@metamask-previews/profile-sync-controller 34.0.3-preview-51ecba2 → 34.0.3-preview-b50d61887
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +0 -10
- package/dist/controllers/authentication/AuthenticationController-method-action-types.d.ts +2 -23
- package/dist/controllers/authentication/AuthenticationController-method-action-types.d.ts.map +1 -1
- package/dist/controllers/authentication/AuthenticationController-method-action-types.js.map +1 -1
- package/dist/controllers/authentication/AuthenticationController.d.ts +1 -19
- package/dist/controllers/authentication/AuthenticationController.d.ts.map +1 -1
- package/dist/controllers/authentication/AuthenticationController.js +2 -48
- package/dist/controllers/authentication/AuthenticationController.js.map +1 -1
- package/dist/controllers/authentication/index.d.ts +1 -1
- package/dist/controllers/authentication/index.d.ts.map +1 -1
- package/dist/controllers/authentication/index.js.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/flow-srp.d.ts +2 -13
- package/dist/sdk/authentication-jwt-bearer/flow-srp.d.ts.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/flow-srp.js +4 -19
- package/dist/sdk/authentication-jwt-bearer/flow-srp.js.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/services.d.ts +1 -12
- package/dist/sdk/authentication-jwt-bearer/services.d.ts.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/services.js +14 -56
- package/dist/sdk/authentication-jwt-bearer/services.js.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/types.d.ts +0 -9
- package/dist/sdk/authentication-jwt-bearer/types.d.ts.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/types.js.map +1 -1
- package/dist/sdk/authentication.d.ts +2 -3
- package/dist/sdk/authentication.d.ts.map +1 -1
- package/dist/sdk/authentication.js +2 -6
- package/dist/sdk/authentication.js.map +1 -1
- package/dist/sdk/constants.d.ts +0 -1
- package/dist/sdk/constants.d.ts.map +1 -1
- package/dist/sdk/constants.js +0 -1
- package/dist/sdk/constants.js.map +1 -1
- package/dist/sdk/errors.d.ts +0 -8
- package/dist/sdk/errors.d.ts.map +1 -1
- package/dist/sdk/errors.js +0 -11
- package/dist/sdk/errors.js.map +1 -1
- package/dist/sdk/mocks/auth.d.ts +0 -12
- package/dist/sdk/mocks/auth.d.ts.map +1 -1
- package/dist/sdk/mocks/auth.js +1 -13
- package/dist/sdk/mocks/auth.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -7,22 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
-
### Added
|
|
11
|
-
|
|
12
|
-
- Add `AuthenticationController.exchangeSocialAccessToken` and the `AuthenticationController:exchangeSocialAccessToken` messenger action, exchanging the wallet's Google, Apple or Telegram social access token (`POST /api/v2/social/login`) for an access token and the canonical profile, without storing them ([#10886](https://github.com/MetaMask/core/pull/10886))
|
|
13
|
-
- Add `exchangeSocialAccessToken` to the SDK's `JwtBearerAuth`, the `SocialLoginParams` type, and `SocialIdentifierNotPairedError`, thrown when the identifier was never paired to a profile
|
|
14
|
-
|
|
15
10
|
### Changed
|
|
16
11
|
|
|
17
12
|
- Bump `loglevel` from `^1.8.1` to `^1.9.2` ([#10724](https://github.com/MetaMask/core/pull/10724))
|
|
18
13
|
- Bump `@metamask/keyring-controller` from `^28.1.0` to `^28.2.0` ([#10851](https://github.com/MetaMask/core/pull/10851))
|
|
19
14
|
- Bump `@metamask/base-controller` from `^10.0.0` to `^10.1.0` ([#10864](https://github.com/MetaMask/core/pull/10864))
|
|
20
15
|
|
|
21
|
-
### Fixed
|
|
22
|
-
|
|
23
|
-
- Fix `AuthenticationController.completeCredentialEnrollment` failing with `aal2_required` when adding a second factor, by sending the verification token that began the enrollment, which the server now requires to complete it too ([#00000](https://github.com/MetaMask/core/pull/00000))
|
|
24
|
-
- `JwtBearerAuth.completeMfaEnrollment` accepts an optional `accessToken`, like `beginMfaEnrollment`
|
|
25
|
-
|
|
26
16
|
## [34.0.3]
|
|
27
17
|
|
|
28
18
|
### Changed
|
|
@@ -7,23 +7,6 @@ export type AuthenticationControllerPerformSignInAction = {
|
|
|
7
7
|
type: `AuthenticationController:performSignIn`;
|
|
8
8
|
handler: AuthenticationController['performSignIn'];
|
|
9
9
|
};
|
|
10
|
-
/**
|
|
11
|
-
* Exchanges the social access token SeedlessOnboarding holds for the
|
|
12
|
-
* wallet's Google/Apple/Telegram login (`POST /api/v2/social/login`) for an
|
|
13
|
-
* access token and the canonical profile it is paired to. Shows no UI and
|
|
14
|
-
* stores nothing: SRP sessions remain the source of truth for
|
|
15
|
-
* `getBearerToken`.
