@metamask-previews/seedless-onboarding-controller 1.0.0-preview-4e3fd4c0 → 1.0.0-preview-c6e5eb7

package/dist/SeedlessOnboardingController.cjs

@@ -10,16 +10,13 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_recoverKeyringEncryptionKey, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_assertIsValidVaultData, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_recoverPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_assertIsValidVaultData, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getDefaultSeedlessOnboardingControllerState = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
 const base_controller_1 = require("@metamask/base-controller");
 const toprf_secure_backup_1 = require("@metamask/toprf-secure-backup");
 const utils_1 = require("@metamask/utils");
-const aes_1 = require("@noble/ciphers/aes");
-const utils_2 = require("@noble/ciphers/utils");
-const webcrypto_1 = require("@noble/ciphers/webcrypto");
 const secp256k1_1 = require("@noble/curves/secp256k1");
 const async_mutex_1 = require("async-mutex");
 const constants_1 = require("./constants.cjs");
@@ -102,10 +99,6 @@ const seedlessOnboardingMetadata = {
         persist: false,
         anonymous: true,
     },
-    encryptedKeyringEncryptionKey: {
-        persist: true,
-        anonymous: true,
-    },
 };
 class SeedlessOnboardingController extends base_controller_1.BaseController {
     /**
@@ -370,16 +363,8 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 skipLock: true, // skip lock since we already have the lock
             });
             const attemptChangePassword = async () => {
-                // load keyring encryption key if it exists
-                let keyringEncryptionKey;
-                if (this.state.encryptedKeyringEncryptionKey) {
-                    keyringEncryptionKey = await this.loadKeyringEncryptionKey();
-                }
                 // update the encryption key with new password and update the Metadata Store
-                const { encKey: newEncKey, authKeyPair: newAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_changeEncryptionKey).call(this, {
-                    oldPassword,
-                    newPassword,
-                });
+                const { encKey: newEncKey, authKeyPair: newAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_changeEncryptionKey).call(this, newPassword, oldPassword);
                 // update and encrypt the vault with new password
                 await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
                     password: newPassword,
@@ -390,10 +375,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                     authPubKey: newAuthKeyPair.pk,
                 });
                 __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_resetPasswordOutdatedCache).call(this);
-                // store the keyring encryption key if it exists
-                if (keyringEncryptionKey) {
-                    await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_storeKeyringEncryptionKey).call(this, newEncKey, keyringEncryptionKey);
-                }
             };
             try {
                 await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_executeWithTokenRefresh).call(this, attemptChangePassword, 'changePassword');
@@ -486,12 +467,17 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * persist the latest global password authPubKey
      *
      * @param params - The parameters for syncing the latest global password.
+     * @param params.oldPassword - The old password to verify.
      * @param params.globalPassword - The latest global password.
      * @returns A promise that resolves to the success of the operation.
      */
-    async syncLatestGlobalPassword({ globalPassword, }) {
+    async syncLatestGlobalPassword({ oldPassword, globalPassword, }) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             const doSyncPassword = async () => {
+                // verify correct old password
+                await this.verifyVaultPassword(oldPassword, {
+                    skipLock: true, // skip lock since we already have the lock
+                });
                 // update vault with latest globalPassword
                 const { encKey, authKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
                 // update and encrypt the vault with new password
@@ -517,18 +503,18 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param params.globalPassword - The latest global password.
      * @returns A promise that resolves to the password corresponding to the current authPubKey in state.
      */
-    async recoverKeyringEncryptionKey({ globalPassword, }) {
+    async recoverCurrentDevicePassword({ globalPassword, }) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_executeWithTokenRefresh).call(this, async () => {
                 const currentDeviceAuthPubKey = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverAuthPubKey).call(this);
-                const { keyringEncryptionKey } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverKeyringEncryptionKey).call(this, {
-                    targetAuthPubKey: currentDeviceAuthPubKey,
+                const { password: currentDevicePassword } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverPassword).call(this, {
+                    targetPwPubKey: currentDeviceAuthPubKey,
                     globalPassword,
                 });
                 return {
-                    keyringEncryptionKey,
+                    password: currentDevicePassword,
                 };
-            }, 'recoverKeyringEncryptionKey');
+            }, 'recoverCurrentDevicePassword');
         });
     }
     /**
@@ -583,26 +569,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             return defaultState;
         });
     }
-    /**
-     * Store the keyring encryption key in state, encrypted under the current
-     * encryption key.
-     *
-     * @param keyringEncryptionKey - The keyring encryption key.
-     */
-    async storeKeyringEncryptionKey(keyringEncryptionKey) {
-        const { toprfEncryptionKey: encKey } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey).call(this);
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_storeKeyringEncryptionKey).call(this, encKey, keyringEncryptionKey);
-    }
-    /**
-     * Load the keyring encryption key from state, decrypted under the current
-     * encryption key.
-     *
-     * @returns The keyring encryption key.
-     */
-    async loadKeyringEncryptionKey() {
-        const { toprfEncryptionKey: encKey } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey).call(this);
-        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadKeyringEncryptionKey).call(this, encKey);
-    }
     /**
      * Refresh expired nodeAuthTokens using the stored refresh token.
      *
@@ -688,27 +654,24 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     }
 }
 exports.SeedlessOnboardingController = SeedlessOnboardingController;
-_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_recoverKeyringEncryptionKey = 
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_recoverPassword = 
 /**
- * @description Fetch the keyring encryption key corresponding to the targetAuthPubKey.
+ * @description Fetch the password corresponding to the targetPwPubKey.
  *
- * @param params - The parameters for fetching the keyring encryption key.
- * @param params.targetAuthPubKey - The target public key of the keyring encryption key to recover.
