@metamask-previews/seedless-onboarding-controller 3.0.0-preview-331bec5d → 3.0.0-preview-f3f2e8c8

package/CHANGELOG.md

@@ -7,23 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Added
-
-- Added `renewRefreshToken` options in SeedlessOnboardingController constructor - A function to renew the refresh token and get new revoke token. ([#6275](https://github.com/MetaMask/core/pull/6275))
-- Added `renewRefreshToken` method to renew refresh token from client ([#6275](https://github.com/MetaMask/core/pull/6275))
-- Added `revokePendingRefreshTokens` method to revoke all pending old refresh tokens instead from client ([#6275](https://github.com/MetaMask/core/pull/6275))
-
-### Changed
-
-- **BREAKING:** Updated ControllerMessenger `AllowedEvents`. ([#6292](https://github.com/MetaMask/core/pull/6292))
-- Update `setLocked()` method with `mutex` and it becomes `async` method. ([#6292](https://github.com/MetaMask/core/pull/6292))
-- Bump `@metamask/base-controller` from `^8.1.0` to `^8.3.0` ([#6355](https://github.com/MetaMask/core/pull/6355), [#6465](https://github.com/MetaMask/core/pull/6465))
-
-### Removed
-
-- **BREAKING:** Removed `Keyring:lock` and `Keyring:unlock` events from the controller allowed events. ([#6292](https://github.com/MetaMask/core/pull/6292))
-- Removed `revokeRefreshToken` method ([#6275](https://github.com/MetaMask/core/pull/6275))
-
 ## [3.0.0]
 
 ### Changed

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_renewRefreshToken, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_cachedDecryptedVaultData, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_addRefreshTokenToRevokeList, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getInitialSeedlessOnboardingControllerStateWithDefaults = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -116,10 +116,6 @@ const seedlessOnboardingMetadata = {
         persist: false,
         anonymous: false,
     },
-    pendingToBeRevokedTokens: {
-        persist: true,
-        anonymous: false,
-    },
     // stays in vault
     accessToken: {
         persist: false,
@@ -156,10 +152,9 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param options.network - The network to be used for the Seedless Onboarding flow.
      * @param options.refreshJWTToken - A function to get a new jwt token using refresh token.
      * @param options.revokeRefreshToken - A function to revoke the refresh token.
-     * @param options.renewRefreshToken - A function to renew the refresh token and get new revoke token.
      * @param options.passwordOutdatedCacheTTL - The TTL of the password outdated cache in milliseconds.,
      */
-    constructor({ messenger, state, encryptor, toprfKeyDeriver, network = constants_1.Web3AuthNetwork.Mainnet, refreshJWTToken, revokeRefreshToken, renewRefreshToken, passwordOutdatedCacheTTL = constants_1.PASSWORD_OUTDATED_CACHE_TTL_MS, }) {
+    constructor({ messenger, state, encryptor, toprfKeyDeriver, network = constants_1.Web3AuthNetwork.Mainnet, refreshJWTToken, revokeRefreshToken, passwordOutdatedCacheTTL = constants_1.PASSWORD_OUTDATED_CACHE_TTL_MS, }) {
         super({
             name: constants_1.controllerName,
             metadata: seedlessOnboardingMetadata,
@@ -172,11 +167,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         _SeedlessOnboardingController_vaultOperationMutex.set(this, new async_mutex_1.Mutex());
         _SeedlessOnboardingController_refreshJWTToken.set(this, void 0);
         _SeedlessOnboardingController_revokeRefreshToken.set(this, void 0);
-        _SeedlessOnboardingController_renewRefreshToken.set(this, void 0);
-        /**
-         * The TTL of the password outdated cache in milliseconds.
-         */
-        _SeedlessOnboardingController_passwordOutdatedCacheTTL.set(this, void 0);
         /**
          * Controller lock state.
          *
@@ -184,11 +174,9 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
          */
         _SeedlessOnboardingController_isUnlocked.set(this, false);
         /**
-         * Cached decrypted vault data.
-         *
-         * This is used to cache the decrypted vault data to avoid decrypting the vault data multiple times.
+         * The TTL of the password outdated cache in milliseconds.
