@metamask-previews/seedless-onboarding-controller 8.0.0-preview-1821148 → 8.0.0-preview-511b467

package/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- `refreshAuthTokens` now coalesces concurrent calls — if a refresh is already in-flight, subsequent callers share the same promise rather than issuing duplicate HTTP requests with the same token ([#7989](https://github.com/MetaMask/core/pull/7989))
+- `revokePendingRefreshTokens` now enforces a per-token grace period before revocation — only tokens that have been pending for at least `PENDING_REVOKE_TOKEN_DELAY_MS` (15 s) are eligible, preventing a cross-cycle race where an earlier rotation cycle revokes tokens queued by a later cycle ([#7989](https://github.com/MetaMask/core/pull/7989))
+- `refreshAuthTokens` now uses the live `state.refreshToken` value when calling `authenticate` after a successful HTTP refresh, preventing a stale-capture bug that could overwrite a concurrently-renewed token with an older one ([#7989](https://github.com/MetaMask/core/pull/7989))
+- `renewRefreshToken` now queues the old token for revocation only after `#createNewVaultWithAuthData` succeeds, ensuring tokens are not queued if vault creation fails ([#7989](https://github.com/MetaMask/core/pull/7989))
+
+### Fixed
+
+- Fixed `refreshAuthTokens` throwing the generic `FailedToRefreshJWTTokens` error for all HTTP failures — a 401 response (permanently revoked token) now throws `InvalidRefreshToken` instead, giving callers a distinct signal to distinguish permanent from transient failures ([#7989](https://github.com/MetaMask/core/pull/7989))
+
 ## [8.0.0]
 
 ### Added

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_renewRefreshToken, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_cachedDecryptedVaultData, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_pickLatestAccessToken, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_encryptSeedlessEncryptionKey, _SeedlessOnboardingController_getAccessTokenAndRevokeToken, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_addRefreshTokenToRevokeList, _SeedlessOnboardingController_isAuthTokenError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh, _SeedlessOnboardingController_checkTokensExpired;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_pendingRefreshPromise, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_renewRefreshToken, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_cachedDecryptedVaultData, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_pickLatestAccessToken, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_encryptSeedlessEncryptionKey, _SeedlessOnboardingController_getAccessTokenAndRevokeToken, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_doRefreshAuthTokens, _SeedlessOnboardingController_addRefreshTokenToRevokeList, _SeedlessOnboardingController_isAuthTokenError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh, _SeedlessOnboardingController_checkTokensExpired;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getInitialSeedlessOnboardingControllerStateWithDefaults = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -212,6 +212,12 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         _SeedlessOnboardingController_vaultEncryptor.set(this, void 0);
         _SeedlessOnboardingController_controllerOperationMutex.set(this, new async_mutex_1.Mutex());
         _SeedlessOnboardingController_vaultOperationMutex.set(this, new async_mutex_1.Mutex());
+        /**
+         * In-flight promise for `refreshAuthTokens`.  Any concurrent caller that
+         * arrives while a refresh is already in-progress will share this promise
+         * rather than issuing a second HTTP request with the same refresh token.
+         */
+        _SeedlessOnboardingController_pendingRefreshPromise.set(this, void 0);
         _SeedlessOnboardingController_refreshJWTToken.set(this, void 0);
         _SeedlessOnboardingController_revokeRefreshToken.set(this, void 0);
         _SeedlessOnboardingController_renewRefreshToken.set(this, void 0);
@@ -763,59 +769,23 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadKeyringEncryptionKey).call(this, encKey);
     }
     /**
-     * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using the stored refresh token.
+     * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using
+     * the stored refresh token.
      *
-     * This method retrieves the refresh token from the vault and uses it to obtain
-     * new nodeAuthTokens when the current ones have expired.
+     * Concurrent callers share a single in-flight HTTP request — if a refresh is
+     * already in-progress the returned promise resolves when that request settles
+     * rather than firing a duplicate request with the same token.
      *
-     * @returns A promise that resolves to the new nodeAuthTokens.
+     * @returns A promise that resolves when the tokens have been refreshed.
