@metamask-previews/seedless-onboarding-controller 2.0.1-preview-32f9004a → 2.1.0-preview-522a9fc

package/CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.1.0]
+
+### Added
+
+- Added `access_token` and `metadata_access_token` in seedless controller state. ([#6060](https://github.com/MetaMask/core/pull/6060))
+  - `access_token` can be used by profile sync pairing and for other apis access after wallet is unlocked.
+  - `metadata_access_token` is used to give access for web3auth metadata apis.
+
 ## [2.0.1]
 
 ### Fixed
@@ -78,7 +86,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
     - `checkIsPasswordOutdated`: Check if the password is current device is outdated, i.e. user changed password in another device.
     - `clearState`: Reset the state of the controller to the defaults.
 
-[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/seedless-onboarding-controller@2.0.1...HEAD
+[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/seedless-onboarding-controller@2.1.0...HEAD
+[2.1.0]: https://github.com/MetaMask/core/compare/@metamask/seedless-onboarding-controller@2.0.1...@metamask/seedless-onboarding-controller@2.1.0
 [2.0.1]: https://github.com/MetaMask/core/compare/@metamask/seedless-onboarding-controller@2.0.0...@metamask/seedless-onboarding-controller@2.0.1
 [2.0.0]: https://github.com/MetaMask/core/compare/@metamask/seedless-onboarding-controller@1.0.0...@metamask/seedless-onboarding-controller@2.0.0
 [1.0.0]: https://github.com/MetaMask/core/releases/tag/@metamask/seedless-onboarding-controller@1.0.0