          */
-        _SeedlessOnboardingController_cachedDecryptedVaultData.set(this, void 0);
+        _SeedlessOnboardingController_passwordOutdatedCacheTTL.set(this, void 0);
         (0, assertions_1.assertIsPasswordOutdatedCacheValid)(passwordOutdatedCacheTTL);
         __classPrivateFieldSet(this, _SeedlessOnboardingController_passwordOutdatedCacheTTL, passwordOutdatedCacheTTL, "f");
         __classPrivateFieldSet(this, _SeedlessOnboardingController_vaultEncryptor, encryptor, "f");
@@ -199,7 +187,14 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         });
         __classPrivateFieldSet(this, _SeedlessOnboardingController_refreshJWTToken, refreshJWTToken, "f");
         __classPrivateFieldSet(this, _SeedlessOnboardingController_revokeRefreshToken, revokeRefreshToken, "f");
-        __classPrivateFieldSet(this, _SeedlessOnboardingController_renewRefreshToken, renewRefreshToken, "f");
+        // setup subscriptions to the keyring lock event
+        // when the keyring is locked (wallet is locked), the controller will be cleared of its credentials
+        this.messagingSystem.subscribe('KeyringController:lock', () => {
+            this.setLocked();
+        });
+        this.messagingSystem.subscribe('KeyringController:unlock', () => {
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
+        });
     }
     async fetchMetadataAccessCreds() {
         const { metadataAccessToken } = this.state;
@@ -511,7 +506,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      */
     async submitPassword(password) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, { password });
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password);
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
         });
     }
@@ -519,20 +514,15 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * Set the controller to locked state, and deallocate the secrets (vault encryption key and salt).
      *
      * When the controller is locked, the user will not be able to perform any operations on the controller/vault.
-     *
-     * @returns A promise that resolves to the success of the operation.
      */
-    async setLocked() {
-        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            this.update((state) => {
-                delete state.vaultEncryptionKey;
-                delete state.vaultEncryptionSalt;
-                delete state.revokeToken;
-                delete state.accessToken;
-            });
-            __classPrivateFieldSet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, undefined, "f");
-            __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, false, "f");
+    setLocked() {
+        this.update((state) => {
+            delete state.vaultEncryptionKey;
+            delete state.vaultEncryptionSalt;
+            delete state.revokeToken;
+            delete state.accessToken;
         });
+        __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, false, "f");
     }
     /**
      * Sync the latest global password to the controller.
@@ -699,25 +689,22 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         }
     }
     /**
-     * Renew the refresh token - get new refresh token and new revoke token
+     * Revoke the refresh token and get new refresh token and new revoke token
      * and also updates the vault with the new revoke token.
      * This method is to be called after user is authenticated.
      *
      * @param password - The password to encrypt the vault.
      * @returns A Promise that resolves to void.
      */
-    async renewRefreshToken(password) {
+    async revokeRefreshToken(password) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-            const { refreshToken, vaultEncryptionKey } = this.state;
-            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
-                password,
-                encryptionKey: vaultEncryptionKey,
-            });
+            const { vaultEncryptionKey } = this.state;
+            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password, vaultEncryptionKey);
             if (!revokeToken) {
                 throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
             }
-            const { newRevokeToken, newRefreshToken } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_renewRefreshToken, "f").call(this, {
+            const { newRevokeToken, newRefreshToken } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_revokeRefreshToken, "f").call(this, {
                 connection: this.state.authConnection,
                 revokeToken,
             });
@@ -728,11 +715,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                     // set new refresh token to persist in state
                     state.refreshToken = newRefreshToken;
                 });
-                // add the old refresh token to the list to be revoked later when possible
-                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_addRefreshTokenToRevokeList).call(this, {
-                    refreshToken,
-                    revokeToken,
-                });
                 await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
                     password,
                     rawToprfEncryptionKey,
@@ -742,49 +724,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             }
         });
     }
-    /**
-     * Revoke all pending refresh tokens.
-     *
-     * This method is to be called after user is authenticated.
-     *
-     * @returns A Promise that resolves to void.
-     */
-    async revokePendingRefreshTokens() {
-        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-            const { pendingToBeRevokedTokens } = this.state;
-            if (!pendingToBeRevokedTokens || pendingToBeRevokedTokens.length === 0) {
-                return;
-            }
-            // revoke all pending refresh tokens in parallel
-            const promises = pendingToBeRevokedTokens.map(({ revokeToken }) => {
-                const revokePromise = async () => {
-                    try {
-                        await __classPrivateFieldGet(this, _SeedlessOnboardingController_revokeRefreshToken, "f").call(this, {
-                            connection: this.state.authConnection,
-                            revokeToken,
-                        });
-                        return revokeToken;
-                    }
-                    catch (error) {
-                        log('Error revoking refresh token', error);
-                        return null;
-                    }
-                };
-                return revokePromise();
-            });
-            const result = await Promise.all(promises); // no need to do Promise.allSettled because the promise already handle try catch
-            // filter out the null values
-            const revokedTokens = result.filter((token) => token !== null);
-            if (revokedTokens.length > 0) {
-                // update the state to remove the revoked tokens once all concurrent token revoke finish
-                this.update((state) => {
-                    state.pendingToBeRevokedTokens =
-                        state.pendingToBeRevokedTokens?.filter((token) => !revokedTokens.includes(token.revokeToken));
-                });
-            }
-        });
-    }
     /**
      * Check if the current node auth token is expired.
