@metamask-previews/seedless-onboarding-controller 8.1.0-preview-152e02d → 8.1.0-preview-e0f8f1907

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Token refresh now uses a dedicated private `#reAuthenticate` method that only accepts the tokens returned by the JWT-refresh service (`idTokens`, `accessToken`, `metadataAccessToken`), making the re-authentication path stricter than the initial `authenticate` call ([#8148](https://github.com/MetaMask/core/pull/8148))
+- After a successful JWT refresh the controller proactively rotates the refresh/revoke token pair (when the vault is unlocked) via the public `rotateRefreshToken` method ([#8148](https://github.com/MetaMask/core/pull/8148))
+- Token expiry checks now use a 90% lifetime threshold for proactive refresh: access tokens and metadata access tokens are refreshed when less than 10% of their lifetime remains (requires `iat`), while node auth tokens fall back to exact-expiry checking ([#8148](https://github.com/MetaMask/core/pull/8148))
+
+### Removed
+
+- **BREAKING:** Removed public `renewRefreshToken` method — refresh token rotation is now handled by `rotateRefreshToken`, which can also be called directly ([#8148](https://github.com/MetaMask/core/pull/8148))
+
+### Fixed
+
+- Fixed `FailedToFetchAuthPubKey` errors caused by expired tokens in `addNewSecretData` and `changePassword` — `assertPasswordInSync` is now called inside the token-refresh wrapper so expired `nodeAuthTokens` are refreshed before reaching the backend
+
 ## [8.1.0]
 
 ### Changed

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_pendingRefreshPromise, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_renewRefreshToken, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_cachedDecryptedVaultData, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_pickLatestAccessToken, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_encryptSeedlessEncryptionKey, _SeedlessOnboardingController_getAccessTokenAndRevokeToken, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_doRefreshAuthTokens, _SeedlessOnboardingController_addRefreshTokenToRevokeList, _SeedlessOnboardingController_isAuthTokenError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh, _SeedlessOnboardingController_checkTokensExpired;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_pendingRefreshPromise, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_renewRefreshToken, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_cachedDecryptedVaultData, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_pickLatestAccessToken, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_encryptSeedlessEncryptionKey, _SeedlessOnboardingController_getAccessTokenAndRevokeToken, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_doRefreshAuthTokens, _SeedlessOnboardingController_reAuthenticate, _SeedlessOnboardingController_addRefreshTokenToRevokeList, _SeedlessOnboardingController_isAuthTokenError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh, _SeedlessOnboardingController_checkTokensExpired;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getInitialSeedlessOnboardingControllerStateWithDefaults = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -255,10 +255,11 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         if (!metadataAccessToken) {
             throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidMetadataAccessToken);
         }
-        // Check if token is expired and refresh if needed
+        // Use the same 90%-lifetime threshold as checkMetadataAccessTokenExpired
+        // so both code paths agree on when a refresh is needed.
         const decodedToken = (0, utils_3.decodeJWTToken)(metadataAccessToken);
-        if (decodedToken.exp < Math.floor(Date.now() / 1000)) {
-            // Token is expired, refresh it
+        if (isTokenNearExpiry(decodedToken.exp, decodedToken.iat)) {
+            // Token is near expiry or already expired, refresh it
             await this.refreshAuthTokens();
             // Get the new token after refresh
             const { metadataAccessToken: newMetadataAccessToken } = this.state;
@@ -291,7 +292,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param params.userId - user email or id from Social login
      * @param params.groupedAuthConnectionId - Optional grouped authConnectionId to be used for the authenticate request.
      * @param params.socialLoginEmail - The user email from Social login.
-     * @param params.refreshToken - refresh token for refreshing expired nodeAuthTokens.
+     * @param params.refreshToken - Refresh token issued during OAuth login. Written to state when provided.
      * @param params.revokeToken - revoke token for revoking refresh token and get new refresh token and new revoke token.
      * @param params.accessToken - Access token for pairing with profile sync auth service and to access other services.
      * @param params.metadataAccessToken - Metadata access token for accessing the metadata service before the vault is created or unlocked.
