@metamask-previews/seedless-onboarding-controller 2.1.0-preview-c2d112dc → 2.1.0-preview-7b1ac259

package/CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- remove `access_token` validation when the wallet is locked. ([#6133](https://github.com/MetaMask/core/pull/6133))
+
 ## [2.1.0]
 
 ### Added

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_assertIsValidVaultData, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_assertIsValidVaultData, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getDefaultSeedlessOnboardingControllerState = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -212,6 +212,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @returns A promise that resolves to the authentication result.
      */
     async authenticate(params) {
+        console.log('authenticate::params', params);
         const doAuthenticateWithNodes = async () => {
             try {
                 const { idTokens, authConnectionId, groupedAuthConnectionId, userId, authConnection, socialLoginEmail, refreshToken, revokeToken, accessToken, metadataAccessToken, } = params;
@@ -535,16 +536,18 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @description Unlock the controller with the latest global password.
      *
      * @param params - The parameters for unlocking the controller.
+     * @param params.maxKeyChainLength - The maximum chain length of the pwd encryption keys.
      * @param params.globalPassword - The latest global password.
      * @returns A promise that resolves to the success of the operation.
      */
-    async submitGlobalPassword({ globalPassword, }) {
+    async submitGlobalPassword({ globalPassword, maxKeyChainLength = 5, }) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_executeWithTokenRefresh).call(this, async () => {
                 const currentDeviceAuthPubKey = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverAuthPubKey).call(this);
                 await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_submitGlobalPassword).call(this, {
                     targetAuthPubKey: currentDeviceAuthPubKey,
                     globalPassword,
+                    maxKeyChainLength,
                 });
             }, 'submitGlobalPassword');
         });
@@ -698,6 +701,11 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         // check if the token is expired
         return decodedToken.exp < Date.now() / 1000;
     }
+    /**
+     * Check if the current metadata access token is expired.
+     *
+     * @returns True if the metadata access token is expired, false otherwise.
+     */
     checkMetadataAccessTokenExpired() {
         try {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
@@ -710,10 +718,17 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             return true; // Consider unauthenticated user as having expired tokens
         }
     }
+    /**
+     * Check if the current access token is expired.
+     * When the vault is locked, the access token is not accessible, so we return false.
+     *
+     * @returns True if the access token is expired, false otherwise.
+     */
     checkAccessTokenExpired() {
         try {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
             const { accessToken } = this.state;
+            console.log('checkAccessTokenExpired::accessToken', accessToken);
             if (!accessToken) {
                 return true; // Consider missing token as expired
             }
@@ -732,13 +747,14 @@ _SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardin
  * password validity and unlock the controller.
  *
  * @param params - The parameters for submitting the global password.
+ * @param params.maxKeyChainLength - The maximum chain length of the pwd encryption keys.
  * @param params.targetAuthPubKey - The target public key of the keyring
  * encryption key to recover.
  * @param params.globalPassword - The latest global password.
  * @returns A promise that resolves to the keyring encryption key
  * corresponding to the current authPubKey in state.
  */
-async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPubKey, globalPassword, }) {
+async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPubKey, globalPassword, maxKeyChainLength = 5, }) {
     const { pwEncKey: curPwEncKey, authKeyPair: curAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
     try {
         // Recover vault encryption key.
@@ -746,6 +762,7 @@ async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPu
             targetAuthPubKey,
             curPwEncKey,
             curAuthKeyPair,
+            maxPwChainLength: maxKeyChainLength,
         });
         const { pwEncKey } = res;
         const vaultKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, pwEncKey);
@@ -759,6 +776,9 @@ async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPu
         if (__classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_isTokenExpiredError).call(this, error)) {
             throw error;
         }
+        if (__classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_isMaxKeyChainLengthError).call(this, error)) {
+            throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.MaxKeyChainLengthExceeded);
+        }
         throw errors_1.PasswordSyncError.getInstance(error);
     }
 }, _SeedlessOnboardingController_setUnlocked = function _SeedlessOnboardingController_setUnlocked() {
@@ -1295,6 +1315,12 @@ async function _SeedlessOnboardingController_assertPasswordInSync(options) {
         return error.code === toprf_secure_backup_1.TOPRFErrorCode.AuthTokenExpired;
     }
     return false;
+}, _SeedlessOnboardingController_isMaxKeyChainLengthError = function _SeedlessOnboardingController_isMaxKeyChainLengthError(error) {
+    if (error instanceof toprf_secure_backup_1.TOPRFError) {
+        // todo: update this when the error message to error code once toprf sdk is updated.
+        return error.message === 'Exceeded maximum password chain length';
+    }
+    return false;
 }, _SeedlessOnboardingController_executeWithTokenRefresh = 
 /**
  * Executes an operation with automatic token refresh on expiration.
@@ -1313,7 +1339,12 @@ async function _SeedlessOnboardingController_executeWithTokenRefresh(operation,
         // proactively check for expired tokens and refresh them if needed
         const isNodeAuthTokenExpired = this.checkNodeAuthTokenExpired();
         const isMetadataAccessTokenExpired = this.checkMetadataAccessTokenExpired();
-        const isAccessTokenExpired = this.checkAccessTokenExpired();
+        // access token is only accessible when the vault is unlocked
+        // so skip the check if the vault is locked
+        let isAccessTokenExpired = false;
+        if (__classPrivateFieldGet(this, _SeedlessOnboardingController_isUnlocked, "f")) {
+            isAccessTokenExpired = this.checkAccessTokenExpired();
+        }
         if (isNodeAuthTokenExpired ||
             isMetadataAccessTokenExpired ||
             isAccessTokenExpired) {