@metamask-previews/seedless-onboarding-controller 3.0.0-preview-e53ed971 → 3.0.0-preview-3f792d6

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getInitialSeedlessOnboardingControllerStateWithDefaults = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -167,16 +167,16 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         _SeedlessOnboardingController_vaultOperationMutex.set(this, new async_mutex_1.Mutex());
         _SeedlessOnboardingController_refreshJWTToken.set(this, void 0);
         _SeedlessOnboardingController_revokeRefreshToken.set(this, void 0);
+        /**
+         * The TTL of the password outdated cache in milliseconds.
+         */
+        _SeedlessOnboardingController_passwordOutdatedCacheTTL.set(this, void 0);
         /**
          * Controller lock state.
          *
          * The controller lock is synchronized with the keyring lock.
          */
         _SeedlessOnboardingController_isUnlocked.set(this, false);
-        /**
-         * The TTL of the password outdated cache in milliseconds.
-         */
-        _SeedlessOnboardingController_passwordOutdatedCacheTTL.set(this, void 0);
         (0, assertions_1.assertIsPasswordOutdatedCacheValid)(passwordOutdatedCacheTTL);
         __classPrivateFieldSet(this, _SeedlessOnboardingController_passwordOutdatedCacheTTL, passwordOutdatedCacheTTL, "f");
         __classPrivateFieldSet(this, _SeedlessOnboardingController_vaultEncryptor, encryptor, "f");
@@ -506,7 +506,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      */
     async submitPassword(password) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password);
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, { password });
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
         });
     }
@@ -700,7 +700,10 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
             const { vaultEncryptionKey } = this.state;
-            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password, vaultEncryptionKey);
+            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
+                password,
+                encryptionKey: vaultEncryptionKey,
+            });
             if (!revokeToken) {
                 throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
             }
@@ -778,7 +781,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     }
 }
 exports.SeedlessOnboardingController = SeedlessOnboardingController;
-_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
 /**
  * @description Submit the global password to the controller, verify the
  * password validity and unlock the controller.
@@ -804,7 +807,9 @@ async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPu
         const { pwEncKey } = res;
         const vaultKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, pwEncKey);
         // Unlock the controller
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
+            encryptionKey: vaultKey,
+        });
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
     }
     catch (error) {
@@ -836,8 +841,10 @@ async function _SeedlessOnboardingController_getAccessToken(password) {
     if (!vault) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidAccessToken);
     }
-    const { parsedVaultData } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, password);
-    return parsedVaultData.accessToken;
+    const { vaultData } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, {
+        password,
+    });
+    return vaultData.accessToken;
 }, _SeedlessOnboardingController_setUnlocked = function _SeedlessOnboardingController_setUnlocked() {
     __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, true, "f");
 }, _SeedlessOnboardingController_persistOprfKey = 
@@ -1002,7 +1009,7 @@ async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword,
             toprfEncryptionKey: encKey,
             toprfPwEncryptionKey: pwEncKey,
             toprfAuthKeyPair: authKeyPair,
-        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, oldPassword));
+        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, { password: oldPassword }));
     }
     const result = await this.toprfClient.changeEncKey({
         nodeAuthTokens: this.state.nodeAuthTokens,
@@ -1071,8 +1078,9 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * Unlocks the encrypted vault using the provided password and returns the decrypted vault data.
  * This method ensures thread-safety by using a mutex lock when accessing the vault.
  *
- * @param password - The optional password to unlock the vault.
- * @param encryptionKey - The optional encryption key to unlock the vault.
+ * @param params - The parameters for unlocking the vault.
+ * @param params.password - The optional password to unlock the vault.
+ * @param params.encryptionKey - The optional encryption key to unlock the vault.
