@metamask-previews/seedless-onboarding-controller 1.0.0-preview-4e3fd4c0 → 1.0.0-preview-3636a128

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_recoverKeyringEncryptionKey, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_assertIsValidVaultData, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_assertIsValidVaultData, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getDefaultSeedlessOnboardingControllerState = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -102,6 +102,10 @@ const seedlessOnboardingMetadata = {
         persist: false,
         anonymous: true,
     },
+    encryptedSeedlessEncryptionKey: {
+        persist: true,
+        anonymous: true,
+    },
     encryptedKeyringEncryptionKey: {
         persist: true,
         anonymous: true,
@@ -517,18 +521,15 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param params.globalPassword - The latest global password.
      * @returns A promise that resolves to the password corresponding to the current authPubKey in state.
      */
-    async recoverKeyringEncryptionKey({ globalPassword, }) {
+    async submitGlobalPassword({ globalPassword, }) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_executeWithTokenRefresh).call(this, async () => {
                 const currentDeviceAuthPubKey = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverAuthPubKey).call(this);
-                const { keyringEncryptionKey } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverKeyringEncryptionKey).call(this, {
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_submitGlobalPassword).call(this, {
                     targetAuthPubKey: currentDeviceAuthPubKey,
                     globalPassword,
                 });
-                return {
-                    keyringEncryptionKey,
-                };
-            }, 'recoverKeyringEncryptionKey');
+            }, 'submitGlobalPassword');
         });
     }
     /**
@@ -688,7 +689,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     }
 }
 exports.SeedlessOnboardingController = SeedlessOnboardingController;
-_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_recoverKeyringEncryptionKey = 
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
 /**
  * @description Fetch the keyring encryption key corresponding to the targetAuthPubKey.
  *
@@ -697,9 +698,10 @@ _SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardin
  * @param params.globalPassword - The latest global password.
  * @returns A promise that resolves to the keyring encryption key corresponding to the current authPubKey in state.
  */
-async function _SeedlessOnboardingController_recoverKeyringEncryptionKey({ targetAuthPubKey, globalPassword, }) {
+async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPubKey, globalPassword, }) {
     const { encKey: latestPwEncKey, authKeyPair: latestPwAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
     try {
+        // Recover vault encryption key.
         const res = await this.toprfClient.recoverPassword({
             targetPwPubKey: targetAuthPubKey,
             curEncKey: latestPwEncKey,
@@ -707,8 +709,12 @@ async function _SeedlessOnboardingController_recoverKeyringEncryptionKey({ targe
         });
         const { password: recoveredEncryptionKeyBase64 } = res;
         const recoveredEncryptionKey = (0, utils_1.base64ToBytes)(recoveredEncryptionKeyBase64);
-        const keyringEncryptionKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadKeyringEncryptionKey).call(this, recoveredEncryptionKey);
-        return { keyringEncryptionKey };
+        const vaultKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, recoveredEncryptionKey);
+        // Unlock the controller
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey).call(this, undefined, vaultKey);
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
+        // revoke and recyle refresh token after unlock to keep refresh token fresh, avoid malicious use of leaked refresh token
+        await this.revokeRefreshToken(globalPassword);
     }
     catch (error) {
         if (__classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_isTokenExpiredError).call(this, error)) {
@@ -777,6 +783,20 @@ async function _SeedlessOnboardingController_loadKeyringEncryptionKey(encKey) {
     const aes = (0, webcrypto_1.managedNonce)(aes_1.gcm)(encKey);
     const password = aes.decrypt(encryptedPasswordBytes);
     return (0, utils_2.bytesToUtf8)(password);
+}, _SeedlessOnboardingController_loadSeedlessEncryptionKey = 
+/**
+ * Decrypt the seedless encryption key from state.
+ *
+ * @param encKey - The encryption key.
+ * @returns The seedless encryption key.
+ */
+async function _SeedlessOnboardingController_loadSeedlessEncryptionKey(encKey) {
+    const { encryptedSeedlessEncryptionKey: encryptedKey } = this.state;
+    assertIsEncryptedSeedlessEncryptionKeySet(encryptedKey);
+    const encryptedPasswordBytes = (0, utils_1.base64ToBytes)(encryptedKey);
+    const aes = (0, webcrypto_1.managedNonce)(aes_1.gcm)(encKey);
+    const password = aes.decrypt(encryptedPasswordBytes);
+    return (0, utils_2.bytesToUtf8)(password);
 }, _SeedlessOnboardingController_recoverAuthPubKey = function _SeedlessOnboardingController_recoverAuthPubKey() {
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsSRPBackedUpUser).call(this, this.state);
     const { authPubKey } = this.state;
@@ -892,6 +912,7 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * This method ensures thread-safety by using a mutex lock when accessing the vault.
  *
  * @param password - The optional password to unlock the vault.
+ * @param encryptionKey - The optional encryption key to unlock the vault.
