@metamask-previews/seedless-onboarding-controller 0.0.0-preview-c4b7ea2e → 0.0.0-preview-e9f8bc88

package/dist/SeedlessOnboardingController.mjs

@@ -9,14 +9,15 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSeedPhraseBackup, _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey, _SeedlessOnboardingController_withPersistedSeedPhraseBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsValidVaultData;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_recoverPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSeedPhraseBackup, _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey, _SeedlessOnboardingController_withPersistedSeedPhraseBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_assertIsValidVaultData;
 import { keccak256AndHexify } from "@metamask/auth-network-utils";
 import { BaseController } from "@metamask/base-controller";
 import { ToprfSecureBackup } from "@metamask/toprf-secure-backup";
 import { base64ToBytes, bytesToBase64, stringToBytes, remove0x, bigIntToHex } from "@metamask/utils";
+import { secp256k1 } from "@noble/curves/secp256k1";
 import { Mutex } from "async-mutex";
-import { controllerName, SecretType, SeedlessOnboardingControllerErrorMessage, Web3AuthNetwork } from "./constants.mjs";
-import { RecoveryError } from "./errors.mjs";
+import { controllerName, PASSWORD_OUTDATED_CACHE_TTL_MS, SecretType, SeedlessOnboardingControllerErrorMessage, Web3AuthNetwork } from "./constants.mjs";
+import { PasswordSyncError, RecoveryError } from "./errors.mjs";
 import { projectLogger, createModuleLogger } from "./logger.mjs";
 import { SecretMetadata } from "./SecretMetadata.mjs";
 const log = createModuleLogger(projectLogger, controllerName);
@@ -47,7 +48,7 @@ const seedlessOnboardingMetadata = {
         anonymous: true,
     },
     nodeAuthTokens: {
-        persist: false,
+        persist: true,
         anonymous: true,
     },
     authConnection: {
@@ -78,6 +79,14 @@ const seedlessOnboardingMetadata = {
         persist: false,
         anonymous: true,
     },
+    authPubKey: {
+        persist: true,
+        anonymous: true,
+    },
+    passwordOutdatedCache: {
+        persist: true,
+        anonymous: true,
+    },
 };
 export class SeedlessOnboardingController extends BaseController {
     /**
@@ -101,6 +110,7 @@ export class SeedlessOnboardingController extends BaseController {
         });
         _SeedlessOnboardingController_instances.add(this);
         _SeedlessOnboardingController_vaultEncryptor.set(this, void 0);
+        _SeedlessOnboardingController_controllerOperationMutex.set(this, new Mutex());
         _SeedlessOnboardingController_vaultOperationMutex.set(this, new Mutex());
         /**
          * Controller lock state.
@@ -136,35 +146,37 @@ export class SeedlessOnboardingController extends BaseController {
      * @returns A promise that resolves to the authentication result.
