@metamask-previews/seedless-onboarding-controller 2.4.0-preview-89ee3f6 → 2.4.0-preview-4aa55b88

package/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Added an optional parameter, `passwordOutdatedCacheTTL` to the constructor params and exported `SecretMetadata` class from the controller.([#6169](https://github.com/MetaMask/core/pull/6169))
+
+### Removed
+
+- Removed `syncLatestGlobalPassword` from the Controller. ([#6180](https://github.com/MetaMask/core/pull/6180))
+  - Moved the vault syncing to the `submitGlobalPassword` method
+
 ## [2.4.0]
 
 ### Fixed

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getDefaultSeedlessOnboardingControllerState = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -136,8 +136,9 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param options.network - The network to be used for the Seedless Onboarding flow.
      * @param options.refreshJWTToken - A function to get a new jwt token using refresh token.
      * @param options.revokeRefreshToken - A function to revoke the refresh token.
+     * @param options.passwordOutdatedCacheTTL - The TTL of the password outdated cache in milliseconds.,
      */
-    constructor({ messenger, state, encryptor, toprfKeyDeriver, network = constants_1.Web3AuthNetwork.Mainnet, refreshJWTToken, revokeRefreshToken, }) {
+    constructor({ messenger, state, encryptor, toprfKeyDeriver, network = constants_1.Web3AuthNetwork.Mainnet, refreshJWTToken, revokeRefreshToken, passwordOutdatedCacheTTL = constants_1.PASSWORD_OUTDATED_CACHE_TTL_MS, }) {
         super({
             name: constants_1.controllerName,
             metadata: seedlessOnboardingMetadata,
@@ -159,6 +160,12 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
          * The controller lock is synchronized with the keyring lock.
          */
         _SeedlessOnboardingController_isUnlocked.set(this, false);
+        /**
+         * The TTL of the password outdated cache in milliseconds.
+         */
+        _SeedlessOnboardingController_passwordOutdatedCacheTTL.set(this, void 0);
+        (0, assertions_1.assertIsPasswordOutdatedCacheValid)(passwordOutdatedCacheTTL);
+        __classPrivateFieldSet(this, _SeedlessOnboardingController_passwordOutdatedCacheTTL, passwordOutdatedCacheTTL, "f");
         __classPrivateFieldSet(this, _SeedlessOnboardingController_vaultEncryptor, encryptor, "f");
         this.toprfClient = new toprf_secure_backup_1.ToprfSecureBackup({
             network,
@@ -514,33 +521,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         });
         __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, false, "f");
     }
-    /**
-     * Sync the latest global password to the controller.
-     * reset vault with latest globalPassword,
-     * persist the latest global password authPubKey
-     *
-     * @param params - The parameters for syncing the latest global password.
-     * @param params.globalPassword - The latest global password.
-     * @returns A promise that resolves to the success of the operation.
-     */
-    async syncLatestGlobalPassword({ globalPassword, }) {
-        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
-            const doSyncPassword = async () => {
-                // update vault with latest globalPassword
-                const { encKey, pwEncKey, authKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
-                // update and encrypt the vault with new password
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-                    password: globalPassword,
-                    rawToprfEncryptionKey: encKey,
-                    rawToprfPwEncryptionKey: pwEncKey,
-                    rawToprfAuthKeyPair: authKeyPair,
-                });
-                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_resetPasswordOutdatedCache).call(this);
-            };
-            return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_executeWithTokenRefresh).call(this, doSyncPassword, 'syncLatestGlobalPassword');
-        });
-    }
     /**
      * @description Unlock the controller with the latest global password.
      *
@@ -581,7 +561,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 const now = Date.now();
                 const isCacheValid = passwordOutdatedCache &&
                     now - passwordOutdatedCache.timestamp <
-                        constants_1.PASSWORD_OUTDATED_CACHE_TTL_MS;
+                        __classPrivateFieldGet(this, _SeedlessOnboardingController_passwordOutdatedCacheTTL, "f");
                 if (isCacheValid) {
                     return passwordOutdatedCache.isExpiredPwd;
                 }
@@ -590,11 +570,16 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             const currentDeviceAuthPubKey = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverAuthPubKey).call(this);
             let globalAuthPubKey = options?.globalAuthPubKey;
             if (!globalAuthPubKey) {
-                const { authPubKey } = await this.toprfClient.fetchAuthPubKey({
+                const { authPubKey } = await this.toprfClient
+                    .fetchAuthPubKey({
                     nodeAuthTokens,
                     authConnectionId,
                     groupedAuthConnectionId,
                     userId,
+                })
+                    .catch((error) => {
+                    log('Error fetching auth pub key', error);
+                    throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.FailedToFetchAuthPubKey);