      *
@@ -839,7 +778,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     }
 }
 exports.SeedlessOnboardingController = SeedlessOnboardingController;
-_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_renewRefreshToken = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_cachedDecryptedVaultData = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
 /**
  * @description Submit the global password to the controller, verify the
  * password validity and unlock the controller.
@@ -865,9 +804,7 @@ async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPu
         const { pwEncKey } = res;
         const vaultKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, pwEncKey);
         // Unlock the controller
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
-            encryptionKey: vaultKey,
-        });
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
     }
     catch (error) {
@@ -899,10 +836,8 @@ async function _SeedlessOnboardingController_getAccessToken(password) {
     if (!vault) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidAccessToken);
     }
-    const { vaultData } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, {
-        password,
-    });
-    return vaultData.accessToken;
+    const { parsedVaultData } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, password);
+    return parsedVaultData.accessToken;
 }, _SeedlessOnboardingController_setUnlocked = function _SeedlessOnboardingController_setUnlocked() {
     __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, true, "f");
 }, _SeedlessOnboardingController_persistOprfKey = 
@@ -1067,7 +1002,7 @@ async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword,
             toprfEncryptionKey: encKey,
             toprfPwEncryptionKey: pwEncKey,
             toprfAuthKeyPair: authKeyPair,
-        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, { password: oldPassword }));
+        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, oldPassword));
     }
     const result = await this.toprfClient.changeEncKey({
         nodeAuthTokens: this.state.nodeAuthTokens,
@@ -1136,9 +1071,8 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * Unlocks the encrypted vault using the provided password and returns the decrypted vault data.
  * This method ensures thread-safety by using a mutex lock when accessing the vault.
  *
- * @param params - The parameters for unlocking the vault.
- * @param params.password - The optional password to unlock the vault.
- * @param params.encryptionKey - The optional encryption key to unlock the vault.
+ * @param password - The optional password to unlock the vault.
+ * @param encryptionKey - The optional encryption key to unlock the vault.
  * @returns A promise that resolves to an object containing:
  * - toprfEncryptionKey: The decrypted TOPRF encryption key
  * - toprfAuthKeyPair: The decrypted TOPRF authentication key pair
@@ -1150,43 +1084,54 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * - The password is incorrect (from encryptor.decrypt)
  * - The decrypted vault data is malformed
  */
-async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(params) {
+async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(password, encryptionKey) {
     return __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
-        if (__classPrivateFieldGet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, "f")) {
-            return __classPrivateFieldGet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, "f");
-        }
-        const { vaultData, vaultEncryptionKey, vaultEncryptionSalt } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, params);
+        const { parsedVaultData, vaultEncryptionKey, vaultEncryptionSalt } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, password, encryptionKey);
+        const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, accessToken, } = parsedVaultData;
         this.update((state) => {
             state.vaultEncryptionKey = vaultEncryptionKey;
             state.vaultEncryptionSalt = vaultEncryptionSalt;
-            state.revokeToken = vaultData.revokeToken;
-            state.accessToken = vaultData.accessToken;
+            state.revokeToken = revokeToken;
+            state.accessToken = accessToken;
         });
-        const deserializedVaultData = (0, utils_3.deserializeVaultData)(vaultData);
-        __classPrivateFieldSet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, deserializedVaultData, "f");
-        return deserializedVaultData;
+        return {
+            toprfEncryptionKey,
+            toprfPwEncryptionKey,
+            toprfAuthKeyPair,
+            revokeToken,
+            accessToken,
+        };
     });
 }, _SeedlessOnboardingController_decryptAndParseVaultData = 
 /**
  * Decrypts the vault data and parses it into a usable format.
  *
- * @param params - The parameters for decrypting the vault.
- * @param params.password - The optional password to decrypt the vault.
- * @param params.encryptionKey - The optional encryption key to decrypt the vault.
+ * @param password - The optional password to decrypt the vault.
+ * @param encryptionKey - The optional encryption key to decrypt the vault.