      */
     async authenticate(params) {
-        try {
-            const { idTokens, authConnectionId, groupedAuthConnectionId, userId, authConnection, socialLoginEmail, } = params;
-            const hashedIdTokenHexes = idTokens.map((idToken) => {
-                return remove0x(keccak256AndHexify(stringToBytes(idToken)));
-            });
-            const authenticationResult = await this.toprfClient.authenticate({
-                authConnectionId: groupedAuthConnectionId || authConnectionId,
-                userId,
-                idTokens: hashedIdTokenHexes,
-                groupedAuthConnectionParams: {
-                    authConnectionId,
-                    idTokens,
-                },
-            });
-            // update the state with the authenticated user info
-            this.update((state) => {
-                state.nodeAuthTokens = authenticationResult.nodeAuthTokens;
-                state.authConnectionId = authConnectionId;
-                state.groupedAuthConnectionId = groupedAuthConnectionId;
-                state.userId = userId;
-                state.authConnection = authConnection;
-                state.socialLoginEmail = socialLoginEmail;
-            });
-            return authenticationResult;
-        }
-        catch (error) {
-            log('Error authenticating user', error);
-            throw new Error(SeedlessOnboardingControllerErrorMessage.AuthenticationError);
-        }
+        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
+            try {
+                const { idTokens, authConnectionId, groupedAuthConnectionId, userId, authConnection, socialLoginEmail, } = params;
+                const hashedIdTokenHexes = idTokens.map((idToken) => {
+                    return remove0x(keccak256AndHexify(stringToBytes(idToken)));
+                });
+                const authenticationResult = await this.toprfClient.authenticate({
+                    authConnectionId: groupedAuthConnectionId || authConnectionId,
+                    userId,
+                    idTokens: hashedIdTokenHexes,
+                    groupedAuthConnectionParams: {
+                        authConnectionId,
+                        idTokens,
+                    },
+                });
+                // update the state with the authenticated user info
+                this.update((state) => {
+                    state.nodeAuthTokens = authenticationResult.nodeAuthTokens;
+                    state.authConnectionId = authConnectionId;
+                    state.groupedAuthConnectionId = groupedAuthConnectionId;
+                    state.userId = userId;
+                    state.authConnection = authConnection;
+                    state.socialLoginEmail = socialLoginEmail;
+                });
+                return authenticationResult;
+            }
+            catch (error) {
+                log('Error authenticating user', error);
+                throw new Error(SeedlessOnboardingControllerErrorMessage.AuthenticationError);
+            }
+        });
     }
     /**
      * Create a new TOPRF encryption key using given password and backups the provided seed phrase.
@@ -178,27 +190,32 @@ export class SeedlessOnboardingController extends BaseController {
         // to make sure that fail fast,
         // assert that the user is authenticated before creating the TOPRF key and backing up the seed phrase
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-        // locally evaluate the encryption key from the password
-        const { encKey, authKeyPair, oprfKey } = this.toprfClient.createLocalKey({
-            password,
-        });
-        // encrypt and store the seed phrase backup
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_encryptAndStoreSeedPhraseBackup).call(this, {
-            keyringId,
-            seedPhrase,
-            encKey,
-            authKeyPair,
-        });
-        // store/persist the encryption key shares
-        // We store the seed phrase metadata in the metadata store first. If this operation fails,
-        // we avoid persisting the encryption key shares to prevent a situation where a user appears
-        // to have an account but with no associated data.
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistOprfKey).call(this, oprfKey, authKeyPair.pk);
-        // create a new vault with the resulting authentication data
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-            password,
-            rawToprfEncryptionKey: encKey,
-            rawToprfAuthKeyPair: authKeyPair,
+        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
+            // locally evaluate the encryption key from the password
+            const { encKey, authKeyPair, oprfKey } = this.toprfClient.createLocalKey({
+                password,
+            });
+            // encrypt and store the seed phrase backup
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_encryptAndStoreSeedPhraseBackup).call(this, {
+                keyringId,
+                seedPhrase,
+                encKey,
+                authKeyPair,
+            });
+            // store/persist the encryption key shares
+            // We store the seed phrase metadata in the metadata store first. If this operation fails,
+            // we avoid persisting the encryption key shares to prevent a situation where a user appears
+            // to have an account but with no associated data.
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistOprfKey).call(this, oprfKey, authKeyPair.pk);
+            // create a new vault with the resulting authentication data
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                password,
+                rawToprfEncryptionKey: encKey,
+                rawToprfAuthKeyPair: authKeyPair,
+            });
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
+                authPubKey: authKeyPair.pk,
+            });
         });
     }
     /**
@@ -209,15 +226,21 @@ export class SeedlessOnboardingController extends BaseController {
      * @returns A promise that resolves to the success of the operation.