                 });
                 globalAuthPubKey = authPubKey;
             }
@@ -727,7 +712,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     }
 }
 exports.SeedlessOnboardingController = SeedlessOnboardingController;
-_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
 /**
  * @description Submit the global password to the controller, verify the
  * password validity and unlock the controller.
@@ -741,31 +726,32 @@ _SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardin
  * corresponding to the current authPubKey in state.
  */
 async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPubKey, globalPassword, maxKeyChainLength, }) {
-    const { pwEncKey: curPwEncKey, authKeyPair: curAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
+    const { pwEncKey: latestPwEncKey, authKeyPair: latestAuthKeyPair, encKey: latestEncKey, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
     try {
         // Recover vault encryption key.
-        const res = await this.toprfClient.recoverPwEncKey({
+        const { pwEncKey } = await this.toprfClient.recoverPwEncKey({
             targetAuthPubKey,
-            curPwEncKey,
-            curAuthKeyPair,
+            curPwEncKey: latestPwEncKey,
+            curAuthKeyPair: latestAuthKeyPair,
             maxPwChainLength: maxKeyChainLength,
         });
-        const { pwEncKey } = res;
         const vaultKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, pwEncKey);
+        const keyringEncryptionKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadKeyringEncryptionKey).call(this, pwEncKey);
         // Unlock the controller
-        const { revokeToken, toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
+        const { revokeToken } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
         if (revokeToken) {
             // revoke and recyle refresh token after unlock to keep refresh token fresh, avoid malicious use of leaked refresh token
             await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState).call(this, revokeToken);
-            // re-creating vault to persist the new revoke token
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-                password: globalPassword,
-                rawToprfEncryptionKey: toprfEncryptionKey,
-                rawToprfPwEncryptionKey: toprfPwEncryptionKey,
-                rawToprfAuthKeyPair: toprfAuthKeyPair,
-            });
         }
+        // re-creating vault to persist the new revoke token
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+            password: globalPassword,
+            rawToprfEncryptionKey: latestEncKey,
+            rawToprfPwEncryptionKey: latestPwEncKey,
+            rawToprfAuthKeyPair: latestAuthKeyPair,
+        });
+        await this.storeKeyringEncryptionKey(keyringEncryptionKey);
     }
     catch (error) {
         if (__classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_isTokenExpiredError).call(this, error)) {
@@ -945,16 +931,25 @@ async function _SeedlessOnboardingController_recoverEncKey(password) {
 async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword, newPassword, latestKeyIndex, }) {
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
     const { authConnectionId, groupedAuthConnectionId, userId } = this.state;
-    let { toprfEncryptionKey: encKey, toprfPwEncryptionKey: pwEncKey, toprfAuthKeyPair: authKeyPair, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, oldPassword);
-    let newKeyShareIndex = latestKeyIndex;
-    if (!newKeyShareIndex || !encKey || !pwEncKey || !authKeyPair) {
+    let encKey;
+    let pwEncKey;
+    let authKeyPair;
+    let globalKeyIndex = latestKeyIndex;
+    if (!globalKeyIndex) {
         ({
             encKey,
             pwEncKey,
             authKeyPair,
-            keyShareIndex: newKeyShareIndex,
+            keyShareIndex: globalKeyIndex,
         } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, oldPassword));
     }
+    else {
+        ({
+            toprfEncryptionKey: encKey,
+            toprfPwEncryptionKey: pwEncKey,
+            toprfAuthKeyPair: authKeyPair,
+        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, oldPassword));
+    }
     const result = await this.toprfClient.changeEncKey({
         nodeAuthTokens: this.state.nodeAuthTokens,
         authConnectionId,
@@ -963,7 +958,7 @@ async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword,
         oldEncKey: encKey,
         oldPwEncKey: pwEncKey,
         oldAuthKeyPair: authKeyPair,
-        newKeyShareIndex,
+        newKeyShareIndex: globalKeyIndex,
         newPassword,
     });
     return result;
@@ -1313,11 +1308,16 @@ async function _SeedlessOnboardingController_assertPasswordInSync(options) {
     if (!nodeAuthTokens || !authConnectionId || !userId) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.MissingAuthUserInfo);
     }
-    const { authPubKey, keyIndex: latestKeyIndex } = await this.toprfClient.fetchAuthPubKey({
+    const { authPubKey, keyIndex: latestKeyIndex } = await this.toprfClient
+        .fetchAuthPubKey({
         nodeAuthTokens,
         authConnectionId,
         groupedAuthConnectionId,
         userId,
+    })
+        .catch((error) => {
+        log('Error fetching auth pub key', error);
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.FailedToFetchAuthPubKey);
     });
     const isPasswordOutdated = await this.checkIsPasswordOutdated({
         ...options,