  * @returns A promise that resolves to an object containing:
  */
-async function _SeedlessOnboardingController_decryptAndParseVaultData(params) {
+async function _SeedlessOnboardingController_decryptAndParseVaultData(password, encryptionKey) {
     let { vaultEncryptionKey, vaultEncryptionSalt } = this.state;
     const { vault: encryptedVault } = this.state;
     if (!encryptedVault) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultError);
     }
-    if (params?.encryptionKey) {
-        vaultEncryptionKey = params.encryptionKey;
+    if (encryptionKey) {
+        vaultEncryptionKey = encryptionKey;
     }
     let decryptedVaultData;
-    // if the encryption key is available, we will use it to decrypt the vault
-    if (vaultEncryptionKey) {
+    if (password) {
+        assertIsValidPassword(password);
+        // Note that vault decryption using the password is a very costly operation as it involves deriving the encryption key
+        // from the password using an intentionally slow key derivation function.
+        // We should make sure that we only call it very intentionally.
+        const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(password, encryptedVault);
+        decryptedVaultData = result.vault;
+        vaultEncryptionKey = result.exportedKeyString;
+        vaultEncryptionSalt = result.salt;
+    }
+    else {
+        assertIsVaultEncryptionKeyDefined(vaultEncryptionKey);
         const parsedEncryptedVault = JSON.parse(encryptedVault);
         if (vaultEncryptionSalt &&
             vaultEncryptionSalt !== parsedEncryptedVault.salt) {
@@ -1195,20 +1140,9 @@ async function _SeedlessOnboardingController_decryptAndParseVaultData(params) {
         const key = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").importKey(vaultEncryptionKey);
         decryptedVaultData = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithKey(key, parsedEncryptedVault);
     }
-    else {
-        // if the encryption key is not available, we will use the password to decrypt the vault
-        assertIsValidPassword(params?.password);
-        // Note that vault decryption using the password is a very costly operation as it involves deriving the encryption key
-        // from the password using an intentionally slow key derivation function.
-        // We should make sure that we only call it very intentionally.
-        const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(params.password, encryptedVault);
-        decryptedVaultData = result.vault;
-        vaultEncryptionKey = result.exportedKeyString;
-        vaultEncryptionSalt = result.salt;
-    }
-    const vaultData = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
+    const parsedVaultData = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
     return {
-        vaultData,
+        parsedVaultData,
         vaultEncryptionKey,
         vaultEncryptionSalt,
     };
@@ -1284,16 +1218,17 @@ async function _SeedlessOnboardingController_createNewVaultWithAuthData({ passwo
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
     const { revokeToken } = this.state;
     const accessToken = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_getAccessToken).call(this, password);
-    const vaultData = {
-        toprfAuthKeyPair: rawToprfAuthKeyPair,
-        toprfEncryptionKey: rawToprfEncryptionKey,
-        toprfPwEncryptionKey: rawToprfPwEncryptionKey,
+    const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_serializeKeyData).call(this, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair);
+    const serializedVaultData = JSON.stringify({
+        toprfEncryptionKey,
+        toprfPwEncryptionKey,
+        toprfAuthKeyPair,
         revokeToken,
         accessToken,
-    };
+    });
     await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
         password,
-        vaultData,
+        serializedVaultData,
         pwEncKey: rawToprfPwEncryptionKey,
     });
     // update the authPubKey in the state
@@ -1307,16 +1242,13 @@ async function _SeedlessOnboardingController_createNewVaultWithAuthData({ passwo
  *
  * @param params - The parameters for updating the vault.
  * @param params.password - The password to encrypt the vault.
- * @param params.vaultData - The raw vault data to update the vault with.
+ * @param params.serializedVaultData - The serialized authentication data to update the vault with.
  * @param params.pwEncKey - The global password encryption key.
  * @returns A promise that resolves to the updated vault.
  */
-async function _SeedlessOnboardingController_updateVault({ password, vaultData, pwEncKey, }) {
+async function _SeedlessOnboardingController_updateVault({ password, serializedVaultData, pwEncKey, }) {
     await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
         assertIsValidPassword(password);
-        // cache the vault data to avoid decrypting the vault data multiple times
-        __classPrivateFieldSet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, vaultData, "f");
-        const serializedVaultData = (0, utils_3.serializeVaultData)(vaultData);
         // Note that vault encryption using the password is a very costly operation as it involves deriving the encryption key
         // from the password using an intentionally slow key derivation function.
         // We should make sure that we only call it very intentionally.