      */
     async addNewSeedPhraseBackup(seedPhrase, keyringId) {
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
-        // verify the password and unlock the vault
-        const { toprfEncryptionKey, toprfAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey).call(this);
-        // encrypt and store the seed phrase backup
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_encryptAndStoreSeedPhraseBackup).call(this, {
-            keyringId,
-            seedPhrase,
-            encKey: toprfEncryptionKey,
-            authKeyPair: toprfAuthKeyPair,
+        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertPasswordInSync).call(this, {
+                skipCache: true,
+                skipLock: true, // skip lock since we already have the lock
+            });
+            // verify the password and unlock the vault
+            const { toprfEncryptionKey, toprfAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey).call(this);
+            // encrypt and store the seed phrase backup
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_encryptAndStoreSeedPhraseBackup).call(this, {
+                keyringId,
+                seedPhrase,
+                encKey: toprfEncryptionKey,
+                authKeyPair: toprfAuthKeyPair,
+            });
         });
     }
     /**
@@ -231,40 +254,45 @@ export class SeedlessOnboardingController extends BaseController {
     async fetchAllSeedPhrases(password) {
         // assert that the user is authenticated before fetching the seed phrases
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-        let encKey;
-        let authKeyPair;
-        if (password) {
-            const recoverEncKeyResult = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, password);
-            encKey = recoverEncKeyResult.encKey;
-            authKeyPair = recoverEncKeyResult.authKeyPair;
-        }
-        else {
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
-            // verify the password and unlock the vault
-            const { toprfEncryptionKey, toprfAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey).call(this);
-            encKey = toprfEncryptionKey;
-            authKeyPair = toprfAuthKeyPair;
-        }
-        try {
-            const secretData = await this.toprfClient.fetchAllSecretDataItems({
-                decKey: encKey,
-                authKeyPair,
-            });
-            if (secretData?.length > 0 && password) {
-                // if password is provided, we need to create a new vault with the auth data. (supposedly the user is trying to rehydrate the wallet)
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-                    password,
-                    rawToprfEncryptionKey: encKey,
-                    rawToprfAuthKeyPair: authKeyPair,
+        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
+            let encKey;
+            let authKeyPair;
+            if (password) {
+                const recoverEncKeyResult = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, password);
+                encKey = recoverEncKeyResult.encKey;
+                authKeyPair = recoverEncKeyResult.authKeyPair;
+            }
+            else {
+                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
+                // verify the password and unlock the vault
+                const keysFromVault = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey).call(this);
+                encKey = keysFromVault.toprfEncryptionKey;
+                authKeyPair = keysFromVault.toprfAuthKeyPair;
+            }
+            try {
+                const secretData = await this.toprfClient.fetchAllSecretDataItems({
+                    decKey: encKey,
+                    authKeyPair,
                 });
+                if (secretData?.length > 0 && password) {
+                    // if password is provided, we need to create a new vault with the auth data. (supposedly the user is trying to rehydrate the wallet)
+                    await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                        password,
+                        rawToprfEncryptionKey: encKey,
+                        rawToprfAuthKeyPair: authKeyPair,
+                    });
+                    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
+                        authPubKey: authKeyPair.pk,
+                    });
+                }
+                const secrets = SecretMetadata.parseSecretsFromMetadataStore(secretData, SecretType.Mnemonic);
+                return secrets.map((secret) => secret.data);
             }
-            const secrets = SecretMetadata.parseSecretsFromMetadataStore(secretData, SecretType.Mnemonic);
-            return secrets.map((secret) => secret.data);
-        }
-        catch (error) {
-            log('Error fetching seed phrase metadata', error);
-            throw new Error(SeedlessOnboardingControllerErrorMessage.FailedToFetchSeedPhraseMetadata);
-        }
+            catch (error) {
+                log('Error fetching seed phrase metadata', error);
+                throw new Error(SeedlessOnboardingControllerErrorMessage.FailedToFetchSeedPhraseMetadata);
+            }
+        });
     }
     /**
      * Update the password of the seedless onboarding flow.
@@ -273,25 +301,38 @@ export class SeedlessOnboardingController extends BaseController {
      *
      * @param newPassword - The new password to update.
      * @param oldPassword - The old password to verify.
+     * @returns A promise that resolves to the success of the operation.
