@metamask-previews/seedless-onboarding-controller 1.0.0-preview-3c8bcc82 → 2.0.0-preview-d9822daf

package/CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.0.0]
+
 ### Added
 
 - Added `PrivateKey sync` feature to the controller ([#5948](https://github.com/MetaMask/core/pull/5948)).
@@ -20,6 +22,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - updated `updateBackupMetadataState` method param with `{ keyringId?: string; data: Uint8Array; type: SecretType }`. Previously , `{ keyringId: string; seedPhrase: Uint8Array }`.
 - Added `submitGlobalPassword`. ([#5995](https://github.com/MetaMask/core/pull/5995))
 - Added `storeKeyringEncryptionKey` and `loadKeyringEncryptionKey`. ([#5995](https://github.com/MetaMask/core/pull/5995))
+- Added validations in `fetchAllSecretData`. ([#6047](https://github.com/MetaMask/core/pull/6047))
+  - Throwing `NoSecretDataFound` error when the client receives the empty secret data from the metadata store.
+  - Throwing `InvalidPrimarySecretDataType` error when the first secret data backup is not a `Mnemonic`. First backup must always be a `Mnemonic`
+    since generating a new mnemonic (SRP) is the only way to create a new wallet for a Social Login user.
 
 ### Changed
 
@@ -33,6 +39,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - removed parameter `oldPassword`
   - no longer verifying old password
   - explicitly requring unlocked controller
+- **BREAKING** Changed data structure of return values from `fetchAllSecretData`. ([#6047](https://github.com/MetaMask/core/pull/6047))
+  - Now returns `SecretMetadata[]` object instead of `Record<SecretType, Uint8Array[]>`
+- Bump `@metamask/utils` from `^11.2.0` to `^11.4.2` ([#6054](https://github.com/MetaMask/core/pull/6054))
 
 ### Removed
 
@@ -63,5 +72,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
     - `checkIsPasswordOutdated`: Check if the password is current device is outdated, i.e. user changed password in another device.
     - `clearState`: Reset the state of the controller to the defaults.
 
-[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/seedless-onboarding-controller@1.0.0...HEAD
+[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/seedless-onboarding-controller@2.0.0...HEAD
+[2.0.0]: https://github.com/MetaMask/core/compare/@metamask/seedless-onboarding-controller@1.0.0...@metamask/seedless-onboarding-controller@2.0.0
 [1.0.0]: https://github.com/MetaMask/core/releases/tag/@metamask/seedless-onboarding-controller@1.0.0

