInjectable({ factory: function ScenarioAssemblyController_Factory() { return new exports.ɵn(i0.ɵɵinject(i0.NgZone), i0.ɵɵinject(i0.INJECTOR)); }, token: exports.ɵn, providedIn: "root" });
+    exports.ɵn.decorators = [
         { type: i0.Injectable, args: [{
                     providedIn: 'root',
                 },] }
     ];
-    exports.ɵo.ctorParameters = function () { return [
+    exports.ɵn.ctorParameters = function () { return [
         { type: i0.NgZone },
         { type: i0.Injector }
     ]; };
-    exports.ɵo = __decorate([
+    exports.ɵn = __decorate([
         RunOutsideAngular({
             ngZoneName: 'ngZone',
         })
-    ], exports.ɵo);
+    ], exports.ɵn);
 
     var CreateScenarioMutation = gqlTyped(templateObject_1$q || (templateObject_1$q = __makeTemplateObject(["\nmutation CreateScenarioMutation($input: CreateScenarioInput!) {\n  createScenario(input: $input) {\n    scenario {\n      id\n    }\n  }\n}\n"], ["\nmutation CreateScenarioMutation($input: CreateScenarioInput!) {\n  createScenario(input: $input) {\n    scenario {\n      id\n    }\n  }\n}\n"])));
     var UpdateScenarioMutation = gqlTyped(templateObject_2$m || (templateObject_2$m = __makeTemplateObject(["\nmutation UpdateScenarioMutation($input: UpdateScenarioInput!) {\n  updateScenario(input: $input) {\n    scenario {\n      id\n    }\n  }\n}\n"], ["\nmutation UpdateScenarioMutation($input: UpdateScenarioInput!) {\n  updateScenario(input: $input) {\n    scenario {\n      id\n    }\n  }\n}\n"])));
@@ -13736,7 +13730,7 @@
         return ScenarioService;
     }(LrService));
     exports.ScenarioService.SLIP39_PASSPHRASE = 'lifeready';
-    exports.ScenarioService.ɵprov = i0.ɵɵdefineInjectable({ factory: function ScenarioService_Factory() { return new exports.ScenarioService(i0.ɵɵinject(i0.NgZone), i0.ɵɵinject(i0.INJECTOR), i0.ɵɵinject(KeyGraphService), i0.ɵɵinject(exports.Item2Service), i0.ɵɵinject(exports.ɵo), i0.ɵɵinject(EncryptionService)); }, token: exports.ScenarioService, providedIn: "root" });
+    exports.ScenarioService.ɵprov = i0.ɵɵdefineInjectable({ factory: function ScenarioService_Factory() { return new exports.ScenarioService(i0.ɵɵinject(i0.NgZone), i0.ɵɵinject(i0.INJECTOR), i0.ɵɵinject(KeyGraphService), i0.ɵɵinject(exports.Item2Service), i0.ɵɵinject(exports.ɵn), i0.ɵɵinject(EncryptionService)); }, token: exports.ScenarioService, providedIn: "root" });
     exports.ScenarioService.decorators = [
         { type: i0.Injectable, args: [{
                     providedIn: 'root',
@@ -13747,7 +13741,7 @@
         { type: i0.Injector },
         { type: KeyGraphService },
         { type: exports.Item2Service },
-        { type: exports.ɵo },
+        { type: exports.ɵn },
         { type: EncryptionService }
     ]; };
     exports.ScenarioService = __decorate([
@@ -13966,7 +13960,7 @@
         })
     ], exports.SharedContactCard2Service);
 
-    exports.ɵp = /** @class */ (function (_super) {
+    exports.ɵo = /** @class */ (function (_super) {
         __extends(TpPasswordResetPrivateService, _super);
         function TpPasswordResetPrivateService(ngZone, injector) {
             var _this = _super.call(this, injector) || this;
@@ -14015,21 +14009,21 @@
         };
         return TpPasswordResetPrivateService;
     }(LrService));
-    exports.ɵp.ɵprov = i0.ɵɵdefineInjectable({ factory: function TpPasswordResetPrivateService_Factory() { return new exports.ɵp(i0.ɵɵinject(i0.NgZone), i0.ɵɵinject(i0.INJECTOR)); }, token: exports.ɵp, providedIn: "root" });
-    exports.ɵp.decorators = [
+    exports.ɵo.ɵprov = i0.ɵɵdefineInjectable({ factory: function TpPasswordResetPrivateService_Factory() { return new exports.ɵo(i0.ɵɵinject(i0.NgZone), i0.ɵɵinject(i0.INJECTOR)); }, token: exports.ɵo, providedIn: "root" });
+    exports.ɵo.decorators = [
         { type: i0.Injectable, args: [{
                     providedIn: 'root',
                 },] }
     ];
-    exports.ɵp.ctorParameters = function () { return [
+    exports.ɵo.ctorParameters = function () { return [
         { type: i0.NgZone },
         { type: i0.Injector }
     ]; };
-    exports.ɵp = __decorate([
+    exports.ɵo = __decorate([
         RunOutsideAngular({
             ngZoneName: 'ngZone',
         })
-    ], exports.ɵp);
+    ], exports.ɵo);
 
