@metamask/profile-sync-controller 0.4.0 → 0.6.0

package/dist/controllers/authentication/auth-snap-requests.cjs

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSnapSignMessageRequest = exports.createSnapPublicKeyRequest = void 0;
+const snapId = 'npm:@metamask/message-signing-snap';
+/**
+ * Constructs Request to Message Signing Snap to get Public Key
+ *
+ * @returns Snap Public Key Request
+ */
+function createSnapPublicKeyRequest() {
+    return {
+        snapId,
+        origin: '',
+        handler: 'onRpcRequest',
+        request: {
+            method: 'getPublicKey',
+        },
+    };
+}
+exports.createSnapPublicKeyRequest = createSnapPublicKeyRequest;
+/**
+ * Constructs Request to get Message Signing Snap to sign a message.
+ *
+ * @param message - message to sign
+ * @returns Snap Sign Message Request
+ */
+function createSnapSignMessageRequest(message) {
+    return {
+        snapId,
+        origin: '',
+        handler: 'onRpcRequest',
+        request: {
+            method: 'signMessage',
+            params: { message },
+        },
+    };
+}
+exports.createSnapSignMessageRequest = createSnapSignMessageRequest;
+//# sourceMappingURL=auth-snap-requests.cjs.map

package/dist/controllers/authentication/auth-snap-requests.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-snap-requests.cjs","sourceRoot":"","sources":["../../../src/controllers/authentication/auth-snap-requests.ts"],"names":[],"mappings":";;;AAMA,MAAM,MAAM,GAAG,oCAA8C,CAAC;AAE9D;;;;GAIG;AACH,SAAgB,0BAA0B;IACxC,OAAO;QACL,MAAM;QACN,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,cAAqB;QAC9B,OAAO,EAAE;YACP,MAAM,EAAE,cAAc;SACvB;KACF,CAAC;AACJ,CAAC;AATD,gEASC;AAED;;;;;GAKG;AACH,SAAgB,4BAA4B,CAC1C,OAA6B;IAE7B,OAAO;QACL,MAAM;QACN,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,cAAqB;QAC9B,OAAO,EAAE;YACP,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE;SACpB;KACF,CAAC;AACJ,CAAC;AAZD,oEAYC","sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type { HandleSnapRequest } from '@metamask/snaps-controllers';\nimport type { SnapId } from '@metamask/snaps-sdk';\n\ntype SnapRPCRequest = Parameters<HandleSnapRequest['handler']>[0];\n\nconst snapId = 'npm:@metamask/message-signing-snap' as SnapId;\n\n/**\n * Constructs Request to Message Signing Snap to get Public Key\n *\n * @returns Snap Public Key Request\n */\nexport function createSnapPublicKeyRequest(): SnapRPCRequest {\n  return {\n    snapId,\n    origin: '',\n    handler: 'onRpcRequest' as any,\n    request: {\n      method: 'getPublicKey',\n    },\n  };\n}\n\n/**\n * Constructs Request to get Message Signing Snap to sign a message.\n *\n * @param message - message to sign\n * @returns Snap Sign Message Request\n */\nexport function createSnapSignMessageRequest(\n  message: `metamask:${string}`,\n): SnapRPCRequest {\n  return {\n    snapId,\n    origin: '',\n    handler: 'onRpcRequest' as any,\n    request: {\n      method: 'signMessage',\n      params: { message },\n    },\n  };\n}\n"]}

package/dist/{types/controllers/authentication/auth-snap-requests.d.ts → controllers/authentication/auth-snap-requests.d.cts}

@@ -1,4 +1,4 @@
-import type { HandleSnapRequest } from '@metamask/snaps-controllers';
+import type { HandleSnapRequest } from "@metamask/snaps-controllers";
 type SnapRPCRequest = Parameters<HandleSnapRequest['handler']>[0];
 /**
  * Constructs Request to Message Signing Snap to get Public Key
@@ -14,4 +14,4 @@ export declare function createSnapPublicKeyRequest(): SnapRPCRequest;
  */
 export declare function createSnapSignMessageRequest(message: `metamask:${string}`): SnapRPCRequest;
 export {};
-//# sourceMappingURL=auth-snap-requests.d.ts.map
+//# sourceMappingURL=auth-snap-requests.d.cts.map

package/dist/controllers/authentication/auth-snap-requests.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-snap-requests.d.cts","sourceRoot":"","sources":["../../../src/controllers/authentication/auth-snap-requests.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oCAAoC;AAGrE,KAAK,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAIlE;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,cAAc,CAS3D;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,YAAY,MAAM,EAAE,GAC5B,cAAc,CAUhB"}

package/dist/controllers/authentication/auth-snap-requests.d.mts

@@ -0,0 +1,17 @@
+import type { HandleSnapRequest } from "@metamask/snaps-controllers";
+type SnapRPCRequest = Parameters<HandleSnapRequest['handler']>[0];
+/**
+ * Constructs Request to Message Signing Snap to get Public Key
+ *
+ * @returns Snap Public Key Request
+ */
+export declare function createSnapPublicKeyRequest(): SnapRPCRequest;
+/**
+ * Constructs Request to get Message Signing Snap to sign a message.
+ *
+ * @param message - message to sign
+ * @returns Snap Sign Message Request
+ */
+export declare function createSnapSignMessageRequest(message: `metamask:${string}`): SnapRPCRequest;
+export {};
+//# sourceMappingURL=auth-snap-requests.d.mts.map

package/dist/controllers/authentication/auth-snap-requests.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-snap-requests.d.mts","sourceRoot":"","sources":["../../../src/controllers/authentication/auth-snap-requests.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oCAAoC;AAGrE,KAAK,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAIlE;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,cAAc,CAS3D;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,YAAY,MAAM,EAAE,GAC5B,cAAc,CAUhB"}