|
|
16
|
-
*
|
|
17
|
-
* Throws when the wallet has no social vault or no social token, and
|
|
18
|
-
* `SocialIdentifierNotPairedError` when the identifier was never paired to
|
|
19
|
-
* a profile.
|
|
20
|
-
*
|
|
21
|
-
* @returns The access token and canonical profile.
|
|
22
|
-
*/
|
|
23
|
-
export type AuthenticationControllerExchangeSocialAccessTokenAction = {
|
|
24
|
-
type: `AuthenticationController:exchangeSocialAccessToken`;
|
|
25
|
-
handler: AuthenticationController['exchangeSocialAccessToken'];
|
|
26
|
-
};
|
|
27
10
|
/**
|
|
28
11
|
* Marks profile pairing as needed. Clients call this when the SRP set
|
|
29
12
|
* changes (e.g. a new keyring was added) so the next auto-sign-in cycle
|
|
@@ -55,9 +38,6 @@ export type AuthenticationControllerBeginCredentialEnrollmentAction = {
|
|
|
55
38
|
/**
|
|
56
39
|
* Completes credential enrollment and refreshes the credential cache.
|
|
57
40
|
*
|
|
58
|
-
* It is sent with the verification token that began the enrollment, if
|
|
59
|
-
* any: once a factor is enrolled, the server requires AAL2 for both steps.
|
|
60
|
-
*
|
|
61
41
|
* The server returns an assertion for the new credential, which opens a
|
|
62
42
|
* verification session like `completeCredentialVerification`, replacing
|
|
63
43
|
* any earlier one. If that exchange fails, the earlier session is kept:
|
|
@@ -123,8 +103,7 @@ export type AuthenticationControllerGetVerificationTokenAction = {
|
|
|
123
103
|
handler: AuthenticationController['getVerificationToken'];
|
|
124
104
|
};
|
|
125
105
|
/**
|
|
126
|
-
* Clears every in-memory verification session and its expiration timer
|
|
127
|
-
* and the tokens kept for enrollments in progress.
|
|
106
|
+
* Clears every in-memory verification session and its expiration timer.
|
|
128
107
|
*/
|
|
129
108
|
export type AuthenticationControllerClearVerificationSessionAction = {
|
|
130
109
|
type: `AuthenticationController:clearVerificationSession`;
|
|
@@ -237,5 +216,5 @@ export type AuthenticationControllerIsSignedInAction = {
|
|
|
237
216
|
/**
|
|
238
217
|
* Union of all AuthenticationController action types.
|
|
239
218
|
*/
|
|
240
|
-
export type AuthenticationControllerMethodActions = AuthenticationControllerPerformSignInAction |
|
|
219
|
+
export type AuthenticationControllerMethodActions = AuthenticationControllerPerformSignInAction | AuthenticationControllerRequestProfilePairingAction | AuthenticationControllerRefreshEnrolledCredentialsAction | AuthenticationControllerBeginCredentialEnrollmentAction | AuthenticationControllerCompleteCredentialEnrollmentAction | AuthenticationControllerBeginCredentialVerificationAction | AuthenticationControllerCompleteCredentialVerificationAction | AuthenticationControllerGetVerificationTokenAction | AuthenticationControllerClearVerificationSessionAction | AuthenticationControllerPerformSignOutAction | AuthenticationControllerClearStateAction | AuthenticationControllerGetBearerTokenAction | AuthenticationControllerGetSessionProfileAction | AuthenticationControllerRefreshCanonicalProfileIdAction | AuthenticationControllerGetUserProfileLineageAction | AuthenticationControllerGetCustomerServiceTokenAction | AuthenticationControllerGetPartnerIdentityTokenAction | AuthenticationControllerIsSignedInAction;
|
|
241
220
|
//# sourceMappingURL=AuthenticationController-method-action-types.d.ts.map
|
package/dist/controllers/authentication/AuthenticationController-method-action-types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthenticationController-method-action-types.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF
|
|
1
|
+
{"version":3,"file":"AuthenticationController-method-action-types.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,wBAAwB,CAAC,4BAA4B,CAAC,CAAC;CACjE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,wBAAwB,CAAC,8BAA8B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,wBAAwB,CAAC,6BAA6B,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4DAA4D,GAAG;IACzE,IAAI,EAAE,yDAAyD,CAAC;IAChE,OAAO,EAAE,wBAAwB,CAAC,gCAAgC,CAAC,CAAC;CACrE,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,wBAAwB,CAAC,sBAAsB,CAAC,CAAC;CAC3D,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,sDAAsD,GAAG;IACnE,IAAI,EAAE,mDAAmD,CAAC;IAC1D,OAAO,EAAE,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;CAC/D,CAAC;AAEF,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qCAAqC,GAC7C,2CAA2C,GAC3C,mDAAmD,GACnD,wDAAwD,GACxD,uDAAuD,GACvD,0DAA0D,GAC1D,yDAAyD,GACzD,4DAA4D,GAC5D,kDAAkD,GAClD,sDAAsD,GACtD,4CAA4C,GAC5C,wCAAwC,GACxC,4CAA4C,GAC5C,+CAA+C,GAC/C,uDAAuD,GACvD,mDAAmD,GACnD,qDAAqD,GACrD,qDAAqD,GACrD,wCAAwC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthenticationController-method-action-types.js","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController.js';\n\nexport type AuthenticationControllerPerformSignInAction = {\n type: `AuthenticationController:performSignIn`;\n handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Exchanges the social access token SeedlessOnboarding holds for the\n * wallet's Google/Apple/Telegram login (`POST /api/v2/social/login`) for an\n * access token and the canonical profile it is paired to. Shows no UI and\n * stores nothing: SRP sessions remain the source of truth for\n * `getBearerToken`.\n *\n * Throws when the wallet has no social vault or no social token, and\n * `SocialIdentifierNotPairedError` when the identifier was never paired to\n * a profile.\n *\n * @returns The access token and canonical profile.