@metamask/profile-sync-controller 28.1.1 → 28.3.0

package/dist/controllers/authentication/AuthenticationController.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController.mjs","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAsB3D,OAAO,EACL,+BAA+B,EAC/B,QAAQ,EACR,GAAG,EACH,aAAa,EACd,4BAAkB;AAEnB,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,EAC7B,iCAA6B;AAG9B,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAmBlD,MAAM,CAAC,MAAM,YAAY,GAAkC;IACzD,UAAU,EAAE,KAAK;IACjB,mBAAmB,EAAE,IAAI;CAC1B,CAAC;AACF,MAAM,QAAQ,GAAiD;IAC7D,UAAU,EAAE;QACV,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,mBAAmB,EAAE;QACnB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,cAAc,EAAE;QACd,sCAAsC;QACtC,kBAAkB,EAAE,CAAC,cAAc,EAAE,EAAE;YACrC,4FAA4F;YAC5F,2FAA2F;YAC3F,mEAAmE;YACnE,kEAAkE;YAClE,oDAAoD;YACpD,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,MAAM,CAC1C,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBACxC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,uBAAuB,EAAE,GACxD,KAAK,CAAC,KAAK,CAAC;gBACd,uBAAuB,CAAC,GAAG,CAAC,GAAG;oBAC7B,GAAG,KAAK;oBACR,KAAK,EAAE,uBAAuB;iBAC/B,CAAC;gBACF,OAAO,uBAAuB,CAAC;YACjC,CAAC,EACD,EAAE,CACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,KAAK;QAC7B,QAAQ,EAAE,IAAI;KACf;CACF,CAAC;AAMF,MAAM,yBAAyB,GAAG;IAChC,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,2BAA2B;IAC3B,uBAAuB;IACvB,YAAY;IACZ,uBAAuB;CACf,CAAC;AA8CX;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,cAI7C;IAiCC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GAUZ;QACC,KAAK,CAAC;YACJ,SAAS;YACT,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,KAAK,EAAE;SACrC,CAAC,CAAC;;QApDI,wDAA8B;QAE9B,iDAAoB;QAEpB,2CAA4B;YACnC,GAAG,EAAE,GAAG,CAAC,GAAG;SACb,EAAC;QAEF,+CAAc,KAAK,EAAC;QAEpB,yEAAuC;QAEvC,oEAAoE;QACpE,qEAAqE;QACrE,iDAAiD;QACjD,+DAA8B,CAAC,EAAC;QAEvB,sDAAqB;YAC5B,6BAA6B,EAAE,GAAG,EAAE;gBAClC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBACzE,uBAAA,IAAI,wCAAe,UAAU,MAAA,CAAC;gBAE9B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,0BAA0B,EAAE,GAAG,EAAE;oBACxD,uBAAA,IAAI,wCAAe,IAAI,MAAA,CAAC;gBAC1B,CAAC,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wBAAwB,EAAE,GAAG,EAAE;oBACtD,uBAAA,IAAI,wCAAe,KAAK,MAAA,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACL,CAAC;SACF,EAAC;QAyZF,0DAA+D,EAAE,EAAC;QAjYhE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,uBAAA,IAAI,oCAAW;YACb,GAAG,uBAAA,IAAI,wCAAQ;YACf,GAAG,MAAM;SACV,MAAA,CAAC;QAEF,uBAAA,IAAI,yCAAgB,WAAW,MAAA,CAAC;QAEhC,uBAAA,IAAI,kCAAS,IAAI,aAAa,CAC5B;YACE,GAAG,EAAE,uBAAA,IAAI,wCAAQ,CAAC,GAAG;YACrB,QAAQ,EAAE,WAAW,CAAC,KAAK;YAC3B,IAAI,EAAE,QAAQ,CAAC,GAAG;SACnB,EACD;YACE,OAAO,EAAE;gBACP,gBAAgB,EAAE,uBAAA,IAAI,gGAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5D,gBAAgB,EAAE,uBAAA,IAAI,8FAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3D;YACD,OAAO,EAAE;gBACP,aAAa,EAAE,uBAAA,IAAI,uFAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChD,WAAW,EAAE,uBAAA,IAAI,sFAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;aAC9C;YACD,WAAW,EAAE,uBAAA,IAAI,6CAAa;SAC/B,CACF,MAAA,CAAC;QAEF,uBAAA,IAAI,mDAAmB,CAAC,6BAA6B,EAAE,CAAC;QAExD,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,IAAI,EACJ,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAgEM,KAAK,CAAC,aAAa;QACxB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,eAAe,CAAC,CAAC;QAExC,MAAM,YAAY,GAAG,uBAAA,IAAI,4DAA4B,CAAC;QACtD,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,CAAwB,CAAC;QACzD,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,mEAAmE;QACnE,oCAAoC;QACpC,KAAK,MAAM,CAAC,eAAe,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;YACrE,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,sCAAsC;YACtC,uBAAA,IAAI,kGAA6B,MAAjC,IAAI,EAA8B,YAAY,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,uBAAA,IAAI,6EAAQ,MAAZ,IAAI,EAAS,YAAY,EAAE,YAAY,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACI,qBAAqB;QAC1B,6KAAoC,CAAC,MAAA,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAuGM,cAAc;QACnB,uBAAA,IAAI,0DAAiC,SAAS,MAAA,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;YACzB,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,cAAc,CAAC,eAAwB;QAClD,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,gBAAgB,CAAC,CAAC;QACzC,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,iBAAiB,CAC5B,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,mBAAmB,CAAC,CAAC;QAC5C,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,yBAAyB;QACpC,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,2BAA2B,CAAC,CAAC;QAEpD,MAAM,sBAAsB,GAAG,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;QACvE,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,EAAuB,sBAAsB,CAAC,CAAC;QACnD,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QAExD,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,uBAAA,IAAI,yFAAoB,MAAxB,IAAI,EAAqB,SAAS,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAcM,KAAK,CAAC,qBAAqB,CAChC,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,uBAAuB,CAAC,CAAC;QAChD,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IAC/B,CAAC;CAmEF;skBA1XC,KAAK,8DACH,eAAwB;IAExB,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;AAC/C,CAAC,sDAED,KAAK,4DACH,aAA4B,EAC5B,eAAwB;IAExB,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,6CAAa,CAAC,gBAAgB,EAAE,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1B,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG;YACjC,GAAG,aAAa;YAChB,OAAO,EAAE;gBACP,GAAG,aAAa,CAAC,OAAO;gBACxB,aAAa;aACd;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,mGAEiB,UAAkB;IAClC,IAAI,CAAC,uBAAA,IAAI,4CAAY,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,wCAAwC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,wDAED,KAAK;IACH,IAAI,uBAAA,IAAI,8DAA8B,EAAE,CAAC;QACvC,OAAO,uBAAA,IAAI,8DAA8B,CAAC;IAC5C,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,CAAwB,CAAC;IAEzD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,uBAAA,IAAI,0DAAiC,SAAS,MAAA,CAAC;IAC/C,OAAO,uBAAA,IAAI,8DAA8B,CAAC;AAC5C,CAAC,yHAoD4B,YAAoB;IAC/C,IAAI,uBAAA,IAAI,4DAA4B,KAAK,YAAY,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,2CAAS,YAAsB,EAAE,YAAoB;IACxD,MAAM,iBAAiB,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;IAE9D,MAAM,cAAc,GAAG,MAAM,uBAAA,IAAI,sFAAiB,MAArB,IAAI,EAAkB,YAAY,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;IAEzD,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IAED,uBAAA,IAAI,kGAA6B,MAAjC,IAAI,EAA8B,YAAY,CAAC,CAAC;IAEhD,MAAM,gBAAgB,GAAG,iBAAiB,KAAK,YAAY,CAAC;IAC5D,MAAM,4BAA4B,GAChC,gBAAgB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,IAAI,4BAA4B,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wCAAwC,EAAE;YAC/D,SAAS,EAAE,YAAY;YACvB,cAAc;YACd,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,8CAED,KAAK,oDAAkB,YAAsB;IAC3C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,+BAA+B;IAC3E,MAAM,EACJ,cAAc,EACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,GAChC,GAAG,MAAM,uBAAA,IAAI,sCAAM,CAAC,eAAe,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACvE,uBAAA,IAAI,yFAAoB,MAAxB,IAAI,EAAqB,kBAAkB,CAAC,CAAC;IAC7C,OAAO,cAAc,CAAC;AACxB,CAAC,uGAEmB,kBAA0B;IAC5C,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACtC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;gBACnB,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK;IACH,MAAM,sBAAsB,GAAG,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;IACvE,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,sBAAsB,CAAC,EAAE,OAAO;QAC1D,EAAE,kBAAkB,IAAI,IAAI,CAC/B,CAAC;AACJ,CAAC,2GAoFqB,eAAuB;IAC3C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;YACnB,iEAAiE;YACjE,2EAA2E;YAC3E,wEAAwE;YACxE,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,EAAE,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAeD;;;;;;GAMG;AACH,KAAK,qDAAmB,eAAwB;IAC9C,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,mBAAmB,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,0BAA0B,CAAC,eAAe,CAAC,CAC5C,CAAW,CAAC;IAEb,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK;IACH,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,uBAAuB,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,8BAA8B,EAAE,CACjC,CAAuB,CAAC;IAEzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAID;;;;;;;GAOG;AACH,KAAK,oDACH,OAAe,EACf,eAAwB;IAExB,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,kBAAkB,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,4BAA4B,CAAC,OAAO,EAAE,eAAe,CAAC,CACvD,CAAW,CAAC;IAEb,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;IAE9C,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { BaseController } from '@metamask/base-controller';\nimport type {\n  ControllerGetStateAction,\n  ControllerStateChangeEvent,\n  StateMetadata,\n} from '@metamask/base-controller';\nimport type {\n  KeyringControllerGetStateAction,\n  KeyringControllerLockEvent,\n  KeyringControllerUnlockEvent,\n} from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\nimport type { SnapControllerHandleRequestAction } from '@metamask/snaps-controllers';\nimport type { Json } from '@metamask/utils';\n\nimport type {\n  LoginResponse,\n  ProfileAlias,\n  SRPInterface,\n  UserProfile,\n  UserProfileLineage,\n} from '../../sdk';\nimport {\n  assertMessageStartsWithMetamask,\n  AuthType,\n  Env,\n  JwtBearerAuth,\n} from '../../sdk';\nimport type { MetaMetricsAuth } from '../../shared/types/services';\nimport {\n  createSnapPublicKeyRequest,\n  createSnapAllPublicKeysRequest,\n  createSnapSignMessageRequest,\n} from './auth-snap-requests';\nimport { AuthenticationControllerMethodActions } from './AuthenticationController-method-action-types';\n\nconst controllerName = 'AuthenticationController';\n\n// State\nexport type AuthenticationControllerState = {\n  isSignedIn: boolean;\n  srpSessionData?: Record<string, LoginResponse>;\n  /**\n   * Client gate for profile pairing. Defaults to `true` (fresh install /\n   * upgrade), set to `false` after a successful `performSignIn` pair, set\n   * back to `true` via `requestProfilePairing()` when the SRP set changes,\n   * and left `true` on pair failure so the next state shift retries.\n   *\n   * Optional in the type so partial-state selectors stay assignable to\n   * `AuthenticationControllerState`. The controller seeds it via\n   * `defaultState` at construction; consumers should read `undefined` as\n   * `true` to mirror that runtime default.