@@ -397,11 +398,11 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     async addNewSecretData(data, type, options) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertPasswordInSync).call(this, {
-                skipCache: true,
-                skipLock: true, // skip lock since we already have the lock
-            });
             const performBackup = async () => {
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertPasswordInSync).call(this, {
+                    skipCache: true,
+                    skipLock: true, // skip lock since we already have the lock
+                });
                 // verify the password and unlock the vault
                 const { toprfEncryptionKey, toprfAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this);
                 // encrypt and store the secret data
@@ -476,11 +477,11 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             await this.verifyVaultPassword(oldPassword, {
                 skipLock: true, // skip lock since we already have the lock
             });
-            const { latestKeyIndex } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertPasswordInSync).call(this, {
-                skipCache: true,
-                skipLock: true, // skip lock since we already have the lock
-            });
             const attemptChangePassword = async () => {
+                const { latestKeyIndex } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertPasswordInSync).call(this, {
+                    skipCache: true,
+                    skipLock: true, // skip lock since we already have the lock
+                });
                 // load keyring encryption key if it exists
                 let keyringEncryptionKey;
                 if (this.state.encryptedKeyringEncryptionKey) {
@@ -779,54 +780,64 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @returns A promise that resolves when the tokens have been refreshed.
      */
     async refreshAuthTokens() {
+        // Coalesce concurrent calls to avoid issuing parallel HTTP requests
+        // with the same refresh token.
         if (__classPrivateFieldGet(this, _SeedlessOnboardingController_pendingRefreshPromise, "f")) {
             return __classPrivateFieldGet(this, _SeedlessOnboardingController_pendingRefreshPromise, "f");
         }
-        __classPrivateFieldSet(this, _SeedlessOnboardingController_pendingRefreshPromise, __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_doRefreshAuthTokens).call(this).finally(() => {
-            __classPrivateFieldSet(this, _SeedlessOnboardingController_pendingRefreshPromise, undefined, "f");
-        }), "f");
-        return __classPrivateFieldGet(this, _SeedlessOnboardingController_pendingRefreshPromise, "f");
+        const promise = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_doRefreshAuthTokens).call(this).finally(() => {
+            if (__classPrivateFieldGet(this, _SeedlessOnboardingController_pendingRefreshPromise, "f") === promise) {
+                __classPrivateFieldSet(this, _SeedlessOnboardingController_pendingRefreshPromise, undefined, "f");
+            }
+        });
+        __classPrivateFieldSet(this, _SeedlessOnboardingController_pendingRefreshPromise, promise, "f");
+        return promise;
     }
     /**
-     * Renew the refresh token - get new refresh token and new revoke token
-     * and also updates the vault with the new revoke token.
-     * This method is to be called after user is authenticated.
+     * Rotate the refresh token — fetch a new refresh/revoke token pair from the
+     * auth service and persist the new revoke token in the vault.
+     *
+     * This method should be called after a successful JWT refresh.
      *
-     * @param password - The password to encrypt the vault.
      * @returns A Promise that resolves to void.
      */
-    async renewRefreshToken(password) {
-        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-            const { refreshToken, vaultEncryptionKey } = this.state;
-            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
-                password,
-                encryptionKey: vaultEncryptionKey,
+    async rotateRefreshToken() {
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+        const vaultData = __classPrivateFieldGet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, "f");
+        // Safety net: the caller (#doRefreshAuthTokens) already guards with
+        // `this.#isUnlocked && this.#cachedDecryptedVaultData`, so this branch
+        // is unreachable in normal flow. This check is added to satisfy the linter and
+        // to make sure any future caller of this method does not bypass the check.
+        /* istanbul ignore if */
+        if (!vaultData) {
+            throw new errors_1.SeedlessOnboardingError(constants_1.SeedlessOnboardingControllerErrorMessage.VaultLocked);
+        }
+        const { refreshToken } = this.state;
+        const { toprfPwEncryptionKey: pwEncKey, revokeToken } = vaultData;
+        const { newRevokeToken, newRefreshToken } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_renewRefreshToken, "f").call(this, {
+            connection: this.state.authConnection,
+            revokeToken,
+        });
+        if (newRevokeToken && newRefreshToken) {
+            // Persist the new revoke token to the vault first. Only update state after
+            // the vault write succeeds, so state and vault stay in sync if the write fails.
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
+                vaultData: {
+                    ...vaultData,
+                    revokeToken: newRevokeToken,
+                },
+                pwEncKey,
+            });
+            this.update((state) => {
+                state.revokeToken = newRevokeToken;
+                state.refreshToken = newRefreshToken;
             });
-            const { newRevokeToken, newRefreshToken } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_renewRefreshToken, "f").call(this, {
-                connection: this.state.authConnection,
+            // add the old refresh token to the list to be revoked later when possible
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_addRefreshTokenToRevokeList).call(this, {
+                refreshToken,
                 revokeToken,
             });
-            if (newRevokeToken && newRefreshToken) {
-                this.update((state) => {
-                    // set new revoke token in state temporarily for persisting in vault
-                    state.revokeToken = newRevokeToken;
-                    // set new refresh token to persist in state
-                    state.refreshToken = newRefreshToken;
-                });
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-                    password,
-                    rawToprfEncryptionKey,
-                    rawToprfPwEncryptionKey,
-                    rawToprfAuthKeyPair,
-                });
-                // add the old refresh token to the list to be revoked later when possible
-                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_addRefreshTokenToRevokeList).call(this, {
-                    refreshToken,
-                    revokeToken,
-                });
-            }
-        });
+        }
     }
     /**
      * Revoke all pending refresh tokens.