package/dist/controllers/authentication/auth-snap-requests.mjs

@@ -1,10 +1,34 @@
-import {
-  createSnapPublicKeyRequest,
-  createSnapSignMessageRequest
-} from "../../chunk-NMIF3LSX.mjs";
-import "../../chunk-U5UIDVOO.mjs";
-export {
-  createSnapPublicKeyRequest,
-  createSnapSignMessageRequest
-};
+const snapId = 'npm:@metamask/message-signing-snap';
+/**
+ * Constructs Request to Message Signing Snap to get Public Key
+ *
+ * @returns Snap Public Key Request
+ */
+export function createSnapPublicKeyRequest() {
+    return {
+        snapId,
+        origin: '',
+        handler: 'onRpcRequest',
+        request: {
+            method: 'getPublicKey',
+        },
+    };
+}
+/**
+ * Constructs Request to get Message Signing Snap to sign a message.
+ *
+ * @param message - message to sign
+ * @returns Snap Sign Message Request
+ */
+export function createSnapSignMessageRequest(message) {
+    return {
+        snapId,
+        origin: '',
+        handler: 'onRpcRequest',
+        request: {
+            method: 'signMessage',
+            params: { message },
+        },
+    };
+}
 //# sourceMappingURL=auth-snap-requests.mjs.map

package/dist/controllers/authentication/auth-snap-requests.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"file":"auth-snap-requests.mjs","sourceRoot":"","sources":["../../../src/controllers/authentication/auth-snap-requests.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,GAAG,oCAA8C,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,MAAM;QACN,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,cAAqB;QAC9B,OAAO,EAAE;YACP,MAAM,EAAE,cAAc;SACvB;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAA6B;IAE7B,OAAO;QACL,MAAM;QACN,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,cAAqB;QAC9B,OAAO,EAAE;YACP,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE;SACpB;KACF,CAAC;AACJ,CAAC","sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type { HandleSnapRequest } from '@metamask/snaps-controllers';\nimport type { SnapId } from '@metamask/snaps-sdk';\n\ntype SnapRPCRequest = Parameters<HandleSnapRequest['handler']>[0];\n\nconst snapId = 'npm:@metamask/message-signing-snap' as SnapId;\n\n/**\n * Constructs Request to Message Signing Snap to get Public Key\n *\n * @returns Snap Public Key Request\n */\nexport function createSnapPublicKeyRequest(): SnapRPCRequest {\n  return {\n    snapId,\n    origin: '',\n    handler: 'onRpcRequest' as any,\n    request: {\n      method: 'getPublicKey',\n    },\n  };\n}\n\n/**\n * Constructs Request to get Message Signing Snap to sign a message.\n *\n * @param message - message to sign\n * @returns Snap Sign Message Request\n */\nexport function createSnapSignMessageRequest(\n  message: `metamask:${string}`,\n): SnapRPCRequest {\n  return {\n    snapId,\n    origin: '',\n    handler: 'onRpcRequest' as any,\n    request: {\n      method: 'signMessage',\n      params: { message },\n    },\n  };\n}\n"]}

package/dist/controllers/authentication/index.cjs

@@ -0,0 +1,39 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Mocks = exports.Controller = void 0;
+const AuthenticationController_1 = __importDefault(require("./AuthenticationController.cjs"));
+exports.Controller = AuthenticationController_1.default;
+const AuthenticationController = AuthenticationController_1.default;
+exports.default = AuthenticationController;
+__exportStar(require("./AuthenticationController.cjs"), exports);
+exports.Mocks = __importStar(require("./__fixtures__/index.cjs"));
+//# sourceMappingURL=index.cjs.map

package/dist/controllers/authentication/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","sourceRoot":"","sources":["../../../src/controllers/authentication/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8FAAoD;AAG3C,qBAHF,kCAAU,CAGE;AADnB,MAAM,wBAAwB,GAAG,kCAAU,CAAC;AAE5C,kBAAe,wBAAwB,CAAC;AACxC,iEAA2C;AAC3C,kEAAwC","sourcesContent":["import Controller from './AuthenticationController';\n\nconst AuthenticationController = Controller;\nexport { Controller };\nexport default AuthenticationController;\nexport * from './AuthenticationController';\nexport * as Mocks from './__fixtures__';\n"]}

package/dist/controllers/authentication/index.d.cts

@@ -0,0 +1,7 @@
+import Controller from "./AuthenticationController.cjs";
+declare const AuthenticationController: typeof Controller;
+export { Controller };
+export default AuthenticationController;
+export * from "./AuthenticationController.cjs";
+export * as Mocks from "./__fixtures__/index.cjs";
+//# sourceMappingURL=index.d.cts.map

package/dist/controllers/authentication/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","sourceRoot":"","sources":["../../../src/controllers/authentication/index.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,uCAAmC;AAEpD,QAAA,MAAM,wBAAwB,mBAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,CAAC;AACtB,eAAe,wBAAwB,CAAC;AACxC,+CAA2C;AAC3C,OAAO,KAAK,KAAK,iCAAuB"}

package/dist/controllers/authentication/index.d.mts

@@ -0,0 +1,7 @@
+import Controller from "./AuthenticationController.mjs";
+declare const AuthenticationController: typeof Controller;
+export { Controller };
+export default AuthenticationController;
+export * from "./AuthenticationController.mjs";
+export * as Mocks from "./__fixtures__/index.mjs";
+//# sourceMappingURL=index.d.mts.map

package/dist/controllers/authentication/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../../src/controllers/authentication/index.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,uCAAmC;AAEpD,QAAA,MAAM,wBAAwB,mBAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,CAAC;AACtB,eAAe,wBAAwB,CAAC;AACxC,+CAA2C;AAC3C,OAAO,KAAK,KAAK,iCAAuB"}

