@metamask-previews/seedless-onboarding-controller 2.4.0-preview-b8fffa99 → 2.4.0-preview-889b5df9

package/CHANGELOG.md

@@ -7,10 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Added
-
-- Added an optional parameter, `passwordOutdatedCacheTTL` to the constructor params and exported `SecretMetadata` class from the controller.([#6169](https://github.com/MetaMask/core/pull/6169))
-
 ## [2.4.0]
 
 ### Fixed

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getDefaultSeedlessOnboardingControllerState = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -136,9 +136,8 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param options.network - The network to be used for the Seedless Onboarding flow.
      * @param options.refreshJWTToken - A function to get a new jwt token using refresh token.
      * @param options.revokeRefreshToken - A function to revoke the refresh token.
-     * @param options.passwordOutdatedCacheTTL - The TTL of the password outdated cache in milliseconds.,
      */
-    constructor({ messenger, state, encryptor, toprfKeyDeriver, network = constants_1.Web3AuthNetwork.Mainnet, refreshJWTToken, revokeRefreshToken, passwordOutdatedCacheTTL = constants_1.PASSWORD_OUTDATED_CACHE_TTL_MS, }) {
+    constructor({ messenger, state, encryptor, toprfKeyDeriver, network = constants_1.Web3AuthNetwork.Mainnet, refreshJWTToken, revokeRefreshToken, }) {
         super({
             name: constants_1.controllerName,
             metadata: seedlessOnboardingMetadata,
@@ -160,12 +159,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
          * The controller lock is synchronized with the keyring lock.
          */
         _SeedlessOnboardingController_isUnlocked.set(this, false);
-        /**
-         * The TTL of the password outdated cache in milliseconds.
-         */
-        _SeedlessOnboardingController_passwordOutdatedCacheTTL.set(this, void 0);
-        (0, assertions_1.assertIsPasswordOutdatedCacheValid)(passwordOutdatedCacheTTL);
-        __classPrivateFieldSet(this, _SeedlessOnboardingController_passwordOutdatedCacheTTL, passwordOutdatedCacheTTL, "f");
         __classPrivateFieldSet(this, _SeedlessOnboardingController_vaultEncryptor, encryptor, "f");
         this.toprfClient = new toprf_secure_backup_1.ToprfSecureBackup({
             network,
@@ -398,7 +391,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             await this.verifyVaultPassword(oldPassword, {
                 skipLock: true, // skip lock since we already have the lock
             });
-            const { latestKeyIndex } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertPasswordInSync).call(this, {
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertPasswordInSync).call(this, {
                 skipCache: true,
                 skipLock: true, // skip lock since we already have the lock
             });
@@ -412,7 +405,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 const { encKey: newEncKey, pwEncKey: newPwEncKey, authKeyPair: newAuthKeyPair, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_changeEncryptionKey).call(this, {
                     oldPassword,
                     newPassword,
-                    latestKeyIndex,
                 });
                 // update and encrypt the vault with new password
                 await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
@@ -495,27 +487,14 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password);
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-                password,
-                rawToprfEncryptionKey: toprfEncryptionKey,
-                rawToprfPwEncryptionKey: toprfPwEncryptionKey,
-                rawToprfAuthKeyPair: toprfAuthKeyPair,
-            });
             if (revokeToken) {
-                // this call is not critical for unlocking, so we can do it in the background without await.
-                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState).call(this, revokeToken)
-                    .then(() => {
-                    // re-creating vault to persist the new revoke token
-                    // TODO: Optimize this function such that updates to vault wont require re-creating the vault.
-                    return __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-                        password,
-                        rawToprfEncryptionKey: toprfEncryptionKey,
-                        rawToprfPwEncryptionKey: toprfPwEncryptionKey,
-                        rawToprfAuthKeyPair: toprfAuthKeyPair,
-                    });
-                })
-                    .catch((error) => {
-                    log('Error revoking refresh token', error);
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState).call(this, revokeToken);
+                // re-creating vault to persist the new revoke token
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                    password,
+                    rawToprfEncryptionKey: toprfEncryptionKey,
+                    rawToprfPwEncryptionKey: toprfPwEncryptionKey,
+                    rawToprfAuthKeyPair: toprfAuthKeyPair,
                 });
             }
         });
@@ -585,8 +564,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @description Check if the current password is outdated compare to the global password.
      *
      * @param options - Optional options object.
-     * @param options.globalAuthPubKey - The global auth public key to compare with the current auth public key.
-     * If not provided, the global auth public key will be fetched from the backend.
      * @param options.skipCache - If true, bypass the cache and force a fresh check.
      * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)
      * @returns A promise that resolves to true if the password is outdated, false otherwise.
@@ -601,28 +578,19 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 const now = Date.now();
                 const isCacheValid = passwordOutdatedCache &&
                     now - passwordOutdatedCache.timestamp <
-                        __classPrivateFieldGet(this, _SeedlessOnboardingController_passwordOutdatedCacheTTL, "f");
+                        constants_1.PASSWORD_OUTDATED_CACHE_TTL_MS;
                 if (isCacheValid) {
                     return passwordOutdatedCache.isExpiredPwd;
                 }
             }
             const { nodeAuthTokens, authConnectionId, groupedAuthConnectionId, userId, } = this.state;
             const currentDeviceAuthPubKey = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverAuthPubKey).call(this);
-            let globalAuthPubKey = options?.globalAuthPubKey;
-            if (!globalAuthPubKey) {
-                const { authPubKey } = await this.toprfClient
-                    .fetchAuthPubKey({
-                    nodeAuthTokens,
-                    authConnectionId,
-                    groupedAuthConnectionId,
-                    userId,