\n */\nexport type AuthenticationControllerExchangeSocialAccessTokenAction = {\n type: `AuthenticationController:exchangeSocialAccessToken`;\n handler: AuthenticationController['exchangeSocialAccessToken'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n type: `AuthenticationController:requestProfilePairing`;\n handler: AuthenticationController['requestProfilePairing'];\n};\n\n/**\n * Refreshes credentials enrolled on the canonical profile.\n *\n * @returns The current supported credentials.\n */\nexport type AuthenticationControllerRefreshEnrolledCredentialsAction = {\n type: `AuthenticationController:refreshEnrolledCredentials`;\n handler: AuthenticationController['refreshEnrolledCredentials'];\n};\n\n/**\n * Begins enrollment of a passkey or email OTP credential.\n *\n * @param request - Credential, optional email address, and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginCredentialEnrollmentAction = {\n type: `AuthenticationController:beginCredentialEnrollment`;\n handler: AuthenticationController['beginCredentialEnrollment'];\n};\n\n/**\n * Completes credential enrollment and refreshes the credential cache.\n *\n * It is sent with the verification token that began the enrollment, if\n * any: once a factor is enrolled, the server requires AAL2 for both steps.\n *\n * The server returns an assertion for the new credential, which opens a\n * verification session like `completeCredentialVerification`, replacing\n * any earlier one. If that exchange fails, the earlier session is kept:\n * the credential is enrolled either way.\n *\n * A cache-refresh failure does not undo successful enrollment. Email\n * enrollment invalidates the primary SRP session *after* refresh so the\n * credentials call can reuse the still-valid access token; the next token\n * fetch then includes the newly verified email claim. That invalidation\n * happens even if the session ends mid-request: the enrollment succeeded\n * on the server, so a token cached across a lock must not be reused\n * without the new claim.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The refreshed credentials, or the existing cache if refresh fails.\n */\nexport type AuthenticationControllerCompleteCredentialEnrollmentAction = {\n type: `AuthenticationController:completeCredentialEnrollment`;\n handler: AuthenticationController['completeCredentialEnrollment'];\n};\n\n/**\n * Begins verification with an enrolled credential.\n *\n * @param request - Credential type and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginCredentialVerificationAction = {\n type: `AuthenticationController:beginCredentialVerification`;\n handler: AuthenticationController['beginCredentialVerification'];\n};\n\n/**\n * Completes verification and opens a short-lived verification session.\n *\n * The assertion returned by the MFA service is exchanged at Hydra for an\n * access token. Its assurance level is not checked: the services receiving\n * the token enforce their own requirements. The token itself never enters\n * controller state.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The verification token.\n */\nexport type AuthenticationControllerCompleteCredentialVerificationAction = {\n type: `AuthenticationController:completeCredentialVerification`;\n handler: AuthenticationController['completeCredentialVerification'];\n};\n\n/**\n * Returns the active verification token when it meets the requested\n * freshness.\n *\n * Low-level: features should go through the client MFA kit\n * (`verifyOrEnroll`), which reuses a matching session without showing any\n * screen and checks which method proved it. Read the token directly only\n * from code that cannot show UI, and treat `null` as \"let the UI layer\n * ask\".\n *\n * @param request - Optional maximum session age in milliseconds, measured\n * from when the token was obtained. Zero always requires a new ceremony.\n * @returns A live verification token, or null when no reusable session\n * exists.\n */\nexport type AuthenticationControllerGetVerificationTokenAction = {\n type: `AuthenticationController:getVerificationToken`;\n handler: AuthenticationController['getVerificationToken'];\n};\n\n/**\n * Clears every in-memory verification session and its expiration timer,\n * and the tokens kept for enrollments in progress.\n */\nexport type AuthenticationControllerClearVerificationSessionAction = {\n type: `AuthenticationController:clearVerificationSession`;\n handler: AuthenticationController['clearVerificationSession'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n type: `AuthenticationController:performSignOut`;\n handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Resets the controller to `defaultState`. Clients call this on wallet reset\n * so the next wallet starts unsigned with both pairing gates re-armed.\n */\nexport type AuthenticationControllerClearStateAction = {\n type: `AuthenticationController:clearState`;\n handler: AuthenticationController['clearState'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n type: `AuthenticationController:getBearerToken`;\n handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n type: `AuthenticationController:getSessionProfile`;\n handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n type: `AuthenticationController:refreshCanonicalProfileId`;\n handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n type: `AuthenticationController:getUserProfileLineage`;\n handler: AuthenticationController['getUserProfileLineage'];\n};\n\n/**\n * Returns a Customer Service specific access token for the specified SRP,\n * logging in if needed.