@metamask-previews/seedless-onboarding-controller 1.0.0-preview-ca9d0265 → 1.0.0-preview-01cb507d

package/dist/SeedlessOnboardingController.cjs

@@ -10,13 +10,16 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_recoverPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_assertIsValidVaultData, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_recoverKeyringEncryptionKey, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_assertIsValidVaultData, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getDefaultSeedlessOnboardingControllerState = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
 const base_controller_1 = require("@metamask/base-controller");
 const toprf_secure_backup_1 = require("@metamask/toprf-secure-backup");
 const utils_1 = require("@metamask/utils");
+const aes_1 = require("@noble/ciphers/aes");
+const utils_2 = require("@noble/ciphers/utils");
+const webcrypto_1 = require("@noble/ciphers/webcrypto");
 const secp256k1_1 = require("@noble/curves/secp256k1");
 const async_mutex_1 = require("async-mutex");
 const constants_1 = require("./constants.cjs");
@@ -99,6 +102,10 @@ const seedlessOnboardingMetadata = {
         persist: false,
         anonymous: true,
     },
+    encryptedKeyringEncryptionKey: {
+        persist: true,
+        anonymous: true,
+    },
 };
 class SeedlessOnboardingController extends base_controller_1.BaseController {
     /**
@@ -210,9 +217,10 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param password - The password used to create new wallet and seedphrase
      * @param seedPhrase - The initial seed phrase (Mnemonic) created together with the wallet.
      * @param keyringId - The keyring id of the backup seed phrase
+     * @param keyringEncryptionKey - The encryption key to be used for encrypting the keyring vault.
      * @returns A promise that resolves to the encrypted seed phrase and the encryption key.
      */
-    async createToprfKeyAndBackupSeedPhrase(password, seedPhrase, keyringId) {
+    async createToprfKeyAndBackupSeedPhrase(password, seedPhrase, keyringId, keyringEncryptionKey) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             // to make sure that fail fast,
             // assert that the user is authenticated before creating the TOPRF key and backing up the seed phrase
@@ -246,6 +254,8 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
                     authPubKey: authKeyPair.pk,
                 });
+                // encrypt and store the keyring encryption key
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_storeKeyringEncryptionKey).call(this, encKey, keyringEncryptionKey);
             };
             await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_executeWithTokenRefresh).call(this, performKeyCreationAndBackup, 'createToprfKeyAndBackupSeedPhrase');
         });
@@ -347,11 +357,13 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      *
      * Changing password will also update the encryption key, metadata store and the vault with new encrypted values.
      *
-     * @param newPassword - The new password to update.
-     * @param oldPassword - The old password to verify.
+     * @param params - The function parameters.
+     * @param params.oldPassword - The old password to verify.
+     * @param params.newPassword - The new password to update.
+     * @param params.newKeyringEncryptionKey - The new keyring encryption key to store.
      * @returns A promise that resolves to the success of the operation.
      */
-    async changePassword(newPassword, oldPassword) {
+    async changePassword({ oldPassword, newPassword, newKeyringEncryptionKey, }) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
             // verify the old password of the encrypted vault
@@ -364,7 +376,11 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             });
             const attemptChangePassword = async () => {
                 // update the encryption key with new password and update the Metadata Store
-                const { encKey: newEncKey, authKeyPair: newAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_changeEncryptionKey).call(this, newPassword, oldPassword);
+                const { encKey: newEncKey, authKeyPair: newAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_changeEncryptionKey).call(this, {
+                    oldPassword,
+                    newPassword,
+                    newKeyringEncryptionKey,
+                });
                 // update and encrypt the vault with new password
                 await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
                     password: newPassword,
@@ -467,17 +483,12 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * persist the latest global password authPubKey
      *
      * @param params - The parameters for syncing the latest global password.
-     * @param params.oldPassword - The old password to verify.
      * @param params.globalPassword - The latest global password.
      * @returns A promise that resolves to the success of the operation.