package/dist/SeedlessOnboardingController.cjs

@@ -26,6 +26,7 @@ const constants_1 = require("./constants.cjs");
 const errors_1 = require("./errors.cjs");
 const logger_1 = require("./logger.cjs");
 const SecretMetadata_1 = require("./SecretMetadata.cjs");
+const utils_3 = require("./utils.cjs");
 const log = (0, logger_1.createModuleLogger)(logger_1.projectLogger, constants_1.controllerName);
 /**
  * Get the default state for the Seedless Onboarding Controller.
@@ -102,6 +103,17 @@ const seedlessOnboardingMetadata = {
         persist: false,
         anonymous: true,
     },
+    // stays in vault
+    accessToken: {
+        persist: false,
+        anonymous: true,
+    },
+    // stays outside of vault as this token is accessed by the metadata service
+    // before the vault is created or unlocked.
+    metadataAccessToken: {
+        persist: true,
+        anonymous: true,
+    },
     encryptedSeedlessEncryptionKey: {
         persist: true,
         anonymous: true,
@@ -150,6 +162,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         this.toprfClient = new toprf_secure_backup_1.ToprfSecureBackup({
             network,
             keyDeriver: toprfKeyDeriver,
+            fetchMetadataAccessCreds: this.fetchMetadataAccessCreds.bind(this),
         });
         __classPrivateFieldSet(this, _SeedlessOnboardingController_refreshJWTToken, refreshJWTToken, "f");
         __classPrivateFieldSet(this, _SeedlessOnboardingController_revokeRefreshToken, revokeRefreshToken, "f");
@@ -162,6 +175,24 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
         });
     }
+    async fetchMetadataAccessCreds() {
+        const { metadataAccessToken } = this.state;
+        if (!metadataAccessToken) {
+            throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidMetadataAccessToken);
+        }
+        // Check if token is expired and refresh if needed
+        const decodedToken = (0, utils_3.decodeJWTToken)(metadataAccessToken);
+        if (decodedToken.exp < Math.floor(Date.now() / 1000)) {
+            // Token is expired, refresh it
+            await this.refreshAuthTokens();
+            // Get the new token after refresh
+            const { metadataAccessToken: newMetadataAccessToken } = this.state;
+            return {
+                metadataAccessToken: newMetadataAccessToken,
+            };
+        }
+        return { metadataAccessToken };
+    }
     /**
      * Authenticate OAuth user using the seedless onboarding flow
      * and determine if the user is already registered or not.
@@ -175,13 +206,15 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param params.socialLoginEmail - The user email from Social login.
      * @param params.refreshToken - refresh token for refreshing expired nodeAuthTokens.
      * @param params.revokeToken - revoke token for revoking refresh token and get new refresh token and new revoke token.
+     * @param params.accessToken - Access token for pairing with profile sync auth service and to access other services.
+     * @param params.metadataAccessToken - Metadata access token for accessing the metadata service before the vault is created or unlocked.
      * @param params.skipLock - Optional flag to skip acquiring the controller lock. (to prevent deadlock in case the caller already acquired the lock)
      * @returns A promise that resolves to the authentication result.
      */
     async authenticate(params) {
         const doAuthenticateWithNodes = async () => {
             try {
-                const { idTokens, authConnectionId, groupedAuthConnectionId, userId, authConnection, socialLoginEmail, refreshToken, revokeToken, } = params;
+                const { idTokens, authConnectionId, groupedAuthConnectionId, userId, authConnection, socialLoginEmail, refreshToken, revokeToken, accessToken, metadataAccessToken, } = params;
                 const authenticationResult = await this.toprfClient.authenticate({
                     authConnectionId,
                     userId,
@@ -203,6 +236,12 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                         // Temporarily store revoke token in state for later vault creation
                         state.revokeToken = revokeToken;
                     }
+                    if (accessToken) {
+                        state.accessToken = accessToken;
+                    }
+                    if (metadataAccessToken) {
+                        state.metadataAccessToken = metadataAccessToken;
+                    }
                 });
                 return authenticationResult;
             }
@@ -461,6 +500,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             delete state.vaultEncryptionKey;
             delete state.vaultEncryptionSalt;
             delete state.revokeToken;
+            delete state.accessToken;
         });
         __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, false, "f");
     }
@@ -582,14 +622,14 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadKeyringEncryptionKey).call(this, encKey);
     }
     /**
-     * Refresh expired nodeAuthTokens using the stored refresh token.
+     * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using the stored refresh token.
      *
      * This method retrieves the refresh token from the vault and uses it to obtain
      * new nodeAuthTokens when the current ones have expired.
      *
      * @returns A promise that resolves to the new nodeAuthTokens.
      */
-    async refreshNodeAuthTokens() {
+    async refreshAuthTokens() {
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
         const { refreshToken } = this.state;
         try {
@@ -597,10 +637,12 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 connection: this.state.authConnection,
                 refreshToken,
             });
-            const { idTokens } = res;
+            const { idTokens, accessToken, metadataAccessToken } = res;
             // re-authenticate with the new id tokens to set new node auth tokens
             await this.authenticate({
                 idTokens,
+                accessToken,
+                metadataAccessToken,
                 authConnection: this.state.authConnection,
                 authConnectionId: this.state.authConnectionId,
                 groupedAuthConnectionId: this.state.groupedAuthConnectionId,
@@ -652,18 +694,35 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         // all auth tokens should be expired at the same time so we can check the first one
         const firstAuthToken = nodeAuthTokens[0]?.authToken;
         // node auth token is base64 encoded json object
-        const decodedToken = this.decodeNodeAuthToken(firstAuthToken);
+        const decodedToken = (0, utils_3.decodeNodeAuthToken)(firstAuthToken);
         // check if the token is expired
         return decodedToken.exp < Date.now() / 1000;
     }
-    /**
-     * Decode the node auth token from base64 to json object.
-     *
-     * @param token - The node auth token to decode.
-     * @returns The decoded node auth token.
-     */
-    decodeNodeAuthToken(token) {
-        return JSON.parse((0, utils_2.bytesToUtf8)((0, utils_1.base64ToBytes)(token)));
+    checkMetadataAccessTokenExpired() {
+        try {
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+            const { metadataAccessToken } = this.state;
+            // assertIsAuthenticatedUser will throw if metadataAccessToken is missing