  * @returns A promise that resolves to an object containing:
  * - toprfEncryptionKey: The decrypted TOPRF encryption key
  * - toprfAuthKeyPair: The decrypted TOPRF authentication key pair
@@ -1084,54 +1092,38 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * - The password is incorrect (from encryptor.decrypt)
  * - The decrypted vault data is malformed
  */
-async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(password, encryptionKey) {
+async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(params) {
     return __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
-        const { parsedVaultData, vaultEncryptionKey, vaultEncryptionSalt } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, password, encryptionKey);
-        const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, accessToken, } = parsedVaultData;
+        const { vaultData, vaultEncryptionKey, vaultEncryptionSalt } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, params);
         this.update((state) => {
             state.vaultEncryptionKey = vaultEncryptionKey;
             state.vaultEncryptionSalt = vaultEncryptionSalt;
-            state.revokeToken = revokeToken;
-            state.accessToken = accessToken;
+            state.revokeToken = vaultData.revokeToken;
+            state.accessToken = vaultData.accessToken;
         });
-        return {
-            toprfEncryptionKey,
-            toprfPwEncryptionKey,
-            toprfAuthKeyPair,
-            revokeToken,
-            accessToken,
-        };
+        return (0, utils_3.deserializeVaultData)(vaultData);
     });
 }, _SeedlessOnboardingController_decryptAndParseVaultData = 
 /**
  * Decrypts the vault data and parses it into a usable format.
  *
- * @param password - The optional password to decrypt the vault.
- * @param encryptionKey - The optional encryption key to decrypt the vault.
+ * @param params - The parameters for decrypting the vault.
+ * @param params.password - The optional password to decrypt the vault.
+ * @param params.encryptionKey - The optional encryption key to decrypt the vault.
  * @returns A promise that resolves to an object containing:
  */
-async function _SeedlessOnboardingController_decryptAndParseVaultData(password, encryptionKey) {
+async function _SeedlessOnboardingController_decryptAndParseVaultData(params) {
     let { vaultEncryptionKey, vaultEncryptionSalt } = this.state;
     const { vault: encryptedVault } = this.state;
     if (!encryptedVault) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultError);
     }
-    if (encryptionKey) {
-        vaultEncryptionKey = encryptionKey;
+    if (params?.encryptionKey) {
+        vaultEncryptionKey = params.encryptionKey;
     }
     let decryptedVaultData;
-    if (password) {
-        assertIsValidPassword(password);
-        // Note that vault decryption using the password is a very costly operation as it involves deriving the encryption key
-        // from the password using an intentionally slow key derivation function.
-        // We should make sure that we only call it very intentionally.
-        const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(password, encryptedVault);
-        decryptedVaultData = result.vault;
-        vaultEncryptionKey = result.exportedKeyString;
-        vaultEncryptionSalt = result.salt;
-    }
-    else {
-        assertIsVaultEncryptionKeyDefined(vaultEncryptionKey);
+    // if the encryption key is available, we will use it to decrypt the vault
+    if (vaultEncryptionKey) {
         const parsedEncryptedVault = JSON.parse(encryptedVault);
         if (vaultEncryptionSalt &&
             vaultEncryptionSalt !== parsedEncryptedVault.salt) {
@@ -1140,9 +1132,20 @@ async function _SeedlessOnboardingController_decryptAndParseVaultData(password,
         const key = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").importKey(vaultEncryptionKey);
         decryptedVaultData = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithKey(key, parsedEncryptedVault);
     }
-    const parsedVaultData = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
+    else {
+        // if the encryption key is not available, we will use the password to decrypt the vault
+        assertIsValidPassword(params?.password);
+        // Note that vault decryption using the password is a very costly operation as it involves deriving the encryption key
+        // from the password using an intentionally slow key derivation function.
+        // We should make sure that we only call it very intentionally.