      */
-    async syncLatestGlobalPassword({ oldPassword, globalPassword, }) {
+    async syncLatestGlobalPassword({ globalPassword, }) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             const doSyncPassword = async () => {
-                // verify correct old password
-                await this.verifyVaultPassword(oldPassword, {
-                    skipLock: true, // skip lock since we already have the lock
-                });
                 // update vault with latest globalPassword
                 const { encKey, authKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
                 // update and encrypt the vault with new password
@@ -503,18 +514,18 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param params.globalPassword - The latest global password.
      * @returns A promise that resolves to the password corresponding to the current authPubKey in state.
      */
-    async recoverCurrentDevicePassword({ globalPassword, }) {
+    async recoverKeyringEncryptionKey({ globalPassword, }) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_executeWithTokenRefresh).call(this, async () => {
                 const currentDeviceAuthPubKey = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverAuthPubKey).call(this);
-                const { password: currentDevicePassword } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverPassword).call(this, {
-                    targetPwPubKey: currentDeviceAuthPubKey,
+                const { keyringEncryptionKey } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverKeyringEncryptionKey).call(this, {
+                    targetAuthPubKey: currentDeviceAuthPubKey,
                     globalPassword,
                 });
                 return {
-                    password: currentDevicePassword,
+                    keyringEncryptionKey,
                 };
-            }, 'recoverCurrentDevicePassword');
+            }, 'recoverKeyringEncryptionKey');
         });
     }
     /**
@@ -654,24 +665,27 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     }
 }
 exports.SeedlessOnboardingController = SeedlessOnboardingController;
-_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_recoverPassword = 
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_recoverKeyringEncryptionKey = 
 /**
- * @description Fetch the password corresponding to the targetPwPubKey.
+ * @description Fetch the keyring encryption key corresponding to the targetAuthPubKey.
  *
- * @param params - The parameters for fetching the password.
- * @param params.targetPwPubKey - The target public key of the password to recover.
+ * @param params - The parameters for fetching the keyring encryption key.
+ * @param params.targetAuthPubKey - The target public key of the keyring encryption key to recover.
  * @param params.globalPassword - The latest global password.
- * @returns A promise that resolves to the password corresponding to the current authPubKey in state.
+ * @returns A promise that resolves to the keyring encryption key corresponding to the current authPubKey in state.
  */
-async function _SeedlessOnboardingController_recoverPassword({ targetPwPubKey, globalPassword, }) {
+async function _SeedlessOnboardingController_recoverKeyringEncryptionKey({ targetAuthPubKey, globalPassword, }) {
     const { encKey: latestPwEncKey, authKeyPair: latestPwAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
     try {
         const res = await this.toprfClient.recoverPassword({
-            targetPwPubKey,
+            targetPwPubKey: targetAuthPubKey,
             curEncKey: latestPwEncKey,
             curAuthKeyPair: latestPwAuthKeyPair,
         });
-        return res;
+        const { password: recoveredEncryptionKeyBase64 } = res;
+        const recoveredEncryptionKey = (0, utils_1.base64ToBytes)(recoveredEncryptionKeyBase64);
+        const keyringEncryptionKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadKeyringEncryptionKey).call(this, recoveredEncryptionKey);
+        return { keyringEncryptionKey };
     }
     catch (error) {
         if (__classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_isTokenExpiredError).call(this, error)) {
@@ -713,6 +727,33 @@ async function _SeedlessOnboardingController_persistOprfKey(oprfKey, authPubKey)
     this.update((state) => {
         state.authPubKey = (0, utils_1.bytesToBase64)(params.authPubKey);
     });
+}, _SeedlessOnboardingController_storeKeyringEncryptionKey = 
+/**
+ * Encrypt the keyring encryption key and store it in state.
+ *
+ * @param encKey - The encryption key.
+ * @param keyringEncryptionKey - The keyring encryption key.
