@metamask-previews/seedless-onboarding-controller 3.0.0-preview-3f792d6 → 3.0.0-preview-6a91767a

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getInitialSeedlessOnboardingControllerStateWithDefaults = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -167,16 +167,16 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         _SeedlessOnboardingController_vaultOperationMutex.set(this, new async_mutex_1.Mutex());
         _SeedlessOnboardingController_refreshJWTToken.set(this, void 0);
         _SeedlessOnboardingController_revokeRefreshToken.set(this, void 0);
-        /**
-         * The TTL of the password outdated cache in milliseconds.
-         */
-        _SeedlessOnboardingController_passwordOutdatedCacheTTL.set(this, void 0);
         /**
          * Controller lock state.
          *
          * The controller lock is synchronized with the keyring lock.
          */
         _SeedlessOnboardingController_isUnlocked.set(this, false);
+        /**
+         * The TTL of the password outdated cache in milliseconds.
+         */
+        _SeedlessOnboardingController_passwordOutdatedCacheTTL.set(this, void 0);
         (0, assertions_1.assertIsPasswordOutdatedCacheValid)(passwordOutdatedCacheTTL);
         __classPrivateFieldSet(this, _SeedlessOnboardingController_passwordOutdatedCacheTTL, passwordOutdatedCacheTTL, "f");
         __classPrivateFieldSet(this, _SeedlessOnboardingController_vaultEncryptor, encryptor, "f");
@@ -506,7 +506,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      */
     async submitPassword(password) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, { password });
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password);
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
         });
     }
@@ -700,10 +700,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
             const { vaultEncryptionKey } = this.state;
-            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
-                password,
-                encryptionKey: vaultEncryptionKey,
-            });
+            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password, vaultEncryptionKey);
             if (!revokeToken) {
                 throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
             }
@@ -781,7 +778,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     }
 }
 exports.SeedlessOnboardingController = SeedlessOnboardingController;
-_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
 /**
  * @description Submit the global password to the controller, verify the
  * password validity and unlock the controller.
@@ -807,9 +804,7 @@ async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPu
         const { pwEncKey } = res;
         const vaultKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, pwEncKey);
         // Unlock the controller
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
-            encryptionKey: vaultKey,
-        });
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
     }
     catch (error) {
@@ -841,10 +836,8 @@ async function _SeedlessOnboardingController_getAccessToken(password) {
     if (!vault) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidAccessToken);
     }
-    const { vaultData } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, {
-        password,
-    });
-    return vaultData.accessToken;
+    const { parsedVaultData } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, password);
+    return parsedVaultData.accessToken;
 }, _SeedlessOnboardingController_setUnlocked = function _SeedlessOnboardingController_setUnlocked() {
     __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, true, "f");
 }, _SeedlessOnboardingController_persistOprfKey = 
@@ -1009,7 +1002,7 @@ async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword,
             toprfEncryptionKey: encKey,
             toprfPwEncryptionKey: pwEncKey,
             toprfAuthKeyPair: authKeyPair,
-        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, { password: oldPassword }));
+        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, oldPassword));
     }
     const result = await this.toprfClient.changeEncKey({
         nodeAuthTokens: this.state.nodeAuthTokens,
@@ -1078,9 +1071,8 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * Unlocks the encrypted vault using the provided password and returns the decrypted vault data.
  * This method ensures thread-safety by using a mutex lock when accessing the vault.
  *
- * @param params - The parameters for unlocking the vault.
- * @param params.password - The optional password to unlock the vault.
- * @param params.encryptionKey - The optional encryption key to unlock the vault.
+ * @param password - The optional password to unlock the vault.
+ * @param encryptionKey - The optional encryption key to unlock the vault.