      */
     async refreshAuthTokens() {
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-        const { refreshToken } = this.state;
-        const res = await __classPrivateFieldGet(this, _SeedlessOnboardingController_refreshJWTToken, "f").call(this, {
-            connection: this.state.authConnection,
-            refreshToken,
-        }).catch((error) => {
-            log('Error refreshing JWT tokens', error);
-            throw new errors_1.SeedlessOnboardingError(constants_1.SeedlessOnboardingControllerErrorMessage.FailedToRefreshJWTTokens, {
-                cause: error,
-            });
-        });
-        try {
-            const { idTokens, accessToken, metadataAccessToken } = res;
-            // re-authenticate with the new id tokens to set new node auth tokens
-            // NOTE: here we can't provide the `revokeToken` value to the `authenticate` method because `refreshAuthTokens` method can be called when the wallet (vault) is locked
-            await this.authenticate({
-                idTokens,
-                accessToken,
-                metadataAccessToken,
-                authConnection: this.state.authConnection,
-                authConnectionId: this.state.authConnectionId,
-                groupedAuthConnectionId: this.state.groupedAuthConnectionId,
-                userId: this.state.userId,
-                refreshToken,
-                skipLock: true,
-            });
-            // update the vault with new access token if wallet is unlocked
-            if (__classPrivateFieldGet(this, _SeedlessOnboardingController_isUnlocked, "f") && __classPrivateFieldGet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, "f")) {
-                const updatedVaultData = {
-                    ...__classPrivateFieldGet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, "f"),
-                    accessToken,
-                };
-                const pwEncKey = __classPrivateFieldGet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, "f").toprfPwEncryptionKey;
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
-                    vaultData: updatedVaultData,
-                    pwEncKey,
-                });
-            }
-        }
-        catch (error) {
-            log('Error refreshing node auth tokens', error);
-            throw new errors_1.SeedlessOnboardingError(constants_1.SeedlessOnboardingControllerErrorMessage.AuthenticationError, {
-                cause: error,
-            });
+        if (__classPrivateFieldGet(this, _SeedlessOnboardingController_pendingRefreshPromise, "f")) {
+            return __classPrivateFieldGet(this, _SeedlessOnboardingController_pendingRefreshPromise, "f");
         }
+        __classPrivateFieldSet(this, _SeedlessOnboardingController_pendingRefreshPromise, __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_doRefreshAuthTokens).call(this).finally(() => {
+            __classPrivateFieldSet(this, _SeedlessOnboardingController_pendingRefreshPromise, undefined, "f");
+        }), "f");
+        return __classPrivateFieldGet(this, _SeedlessOnboardingController_pendingRefreshPromise, "f");
     }
     /**
      * Renew the refresh token - get new refresh token and new revoke token
@@ -844,17 +814,17 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                     // set new refresh token to persist in state
                     state.refreshToken = newRefreshToken;
                 });
-                // add the old refresh token to the list to be revoked later when possible
-                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_addRefreshTokenToRevokeList).call(this, {
-                    refreshToken,
-                    revokeToken,
-                });
                 await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
                     password,
                     rawToprfEncryptionKey,
                     rawToprfPwEncryptionKey,
                     rawToprfAuthKeyPair,
                 });
+                // add the old refresh token to the list to be revoked later when possible
+                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_addRefreshTokenToRevokeList).call(this, {
+                    refreshToken,
+                    revokeToken,
+                });
             }
         });
     }
@@ -872,8 +842,17 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             if (!pendingToBeRevokedTokens || pendingToBeRevokedTokens.length === 0) {
                 return;
             }
+            // Only revoke tokens that have been pending for at least PENDING_REVOKE_TOKEN_DELAY_MS.
+            // Entries without queuedAt (pre-migration persisted state) default to 0 (epoch) and
+            // are always old enough. This prevents a cross-cycle race where an earlier cycle's
+            // timer revokes tokens queued by a later cycle before those tokens' own grace period expires.
+            const now = Date.now();
+            const tokensReadyToRevoke = pendingToBeRevokedTokens.filter(({ queuedAt }) => now - (queuedAt ?? 0) >= constants_1.PENDING_REVOKE_TOKEN_DELAY_MS);
+            if (tokensReadyToRevoke.length === 0) {
+                return;
+            }
             // revoke all pending refresh tokens in parallel
-            const promises = pendingToBeRevokedTokens.map(({ revokeToken }) => {
+            const promises = tokensReadyToRevoke.map(({ revokeToken }) => {
                 const revokePromise = async () => {
                     try {
                         await __classPrivateFieldGet(this, _SeedlessOnboardingController_revokeRefreshToken, "f").call(this, {
@@ -970,7 +949,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     }
 }
 exports.SeedlessOnboardingController = SeedlessOnboardingController;
-_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_renewRefreshToken = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_cachedDecryptedVaultData = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_pendingRefreshPromise = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_renewRefreshToken = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_cachedDecryptedVaultData = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
 /**
  * @description Submit the global password to the controller, verify the
  * password validity and unlock the controller.