\n   */\n  needsProfilePairing?: boolean;\n};\nexport const defaultState: AuthenticationControllerState = {\n  isSignedIn: false,\n  needsProfilePairing: true,\n};\nconst metadata: StateMetadata<AuthenticationControllerState> = {\n  isSignedIn: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  needsProfilePairing: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  srpSessionData: {\n    // Remove access token from state logs\n    includeInStateLogs: (srpSessionData) => {\n      // Unreachable branch, included just to fix a type error for the case where this property is\n      // unset. The type gets collapsed to include `| undefined` even though `undefined` is never\n      // set here, because we don't yet use `exactOptionalPropertyTypes`.\n      // TODO: Remove branch after enabling `exactOptionalPropertyTypes`\n      // ref: https://github.com/MetaMask/core/issues/6565\n      if (srpSessionData === null || srpSessionData === undefined) {\n        return null;\n      }\n      return Object.entries(srpSessionData).reduce<Record<string, Json>>(\n        (sanitizedSrpSessionData, [key, value]) => {\n          const { accessToken: _unused, ...tokenWithoutAccessToken } =\n            value.token;\n          sanitizedSrpSessionData[key] = {\n            ...value,\n            token: tokenWithoutAccessToken,\n          };\n          return sanitizedSrpSessionData;\n        },\n        {},\n      );\n    },\n    persist: true,\n    includeInDebugSnapshot: false,\n    usedInUi: true,\n  },\n};\n\ntype ControllerConfig = {\n  env: Env;\n};\n\nconst MESSENGER_EXPOSED_METHODS = [\n  'performSignIn',\n  'performSignOut',\n  'getBearerToken',\n  'getSessionProfile',\n  'refreshCanonicalProfileId',\n  'getUserProfileLineage',\n  'isSignedIn',\n  'requestProfilePairing',\n] as const;\n\nexport type Actions =\n  | AuthenticationControllerGetStateAction\n  | AuthenticationControllerMethodActions;\n\nexport type AuthenticationControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  AuthenticationControllerState\n>;\n\nexport type AuthenticationControllerStateChangeEvent =\n  ControllerStateChangeEvent<\n    typeof controllerName,\n    AuthenticationControllerState\n  >;\n\nexport type ProfileSignInInfo = {\n  profileId: string;\n  profileAliases: ProfileAlias[];\n  profileIdChanged: boolean;\n};\n\nexport type AuthenticationControllerProfileSignInEvent = {\n  type: `${typeof controllerName}:profileSignIn`;\n  payload: [ProfileSignInInfo];\n};\n\nexport type Events =\n  | AuthenticationControllerStateChangeEvent\n  | AuthenticationControllerProfileSignInEvent;\n\n// Allowed Actions\ntype AllowedActions =\n  | KeyringControllerGetStateAction\n  | SnapControllerHandleRequestAction;\n\ntype AllowedEvents = KeyringControllerLockEvent | KeyringControllerUnlockEvent;\n\n// Messenger\nexport type AuthenticationControllerMessenger = Messenger<\n  typeof controllerName,\n  Actions | AllowedActions,\n  Events | AllowedEvents\n>;\n\n/**\n * Controller that enables authentication for restricted endpoints.\n * Used for Backup & Sync, Notifications, and other services.\n */\nexport class AuthenticationController extends BaseController<\n  typeof controllerName,\n  AuthenticationControllerState,\n  AuthenticationControllerMessenger\n> {\n  readonly #metametrics: MetaMetricsAuth;\n\n  readonly #auth: SRPInterface;\n\n  readonly #config: ControllerConfig = {\n    env: Env.PRD,\n  };\n\n  #isUnlocked = false;\n\n  #cachedPrimaryEntropySourceId?: string;\n\n  // Bumped by `requestProfilePairing`. `performSignIn` snapshots this\n  // before its first await; if it changes mid-flight we must NOT clear\n  // `needsProfilePairing` (the rearm signal wins).\n  #profilePairingRequestEpoch = 0;\n\n  readonly #keyringController = {\n    setupLockedStateSubscriptions: () => {\n      const { isUnlocked } = this.messenger.call('KeyringController:getState');\n      this.#isUnlocked = isUnlocked;\n\n      this.messenger.subscribe('KeyringController:unlock', () => {\n        this.#isUnlocked = true;\n      });\n\n      this.messenger.subscribe('KeyringController:lock', () => {\n        this.#isUnlocked = false;\n      });\n    },\n  };\n\n  constructor({\n    messenger,\n    state,\n    config,\n    metametrics,\n  }: {\n    messenger: AuthenticationControllerMessenger;\n    state?: AuthenticationControllerState;\n    config?: Partial<ControllerConfig>;\n    /**\n     * Not using the Messaging System as we\n     * do not want to tie this strictly to extension\n     */\n    metametrics: MetaMetricsAuth;\n  }) {\n    super({\n      messenger,\n      metadata,\n      name: controllerName,\n      state: { ...defaultState, ...state },\n    });\n\n    if (!metametrics) {\n      throw new Error('`metametrics` field is required');\n    }\n\n    this.#config = {\n      ...this.#config,\n      ...config,\n    };\n\n    this.#metametrics = metametrics;\n\n    this.#auth = new JwtBearerAuth(\n      {\n        env: this.#config.env,\n        platform: metametrics.agent,\n        type: AuthType.SRP,\n      },\n      {\n        storage: {\n          getLoginResponse: this.#getLoginResponseFromState.bind(this),\n          setLoginResponse: this.#setLoginResponseToState.bind(this),\n        },\n        signing: {\n          getIdentifier: this.#snapGetPublicKey.bind(this),\n          signMessage: this.#snapSignMessage.bind(this),\n        },\n        metametrics: this.#metametrics,\n      },\n    );\n\n    this.#keyringController.setupLockedStateSubscriptions();\n\n    this.messenger.registerMethodActionHandlers(\n      this,\n      MESSENGER_EXPOSED_METHODS,\n    );\n  }\n\n  async #getLoginResponseFromState(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    if (!this.state.srpSessionData?.[resolvedId]) {\n      return null;\n    }\n    return this.state.srpSessionData[resolvedId];\n  }\n\n  async #setLoginResponseToState(\n    loginResponse: LoginResponse,\n    entropySourceId?: string,\n  ) {\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    const metaMetricsId = await this.#metametrics.getMetaMetricsId();\n    this.update((state) => {\n      state.isSignedIn = true;\n      if (!state.srpSessionData) {\n        state.srpSessionData = {};\n      }\n      state.srpSessionData[resolvedId] = {\n        ...loginResponse,\n        profile: {\n          ...loginResponse.profile,\n          metaMetricsId,\n        },\n      };\n    });\n  }\n\n  #assertIsUnlocked(methodName: string): void {\n    if (!this.#isUnlocked) {\n      throw new Error(`${methodName} - unable to proceed, wallet is locked`);\n    }\n  }\n\n  async #getPrimaryEntropySourceId(): Promise<string> {\n    if (this.#cachedPrimaryEntropySourceId) {\n      return this.#cachedPrimaryEntropySourceId;\n    }\n    const allPublicKeys = await this.#snapGetAllPublicKeys();\n\n    if (allPublicKeys.length === 0) {\n      throw new Error(\n        '#getPrimaryEntropySourceId - No entropy sources found from snap',\n      );\n    }\n\n    const primaryId = allPublicKeys[0][0];\n    if (!primaryId) {\n      throw new Error(\n        '#getPrimaryEntropySourceId - Primary entropy source ID is undefined',\n      );\n    }\n\n    this.#cachedPrimaryEntropySourceId = primaryId;\n    return this.#cachedPrimaryEntropySourceId;\n  }\n\n  public async performSignIn(): Promise<string[]> {\n    this.#assertIsUnlocked('performSignIn');\n\n    const epochAtStart = this.#profilePairingRequestEpoch;\n    const allPublicKeys = await this.#snapGetAllPublicKeys();\n    const accessTokens: string[] = [];\n\n    // We iterate sequentially in order to be sure that the first entry\n    // is the primary SRP LoginResponse.\n    for (const [entropySourceId] of allPublicKeys) {\n      const accessToken = await this.#auth.getAccessToken(entropySourceId);\n      accessTokens.push(accessToken);\n    }\n\n    if (allPublicKeys.length < 2) {\n      // Single-SRP wallet: nothing to pair.\n      this.#tryClearNeedsProfilePairing(epochAtStart);\n    } else {\n      // Pair failures must not break sign-in; the gate stays `true` for retry.\n      try {\n        await this.#doPair(accessTokens, epochAtStart);\n      } catch {\n        // noop\n      }\n    }\n\n    return accessTokens;\n  }\n\n  /**\n   * Marks profile pairing as needed. Clients call this when the SRP set\n   * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n   * re-runs `performSignIn` and re-pairs.\n   */\n  public requestProfilePairing(): void {\n    this.#profilePairingRequestEpoch += 1;\n    if (!this.state.needsProfilePairing) {\n      this.update((state) => {\n        state.needsProfilePairing = true;\n      });\n    }\n  }\n\n  /**\n   * Clears `needsProfilePairing` only if no `requestProfilePairing` call\n   * landed since `epochAtStart` was captured. Prevents `performSignIn`\n   * from silently overwriting a concurrent rearm.\n   *\n   * @param epochAtStart - Epoch value captured at the start of `performSignIn`.\n   */\n  #tryClearNeedsProfilePairing(epochAtStart: number): void {\n    if (this.#profilePairingRequestEpoch !== epochAtStart) {\n      return;\n    }\n    if (this.state.needsProfilePairing) {\n      this.update((state) => {\n        state.needsProfilePairing = false;\n      });\n    }\n  }\n\n  /**\n   * Pairs all SRPs via `POST /profile/pair`, propagates the canonical\n   * profile ID, clears `needsProfilePairing`, and emits\n   * `AuthenticationController:profileSignIn` when the canonical changes or\n   * new aliases are returned. Throws on failure.\n   *\n   * @param accessTokens - Per-SRP access tokens, primary first.\n   * @param epochAtStart - Pairing-request epoch captured by the caller.\n   * Used to skip the gate clear if `requestProfilePairing` ran while the\n   * pair API call was in-flight.\n   */\n  async #doPair(accessTokens: string[], epochAtStart: number): Promise<void> {\n    const previousCanonical = await this.#getCanonicalProfileId();\n\n    const profileAliases = await this.#pairSrpProfiles(accessTokens);\n    const newCanonical = await this.#getCanonicalProfileId();\n\n    // If somehow we cannot compute the new canonical profile ID after pairing,\n    // we just return now and do not update the `needsProfilePairing` flag.\n    if (!newCanonical) {\n      return;\n    }\n\n    this.#tryClearNeedsProfilePairing(epochAtStart);\n\n    const profileIdChanged = previousCanonical !