\n *\n * Exchanges the OIDC access token for a short-lived token scoped to the\n * customer-service audience. Customer Service tooling consumes this token to\n * identify and authenticate the user.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The customer-service access token.\n */\nexport type AuthenticationControllerGetCustomerServiceTokenAction = {\n type: `AuthenticationController:getCustomerServiceToken`;\n handler: AuthenticationController['getCustomerServiceToken'];\n};\n\n/**\n * Mints a partner identity token for the specified SRP, logging in if needed.\n *\n * Calls `POST /api/v2/oidc/token` with the Hydra login bearer and returns\n * the minted `access_token`. Email on live tokens is under JWT `ext`.\n * HTTP 422 throws `EmailRequiredError` when this profile has no\n * verified email.\n *\n * @param claims - Claim names to embed. Only `email` is supported.\n * @param audience - Partner audience (`kyc` or `iron`).\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The partner identity access token.\n */\nexport type AuthenticationControllerGetPartnerIdentityTokenAction = {\n type: `AuthenticationController:getPartnerIdentityToken`;\n handler: AuthenticationController['getPartnerIdentityToken'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n type: `AuthenticationController:isSignedIn`;\n handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n | AuthenticationControllerPerformSignInAction\n | AuthenticationControllerExchangeSocialAccessTokenAction\n | AuthenticationControllerRequestProfilePairingAction\n | AuthenticationControllerRefreshEnrolledCredentialsAction\n | AuthenticationControllerBeginCredentialEnrollmentAction\n | AuthenticationControllerCompleteCredentialEnrollmentAction\n | AuthenticationControllerBeginCredentialVerificationAction\n | AuthenticationControllerCompleteCredentialVerificationAction\n | AuthenticationControllerGetVerificationTokenAction\n | AuthenticationControllerClearVerificationSessionAction\n | AuthenticationControllerPerformSignOutAction\n | AuthenticationControllerClearStateAction\n | AuthenticationControllerGetBearerTokenAction\n | AuthenticationControllerGetSessionProfileAction\n | AuthenticationControllerRefreshCanonicalProfileIdAction\n | AuthenticationControllerGetUserProfileLineageAction\n | AuthenticationControllerGetCustomerServiceTokenAction\n | AuthenticationControllerGetPartnerIdentityTokenAction\n | AuthenticationControllerIsSignedInAction;\n"]}
|
|
1
|
+
{"version":3,"file":"AuthenticationController-method-action-types.js","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController.js';\n\nexport type AuthenticationControllerPerformSignInAction = {\n type: `AuthenticationController:performSignIn`;\n handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n type: `AuthenticationController:requestProfilePairing`;\n handler: AuthenticationController['requestProfilePairing'];\n};\n\n/**\n * Refreshes credentials enrolled on the canonical profile.\n *\n * @returns The current supported credentials.\n */\nexport type AuthenticationControllerRefreshEnrolledCredentialsAction = {\n type: `AuthenticationController:refreshEnrolledCredentials`;\n handler: AuthenticationController['refreshEnrolledCredentials'];\n};\n\n/**\n * Begins enrollment of a passkey or email OTP credential.\n *\n * @param request - Credential, optional email address, and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginCredentialEnrollmentAction = {\n type: `AuthenticationController:beginCredentialEnrollment`;\n handler: AuthenticationController['beginCredentialEnrollment'];\n};\n\n/**\n * Completes credential enrollment and refreshes the credential cache.\n *\n * The server returns an assertion for the new credential, which opens a\n * verification session like `completeCredentialVerification`, replacing\n * any earlier one. If that exchange fails, the earlier session is kept:\n * the credential is enrolled either way.\n *\n * A cache-refresh failure does not undo successful enrollment. Email\n * enrollment invalidates the primary SRP session *after* refresh so the\n * credentials call can reuse the still-valid access token; the next token\n * fetch then includes the newly verified email claim. That invalidation\n * happens even if the session ends mid-request: the enrollment succeeded\n * on the server, so a token cached across a lock must not be reused\n * without the new claim.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The refreshed credentials, or the existing cache if refresh fails.\n */\nexport type AuthenticationControllerCompleteCredentialEnrollmentAction = {\n type: `AuthenticationController:completeCredentialEnrollment`;\n handler: AuthenticationController['completeCredentialEnrollment'];\n};\n\n/**\n * Begins verification with an enrolled credential.\n *\n * @param request - Credential type and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginCredentialVerificationAction = {\n type: `AuthenticationController:beginCredentialVerification`;\n handler: AuthenticationController['beginCredentialVerification'];\n};\n\n/**\n * Completes verification and opens a short-lived verification session.\n *\n * The assertion returned by the MFA service is exchanged at Hydra for an\n * access token. Its assurance level is not checked: the services receiving\n * the token enforce their own requirements. The token itself never enters\n * controller state.