  * @returns A promise that resolves to an object containing:
  * - toprfEncryptionKey: The decrypted TOPRF encryption key
  * - toprfAuthKeyPair: The decrypted TOPRF authentication key pair
@@ -1092,38 +1084,54 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * - The password is incorrect (from encryptor.decrypt)
  * - The decrypted vault data is malformed
  */
-async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(params) {
+async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(password, encryptionKey) {
     return __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
-        const { vaultData, vaultEncryptionKey, vaultEncryptionSalt } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, params);
+        const { parsedVaultData, vaultEncryptionKey, vaultEncryptionSalt } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, password, encryptionKey);
+        const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, accessToken, } = parsedVaultData;
         this.update((state) => {
             state.vaultEncryptionKey = vaultEncryptionKey;
             state.vaultEncryptionSalt = vaultEncryptionSalt;
-            state.revokeToken = vaultData.revokeToken;
-            state.accessToken = vaultData.accessToken;
+            state.revokeToken = revokeToken;
+            state.accessToken = accessToken;
         });
-        return (0, utils_3.deserializeVaultData)(vaultData);
+        return {
+            toprfEncryptionKey,
+            toprfPwEncryptionKey,
+            toprfAuthKeyPair,
+            revokeToken,
+            accessToken,
+        };
     });
 }, _SeedlessOnboardingController_decryptAndParseVaultData = 
 /**
  * Decrypts the vault data and parses it into a usable format.
  *
- * @param params - The parameters for decrypting the vault.
- * @param params.password - The optional password to decrypt the vault.
- * @param params.encryptionKey - The optional encryption key to decrypt the vault.
+ * @param password - The optional password to decrypt the vault.
+ * @param encryptionKey - The optional encryption key to decrypt the vault.
  * @returns A promise that resolves to an object containing:
  */
-async function _SeedlessOnboardingController_decryptAndParseVaultData(params) {
+async function _SeedlessOnboardingController_decryptAndParseVaultData(password, encryptionKey) {
     let { vaultEncryptionKey, vaultEncryptionSalt } = this.state;
     const { vault: encryptedVault } = this.state;
     if (!encryptedVault) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultError);
     }
-    if (params?.encryptionKey) {
-        vaultEncryptionKey = params.encryptionKey;
+    if (encryptionKey) {
+        vaultEncryptionKey = encryptionKey;
     }
     let decryptedVaultData;
-    // if the encryption key is available, we will use it to decrypt the vault
-    if (vaultEncryptionKey) {
+    if (password) {
+        assertIsValidPassword(password);
+        // Note that vault decryption using the password is a very costly operation as it involves deriving the encryption key
+        // from the password using an intentionally slow key derivation function.
+        // We should make sure that we only call it very intentionally.
+        const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(password, encryptedVault);
+        decryptedVaultData = result.vault;
+        vaultEncryptionKey = result.exportedKeyString;
+        vaultEncryptionSalt = result.salt;
+    }
+    else {
+        assertIsVaultEncryptionKeyDefined(vaultEncryptionKey);
         const parsedEncryptedVault = JSON.parse(encryptedVault);
         if (vaultEncryptionSalt &&
             vaultEncryptionSalt !== parsedEncryptedVault.salt) {
@@ -1132,20 +1140,9 @@ async function _SeedlessOnboardingController_decryptAndParseVaultData(params) {
         const key = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").importKey(vaultEncryptionKey);
         decryptedVaultData = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithKey(key, parsedEncryptedVault);
     }
-    else {
-        // if the encryption key is not available, we will use the password to decrypt the vault
-        assertIsValidPassword(params?.password);
-        // Note that vault decryption using the password is a very costly operation as it involves deriving the encryption key
-        // from the password using an intentionally slow key derivation function.
-        // We should make sure that we only call it very intentionally.