== newCanonical;\n    const shouldEmitProfileSignInEvent =\n      profileIdChanged || profileAliases.length > 0;\n\n    if (shouldEmitProfileSignInEvent) {\n      this.messenger.publish('AuthenticationController:profileSignIn', {\n        profileId: newCanonical,\n        profileAliases,\n        profileIdChanged,\n      });\n    }\n  }\n\n  async #pairSrpProfiles(accessTokens: string[]): Promise<ProfileAlias[]> {\n    if (accessTokens.length < 2) {\n      return [];\n    }\n    const primaryAccessToken = accessTokens[0]; // Associated with primary SRP.\n    const {\n      profileAliases,\n      profile: { canonicalProfileId },\n    } = await this.#auth.pairSrpProfiles(accessTokens, primaryAccessToken);\n    this.#propagateCanonical(canonicalProfileId);\n    return profileAliases;\n  }\n\n  #propagateCanonical(canonicalProfileId: string): void {\n    const { srpSessionData } = this.state;\n    if (!srpSessionData) {\n      return;\n    }\n\n    this.update((state) => {\n      for (const entry of Object.values(state.srpSessionData ?? {})) {\n        if (entry?.profile) {\n          entry.profile.canonicalProfileId = canonicalProfileId;\n        }\n      }\n    });\n  }\n\n  /**\n   * Returns the canonical profile id from the primary SRP's cached session.\n   * Returns `null` when no session exists yet for the primary SRP.\n   *\n   * Always reads from the primary SRP because the canonical is shared across\n   * all paired SRPs after `#propagateCanonical`.\n   *\n   * @returns The canonical profile id, or `null` if unavailable.\n   */\n  async #getCanonicalProfileId(): Promise<string | null> {\n    const primaryEntropySourceId = await this.#getPrimaryEntropySourceId();\n    return (\n      this.state.srpSessionData?.[primaryEntropySourceId]?.profile\n        ?.canonicalProfileId ?? null\n    );\n  }\n\n  public performSignOut(): void {\n    this.#cachedPrimaryEntropySourceId = undefined;\n    this.update((state) => {\n      state.isSignedIn = false;\n      state.srpSessionData = undefined;\n    });\n  }\n\n  /**\n   * Returns a bearer token for the specified SRP, logging in if needed.\n   *\n   * When called without `entropySourceId`, returns the primary (first) SRP's\n   * access token, which is effectively the canonical\n   * profile's token that can be used by alias-aware consumers for cross-SRP\n   * operations.\n   *\n   * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n   * @returns The OIDC access token.\n   */\n  public async getBearerToken(entropySourceId?: string): Promise<string> {\n    this.#assertIsUnlocked('getBearerToken');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getAccessToken(resolvedId);\n  }\n\n  /**\n   * Returns the cached session profile, logging in if no session exists.\n   *\n   * The returned `canonicalProfileId` reflects the value from the most recent\n   * login or pairing. In the rare event where a canonical changed because of\n   * a pairing that happened on another device, the cached value may be stale\n   * until the next login. For guaranteed freshness, call\n   * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n   *\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns profile for the session.\n   */\n  public async getSessionProfile(\n    entropySourceId?: string,\n  ): Promise<UserProfile> {\n    this.#assertIsUnlocked('getSessionProfile');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getUserProfile(resolvedId);\n  }\n\n  /**\n   * Forces a fresh retrieval of the canonical profile ID from the server\n   * and propagates it to all cached SRP sessions.\n   *\n   * This method invalidates the primary SRP's cached session and forces a\n   * re-login. Use it before operations that require a guaranteed-fresh\n   * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n   * best-effort reads, use\n   * `getSessionProfile().canonicalProfileId` instead.\n   *\n   * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n   * the server returns the current canonical for the entire pairing group\n   * from any single SRP login.\n   *\n   * @returns The refreshed canonical profile ID.\n   */\n  public async refreshCanonicalProfileId(): Promise<string> {\n    this.#assertIsUnlocked('refreshCanonicalProfileId');\n\n    const primaryEntropySourceId = await this.#getPrimaryEntropySourceId();\n    this.#invalidateSrpSession(primaryEntropySourceId);\n    await this.#auth.getAccessToken(primaryEntropySourceId);\n\n    const canonical = await this.#getCanonicalProfileId();\n    if (!canonical) {\n      throw new Error(\n        'refreshCanonicalProfileId - Unable to resolve canonical profile ID',\n      );\n    }\n\n    this.#propagateCanonical(canonical);\n    return canonical;\n  }\n\n  #invalidateSrpSession(entropySourceId: string): void {\n    this.update((state) => {\n      const entry = state.srpSessionData?.[entropySourceId];\n      if (entry?.profile) {\n        // Setting canonicalProfileId to '' forces a re-fetch on the next\n        // #getAuthSession call. The falsy check (!auth.profile.canonicalProfileId)\n        // treats '' the same as undefined/null — all signal an invalid session.\n        entry.profile.canonicalProfileId = '';\n      }\n    });\n  }\n\n  public async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    this.#assertIsUnlocked('getUserProfileLineage');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getUserProfileLineage(resolvedId);\n  }\n\n  public isSignedIn(): boolean {\n    return this.state.isSignedIn;\n  }\n\n  /**\n   * Returns the auth snap public key.\n   *\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns The snap public key.\n   */\n  async #snapGetPublicKey(entropySourceId?: string): Promise<string> {\n    this.#assertIsUnlocked('#snapGetPublicKey');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapPublicKeyRequest(entropySourceId),\n    )) as string;\n\n    return result;\n  }\n\n  /**\n   * Returns a mapping of entropy source IDs to auth snap public keys.\n   *\n   * @returns A mapping of entropy source IDs to public keys.\n   */\n  async #snapGetAllPublicKeys(): Promise<[string, string][]> {\n    this.#assertIsUnlocked('#snapGetAllPublicKeys');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapAllPublicKeysRequest(),\n    )) as [string, string][];\n\n    return result;\n  }\n\n  #_snapSignMessageCache: Record<`metamask:${string}`, string> = {};\n\n  /**\n   * Signs a specific message using an underlying auth snap.\n   *\n   * @param message - A specific tagged message to sign.\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns A Signature created by the snap.\n   */\n  async #snapSignMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    assertMessageStartsWithMetamask(message);\n\n    if (this.#_snapSignMessageCache[message]) {\n      return this.#_snapSignMessageCache[message];\n    }\n\n    this.#assertIsUnlocked('#snapSignMessage');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapSignMessageRequest(message, entropySourceId),\n    )) as string;\n\n    this.#_snapSignMessageCache[message] = result;\n\n    return result;\n  }\n}\n"]}
+{"version":3,"file":"AuthenticationController.mjs","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAsB3D,OAAO,EACL,+BAA+B,EAC/B,QAAQ,EACR,GAAG,EACH,aAAa,EACd,4BAAkB;AAEnB,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,EAC7B,iCAA6B;AAG9B,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAmBlD,MAAM,CAAC,MAAM,YAAY,GAAkC;IACzD,UAAU,EAAE,KAAK;IACjB,mBAAmB,EAAE,IAAI;CAC1B,CAAC;AACF,MAAM,QAAQ,GAAiD;IAC7D,UAAU,EAAE;QACV,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,mBAAmB,EAAE;QACnB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,cAAc,EAAE;QACd,sCAAsC;QACtC,kBAAkB,EAAE,CAAC,cAAc,EAAE,EAAE;YACrC,4FAA4F;YAC5F,2FAA2F;YAC3F,mEAAmE;YACnE,kEAAkE;YAClE,oDAAoD;YACpD,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,MAAM,CAC1C,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBACxC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,uBAAuB,EAAE,GACxD,KAAK,CAAC,KAAK,CAAC;gBACd,uBAAuB,CAAC,GAAG,CAAC,GAAG;oBAC7B,GAAG,KAAK;oBACR,KAAK,EAAE,uBAAuB;iBAC/B,CAAC;gBACF,OAAO,uBAAuB,CAAC;YACjC,CAAC,EACD,EAAE,CACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,KAAK;QAC7B,QAAQ,EAAE,IAAI;KACf;CACF,CAAC;AAMF,MAAM,yBAAyB,GAAG;IAChC,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,2BAA2B;IAC3B,uBAAuB;IACvB,yBAAyB;IACzB,YAAY;IACZ,uBAAuB;CACf,CAAC;AA8CX;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,cAI7C;IAiCC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GAUZ;QACC,KAAK,CAAC;YACJ,SAAS;YACT,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,KAAK,EAAE;SACrC,CAAC,CAAC;;QApDI,wDAA8B;QAE9B,iDAAoB;QAEpB,2CAA4B;YACnC,GAAG,EAAE,GAAG,CAAC,GAAG;SACb,EAAC;QAEF,+CAAc,KAAK,EAAC;QAEpB,yEAAuC;QAEvC,oEAAoE;QACpE,qEAAqE;QACrE,iDAAiD;QACjD,+DAA8B,CAAC,EAAC;QAEvB,sDAAqB;YAC5B,6BAA6B,EAAE,GAAG,EAAE;gBAClC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBACzE,uBAAA,IAAI,wCAAe,UAAU,MAAA,CAAC;gBAE9B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,0BAA0B,EAAE,GAAG,EAAE;oBACxD,uBAAA,IAAI,wCAAe,IAAI,MAAA,CAAC;gBAC1B,CAAC,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wBAAwB,EAAE,GAAG,EAAE;oBACtD,uBAAA,IAAI,wCAAe,KAAK,MAAA,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACL,CAAC;SACF,EAAC;QA6aF,0DAA+D,EAAE,EAAC;QArZhE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,uBAAA,IAAI,oCAAW;YACb,GAAG,uBAAA,IAAI,wCAAQ;YACf,GAAG,MAAM;SACV,MAAA,CAAC;QAEF,uBAAA,IAAI,yCAAgB,WAAW,MAAA,CAAC;QAEhC,uBAAA,IAAI,kCAAS,IAAI,aAAa,CAC5B;YACE,GAAG,EAAE,uBAAA,IAAI,wCAAQ,CAAC,GAAG;YACrB,QAAQ,EAAE,WAAW,CAAC,KAAK;YAC3B,IAAI,EAAE,QAAQ,CAAC,GAAG;SACnB,EACD;YACE,OAAO,EAAE;gBACP,gBAAgB,EAAE,uBAAA,IAAI,gGAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5D,gBAAgB,EAAE,uBAAA,IAAI,8FAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3D;YACD,OAAO,EAAE;gBACP,aAAa,EAAE,uBAAA,IAAI,uFAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChD,WAAW,EAAE,uBAAA,IAAI,sFAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;aAC9C;YACD,WAAW,EAAE,uBAAA,IAAI,6CAAa;SAC/B,CACF,MAAA,CAAC;QAEF,uBAAA,IAAI,mDAAmB,CAAC,6BAA6B,EAAE,CAAC;QAExD,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,IAAI,EACJ,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAgEM,KAAK,CAAC,aAAa;QACxB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,eAAe,CAAC,CAAC;QAExC,MAAM,YAAY,GAAG,uBAAA,IAAI,4DAA4B,CAAC;QACtD,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,CAAwB,CAAC;QACzD,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,mEAAmE;QACnE,oCAAoC;QACpC,KAAK,MAAM,CAAC,eAAe,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;YACrE,