@metamask-previews/seedless-onboarding-controller 2.0.1-preview-c10fdda1 → 2.0.1-preview-32f9004a

package/CHANGELOG.md

@@ -7,12 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Added
-
-- Added `access_token` and `metadata_access_token` in seedless controller state. ([#6060](https://github.com/MetaMask/core/pull/6060))
-  - `access_token` can be used by profile sync pairing and for other apis access after wallet is unlocked.
-  - `metadata_access_token` is used to give access for web3auth metadata apis.
-
 ## [2.0.1]
 
 ### Fixed

package/dist/SeedlessOnboardingController.cjs

@@ -102,17 +102,6 @@ const seedlessOnboardingMetadata = {
         persist: false,
         anonymous: true,
     },
-    // stays in vault
-    accessToken: {
-        persist: false,
-        anonymous: true,
-    },
-    // stays outside of vault as this token is accessed by the metadata service
-    // before the vault is created or unlocked.
-    metadataAccessToken: {
-        persist: true,
-        anonymous: true,
-    },
     encryptedSeedlessEncryptionKey: {
         persist: true,
         anonymous: true,
@@ -161,7 +150,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         this.toprfClient = new toprf_secure_backup_1.ToprfSecureBackup({
             network,
             keyDeriver: toprfKeyDeriver,
-            fetchMetadataAccessCreds: this.fetchMetadataAccessCreds.bind(this),
         });
         __classPrivateFieldSet(this, _SeedlessOnboardingController_refreshJWTToken, refreshJWTToken, "f");
         __classPrivateFieldSet(this, _SeedlessOnboardingController_revokeRefreshToken, revokeRefreshToken, "f");
@@ -174,25 +162,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
         });
     }
-    async fetchMetadataAccessCreds() {
-        const { metadataAccessToken } = this.state;
-        if (!metadataAccessToken) {
-            throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidMetadataAccessToken);
-        }
-        // Check if token is expired and refresh if needed
-        const decodedToken = this.decodeJWTToken(metadataAccessToken);
-        if (decodedToken.exp < Math.floor(Date.now() / 1000)) {
-            // Token is expired, refresh it
-            await this.refreshAuthTokens();
-            // Get the new token after refresh
-            const { metadataAccessToken: newMetadataAccessToken } = this.state;
-            if (!newMetadataAccessToken) {
-                throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidMetadataAccessToken);
-            }
-            return { metadataAccessToken: newMetadataAccessToken };
-        }
-        return { metadataAccessToken };
-    }
     /**
      * Authenticate OAuth user using the seedless onboarding flow
      * and determine if the user is already registered or not.
@@ -206,15 +175,13 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param params.socialLoginEmail - The user email from Social login.
      * @param params.refreshToken - refresh token for refreshing expired nodeAuthTokens.
      * @param params.revokeToken - revoke token for revoking refresh token and get new refresh token and new revoke token.
-     * @param params.accessToken - Access token for pairing with profile sync auth service and to access other services.
-     * @param params.metadataAccessToken - Metadata access token for accessing the metadata service before the vault is created or unlocked.
      * @param params.skipLock - Optional flag to skip acquiring the controller lock. (to prevent deadlock in case the caller already acquired the lock)
      * @returns A promise that resolves to the authentication result.
      */
     async authenticate(params) {
         const doAuthenticateWithNodes = async () => {
             try {
-                const { idTokens, authConnectionId, groupedAuthConnectionId, userId, authConnection, socialLoginEmail, refreshToken, revokeToken, accessToken, metadataAccessToken, } = params;
+                const { idTokens, authConnectionId, groupedAuthConnectionId, userId, authConnection, socialLoginEmail, refreshToken, revokeToken, } = params;
                 const authenticationResult = await this.toprfClient.authenticate({
                     authConnectionId,
                     userId,
@@ -236,12 +203,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                         // Temporarily store revoke token in state for later vault creation
                         state.revokeToken = revokeToken;
                     }
-                    if (accessToken) {
-                        state.accessToken = accessToken;
-                    }
-                    if (metadataAccessToken) {
-                        state.metadataAccessToken = metadataAccessToken;
-                    }
                 });
                 return authenticationResult;
             }
@@ -500,7 +461,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             delete state.vaultEncryptionKey;
             delete state.vaultEncryptionSalt;
             delete state.revokeToken;
-            delete state.accessToken;
         });
         __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, false, "f");
     }
@@ -622,14 +582,14 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadKeyringEncryptionKey).call(this, encKey);
