@metamask-previews/seedless-onboarding-controller 2.2.0-preview-bfc59609 → 2.3.0-preview-3713f9f

package/CHANGELOG.md

@@ -7,15 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [2.2.0]
+## [2.3.0]
+
+### Uncategorized
+
+- Seedless onboarding controller: Remove usage of `Buffer` ([#6140](https://github.com/MetaMask/core/pull/6140))
 
 ### Added
 
 - Added a optional param `maxKeyChainLength` in `submitGlobalPassword` function.([#6134](https://github.com/MetaMask/core/pull/6134))
+- Separated vault update logic from `revokeRefreshToken`, `revokeRefreshToken` now accepts a revokeToken instead of password. ([#6134](https://github.com/MetaMask/core/pull/6134))
+
+### Changed
+
+- `revokeRefreshToken` is removed and a private function named `revokeRefreshTokenAndUpdateState` is added as a replacement.([#6136](https://github.com/MetaMask/core/pull/6136))
+
+## [2.2.0]
 
 ### Fixed
 
-- remove `access_token` validation when the wallet is locked. ([#6133](https://github.com/MetaMask/core/pull/6133))
+- Removed `access_token` validation when the wallet is locked. ([#6133](https://github.com/MetaMask/core/pull/6133))
+- Removed `revoke_token` validation from `#parseVault` and `createNewVaultWithAuthData` to handle the case when max key chain length exceeds. ([#6136](https://github.com/MetaMask/core/pull/6136))
 
 ## [2.1.0]
 
@@ -96,7 +108,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
     - `checkIsPasswordOutdated`: Check if the password is current device is outdated, i.e. user changed password in another device.
     - `clearState`: Reset the state of the controller to the defaults.
 
-[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/seedless-onboarding-controller@2.2.0...HEAD
+[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/seedless-onboarding-controller@2.3.0...HEAD
+[2.3.0]: https://github.com/MetaMask/core/compare/@metamask/seedless-onboarding-controller@2.2.0...@metamask/seedless-onboarding-controller@2.3.0
 [2.2.0]: https://github.com/MetaMask/core/compare/@metamask/seedless-onboarding-controller@2.1.0...@metamask/seedless-onboarding-controller@2.2.0
 [2.1.0]: https://github.com/MetaMask/core/compare/@metamask/seedless-onboarding-controller@2.0.1...@metamask/seedless-onboarding-controller@2.1.0
 [2.0.1]: https://github.com/MetaMask/core/compare/@metamask/seedless-onboarding-controller@2.0.0...@metamask/seedless-onboarding-controller@2.0.1