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,sCAAsC;YACtC,uBAAA,IAAI,kGAA6B,MAAjC,IAAI,EAA8B,YAAY,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,uBAAA,IAAI,6EAAQ,MAAZ,IAAI,EAAS,YAAY,EAAE,YAAY,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACI,qBAAqB;QAC1B,6KAAoC,CAAC,MAAA,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAuGM,cAAc;QACnB,uBAAA,IAAI,0DAAiC,SAAS,MAAA,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;YACzB,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,cAAc,CAAC,eAAwB;QAClD,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,gBAAgB,CAAC,CAAC;QACzC,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,iBAAiB,CAC5B,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,mBAAmB,CAAC,CAAC;QAC5C,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,yBAAyB;QACpC,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,2BAA2B,CAAC,CAAC;QAEpD,MAAM,sBAAsB,GAAG,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;QACvE,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,EAAuB,sBAAsB,CAAC,CAAC;QACnD,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QAExD,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,uBAAA,IAAI,yFAAoB,MAAxB,IAAI,EAAqB,SAAS,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAcM,KAAK,CAAC,qBAAqB,CAChC,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,uBAAuB,CAAC,CAAC;QAChD,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,uBAAuB,CAClC,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,yBAAyB,CAAC,CAAC;QAClD,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IAC/B,CAAC;CAmEF;skBA9YC,KAAK,8DACH,eAAwB;IAExB,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;AAC/C,CAAC,sDAED,KAAK,4DACH,aAA4B,EAC5B,eAAwB;IAExB,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,6CAAa,CAAC,gBAAgB,EAAE,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1B,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG;YACjC,GAAG,aAAa;YAChB,OAAO,EAAE;gBACP,GAAG,aAAa,CAAC,OAAO;gBACxB,aAAa;aACd;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,mGAEiB,UAAkB;IAClC,IAAI,CAAC,uBAAA,IAAI,4CAAY,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,wCAAwC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,wDAED,KAAK;IACH,IAAI,uBAAA,IAAI,8DAA8B,EAAE,CAAC;QACvC,OAAO,uBAAA,IAAI,8DAA8B,CAAC;IAC5C,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,CAAwB,CAAC;IAEzD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,uBAAA,IAAI,0DAAiC,SAAS,MAAA,CAAC;IAC/C,OAAO,uBAAA,IAAI,8DAA8B,CAAC;AAC5C,CAAC,yHAoD4B,YAAoB;IAC/C,IAAI,uBAAA,IAAI,4DAA4B,KAAK,YAAY,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,2CAAS,YAAsB,EAAE,YAAoB;IACxD,MAAM,iBAAiB,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;IAE9D,MAAM,cAAc,GAAG,MAAM,uBAAA,IAAI,sFAAiB,MAArB,IAAI,EAAkB,YAAY,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;IAEzD,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IAED,uBAAA,IAAI,kGAA6B,MAAjC,IAAI,EAA8B,YAAY,CAAC,CAAC;IAEhD,MAAM,gBAAgB,GAAG,iBAAiB,KAAK,YAAY,CAAC;IAC5D,MAAM,4BAA4B,GAChC,gBAAgB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,IAAI,4BAA4B,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wCAAwC,EAAE;YAC/D,SAAS,EAAE,YAAY;YACvB,cAAc;YACd,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,8CAED,KAAK,oDAAkB,YAAsB;IAC3C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,+BAA+B;IAC3E,MAAM,EACJ,cAAc,EACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,GAChC,GAAG,MAAM,uBAAA,IAAI,sCAAM,CAAC,eAAe,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACvE,uBAAA,IAAI,yFAAoB,MAAxB,IAAI,EAAqB,kBAAkB,CAAC,CAAC;IAC7C,OAAO,cAAc,CAAC;AACxB,CAAC,uGAEmB,kBAA0B;IAC5C,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACtC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;gBACnB,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK;IACH,MAAM,sBAAsB,GAAG,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;IACvE,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,sBAAsB,CAAC,EAAE,OAAO;QAC1D,EAAE,kBAAkB,IAAI,IAAI,CAC/B,CAAC;AACJ,CAAC,2GAoFqB,eAAuB;IAC3C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;YACnB,iEAAiE;YACjE,2EAA2E;YAC3E,wEAAwE;YACxE,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,EAAE,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAmCD;;;;;;GAMG;AACH,KAAK,qDAAmB,eAAwB;IAC9C,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,mBAAmB,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,0BAA0B,CAAC,eAAe,CAAC,CAC5C,CAAW,CAAC;IAEb,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK;IACH,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,uBAAuB,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,8BAA8B,EAAE,CACjC,CAAuB,CAAC;IAEzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAID;;;;;;;GAOG;AACH,KAAK,oDACH,OAAe,EACf,eAAwB;IAExB,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,kBAAkB,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,4BAA4B,CAAC,OAAO,EAAE,eAAe,CAAC,CACvD,CAAW,CAAC;IAEb,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;IAE9C,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { BaseController } from '@metamask/base-controller';\nimport type {\n  ControllerGetStateAction,\n  ControllerStateChangeEvent,\n  StateMetadata,\n} from '@metamask/base-controller';\nimport type {\n  KeyringControllerGetStateAction,\n  KeyringControllerLockEvent,\n  KeyringControllerUnlockEvent,\n} from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\nimport type { SnapControllerHandleRequestAction } from '@metamask/snaps-controllers';\nimport type { Json } from '@metamask/utils';\n\nimport type {\n  LoginResponse,\n  ProfileAlias,\n  SRPInterface,\n  UserProfile,\n  UserProfileLineage,\n} from '../../sdk';\nimport {\n  assertMessageStartsWithMetamask,\n  AuthType,\n  Env,\n  JwtBearerAuth,\n} from '../../sdk';\nimport type { MetaMetricsAuth } from '../../shared/types/services';\nimport {\n  createSnapPublicKeyRequest,\n  createSnapAllPublicKeysRequest,\n  createSnapSignMessageRequest,\n} from './auth-snap-requests';\nimport { AuthenticationControllerMethodActions } from './AuthenticationController-method-action-types';\n\nconst controllerName = 'AuthenticationController';\n\n// State\nexport type AuthenticationControllerState = {\n  isSignedIn: boolean;\n  srpSessionData?: Record<string, LoginResponse>;\n  /**\n   * Client gate for profile pairing. Defaults to `true` (fresh install /\n   * upgrade), set to `false` after a successful `performSignIn` pair, set\n   * back to `true` via `requestProfilePairing()` when the SRP set changes,\n   * and left `true` on pair failure so the next state shift retries.\n   *\n   * Optional in the type so partial-state selectors stay assignable to\n   * `AuthenticationControllerState`. The controller seeds it via\n   * `defaultState` at construction; consumers should read `undefined` as\n   * `true` to mirror that runtime default.\n   */\n  needsProfilePairing?: boolean;\n};\nexport const defaultState: AuthenticationControllerState = {\n  isSignedIn: false,\n  needsProfilePairing: true,\n};\nconst metadata: StateMetadata<AuthenticationControllerState> = {\n  isSignedIn: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  needsProfilePairing: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  srpSessionData: {\n    // Remove access token from state logs\n    includeInStateLogs: (srpSessionData) => {\n      // Unreachable branch, included just to fix a type error for the case where this property is\n      // unset. The type gets collapsed to include `| undefined` even though `undefined` is never\n      // set here, because we don't yet use `exactOptionalPropertyTypes`.\n      // TODO: Remove branch after enabling `exactOptionalPropertyTypes`\n      // ref: https://github.com/MetaMask/core/issues/6565\n      if (srpSessionData === null || srpSessionData === undefined) {\n        return null;\n      }\n      return Object.entries(srpSessionData).reduce<Record<string, Json>>(\n        (sanitizedSrpSessionData, [key, value]) => {\n          const { accessToken: _unused, ...tokenWithoutAccessToken } =\n            value.token;\n          sanitizedSrpSessionData[key] = {\n            ...value,\n            token: tokenWithoutAccessToken,\n          };\n          return sanitizedSrpSessionData;\n        },\n        {},\n      );\n    },\n    persist: true,\n    includeInDebugSnapshot: false,\n    usedInUi: true,\n  },\n};\n\ntype ControllerConfig = {\n  env: Env;\n};\n\nconst MESSENGER_EXPOSED_METHODS = [\n  'performSignIn',\n  'performSignOut',\n  'getBearerToken',\n  'getSessionProfile',\n  'refreshCanonicalProfileId',\n  'getUserProfileLineage',\n  'getCustomerServiceToken',\n  'isSignedIn',\n  'requestProfilePairing',\n] as const;\n\nexport type Actions =\n  | AuthenticationControllerGetStateAction\n  | AuthenticationControllerMethodActions;\n\nexport type AuthenticationControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  AuthenticationControllerState\n>;\n\nexport type AuthenticationControllerStateChangeEvent =\n  ControllerStateChangeEvent<\n    typeof controllerName,\n    AuthenticationControllerState\n  >;\n\nexport type ProfileSignInInfo = {\n  profileId: string;\n  profileAliases: ProfileAlias[];\n  profileIdChanged: boolean;\n};\n\nexport type AuthenticationControllerProfileSignInEvent = {\n  type: `${typeof controllerName}:profileSignIn`;\n  payload: [ProfileSignInInfo];\n};\n\nexport type Events =\n  | AuthenticationControllerStateChangeEvent\n  | AuthenticationControllerProfileSignInEvent;\n\n// Allowed Actions\ntype AllowedActions =\n  | KeyringControllerGetStateAction\n  | SnapControllerHandleRequestAction;\n\ntype AllowedEvents = KeyringControllerLockEvent | KeyringControllerUnlockEvent;\n\n// Messenger\nexport type AuthenticationControllerMessenger = Messenger<\n  typeof controllerName,\n  Actions | AllowedActions,\n  Events | AllowedEvents\n>;\n\n/**\n * Controller that enables authentication for restricted endpoints.\n * Used for Backup & Sync, Notifications, and other services.\n */\nexport class AuthenticationController extends BaseController<\n  typeof controllerName,\n  AuthenticationControllerState,\n  AuthenticationControllerMessenger\n> {\n  readonly #metametrics: MetaMetricsAuth;\n\n  readonly #auth: SRPInterface;\n\n  readonly #config: ControllerConfig = {\n    env: Env.PRD,\n  };\n\n  #isUnlocked = false;\n\n  #cachedPrimaryEntropySourceId?: string;\n\n  // Bumped by `requestProfilePairing`. `performSignIn` snapshots this\n  // before its first await; if it changes mid-flight we must NOT clear\n  // `needsProfilePairing` (the rearm signal wins).