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_assertIsValidVaultData, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_assertIsValidVaultData, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getDefaultSeedlessOnboardingControllerState = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -255,9 +255,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                     rawToprfPwEncryptionKey: pwEncKey,
                     rawToprfAuthKeyPair: authKeyPair,
                 });
-                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
-                    authPubKey: authKeyPair.pk,
-                });
             };
             await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_executeWithTokenRefresh).call(this, performKeyCreationAndBackup, 'createToprfKeyAndBackupSeedPhrase');
         });
@@ -322,40 +319,20 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 pwEncKey = keysFromVault.toprfPwEncryptionKey;
                 authKeyPair = keysFromVault.toprfAuthKeyPair;
             }
-            try {
-                const performFetch = async () => {
-                    const secretData = await this.toprfClient.fetchAllSecretDataItems({
-                        decKey: encKey,
-                        authKeyPair,
-                    });
-                    if (secretData?.length > 0 && password) {
-                        // if password is provided, we need to create a new vault with the auth data. (supposedly the user is trying to rehydrate the wallet)
-                        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-                            password,
-                            rawToprfEncryptionKey: encKey,
-                            rawToprfPwEncryptionKey: pwEncKey,
-                            rawToprfAuthKeyPair: authKeyPair,
-                        });
-                        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
-                            authPubKey: authKeyPair.pk,
-                        });
-                    }
-                    const result = {
-                        mnemonic: [],
-                        privateKey: [],
-                    };
-                    const secrets = SecretMetadata_1.SecretMetadata.parseSecretsFromMetadataStore(secretData);
-                    secrets.forEach((secret) => {
-                        result[secret.type].push(secret.data);
+            const performFetch = async () => {
+                const secrets = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore).call(this, encKey, authKeyPair);
+                if (password) {
+                    // if password is provided, we need to create a new vault with the auth data. (supposedly the user is trying to rehydrate the wallet)
+                    await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                        password,
+                        rawToprfEncryptionKey: encKey,
+                        rawToprfPwEncryptionKey: pwEncKey,
+                        rawToprfAuthKeyPair: authKeyPair,
                     });
-                    return result;
-                };
-                return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_executeWithTokenRefresh).call(this, performFetch, 'fetchAllSecretData');
-            }
-            catch (error) {
-                log('Error fetching secret data', error);
-                throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.FailedToFetchSecretMetadata);
-            }
+                }
+                return secrets;
+            };
+            return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_executeWithTokenRefresh).call(this, performFetch, 'fetchAllSecretData');
         });
     }
     /**
@@ -396,9 +373,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                     rawToprfPwEncryptionKey: newPwEncKey,
                     rawToprfAuthKeyPair: newAuthKeyPair,
                 });
-                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
-                    authPubKey: newAuthKeyPair.pk,
-                });
                 __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_resetPasswordOutdatedCache).call(this);
                 // store the keyring encryption key if it exists
                 if (keyringEncryptionKey) {
@@ -512,10 +486,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                     rawToprfPwEncryptionKey: pwEncKey,
                     rawToprfAuthKeyPair: authKeyPair,
                 });
-                // persist the latest global password authPubKey
-                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
-                    authPubKey: authKeyPair.pk,
-                });
                 __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_resetPasswordOutdatedCache).call(this);
             };
             return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_executeWithTokenRefresh).call(this, doSyncPassword, 'syncLatestGlobalPassword');
@@ -820,9 +790,9 @@ async function _SeedlessOnboardingController_loadSeedlessEncryptionKey(encKey) {
  * @throws RecoveryError - If failed to recover the encryption key.
  */
 async function _SeedlessOnboardingController_recoverEncKey(password) {
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+    const { authConnectionId, groupedAuthConnectionId, userId } = this.state;
     try {
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-        const { authConnectionId, groupedAuthConnectionId, userId } = this.state;
         const recoverEncKeyResult = await this.toprfClient.recoverEncKey({
             nodeAuthTokens: this.state.nodeAuthTokens,
             password,
@@ -833,14 +803,39 @@ async function _SeedlessOnboardingController_recoverEncKey(password) {
         return recoverEncKeyResult;
     }
     catch (error) {
-        console.log('error', error);
-        console.log('isTokenExpiredError', __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_isTokenExpiredError).call(this, error));
         // throw token expired error for token refresh handler
         if (__classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_isTokenExpiredError).call(this, error)) {
             throw error;
         }
         throw errors_1.RecoveryError.getInstance(error);
     }
+}, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore = async function _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore(encKey, authKeyPair) {
+    let secretData = [];
+    try {
+        // fetch and decrypt the secret data from the metadata store
+        secretData = await this.toprfClient.fetchAllSecretDataItems({
+            decKey: encKey,
+            authKeyPair,
+        });
+    }
+    catch (error) {
+        log('Error fetching secret data', error);
+        if (__classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_isTokenExpiredError).call(this, error)) {
+            throw error;
+        }
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.FailedToFetchSecretMetadata);
+    }
+    // user must have at least one secret data
+    if (secretData?.length > 0) {
+        const secrets = SecretMetadata_1.SecretMetadata.parseSecretsFromMetadataStore(secretData);
+        // validate the primary secret data is a mnemonic (SRP)
+        const primarySecret = secrets[0];
+        if (primarySecret.type !== constants_1.SecretType.Mnemonic) {
+            throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidPrimarySecretDataType);
+        }
+        return secrets;
+    }
+    throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.NoSecretDataFound);
 }, _SeedlessOnboardingController_changeEncryptionKey = 
 /**
  * Update the encryption key with new password and update the Metadata Store with new encryption key.
@@ -1070,6 +1065,10 @@ async function _SeedlessOnboardingController_createNewVaultWithAuthData({ passwo
         serializedVaultData,
         pwEncKey: rawToprfPwEncryptionKey,
     });
+    // update the authPubKey in the state
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
+        authPubKey: rawToprfAuthKeyPair.pk,
+    });
 }, _SeedlessOnboardingController_updateVault = 
 /**
  * Encrypt and update the vault with the given authentication data.