package/dist/controllers/authentication/index.mjs

@@ -1,19 +1,7 @@
-import {
-  authentication_default,
-  fixtures_exports
-} from "../../chunk-UHP2Y32K.mjs";
-import {
-  AuthenticationController,
-  defaultState
-} from "../../chunk-D4SNJOID.mjs";
-import "../../chunk-LGXQBALM.mjs";
-import "../../chunk-NMIF3LSX.mjs";
-import "../../chunk-KTCSRECK.mjs";
-import "../../chunk-U5UIDVOO.mjs";
-export {
-  AuthenticationController as Controller,
-  fixtures_exports as Mocks,
-  authentication_default as default,
-  defaultState
-};
+import Controller from "./AuthenticationController.mjs";
+const AuthenticationController = Controller;
+export { Controller };
+export default AuthenticationController;
+export * from "./AuthenticationController.mjs";
+export * as Mocks from "./__fixtures__/index.mjs";
 //# sourceMappingURL=index.mjs.map

package/dist/controllers/authentication/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../src/controllers/authentication/index.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,uCAAmC;AAEpD,MAAM,wBAAwB,GAAG,UAAU,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,CAAC;AACtB,eAAe,wBAAwB,CAAC;AACxC,+CAA2C;AAC3C,OAAO,KAAK,KAAK,iCAAuB","sourcesContent":["import Controller from './AuthenticationController';\n\nconst AuthenticationController = Controller;\nexport { Controller };\nexport default AuthenticationController;\nexport * from './AuthenticationController';\nexport * as Mocks from './__fixtures__';\n"]}

package/dist/controllers/authentication/services.cjs

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createLoginRawMessage = exports.getAccessToken = exports.login = exports.getNonce = exports.OIDC_TOKENS_ENDPOINT = exports.AUTH_LOGIN_ENDPOINT = exports.AUTH_NONCE_ENDPOINT = void 0;
+const env_1 = require("../../sdk/env.cjs");
+const ENV_URLS = (0, env_1.getEnvUrls)(env_1.Env.PRD);
+const AUTH_ENDPOINT = ENV_URLS.authApiUrl;
+exports.AUTH_NONCE_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/nonce`;
+exports.AUTH_LOGIN_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/srp/login`;
+const OIDC_ENDPOINT = ENV_URLS.oidcApiUrl || '';
+exports.OIDC_TOKENS_ENDPOINT = `${OIDC_ENDPOINT}/oauth2/token`;
+const OIDC_CLIENT_ID = (platform) => {
+    if (platform === 'extension') {
+        return (0, env_1.getOidcClientId)(env_1.Env.PRD, env_1.Platform.EXTENSION);
+    }
+    if (platform === 'mobile') {
+        return (0, env_1.getOidcClientId)(env_1.Env.PRD, env_1.Platform.MOBILE);
+    }
+    throw new Error(`Unsupported platform - ${platform}`);
+};
+const OIDC_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
+/**
+ * Auth Service - Get Nonce. Used for the initial JWTBearer flow
+ *
+ * @param publicKey - public key to associate a nonce with
+ * @returns the nonce or null if failed
+ */
+async function getNonce(publicKey) {
+    const nonceUrl = new URL(exports.AUTH_NONCE_ENDPOINT);
+    nonceUrl.searchParams.set('identifier', publicKey);
+    try {
+        const nonceResponse = await fetch(nonceUrl.toString());
+        if (!nonceResponse.ok) {
+            return null;
+        }
+        const nonceJson = await nonceResponse.json();
+        return nonceJson?.nonce ?? null;
+    }
+    catch (e) {
+        console.error('authentication-controller/services: unable to get nonce', e);
+        return null;
+    }
+}
+exports.getNonce = getNonce;
+/**
+ * Auth Service - Login. Will perform login with a given signature and will return a single use JWT Token.
+ *
+ * @param rawMessage - the original message before signing
+ * @param signature - the signed message
+ * @param clientMetaMetrics - optional client metametrics id (to associate on backend)
+ * @returns The Login Response
+ */
+async function login(rawMessage, signature, clientMetaMetrics) {
+    try {
+        const response = await fetch(exports.AUTH_LOGIN_ENDPOINT, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                signature,
+                // eslint-disable-next-line @typescript-eslint/naming-convention
+                raw_message: rawMessage,
+                metametrics: {
+                    // eslint-disable-next-line @typescript-eslint/naming-convention
+                    metametrics_id: clientMetaMetrics.metametricsId,
+                    agent: clientMetaMetrics.agent,
+                },
+            }),
+        });
+        if (!response.ok) {
+            return null;
+        }
+        const loginResponse = await response.json();
+        return loginResponse ?? null;
+    }
+    catch (e) {
+        console.error('authentication-controller/services: unable to login', e);
+        return null;
+    }
+}
+exports.login = login;
+/**
+ * OIDC Service - Access Token. Trades the Auth Token for an access token (to be used for other authenticated endpoints)
+ * NOTE - the access token is short lived, which means it is best practice to validate session before calling authenticated endpoints
+ *
+ * @param jwtToken - the JWT Auth Token, received from `/login`
+ * @param platform - the OIDC platform to retrieve access token
+ * @returns JWT Access token to store and use on authorized endpoints.
+ */
+async function getAccessToken(jwtToken, platform) {
+    const headers = new Headers({
+        'Content-Type': 'application/x-www-form-urlencoded',
+    });
+    const urlEncodedBody = new URLSearchParams();
+    urlEncodedBody.append('grant_type', OIDC_GRANT_TYPE);
+    urlEncodedBody.append('client_id', OIDC_CLIENT_ID(platform));
+    urlEncodedBody.append('assertion', jwtToken);
+    try {
+        const response = await fetch(exports.OIDC_TOKENS_ENDPOINT, {
+            method: 'POST',
+            headers,
+            body: urlEncodedBody.toString(),
+        });
+        if (!response.ok) {
+            return null;
+        }
+        const accessTokenResponse = await response.json();
+        return accessTokenResponse?.access_token ?? null;
+    }
+    catch (e) {
+        console.error('authentication-controller/services: unable to get access token', e);
+        return null;
+    }
+}
+exports.getAccessToken = getAccessToken;
+/**
+ * Utility to create the raw login message for the JWT bearer flow (via SRP)
+ *
+ * @param nonce - nonce received from `/nonce` endpoint
+ * @param publicKey - public key used to retrieve nonce and for message signing
+ * @returns Raw Message which will be used for signing & logging in.
+ */
+function createLoginRawMessage(nonce, publicKey) {
+    return `metamask:${nonce}:${publicKey}`;
+}
+exports.createLoginRawMessage = createLoginRawMessage;
+//# sourceMappingURL=services.cjs.map