\n  #profilePairingRequestEpoch = 0;\n\n  readonly #keyringController = {\n    setupLockedStateSubscriptions: () => {\n      const { isUnlocked } = this.messenger.call('KeyringController:getState');\n      this.#isUnlocked = isUnlocked;\n\n      this.messenger.subscribe('KeyringController:unlock', () => {\n        this.#isUnlocked = true;\n      });\n\n      this.messenger.subscribe('KeyringController:lock', () => {\n        this.#isUnlocked = false;\n      });\n    },\n  };\n\n  constructor({\n    messenger,\n    state,\n    config,\n    metametrics,\n  }: {\n    messenger: AuthenticationControllerMessenger;\n    state?: AuthenticationControllerState;\n    config?: Partial<ControllerConfig>;\n    /**\n     * Not using the Messaging System as we\n     * do not want to tie this strictly to extension\n     */\n    metametrics: MetaMetricsAuth;\n  }) {\n    super({\n      messenger,\n      metadata,\n      name: controllerName,\n      state: { ...defaultState, ...state },\n    });\n\n    if (!metametrics) {\n      throw new Error('`metametrics` field is required');\n    }\n\n    this.#config = {\n      ...this.#config,\n      ...config,\n    };\n\n    this.#metametrics = metametrics;\n\n    this.#auth = new JwtBearerAuth(\n      {\n        env: this.#config.env,\n        platform: metametrics.agent,\n        type: AuthType.SRP,\n      },\n      {\n        storage: {\n          getLoginResponse: this.#getLoginResponseFromState.bind(this),\n          setLoginResponse: this.#setLoginResponseToState.bind(this),\n        },\n        signing: {\n          getIdentifier: this.#snapGetPublicKey.bind(this),\n          signMessage: this.#snapSignMessage.bind(this),\n        },\n        metametrics: this.#metametrics,\n      },\n    );\n\n    this.#keyringController.setupLockedStateSubscriptions();\n\n    this.messenger.registerMethodActionHandlers(\n      this,\n      MESSENGER_EXPOSED_METHODS,\n    );\n  }\n\n  async #getLoginResponseFromState(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    if (!this.state.srpSessionData?.[resolvedId]) {\n      return null;\n    }\n    return this.state.srpSessionData[resolvedId];\n  }\n\n  async #setLoginResponseToState(\n    loginResponse: LoginResponse,\n    entropySourceId?: string,\n  ) {\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    const metaMetricsId = await this.#metametrics.getMetaMetricsId();\n    this.update((state) => {\n      state.isSignedIn = true;\n      if (!state.srpSessionData) {\n        state.srpSessionData = {};\n      }\n      state.srpSessionData[resolvedId] = {\n        ...loginResponse,\n        profile: {\n          ...loginResponse.profile,\n          metaMetricsId,\n        },\n      };\n    });\n  }\n\n  #assertIsUnlocked(methodName: string): void {\n    if (!this.#isUnlocked) {\n      throw new Error(`${methodName} - unable to proceed, wallet is locked`);\n    }\n  }\n\n  async #getPrimaryEntropySourceId(): Promise<string> {\n    if (this.#cachedPrimaryEntropySourceId) {\n      return this.#cachedPrimaryEntropySourceId;\n    }\n    const allPublicKeys = await this.#snapGetAllPublicKeys();\n\n    if (allPublicKeys.length === 0) {\n      throw new Error(\n        '#getPrimaryEntropySourceId - No entropy sources found from snap',\n      );\n    }\n\n    const primaryId = allPublicKeys[0][0];\n    if (!primaryId) {\n      throw new Error(\n        '#getPrimaryEntropySourceId - Primary entropy source ID is undefined',\n      );\n    }\n\n    this.#cachedPrimaryEntropySourceId = primaryId;\n    return this.#cachedPrimaryEntropySourceId;\n  }\n\n  public async performSignIn(): Promise<string[]> {\n    this.#assertIsUnlocked('performSignIn');\n\n    const epochAtStart = this.#profilePairingRequestEpoch;\n    const allPublicKeys = await this.#snapGetAllPublicKeys();\n    const accessTokens: string[] = [];\n\n    // We iterate sequentially in order to be sure that the first entry\n    // is the primary SRP LoginResponse.\n    for (const [entropySourceId] of allPublicKeys) {\n      const accessToken = await this.#auth.getAccessToken(entropySourceId);\n      accessTokens.push(accessToken);\n    }\n\n    if (allPublicKeys.length < 2) {\n      // Single-SRP wallet: nothing to pair.\n      this.#tryClearNeedsProfilePairing(epochAtStart);\n    } else {\n      // Pair failures must not break sign-in; the gate stays `true` for retry.\n      try {\n        await this.#doPair(accessTokens, epochAtStart);\n      } catch {\n        // noop\n      }\n    }\n\n    return accessTokens;\n  }\n\n  /**\n   * Marks profile pairing as needed. Clients call this when the SRP set\n   * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n   * re-runs `performSignIn` and re-pairs.\n   */\n  public requestProfilePairing(): void {\n    this.#profilePairingRequestEpoch += 1;\n    if (!this.state.needsProfilePairing) {\n      this.update((state) => {\n        state.needsProfilePairing = true;\n      });\n    }\n  }\n\n  /**\n   * Clears `needsProfilePairing` only if no `requestProfilePairing` call\n   * landed since `epochAtStart` was captured. Prevents `performSignIn`\n   * from silently overwriting a concurrent rearm.\n   *\n   * @param epochAtStart - Epoch value captured at the start of `performSignIn`.\n   */\n  #tryClearNeedsProfilePairing(epochAtStart: number): void {\n    if (this.#profilePairingRequestEpoch !== epochAtStart) {\n      return;\n    }\n    if (this.state.needsProfilePairing) {\n      this.update((state) => {\n        state.needsProfilePairing = false;\n      });\n    }\n  }\n\n  /**\n   * Pairs all SRPs via `POST /profile/pair`, propagates the canonical\n   * profile ID, clears `needsProfilePairing`, and emits\n   * `AuthenticationController:profileSignIn` when the canonical changes or\n   * new aliases are returned. Throws on failure.\n   *\n   * @param accessTokens - Per-SRP access tokens, primary first.\n   * @param epochAtStart - Pairing-request epoch captured by the caller.\n   * Used to skip the gate clear if `requestProfilePairing` ran while the\n   * pair API call was in-flight.\n   */\n  async #doPair(accessTokens: string[], epochAtStart: number): Promise<void> {\n    const previousCanonical = await this.#getCanonicalProfileId();\n\n    const profileAliases = await this.#pairSrpProfiles(accessTokens);\n    const newCanonical = await this.#getCanonicalProfileId();\n\n    // If somehow we cannot compute the new canonical profile ID after pairing,\n    // we just return now and do not update the `needsProfilePairing` flag.\n    if (!newCanonical) {\n      return;\n    }\n\n    this.#tryClearNeedsProfilePairing(epochAtStart);\n\n    const profileIdChanged = previousCanonical !== newCanonical;\n    const shouldEmitProfileSignInEvent =\n      profileIdChanged || profileAliases.length > 0;\n\n    if (shouldEmitProfileSignInEvent) {\n      this.messenger.publish('AuthenticationController:profileSignIn', {\n        profileId: newCanonical,\n        profileAliases,\n        profileIdChanged,\n      });\n    }\n  }\n\n  async #pairSrpProfiles(accessTokens: string[]): Promise<ProfileAlias[]> {\n    if (accessTokens.length < 2) {\n      return [];\n    }\n    const primaryAccessToken = accessTokens[0]; // Associated with primary SRP.\n    const {\n      profileAliases,\n      profile: { canonicalProfileId },\n    } = await this.#auth.pairSrpProfiles(accessTokens, primaryAccessToken);\n    this.#propagateCanonical(canonicalProfileId);\n    return profileAliases;\n  }\n\n  #propagateCanonical(canonicalProfileId: string): void {\n    const { srpSessionData } = this.state;\n    if (!srpSessionData) {\n      return;\n    }\n\n    this.update((state) => {\n      for (const entry of Object.values(state.srpSessionData ?? {})) {\n        if (entry?.profile) {\n          entry.profile.canonicalProfileId = canonicalProfileId;\n        }\n      }\n    });\n  }\n\n  /**\n   * Returns the canonical profile id from the primary SRP's cached session.\n   * Returns `null` when no session exists yet for the primary SRP.\n   *\n   * Always reads from the primary SRP because the canonical is shared across\n   * all paired SRPs after `#propagateCanonical`.\n   *\n   * @returns The canonical profile id, or `null` if unavailable.\n   */\n  async #getCanonicalProfileId(): Promise<string | null> {\n    const primaryEntropySourceId = await this.#getPrimaryEntropySourceId();\n    return (\n      this.state.srpSessionData?.[primaryEntropySourceId]?.profile\n        ?.canonicalProfileId ?? null\n    );\n  }\n\n  public performSignOut(): void {\n    this.#cachedPrimaryEntropySourceId = undefined;\n    this.update((state) => {\n      state.isSignedIn = false;\n      state.srpSessionData = undefined;\n    });\n  }\n\n  /**\n   * Returns a bearer token for the specified SRP, logging in if needed.\n   *\n   * When called without `entropySourceId`, returns the primary (first) SRP's\n   * access token, which is effectively the canonical\n   * profile's token that can be used by alias-aware consumers for cross-SRP\n   * operations.\n   *\n   * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n   * @returns The OIDC access token.\n   */\n  public async getBearerToken(entropySourceId?: string): Promise<string> {\n    this.#assertIsUnlocked('getBearerToken');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getAccessToken(resolvedId);\n  }\n\n  /**\n   * Returns the cached session profile, logging in if no session exists.\n   *\n   * The returned `canonicalProfileId` reflects the value from the most recent\n   * login or pairing. In the rare event where a canonical changed because of\n   * a pairing that happened on another device, the cached value may be stale\n   * until the next login. For guaranteed freshness, call\n   * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n   *\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns profile for the session.\n   */\n  public async getSessionProfile(\n    entropySourceId?: string,\n  ): Promise<UserProfile> {\n    this.#assertIsUnlocked('getSessionProfile');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getUserProfile(resolvedId);\n  }\n\n  /**\n   * Forces a fresh retrieval of the canonical profile ID from the server\n   * and propagates it to all cached SRP sessions.