      */
     async changePassword(newPassword, oldPassword) {
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
-        // verify the old password of the encrypted vault
-        await this.verifyPassword(oldPassword);
-        try {
-            // update the encryption key with new password and update the Metadata Store
-            const { encKey: newEncKey, authKeyPair: newAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_changeEncryptionKey).call(this, newPassword, oldPassword);
-            // update and encrypt the vault with new password
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-                password: newPassword,
-                rawToprfEncryptionKey: newEncKey,
-                rawToprfAuthKeyPair: newAuthKeyPair,
+        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
+            // verify the old password of the encrypted vault
+            await this.verifyVaultPassword(oldPassword, {
+                skipLock: true, // skip lock since we already have the lock
             });
-        }
-        catch (error) {
-            log('Error changing password', error);
-            throw new Error(SeedlessOnboardingControllerErrorMessage.FailedToChangePassword);
-        }
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertPasswordInSync).call(this, {
+                skipCache: true,
+                skipLock: true, // skip lock since we already have the lock
+            });
+            try {
+                // update the encryption key with new password and update the Metadata Store
+                const { encKey: newEncKey, authKeyPair: newAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_changeEncryptionKey).call(this, newPassword, oldPassword);
+                // update and encrypt the vault with new password
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                    password: newPassword,
+                    rawToprfEncryptionKey: newEncKey,
+                    rawToprfAuthKeyPair: newAuthKeyPair,
+                });
+                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
+                    authPubKey: newAuthKeyPair.pk,
+                });
+                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_resetPasswordOutdatedCache).call(this);
+            }
+            catch (error) {
+                log('Error changing password', error);
+                throw new Error(SeedlessOnboardingControllerErrorMessage.FailedToChangePassword);
+            }
+        });
     }
     /**
      * Update the backup metadata state for the given seed phrase.
@@ -308,13 +349,21 @@ export class SeedlessOnboardingController extends BaseController {
      * Verify the password validity by decrypting the vault.
      *
      * @param password - The password to verify.
+     * @param options - Optional options object.
+     * @param options.skipLock - Whether to skip the lock acquisition.
+     * @returns A promise that resolves to the success of the operation.
      * @throws {Error} If the password is invalid or the vault is not initialized.
      */
-    async verifyPassword(password) {
-        if (!this.state.vault) {
-            throw new Error(SeedlessOnboardingControllerErrorMessage.VaultError);
-        }
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decrypt(password, this.state.vault);
+    async verifyVaultPassword(password, options) {
+        const doVerify = async () => {
+            if (!this.state.vault) {
+                throw new Error(SeedlessOnboardingControllerErrorMessage.VaultError);
+            }
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decrypt(password, this.state.vault);
+        };
+        return options?.skipLock
+            ? await doVerify()
+            : await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, doVerify);
     }
     /**
      * Get the hash of the seed phrase backup for the given seed phrase, from the state.
@@ -337,10 +386,13 @@ export class SeedlessOnboardingController extends BaseController {
      * This operation is useful when user performs some actions that requires the user password/encryption key. e.g. add new srp backup
      *
      * @param password - The password to submit.
+     * @returns A promise that resolves to the success of the operation.
      */
     async submitPassword(password) {
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey).call(this, password);
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
+        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey).call(this, password);
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
+        });
     }
     /**
      * Set the controller to locked state, and deallocate the secrets (vault encryption key and salt).
@@ -354,6 +406,98 @@ export class SeedlessOnboardingController extends BaseController {
         });
         __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, false, "f");
     }
+    /**
+     * Sync the latest global password to the controller.
+     * reset vault with latest globalPassword,
+     * persist the latest global password authPubKey
+     *
+     * @param params - The parameters for syncing the latest global password.
+     * @param params.oldPassword - The old password to verify.
+     * @param params.globalPassword - The latest global password.
+     * @returns A promise that resolves to the success of the operation.