package/dist/controllers/authentication/services.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.cjs","sourceRoot":"","sources":["../../../src/controllers/authentication/services.ts"],"names":[],"mappings":";;;AAAA,2CAA2E;AAE3E,MAAM,QAAQ,GAAG,IAAA,gBAAU,EAAC,SAAG,CAAC,GAAG,CAAC,CAAC;AAErC,MAAM,aAAa,GAAW,QAAQ,CAAC,UAAU,CAAC;AACrC,QAAA,mBAAmB,GAAG,GAAG,aAAa,eAAe,CAAC;AACtD,QAAA,mBAAmB,GAAG,GAAG,aAAa,mBAAmB,CAAC;AAEvE,MAAM,aAAa,GAAW,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;AAC3C,QAAA,oBAAoB,GAAG,GAAG,aAAa,eAAe,CAAC;AACpE,MAAM,cAAc,GAAG,CAAC,QAAgC,EAAE,EAAE;IAC1D,IAAI,QAAQ,KAAK,WAAW,EAAE;QAC5B,OAAO,IAAA,qBAAe,EAAC,SAAG,CAAC,GAAG,EAAE,cAAQ,CAAC,SAAS,CAAC,CAAC;KACrD;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE;QACzB,OAAO,IAAA,qBAAe,EAAC,SAAG,CAAC,GAAG,EAAE,cAAQ,CAAC,MAAM,CAAC,CAAC;KAClD;IAED,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAkB,EAAE,CAAC,CAAC;AAClE,CAAC,CAAC;AACF,MAAM,eAAe,GAAG,6CAA6C,CAAC;AAMtE;;;;;GAKG;AACI,KAAK,UAAU,QAAQ,CAAC,SAAiB;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,2BAAmB,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAEnD,IAAI;QACF,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;YACrB,OAAO,IAAI,CAAC;SACb;QAED,MAAM,SAAS,GAAkB,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QAC5D,OAAO,SAAS,EAAE,KAAK,IAAI,IAAI,CAAC;KACjC;IAAC,OAAO,CAAC,EAAE;QACV,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE,CAAC,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;KACb;AACH,CAAC;AAhBD,4BAgBC;AA6BD;;;;;;;GAOG;AACI,KAAK,UAAU,KAAK,CACzB,UAAkB,EAClB,SAAiB,EACjB,iBAAoC;IAEpC,IAAI;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,2BAAmB,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS;gBACT,gEAAgE;gBAChE,WAAW,EAAE,UAAU;gBACvB,WAAW,EAAE;oBACX,gEAAgE;oBAChE,cAAc,EAAE,iBAAiB,CAAC,aAAa;oBAC/C,KAAK,EAAE,iBAAiB,CAAC,KAAK;iBAC/B;aACF,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAChB,OAAO,IAAI,CAAC;SACb;QAED,MAAM,aAAa,GAAkB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3D,OAAO,aAAa,IAAI,IAAI,CAAC;KAC9B;IAAC,OAAO,CAAC,EAAE;QACV,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;KACb;AACH,CAAC;AAjCD,sBAiCC;AAYD;;;;;;;GAOG;AACI,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,QAAoC;IAEpC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,cAAc,EAAE,mCAAmC;KACpD,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,eAAe,EAAE,CAAC;IAC7C,cAAc,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACrD,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE7C,IAAI;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,4BAAoB,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAChB,OAAO,IAAI,CAAC;SACb;QAED,MAAM,mBAAmB,GAAuB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtE,OAAO,mBAAmB,EAAE,YAAY,IAAI,IAAI,CAAC;KAClD;IAAC,OAAO,CAAC,EAAE;QACV,OAAO,CAAC,KAAK,CACX,gEAAgE,EAChE,CAAC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;KACb;AACH,CAAC;AAjCD,wCAiCC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CACnC,KAAa,EACb,SAAiB;IAEjB,OAAO,YAAY,KAAK,IAAI,SAAS,EAAW,CAAC;AACnD,CAAC;AALD,sDAKC","sourcesContent":["import { Env, Platform, getEnvUrls, getOidcClientId } from '../../sdk/env';\n\nconst ENV_URLS = getEnvUrls(Env.PRD);\n\nconst AUTH_ENDPOINT: string = ENV_URLS.authApiUrl;\nexport const AUTH_NONCE_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/nonce`;\nexport const AUTH_LOGIN_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/srp/login`;\n\nconst OIDC_ENDPOINT: string = ENV_URLS.oidcApiUrl || '';\nexport const OIDC_TOKENS_ENDPOINT = `${OIDC_ENDPOINT}/oauth2/token`;\nconst OIDC_CLIENT_ID = (platform: 'mobile' | 'extension') => {\n  if (platform === 'extension') {\n    return getOidcClientId(Env.PRD, Platform.EXTENSION);\n  }\n  if (platform === 'mobile') {\n    return getOidcClientId(Env.PRD, Platform.MOBILE);\n  }\n\n  throw new Error(`Unsupported platform - ${platform as string}`);\n};\nconst OIDC_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:jwt-bearer';\n\nexport type NonceResponse = {\n  nonce: string;\n};\n\n/**\n * Auth Service - Get Nonce. Used for the initial JWTBearer flow\n *\n * @param publicKey - public key to associate a nonce with\n * @returns the nonce or null if failed\n */\nexport async function getNonce(publicKey: string): Promise<string | null> {\n  const nonceUrl = new URL(AUTH_NONCE_ENDPOINT);\n  nonceUrl.searchParams.set('identifier', publicKey);\n\n  try {\n    const nonceResponse = await fetch(nonceUrl.toString());\n    if (!nonceResponse.ok) {\n      return null;\n    }\n\n    const nonceJson: NonceResponse = await nonceResponse.json();\n    return nonceJson?.nonce ?? null;\n  } catch (e) {\n    console.error('authentication-controller/services: unable to get nonce', e);\n    return null;\n  }\n}\n\n/**\n * The Login API Server Response Shape\n */\nexport type LoginResponse = {\n  token: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  expires_in: string;\n  /**\n   * Contains anonymous information about the logged in profile.