\n   *\n   * This method invalidates the primary SRP's cached session and forces a\n   * re-login. Use it before operations that require a guaranteed-fresh\n   * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n   * best-effort reads, use\n   * `getSessionProfile().canonicalProfileId` instead.\n   *\n   * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n   * the server returns the current canonical for the entire pairing group\n   * from any single SRP login.\n   *\n   * @returns The refreshed canonical profile ID.\n   */\n  public async refreshCanonicalProfileId(): Promise<string> {\n    this.#assertIsUnlocked('refreshCanonicalProfileId');\n\n    const primaryEntropySourceId = await this.#getPrimaryEntropySourceId();\n    this.#invalidateSrpSession(primaryEntropySourceId);\n    await this.#auth.getAccessToken(primaryEntropySourceId);\n\n    const canonical = await this.#getCanonicalProfileId();\n    if (!canonical) {\n      throw new Error(\n        'refreshCanonicalProfileId - Unable to resolve canonical profile ID',\n      );\n    }\n\n    this.#propagateCanonical(canonical);\n    return canonical;\n  }\n\n  #invalidateSrpSession(entropySourceId: string): void {\n    this.update((state) => {\n      const entry = state.srpSessionData?.[entropySourceId];\n      if (entry?.profile) {\n        // Setting canonicalProfileId to '' forces a re-fetch on the next\n        // #getAuthSession call. The falsy check (!auth.profile.canonicalProfileId)\n        // treats '' the same as undefined/null — all signal an invalid session.\n        entry.profile.canonicalProfileId = '';\n      }\n    });\n  }\n\n  public async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    this.#assertIsUnlocked('getUserProfileLineage');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getUserProfileLineage(resolvedId);\n  }\n\n  /**\n   * Returns a Customer Service specific access token for the specified SRP,\n   * logging in if needed.\n   *\n   * Exchanges the OIDC access token for a short-lived token scoped to the\n   * customer-service audience. Customer Service tooling consumes this token to\n   * identify and authenticate the user.\n   *\n   * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n   * @returns The customer-service access token.\n   */\n  public async getCustomerServiceToken(\n    entropySourceId?: string,\n  ): Promise<string> {\n    this.#assertIsUnlocked('getCustomerServiceToken');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getCustomerServiceToken(resolvedId);\n  }\n\n  public isSignedIn(): boolean {\n    return this.state.isSignedIn;\n  }\n\n  /**\n   * Returns the auth snap public key.\n   *\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns The snap public key.\n   */\n  async #snapGetPublicKey(entropySourceId?: string): Promise<string> {\n    this.#assertIsUnlocked('#snapGetPublicKey');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapPublicKeyRequest(entropySourceId),\n    )) as string;\n\n    return result;\n  }\n\n  /**\n   * Returns a mapping of entropy source IDs to auth snap public keys.\n   *\n   * @returns A mapping of entropy source IDs to public keys.\n   */\n  async #snapGetAllPublicKeys(): Promise<[string, string][]> {\n    this.#assertIsUnlocked('#snapGetAllPublicKeys');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapAllPublicKeysRequest(),\n    )) as [string, string][];\n\n    return result;\n  }\n\n  #_snapSignMessageCache: Record<`metamask:${string}`, string> = {};\n\n  /**\n   * Signs a specific message using an underlying auth snap.\n   *\n   * @param message - A specific tagged message to sign.\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns A Signature created by the snap.\n   */\n  async #snapSignMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    assertMessageStartsWithMetamask(message);\n\n    if (this.#_snapSignMessageCache[message]) {\n      return this.#_snapSignMessageCache[message];\n    }\n\n    this.#assertIsUnlocked('#snapSignMessage');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapSignMessageRequest(message, entropySourceId),\n    )) as string;\n\n    this.#_snapSignMessageCache[message] = result;\n\n    return result;\n  }\n}\n"]}

package/dist/controllers/authentication/mocks/mockResponses.cjs

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getMockAuthAccessTokenResponse = exports.getMockAuthPairResponse = exports.MOCK_PAIR_PROFILES_RESPONSE = exports.getE2EIdentifierFromJwt = exports.MOCK_OATH_TOKEN_RESPONSE = exports.getMockAuthLoginResponse = exports.MOCK_LOGIN_RESPONSE = exports.getMockAuthNonceResponse = exports.MOCK_JWT = exports.MOCK_NONCE = exports.MOCK_NONCE_RESPONSE = void 0;
+exports.getMockCustomerServiceTokenResponse = exports.MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE = exports.getMockAuthAccessTokenResponse = exports.getMockAuthPairResponse = exports.MOCK_PAIR_PROFILES_RESPONSE = exports.getE2EIdentifierFromJwt = exports.MOCK_OATH_TOKEN_RESPONSE = exports.getMockAuthLoginResponse = exports.MOCK_LOGIN_RESPONSE = exports.getMockAuthNonceResponse = exports.MOCK_JWT = exports.MOCK_NONCE = exports.MOCK_NONCE_RESPONSE = void 0;
 const auth_1 = require("../../../sdk/mocks/auth.cjs");
 exports.MOCK_NONCE_RESPONSE = auth_1.MOCK_NONCE_RESPONSE;
 exports.MOCK_NONCE = exports.MOCK_NONCE_RESPONSE.nonce;
@@ -112,4 +112,13 @@ const getMockAuthAccessTokenResponse = () => {
     };
 };
 exports.getMockAuthAccessTokenResponse = getMockAuthAccessTokenResponse;
+exports.MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE = auth_1.MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE;
+const getMockCustomerServiceTokenResponse = () => {
+    return {
+        url: auth_1.MOCK_CUSTOMER_SERVICE_TOKEN_URL,
+        requestMethod: 'POST',
+        response: exports.MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE,
+    };
+};
+exports.getMockCustomerServiceTokenResponse = getMockCustomerServiceTokenResponse;
 //# sourceMappingURL=mockResponses.cjs.map

package/dist/controllers/authentication/mocks/mockResponses.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"mockResponses.cjs","sourceRoot":"","sources":["../../../../src/controllers/authentication/mocks/mockResponses.ts"],"names":[],"mappings":";;;AAAA,sDAUiC;AAQpB,QAAA,mBAAmB,GAAG,0BAAuB,CAAC;AAC9C,QAAA,UAAU,GAAG,2BAAmB,CAAC,KAAK,CAAC;AACvC,QAAA,QAAQ,GAAG,eAAY,CAAC;AAE9B,MAAM,wBAAwB,GAAG,GAAiB,EAAE;IACzD,OAAO;QACL,GAAG,EAAE,qBAAc;QACnB,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,CACR,CAAW,EACX,IAAa,EACb,+BAA+D,EACnC,EAAE;YAC9B,2FAA2F;YAC3F,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,+BAA+B,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAE1E,OAAO;gBACL,GAAG,2BAAmB;gBACtB,KAAK,EAAE,aAAa,IAAI,2BAAmB,CAAC,KAAK;gBACjD,UAAU,EAAE,2BAAmB,CAAC,UAAU;aAC3C,CAAC;QACJ,CAAC;KACqB,CAAC;AAC3B,CAAC,CAAC;AArBW,QAAA,wBAAwB,4BAqBnC;AAEW,QAAA,mBAAmB,GAAG,8BAA2B,CAAC;AAExD,MAAM,wBAAwB,GAAG,GAAiB,EAAE;IACzD,OAAO;QACL,GAAG,EAAE,yBAAkB;QACvB,aAAa,EAAE,MAAM;QACrB,mHAAmH;QACnH,+DAA+D;QAC/D,QAAQ,EAAE,CAAC,eAEV,EAA8B,EAAE;YAC/B,MAAM,kBAAkB,GAAG,eAAe,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnE,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAE1E,OAAO;gBACL,GAAG,2BAAmB;gBACtB,KAAK,EAAE,aAAa,IAAI,2BAAmB,CAAC,KAAK;gBACjD,OAAO,EAAE;oBACP,GAAG,2BAAmB,CAAC,OAAO;oBAC9B,UAAU,EAAE,aAAa,IAAI,2BAAmB,CAAC,OAAO,CAAC,UAAU;oBACnE,aAAa,EACX,aAAa,IAAI,2BAAmB,CAAC,OAAO,CAAC,aAAa;iBAC7D;aACF,CAAC;QACJ,CAAC;KACqB,CAAC;AAC3B,CAAC,CAAC;AAxBW,QAAA,wBAAwB,4BAwBnC;AAEW,QAAA,wBAAwB,GAAG,+BAA4B,CAAC;AAErE,MAAM,uBAAuB,GAAG,UAAU,CAAC,CAAC,aAAa;AAEzD;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAU,EAAE;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAClE,CAAC;IACF,OAAO,GAAG,MAAM,IAAI,OAAO,OAAO,CAAC;AACrC,CAAC,CAAC;AAEF;;;;;;;GAOG;AACI,MAAM,uBAAuB,GAAG,CAAC,KAAa,EAAU,EAAE;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9C,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAbW,QAAA,uBAAuB,2BAalC;AAEW,QAAA,2BAA2B,GAAG,kCAA+B,CAAC;AAEpE,MAAM,uBAAuB,GAAG,GAAiB,EAAE;IACxD,OAAO;QACL,GAAG,EAAE,6BAAsB;QAC3B,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,mCAA2B;KACf,CAAC;AAC3B,CAAC,CAAC;AANW,QAAA,uBAAuB,2BAMlC;AAEK,MAAM,8BAA8B,GAAG,GAAiB,EAAE;IAC/D,OAAO;QACL,GAAG,EAAE,0BAAmB;QACxB,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,CAAC,eAAwB,EAAmC,EAAE;YACtE,2EAA2E;YAC3E,4EAA4E;YAC5E,MAAM,aAAa,GAAG,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC,GAAG,CAC5D,WAAW,CACZ,CAAC;YAEF,OAAO;gBACL,GAAG,gCAAwB;gBAC3B,YAAY,EAAE,aAAa;oBACzB,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC;oBAC9B,CAAC,CAAC,gCAAwB,CAAC,YAAY;aAC1C,CAAC;QACJ,CAAC;KACqB,CAAC;AAC3B,CAAC,CAAC;AAnBW,QAAA,8BAA8B,kCAmBzC","sourcesContent":["import {\n  MOCK_NONCE_RESPONSE as SDK_MOCK_NONCE_RESPONSE,\n  MOCK_JWT as SDK_MOCK_JWT,\n  MOCK_SRP_LOGIN_RESPONSE as SDK_MOCK_SRP_LOGIN_RESPONSE,\n  MOCK_OIDC_TOKEN_RESPONSE as SDK_MOCK_OIDC_TOKEN_RESPONSE,\n  MOCK_PAIR_PROFILES_RESPONSE as SDK_MOCK_PAIR_PROFILES_RESPONSE,\n  MOCK_NONCE_URL,\n  MOCK_SRP_LOGIN_URL,\n  MOCK_OIDC_TOKEN_URL,\n  MOCK_PAIR_PROFILES_URL,\n} from '../../../sdk/mocks/auth';\n\ntype MockResponse = {\n  url: string;\n  requestMethod: 'GET' | 'POST' | 'PUT';\n  response: unknown;\n};\n\nexport const MOCK_NONCE_RESPONSE = SDK_MOCK_NONCE_RESPONSE;\nexport const MOCK_NONCE = MOCK_NONCE_RESPONSE.nonce;\nexport const MOCK_JWT = SDK_MOCK_JWT;\n\nexport const getMockAuthNonceResponse = (): MockResponse => {\n  return {\n    url: MOCK_NONCE_URL,\n    requestMethod: 'GET',\n    response: (\n      _?: unknown,\n      path?: string,\n      getE2ESrpIdentifierForPublicKey?: (publicKey: string) => string,\n    ): typeof MOCK_NONCE_RESPONSE => {\n      // The goal here is to have this identifier bubble all the way up to being the access token\n      // That way, we can use it to segregate data in the test environment\n      const identifier = path?.split('?identifier=')[1];\n      const e2eIdentifier = getE2ESrpIdentifierForPublicKey?.(identifier ?? '');\n\n      return {\n        ...MOCK_NONCE_RESPONSE,\n        nonce: e2eIdentifier ?? MOCK_NONCE_RESPONSE.nonce,\n        identifier: MOCK_NONCE_RESPONSE.identifier,\n      };\n    },\n  } satisfies MockResponse;\n};\n\nexport const MOCK_LOGIN_RESPONSE = SDK_MOCK_SRP_LOGIN_RESPONSE;\n\nexport const getMockAuthLoginResponse = (): MockResponse => {\n  return {\n    url: MOCK_SRP_LOGIN_URL,\n    requestMethod: 'POST',\n    // In case this mock is used in an E2E test, we populate token, profile_id and identifier_id with the e2eIdentifier\n    // to make it easier to segregate data in the test environment.