@metamask-previews/seedless-onboarding-controller 2.4.0-preview-fed19434 → 2.4.0-preview-9b5151c

package/CHANGELOG.md

@@ -11,15 +11,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Added an optional parameter, `passwordOutdatedCacheTTL` to the constructor params and exported `SecretMetadata` class from the controller.([#6169](https://github.com/MetaMask/core/pull/6169))
 
-### Changed
-
-- Renamed public method `submitGlobalPassword` to `submitGlobalPasswordAndSync`. ([#6180](https://github.com/MetaMask/core/pull/6180))
-
-### Removed
-
-- Removed `syncLatestGlobalPassword` from the Controller. ([#6180](https://github.com/MetaMask/core/pull/6180))
-  - Moved the vault syncing to the `submitGlobalPassword` method
-
 ## [2.4.0]
 
 ### Fixed

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPasswordAndSync, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getDefaultSeedlessOnboardingControllerState = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -495,26 +495,14 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password);
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-                password,
-                rawToprfEncryptionKey: toprfEncryptionKey,
-                rawToprfPwEncryptionKey: toprfPwEncryptionKey,
-                rawToprfAuthKeyPair: toprfAuthKeyPair,
-            });
             if (revokeToken) {
-                // this call is not critical for unlocking, so we can do it in the background without await.
-                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState).call(this, revokeToken)
-                    .then(() => {
-                    // re-creating vault to persist the new revoke token
-                    return __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-                        password,
-                        rawToprfEncryptionKey: toprfEncryptionKey,
-                        rawToprfPwEncryptionKey: toprfPwEncryptionKey,
-                        rawToprfAuthKeyPair: toprfAuthKeyPair,
-                    });
-                })
-                    .catch((error) => {
-                    log('Error revoking refresh token', error);
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState).call(this, revokeToken);
+                // re-creating vault to persist the new revoke token
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                    password,
+                    rawToprfEncryptionKey: toprfEncryptionKey,
+                    rawToprfPwEncryptionKey: toprfPwEncryptionKey,
+                    rawToprfAuthKeyPair: toprfAuthKeyPair,
                 });
             }
         });
@@ -533,6 +521,33 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         });
         __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, false, "f");
     }
+    /**
+     * Sync the latest global password to the controller.
+     * reset vault with latest globalPassword,
+     * persist the latest global password authPubKey
+     *
+     * @param params - The parameters for syncing the latest global password.
+     * @param params.globalPassword - The latest global password.
+     * @returns A promise that resolves to the success of the operation.
+     */
+    async syncLatestGlobalPassword({ globalPassword, }) {
+        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
+            const doSyncPassword = async () => {
+                // update vault with latest globalPassword
+                const { encKey, pwEncKey, authKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
+                // update and encrypt the vault with new password
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                    password: globalPassword,
+                    rawToprfEncryptionKey: encKey,
+                    rawToprfPwEncryptionKey: pwEncKey,
+                    rawToprfAuthKeyPair: authKeyPair,
+                });
+                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_resetPasswordOutdatedCache).call(this);
+            };
+            return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_executeWithTokenRefresh).call(this, doSyncPassword, 'syncLatestGlobalPassword');
+        });
+    }
     /**
      * @description Unlock the controller with the latest global password.
      *
@@ -541,16 +556,16 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param params.globalPassword - The latest global password.
      * @returns A promise that resolves to the success of the operation.
      */
-    async submitGlobalPasswordAndSync({ globalPassword, maxKeyChainLength = 5, }) {
+    async submitGlobalPassword({ globalPassword, maxKeyChainLength = 5, }) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_executeWithTokenRefresh).call(this, async () => {
                 const currentDeviceAuthPubKey = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverAuthPubKey).call(this);
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_submitGlobalPasswordAndSync).call(this, {
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_submitGlobalPassword).call(this, {
                     targetAuthPubKey: currentDeviceAuthPubKey,
                     globalPassword,
                     maxKeyChainLength,
                 });
-            }, 'submitGlobalPasswordAndSync');
+            }, 'submitGlobalPassword');
         });
     }
     /**
@@ -724,7 +739,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     }
 }
 exports.SeedlessOnboardingController = SeedlessOnboardingController;
-_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPasswordAndSync = 
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
 /**
  * @description Submit the global password to the controller, verify the
  * password validity and unlock the controller.
@@ -737,52 +752,32 @@ _SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardin
  * @returns A promise that resolves to the keyring encryption key
  * corresponding to the current authPubKey in state.
  */
-async function _SeedlessOnboardingController_submitGlobalPasswordAndSync({ targetAuthPubKey, globalPassword, maxKeyChainLength, }) {
-    const { pwEncKey: latestPwEncKey, authKeyPair: latestAuthKeyPair, encKey: latestEncKey, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
+async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPubKey, globalPassword, maxKeyChainLength, }) {
+    const { pwEncKey: curPwEncKey, authKeyPair: curAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
     try {
-        // Recover current device's vault encryption key with the latest global password
-        const { pwEncKey: currentDevicePwEncKey } = await this.toprfClient.recoverPwEncKey({
+        // Recover vault encryption key.
+        const res = await this.toprfClient.recoverPwEncKey({
             targetAuthPubKey,
-            curPwEncKey: latestPwEncKey,
-            curAuthKeyPair: latestAuthKeyPair,
+            curPwEncKey,
+            curAuthKeyPair,
             maxPwChainLength: maxKeyChainLength,
         });
-        // recover the vault encryption key and keyring encryption key with the current device's pwEncKey
-        const [vaultKey, keyringEncryptionKey] = await Promise.all([
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, currentDevicePwEncKey),
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadKeyringEncryptionKey).call(this, currentDevicePwEncKey),
-        ]);
-        // Unlock the controller and vault
-        const { revokeToken } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
+        const { pwEncKey } = res;
+        const vaultKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, pwEncKey);
+        // Unlock the controller
+        const { revokeToken, toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-            password: globalPassword,
-            rawToprfEncryptionKey: latestEncKey,
-            rawToprfPwEncryptionKey: latestPwEncKey,
-            rawToprfAuthKeyPair: latestAuthKeyPair,
-        });
         if (revokeToken) {
-            // // revoke and recyle refresh token after unlock to keep refresh token fresh, avoid malicious use of leaked refresh token
-            // // this call is not critical for unlocking, so we can do it in the background without await.
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState).call(this, revokeToken)
-                .then(() => {
-                // re-creating vault to persist the new revoke token.
-                // TODO: Optimize this function such that updates to vault wont require re-creating the vault.
-                return __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-                    password: globalPassword,
-                    rawToprfEncryptionKey: latestEncKey,
-                    rawToprfPwEncryptionKey: latestPwEncKey,
-                    rawToprfAuthKeyPair: latestAuthKeyPair,
-                });
-            })
-                .catch((error) => {
-                log('Error revoking refresh token', error);
+            // revoke and recyle refresh token after unlock to keep refresh token fresh, avoid malicious use of leaked refresh token
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState).call(this, revokeToken);
+            // re-creating vault to persist the new revoke token
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                password: globalPassword,
+                rawToprfEncryptionKey: toprfEncryptionKey,
+                rawToprfPwEncryptionKey: toprfPwEncryptionKey,
+                rawToprfAuthKeyPair: toprfAuthKeyPair,
             });
         }
-        // restore the current keyring encryption key with the new global password
-        await this.storeKeyringEncryptionKey(keyringEncryptionKey);
-        // reset the password outdated cache after successful global password submission and state sync
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_resetPasswordOutdatedCache).call(this);
     }
     catch (error) {
         if (__classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_isTokenExpiredError).call(this, error)) {