@metamask-previews/seedless-onboarding-controller 2.5.1-preview-8a39b4da → 2.5.1-preview-a6a20717

package/CHANGELOG.md

@@ -7,16 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Fixed
-
-- Apply controller level lock, mutex, on the `setLocked()` call. ([#6278](https://github.com/MetaMask/core/pull/6278))
+### Added
 
+- Added new persisted state value, `isSeedlessOnboardingUserAuthenticated`. ([#6288](https://github.com/MetaMask/core/pull/6288))
+  - This is for the UI state in the clients, to avoid querying sensistive controller state data to determine the social login authentication state.
 
 ### Changed
 
-- Refactor `setUnlocked` method from `createNewVaultWithAuthData` method. ([#6278](https://github.com/MetaMask/core/pull/6278))
 - Bump `@metamask/base-controller` from `^8.0.1` to `^8.1.0` ([#6284](https://github.com/MetaMask/core/pull/6284))
 
+### Fixed
+
+- Set `anonymous` to `false` for sensitive fields in the controller state. ([#6283](https://github.com/MetaMask/core/pull/6283))
+
 ## [2.5.1]
 
 ### Changed

package/dist/SeedlessOnboardingController.cjs

@@ -12,7 +12,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
 };
 var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SeedlessOnboardingController = exports.getDefaultSeedlessOnboardingControllerState = void 0;
+exports.SeedlessOnboardingController = exports.getInitialSeedlessOnboardingControllerStateWithDefaults = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
 const base_controller_1 = require("@metamask/base-controller");
 const toprf_secure_backup_1 = require("@metamask/toprf-secure-backup");
@@ -30,16 +30,28 @@ const SecretMetadata_1 = require("./SecretMetadata.cjs");
 const utils_3 = require("./utils.cjs");
 const log = (0, logger_1.createModuleLogger)(logger_1.projectLogger, constants_1.controllerName);
 /**
- * Get the default state for the Seedless Onboarding Controller.
+ * Get the initial state for the Seedless Onboarding Controller with defaults.
  *
- * @returns The default state for the Seedless Onboarding Controller.
+ * @param overrides - The overrides for the initial state.
+ * @returns The initial state for the Seedless Onboarding Controller.
  */
-function getDefaultSeedlessOnboardingControllerState() {
-    return {
+function getInitialSeedlessOnboardingControllerStateWithDefaults(overrides) {
+    const initialState = {
         socialBackupsMetadata: [],
+        isSeedlessOnboardingUserAuthenticated: false,
+        ...overrides,
     };
+    // Ensure authenticated flag is set correctly.
+    try {
+        (0, assertions_1.assertIsSeedlessOnboardingUserAuthenticated)(initialState);
+        initialState.isSeedlessOnboardingUserAuthenticated = true;
+    }
+    catch {
+        initialState.isSeedlessOnboardingUserAuthenticated = false;
+    }
+    return initialState;
 }
-exports.getDefaultSeedlessOnboardingControllerState = getDefaultSeedlessOnboardingControllerState;
+exports.getInitialSeedlessOnboardingControllerStateWithDefaults = getInitialSeedlessOnboardingControllerStateWithDefaults;
 /**
  * Seedless Onboarding Controller State Metadata.
  *
@@ -54,11 +66,11 @@ const seedlessOnboardingMetadata = {
     },
     socialBackupsMetadata: {
         persist: true,
-        anonymous: true,
+        anonymous: false,
     },
     nodeAuthTokens: {
         persist: true,
-        anonymous: true,
+        anonymous: false,
     },
     authConnection: {
         persist: true,
@@ -74,23 +86,23 @@ const seedlessOnboardingMetadata = {
     },
     userId: {
         persist: true,
-        anonymous: true,
+        anonymous: false,
     },
     socialLoginEmail: {
         persist: true,
-        anonymous: true,
+        anonymous: false,
     },
     vaultEncryptionKey: {
         persist: false,
-        anonymous: true,
+        anonymous: false,
     },
     vaultEncryptionSalt: {
         persist: false,
-        anonymous: true,
+        anonymous: false,
     },
     authPubKey: {
         persist: true,
-        anonymous: true,
+        anonymous: false,
     },
     passwordOutdatedCache: {
         persist: true,
@@ -98,28 +110,32 @@ const seedlessOnboardingMetadata = {
     },
     refreshToken: {
         persist: true,
-        anonymous: true,
+        anonymous: false,
     },
     revokeToken: {
         persist: false,
-        anonymous: true,
+        anonymous: false,
     },
     // stays in vault
     accessToken: {
         persist: false,
-        anonymous: true,
+        anonymous: false,
     },
     // stays outside of vault as this token is accessed by the metadata service
     // before the vault is created or unlocked.
     metadataAccessToken: {
         persist: true,
-        anonymous: true,
+        anonymous: false,
     },
     encryptedSeedlessEncryptionKey: {
         persist: true,
-        anonymous: true,
+        anonymous: false,
     },
     encryptedKeyringEncryptionKey: {
+        persist: true,
+        anonymous: false,
+    },
+    isSeedlessOnboardingUserAuthenticated: {
         persist: true,
         anonymous: true,
     },
@@ -142,10 +158,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         super({
             name: constants_1.controllerName,
             metadata: seedlessOnboardingMetadata,
-            state: {
-                ...getDefaultSeedlessOnboardingControllerState(),
-                ...state,
-            },
+            state: getInitialSeedlessOnboardingControllerStateWithDefaults(state),
             messenger,
         });
         _SeedlessOnboardingController_instances.add(this);
@@ -176,8 +189,8 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         __classPrivateFieldSet(this, _SeedlessOnboardingController_revokeRefreshToken, revokeRefreshToken, "f");
         // setup subscriptions to the keyring lock event
         // when the keyring is locked (wallet is locked), the controller will be cleared of its credentials
-        this.messagingSystem.subscribe('KeyringController:lock', async () => {
-            await this.setLocked();
+        this.messagingSystem.subscribe('KeyringController:lock', () => {
+            this.setLocked();
         });
         this.messagingSystem.subscribe('KeyringController:unlock', () => {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