\n   *\n   * @property identifier_id - a deterministic unique identifier on the method used to sign in\n   * @property profile_id - a unique id for a given profile\n   * @property metametrics_id - an anonymous server id\n   */\n  profile: {\n    // eslint-disable-next-line @typescript-eslint/naming-convention\n    identifier_id: string;\n    // eslint-disable-next-line @typescript-eslint/naming-convention\n    profile_id: string;\n  };\n};\n\ntype ClientMetaMetrics = {\n  metametricsId: string;\n  agent: 'extension' | 'mobile';\n};\n\n/**\n * Auth Service - Login. Will perform login with a given signature and will return a single use JWT Token.\n *\n * @param rawMessage - the original message before signing\n * @param signature - the signed message\n * @param clientMetaMetrics - optional client metametrics id (to associate on backend)\n * @returns The Login Response\n */\nexport async function login(\n  rawMessage: string,\n  signature: string,\n  clientMetaMetrics: ClientMetaMetrics,\n): Promise<LoginResponse | null> {\n  try {\n    const response = await fetch(AUTH_LOGIN_ENDPOINT, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify({\n        signature,\n        // eslint-disable-next-line @typescript-eslint/naming-convention\n        raw_message: rawMessage,\n        metametrics: {\n          // eslint-disable-next-line @typescript-eslint/naming-convention\n          metametrics_id: clientMetaMetrics.metametricsId,\n          agent: clientMetaMetrics.agent,\n        },\n      }),\n    });\n\n    if (!response.ok) {\n      return null;\n    }\n\n    const loginResponse: LoginResponse = await response.json();\n    return loginResponse ?? null;\n  } catch (e) {\n    console.error('authentication-controller/services: unable to login', e);\n    return null;\n  }\n}\n\n/**\n * The Auth API Token Response Shape\n */\nexport type OAuthTokenResponse = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  access_token: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  expires_in: number;\n};\n\n/**\n * OIDC Service - Access Token. Trades the Auth Token for an access token (to be used for other authenticated endpoints)\n * NOTE - the access token is short lived, which means it is best practice to validate session before calling authenticated endpoints\n *\n * @param jwtToken - the JWT Auth Token, received from `/login`\n * @param platform - the OIDC platform to retrieve access token\n * @returns JWT Access token to store and use on authorized endpoints.\n */\nexport async function getAccessToken(\n  jwtToken: string,\n  platform: ClientMetaMetrics['agent'],\n): Promise<string | null> {\n  const headers = new Headers({\n    'Content-Type': 'application/x-www-form-urlencoded',\n  });\n\n  const urlEncodedBody = new URLSearchParams();\n  urlEncodedBody.append('grant_type', OIDC_GRANT_TYPE);\n  urlEncodedBody.append('client_id', OIDC_CLIENT_ID(platform));\n  urlEncodedBody.append('assertion', jwtToken);\n\n  try {\n    const response = await fetch(OIDC_TOKENS_ENDPOINT, {\n      method: 'POST',\n      headers,\n      body: urlEncodedBody.toString(),\n    });\n\n    if (!response.ok) {\n      return null;\n    }\n\n    const accessTokenResponse: OAuthTokenResponse = await response.json();\n    return accessTokenResponse?.access_token ?? null;\n  } catch (e) {\n    console.error(\n      'authentication-controller/services: unable to get access token',\n      e,\n    );\n    return null;\n  }\n}\n\n/**\n * Utility to create the raw login message for the JWT bearer flow (via SRP)\n *\n * @param nonce - nonce received from `/nonce` endpoint\n * @param publicKey - public key used to retrieve nonce and for message signing\n * @returns Raw Message which will be used for signing & logging in.\n */\nexport function createLoginRawMessage(\n  nonce: string,\n  publicKey: string,\n): `metamask:${string}:${string}` {\n  return `metamask:${nonce}:${publicKey}` as const;\n}\n"]}

