@metamask-previews/seedless-onboarding-controller 6.0.0-preview-950f30f7 → 6.0.0-preview-fe9b7e4c

package/CHANGELOG.md

@@ -9,12 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Revert `revokeToken` value as optional in `authenticate` method. ([#7012](https://github.com/MetaMask/core/pull/7012))
-- Renamed, `checkIsSeedlessOnboardingUserAuthenticated` to `getIsUserAuthenticated` and added an optional parameter to skip the vault creation check. ([#7012](https://github.com/MetaMask/core/pull/7012))
-
-### Fixed
-
-- Fixed `InvalidRevokeToken` issue in `refreshAuthTokens` method. ([#7012](https://github.com/MetaMask/core/pull/7012))
+- `SeedlessOnboardingController` now accepts an optional `SupportedKeyDerivationOptions` type parameter ([#5963](https://github.com/MetaMask/core/pull/5963))
+  - The type parameter can be used to specify which key derivation algorithms are supported by the controller instance.
 
 ## [6.0.0]
 
@@ -117,7 +113,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - Added an optional parameter, `passwordOutdatedCacheTTL` to the constructor params and exported `SecretMetadata` class from the controller.([#6169](https://github.com/MetaMask/core/pull/6169))
-
 - Added `revokeRefreshToken` function to revoke refresh token and update vault with the new revoke token.([#6187](https://github.com/MetaMask/core/pull/6187))
 