@@ -237,6 +250,8 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                     state.userId = userId;
                     state.authConnection = authConnection;
                     state.socialLoginEmail = socialLoginEmail;
+                    state.metadataAccessToken = metadataAccessToken;
+                    state.accessToken = accessToken;
                     if (refreshToken) {
                         state.refreshToken = refreshToken;
                     }
@@ -244,12 +259,10 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                         // Temporarily store revoke token in state for later vault creation
                         state.revokeToken = revokeToken;
                     }
-                    if (accessToken) {
-                        state.accessToken = accessToken;
-                    }
-                    if (metadataAccessToken) {
-                        state.metadataAccessToken = metadataAccessToken;
-                    }
+                    // we will check if the controller state is properly set with the authenticated user info
+                    // before setting the isSeedlessOnboardingUserAuthenticated to true
+                    (0, assertions_1.assertIsSeedlessOnboardingUserAuthenticated)(state);
+                    state.isSeedlessOnboardingUserAuthenticated = true;
                 });
                 return authenticationResult;
             }
@@ -302,7 +315,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                     rawToprfPwEncryptionKey: pwEncKey,
                     rawToprfAuthKeyPair: authKeyPair,
                 });
-                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
             };
             await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_executeWithTokenRefresh).call(this, performKeyCreationAndBackup, 'createToprfKeyAndBackupSeedPhrase');
         });
@@ -377,7 +389,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                         rawToprfPwEncryptionKey: pwEncKey,
                         rawToprfAuthKeyPair: authKeyPair,
                     });
-                    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
                 }
                 return secrets;
             };
@@ -504,16 +515,14 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      *
      * When the controller is locked, the user will not be able to perform any operations on the controller/vault.
      */
-    async setLocked() {
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            this.update((state) => {
-                delete state.vaultEncryptionKey;
-                delete state.vaultEncryptionSalt;
-                delete state.revokeToken;
-                delete state.accessToken;
-            });
-            __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, false, "f");
+    setLocked() {
+        this.update((state) => {
+            delete state.vaultEncryptionKey;
+            delete state.vaultEncryptionSalt;
+            delete state.revokeToken;
+            delete state.accessToken;
         });
+        __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, false, "f");
     }
     /**
      * Sync the latest global password to the controller.
@@ -538,7 +547,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                     rawToprfAuthKeyPair: authKeyPair,
                 });
                 __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_resetPasswordOutdatedCache).call(this);
-                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
             };
             return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_executeWithTokenRefresh).call(this, doSyncPassword, 'syncLatestGlobalPassword');
         });
@@ -621,7 +629,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * Clears the current state of the SeedlessOnboardingController.
      */
     clearState() {
-        const defaultState = getDefaultSeedlessOnboardingControllerState();
+        const defaultState = getInitialSeedlessOnboardingControllerStateWithDefaults();
         this.update(() => {
             return defaultState;
         });
@@ -1227,6 +1235,7 @@ async function _SeedlessOnboardingController_createNewVaultWithAuthData({ passwo
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
         authPubKey: rawToprfAuthKeyPair.pk,
     });
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
 }, _SeedlessOnboardingController_updateVault = 
 /**
  * Encrypt and update the vault with the given authentication data.
@@ -1326,27 +1335,14 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.ControllerLocked);
     }
 }, _SeedlessOnboardingController_assertIsAuthenticatedUser = function _SeedlessOnboardingController_assertIsAuthenticatedUser(value) {
-    if (!value ||
-        typeof value !== 'object' ||
-        !('authConnectionId' in value) ||
-        typeof value.authConnectionId !== 'string' ||
-        !('userId' in value) ||
-        typeof value.userId !== 'string') {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.MissingAuthUserInfo);
-    }
-    if (!('nodeAuthTokens' in value) ||
-        typeof value.nodeAuthTokens !== 'object' ||
-        !Array.isArray(value.nodeAuthTokens) ||
-        value.nodeAuthTokens.length < 3 // At least 3 auth tokens are required for Threshold OPRF service
-    ) {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InsufficientAuthToken);
-    }
-    if (!('refreshToken' in value) || typeof value.refreshToken !== 'string') {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRefreshToken);
+    try {
+        (0, assertions_1.assertIsSeedlessOnboardingUserAuthenticated)(value);
     }
-    if (!('metadataAccessToken' in value) ||
-        typeof value.metadataAccessToken !== 'string') {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidMetadataAccessToken);
+    catch (error) {
+        this.update((state) => {
+            state.isSeedlessOnboardingUserAuthenticated = false;
+        });
+        throw error;
     }
 }, _SeedlessOnboardingController_assertIsSRPBackedUpUser = function _SeedlessOnboardingController_assertIsSRPBackedUpUser(value) {
     if (!this.state.authPubKey) {