     }
     /**
-     * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using the stored refresh token.
+     * Refresh expired nodeAuthTokens using the stored refresh token.
      *
      * This method retrieves the refresh token from the vault and uses it to obtain
      * new nodeAuthTokens when the current ones have expired.
      *
      * @returns A promise that resolves to the new nodeAuthTokens.
      */
-    async refreshAuthTokens() {
+    async refreshNodeAuthTokens() {
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
         const { refreshToken } = this.state;
         try {
@@ -637,12 +597,10 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 connection: this.state.authConnection,
                 refreshToken,
             });
-            const { idTokens, accessToken, metadataAccessToken } = res;
+            const { idTokens } = res;
             // re-authenticate with the new id tokens to set new node auth tokens
             await this.authenticate({
                 idTokens,
-                accessToken,
-                metadataAccessToken,
                 authConnection: this.state.authConnection,
                 authConnectionId: this.state.authConnectionId,
                 groupedAuthConnectionId: this.state.groupedAuthConnectionId,
@@ -698,34 +656,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         // check if the token is expired
         return decodedToken.exp < Date.now() / 1000;
     }
-    checkMetadataAccessTokenExpired() {
-        try {
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-            const { metadataAccessToken } = this.state;
-            if (!metadataAccessToken) {
-                return true; // Consider missing token as expired
-            }
-            const decodedToken = this.decodeJWTToken(metadataAccessToken);
-            return decodedToken.exp < Math.floor(Date.now() / 1000);
-        }
-        catch {
-            return true; // Consider unauthenticated user as having expired tokens
-        }
-    }
-    checkAccessTokenExpired() {
-        try {
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-            const { accessToken } = this.state;
-            if (!accessToken) {
-                return true; // Consider missing token as expired
-            }
-            const decodedToken = this.decodeJWTToken(accessToken);
-            return decodedToken.exp < Math.floor(Date.now() / 1000);
-        }
-        catch {
-            return true; // Consider unauthenticated user as having expired tokens
-        }
-    }
     /**
      * Decode the node auth token from base64 to json object.
      *
@@ -735,30 +665,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     decodeNodeAuthToken(token) {
         return JSON.parse((0, utils_2.bytesToUtf8)((0, utils_1.base64ToBytes)(token)));
     }
-    /**
-     * Decode JWT token
-     *
-     * @param token - The JWT token to decode.
-     * @returns The decoded JWT token.
-     */
-    decodeJWTToken(token) {
-        // JWT tokens have 3 parts separated by dots: header.payload.signature
-        const parts = token.split('.');
-        if (parts.length !== 3) {
-            throw new Error('Invalid JWT token format');
-        }
-        // Decode the payload (second part)
-        const payload = parts[1];
-        // Add padding if needed for base64 decoding
-        const paddedPayload = payload + '='.repeat((4 - (payload.length % 4)) % 4);
-        try {
-            const decoded = JSON.parse(Buffer.from(paddedPayload, 'base64').toString());
-            return decoded;
-        }
-        catch (error) {
-            throw new Error(`Failed to decode JWT token: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
 }
 exports.SeedlessOnboardingController = SeedlessOnboardingController;
 _SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
@@ -1013,6 +919,7 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * @param password - The optional password to unlock the vault.
  * @param encryptionKey - The optional encryption key to unlock the vault.
  * @returns A promise that resolves to an object containing:
+ * - nodeAuthTokens: Authentication tokens to communicate with the TOPRF service
  * - toprfEncryptionKey: The decrypted TOPRF encryption key
  * - toprfAuthKeyPair: The decrypted TOPRF authentication key pair
  * @throws {Error} If:
@@ -1055,19 +962,20 @@ async function _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey(passw
             updatedState.vaultEncryptionKey = vaultEncryptionKey;
             updatedState.vaultEncryptionSalt = vaultEncryptionSalt;
         }
-        const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, accessToken, } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
+        const { nodeAuthTokens, toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
+        // update the state with the restored nodeAuthTokens
         this.update((state) => {
+            state.nodeAuthTokens = nodeAuthTokens;
             state.vaultEncryptionKey = updatedState.vaultEncryptionKey;
             state.vaultEncryptionSalt = updatedState.vaultEncryptionSalt;
             state.revokeToken = revokeToken;
-            state.accessToken = accessToken;
