@metamask-previews/seedless-onboarding-controller 3.0.0-preview-93dcb549 → 3.0.0-preview-c2598d9e

package/CHANGELOG.md

@@ -7,10 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Added `renewRefreshToken` options in SeedlessOnboardingController constructor - A function to renew the refresh token and get new revoke token. ([#6275](https://github.com/MetaMask/core/pull/6275))
+- Added `renewRefreshToken` method to renew refresh token from client ([#6275](https://github.com/MetaMask/core/pull/6275))
+- Added `revokePendingRefreshTokens` method to revoke all pending old refresh tokens instead from client ([#6275](https://github.com/MetaMask/core/pull/6275))
+
 ### Changed
 
 - Bump `@metamask/base-controller` from `^8.1.0` to `^8.2.0` ([#6355](https://github.com/MetaMask/core/pull/6355))
 
+### Removed
+
+- Removed `revokeRefreshToken` method ([#6275](https://github.com/MetaMask/core/pull/6275))
+
 ## [3.0.0]
 
 ### Changed

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_cachedDecryptedVaultData, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_renewRefreshToken, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_cachedDecryptedVaultData, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_addRefreshTokenToRevokeList, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getInitialSeedlessOnboardingControllerStateWithDefaults = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -116,6 +116,10 @@ const seedlessOnboardingMetadata = {
         persist: false,
         anonymous: false,
     },
+    pendingToBeRevokedTokens: {
+        persist: true,
+        anonymous: false,
+    },
     // stays in vault
     accessToken: {
         persist: false,
@@ -152,9 +156,10 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param options.network - The network to be used for the Seedless Onboarding flow.
      * @param options.refreshJWTToken - A function to get a new jwt token using refresh token.
      * @param options.revokeRefreshToken - A function to revoke the refresh token.
+     * @param options.renewRefreshToken - A function to renew the refresh token and get new revoke token.
      * @param options.passwordOutdatedCacheTTL - The TTL of the password outdated cache in milliseconds.,
      */
-    constructor({ messenger, state, encryptor, toprfKeyDeriver, network = constants_1.Web3AuthNetwork.Mainnet, refreshJWTToken, revokeRefreshToken, passwordOutdatedCacheTTL = constants_1.PASSWORD_OUTDATED_CACHE_TTL_MS, }) {
+    constructor({ messenger, state, encryptor, toprfKeyDeriver, network = constants_1.Web3AuthNetwork.Mainnet, refreshJWTToken, revokeRefreshToken, renewRefreshToken, passwordOutdatedCacheTTL = constants_1.PASSWORD_OUTDATED_CACHE_TTL_MS, }) {
         super({
             name: constants_1.controllerName,
             metadata: seedlessOnboardingMetadata,
@@ -167,6 +172,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         _SeedlessOnboardingController_vaultOperationMutex.set(this, new async_mutex_1.Mutex());
         _SeedlessOnboardingController_refreshJWTToken.set(this, void 0);
         _SeedlessOnboardingController_revokeRefreshToken.set(this, void 0);
+        _SeedlessOnboardingController_renewRefreshToken.set(this, void 0);
         /**
          * The TTL of the password outdated cache in milliseconds.
          */
@@ -193,6 +199,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         });
         __classPrivateFieldSet(this, _SeedlessOnboardingController_refreshJWTToken, refreshJWTToken, "f");
         __classPrivateFieldSet(this, _SeedlessOnboardingController_revokeRefreshToken, revokeRefreshToken, "f");
+        __classPrivateFieldSet(this, _SeedlessOnboardingController_renewRefreshToken, renewRefreshToken, "f");
         // setup subscriptions to the keyring lock event
         // when the keyring is locked (wallet is locked), the controller will be cleared of its credentials
         this.messagingSystem.subscribe('KeyringController:lock', () => {
@@ -696,17 +703,17 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         }
     }
     /**
-     * Revoke the refresh token and get new refresh token and new revoke token
+     * Renew the refresh token - get new refresh token and new revoke token
      * and also updates the vault with the new revoke token.
      * This method is to be called after user is authenticated.
      *
      * @param password - The password to encrypt the vault.
      * @returns A Promise that resolves to void.
      */
-    async revokeRefreshToken(password) {
+    async renewRefreshToken(password) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-            const { vaultEncryptionKey } = this.state;
+            const { refreshToken, vaultEncryptionKey } = this.state;
             const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
                 password,