+ * @param params - The parameters for fetching the password.
+ * @param params.targetPwPubKey - The target public key of the password to recover.
  * @param params.globalPassword - The latest global password.
- * @returns A promise that resolves to the keyring encryption key corresponding to the current authPubKey in state.
+ * @returns A promise that resolves to the password corresponding to the current authPubKey in state.
  */
-async function _SeedlessOnboardingController_recoverKeyringEncryptionKey({ targetAuthPubKey, globalPassword, }) {
+async function _SeedlessOnboardingController_recoverPassword({ targetPwPubKey, globalPassword, }) {
     const { encKey: latestPwEncKey, authKeyPair: latestPwAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
     try {
         const res = await this.toprfClient.recoverPassword({
-            targetPwPubKey: targetAuthPubKey,
+            targetPwPubKey,
             curEncKey: latestPwEncKey,
             curAuthKeyPair: latestPwAuthKeyPair,
         });
-        const { password: recoveredEncryptionKeyBase64 } = res;
-        const recoveredEncryptionKey = (0, utils_1.base64ToBytes)(recoveredEncryptionKeyBase64);
-        const keyringEncryptionKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadKeyringEncryptionKey).call(this, recoveredEncryptionKey);
-        return { keyringEncryptionKey };
+        return res;
     }
     catch (error) {
         if (__classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_isTokenExpiredError).call(this, error)) {
@@ -750,33 +713,6 @@ async function _SeedlessOnboardingController_persistOprfKey(oprfKey, authPubKey)
     this.update((state) => {
         state.authPubKey = (0, utils_1.bytesToBase64)(params.authPubKey);
     });
-}, _SeedlessOnboardingController_storeKeyringEncryptionKey = 
-/**
- * Encrypt the keyring encryption key and store it in state.
- *
- * @param encKey - The encryption key.
- * @param keyringEncryptionKey - The keyring encryption key.
- */
-async function _SeedlessOnboardingController_storeKeyringEncryptionKey(encKey, keyringEncryptionKey) {
-    const aes = (0, webcrypto_1.managedNonce)(aes_1.gcm)(encKey);
-    const encryptedKeyringEncryptionKey = aes.encrypt((0, utils_2.utf8ToBytes)(keyringEncryptionKey));
-    this.update((state) => {
-        state.encryptedKeyringEncryptionKey = (0, utils_1.bytesToBase64)(encryptedKeyringEncryptionKey);
-    });
-}, _SeedlessOnboardingController_loadKeyringEncryptionKey = 
-/**
- * Decrypt the keyring encryption key from state.
- *
- * @param encKey - The encryption key.
- * @returns The keyring encryption key.
- */
-async function _SeedlessOnboardingController_loadKeyringEncryptionKey(encKey) {
-    const { encryptedKeyringEncryptionKey: encryptedKey } = this.state;
-    assertIsEncryptedKeyringEncryptionKeySet(encryptedKey);
-    const encryptedPasswordBytes = (0, utils_1.base64ToBytes)(encryptedKey);
-    const aes = (0, webcrypto_1.managedNonce)(aes_1.gcm)(encKey);
-    const password = aes.decrypt(encryptedPasswordBytes);
-    return (0, utils_2.bytesToUtf8)(password);
 }, _SeedlessOnboardingController_recoverAuthPubKey = function _SeedlessOnboardingController_recoverAuthPubKey() {
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsSRPBackedUpUser).call(this, this.state);
     const { authPubKey } = this.state;
@@ -815,16 +751,15 @@ async function _SeedlessOnboardingController_recoverEncKey(password) {
 /**
  * Update the encryption key with new password and update the Metadata Store with new encryption key.
  *
- * @param params - The function parameters.
- * @param params.oldPassword - The old password to verify.
- * @param params.newPassword - The new password to update.
+ * @param newPassword - The new password to update.
+ * @param oldPassword - The old password to verify.
  * @returns A promise that resolves to new encryption key and authentication key pair.
  */
-async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword, newPassword, }) {
+async function _SeedlessOnboardingController_changeEncryptionKey(newPassword, oldPassword) {
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
     const { authConnectionId, groupedAuthConnectionId, userId } = this.state;
     const { encKey, authKeyPair, keyShareIndex: newKeyShareIndex, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, oldPassword);
-    const result = await this.toprfClient.changeEncKey({
+    return await this.toprfClient.changeEncKey({
         nodeAuthTokens: this.state.nodeAuthTokens,
         authConnectionId,
         groupedAuthConnectionId,
@@ -832,10 +767,9 @@ async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword,
         oldEncKey: encKey,
         oldAuthKeyPair: authKeyPair,
         newKeyShareIndex,
-        oldPassword: (0, utils_1.bytesToBase64)(encKey),
+        oldPassword,
         newPassword,
     });
-    return result;
 }, _SeedlessOnboardingController_encryptAndStoreSecretData = 
 /**
  * Encrypt and store the secret data backup in the metadata store.
@@ -1262,15 +1196,4 @@ async function withLock(mutex, callback) {
         releaseLock();
     }
 }
-/**
- * Assert that the provided encrypted keyring encryption key is a valid non-empty string.
- *
- * @param encryptedKeyringEncryptionKey - The encrypted keyring encryption key to check.
- * @throws If the encrypted keyring encryption key is not a valid string.
- */
-function assertIsEncryptedKeyringEncryptionKeySet(encryptedKeyringEncryptionKey) {
-    if (!encryptedKeyringEncryptionKey) {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.EncryptedKeyringEncryptionKeyNotSet);
-    }
-}
 //# sourceMappingURL=SeedlessOnboardingController.cjs.map