package/dist/{types/controllers/authentication/services.d.ts → controllers/authentication/services.d.cts}

@@ -67,4 +67,4 @@ export declare function getAccessToken(jwtToken: string, platform: ClientMetaMet
  */
 export declare function createLoginRawMessage(nonce: string, publicKey: string): `metamask:${string}:${string}`;
 export {};
-//# sourceMappingURL=services.d.ts.map
+//# sourceMappingURL=services.d.cts.map

package/dist/controllers/authentication/services.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.cts","sourceRoot":"","sources":["../../../src/controllers/authentication/services.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,mBAAmB,QAAkC,CAAC;AACnE,eAAO,MAAM,mBAAmB,QAAsC,CAAC;AAGvE,eAAO,MAAM,oBAAoB,QAAkC,CAAC;AAapE,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBxE;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAC;IAEd,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,OAAO,EAAE;QAEP,aAAa,EAAE,MAAM,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,WAAW,GAAG,QAAQ,CAAC;CAC/B,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,KAAK,CACzB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,iBAAiB,GACnC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA6B/B;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAE/B,YAAY,EAAE,MAAM,CAAC;IAErB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA8BxB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,YAAY,MAAM,IAAI,MAAM,EAAE,CAEhC"}

package/dist/controllers/authentication/services.d.mts

@@ -0,0 +1,70 @@
+export declare const AUTH_NONCE_ENDPOINT: string;
+export declare const AUTH_LOGIN_ENDPOINT: string;
+export declare const OIDC_TOKENS_ENDPOINT: string;
+export type NonceResponse = {
+    nonce: string;
+};
+/**
+ * Auth Service - Get Nonce. Used for the initial JWTBearer flow
+ *
+ * @param publicKey - public key to associate a nonce with
+ * @returns the nonce or null if failed
+ */
+export declare function getNonce(publicKey: string): Promise<string | null>;
+/**
+ * The Login API Server Response Shape
+ */
+export type LoginResponse = {
+    token: string;
+    expires_in: string;
+    /**
+     * Contains anonymous information about the logged in profile.
+     *
+     * @property identifier_id - a deterministic unique identifier on the method used to sign in
+     * @property profile_id - a unique id for a given profile
+     * @property metametrics_id - an anonymous server id
+     */
+    profile: {
+        identifier_id: string;
+        profile_id: string;
+    };
+};
+type ClientMetaMetrics = {
+    metametricsId: string;
+    agent: 'extension' | 'mobile';
+};
+/**
+ * Auth Service - Login. Will perform login with a given signature and will return a single use JWT Token.
+ *
+ * @param rawMessage - the original message before signing
+ * @param signature - the signed message
+ * @param clientMetaMetrics - optional client metametrics id (to associate on backend)
+ * @returns The Login Response
+ */
+export declare function login(rawMessage: string, signature: string, clientMetaMetrics: ClientMetaMetrics): Promise<LoginResponse | null>;
+/**
+ * The Auth API Token Response Shape
+ */
+export type OAuthTokenResponse = {
+    access_token: string;
+    expires_in: number;
+};
+/**
+ * OIDC Service - Access Token. Trades the Auth Token for an access token (to be used for other authenticated endpoints)
+ * NOTE - the access token is short lived, which means it is best practice to validate session before calling authenticated endpoints
+ *
+ * @param jwtToken - the JWT Auth Token, received from `/login`
+ * @param platform - the OIDC platform to retrieve access token
+ * @returns JWT Access token to store and use on authorized endpoints.
+ */
+export declare function getAccessToken(jwtToken: string, platform: ClientMetaMetrics['agent']): Promise<string | null>;
+/**
+ * Utility to create the raw login message for the JWT bearer flow (via SRP)
+ *
+ * @param nonce - nonce received from `/nonce` endpoint
+ * @param publicKey - public key used to retrieve nonce and for message signing
+ * @returns Raw Message which will be used for signing & logging in.
+ */
+export declare function createLoginRawMessage(nonce: string, publicKey: string): `metamask:${string}:${string}`;
+export {};
+//# sourceMappingURL=services.d.mts.map

package/dist/controllers/authentication/services.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.mts","sourceRoot":"","sources":["../../../src/controllers/authentication/services.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,mBAAmB,QAAkC,CAAC;AACnE,eAAO,MAAM,mBAAmB,QAAsC,CAAC;AAGvE,eAAO,MAAM,oBAAoB,QAAkC,CAAC;AAapE,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBxE;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAC;IAEd,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,OAAO,EAAE;QAEP,aAAa,EAAE,MAAM,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,WAAW,GAAG,QAAQ,CAAC;CAC/B,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,KAAK,CACzB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,iBAAiB,GACnC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA6B/B;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAE/B,YAAY,EAAE,MAAM,CAAC;IAErB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA8BxB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,YAAY,MAAM,IAAI,MAAM,EAAE,CAEhC"}