+            const decodedToken = (0, utils_3.decodeJWTToken)(metadataAccessToken);
+            return decodedToken.exp < Math.floor(Date.now() / 1000);
+        }
+        catch {
+            return true; // Consider unauthenticated user as having expired tokens
+        }
+    }
+    checkAccessTokenExpired() {
+        try {
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+            const { accessToken } = this.state;
+            if (!accessToken) {
+                return true; // Consider missing token as expired
+            }
+            const decodedToken = (0, utils_3.decodeJWTToken)(accessToken);
+            return decodedToken.exp < Math.floor(Date.now() / 1000);
+        }
+        catch {
+            return true; // Consider unauthenticated user as having expired tokens
+        }
     }
 }
 exports.SeedlessOnboardingController = SeedlessOnboardingController;
@@ -919,7 +978,6 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * @param password - The optional password to unlock the vault.
  * @param encryptionKey - The optional encryption key to unlock the vault.
  * @returns A promise that resolves to an object containing:
- * - nodeAuthTokens: Authentication tokens to communicate with the TOPRF service
  * - toprfEncryptionKey: The decrypted TOPRF encryption key
  * - toprfAuthKeyPair: The decrypted TOPRF authentication key pair
  * @throws {Error} If:
@@ -962,20 +1020,19 @@ async function _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey(passw
             updatedState.vaultEncryptionKey = vaultEncryptionKey;
             updatedState.vaultEncryptionSalt = vaultEncryptionSalt;
         }
-        const { nodeAuthTokens, toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
-        // update the state with the restored nodeAuthTokens
+        const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, accessToken, } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
         this.update((state) => {
-            state.nodeAuthTokens = nodeAuthTokens;
             state.vaultEncryptionKey = updatedState.vaultEncryptionKey;
             state.vaultEncryptionSalt = updatedState.vaultEncryptionSalt;
             state.revokeToken = revokeToken;
+            state.accessToken = accessToken;
         });
         return {
-            nodeAuthTokens,
             toprfEncryptionKey,
             toprfPwEncryptionKey,
             toprfAuthKeyPair,
             revokeToken,
+            accessToken,
         };
     });
 }, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState = 
@@ -1051,14 +1108,17 @@ async function _SeedlessOnboardingController_createNewVaultWithAuthData({ passwo
     if (!this.state.revokeToken) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
     }
+    if (!this.state.accessToken) {
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidAccessToken);
+    }
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
     const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_serializeKeyData).call(this, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair);
     const serializedVaultData = JSON.stringify({
-        authTokens: this.state.nodeAuthTokens,
         toprfEncryptionKey,
         toprfPwEncryptionKey,
         toprfAuthKeyPair,
         revokeToken: this.state.revokeToken,
+        accessToken: this.state.accessToken,
     });
     await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
         password,
@@ -1157,11 +1217,11 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
         pk: (0, utils_1.base64ToBytes)(parsedToprfAuthKeyPair.pk),
     };
     return {
-        nodeAuthTokens: parsedVaultData.authTokens,
         toprfEncryptionKey: rawToprfEncryptionKey,
         toprfPwEncryptionKey: rawToprfPwEncryptionKey,
         toprfAuthKeyPair: rawToprfAuthKeyPair,
         revokeToken: parsedVaultData.revokeToken,
+        accessToken: parsedVaultData.accessToken,
     };
 }, _SeedlessOnboardingController_assertIsUnlocked = function _SeedlessOnboardingController_assertIsUnlocked() {
     if (!__classPrivateFieldGet(this, _SeedlessOnboardingController_isUnlocked, "f")) {
@@ -1186,6 +1246,10 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
     if (!('refreshToken' in value) || typeof value.refreshToken !== 'string') {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRefreshToken);
     }
+    if (!('metadataAccessToken' in value) ||
+        typeof value.metadataAccessToken !== 'string') {
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidMetadataAccessToken);
+    }
 }, _SeedlessOnboardingController_assertIsSRPBackedUpUser = function _SeedlessOnboardingController_assertIsSRPBackedUpUser(value) {
     if (!this.state.authPubKey) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.SRPNotBackedUpError);
@@ -1212,8 +1276,6 @@ async function _SeedlessOnboardingController_assertPasswordInSync(options) {
     // value is not valid vault data if any of the following conditions are true:
     if (!value || // value is not defined
         typeof value !== 'object' || // value is not an object
-        !('authTokens' in value) || // authTokens is not defined
-        typeof value.authTokens !== 'object' || // authTokens is not an object
         !('toprfEncryptionKey' in value) || // toprfEncryptionKey is not defined
         typeof value.toprfEncryptionKey !== 'string' || // toprfEncryptionKey is not a string
         !('toprfPwEncryptionKey' in value) || // toprfPwEncryptionKey is not defined
@@ -1221,7 +1283,9 @@ async function _SeedlessOnboardingController_assertPasswordInSync(options) {
         !('toprfAuthKeyPair' in value) || // toprfAuthKeyPair is not defined
         typeof value.toprfAuthKeyPair !== 'string' || // toprfAuthKeyPair is not a string
         !('revokeToken' in value) || // revokeToken is not defined
-        typeof value.revokeToken !== 'string' // revokeToken is not a string
+        typeof value.revokeToken !== 'string' || // revokeToken is not a string
+        !('accessToken' in value) || // accessToken is not defined
+        typeof value.accessToken !== 'string' // accessToken is not a string
     ) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultDataError);
     }
@@ -1248,9 +1312,13 @@ async function _SeedlessOnboardingController_executeWithTokenRefresh(operation,
     try {
         // proactively check for expired tokens and refresh them if needed
         const isNodeAuthTokenExpired = this.checkNodeAuthTokenExpired();
-        if (isNodeAuthTokenExpired) {
+        const isMetadataAccessTokenExpired = this.checkMetadataAccessTokenExpired();
+        const isAccessTokenExpired = this.checkAccessTokenExpired();
+        if (isNodeAuthTokenExpired ||
+            isMetadataAccessTokenExpired ||
+            isAccessTokenExpired) {
             log(`JWT token expired during ${operationName}, attempting to refresh tokens`, 'node auth token exp check');
-            await this.refreshNodeAuthTokens();
+            await this.refreshAuthTokens();
         }
         return await operation();
     }
@@ -1260,7 +1328,7 @@ async function _SeedlessOnboardingController_executeWithTokenRefresh(operation,
             log(`Token expired during ${operationName}, attempting to refresh tokens`, error);
             try {
                 // Refresh the tokens
-                await this.refreshNodeAuthTokens();
+                await this.refreshAuthTokens();
                 // Retry the operation with fresh tokens
                 return await operation();
             }