@metamask-previews/seedless-onboarding-controller 2.0.1-preview-2bb8758e → 2.0.1-preview-c10fdda1

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Added `access_token` and `metadata_access_token` in seedless controller state. ([#6060](https://github.com/MetaMask/core/pull/6060))
+  - `access_token` can be used by profile sync pairing and for other apis access after wallet is unlocked.
+  - `metadata_access_token` is used to give access for web3auth metadata apis.
+
 ## [2.0.1]
 
 ### Fixed

package/dist/SeedlessOnboardingController.cjs

@@ -102,6 +102,17 @@ const seedlessOnboardingMetadata = {
         persist: false,
         anonymous: true,
     },
+    // stays in vault
+    accessToken: {
+        persist: false,
+        anonymous: true,
+    },
+    // stays outside of vault as this token is accessed by the metadata service
+    // before the vault is created or unlocked.
+    metadataAccessToken: {
+        persist: true,
+        anonymous: true,
+    },
     encryptedSeedlessEncryptionKey: {
         persist: true,
         anonymous: true,
@@ -150,6 +161,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         this.toprfClient = new toprf_secure_backup_1.ToprfSecureBackup({
             network,
             keyDeriver: toprfKeyDeriver,
+            fetchMetadataAccessCreds: this.fetchMetadataAccessCreds.bind(this),
         });
         __classPrivateFieldSet(this, _SeedlessOnboardingController_refreshJWTToken, refreshJWTToken, "f");
         __classPrivateFieldSet(this, _SeedlessOnboardingController_revokeRefreshToken, revokeRefreshToken, "f");
@@ -162,6 +174,25 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
         });
     }
+    async fetchMetadataAccessCreds() {
+        const { metadataAccessToken } = this.state;
+        if (!metadataAccessToken) {
+            throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidMetadataAccessToken);
+        }
+        // Check if token is expired and refresh if needed
+        const decodedToken = this.decodeJWTToken(metadataAccessToken);
+        if (decodedToken.exp < Math.floor(Date.now() / 1000)) {
+            // Token is expired, refresh it
+            await this.refreshAuthTokens();
+            // Get the new token after refresh
+            const { metadataAccessToken: newMetadataAccessToken } = this.state;
+            if (!newMetadataAccessToken) {
+                throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidMetadataAccessToken);
+            }
+            return { metadataAccessToken: newMetadataAccessToken };
+        }
+        return { metadataAccessToken };
+    }
     /**
      * Authenticate OAuth user using the seedless onboarding flow
      * and determine if the user is already registered or not.
@@ -175,13 +206,15 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param params.socialLoginEmail - The user email from Social login.
      * @param params.refreshToken - refresh token for refreshing expired nodeAuthTokens.
      * @param params.revokeToken - revoke token for revoking refresh token and get new refresh token and new revoke token.
+     * @param params.accessToken - Access token for pairing with profile sync auth service and to access other services.
+     * @param params.metadataAccessToken - Metadata access token for accessing the metadata service before the vault is created or unlocked.
      * @param params.skipLock - Optional flag to skip acquiring the controller lock. (to prevent deadlock in case the caller already acquired the lock)
      * @returns A promise that resolves to the authentication result.
      */
     async authenticate(params) {
         const doAuthenticateWithNodes = async () => {
             try {
-                const { idTokens, authConnectionId, groupedAuthConnectionId, userId, authConnection, socialLoginEmail, refreshToken, revokeToken, } = params;
+                const { idTokens, authConnectionId, groupedAuthConnectionId, userId, authConnection, socialLoginEmail, refreshToken, revokeToken, accessToken, metadataAccessToken, } = params;
                 const authenticationResult = await this.toprfClient.authenticate({
                     authConnectionId,
                     userId,
@@ -203,6 +236,12 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                         // Temporarily store revoke token in state for later vault creation
                         state.revokeToken = revokeToken;
                     }
+                    if (accessToken) {
+                        state.accessToken = accessToken;
+                    }
+                    if (metadataAccessToken) {
+                        state.metadataAccessToken = metadataAccessToken;
+                    }
                 });
                 return authenticationResult;
             }
@@ -461,6 +500,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             delete state.vaultEncryptionKey;
             delete state.vaultEncryptionSalt;
             delete state.revokeToken;
+            delete state.accessToken;
         });
         __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, false, "f");
     }
@@ -582,14 +622,14 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadKeyringEncryptionKey).call(this, encKey);
     }
     /**
-     * Refresh expired nodeAuthTokens using the stored refresh token.