package/dist/controllers/authentication/services.mjs

@@ -1,21 +1,120 @@
-import {
-  AUTH_LOGIN_ENDPOINT,
-  AUTH_NONCE_ENDPOINT,
-  OIDC_TOKENS_ENDPOINT,
-  createLoginRawMessage,
-  getAccessToken,
-  getNonce,
-  login
-} from "../../chunk-LGXQBALM.mjs";
-import "../../chunk-KTCSRECK.mjs";
-import "../../chunk-U5UIDVOO.mjs";
-export {
-  AUTH_LOGIN_ENDPOINT,
-  AUTH_NONCE_ENDPOINT,
-  OIDC_TOKENS_ENDPOINT,
-  createLoginRawMessage,
-  getAccessToken,
-  getNonce,
-  login
+import { Env, Platform, getEnvUrls, getOidcClientId } from "../../sdk/env.mjs";
+const ENV_URLS = getEnvUrls(Env.PRD);
+const AUTH_ENDPOINT = ENV_URLS.authApiUrl;
+export const AUTH_NONCE_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/nonce`;
+export const AUTH_LOGIN_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/srp/login`;
+const OIDC_ENDPOINT = ENV_URLS.oidcApiUrl || '';
+export const OIDC_TOKENS_ENDPOINT = `${OIDC_ENDPOINT}/oauth2/token`;
+const OIDC_CLIENT_ID = (platform) => {
+    if (platform === 'extension') {
+        return getOidcClientId(Env.PRD, Platform.EXTENSION);
+    }
+    if (platform === 'mobile') {
+        return getOidcClientId(Env.PRD, Platform.MOBILE);
+    }
+    throw new Error(`Unsupported platform - ${platform}`);
 };
+const OIDC_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
+/**
+ * Auth Service - Get Nonce. Used for the initial JWTBearer flow
+ *
+ * @param publicKey - public key to associate a nonce with
+ * @returns the nonce or null if failed
+ */
+export async function getNonce(publicKey) {
+    const nonceUrl = new URL(AUTH_NONCE_ENDPOINT);
+    nonceUrl.searchParams.set('identifier', publicKey);
+    try {
+        const nonceResponse = await fetch(nonceUrl.toString());
+        if (!nonceResponse.ok) {
+            return null;
+        }
+        const nonceJson = await nonceResponse.json();
+        return nonceJson?.nonce ?? null;
+    }
+    catch (e) {
+        console.error('authentication-controller/services: unable to get nonce', e);
+        return null;
+    }
+}
+/**
+ * Auth Service - Login. Will perform login with a given signature and will return a single use JWT Token.
+ *
+ * @param rawMessage - the original message before signing
+ * @param signature - the signed message
+ * @param clientMetaMetrics - optional client metametrics id (to associate on backend)
+ * @returns The Login Response
+ */
+export async function login(rawMessage, signature, clientMetaMetrics) {
+    try {
+        const response = await fetch(AUTH_LOGIN_ENDPOINT, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                signature,
+                // eslint-disable-next-line @typescript-eslint/naming-convention
+                raw_message: rawMessage,
+                metametrics: {
+                    // eslint-disable-next-line @typescript-eslint/naming-convention
+                    metametrics_id: clientMetaMetrics.metametricsId,
+                    agent: clientMetaMetrics.agent,
+                },
+            }),
+        });
+        if (!response.ok) {
+            return null;
+        }
+        const loginResponse = await response.json();
+        return loginResponse ?? null;
+    }
+    catch (e) {
+        console.error('authentication-controller/services: unable to login', e);
+        return null;
+    }
+}
+/**
+ * OIDC Service - Access Token. Trades the Auth Token for an access token (to be used for other authenticated endpoints)
+ * NOTE - the access token is short lived, which means it is best practice to validate session before calling authenticated endpoints
+ *
+ * @param jwtToken - the JWT Auth Token, received from `/login`
+ * @param platform - the OIDC platform to retrieve access token
+ * @returns JWT Access token to store and use on authorized endpoints.
+ */
+export async function getAccessToken(jwtToken, platform) {
+    const headers = new Headers({
+        'Content-Type': 'application/x-www-form-urlencoded',
+    });
+    const urlEncodedBody = new URLSearchParams();
+    urlEncodedBody.append('grant_type', OIDC_GRANT_TYPE);
+    urlEncodedBody.append('client_id', OIDC_CLIENT_ID(platform));
+    urlEncodedBody.append('assertion', jwtToken);
+    try {
+        const response = await fetch(OIDC_TOKENS_ENDPOINT, {
+            method: 'POST',
+            headers,
+            body: urlEncodedBody.toString(),
+        });
+        if (!response.ok) {
+            return null;
+        }
+        const accessTokenResponse = await response.json();
+        return accessTokenResponse?.access_token ?? null;
+    }
+    catch (e) {
+        console.error('authentication-controller/services: unable to get access token', e);
+        return null;
+    }
+}
+/**
+ * Utility to create the raw login message for the JWT bearer flow (via SRP)
+ *
+ * @param nonce - nonce received from `/nonce` endpoint
+ * @param publicKey - public key used to retrieve nonce and for message signing
+ * @returns Raw Message which will be used for signing & logging in.
+ */
+export function createLoginRawMessage(nonce, publicKey) {
+    return `metamask:${nonce}:${publicKey}`;
+}
 //# sourceMappingURL=services.mjs.map