-        const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(params.password, encryptedVault);
-        decryptedVaultData = result.vault;
-        vaultEncryptionKey = result.exportedKeyString;
-        vaultEncryptionSalt = result.salt;
-    }
-    const vaultData = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
+    const parsedVaultData = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
     return {
-        vaultData,
+        parsedVaultData,
         vaultEncryptionKey,
         vaultEncryptionSalt,
     };
@@ -1221,10 +1218,11 @@ async function _SeedlessOnboardingController_createNewVaultWithAuthData({ passwo
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
     const { revokeToken } = this.state;
     const accessToken = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_getAccessToken).call(this, password);
-    const serializedVaultData = (0, utils_3.serializeVaultData)({
-        toprfAuthKeyPair: rawToprfAuthKeyPair,
-        toprfEncryptionKey: rawToprfEncryptionKey,
-        toprfPwEncryptionKey: rawToprfPwEncryptionKey,
+    const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_serializeKeyData).call(this, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair);
+    const serializedVaultData = JSON.stringify({
+        toprfEncryptionKey,
+        toprfPwEncryptionKey,
+        toprfAuthKeyPair,
         revokeToken,
         accessToken,
     });
@@ -1294,6 +1292,18 @@ async function _SeedlessOnboardingController_withControllerLock(callback) {
  */
 async function _SeedlessOnboardingController_withVaultLock(callback) {
     return await withLock(__classPrivateFieldGet(this, _SeedlessOnboardingController_vaultOperationMutex, "f"), callback);
+}, _SeedlessOnboardingController_serializeKeyData = function _SeedlessOnboardingController_serializeKeyData(encKey, pwEncKey, authKeyPair) {
+    const b64EncodedEncKey = (0, utils_1.bytesToBase64)(encKey);
+    const b64EncodedPwEncKey = (0, utils_1.bytesToBase64)(pwEncKey);
+    const b64EncodedAuthKeyPair = JSON.stringify({
+        sk: (0, utils_1.bigIntToHex)(authKeyPair.sk),
+        pk: (0, utils_1.bytesToBase64)(authKeyPair.pk),
+    });
+    return {
+        toprfEncryptionKey: b64EncodedEncKey,
+        toprfPwEncryptionKey: b64EncodedPwEncKey,
+        toprfAuthKeyPair: b64EncodedAuthKeyPair,
+    };
 }, _SeedlessOnboardingController_parseVaultData = function _SeedlessOnboardingController_parseVaultData(data) {
     if (typeof data !== 'string') {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidVaultData);
@@ -1306,7 +1316,20 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidVaultData);
     }
     (0, assertions_1.assertIsValidVaultData)(parsedVaultData);
-    return parsedVaultData;
+    const rawToprfEncryptionKey = (0, utils_1.base64ToBytes)(parsedVaultData.toprfEncryptionKey);
+    const rawToprfPwEncryptionKey = (0, utils_1.base64ToBytes)(parsedVaultData.toprfPwEncryptionKey);
+    const parsedToprfAuthKeyPair = JSON.parse(parsedVaultData.toprfAuthKeyPair);
+    const rawToprfAuthKeyPair = {
+        sk: BigInt(parsedToprfAuthKeyPair.sk),
+        pk: (0, utils_1.base64ToBytes)(parsedToprfAuthKeyPair.pk),
+    };
+    return {
+        toprfEncryptionKey: rawToprfEncryptionKey,
+        toprfPwEncryptionKey: rawToprfPwEncryptionKey,
+        toprfAuthKeyPair: rawToprfAuthKeyPair,
+        revokeToken: parsedVaultData.revokeToken,
+        accessToken: parsedVaultData.accessToken,
+    };
 }, _SeedlessOnboardingController_assertIsUnlocked = function _SeedlessOnboardingController_assertIsUnlocked() {
     if (!__classPrivateFieldGet(this, _SeedlessOnboardingController_isUnlocked, "f")) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.ControllerLocked);
@@ -1482,4 +1505,15 @@ function assertIsEncryptedSeedlessEncryptionKeySet(encryptedSeedlessEncryptionKe
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.EncryptedSeedlessEncryptionKeyNotSet);
     }
 }
+/**
+ * Assert that the provided vault encryption key is a valid non-empty string.
+ *
+ * @param vaultEncryptionKey - The vault encryption key to check.
+ * @throws If the vault encryption key is not a valid string.
+ */
+function assertIsVaultEncryptionKeyDefined(vaultEncryptionKey) {
+    if (!vaultEncryptionKey) {
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultEncryptionKeyUndefined);
+    }
+}
 //# sourceMappingURL=SeedlessOnboardingController.cjs.map