@@ -898,13 +909,15 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         const firstAuthToken = nodeAuthTokens[0]?.authToken;
         // node auth token is base64 encoded json object
         const decodedToken = (0, utils_3.decodeNodeAuthToken)(firstAuthToken);
-        // check if the token is expired
-        return decodedToken.exp < Date.now() / 1000;
+        // Node auth tokens do not carry a reliable iat field — use exact expiry.
+        return isTokenNearExpiry(decodedToken.exp);
     }
     /**
-     * Check if the current metadata access token is expired.
+     * Check if the current metadata access token should be refreshed.
+     * Returns true when the token is expired or when less than 10% of its
+     * lifetime remains (proactive refresh).
      *
-     * @returns True if the metadata access token is expired, false otherwise.
+     * @returns True if the metadata access token should be refreshed, false otherwise.
      */
     checkMetadataAccessTokenExpired() {
         try {
@@ -912,17 +925,19 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
             const { metadataAccessToken } = this.state;
             // assertIsAuthenticatedUser will throw if metadataAccessToken is missing
             const decodedToken = (0, utils_3.decodeJWTToken)(metadataAccessToken);
-            return decodedToken.exp < Math.floor(Date.now() / 1000);
+            return isTokenNearExpiry(decodedToken.exp, decodedToken.iat);
         }
         catch {
             return true; // Consider unauthenticated user as having expired tokens
         }
     }
     /**
-     * Check if the current access token is expired.
+     * Check if the current access token should be refreshed.
+     * Returns true when the token is expired or when less than 10% of its
+     * lifetime remains (proactive refresh).
      * When the vault is locked, the access token is not accessible, so we return false.
      *
-     * @returns True if the access token is expired, false otherwise.
+     * @returns True if the access token should be refreshed, false otherwise.
      */
     checkAccessTokenExpired() {
         try {
@@ -932,7 +947,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 return true; // Consider missing token as expired
             }
             const decodedToken = (0, utils_3.decodeJWTToken)(accessToken);
-            return decodedToken.exp < Math.floor(Date.now() / 1000);
+            return isTokenNearExpiry(decodedToken.exp, decodedToken.iat);
         }
         catch {
             return true; // Consider unauthenticated user as having expired tokens
@@ -1619,25 +1634,12 @@ async function _SeedlessOnboardingController_doRefreshAuthTokens() {
     });
     try {
         const { idTokens, accessToken, metadataAccessToken } = res;
-        // re-authenticate with the new id tokens to set new node auth tokens
-        // NOTE: here we can't provide the `revokeToken` value to the `authenticate` method because `refreshAuthTokens` method can be called when the wallet (vault) is locked
-        // NOTE: use this.state.refreshToken (current value) rather than the
-        // `refreshToken` captured at the start of this method. If renewRefreshToken()
-        // ran concurrently while our HTTP call was in-flight, it will have already
-        // updated state.refreshToken to the new token. Using the captured (now-stale)
-        // value would overwrite that newer token and revert the state, causing the
-        // old token to be used for subsequent refreshes — and once that old token is
-        // revoked (15 s after the renewal), every subsequent refresh will return 401.
-        await this.authenticate({
+        // Re-authenticate with the refreshed id tokens to update node auth
+        // tokens, accessToken, and metadataAccessToken in state.
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_reAuthenticate).call(this, {
             idTokens,
             accessToken,
             metadataAccessToken,
-            authConnection: this.state.authConnection,
-            authConnectionId: this.state.authConnectionId,
-            groupedAuthConnectionId: this.state.groupedAuthConnectionId,
-            userId: this.state.userId,
-            refreshToken: this.state.refreshToken,
-            skipLock: true,
         });
         // update the vault with new access token if wallet is unlocked
         if (__classPrivateFieldGet(this, _SeedlessOnboardingController_isUnlocked, "f") && __classPrivateFieldGet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, "f")) {
@@ -1650,6 +1652,15 @@ async function _SeedlessOnboardingController_doRefreshAuthTokens() {
                 vaultData: updatedVaultData,
                 pwEncKey,
             });
+            // Proactively rotate the refresh token now that we have vault access.