package/dist/controllers/authentication/services.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"file":"services.mjs","sourceRoot":"","sources":["../../../src/controllers/authentication/services.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,0BAAsB;AAE3E,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAErC,MAAM,aAAa,GAAW,QAAQ,CAAC,UAAU,CAAC;AAClD,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,aAAa,eAAe,CAAC;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,aAAa,mBAAmB,CAAC;AAEvE,MAAM,aAAa,GAAW,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,aAAa,eAAe,CAAC;AACpE,MAAM,cAAc,GAAG,CAAC,QAAgC,EAAE,EAAE;IAC1D,IAAI,QAAQ,KAAK,WAAW,EAAE;QAC5B,OAAO,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;KACrD;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE;QACzB,OAAO,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;KAClD;IAED,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAkB,EAAE,CAAC,CAAC;AAClE,CAAC,CAAC;AACF,MAAM,eAAe,GAAG,6CAA6C,CAAC;AAMtE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,SAAiB;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAEnD,IAAI;QACF,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;YACrB,OAAO,IAAI,CAAC;SACb;QAED,MAAM,SAAS,GAAkB,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QAC5D,OAAO,SAAS,EAAE,KAAK,IAAI,IAAI,CAAC;KACjC;IAAC,OAAO,CAAC,EAAE;QACV,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE,CAAC,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;KACb;AACH,CAAC;AA6BD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,UAAkB,EAClB,SAAiB,EACjB,iBAAoC;IAEpC,IAAI;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS;gBACT,gEAAgE;gBAChE,WAAW,EAAE,UAAU;gBACvB,WAAW,EAAE;oBACX,gEAAgE;oBAChE,cAAc,EAAE,iBAAiB,CAAC,aAAa;oBAC/C,KAAK,EAAE,iBAAiB,CAAC,KAAK;iBAC/B;aACF,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAChB,OAAO,IAAI,CAAC;SACb;QAED,MAAM,aAAa,GAAkB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3D,OAAO,aAAa,IAAI,IAAI,CAAC;KAC9B;IAAC,OAAO,CAAC,EAAE;QACV,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;KACb;AACH,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,QAAoC;IAEpC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,cAAc,EAAE,mCAAmC;KACpD,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,eAAe,EAAE,CAAC;IAC7C,cAAc,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACrD,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE7C,IAAI;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAChB,OAAO,IAAI,CAAC;SACb;QAED,MAAM,mBAAmB,GAAuB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtE,OAAO,mBAAmB,EAAE,YAAY,IAAI,IAAI,CAAC;KAClD;IAAC,OAAO,CAAC,EAAE;QACV,OAAO,CAAC,KAAK,CACX,gEAAgE,EAChE,CAAC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;KACb;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,SAAiB;IAEjB,OAAO,YAAY,KAAK,IAAI,SAAS,EAAW,CAAC;AACnD,CAAC","sourcesContent":["import { Env, Platform, getEnvUrls, getOidcClientId } from '../../sdk/env';\n\nconst ENV_URLS = getEnvUrls(Env.PRD);\n\nconst AUTH_ENDPOINT: string = ENV_URLS.authApiUrl;\nexport const AUTH_NONCE_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/nonce`;\nexport const AUTH_LOGIN_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/srp/login`;\n\nconst OIDC_ENDPOINT: string = ENV_URLS.oidcApiUrl || '';\nexport const OIDC_TOKENS_ENDPOINT = `${OIDC_ENDPOINT}/oauth2/token`;\nconst OIDC_CLIENT_ID = (platform: 'mobile' | 'extension') => {\n  if (platform === 'extension') {\n    return getOidcClientId(Env.PRD, Platform.EXTENSION);\n  }\n  if (platform === 'mobile') {\n    return getOidcClientId(Env.PRD, Platform.MOBILE);\n  }\n\n  throw new Error(`Unsupported platform - ${platform as string}`);\n};\nconst OIDC_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:jwt-bearer';\n\nexport type NonceResponse = {\n  nonce: string;\n};\n\n/**\n * Auth Service - Get Nonce. Used for the initial JWTBearer flow\n *\n * @param publicKey - public key to associate a nonce with\n * @returns the nonce or null if failed\n */\nexport async function getNonce(publicKey: string): Promise<string | null> {\n  const nonceUrl = new URL(AUTH_NONCE_ENDPOINT);\n  nonceUrl.searchParams.set('identifier', publicKey);\n\n  try {\n    const nonceResponse = await fetch(nonceUrl.toString());\n    if (!nonceResponse.ok) {\n      return null;\n    }\n\n    const nonceJson: NonceResponse = await nonceResponse.json();\n    return nonceJson?.nonce ?? null;\n  } catch (e) {\n    console.error('authentication-controller/services: unable to get nonce', e);\n    return null;\n  }\n}\n\n/**\n * The Login API Server Response Shape\n */\nexport type LoginResponse = {\n  token: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  expires_in: string;\n  /**\n   * Contains anonymous information about the logged in profile.\n   *\n   * @property identifier_id - a deterministic unique identifier on the method used to sign in\n   * @property profile_id - a unique id for a given profile\n   * @property metametrics_id - an anonymous server id\n   */\n  profile: {\n    // eslint-disable-next-line @typescript-eslint/naming-convention\n    identifier_id: string;\n    // eslint-disable-next-line @typescript-eslint/naming-convention\n    profile_id: string;\n  };\n};\n\ntype ClientMetaMetrics = {\n  metametricsId: string;\n  agent: 'extension' | 'mobile';\n};\n\n/**\n * Auth Service - Login. Will perform login with a given signature and will return a single use JWT Token.\n *\n * @param rawMessage - the original message before signing\n * @param signature - the signed message\n * @param clientMetaMetrics - optional client metametrics id (to associate on backend)\n * @returns The Login Response\n */\nexport async function login(\n  rawMessage: string,\n  signature: string,\n  clientMetaMetrics: ClientMetaMetrics,\n): Promise<LoginResponse | null> {\n  try {\n    const response = await fetch(AUTH_LOGIN_ENDPOINT, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify({\n        signature,\n        // eslint-disable-next-line @typescript-eslint/naming-convention\n        raw_message: rawMessage,\n        metametrics: {\n          // eslint-disable-next-line @typescript-eslint/naming-convention\n          metametrics_id: clientMetaMetrics.metametricsId,\n          agent: clientMetaMetrics.agent,\n        },\n      }),\n    });\n\n    if (!response.ok) {\n      return null;\n    }\n\n    const loginResponse: LoginResponse = await response.json();\n    return loginResponse ?? null;\n  } catch (e) {\n    console.error('authentication-controller/services: unable to login', e);\n    return null;\n  }\n}\n\n/**\n * The Auth API Token Response Shape\n */\nexport type OAuthTokenResponse = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  access_token: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  expires_in: number;\n};\n\n/**\n * OIDC Service - Access Token. Trades the Auth Token for an access token (to be used for other authenticated endpoints)\n * NOTE - the access token is short lived, which means it is best practice to validate session before calling authenticated endpoints\n *\n * @param jwtToken - the JWT Auth Token, received from `/login`\n * @param platform - the OIDC platform to retrieve access token\n * @returns JWT Access token to store and use on authorized endpoints.\n */\nexport async function getAccessToken(\n  jwtToken: string,\n  platform: ClientMetaMetrics['agent'],\n): Promise<string | null> {\n  const headers = new Headers({\n    'Content-Type': 'application/x-www-form-urlencoded',\n  });\n\n  const urlEncodedBody = new URLSearchParams();\n  urlEncodedBody.append('grant_type', OIDC_GRANT_TYPE);\n  urlEncodedBody.append('client_id', OIDC_CLIENT_ID(platform));\n  urlEncodedBody.append('assertion', jwtToken);\n\n  try {\n    const response = await fetch(OIDC_TOKENS_ENDPOINT, {\n      method: 'POST',\n      headers,\n      body: urlEncodedBody.toString(),\n    });\n\n    if (!response.ok) {\n      return null;\n    }\n\n    const accessTokenResponse: OAuthTokenResponse = await response.json();\n    return accessTokenResponse?.access_token ?? null;\n  } catch (e) {\n    console.error(\n      'authentication-controller/services: unable to get access token',\n      e,\n    );\n    return null;\n  }\n}\n\n/**\n * Utility to create the raw login message for the JWT bearer flow (via SRP)\n *\n * @param nonce - nonce received from `/nonce` endpoint\n * @param publicKey - public key used to retrieve nonce and for message signing\n * @returns Raw Message which will be used for signing & logging in.\n */\nexport function createLoginRawMessage(\n  nonce: string,\n  publicKey: string,\n): `metamask:${string}:${string}` {\n  return `metamask:${nonce}:${publicKey}` as const;\n}\n"]}