@@ -1620,11 +1599,79 @@ async function _SeedlessOnboardingController_assertPasswordInSync(options) {
     this.update((state) => {
         delete state.passwordOutdatedCache;
     });
+}, _SeedlessOnboardingController_doRefreshAuthTokens = 
+/**
+ * Internal implementation of token refresh.  Called exclusively by
+ * `refreshAuthTokens` which gates concurrent access via
+ * `#pendingRefreshPromise`.
+ */
+async function _SeedlessOnboardingController_doRefreshAuthTokens() {
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+    const { refreshToken } = this.state;
+    const res = await __classPrivateFieldGet(this, _SeedlessOnboardingController_refreshJWTToken, "f").call(this, {
+        connection: this.state.authConnection,
+        refreshToken,
+    }).catch((error) => {
+        // Distinguish a server-side token rejection (401) from transient
+        // failures so callers can apply the appropriate recovery strategy.
+        const httpStatusCode = error
+            .statusCode;
+        log('Error refreshing JWT tokens', error, { httpStatusCode });
+        const isTokenRevoked = error instanceof Error &&
+            error.name === 'RefreshTokenHttpError' &&
+            httpStatusCode === 401;
+        throw new errors_1.SeedlessOnboardingError(isTokenRevoked
+            ? constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRefreshToken
+            : constants_1.SeedlessOnboardingControllerErrorMessage.FailedToRefreshJWTTokens, {
+            cause: error,
+        });
+    });
+    try {
+        const { idTokens, accessToken, metadataAccessToken } = res;
+        // re-authenticate with the new id tokens to set new node auth tokens
+        // NOTE: here we can't provide the `revokeToken` value to the `authenticate` method because `refreshAuthTokens` method can be called when the wallet (vault) is locked
+        // NOTE: use this.state.refreshToken (current value) rather than the
+        // `refreshToken` captured at the start of this method. If renewRefreshToken()
+        // ran concurrently while our HTTP call was in-flight, it will have already
+        // updated state.refreshToken to the new token. Using the captured (now-stale)
+        // value would overwrite that newer token and revert the state, causing the
+        // old token to be used for subsequent refreshes — and once that old token is
+        // revoked (15 s after the renewal), every subsequent refresh will return 401.
+        await this.authenticate({
+            idTokens,
+            accessToken,
+            metadataAccessToken,
+            authConnection: this.state.authConnection,
+            authConnectionId: this.state.authConnectionId,
+            groupedAuthConnectionId: this.state.groupedAuthConnectionId,
+            userId: this.state.userId,
+            refreshToken: this.state.refreshToken,
+            skipLock: true,
+        });
+        // update the vault with new access token if wallet is unlocked
+        if (__classPrivateFieldGet(this, _SeedlessOnboardingController_isUnlocked, "f") && __classPrivateFieldGet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, "f")) {
+            const updatedVaultData = {
+                ...__classPrivateFieldGet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, "f"),
+                accessToken,
+            };
+            const pwEncKey = __classPrivateFieldGet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, "f").toprfPwEncryptionKey;
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
+                vaultData: updatedVaultData,
+                pwEncKey,
+            });
+        }
+    }
+    catch (error) {
+        log('Error refreshing node auth tokens', error);
+        throw new errors_1.SeedlessOnboardingError(constants_1.SeedlessOnboardingControllerErrorMessage.AuthenticationError, {
+            cause: error,
+        });
+    }
 }, _SeedlessOnboardingController_addRefreshTokenToRevokeList = function _SeedlessOnboardingController_addRefreshTokenToRevokeList({ refreshToken, revokeToken, }) {
     this.update((state) => {
         state.pendingToBeRevokedTokens = [
             ...(state.pendingToBeRevokedTokens ?? []),
-            { refreshToken, revokeToken },
+            { refreshToken, revokeToken, queuedAt: Date.now() },
         ];
     });
 }, _SeedlessOnboardingController_isAuthTokenError = function _SeedlessOnboardingController_isAuthTokenError(error) {