+            await this.rotateRefreshToken().catch((error) => {
+                // Rotation failure is intentionally non-fatal: the JWT refresh
+                // itself succeeded and the caller should not be blocked.
+                // However the user is now operating with a stale refresh token
+                // that may be revoked server-side, so log prominently.
+                log('Failed to rotate refresh token after successful JWT refresh. ' +
+                    'The user may be logged out when the old token is revoked.', error);
+            });
         }
     }
     catch (error) {
@@ -1658,6 +1669,58 @@ async function _SeedlessOnboardingController_doRefreshAuthTokens() {
             cause: error,
         });
     }
+}, _SeedlessOnboardingController_reAuthenticate = 
+/**
+ * Re-authenticate the user using freshly issued tokens from a JWT refresh.
+ *
+ * Unlike the public `authenticate` method, this variant is called exclusively
+ * from token-refresh paths where the user's identity has already been
+ * established.  It only accepts the tokens returned by the JWT-refresh
+ * service (`idTokens`, `accessToken`, `metadataAccessToken`) and reads all
+ * other auth-connection details from the existing controller state.
+ *
+ * `refreshToken` and `revokeToken` are intentionally absent — token-refresh
+ * paths must not touch `state.refreshToken` directly; that field is managed
+ * exclusively by `rotateRefreshToken`.
+ *
+ * @param params - Tokens issued by the JWT-refresh service.
+ * @param params.idTokens - New node id tokens.
+ * @param params.accessToken - New access token.
+ * @param params.metadataAccessToken - New metadata access token.
+ * @returns A promise that resolves to the authentication result.
+ */
+async function _SeedlessOnboardingController_reAuthenticate(params) {
+    const { idTokens, accessToken, metadataAccessToken } = params;
+    const { authConnection, authConnectionId, groupedAuthConnectionId, userId, socialLoginEmail, } = this.state;
+    try {
+        const authenticationResult = await this.toprfClient.authenticate({
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+            authConnectionId: authConnectionId,
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+            userId: userId,
+            idTokens,
+            groupedAuthConnectionId,
+        });
+        this.update((state) => {
+            state.nodeAuthTokens = authenticationResult.nodeAuthTokens;
+            state.authConnection = authConnection;
+            state.authConnectionId = authConnectionId;
+            state.groupedAuthConnectionId = groupedAuthConnectionId;
+            state.userId = userId;
+            state.socialLoginEmail = socialLoginEmail;
+            state.metadataAccessToken = metadataAccessToken;
+            state.accessToken = accessToken;
+            (0, assertions_1.assertIsSeedlessOnboardingUserAuthenticated)(state);
+            state.isSeedlessOnboardingUserAuthenticated = true;
+        });
+        return authenticationResult;
+    }
+    catch (error) {
+        log('Error re-authenticating user', error);
+        throw new errors_1.SeedlessOnboardingError(constants_1.SeedlessOnboardingControllerErrorMessage.AuthenticationError, {
+            cause: error,
+        });
+    }
 }, _SeedlessOnboardingController_addRefreshTokenToRevokeList = function _SeedlessOnboardingController_addRefreshTokenToRevokeList({ refreshToken, revokeToken, }) {
     this.update((state) => {
         state.pendingToBeRevokedTokens = [
@@ -1732,6 +1795,32 @@ async function _SeedlessOnboardingController_executeWithTokenRefresh(operation,
         isMetadataAccessTokenExpired ||
         isAccessTokenExpired);
 };
+/**
+ * Determine whether a token should be proactively refreshed.
+ *
+ * When `iat` is provided: returns `true` when less than 10% of the token's
+ * lifetime remains (i.e. we are in the last 10% before expiry).
+ * When `iat` is omitted (e.g. node auth tokens): returns `true` when the token
+ * is already expired.
+ *
+ * @param exp - Token expiration time in seconds (Unix epoch).
+ * @param iat - Optional issued-at time in seconds (Unix epoch). Required for 10% threshold.
+ * @returns True if the token should be refreshed.
+ */
+function isTokenNearExpiry(exp, iat) {
+    const now = Date.now() / 1000;
+    if (iat === undefined) {
+        return now >= exp;
+    }
+    const lifetime = exp - iat;
+    // Guard against malformed tokens where iat >= exp (zero or negative lifetime).
+    // Fall back to exact-expiry check so bad tokens are always considered stale.
+    if (lifetime <= 0) {
+        return now >= exp;
+    }
+    const remaining = exp - now;
+    return remaining <= 0.1 * lifetime;
+}
 /**
  * Lock the given mutex before executing the given function,
  * and release it after the function is resolved or after an