                 encryptionKey: vaultEncryptionKey,
@@ -714,7 +721,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             if (!revokeToken) {
                 throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
             }
-            const { newRevokeToken, newRefreshToken } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_revokeRefreshToken, "f").call(this, {
+            const { newRevokeToken, newRefreshToken } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_renewRefreshToken, "f").call(this, {
                 connection: this.state.authConnection,
                 revokeToken,
             });
@@ -725,6 +732,11 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                     // set new refresh token to persist in state
                     state.refreshToken = newRefreshToken;
                 });
+                // add the old refresh token to the list to be revoked later when possible
+                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_addRefreshTokenToRevokeList).call(this, {
+                    refreshToken,
+                    revokeToken,
+                });
                 await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
                     password,
                     rawToprfEncryptionKey,
@@ -734,6 +746,49 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             }
         });
     }
+    /**
+     * Revoke all pending refresh tokens.
+     *
+     * This method is to be called after user is authenticated.
+     *
+     * @returns A Promise that resolves to void.
+     */
+    async revokePendingRefreshTokens() {
+        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+            const { pendingToBeRevokedTokens } = this.state;
+            if (!pendingToBeRevokedTokens || pendingToBeRevokedTokens.length === 0) {
+                return;
+            }
+            // revoke all pending refresh tokens in parallel
+            const promises = pendingToBeRevokedTokens.map(({ revokeToken }) => {
+                const revokePromise = async () => {
+                    try {
+                        await __classPrivateFieldGet(this, _SeedlessOnboardingController_revokeRefreshToken, "f").call(this, {
+                            connection: this.state.authConnection,
+                            revokeToken,
+                        });
+                        return revokeToken;
+                    }
+                    catch (error) {
+                        log('Error revoking refresh token', error);
+                        return null;
+                    }
+                };
+                return revokePromise();
+            });
+            const result = await Promise.all(promises); // no need to do Promise.allSettled because the promise already handle try catch
+            // filter out the null values
+            const revokedTokens = result.filter((token) => token !== null);
+            if (revokedTokens.length > 0) {
+                // update the state to remove the revoked tokens once all concurrent token revoke finish
+                this.update((state) => {
+                    state.pendingToBeRevokedTokens =
+                        state.pendingToBeRevokedTokens?.filter((token) => !revokedTokens.includes(token.revokeToken));
+                });
+            }
+        });
+    }
     /**
      * Check if the current node auth token is expired.
      *
@@ -788,7 +843,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     }
 }
 exports.SeedlessOnboardingController = SeedlessOnboardingController;
-_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_cachedDecryptedVaultData = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_renewRefreshToken = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_cachedDecryptedVaultData = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
 /**
  * @description Submit the global password to the controller, verify the
  * password validity and unlock the controller.
@@ -1378,6 +1433,13 @@ async function _SeedlessOnboardingController_assertPasswordInSync(options) {
     this.update((state) => {
         delete state.passwordOutdatedCache;
     });
+}, _SeedlessOnboardingController_addRefreshTokenToRevokeList = function _SeedlessOnboardingController_addRefreshTokenToRevokeList({ refreshToken, revokeToken, }) {
+    this.update((state) => {
+        state.pendingToBeRevokedTokens = [
+            ...(state.pendingToBeRevokedTokens || []),
+            { refreshToken, revokeToken },
+        ];
+    });
 }, _SeedlessOnboardingController_isTokenExpiredError = function _SeedlessOnboardingController_isTokenExpiredError(error) {
     if (error instanceof toprf_secure_backup_1.TOPRFError) {
         // eslint-disable-next-line @typescript-eslint/no-unsafe-enum-comparison