@metamask-previews/keyring-controller 22.0.2-preview-08a4995 → 22.0.2-preview-3636a128

package/CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Add method `exportEncryptionKey` ([#5984](https://github.com/MetaMask/core/pull/5984))
+
+### Changed
+
+- Make salt optional with method `submitEncryptionKey` ([#5984](https://github.com/MetaMask/core/pull/5984))
+
 ## [22.0.2]
 
 ### Fixed

package/dist/KeyringController.cjs

@@ -858,11 +858,12 @@ class KeyringController extends base_controller_1.BaseController {
         });
     }
     /**
-     * Attempts to decrypt the current vault and load its keyrings,
-     * using the given encryption key and salt.
+     * Attempts to decrypt the current vault and load its keyrings, using the
+     * given encryption key and salt. The optional salt can be used to check for
+     * consistency with the vault salt.
      *
      * @param encryptionKey - Key to unlock the keychain.
-     * @param encryptionSalt - Salt to unlock the keychain.
+     * @param encryptionSalt - Optional salt to unlock the keychain.
      * @returns Promise resolving when the operation completes.
      */
     async submitEncryptionKey(encryptionKey, encryptionSalt) {
@@ -886,6 +887,35 @@ class KeyringController extends base_controller_1.BaseController {
             console.error('Failed to update vault during login:', error);
         }
     }
+    /**
+     * Exports the vault encryption key.
+     *
+     * @returns The vault encryption key.
+     */
+    async exportEncryptionKey() {
+        __classPrivateFieldGet(this, _KeyringController_instances, "m", _KeyringController_assertIsUnlocked).call(this);
+        // There is a case where the controller is unlocked but the encryption key
+        // is not set, even when #cacheEncryptionKey is true. This happens when
+        // calling changePassword with the existing password. In this case, the
+        // encryption key is deleted, but the state is not recreated, because the
+        // session state does not change in this case, and #updateVault is not
+        // called in #persistOrRollback.
+        if (!this.state.encryptionKey) {
+            assertIsExportableKeyEncryptor(__classPrivateFieldGet(this, _KeyringController_encryptor, "f"));
+            assertIsValidPassword(__classPrivateFieldGet(this, _KeyringController_password, "f"));
+            const result = await __classPrivateFieldGet(this, _KeyringController_encryptor, "f").decryptWithDetail(__classPrivateFieldGet(this, _KeyringController_password, "f"), 
+            // Ignoring undefined. Assuming vault is set when unlocked.
+            this.state.vault);
+            if (__classPrivateFieldGet(this, _KeyringController_cacheEncryptionKey, "f")) {
+                this.update((state) => {
+                    state.encryptionKey = result.exportedKeyString;
+                    state.encryptionSalt = result.salt;
+                });
+            }
+            return result.exportedKeyString;
+        }
+        return this.state.encryptionKey;
+    }
     /**
      * Attempts to decrypt the current vault and load its keyrings,
      * using the given password.
@@ -1384,9 +1414,12 @@ async function _KeyringController_unlockKeyrings(password, encryptionKey, encryp
             }
             else {
                 const parsedEncryptedVault = JSON.parse(encryptedVault);
-                if (encryptionSalt !== parsedEncryptedVault.salt) {
+                if (encryptionSalt && encryptionSalt !== parsedEncryptedVault.salt) {
                     throw new Error(constants_1.KeyringControllerError.ExpiredCredentials);
                 }
+                else {
+                    encryptionSalt = parsedEncryptedVault.salt;
+                }
                 if (typeof encryptionKey !== 'string') {
                     throw new TypeError(constants_1.KeyringControllerError.WrongPasswordType);
                 }
@@ -1395,9 +1428,6 @@ async function _KeyringController_unlockKeyrings(password, encryptionKey, encryp
                 // This call is required on the first call because encryptionKey
                 // is not yet inside the memStore
                 updatedState.encryptionKey = encryptionKey;
-                // we can safely assume that encryptionSalt is defined here
-                // because we compare it with the salt from the vault
-                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
                 updatedState.encryptionSalt = encryptionSalt;
             }
         }