+     * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using the stored refresh token.
      *
      * This method retrieves the refresh token from the vault and uses it to obtain
      * new nodeAuthTokens when the current ones have expired.
      *
      * @returns A promise that resolves to the new nodeAuthTokens.
      */
-    async refreshNodeAuthTokens() {
+    async refreshAuthTokens() {
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
         const { refreshToken } = this.state;
         try {
@@ -597,10 +637,12 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 connection: this.state.authConnection,
                 refreshToken,
             });
-            const { idTokens } = res;
+            const { idTokens, accessToken, metadataAccessToken } = res;
             // re-authenticate with the new id tokens to set new node auth tokens
             await this.authenticate({
                 idTokens,
+                accessToken,
+                metadataAccessToken,
                 authConnection: this.state.authConnection,
                 authConnectionId: this.state.authConnectionId,
                 groupedAuthConnectionId: this.state.groupedAuthConnectionId,
@@ -656,6 +698,34 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         // check if the token is expired
         return decodedToken.exp < Date.now() / 1000;
     }
+    checkMetadataAccessTokenExpired() {
+        try {
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+            const { metadataAccessToken } = this.state;
+            if (!metadataAccessToken) {
+                return true; // Consider missing token as expired
+            }
+            const decodedToken = this.decodeJWTToken(metadataAccessToken);
+            return decodedToken.exp < Math.floor(Date.now() / 1000);
+        }
+        catch {
+            return true; // Consider unauthenticated user as having expired tokens
+        }
+    }
+    checkAccessTokenExpired() {
+        try {
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+            const { accessToken } = this.state;
+            if (!accessToken) {
+                return true; // Consider missing token as expired
+            }
+            const decodedToken = this.decodeJWTToken(accessToken);
+            return decodedToken.exp < Math.floor(Date.now() / 1000);
+        }
+        catch {
+            return true; // Consider unauthenticated user as having expired tokens
+        }
+    }
     /**
      * Decode the node auth token from base64 to json object.
      *
@@ -665,6 +735,30 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     decodeNodeAuthToken(token) {
         return JSON.parse((0, utils_2.bytesToUtf8)((0, utils_1.base64ToBytes)(token)));
     }
+    /**
+     * Decode JWT token
+     *
+     * @param token - The JWT token to decode.
+     * @returns The decoded JWT token.
+     */
+    decodeJWTToken(token) {
+        // JWT tokens have 3 parts separated by dots: header.payload.signature
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            throw new Error('Invalid JWT token format');
+        }
+        // Decode the payload (second part)
+        const payload = parts[1];
+        // Add padding if needed for base64 decoding
+        const paddedPayload = payload + '='.repeat((4 - (payload.length % 4)) % 4);
+        try {
+            const decoded = JSON.parse(Buffer.from(paddedPayload, 'base64').toString());
+            return decoded;
+        }
+        catch (error) {
+            throw new Error(`Failed to decode JWT token: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
 }
 exports.SeedlessOnboardingController = SeedlessOnboardingController;
 _SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
@@ -919,7 +1013,6 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * @param password - The optional password to unlock the vault.
  * @param encryptionKey - The optional encryption key to unlock the vault.