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The verification token.\n */\nexport type AuthenticationControllerCompleteCredentialVerificationAction = {\n type: `AuthenticationController:completeCredentialVerification`;\n handler: AuthenticationController['completeCredentialVerification'];\n};\n\n/**\n * Returns the active verification token when it meets the requested\n * freshness.\n *\n * Low-level: features should go through the client MFA kit\n * (`verifyOrEnroll`), which reuses a matching session without showing any\n * screen and checks which method proved it. Read the token directly only\n * from code that cannot show UI, and treat `null` as \"let the UI layer\n * ask\".\n *\n * @param request - Optional maximum session age in milliseconds, measured\n * from when the token was obtained. Zero always requires a new ceremony.\n * @returns A live verification token, or null when no reusable session\n * exists.\n */\nexport type AuthenticationControllerGetVerificationTokenAction = {\n type: `AuthenticationController:getVerificationToken`;\n handler: AuthenticationController['getVerificationToken'];\n};\n\n/**\n * Clears every in-memory verification session and its expiration timer.\n */\nexport type AuthenticationControllerClearVerificationSessionAction = {\n type: `AuthenticationController:clearVerificationSession`;\n handler: AuthenticationController['clearVerificationSession'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n type: `AuthenticationController:performSignOut`;\n handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Resets the controller to `defaultState`. Clients call this on wallet reset\n * so the next wallet starts unsigned with both pairing gates re-armed.\n */\nexport type AuthenticationControllerClearStateAction = {\n type: `AuthenticationController:clearState`;\n handler: AuthenticationController['clearState'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n type: `AuthenticationController:getBearerToken`;\n handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n type: `AuthenticationController:getSessionProfile`;\n handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n type: `AuthenticationController:refreshCanonicalProfileId`;\n handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n type: `AuthenticationController:getUserProfileLineage`;\n handler: AuthenticationController['getUserProfileLineage'];\n};\n\n/**\n * Returns a Customer Service specific access token for the specified SRP,\n * logging in if needed.\n *\n * Exchanges the OIDC access token for a short-lived token scoped to the\n * customer-service audience. Customer Service tooling consumes this token to\n * identify and authenticate the user.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The customer-service access token.\n */\nexport type AuthenticationControllerGetCustomerServiceTokenAction = {\n type: `AuthenticationController:getCustomerServiceToken`;\n handler: AuthenticationController['getCustomerServiceToken'];\n};\n\n/**\n * Mints a partner identity token for the specified SRP, logging in if needed.\n *\n * Calls `POST /api/v2/oidc/token` with the Hydra login bearer and returns\n * the minted `access_token`. Email on live tokens is under JWT `ext`.\n * HTTP 422 throws `EmailRequiredError` when this profile has no\n * verified email.\n *\n * @param claims - Claim names to embed. Only `email` is supported.\n * @param audience - Partner audience (`kyc` or `iron`).\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The partner identity access token.\n */\nexport type AuthenticationControllerGetPartnerIdentityTokenAction = {\n type: `AuthenticationController:getPartnerIdentityToken`;\n handler: AuthenticationController['getPartnerIdentityToken'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n type: `AuthenticationController:isSignedIn`;\n handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n | AuthenticationControllerPerformSignInAction\n | AuthenticationControllerRequestProfilePairingAction\n | AuthenticationControllerRefreshEnrolledCredentialsAction\n | AuthenticationControllerBeginCredentialEnrollmentAction\n | AuthenticationControllerCompleteCredentialEnrollmentAction\n | AuthenticationControllerBeginCredentialVerificationAction\n | AuthenticationControllerCompleteCredentialVerificationAction\n | AuthenticationControllerGetVerificationTokenAction\n | AuthenticationControllerClearVerificationSessionAction\n | AuthenticationControllerPerformSignOutAction\n | AuthenticationControllerClearStateAction\n | AuthenticationControllerGetBearerTokenAction\n | AuthenticationControllerGetSessionProfileAction\n | AuthenticationControllerRefreshCanonicalProfileIdAction\n | AuthenticationControllerGetUserProfileLineageAction\n | AuthenticationControllerGetCustomerServiceTokenAction\n | AuthenticationControllerGetPartnerIdentityTokenAction\n | AuthenticationControllerIsSignedInAction;\n"]}
|
|
@@ -95,20 +95,6 @@ export declare class AuthenticationController extends BaseController<typeof cont
|
|
|
95
95
|
trace?: TraceCallback;
|
|
96
96
|
});
|
|
97
97
|
performSignIn(): Promise<string[]>;
|
|
98
|
-
/**
|
|
99
|
-
* Exchanges the social access token SeedlessOnboarding holds for the
|
|
100
|
-
* wallet's Google/Apple/Telegram login (`POST /api/v2/social/login`) for an
|
|
101
|
-
* access token and the canonical profile it is paired to. Shows no UI and
|
|
102
|
-
* stores nothing: SRP sessions remain the source of truth for
|
|
103
|
-
* `getBearerToken`.