@@ -1360,19 +1292,44 @@ async function _SeedlessOnboardingController_withControllerLock(callback) {
  */
 async function _SeedlessOnboardingController_withVaultLock(callback) {
     return await withLock(__classPrivateFieldGet(this, _SeedlessOnboardingController_vaultOperationMutex, "f"), callback);
+}, _SeedlessOnboardingController_serializeKeyData = function _SeedlessOnboardingController_serializeKeyData(encKey, pwEncKey, authKeyPair) {
+    const b64EncodedEncKey = (0, utils_1.bytesToBase64)(encKey);
+    const b64EncodedPwEncKey = (0, utils_1.bytesToBase64)(pwEncKey);
+    const b64EncodedAuthKeyPair = JSON.stringify({
+        sk: (0, utils_1.bigIntToHex)(authKeyPair.sk),
+        pk: (0, utils_1.bytesToBase64)(authKeyPair.pk),
+    });
+    return {
+        toprfEncryptionKey: b64EncodedEncKey,
+        toprfPwEncryptionKey: b64EncodedPwEncKey,
+        toprfAuthKeyPair: b64EncodedAuthKeyPair,
+    };
 }, _SeedlessOnboardingController_parseVaultData = function _SeedlessOnboardingController_parseVaultData(data) {
     if (typeof data !== 'string') {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultDataError);
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidVaultData);
     }
     let parsedVaultData;
     try {
         parsedVaultData = JSON.parse(data);
     }
     catch {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultDataError);
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidVaultData);
     }
     (0, assertions_1.assertIsValidVaultData)(parsedVaultData);
-    return parsedVaultData;
+    const rawToprfEncryptionKey = (0, utils_1.base64ToBytes)(parsedVaultData.toprfEncryptionKey);
+    const rawToprfPwEncryptionKey = (0, utils_1.base64ToBytes)(parsedVaultData.toprfPwEncryptionKey);
+    const parsedToprfAuthKeyPair = JSON.parse(parsedVaultData.toprfAuthKeyPair);
+    const rawToprfAuthKeyPair = {
+        sk: BigInt(parsedToprfAuthKeyPair.sk),
+        pk: (0, utils_1.base64ToBytes)(parsedToprfAuthKeyPair.pk),
+    };
+    return {
+        toprfEncryptionKey: rawToprfEncryptionKey,
+        toprfPwEncryptionKey: rawToprfPwEncryptionKey,
+        toprfAuthKeyPair: rawToprfAuthKeyPair,
+        revokeToken: parsedVaultData.revokeToken,
+        accessToken: parsedVaultData.accessToken,
+    };
 }, _SeedlessOnboardingController_assertIsUnlocked = function _SeedlessOnboardingController_assertIsUnlocked() {
     if (!__classPrivateFieldGet(this, _SeedlessOnboardingController_isUnlocked, "f")) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.ControllerLocked);
@@ -1402,8 +1359,10 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
  * @throws If the password is outdated.
  */
 async function _SeedlessOnboardingController_assertPasswordInSync(options) {
-    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
     const { nodeAuthTokens, authConnectionId, groupedAuthConnectionId, userId, } = this.state;
+    if (!nodeAuthTokens || !authConnectionId || !userId) {
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.MissingAuthUserInfo);
+    }
     const { authPubKey, keyIndex: latestKeyIndex } = await this.toprfClient
         .fetchAuthPubKey({
         nodeAuthTokens,
@@ -1427,13 +1386,6 @@ async function _SeedlessOnboardingController_assertPasswordInSync(options) {
     this.update((state) => {
         delete state.passwordOutdatedCache;
     });
-}, _SeedlessOnboardingController_addRefreshTokenToRevokeList = function _SeedlessOnboardingController_addRefreshTokenToRevokeList({ refreshToken, revokeToken, }) {
-    this.update((state) => {
-        state.pendingToBeRevokedTokens = [
-            ...(state.pendingToBeRevokedTokens || []),
-            { refreshToken, revokeToken },
-        ];
-    });
 }, _SeedlessOnboardingController_isTokenExpiredError = function _SeedlessOnboardingController_isTokenExpiredError(error) {
     if (error instanceof toprf_secure_backup_1.TOPRFError) {
         // eslint-disable-next-line @typescript-eslint/no-unsafe-enum-comparison
@@ -1553,4 +1505,15 @@ function assertIsEncryptedSeedlessEncryptionKeySet(encryptedSeedlessEncryptionKe
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.EncryptedSeedlessEncryptionKeyNotSet);
     }
 }
+/**
+ * Assert that the provided vault encryption key is a valid non-empty string.
+ *
+ * @param vaultEncryptionKey - The vault encryption key to check.
+ * @throws If the vault encryption key is not a valid string.
+ */
+function assertIsVaultEncryptionKeyDefined(vaultEncryptionKey) {
+    if (!vaultEncryptionKey) {
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultEncryptionKeyUndefined);
+    }
+}
 //# sourceMappingURL=SeedlessOnboardingController.cjs.map