\n    response: (requestJsonBody?: {\n      raw_message: string;\n    }): typeof MOCK_LOGIN_RESPONSE => {\n      const splittedRawMessage = requestJsonBody?.raw_message.split(':');\n      const e2eIdentifier = splittedRawMessage?.[splittedRawMessage.length - 2];\n\n      return {\n        ...MOCK_LOGIN_RESPONSE,\n        token: e2eIdentifier ?? MOCK_LOGIN_RESPONSE.token,\n        profile: {\n          ...MOCK_LOGIN_RESPONSE.profile,\n          profile_id: e2eIdentifier ?? MOCK_LOGIN_RESPONSE.profile.profile_id,\n          identifier_id:\n            e2eIdentifier ?? MOCK_LOGIN_RESPONSE.profile.identifier_id,\n        },\n      };\n    },\n  } satisfies MockResponse;\n};\n\nexport const MOCK_OATH_TOKEN_RESPONSE = SDK_MOCK_OIDC_TOKEN_RESPONSE;\n\nconst MOCK_JWT_FAR_FUTURE_EXP = 4102444800; // 2100-01-01\n\n/**\n * Wraps a plain-text identifier in a minimal JWT so that client-side\n * JWT validation (exp check) passes in E2E tests. The identifier is\n * stored in the `sub` claim and can be extracted via {@link getE2EIdentifierFromJwt}.\n *\n * @param identifier - The plain-text E2E identifier to wrap.\n * @returns A JWT-shaped string containing the identifier.\n */\nconst wrapInMockJwt = (identifier: string): string => {\n  const header = btoa(JSON.stringify({ alg: 'none', typ: 'JWT' }));\n  const payload = btoa(\n    JSON.stringify({ sub: identifier, exp: MOCK_JWT_FAR_FUTURE_EXP }),\n  );\n  return `${header}.${payload}.mock`;\n};\n\n/**\n * Extracts the E2E identifier (`sub` claim) from a mock JWT created\n * by {@link wrapInMockJwt}. Falls back to returning the raw token if\n * decoding fails (backward compatibility with raw-identifier headers).\n *\n * @param token - A bearer token string (JWT or raw identifier).\n * @returns The decoded identifier, or the original token as-is.\n */\nexport const getE2EIdentifierFromJwt = (token: string): string => {\n  try {\n    const parts = token.split('.');\n    if (parts.length === 3) {\n      const { sub } = JSON.parse(atob(parts[1]));\n      if (typeof sub === 'string' && sub.length > 0) {\n        return sub;\n      }\n    }\n  } catch {\n    // not a JWT — fall through\n  }\n  return token;\n};\n\nexport const MOCK_PAIR_PROFILES_RESPONSE = SDK_MOCK_PAIR_PROFILES_RESPONSE;\n\nexport const getMockAuthPairResponse = (): MockResponse => {\n  return {\n    url: MOCK_PAIR_PROFILES_URL,\n    requestMethod: 'POST',\n    response: MOCK_PAIR_PROFILES_RESPONSE,\n  } satisfies MockResponse;\n};\n\nexport const getMockAuthAccessTokenResponse = (): MockResponse => {\n  return {\n    url: MOCK_OIDC_TOKEN_URL,\n    requestMethod: 'POST',\n    response: (requestJsonBody?: string): typeof MOCK_OATH_TOKEN_RESPONSE => {\n      // We wrap the e2eIdentifier in a JWT so client-side JWT validation passes.\n      // The mock server extracts the identifier back via getE2EIdentifierFromJwt.\n      const e2eIdentifier = new URLSearchParams(requestJsonBody).get(\n        'assertion',\n      );\n\n      return {\n        ...MOCK_OATH_TOKEN_RESPONSE,\n        access_token: e2eIdentifier\n          ? wrapInMockJwt(e2eIdentifier)\n          : MOCK_OATH_TOKEN_RESPONSE.access_token,\n      };\n    },\n  } satisfies MockResponse;\n};\n"]}
+{"version":3,"file":"mockResponses.cjs","sourceRoot":"","sources":["../../../../src/controllers/authentication/mocks/mockResponses.ts"],"names":[],"mappings":";;;AAAA,sDAYiC;AAQpB,QAAA,mBAAmB,GAAG,0BAAuB,CAAC;AAC9C,QAAA,UAAU,GAAG,2BAAmB,CAAC,KAAK,CAAC;AACvC,QAAA,QAAQ,GAAG,eAAY,CAAC;AAE9B,MAAM,wBAAwB,GAAG,GAAiB,EAAE;IACzD,OAAO;QACL,GAAG,EAAE,qBAAc;QACnB,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,CACR,CAAW,EACX,IAAa,EACb,+BAA+D,EACnC,EAAE;YAC9B,2FAA2F;YAC3F,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,+BAA+B,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAE1E,OAAO;gBACL,GAAG,2BAAmB;gBACtB,KAAK,EAAE,aAAa,IAAI,2BAAmB,CAAC,KAAK;gBACjD,UAAU,EAAE,2BAAmB,CAAC,UAAU;aAC3C,CAAC;QACJ,CAAC;KACqB,CAAC;AAC3B,CAAC,CAAC;AArBW,QAAA,wBAAwB,4BAqBnC;AAEW,QAAA,mBAAmB,GAAG,8BAA2B,CAAC;AAExD,MAAM,wBAAwB,GAAG,GAAiB,EAAE;IACzD,OAAO;QACL,GAAG,EAAE,yBAAkB;QACvB,aAAa,EAAE,MAAM;QACrB,mHAAmH;QACnH,+DAA+D;QAC/D,QAAQ,EAAE,CAAC,eAEV,EAA8B,EAAE;YAC/B,MAAM,kBAAkB,GAAG,eAAe,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnE,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAE1E,OAAO;gBACL,GAAG,2BAAmB;gBACtB,KAAK,EAAE,aAAa,IAAI,2BAAmB,CAAC,KAAK;gBACjD,OAAO,EAAE;oBACP,GAAG,2BAAmB,CAAC,OAAO;oBAC9B,UAAU,EAAE,aAAa,IAAI,2BAAmB,CAAC,OAAO,CAAC,UAAU;oBACnE,aAAa,EACX,aAAa,IAAI,2BAAmB,CAAC,OAAO,CAAC,aAAa;iBAC7D;aACF,CAAC;QACJ,CAAC;KACqB,CAAC;AAC3B,CAAC,CAAC;AAxBW,QAAA,wBAAwB,4BAwBnC;AAEW,QAAA,wBAAwB,GAAG,+BAA4B,CAAC;AAErE,MAAM,uBAAuB,GAAG,UAAU,CAAC,CAAC,aAAa;AAEzD;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAU,EAAE;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAClE,CAAC;IACF,OAAO,GAAG,MAAM,IAAI,OAAO,OAAO,CAAC;AACrC,CAAC,CAAC;AAEF;;;;;;;GAOG;AACI,MAAM,uBAAuB,GAAG,CAAC,KAAa,EAAU,EAAE;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9C,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAbW,QAAA,uBAAuB,2BAalC;AAEW,QAAA,2BAA2B,GAAG,kCAA+B,CAAC;AAEpE,MAAM,uBAAuB,GAAG,GAAiB,EAAE;IACxD,OAAO;QACL,GAAG,EAAE,6BAAsB;QAC3B,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,mCAA2B;KACf,CAAC;AAC3B,CAAC,CAAC;AANW,QAAA,uBAAuB,2BAMlC;AAEK,MAAM,8BAA8B,GAAG,GAAiB,EAAE;IAC/D,OAAO;QACL,GAAG,EAAE,0BAAmB;QACxB,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,CAAC,eAAwB,EAAmC,EAAE;YACtE,2EAA2E;YAC3E,4EAA4E;YAC5E,MAAM,aAAa,GAAG,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC,GAAG,CAC5D,WAAW,CACZ,CAAC;YAEF,OAAO;gBACL,GAAG,gCAAwB;gBAC3B,YAAY,EAAE,aAAa;oBACzB,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC;oBAC9B,CAAC,CAAC,gCAAwB,CAAC,YAAY;aAC1C,CAAC;QACJ,CAAC;KACqB,CAAC;AAC3B,CAAC,CAAC;AAnBW,QAAA,8BAA8B,kCAmBzC;AAEW,QAAA,oCAAoC,GAC/C,2CAAwC,CAAC;AAEpC,MAAM,mCAAmC,GAAG,GAAiB,EAAE;IACpE,OAAO;QACL,GAAG,EAAE,sCAA+B;QACpC,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,4CAAoC;KACxB,CAAC;AAC3B,CAAC,CAAC;AANW,QAAA,mCAAmC,uCAM9C","sourcesContent":["import {\n  MOCK_NONCE_RESPONSE as SDK_MOCK_NONCE_RESPONSE,\n  MOCK_JWT as SDK_MOCK_JWT,\n  MOCK_SRP_LOGIN_RESPONSE as SDK_MOCK_SRP_LOGIN_RESPONSE,\n  MOCK_OIDC_TOKEN_RESPONSE as SDK_MOCK_OIDC_TOKEN_RESPONSE,\n  MOCK_PAIR_PROFILES_RESPONSE as SDK_MOCK_PAIR_PROFILES_RESPONSE,\n  MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE as SDK_MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE,\n  MOCK_NONCE_URL,\n  MOCK_SRP_LOGIN_URL,\n  MOCK_OIDC_TOKEN_URL,\n  MOCK_PAIR_PROFILES_URL,\n  MOCK_CUSTOMER_SERVICE_TOKEN_URL,\n} from '../../../sdk/mocks/auth';\n\ntype MockResponse = {\n  url: string;\n  requestMethod: 'GET' | 'POST' | 'PUT';\n  response: unknown;\n};\n\nexport const MOCK_NONCE_RESPONSE = SDK_MOCK_NONCE_RESPONSE;\nexport const MOCK_NONCE = MOCK_NONCE_RESPONSE.nonce;\nexport const MOCK_JWT = SDK_MOCK_JWT;\n\nexport const getMockAuthNonceResponse = (): MockResponse => {\n  return {\n    url: MOCK_NONCE_URL,\n    requestMethod: 'GET',\n    response: (\n      _?: unknown,\n      path?: string,\n      getE2ESrpIdentifierForPublicKey?: (publicKey: string) => string,\n    ): typeof MOCK_NONCE_RESPONSE => {\n      // The goal here is to have this identifier bubble all the way up to being the access token\n      // That way, we can use it to segregate data in the test environment\n      const identifier = path?.split('?identifier=')[1];\n      const e2eIdentifier = getE2ESrpIdentifierForPublicKey?.(identifier ?? '');\n\n      return {\n        ...MOCK_NONCE_RESPONSE,\n        nonce: e2eIdentifier ?? MOCK_NONCE_RESPONSE.nonce,\n        identifier: MOCK_NONCE_RESPONSE.identifier,\n      };\n    },\n  } satisfies MockResponse;\n};\n\nexport const MOCK_LOGIN_RESPONSE = SDK_MOCK_SRP_LOGIN_RESPONSE;\n\nexport const getMockAuthLoginResponse = (): MockResponse => {\n  return {\n    url: MOCK_SRP_LOGIN_URL,\n    requestMethod: 'POST',\n    // In case this mock is used in an E2E test, we populate token, profile_id and identifier_id with the e2eIdentifier\n    // to make it easier to segregate data in the test environment.\n    response: (requestJsonBody?: {\n      raw_message: string;\n    }): typeof MOCK_LOGIN_RESPONSE => {\n      const splittedRawMessage = requestJsonBody?.raw_message.split(':');\n      const e2eIdentifier = splittedRawMessage?.[splittedRawMessage.length - 2];\n\n      return {\n        ...MOCK_LOGIN_RESPONSE,\n        token: e2eIdentifier ?? MOCK_LOGIN_RESPONSE.token,\n        profile: {\n          ...MOCK_LOGIN_RESPONSE.profile,\n          profile_id: e2eIdentifier ?? MOCK_LOGIN_RESPONSE.profile.profile_id,\n          identifier_id:\n            e2eIdentifier ?? MOCK_LOGIN_RESPONSE.profile.identifier_id,\n        },\n      };\n    },\n  } satisfies MockResponse;\n};\n\nexport const MOCK_OATH_TOKEN_RESPONSE = SDK_MOCK_OIDC_TOKEN_RESPONSE;\n\nconst MOCK_JWT_FAR_FUTURE_EXP = 4102444800; // 2100-01-01\n\n/**\n * Wraps a plain-text identifier in a minimal JWT so that client-side\n * JWT validation (exp check) passes in E2E tests. The identifier is\n * stored in the `sub` claim and can be extracted via {@link getE2EIdentifierFromJwt}.\n *\n * @param identifier - The plain-text E2E identifier to wrap.\n * @returns A JWT-shaped string containing the identifier.\n */\nconst wrapInMockJwt = (identifier: string): string => {\n  const header = btoa(JSON.stringify({ alg: 'none', typ: 'JWT' }));\n  const payload = btoa(\n    JSON.stringify({ sub: identifier, exp: MOCK_JWT_FAR_FUTURE_EXP }),\n  );\n  return `${header}.${payload}.mock`;\n};\n\n/**\n * Extracts the E2E identifier (`sub` claim) from a mock JWT created\n * by {@link wrapInMockJwt}. Falls back to returning the raw token if\n * decoding fails (backward compatibility with raw-identifier headers).\n *\n * @param token - A bearer token string (JWT or raw identifier).\n * @returns The decoded identifier, or the original token as-is.\n */\nexport const getE2EIdentifierFromJwt = (token: string): string => {\n  try {\n    const parts = token.split('.');\n    if (parts.length === 3) {\n      const { sub } = JSON.parse(atob(parts[1]));\n      if (typeof sub === 'string' && sub.length > 0) {\n        return sub;\n      }\n    }\n  } catch {\n    // not a JWT — fall through\n  }\n  return token;\n};\n\nexport const MOCK_PAIR_PROFILES_RESPONSE = SDK_MOCK_PAIR_PROFILES_RESPONSE;\n\nexport const getMockAuthPairResponse = (): MockResponse => {\n  return {\n    url: MOCK_PAIR_PROFILES_URL,\n    requestMethod: 'POST',\n    response: MOCK_PAIR_PROFILES_RESPONSE,\n  } satisfies MockResponse;\n};\n\nexport const getMockAuthAccessTokenResponse = (): MockResponse => {\n  return {\n    url: MOCK_OIDC_TOKEN_URL,\n    requestMethod: 'POST',\n    response: (requestJsonBody?: string): typeof MOCK_OATH_TOKEN_RESPONSE => {\n      // We wrap the e2eIdentifier in a JWT so client-side JWT validation passes.\n      // The mock server extracts the identifier back via getE2EIdentifierFromJwt.\n      const e2eIdentifier = new URLSearchParams(requestJsonBody).get(\n        'assertion',\n      );\n\n      return {\n        ...MOCK_OATH_TOKEN_RESPONSE,\n        access_token: e2eIdentifier\n          ? wrapInMockJwt(e2eIdentifier)\n          : MOCK_OATH_TOKEN_RESPONSE.access_token,\n      };\n    },\n  } satisfies MockResponse;\n};\n\nexport const MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE =\n  SDK_MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE;\n\nexport const getMockCustomerServiceTokenResponse = (): MockResponse => {\n  return {\n    url: MOCK_CUSTOMER_SERVICE_TOKEN_URL,\n    requestMethod: 'POST',\n    response: MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE,\n  } satisfies MockResponse;\n};\n"]}