  * @returns A promise that resolves to an object containing:
  * - nodeAuthTokens: Authentication tokens to communicate with the TOPRF service
  * - toprfEncryptionKey: The decrypted TOPRF encryption key
@@ -902,14 +923,15 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * - The password is incorrect (from encryptor.decrypt)
  * - The decrypted vault data is malformed
  */
-async function _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey(password) {
+async function _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey(password, encryptionKey) {
     return __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
-        const { vault: encryptedVault, vaultEncryptionKey, vaultEncryptionSalt, } = this.state;
+        let { vaultEncryptionKey } = this.state;
+        const { vault: encryptedVault, vaultEncryptionSalt } = this.state;
         if (!encryptedVault) {
             throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultError);
         }
-        if (!vaultEncryptionKey && !password) {
-            throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.MissingCredentials);
+        if (encryptionKey) {
+            vaultEncryptionKey = encryptionKey;
         }
         let decryptedVaultData;
         const updatedState = {};
@@ -924,13 +946,12 @@ async function _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey(passw
             updatedState.vaultEncryptionSalt = result.salt;
         }
         else {
+            assertIsVaultEncryptionKeyDefined(vaultEncryptionKey);
             const parsedEncryptedVault = JSON.parse(encryptedVault);
-            if (vaultEncryptionSalt !== parsedEncryptedVault.salt) {
+            if (vaultEncryptionSalt &&
+                vaultEncryptionSalt !== parsedEncryptedVault.salt) {
                 throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.ExpiredCredentials);
             }
-            if (typeof vaultEncryptionKey !== 'string') {
-                throw new TypeError(constants_1.SeedlessOnboardingControllerErrorMessage.WrongPasswordType);
-            }
             const key = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").importKey(vaultEncryptionKey);
             decryptedVaultData = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithKey(key, parsedEncryptedVault);
             updatedState.vaultEncryptionKey = vaultEncryptionKey;
@@ -1034,6 +1055,7 @@ async function _SeedlessOnboardingController_createNewVaultWithAuthData({ passwo
     await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
         password,
         serializedVaultData,
+        encKey: rawToprfEncryptionKey,
     });
 }, _SeedlessOnboardingController_updateVault = 
 /**
@@ -1042,19 +1064,24 @@ async function _SeedlessOnboardingController_createNewVaultWithAuthData({ passwo
  * @param params - The parameters for updating the vault.
  * @param params.password - The password to encrypt the vault.
  * @param params.serializedVaultData - The serialized authentication data to update the vault with.
+ * @param params.encKey - The global backup encryption key.
  * @returns A promise that resolves to the updated vault.
  */
-async function _SeedlessOnboardingController_updateVault({ password, serializedVaultData, }) {
+async function _SeedlessOnboardingController_updateVault({ password, serializedVaultData, encKey, }) {
     await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
         assertIsValidPassword(password);
         // Note that vault encryption using the password is a very costly operation as it involves deriving the encryption key
         // from the password using an intentionally slow key derivation function.
         // We should make sure that we only call it very intentionally.
         const { vault, exportedKeyString } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").encryptWithDetail(password, serializedVaultData);
+        // Encrypt vault key.
+        const aes = (0, webcrypto_1.managedNonce)(aes_1.gcm)(encKey);
+        const encryptedKey = aes.encrypt((0, utils_2.utf8ToBytes)(exportedKeyString));
         this.update((state) => {
             state.vault = vault;
             state.vaultEncryptionKey = exportedKeyString;
             state.vaultEncryptionSalt = JSON.parse(vault).salt;
+            state.encryptedSeedlessEncryptionKey = (0, utils_1.bytesToBase64)(encryptedKey);
         });
     });
 }, _SeedlessOnboardingController_withControllerLock = 
@@ -1273,4 +1300,26 @@ function assertIsEncryptedKeyringEncryptionKeySet(encryptedKeyringEncryptionKey)
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.EncryptedKeyringEncryptionKeyNotSet);
     }
 }
+/**
+ * Assert that the provided encrypted seedless encryption key is a valid non-empty string.
+ *
+ * @param encryptedSeedlessEncryptionKey - The encrypted seedless encryption key to check.
+ * @throws If the encrypted seedless encryption key is not a valid string.
+ */
+function assertIsEncryptedSeedlessEncryptionKeySet(encryptedSeedlessEncryptionKey) {
+    if (!encryptedSeedlessEncryptionKey) {
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.EncryptedSeedlessEncryptionKeyNotSet);
+    }
+}
+/**
+ * Assert that the provided vault encryption key is a valid non-empty string.
+ *
+ * @param vaultEncryptionKey - The vault encryption key to check.
+ * @throws If the vault encryption key is not a valid string.
+ */
+function assertIsVaultEncryptionKeyDefined(vaultEncryptionKey) {
+    if (!vaultEncryptionKey) {
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultEncryptionKeyUndefined);
+    }
+}
 //# sourceMappingURL=SeedlessOnboardingController.cjs.map