|
|
104
|
-
*
|
|
105
|
-
* Throws when the wallet has no social vault or no social token, and
|
|
106
|
-
* `SocialIdentifierNotPairedError` when the identifier was never paired to
|
|
107
|
-
* a profile.
|
|
108
|
-
*
|
|
109
|
-
* @returns The access token and canonical profile.
|
|
110
|
-
*/
|
|
111
|
-
exchangeSocialAccessToken(): Promise<LoginResponse>;
|
|
112
98
|
/**
|
|
113
99
|
* Marks profile pairing as needed. Clients call this when the SRP set
|
|
114
100
|
* changes (e.g. a new keyring was added) so the next auto-sign-in cycle
|
|
@@ -131,9 +117,6 @@ export declare class AuthenticationController extends BaseController<typeof cont
|
|
|
131
117
|
/**
|
|
132
118
|
* Completes credential enrollment and refreshes the credential cache.
|
|
133
119
|
*
|
|
134
|
-
* It is sent with the verification token that began the enrollment, if
|
|
135
|
-
* any: once a factor is enrolled, the server requires AAL2 for both steps.
|
|
136
|
-
*
|
|
137
120
|
* The server returns an assertion for the new credential, which opens a
|
|
138
121
|
* verification session like `completeCredentialVerification`, replacing
|
|
139
122
|
* any earlier one. If that exchange fails, the earlier session is kept:
|
|
@@ -187,8 +170,7 @@ export declare class AuthenticationController extends BaseController<typeof cont
|
|
|
187
170
|
*/
|
|
188
171
|
getVerificationToken(request?: GetVerificationTokenRequest): VerificationToken | null;
|
|
189
172
|
/**
|
|
190
|
-
* Clears every in-memory verification session and its expiration timer
|
|
191
|
-
* and the tokens kept for enrollments in progress.
|
|
173
|
+
* Clears every in-memory verification session and its expiration timer.
|
|
192
174
|
*/
|
|
193
175
|
clearVerificationSession(): void;
|
|
194
176
|
performSignOut(): void;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthenticationController.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,4BAA4B,CAAC;AAE9E,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC5B,0CAA0C,EAC3C,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EACV,gDAAgD,EAChD,0CAA0C,EAC3C,MAAM,0CAA0C,CAAC;AAYlD,OAAO,KAAK,EAEV,aAAa,EACb,YAAY,EAIZ,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,2BAA2B,EAG3B,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,GAAG,EAKJ,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAOtE,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAE1G,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAK1B,CAAC;AAmEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAa,CAAC;AAaxD,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;IACT;;;;OAIG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC;CACvC,CAAC;
|
|
1
|
+
{"version":3,"file":"AuthenticationController.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,4BAA4B,CAAC;AAE9E,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC5B,0CAA0C,EAC3C,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EACV,gDAAgD,EAChD,0CAA0C,EAC3C,MAAM,0CAA0C,CAAC;AAYlD,OAAO,KAAK,EAEV,aAAa,EACb,YAAY,EAIZ,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,2BAA2B,EAG3B,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,GAAG,EAKJ,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAOtE,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAE1G,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAK1B,CAAC;AAmEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAa,CAAC;AAaxD,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;IACT;;;;OAIG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC;CACvC,CAAC;AAuBF,MAAM,MAAM,OAAO,GACf,sCAAsC,GACtC,qCAAqC,CAAC;AAE1C,MAAM,MAAM,sCAAsC,GAAG,wBAAwB,CAC3E,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAClD,0BAA0B,CACxB,