+        const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(params.password, encryptedVault);
+        decryptedVaultData = result.vault;
+        vaultEncryptionKey = result.exportedKeyString;
+        vaultEncryptionSalt = result.salt;
+    }
+    const vaultData = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
     return {
-        parsedVaultData,
+        vaultData,
         vaultEncryptionKey,
         vaultEncryptionSalt,
     };
@@ -1218,11 +1221,10 @@ async function _SeedlessOnboardingController_createNewVaultWithAuthData({ passwo
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
     const { revokeToken } = this.state;
     const accessToken = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_getAccessToken).call(this, password);
-    const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_serializeKeyData).call(this, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair);
-    const serializedVaultData = JSON.stringify({
-        toprfEncryptionKey,
-        toprfPwEncryptionKey,
-        toprfAuthKeyPair,
+    const serializedVaultData = (0, utils_3.serializeVaultData)({
+        toprfAuthKeyPair: rawToprfAuthKeyPair,
+        toprfEncryptionKey: rawToprfEncryptionKey,
+        toprfPwEncryptionKey: rawToprfPwEncryptionKey,
         revokeToken,
         accessToken,
     });
@@ -1292,18 +1294,6 @@ async function _SeedlessOnboardingController_withControllerLock(callback) {
  */
 async function _SeedlessOnboardingController_withVaultLock(callback) {
     return await withLock(__classPrivateFieldGet(this, _SeedlessOnboardingController_vaultOperationMutex, "f"), callback);
-}, _SeedlessOnboardingController_serializeKeyData = function _SeedlessOnboardingController_serializeKeyData(encKey, pwEncKey, authKeyPair) {
-    const b64EncodedEncKey = (0, utils_1.bytesToBase64)(encKey);
-    const b64EncodedPwEncKey = (0, utils_1.bytesToBase64)(pwEncKey);
-    const b64EncodedAuthKeyPair = JSON.stringify({
-        sk: (0, utils_1.bigIntToHex)(authKeyPair.sk),
-        pk: (0, utils_1.bytesToBase64)(authKeyPair.pk),
-    });
-    return {
-        toprfEncryptionKey: b64EncodedEncKey,
-        toprfPwEncryptionKey: b64EncodedPwEncKey,
-        toprfAuthKeyPair: b64EncodedAuthKeyPair,
-    };
 }, _SeedlessOnboardingController_parseVaultData = function _SeedlessOnboardingController_parseVaultData(data) {
     if (typeof data !== 'string') {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidVaultData);
@@ -1316,20 +1306,7 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidVaultData);
     }
     (0, assertions_1.assertIsValidVaultData)(parsedVaultData);
-    const rawToprfEncryptionKey = (0, utils_1.base64ToBytes)(parsedVaultData.toprfEncryptionKey);
-    const rawToprfPwEncryptionKey = (0, utils_1.base64ToBytes)(parsedVaultData.toprfPwEncryptionKey);
-    const parsedToprfAuthKeyPair = JSON.parse(parsedVaultData.toprfAuthKeyPair);
-    const rawToprfAuthKeyPair = {
-        sk: BigInt(parsedToprfAuthKeyPair.sk),
-        pk: (0, utils_1.base64ToBytes)(parsedToprfAuthKeyPair.pk),
-    };
-    return {
-        toprfEncryptionKey: rawToprfEncryptionKey,
-        toprfPwEncryptionKey: rawToprfPwEncryptionKey,
-        toprfAuthKeyPair: rawToprfAuthKeyPair,
-        revokeToken: parsedVaultData.revokeToken,
-        accessToken: parsedVaultData.accessToken,
-    };
+    return parsedVaultData;
 }, _SeedlessOnboardingController_assertIsUnlocked = function _SeedlessOnboardingController_assertIsUnlocked() {
     if (!__classPrivateFieldGet(this, _SeedlessOnboardingController_isUnlocked, "f")) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.ControllerLocked);
@@ -1505,15 +1482,4 @@ function assertIsEncryptedSeedlessEncryptionKeySet(encryptedSeedlessEncryptionKe
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.EncryptedSeedlessEncryptionKeyNotSet);
     }
 }
-/**
- * Assert that the provided vault encryption key is a valid non-empty string.
- *
- * @param vaultEncryptionKey - The vault encryption key to check.
- * @throws If the vault encryption key is not a valid string.
- */
-function assertIsVaultEncryptionKeyDefined(vaultEncryptionKey) {
-    if (!vaultEncryptionKey) {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultEncryptionKeyUndefined);
-    }
-}
 //# sourceMappingURL=SeedlessOnboardingController.cjs.map