         });
         return {
+            nodeAuthTokens,
             toprfEncryptionKey,
             toprfPwEncryptionKey,
             toprfAuthKeyPair,
             revokeToken,
-            accessToken,
         };
     });
 }, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState = 
@@ -1143,17 +1051,14 @@ async function _SeedlessOnboardingController_createNewVaultWithAuthData({ passwo
     if (!this.state.revokeToken) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
     }
-    if (!this.state.accessToken) {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidAccessToken);
-    }
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
     const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_serializeKeyData).call(this, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair);
     const serializedVaultData = JSON.stringify({
+        authTokens: this.state.nodeAuthTokens,
         toprfEncryptionKey,
         toprfPwEncryptionKey,
         toprfAuthKeyPair,
         revokeToken: this.state.revokeToken,
-        accessToken: this.state.accessToken,
     });
     await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
         password,
@@ -1252,11 +1157,11 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
         pk: (0, utils_1.base64ToBytes)(parsedToprfAuthKeyPair.pk),
     };
     return {
+        nodeAuthTokens: parsedVaultData.authTokens,
         toprfEncryptionKey: rawToprfEncryptionKey,
         toprfPwEncryptionKey: rawToprfPwEncryptionKey,
         toprfAuthKeyPair: rawToprfAuthKeyPair,
         revokeToken: parsedVaultData.revokeToken,
-        accessToken: parsedVaultData.accessToken,
     };
 }, _SeedlessOnboardingController_assertIsUnlocked = function _SeedlessOnboardingController_assertIsUnlocked() {
     if (!__classPrivateFieldGet(this, _SeedlessOnboardingController_isUnlocked, "f")) {
@@ -1281,10 +1186,6 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
     if (!('refreshToken' in value) || typeof value.refreshToken !== 'string') {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRefreshToken);
     }
-    if (!('metadataAccessToken' in value) ||
-        typeof value.metadataAccessToken !== 'string') {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidMetadataAccessToken);
-    }
 }, _SeedlessOnboardingController_assertIsSRPBackedUpUser = function _SeedlessOnboardingController_assertIsSRPBackedUpUser(value) {
     if (!this.state.authPubKey) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.SRPNotBackedUpError);
@@ -1311,6 +1212,8 @@ async function _SeedlessOnboardingController_assertPasswordInSync(options) {
     // value is not valid vault data if any of the following conditions are true:
     if (!value || // value is not defined
         typeof value !== 'object' || // value is not an object
+        !('authTokens' in value) || // authTokens is not defined
+        typeof value.authTokens !== 'object' || // authTokens is not an object
         !('toprfEncryptionKey' in value) || // toprfEncryptionKey is not defined
         typeof value.toprfEncryptionKey !== 'string' || // toprfEncryptionKey is not a string
         !('toprfPwEncryptionKey' in value) || // toprfPwEncryptionKey is not defined
@@ -1318,9 +1221,7 @@ async function _SeedlessOnboardingController_assertPasswordInSync(options) {
         !('toprfAuthKeyPair' in value) || // toprfAuthKeyPair is not defined
         typeof value.toprfAuthKeyPair !== 'string' || // toprfAuthKeyPair is not a string
         !('revokeToken' in value) || // revokeToken is not defined
-        typeof value.revokeToken !== 'string' || // revokeToken is not a string
-        !('accessToken' in value) || // accessToken is not defined
-        typeof value.accessToken !== 'string' // accessToken is not a string
+        typeof value.revokeToken !== 'string' // revokeToken is not a string
     ) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultDataError);
     }
@@ -1347,13 +1248,9 @@ async function _SeedlessOnboardingController_executeWithTokenRefresh(operation,
     try {
         // proactively check for expired tokens and refresh them if needed
         const isNodeAuthTokenExpired = this.checkNodeAuthTokenExpired();
-        const isMetadataAccessTokenExpired = this.checkMetadataAccessTokenExpired();
-        const isAccessTokenExpired = this.checkAccessTokenExpired();
-        if (isNodeAuthTokenExpired ||
-            isMetadataAccessTokenExpired ||
-            isAccessTokenExpired) {
+        if (isNodeAuthTokenExpired) {
             log(`JWT token expired during ${operationName}, attempting to refresh tokens`, 'node auth token exp check');
-            await this.refreshAuthTokens();
+            await this.refreshNodeAuthTokens();
         }
         return await operation();
     }
@@ -1363,7 +1260,7 @@ async function _SeedlessOnboardingController_executeWithTokenRefresh(operation,
             log(`Token expired during ${operationName}, attempting to refresh tokens`, error);
             try {
                 // Refresh the tokens
-                await this.refreshAuthTokens();
+                await this.refreshNodeAuthTokens();
                 // Retry the operation with fresh tokens
                 return await operation();
             }