     exports.TpPasswordResetRequestService = /** @class */ (function (_super) {
         __extends(TpPasswordResetRequestService, _super);
@@ -14145,7 +14139,7 @@
         };
         return TpPasswordResetRequestService;
     }(LrService));
-    exports.TpPasswordResetRequestService.ɵprov = i0.ɵɵdefineInjectable({ factory: function TpPasswordResetRequestService_Factory() { return new exports.TpPasswordResetRequestService(i0.ɵɵinject(i0.NgZone), i0.ɵɵinject(i0.INJECTOR), i0.ɵɵinject(EncryptionService), i0.ɵɵinject(exports.ɵp)); }, token: exports.TpPasswordResetRequestService, providedIn: "root" });
+    exports.TpPasswordResetRequestService.ɵprov = i0.ɵɵdefineInjectable({ factory: function TpPasswordResetRequestService_Factory() { return new exports.TpPasswordResetRequestService(i0.ɵɵinject(i0.NgZone), i0.ɵɵinject(i0.INJECTOR), i0.ɵɵinject(EncryptionService), i0.ɵɵinject(exports.ɵo)); }, token: exports.TpPasswordResetRequestService, providedIn: "root" });
     exports.TpPasswordResetRequestService.decorators = [
         { type: i0.Injectable, args: [{
                     providedIn: 'root',
@@ -14155,7 +14149,7 @@
         { type: i0.NgZone },
         { type: i0.Injector },
         { type: EncryptionService },
-        { type: exports.ɵp }
+        { type: exports.ɵo }
     ]; };
     exports.TpPasswordResetRequestService = __decorate([
         RunOutsideAngular({
@@ -14163,6 +14157,33 @@
         })
     ], exports.TpPasswordResetRequestService);
 
+    var COGNITO_LOCALSTORAGE_PREFIX = 'CognitoIdentityServiceProvider';
+    /**
+     * Remove all keys in localstorage with matching prefix.
+     * A prefix must be specified. If you want to remove everything, then just use localStorage.clear().
+     *
+     * @param prefix Keys with this prefix will be removed.
+     */
+    function clearLocalStorage(prefix) {
+        if (!prefix) {
+            throw new LrBadArgumentException('You must specify a non empty prefix.');
+        }
+        // Remove all persisted session variables
+        Object.keys(localStorage).forEach(function (key) {
+            if (key.startsWith(prefix)) {
+                localStorage.removeItem(key);
+            }
+        });
+    }
+    /**
+     * Clear all items related to cognito in localstorage.
+     * The remember device function sometimes interferes with creating new users
+     * on TP based password reset.
+     */
+    function clearCognitoLocalStorage() {
+        clearLocalStorage(COGNITO_LOCALSTORAGE_PREFIX);
+    }
+
     exports.TpPasswordResetUserService = /** @class */ (function (_super) {
         __extends(TpPasswordResetUserService, _super);
         function TpPasswordResetUserService(ngZone, injector, config, keyFactory, encryptionService, passwordService, http, auth) {
@@ -14214,7 +14235,11 @@
                 var passKeyBundle, masterKey, wrappedMasterKey, prk, masterKeyWrappedPrk, requestResetResult, signUpResult;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.passwordService.createPassKeyBundle(password)];
+                        case 0:
+                            // Clearing all localstorage data because cognito has the "remember device" functionality which sometimes
+                            // does not work properly. Clearing localstorage seems to solve this issue.
+                            clearCognitoLocalStorage();
+                            return [4 /*yield*/, this.passwordService.createPassKeyBundle(password)];
                         case 1:
                             passKeyBundle = _a.sent();
                             return [4 /*yield*/, this.keyFactory.createKey()];
@@ -14390,7 +14415,7 @@
         };
         return TpPasswordResetService;
     }(LrService));
-    exports.TpPasswordResetService.ɵprov = i0.ɵɵdefineInjectable({ factory: function TpPasswordResetService_Factory() { return new exports.TpPasswordResetService(i0.ɵɵinject(i0.NgZone), i0.ɵɵinject(i0.INJECTOR), i0.ɵɵinject(exports.ɵp), i0.ɵɵinject(exports.ɵj)); }, token: exports.TpPasswordResetService, providedIn: "root" });
+    exports.TpPasswordResetService.ɵprov = i0.ɵɵdefineInjectable({ factory: function TpPasswordResetService_Factory() { return new exports.TpPasswordResetService(i0.ɵɵinject(i0.NgZone), i0.ɵɵinject(i0.INJECTOR), i0.ɵɵinject(exports.ɵo), i0.ɵɵinject(exports.ɵi)); }, token: exports.TpPasswordResetService, providedIn: "root" });
     exports.TpPasswordResetService.decorators = [
         { type: i0.Injectable, args: [{
                     providedIn: 'root',
@@ -14399,8 +14424,8 @@
     exports.TpPasswordResetService.ctorParameters = function () { return [
         { type: i0.NgZone },
         { type: i0.Injector },
-        { type: exports.ɵp },
-        { type: exports.ɵj }
+        { type: exports.ɵo },
+        { type: exports.ɵi }
     ]; };
     exports.TpPasswordResetService = __decorate([
         RunOutsideAngular({
@@ -15026,11 +15051,10 @@
     exports.ɵd = KeyFactoryService;
     exports.ɵe = KeyMetaService;
     exports.ɵh = RunOutsideAngular;
-    exports.ɵi = Slip39Service;
-    exports.ɵk = TpAssemblyController;
-    exports.ɵl = LrService;
-    exports.ɵm = SharedContactCardService;
-    exports.ɵn = TrustedPartyService;
+    exports.ɵj = TpAssemblyController;
+    exports.ɵk = LrService;
+    exports.ɵl = SharedContactCardService;
+    exports.ɵm = TrustedPartyService;
 
     Object.defineProperty(exports, '__esModule', { value: true });