+     */
+    async syncLatestGlobalPassword({ oldPassword, globalPassword, }) {
+        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
+            // verify correct old password
+            await this.verifyVaultPassword(oldPassword, {
+                skipLock: true, // skip lock since we already have the lock
+            });
+            // update vault with latest globalPassword
+            const { encKey, authKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
+            // update and encrypt the vault with new password
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                password: globalPassword,
+                rawToprfEncryptionKey: encKey,
+                rawToprfAuthKeyPair: authKeyPair,
+            });
+            // persist the latest global password authPubKey
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
+                authPubKey: authKeyPair.pk,
+            });
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_resetPasswordOutdatedCache).call(this);
+        });
+    }
+    /**
+     * @description Fetch the password corresponding to the current authPubKey in state (current device password which is already out of sync with the current global password).
+     * then we use this recovered old password to unlock the vault and set the password to the new global password.
+     *
+     * @param params - The parameters for fetching the password.
+     * @param params.globalPassword - The latest global password.
+     * @returns A promise that resolves to the password corresponding to the current authPubKey in state.
+     */
+    async recoverCurrentDevicePassword({ globalPassword, }) {
+        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
+            const currentDeviceAuthPubKey = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverAuthPubKey).call(this);
+            const { password: currentDevicePassword } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverPassword).call(this, {
+                targetPwPubKey: currentDeviceAuthPubKey,
+                globalPassword,
+            });
+            return {
+                password: currentDevicePassword,
+            };
+        });
+    }
+    /**
+     * @description Check if the current password is outdated compare to the global password.
+     *
+     * @param options - Optional options object.
+     * @param options.skipCache - If true, bypass the cache and force a fresh check.
+     * @param options.skipLock - Whether to skip the lock acquisition.
+     * @returns A promise that resolves to true if the password is outdated, false otherwise.
+     */
+    async checkIsPasswordOutdated(options) {
+        // cache result to reduce load on infra
+        // Check cache first unless skipCache is true
+        if (!options?.skipCache) {
+            const { passwordOutdatedCache } = this.state;
+            const now = Date.now();
+            const isCacheValid = passwordOutdatedCache &&
+                now - passwordOutdatedCache.timestamp < PASSWORD_OUTDATED_CACHE_TTL_MS;
+            if (isCacheValid) {
+                return passwordOutdatedCache.isExpiredPwd;
+            }
+        }
+        const doCheck = async () => {
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+            const { nodeAuthTokens, authConnectionId, groupedAuthConnectionId, userId, } = this.state;
+            const currentDeviceAuthPubKey = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverAuthPubKey).call(this);
+            const { authPubKey: globalAuthPubKey } = await this.toprfClient.fetchAuthPubKey({
+                nodeAuthTokens,
+                authConnectionId: groupedAuthConnectionId || authConnectionId,
+                userId,
+            });
+            // use noble lib to deserialize and compare curve point
+            const isExpiredPwd = !secp256k1.ProjectivePoint.fromHex(currentDeviceAuthPubKey).equals(secp256k1.ProjectivePoint.fromHex(globalAuthPubKey));
+            // Cache the result in state
+            this.update((state) => {
+                state.passwordOutdatedCache = { isExpiredPwd, timestamp: Date.now() };
+            });
+            return isExpiredPwd;
+        };
+        return options?.skipLock
+            ? await doCheck()
+            : await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, doCheck);
+    }
     /**
      * Clears the current state of the SeedlessOnboardingController.
      */
@@ -364,7 +508,29 @@ export class SeedlessOnboardingController extends BaseController {
         });
     }
 }
-_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_setUnlocked = function _SeedlessOnboardingController_setUnlocked() {
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_recoverPassword = 
+/**
+ * @description Fetch the password corresponding to the targetPwPubKey.
+ *
+ * @param params - The parameters for fetching the password.
+ * @param params.targetPwPubKey - The target public key of the password to recover.
+ * @param params.globalPassword - The latest global password.
+ * @returns A promise that resolves to the password corresponding to the current authPubKey in state.