-                })
-                    .catch((error) => {
-                    log('Error fetching auth pub key', error);
-                    throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.FailedToFetchAuthPubKey);
-                });
-                globalAuthPubKey = authPubKey;
-            }
+            const { authPubKey: globalAuthPubKey } = await this.toprfClient.fetchAuthPubKey({
+                nodeAuthTokens,
+                authConnectionId,
+                groupedAuthConnectionId,
+                userId,
+            });
             // use noble lib to deserialize and compare curve point
             const isExpiredPwd = !secp256k1_1.secp256k1.ProjectivePoint.fromHex(currentDeviceAuthPubKey).equals(secp256k1_1.secp256k1.ProjectivePoint.fromHex(globalAuthPubKey));
             // Cache the result in state
@@ -752,7 +720,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     }
 }
 exports.SeedlessOnboardingController = SeedlessOnboardingController;
-_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
 /**
  * @description Submit the global password to the controller, verify the
  * password validity and unlock the controller.
@@ -778,30 +746,17 @@ async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPu
         const { pwEncKey } = res;
         const vaultKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, pwEncKey);
         // Unlock the controller
-        const { revokeToken, toprfEncryptionKey: latestEncKey, toprfPwEncryptionKey: latestPwEncKey, toprfAuthKeyPair: latestAuthKeyPair, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
+        const { revokeToken, toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-            password: globalPassword,
-            rawToprfEncryptionKey: latestEncKey,
-            rawToprfPwEncryptionKey: latestPwEncKey,
-            rawToprfAuthKeyPair: latestAuthKeyPair,
-        });
         if (revokeToken) {
             // revoke and recyle refresh token after unlock to keep refresh token fresh, avoid malicious use of leaked refresh token
-            // this call is not critical for unlocking, so we can do it in the background without await.
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState).call(this, revokeToken)
-                .then(() => {
-                // re-creating vault to persist the new revoke token.
-                // TODO: Optimize this function such that updates to vault wont require re-creating the vault.
-                return __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-                    password: globalPassword,
-                    rawToprfEncryptionKey: latestEncKey,
-                    rawToprfPwEncryptionKey: latestPwEncKey,
-                    rawToprfAuthKeyPair: latestAuthKeyPair,
-                });
-            })
-                .catch((error) => {
-                log('Error revoking refresh token', error);
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState).call(this, revokeToken);
+            // re-creating vault to persist the new revoke token
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                password: globalPassword,
+                rawToprfEncryptionKey: toprfEncryptionKey,
+                rawToprfPwEncryptionKey: toprfPwEncryptionKey,
+                rawToprfAuthKeyPair: toprfAuthKeyPair,
             });
         }
     }
@@ -977,31 +932,12 @@ async function _SeedlessOnboardingController_recoverEncKey(password) {
  * @param params - The function parameters.
  * @param params.oldPassword - The old password to verify.
  * @param params.newPassword - The new password to update.
- * @param params.latestKeyIndex - The key index of the latest key.
  * @returns A promise that resolves to new encryption key and authentication key pair.
  */
-async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword, newPassword, latestKeyIndex, }) {
+async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword, newPassword, }) {
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
     const { authConnectionId, groupedAuthConnectionId, userId } = this.state;
-    let encKey;
-    let pwEncKey;
-    let authKeyPair;
-    let globalKeyIndex = latestKeyIndex;
-    if (!globalKeyIndex) {
-        ({
-            encKey,
-            pwEncKey,
-            authKeyPair,
-            keyShareIndex: globalKeyIndex,
-        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, oldPassword));
-    }
-    else {
-        ({
-            toprfEncryptionKey: encKey,
-            toprfPwEncryptionKey: pwEncKey,
-            toprfAuthKeyPair: authKeyPair,
-        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, oldPassword));
-    }
+    const { encKey, pwEncKey, authKeyPair, keyShareIndex: newKeyShareIndex, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, oldPassword);
     const result = await this.toprfClient.changeEncKey({
         nodeAuthTokens: this.state.nodeAuthTokens,
         authConnectionId,
@@ -1010,7 +946,7 @@ async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword,
         oldEncKey: encKey,
         oldPwEncKey: pwEncKey,
         oldAuthKeyPair: authKeyPair,
-        newKeyShareIndex: globalKeyIndex,
+        newKeyShareIndex,
         newPassword,
     });
     return result;
@@ -1352,33 +1288,13 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
  * @param options - The options for asserting the password is in sync.
  * @param options.skipCache - Whether to skip the cache check.
  * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)
- * @returns The global auth public key and the latest key index.
  * @throws If the password is outdated.
  */
 async function _SeedlessOnboardingController_assertPasswordInSync(options) {
-    const { nodeAuthTokens, authConnectionId, groupedAuthConnectionId, userId, } = this.state;
-    if (!nodeAuthTokens || !authConnectionId || !userId) {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.MissingAuthUserInfo);
-    }
-    const { authPubKey, keyIndex: latestKeyIndex } = await this.toprfClient
-        .fetchAuthPubKey({
-        nodeAuthTokens,
-        authConnectionId,
-        groupedAuthConnectionId,
-        userId,
-    })
-        .catch((error) => {
-        log('Error fetching auth pub key', error);
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.FailedToFetchAuthPubKey);
-    });
-    const isPasswordOutdated = await this.checkIsPasswordOutdated({
-        ...options,
-        globalAuthPubKey: authPubKey,
-    });
+    const isPasswordOutdated = await this.checkIsPasswordOutdated(options);
     if (isPasswordOutdated) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.OutdatedPassword);
     }
-    return { authPubKey, latestKeyIndex };
 }, _SeedlessOnboardingController_resetPasswordOutdatedCache = function _SeedlessOnboardingController_resetPasswordOutdatedCache() {
     this.update((state) => {
         delete state.passwordOutdatedCache;