 ## [2.4.0]

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_renewRefreshToken, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_cachedDecryptedVaultData, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_getAccessTokenAndRevokeToken, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_addRefreshTokenToRevokeList, _SeedlessOnboardingController_isAuthTokenError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_renewRefreshToken, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_cachedDecryptedVaultData, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_addRefreshTokenToRevokeList, _SeedlessOnboardingController_isAuthTokenError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getInitialSeedlessOnboardingControllerStateWithDefaults = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -298,10 +298,8 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                     state.socialLoginEmail = socialLoginEmail;
                     state.metadataAccessToken = metadataAccessToken;
                     state.refreshToken = refreshToken;
-                    if (revokeToken) {
-                        // Temporarily store revoke token & access token in state for later vault creation
-                        state.revokeToken = revokeToken;
-                    }
+                    // Temporarily store revoke token & access token in state for later vault creation
+                    state.revokeToken = revokeToken;
                     state.accessToken = accessToken;
                     // we will check if the controller state is properly set with the authenticated user info
                     // before setting the isSeedlessOnboardingUserAuthenticated to true
@@ -643,7 +641,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                     return passwordOutdatedCache.isExpiredPwd;
                 }
             }
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+            (0, assertions_1.assertIsAuthUserInfoValid)(this.state);
             const { nodeAuthTokens, authConnectionId, groupedAuthConnectionId, userId, } = this.state;
             const currentDeviceAuthPubKey = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverAuthPubKey).call(this);
             let globalAuthPubKey = options?.globalAuthPubKey;
@@ -676,19 +674,13 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     /**
      * Check if the user is authenticated with the seedless onboarding flow by checking the token values in the state.
      *
-     * @param skipVaultCreationCheck - An optional flag to skip the vault creation check.
-     * If false, the method will check all the required state values which are necessary for vault creation.
-     * If true, the method will only check the persisted authentication state values which are accessible regardless of the vault lock status.
      * @returns True if the user is authenticated, false otherwise.
      */
-    async getIsUserAuthenticated(skipVaultCreationCheck = false) {
+    async checkIsSeedlessOnboardingUserAuthenticated() {
         let isAuthenticated = false;
         try {
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-            console.log('skipVaultCreationCheck', skipVaultCreationCheck);
-            isAuthenticated =
-                skipVaultCreationCheck || // if the `vaultCreationCheck` is skipped, we won't check the `accessToken` and `revokeToken`
-                    (Boolean(this.state.accessToken) && Boolean(this.state.revokeToken));
+            (0, assertions_1.assertIsSeedlessOnboardingUserAuthenticated)(this.state);
+            isAuthenticated = true;
         }
         catch {
             isAuthenticated = false;
@@ -737,7 +729,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      */
     async refreshAuthTokens() {
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-        const { refreshToken } = this.state;
+        const { refreshToken, revokeToken } = this.state;
         const res = await __classPrivateFieldGet(this, _SeedlessOnboardingController_refreshJWTToken, "f").call(this, {
             connection: this.state.authConnection,
             refreshToken,
@@ -748,7 +740,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         try {
             const { idTokens, accessToken, metadataAccessToken } = res;
             // re-authenticate with the new id tokens to set new node auth tokens
-            // NOTE: here we can't provide the `revokeToken` value to the `authenticate` method because `refreshAuthTokens` method can be called when the wallet (vault) is locked
             await this.authenticate({
                 idTokens,
                 accessToken,
@@ -758,6 +749,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 groupedAuthConnectionId: this.state.groupedAuthConnectionId,
                 userId: this.state.userId,
                 refreshToken,
+                revokeToken,
                 skipLock: true,
             });
         }
@@ -782,6 +774,9 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 password,
                 encryptionKey: vaultEncryptionKey,
             });
+            if (!revokeToken) {
+                throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
+            }
             const { newRevokeToken, newRefreshToken } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_renewRefreshToken, "f").call(this, {
                 connection: this.state.authConnection,
                 revokeToken,
@@ -892,9 +887,6 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         try {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
             const { accessToken } = this.state;
-            if (!accessToken) {
-                return true; // Consider missing token as expired
-            }
             const decodedToken = (0, utils_3.decodeJWTToken)(accessToken);
             return decodedToken.exp < Math.floor(Date.now() / 1000);
         }
@@ -1020,10 +1012,8 @@ async function _SeedlessOnboardingController_loadSeedlessEncryptionKey(encKey) {
     const seedlessEncryptionKey = aes.decrypt(encryptedKeyBytes);
     return (0, utils_2.bytesToUtf8)(seedlessEncryptionKey);
 }, _SeedlessOnboardingController_recoverAuthPubKey = function _SeedlessOnboardingController_recoverAuthPubKey() {
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsSRPBackedUpUser).call(this, this.state);
     const { authPubKey } = this.state;
-    if (!authPubKey) {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.SRPNotBackedUpError);
-    }
     return (0, utils_1.base64ToBytes)(authPubKey);
 }, _SeedlessOnboardingController_recoverEncKey = 
 /**
@@ -1034,7 +1024,7 @@ async function _SeedlessOnboardingController_loadSeedlessEncryptionKey(encKey) {
  * @throws RecoveryError - If failed to recover the encryption key.
  */
 async function _SeedlessOnboardingController_recoverEncKey(password) {
-    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+    (0, assertions_1.assertIsAuthUserInfoValid)(this.state);
     const { nodeAuthTokens, authConnectionId, groupedAuthConnectionId, userId, } = this.state;
     try {
         const recoverEncKeyResult = await this.toprfClient.recoverEncKey({
@@ -1325,7 +1315,7 @@ async function _SeedlessOnboardingController_withPersistedSecretMetadataBackupsS
  */
 async function _SeedlessOnboardingController_createNewVaultWithAuthData({ password, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair, }) {
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-    const { accessToken, revokeToken } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_getAccessTokenAndRevokeToken).call(this, password);
+    const { revokeToken, accessToken } = this.state;
     const vaultData = {
         toprfAuthKeyPair: rawToprfAuthKeyPair,
         toprfEncryptionKey: rawToprfEncryptionKey,
@@ -1373,36 +1363,6 @@ async function _SeedlessOnboardingController_updateVault({ password, vaultData,
             state.encryptedSeedlessEncryptionKey = (0, utils_1.bytesToBase64)(encryptedKey);
         });
     });
-}, _SeedlessOnboardingController_getAccessTokenAndRevokeToken = 
-/**
- * Get the access token and revoke token from the state or the vault.
- *
- * @param password - The password to decrypt the vault.
- * @returns The access token and revoke token.
- */
-async function _SeedlessOnboardingController_getAccessTokenAndRevokeToken(password) {
-    let { accessToken, revokeToken } = this.state;
-    // `accessToken` and `revokeToken` are both available in the state, `ONLY` when the wallet (vault) is unlocked
-    // or during the period between the social authentication and the vault creation during the onboarding flow.
-    if (accessToken && revokeToken) {
-        return { accessToken, revokeToken };
-    }
-    // if `password` is provided to decrypt the vault, decrypt the vault and get the access token and revoke token from the vault
-    if (this.state.vault) {
-        // if the access token or revoke token is not available in the state, decrypt the vault and get the access token and revoke token from the vault
-        const { vaultData } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, { password });
-        accessToken = accessToken || vaultData.accessToken;
-        revokeToken = revokeToken || vaultData.revokeToken;
-    }
-    // we should always throw an error if the access token or revoke token is not available
-    // to prevent the caller from using the controller in an invalid state
-    if (!accessToken) {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidAccessToken);
-    }
-    if (!revokeToken) {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
-    }
-    return { accessToken, revokeToken };
 }, _SeedlessOnboardingController_withControllerLock = 
 /**
  * Lock the controller mutex before executing the given function,
@@ -1459,6 +1419,10 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
         });
         throw error;
     }
+}, _SeedlessOnboardingController_assertIsSRPBackedUpUser = function _SeedlessOnboardingController_assertIsSRPBackedUpUser(value) {
+    if (!this.state.authPubKey) {
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.SRPNotBackedUpError);
+    }
 }, _SeedlessOnboardingController_assertPasswordInSync = 
 /**
  * Assert that the password is in sync with the global password.