+ */
+async function _SeedlessOnboardingController_recoverPassword({ targetPwPubKey, globalPassword, }) {
+    const { encKey: latestPwEncKey, authKeyPair: latestPwAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
+    try {
+        const res = await this.toprfClient.recoverPassword({
+            targetPwPubKey,
+            curEncKey: latestPwEncKey,
+            curAuthKeyPair: latestPwAuthKeyPair,
+        });
+        return res;
+    }
+    catch (error) {
+        throw PasswordSyncError.getInstance(error);
+    }
+}, _SeedlessOnboardingController_setUnlocked = function _SeedlessOnboardingController_setUnlocked() {
     __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, true, "f");
 }, _SeedlessOnboardingController_persistOprfKey = 
 /**
@@ -390,6 +556,14 @@ async function _SeedlessOnboardingController_persistOprfKey(oprfKey, authPubKey)
         log('Error persisting local encryption key', error);
         throw new Error(SeedlessOnboardingControllerErrorMessage.FailedToPersistOprfKey);
     }
+}, _SeedlessOnboardingController_persistAuthPubKey = function _SeedlessOnboardingController_persistAuthPubKey(params) {
+    this.update((state) => {
+        state.authPubKey = bytesToBase64(params.authPubKey);
+    });
+}, _SeedlessOnboardingController_recoverAuthPubKey = function _SeedlessOnboardingController_recoverAuthPubKey() {
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsSRPBackedUpUser).call(this, this.state);
+    const { authPubKey } = this.state;
+    return base64ToBytes(authPubKey);
 }, _SeedlessOnboardingController_recoverEncKey = 
 /**
  * Recover the encryption key from password.
@@ -626,6 +800,21 @@ async function _SeedlessOnboardingController_updateVault({ password, serializedV
             state.vaultEncryptionSalt = JSON.parse(vault).salt;
         });
     });
+}, _SeedlessOnboardingController_withControllerLock = 
+/**
+ * Lock the controller mutex before executing the given function,
+ * and release it after the function is resolved or after an
+ * error is thrown.
+ *
+ * This wrapper ensures that each mutable operation that interacts with the
+ * controller and that changes its state is executed in a mutually exclusive way,
+ * preventing unsafe concurrent access that could lead to unpredictable behavior.
+ *
+ * @param callback - The function to execute while the controller mutex is locked.
+ * @returns The result of the function.
+ */
+async function _SeedlessOnboardingController_withControllerLock(callback) {
+    return await withLock(__classPrivateFieldGet(this, _SeedlessOnboardingController_controllerOperationMutex, "f"), callback);
 }, _SeedlessOnboardingController_withVaultLock = 
 /**
  * Lock the vault mutex before executing the given function,
@@ -693,6 +882,28 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
     ) {
         throw new Error(SeedlessOnboardingControllerErrorMessage.InsufficientAuthToken);
     }
+}, _SeedlessOnboardingController_assertIsSRPBackedUpUser = function _SeedlessOnboardingController_assertIsSRPBackedUpUser(value) {
+    if (!this.state.authPubKey) {
+        throw new Error(SeedlessOnboardingControllerErrorMessage.SRPNotBackedUpError);
+    }
+}, _SeedlessOnboardingController_assertPasswordInSync = 
+/**
+ * Assert that the password is in sync with the global password.
+ *
+ * @param options - The options for asserting the password is in sync.
+ * @param options.skipCache - Whether to skip the cache check.
+ * @param options.skipLock - Whether to skip the lock acquisition.
+ * @throws If the password is outdated.
+ */
+async function _SeedlessOnboardingController_assertPasswordInSync(options) {
+    const isPasswordOutdated = await this.checkIsPasswordOutdated(options);
+    if (isPasswordOutdated) {
+        throw new Error(SeedlessOnboardingControllerErrorMessage.OutdatedPassword);
+    }
+}, _SeedlessOnboardingController_resetPasswordOutdatedCache = function _SeedlessOnboardingController_resetPasswordOutdatedCache() {
+    this.update((state) => {
+        delete state.passwordOutdatedCache;
+    });
 }, _SeedlessOnboardingController_assertIsValidVaultData = function _SeedlessOnboardingController_assertIsValidVaultData(value) {
     // value is not valid vault data if any of the following conditions are true:
     if (!value || // value is not defined