  * @returns A promise that resolves to an object containing:
- * - nodeAuthTokens: Authentication tokens to communicate with the TOPRF service
  * - toprfEncryptionKey: The decrypted TOPRF encryption key
  * - toprfAuthKeyPair: The decrypted TOPRF authentication key pair
  * @throws {Error} If:
@@ -962,20 +1055,19 @@ async function _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey(passw
             updatedState.vaultEncryptionKey = vaultEncryptionKey;
             updatedState.vaultEncryptionSalt = vaultEncryptionSalt;
         }
-        const { nodeAuthTokens, toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
-        // update the state with the restored nodeAuthTokens
+        const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, accessToken, } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
         this.update((state) => {
-            state.nodeAuthTokens = nodeAuthTokens;
             state.vaultEncryptionKey = updatedState.vaultEncryptionKey;
             state.vaultEncryptionSalt = updatedState.vaultEncryptionSalt;
             state.revokeToken = revokeToken;
+            state.accessToken = accessToken;
         });
         return {
-            nodeAuthTokens,
             toprfEncryptionKey,
             toprfPwEncryptionKey,
             toprfAuthKeyPair,
             revokeToken,
+            accessToken,
         };
     });
 }, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState = 
@@ -1051,14 +1143,17 @@ async function _SeedlessOnboardingController_createNewVaultWithAuthData({ passwo
     if (!this.state.revokeToken) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
     }
+    if (!this.state.accessToken) {
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidAccessToken);
+    }
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
     const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_serializeKeyData).call(this, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair);
     const serializedVaultData = JSON.stringify({
-        authTokens: this.state.nodeAuthTokens,
         toprfEncryptionKey,
         toprfPwEncryptionKey,
         toprfAuthKeyPair,
         revokeToken: this.state.revokeToken,
+        accessToken: this.state.accessToken,
     });
     await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
         password,
@@ -1157,11 +1252,11 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
         pk: (0, utils_1.base64ToBytes)(parsedToprfAuthKeyPair.pk),
     };
     return {
-        nodeAuthTokens: parsedVaultData.authTokens,
         toprfEncryptionKey: rawToprfEncryptionKey,
         toprfPwEncryptionKey: rawToprfPwEncryptionKey,
         toprfAuthKeyPair: rawToprfAuthKeyPair,
         revokeToken: parsedVaultData.revokeToken,
+        accessToken: parsedVaultData.accessToken,
     };
 }, _SeedlessOnboardingController_assertIsUnlocked = function _SeedlessOnboardingController_assertIsUnlocked() {
     if (!__classPrivateFieldGet(this, _SeedlessOnboardingController_isUnlocked, "f")) {
@@ -1186,6 +1281,10 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
     if (!('refreshToken' in value) || typeof value.refreshToken !== 'string') {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRefreshToken);
     }
+    if (!('metadataAccessToken' in value) ||
+        typeof value.metadataAccessToken !== 'string') {
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidMetadataAccessToken);
+    }
 }, _SeedlessOnboardingController_assertIsSRPBackedUpUser = function _SeedlessOnboardingController_assertIsSRPBackedUpUser(value) {
     if (!this.state.authPubKey) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.SRPNotBackedUpError);
@@ -1212,8 +1311,6 @@ async function _SeedlessOnboardingController_assertPasswordInSync(options) {
     // value is not valid vault data if any of the following conditions are true:
     if (!value || // value is not defined
         typeof value !== 'object' || // value is not an object
-        !('authTokens' in value) || // authTokens is not defined
-        typeof value.authTokens !== 'object' || // authTokens is not an object
         !('toprfEncryptionKey' in value) || // toprfEncryptionKey is not defined
         typeof value.toprfEncryptionKey !== 'string' || // toprfEncryptionKey is not a string
         !('toprfPwEncryptionKey' in value) || // toprfPwEncryptionKey is not defined
@@ -1221,7 +1318,9 @@ async function _SeedlessOnboardingController_assertPasswordInSync(options) {
         !('toprfAuthKeyPair' in value) || // toprfAuthKeyPair is not defined
         typeof value.toprfAuthKeyPair !== 'string' || // toprfAuthKeyPair is not a string
         !('revokeToken' in value) || // revokeToken is not defined
-        typeof value.revokeToken !== 'string' // revokeToken is not a string
+        typeof value.revokeToken !== 'string' || // revokeToken is not a string
+        !('accessToken' in value) || // accessToken is not defined
+        typeof value.accessToken !== 'string' // accessToken is not a string
     ) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultDataError);
     }
@@ -1248,9 +1347,13 @@ async function _SeedlessOnboardingController_executeWithTokenRefresh(operation,
     try {
         // proactively check for expired tokens and refresh them if needed
         const isNodeAuthTokenExpired = this.checkNodeAuthTokenExpired();
-        if (isNodeAuthTokenExpired) {
+        const isMetadataAccessTokenExpired = this.checkMetadataAccessTokenExpired();
+        const isAccessTokenExpired = this.checkAccessTokenExpired();
+        if (isNodeAuthTokenExpired ||
+            isMetadataAccessTokenExpired ||
+            isAccessTokenExpired) {
             log(`JWT token expired during ${operationName}, attempting to refresh tokens`, 'node auth token exp check');
-            await this.refreshNodeAuthTokens();
+            await this.refreshAuthTokens();
         }
         return await operation();
     }
@@ -1260,7 +1363,7 @@ async function _SeedlessOnboardingController_executeWithTokenRefresh(operation,
             log(`Token expired during ${operationName}, attempting to refresh tokens`, error);
             try {
                 // Refresh the tokens
-                await this.refreshNodeAuthTokens();
+                await this.refreshAuthTokens();
                 // Retry the operation with fresh tokens
                 return await operation();
             }