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_assertIsValidVaultData, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getDefaultSeedlessOnboardingControllerState = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -22,6 +22,7 @@ const utils_2 = require("@noble/ciphers/utils");
 const webcrypto_1 = require("@noble/ciphers/webcrypto");
 const secp256k1_1 = require("@noble/curves/secp256k1");
 const async_mutex_1 = require("async-mutex");
+const assertions_1 = require("./assertions.cjs");
 const constants_1 = require("./constants.cjs");
 const errors_1 = require("./errors.cjs");
 const logger_1 = require("./logger.cjs");
@@ -484,10 +485,18 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      */
     async submitPassword(password) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey).call(this, password);
+            const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey).call(this, password);
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
-            // revoke and recyle refresh token after unlock to keep refresh token fresh, avoid malicious use of leaked refresh token
-            await this.revokeRefreshToken(password);
+            if (revokeToken) {
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState).call(this, revokeToken);
+                // re-creating vault to persist the new revoke token
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                    password,
+                    rawToprfEncryptionKey: toprfEncryptionKey,
+                    rawToprfPwEncryptionKey: toprfPwEncryptionKey,
+                    rawToprfAuthKeyPair: toprfAuthKeyPair,
+                });
+            }
         });
     }
     /**
@@ -657,34 +666,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.AuthenticationError);
         }
     }
-    /**
-     * Revoke the refresh token and get new refresh token and new revoke token.
-     * This method is to be called after unlock
-     *
-     * @param password - The password to re-encrypt new token in the vault.
-     */
-    async revokeRefreshToken(password) {
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-        // get revoke token and backup encryption key from vault (should be unlocked already)
-        const { revokeToken, toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey).call(this);
-        const { newRevokeToken, newRefreshToken } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_revokeRefreshToken, "f").call(this, {
-            connection: this.state.authConnection,
-            revokeToken,
-        });
-        this.update((state) => {
-            // set new revoke token in state temporarily for persisting in vault
-            state.revokeToken = newRevokeToken;
-            // set new refresh token to persist in state
-            state.refreshToken = newRefreshToken;
-        });
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-            password,
-            rawToprfEncryptionKey: toprfEncryptionKey,
-            rawToprfPwEncryptionKey: toprfPwEncryptionKey,
-            rawToprfAuthKeyPair: toprfAuthKeyPair,
-        });
-    }
     /**
      * Check if the current node auth token is expired.
      *
@@ -765,10 +746,19 @@ async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPu
         const { pwEncKey } = res;
         const vaultKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, pwEncKey);
         // Unlock the controller
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey).call(this, undefined, vaultKey);
+        const { revokeToken, toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetBackupEncKey).call(this, undefined, vaultKey);
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
-        // revoke and recyle refresh token after unlock to keep refresh token fresh, avoid malicious use of leaked refresh token
-        await this.revokeRefreshToken(globalPassword);
+        if (revokeToken) {
+            // revoke and recyle refresh token after unlock to keep refresh token fresh, avoid malicious use of leaked refresh token
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState).call(this, revokeToken);
+            // re-creating vault to persist the new revoke token
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                password: globalPassword,
+                rawToprfEncryptionKey: toprfEncryptionKey,
+                rawToprfPwEncryptionKey: toprfPwEncryptionKey,
+                rawToprfAuthKeyPair: toprfAuthKeyPair,
+            });
+        }
     }
     catch (error) {
         if (__classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_isTokenExpiredError).call(this, error)) {
@@ -1123,9 +1113,6 @@ async function _SeedlessOnboardingController_withPersistedSecretMetadataBackupsS
  */
 async function _SeedlessOnboardingController_createNewVaultWithAuthData({ password, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair, }) {
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-    if (!this.state.revokeToken) {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
-    }
     if (!this.state.accessToken) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidAccessToken);
     }
@@ -1226,7 +1213,7 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
     catch {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidVaultData);
     }
-    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsValidVaultData).call(this, parsedVaultData);
+    (0, assertions_1.assertIsValidVaultData)(parsedVaultData);
     const rawToprfEncryptionKey = (0, utils_1.base64ToBytes)(parsedVaultData.toprfEncryptionKey);
     const rawToprfPwEncryptionKey = (0, utils_1.base64ToBytes)(parsedVaultData.toprfPwEncryptionKey);
     const parsedToprfAuthKeyPair = JSON.parse(parsedVaultData.toprfAuthKeyPair);
@@ -1290,23 +1277,25 @@ async function _SeedlessOnboardingController_assertPasswordInSync(options) {
     this.update((state) => {
         delete state.passwordOutdatedCache;
     });
-}, _SeedlessOnboardingController_assertIsValidVaultData = function _SeedlessOnboardingController_assertIsValidVaultData(value) {
-    // value is not valid vault data if any of the following conditions are true:
-    if (!value || // value is not defined
-        typeof value !== 'object' || // value is not an object
-        !('toprfEncryptionKey' in value) || // toprfEncryptionKey is not defined
-        typeof value.toprfEncryptionKey !== 'string' || // toprfEncryptionKey is not a string
-        !('toprfPwEncryptionKey' in value) || // toprfPwEncryptionKey is not defined
-        typeof value.toprfPwEncryptionKey !== 'string' || // toprfPwEncryptionKey is not a string
-        !('toprfAuthKeyPair' in value) || // toprfAuthKeyPair is not defined
-        typeof value.toprfAuthKeyPair !== 'string' || // toprfAuthKeyPair is not a string
-        !('revokeToken' in value) || // revokeToken is not defined
-        typeof value.revokeToken !== 'string' || // revokeToken is not a string
-        !('accessToken' in value) || // accessToken is not defined
-        typeof value.accessToken !== 'string' // accessToken is not a string
-    ) {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultDataError);
-    }
+}, _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState = 
+/**
+ * Revoke the refresh token and get new refresh token and new revoke token.
+ * This method is to be called after user is authenticated.
+ *
+ * @param revokeToken - The revoke token to use for revoking the refresh token.
+ */
+async function _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState(revokeToken) {
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+    const { newRevokeToken, newRefreshToken } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_revokeRefreshToken, "f").call(this, {
+        connection: this.state.authConnection,
+        revokeToken,
+    });
+    this.update((state) => {
+        // set new revoke token in state temporarily for persisting in vault
+        state.revokeToken = newRevokeToken;
+        // set new refresh token to persist in state
+        state.refreshToken = newRefreshToken;
+    });
 }, _SeedlessOnboardingController_isTokenExpiredError = function _SeedlessOnboardingController_isTokenExpiredError(error) {
     if (error instanceof toprf_secure_backup_1.TOPRFError) {
         // eslint-disable-next-line @typescript-eslint/no-unsafe-enum-comparison