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEJ,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,MAAM,GACd,wCAAwC,GACxC,0CAA0C,CAAC;AAG/C,KAAK,cAAc,GACf,+BAA+B,GAC/B,0CAA0C,GAC1C,0CAA0C,GAC1C,gDAAgD,CAAC;AAErD,KAAK,aAAa,GAAG,0BAA0B,GAAG,4BAA4B,CAAC;AAG/E,MAAM,MAAM,iCAAiC,GAAG,SAAS,CACvD,OAAO,cAAc,EACrB,OAAO,GAAG,cAAc,EACxB,MAAM,GAAG,aAAa,CACvB,CAAC;AAEF;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAC1D,OAAO,cAAc,EACrB,6BAA6B,EAC7B,iCAAiC,CAClC;;IA+DC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,EACX,KAAK,GACN,EAAE;QACD,SAAS,EAAE,iCAAiC,CAAC;QAC7C,KAAK,CAAC,EAAE,6BAA6B,CAAC;QACtC,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnC;;;WAGG;QACH,WAAW,EAAE,eAAe,CAAC;QAC7B,KAAK,CAAC,EAAE,aAAa,CAAC;KACvB,EAkDA;IAkLY,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAc9C;IAiJD;;;;OAIG;IACI,qBAAqB,IAAI,IAAI,CAOnC;IA8LD;;;;OAIG;IACU,0BAA0B,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA+BvE;IAED;;;;;OAKG;IACU,yBAAyB,CACpC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAyB9B;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACU,4BAA4B,CACvC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAqD/B;IAED;;;;;OAKG;IACU,2BAA2B,CACtC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,qBAAqB,CAAC,CAiBhC;IAED;;;;;;;;;;OAUG;IACU,8BAA8B,CACzC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,iBAAiB,CAAC,CA4B5B;IAsDD;;;;;;;;;;;;;;OAcG;IACI,oBAAoB,CACzB,OAAO,GAAE,2BAAgC,GACxC,iBAAiB,GAAG,IAAI,CAoB1B;IAmCD;;OAEG;IACI,wBAAwB,IAAI,IAAI,CAKtC;IAoBM,cAAc,IAAI,IAAI,CAQ5B;IAED;;;OAGG;IACI,UAAU,IAAI,IAAI,CAMxB;IAED;;;;;;;;;;OAUG;IACU,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIrE;IAED;;;;;;;;;;;;OAYG;IACU,iBAAiB,CAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC,CAItB;IAED;;;;;;;;;;;;;;;OAeG;IACU,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAgBxD;IAcY,qBAAqB,CAChC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAI7B;IAED;;;;;;;;;;OAUG;IACU,uBAAuB,CAClC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAIjB;IAED;;;;;;;;;;;;OAYG;IACU,uBAAuB,CAClC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAQjB;IAEM,UAAU,IAAI,OAAO,CAE3B;CA8EF"}
|
|
@@ -85,7 +85,6 @@ export const ENROLLMENT_MAX_SESSION_AGE_MS = 2 * 60_000;
|
|
|
85
85
|
const DEFAULT_AUDIENCE = '';
|
|
86
86
|
const MESSENGER_EXPOSED_METHODS = [
|
|
87
87
|
'performSignIn',
|
|
88
|
-
'exchangeSocialAccessToken',
|
|
89
88
|
'performSignOut',
|
|
90
89
|
'getBearerToken',
|
|
91
90
|
'getSessionProfile',
|
|
@@ -128,13 +127,6 @@ export class AuthenticationController extends BaseController {
|
|
|
128
127
|
* exist.
|
|
129
128
|
*/
|
|
130
129
|
#verificationSessions = new Map();
|
|
131
|
-
/**
|
|
132
|
-
* Verification tokens that authorized an enrollment's begin, by flow ID.
|
|
133
|
-
* The server asks for the same AAL2 proof when it is completed, which can
|
|
134
|
-
* be minutes later (for example, while the user finds an email code), past
|
|
135
|
-
* the default session age.
|
|
136
|
-
*/
|
|
137
|
-
#enrollmentAccessTokens = new Map();
|
|
138
130
|
/**
|
|
139
131
|
* Sequence number of the most recently started credentials refresh. Only
|
|
140
132
|
* that refresh may write the cache, so a slower, earlier request cannot
|
|
@@ -481,33 +473,6 @@ export class AuthenticationController extends BaseController {
|
|
|
481
473
|
throw error;
|
|
482
474
|
}
|
|
483
475
|
}
|
|
484
|
-
/**
|
|
485
|
-
* Exchanges the social access token SeedlessOnboarding holds for the
|
|
486
|
-
* wallet's Google/Apple/Telegram login (`POST /api/v2/social/login`) for an
|
|
487
|
-
* access token and the canonical profile it is paired to. Shows no UI and
|
|
488
|
-
* stores nothing: SRP sessions remain the source of truth for
|
|
489
|
-
* `getBearerToken`.