+ */
+async function _SeedlessOnboardingController_storeKeyringEncryptionKey(encKey, keyringEncryptionKey) {
+    const aes = (0, webcrypto_1.managedNonce)(aes_1.gcm)(encKey);
+    const encryptedKeyringEncryptionKey = aes.encrypt((0, utils_2.utf8ToBytes)(keyringEncryptionKey));
+    this.update((state) => {
+        state.encryptedKeyringEncryptionKey = (0, utils_1.bytesToBase64)(encryptedKeyringEncryptionKey);
+    });
+}, _SeedlessOnboardingController_loadKeyringEncryptionKey = 
+/**
+ * Decrypt the keyring encryption key from state.
+ *
+ * @param encKey - The encryption key.
+ * @returns The keyring encryption key.
+ */
+async function _SeedlessOnboardingController_loadKeyringEncryptionKey(encKey) {
+    const { encryptedKeyringEncryptionKey: encryptedKey } = this.state;
+    assertIsEncryptedKeyringEncryptionKeySet(encryptedKey);
+    const encryptedPasswordBytes = (0, utils_1.base64ToBytes)(encryptedKey);
+    const aes = (0, webcrypto_1.managedNonce)(aes_1.gcm)(encKey);
+    const password = aes.decrypt(encryptedPasswordBytes);
+    return (0, utils_2.bytesToUtf8)(password);
 }, _SeedlessOnboardingController_recoverAuthPubKey = function _SeedlessOnboardingController_recoverAuthPubKey() {
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsSRPBackedUpUser).call(this, this.state);
     const { authPubKey } = this.state;
@@ -751,15 +792,17 @@ async function _SeedlessOnboardingController_recoverEncKey(password) {
 /**
  * Update the encryption key with new password and update the Metadata Store with new encryption key.
  *
- * @param newPassword - The new password to update.
- * @param oldPassword - The old password to verify.
+ * @param params - The function parameters.
+ * @param params.oldPassword - The old password to verify.
+ * @param params.newPassword - The new password to update.
+ * @param params.newKeyringEncryptionKey - The new keyring encryption key to store.
  * @returns A promise that resolves to new encryption key and authentication key pair.
  */
-async function _SeedlessOnboardingController_changeEncryptionKey(newPassword, oldPassword) {
+async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword, newPassword, newKeyringEncryptionKey, }) {
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
     const { authConnectionId, groupedAuthConnectionId, userId } = this.state;
     const { encKey, authKeyPair, keyShareIndex: newKeyShareIndex, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, oldPassword);
-    return await this.toprfClient.changeEncKey({
+    const result = await this.toprfClient.changeEncKey({
         nodeAuthTokens: this.state.nodeAuthTokens,
         authConnectionId,
         groupedAuthConnectionId,
@@ -767,9 +810,11 @@ async function _SeedlessOnboardingController_changeEncryptionKey(newPassword, ol
         oldEncKey: encKey,
         oldAuthKeyPair: authKeyPair,
         newKeyShareIndex,
-        oldPassword,
+        oldPassword: (0, utils_1.bytesToBase64)(encKey),
         newPassword,
     });
+    await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_storeKeyringEncryptionKey).call(this, result.encKey, newKeyringEncryptionKey);
+    return result;
 }, _SeedlessOnboardingController_encryptAndStoreSecretData = 
 /**
  * Encrypt and store the secret data backup in the metadata store.
@@ -1196,4 +1241,15 @@ async function withLock(mutex, callback) {
         releaseLock();
     }
 }
+/**
+ * Assert that the provided encrypted keyring encryption key is a valid non-empty string.
+ *
+ * @param encryptedKeyringEncryptionKey - The encrypted keyring encryption key to check.
+ * @throws If the encrypted keyring encryption key is not a valid string.
+ */
+function assertIsEncryptedKeyringEncryptionKeySet(encryptedKeyringEncryptionKey) {
+    if (!encryptedKeyringEncryptionKey) {
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.EncryptedKeyringEncryptionKeyNotSet);
+    }
+}
 //# sourceMappingURL=SeedlessOnboardingController.cjs.map