|
|
490
|
-
*
|
|
491
|
-
* Throws when the wallet has no social vault or no social token, and
|
|
492
|
-
* `SocialIdentifierNotPairedError` when the identifier was never paired to
|
|
493
|
-
* a profile.
|
|
494
|
-
*
|
|
495
|
-
* @returns The access token and canonical profile.
|
|
496
|
-
*/
|
|
497
|
-
async exchangeSocialAccessToken() {
|
|
498
|
-
const identifierType = this.#identifierTypeFromSeedlessState(this.messenger.call('SeedlessOnboardingController:getState'));
|
|
499
|
-
if (identifierType === 'SRP') {
|
|
500
|
-
throw new Error('exchangeSocialAccessToken - the wallet has no social login');
|
|
501
|
-
}
|
|
502
|
-
const socialJwt = await this.messenger.call('SeedlessOnboardingController:getAccessToken');
|
|
503
|
-
if (!socialJwt) {
|
|
504
|
-
throw new Error('exchangeSocialAccessToken - no social access token');
|
|
505
|
-
}
|
|
506
|
-
return await this.#auth.exchangeSocialAccessToken({
|
|
507
|
-
identifierType,
|
|
508
|
-
socialJwt,
|
|
509
|
-
});
|
|
510
|
-
}
|
|
511
476
|
#clearNeedsSocialPairing() {
|
|
512
477
|
if (this.state.needsSocialPairing !== false) {
|
|
513
478
|
this.update((state) => {
|
|
@@ -733,17 +698,11 @@ export class AuthenticationController extends BaseController {
|
|
|
733
698
|
accessToken,
|
|
734
699
|
}));
|
|
735
700
|
this.#assertAuthSessionEpoch(sessionEpoch, 'beginCredentialEnrollment');
|
|
736
|
-
if (accessToken) {
|
|
737
|
-
this.#enrollmentAccessTokens.set(challenge.flowId, accessToken);
|
|
738
|
-
}
|
|
739
701
|
return challenge;
|
|
740
702
|
}
|
|
741
703
|
/**
|
|
742
704
|
* Completes credential enrollment and refreshes the credential cache.
|
|
743
705
|
*
|
|
744
|
-
* It is sent with the verification token that began the enrollment, if
|
|
745
|
-
* any: once a factor is enrolled, the server requires AAL2 for both steps.
|
|
746
|
-
*
|
|
747
706
|
* The server returns an assertion for the new credential, which opens a
|
|
748
707
|
* verification session like `completeCredentialVerification`, replacing
|
|
749
708
|
* any earlier one. If that exchange fails, the earlier session is kept:
|
|
@@ -767,10 +726,7 @@ export class AuthenticationController extends BaseController {
|
|
|
767
726
|
const { type } = request.proof;
|
|
768
727
|
const { operation } = request.reason;
|
|
769
728
|
const primaryEntropySourceId = this.#getPrimaryEntropySourceId();
|
|
770
|
-
const assertion = await this.#runMfaRequest('MFA Enroll Complete', operation, type, async () => await this.#auth.completeMfaEnrollment(request.flowId, request.proof, primaryEntropySourceId
|
|
771
|
-
// Only after success: a failed attempt can be retried on this flow, and
|
|
772
|
-
// needs the same token.
|
|
773
|
-
this.#enrollmentAccessTokens.delete(request.flowId);
|
|
729
|
+
const assertion = await this.#runMfaRequest('MFA Enroll Complete', operation, type, async () => await this.#auth.completeMfaEnrollment(request.flowId, request.proof, primaryEntropySourceId));
|
|
774
730
|
try {
|
|
775
731
|
await this.#openVerificationSessionFromAssertion(assertion, {
|
|
776
732
|
operation,
|
|
@@ -942,15 +898,13 @@ export class AuthenticationController extends BaseController {
|
|
|
942
898
|
}
|
|
943
899
|
}
|
|
944
900
|
/**
|
|
945
|
-
* Clears every in-memory verification session and its expiration timer
|
|
946
|
-
* and the tokens kept for enrollments in progress.
|
|
901
|
+
* Clears every in-memory verification session and its expiration timer.
|
|
947
902
|
*/
|
|
948
903
|
clearVerificationSession() {
|
|
949
904
|
for (const { timer } of this.#verificationSessions.values()) {
|
|
950
905
|
clearTimeout(timer);
|
|
951
906
|
}
|
|
952
907
|
this.#verificationSessions.clear();
|
|
953
|
-
this.#enrollmentAccessTokens.clear();
|
|
954
908
|
}
|
|
955
909
|
/**
|
|
956
910
|
* Drops the cached credential list. Callers that wipe profile state must go
|