package/dist/controllers/authentication/mocks/mockResponses.d.cts

@@ -47,5 +47,12 @@ export declare const MOCK_PAIR_PROFILES_RESPONSE: {
 };
 export declare const getMockAuthPairResponse: () => MockResponse;
 export declare const getMockAuthAccessTokenResponse: () => MockResponse;
+export declare const MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE: {
+    access_token: string;
+    refresh_token: string;
+    expires_in: number;
+    token_type: string;
+};
+export declare const getMockCustomerServiceTokenResponse: () => MockResponse;
 export {};
 //# sourceMappingURL=mockResponses.d.cts.map

package/dist/controllers/authentication/mocks/mockResponses.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"mockResponses.d.cts","sourceRoot":"","sources":["../../../../src/controllers/authentication/mocks/mockResponses.ts"],"names":[],"mappings":"AAYA,KAAK,YAAY,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;CAA0B,CAAC;AAC3D,eAAO,MAAM,UAAU,QAA4B,CAAC;AACpD,eAAO,MAAM,QAAQ,upBAAe,CAAC;AAErC,eAAO,MAAM,wBAAwB,QAAO,YAqB3C,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;CAA8B,CAAC;AAE/D,eAAO,MAAM,wBAAwB,QAAO,YAwB3C,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;CAA+B,CAAC;AAoBrE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,UAAW,MAAM,KAAG,MAavD,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;;CAAkC,CAAC;AAE3E,eAAO,MAAM,uBAAuB,QAAO,YAM1C,CAAC;AAEF,eAAO,MAAM,8BAA8B,QAAO,YAmBjD,CAAC"}
+{"version":3,"file":"mockResponses.d.cts","sourceRoot":"","sources":["../../../../src/controllers/authentication/mocks/mockResponses.ts"],"names":[],"mappings":"AAcA,KAAK,YAAY,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;CAA0B,CAAC;AAC3D,eAAO,MAAM,UAAU,QAA4B,CAAC;AACpD,eAAO,MAAM,QAAQ,upBAAe,CAAC;AAErC,eAAO,MAAM,wBAAwB,QAAO,YAqB3C,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;CAA8B,CAAC;AAE/D,eAAO,MAAM,wBAAwB,QAAO,YAwB3C,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;CAA+B,CAAC;AAoBrE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,UAAW,MAAM,KAAG,MAavD,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;;CAAkC,CAAC;AAE3E,eAAO,MAAM,uBAAuB,QAAO,YAM1C,CAAC;AAEF,eAAO,MAAM,8BAA8B,QAAO,YAmBjD,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;CACP,CAAC;AAE3C,eAAO,MAAM,mCAAmC,QAAO,YAMtD,CAAC"}

package/dist/controllers/authentication/mocks/mockResponses.d.mts

@@ -47,5 +47,12 @@ export declare const MOCK_PAIR_PROFILES_RESPONSE: {
 };
 export declare const getMockAuthPairResponse: () => MockResponse;
 export declare const getMockAuthAccessTokenResponse: () => MockResponse;
+export declare const MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE: {
+    access_token: string;
+    refresh_token: string;
+    expires_in: number;
+    token_type: string;
+};
+export declare const getMockCustomerServiceTokenResponse: () => MockResponse;
 export {};
 //# sourceMappingURL=mockResponses.d.mts.map

package/dist/controllers/authentication/mocks/mockResponses.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"mockResponses.d.mts","sourceRoot":"","sources":["../../../../src/controllers/authentication/mocks/mockResponses.ts"],"names":[],"mappings":"AAYA,KAAK,YAAY,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;CAA0B,CAAC;AAC3D,eAAO,MAAM,UAAU,QAA4B,CAAC;AACpD,eAAO,MAAM,QAAQ,upBAAe,CAAC;AAErC,eAAO,MAAM,wBAAwB,QAAO,YAqB3C,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;CAA8B,CAAC;AAE/D,eAAO,MAAM,wBAAwB,QAAO,YAwB3C,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;CAA+B,CAAC;AAoBrE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,UAAW,MAAM,KAAG,MAavD,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;;CAAkC,CAAC;AAE3E,eAAO,MAAM,uBAAuB,QAAO,YAM1C,CAAC;AAEF,eAAO,MAAM,8BAA8B,QAAO,YAmBjD,CAAC"}
+{"version":3,"file":"mockResponses.d.mts","sourceRoot":"","sources":["../../../../src/controllers/authentication/mocks/mockResponses.ts"],"names":[],"mappings":"AAcA,KAAK,YAAY,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;CAA0B,CAAC;AAC3D,eAAO,MAAM,UAAU,QAA4B,CAAC;AACpD,eAAO,MAAM,QAAQ,upBAAe,CAAC;AAErC,eAAO,MAAM,wBAAwB,QAAO,YAqB3C,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;CAA8B,CAAC;AAE/D,eAAO,MAAM,wBAAwB,QAAO,YAwB3C,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;CAA+B,CAAC;AAoBrE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,UAAW,MAAM,KAAG,MAavD,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;;CAAkC,CAAC;AAE3E,eAAO,MAAM,uBAAuB,QAAO,YAM1C,CAAC;AAEF,eAAO,MAAM,8BAA8B,QAAO,YAmBjD,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;CACP,CAAC;AAE3C,eAAO,MAAM,mCAAmC,QAAO,YAMtD,CAAC"}

package/dist/controllers/authentication/mocks/mockResponses.mjs

@@ -1,4 +1,4 @@
-import { MOCK_NONCE_RESPONSE as SDK_MOCK_NONCE_RESPONSE, MOCK_JWT as SDK_MOCK_JWT, MOCK_SRP_LOGIN_RESPONSE as SDK_MOCK_SRP_LOGIN_RESPONSE, MOCK_OIDC_TOKEN_RESPONSE as SDK_MOCK_OIDC_TOKEN_RESPONSE, MOCK_PAIR_PROFILES_RESPONSE as SDK_MOCK_PAIR_PROFILES_RESPONSE, MOCK_NONCE_URL, MOCK_SRP_LOGIN_URL, MOCK_OIDC_TOKEN_URL, MOCK_PAIR_PROFILES_URL } from "../../../sdk/mocks/auth.mjs";
+import { MOCK_NONCE_RESPONSE as SDK_MOCK_NONCE_RESPONSE, MOCK_JWT as SDK_MOCK_JWT, MOCK_SRP_LOGIN_RESPONSE as SDK_MOCK_SRP_LOGIN_RESPONSE, MOCK_OIDC_TOKEN_RESPONSE as SDK_MOCK_OIDC_TOKEN_RESPONSE, MOCK_PAIR_PROFILES_RESPONSE as SDK_MOCK_PAIR_PROFILES_RESPONSE, MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE as SDK_MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE, MOCK_NONCE_URL, MOCK_SRP_LOGIN_URL, MOCK_OIDC_TOKEN_URL, MOCK_PAIR_PROFILES_URL, MOCK_CUSTOMER_SERVICE_TOKEN_URL } from "../../../sdk/mocks/auth.mjs";
 export const MOCK_NONCE_RESPONSE = SDK_MOCK_NONCE_RESPONSE;
 export const MOCK_NONCE = MOCK_NONCE_RESPONSE.nonce;
 export const MOCK_JWT = SDK_MOCK_JWT;
@@ -104,4 +104,12 @@ export const getMockAuthAccessTokenResponse = () => {
         },
     };
 };
+export const MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE = SDK_MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE;
+export const getMockCustomerServiceTokenResponse = () => {
+    return {
+        url: MOCK_CUSTOMER_SERVICE_TOKEN_URL,
+        requestMethod: 'POST',
+        response: MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE,
+    };
+};
 //# sourceMappingURL=mockResponses.mjs.map

package/dist/controllers/authentication/mocks/mockResponses.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mockResponses.mjs","sourceRoot":"","sources":["../../../../src/controllers/authentication/mocks/mockResponses.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,IAAI,uBAAuB,EAC9C,QAAQ,IAAI,YAAY,EACxB,uBAAuB,IAAI,2BAA2B,EACtD,wBAAwB,IAAI,4BAA4B,EACxD,2BAA2B,IAAI,+BAA+B,EAC9D,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACvB,oCAAgC;AAQjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAC3D,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC;AACpD,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAiB,EAAE;IACzD,OAAO;QACL,GAAG,EAAE,cAAc;QACnB,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,CACR,CAAW,EACX,IAAa,EACb,+BAA+D,EACnC,EAAE;YAC9B,2FAA2F;YAC3F,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,+BAA+B,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAE1E,OAAO;gBACL,GAAG,mBAAmB;gBACtB,KAAK,EAAE,aAAa,IAAI,mBAAmB,CAAC,KAAK;gBACjD,UAAU,EAAE,mBAAmB,CAAC,UAAU;aAC3C,CAAC;QACJ,CAAC;KACqB,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAiB,EAAE;IACzD,OAAO;QACL,GAAG,EAAE,kBAAkB;QACvB,aAAa,EAAE,MAAM;QACrB,mHAAmH;QACnH,+DAA+D;QAC/D,QAAQ,EAAE,CAAC,eAEV,EAA8B,EAAE;YAC/B,MAAM,kBAAkB,GAAG,eAAe,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnE,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAE1E,OAAO;gBACL,GAAG,mBAAmB;gBACtB,KAAK,EAAE,aAAa,IAAI,mBAAmB,CAAC,KAAK;gBACjD,OAAO,EAAE;oBACP,GAAG,mBAAmB,CAAC,OAAO;oBAC9B,UAAU,EAAE,aAAa,IAAI,mBAAmB,CAAC,OAAO,CAAC,UAAU;oBACnE,aAAa,EACX,aAAa,IAAI,mBAAmB,CAAC,OAAO,CAAC,aAAa;iBAC7D;aACF,CAAC;QACJ,CAAC;KACqB,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAErE,MAAM,uBAAuB,GAAG,UAAU,CAAC,CAAC,aAAa;AAEzD;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAU,EAAE;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAClE,CAAC;IACF,OAAO,GAAG,MAAM,IAAI,OAAO,OAAO,CAAC;AACrC,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAa,EAAU,EAAE;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9C,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,CAAC;AAE3E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAiB,EAAE;IACxD,OAAO;QACL,GAAG,EAAE,sBAAsB;QAC3B,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,2BAA2B;KACf,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAiB,EAAE;IAC/D,OAAO;QACL,GAAG,EAAE,mBAAmB;QACxB,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,CAAC,eAAwB,EAAmC,EAAE;YACtE,2EAA2E;YAC3E,4EAA4E;YAC5E,MAAM,aAAa,GAAG,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC,GAAG,CAC5D,WAAW,CACZ,CAAC;YAEF,OAAO;gBACL,GAAG,wBAAwB;gBAC3B,YAAY,EAAE,aAAa;oBACzB,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC;oBAC9B,CAAC,CAAC,wBAAwB,CAAC,YAAY;aAC1C,CAAC;QACJ,CAAC;KACqB,CAAC;AAC3B,CAAC,CAAC","sourcesContent":["import {\n  MOCK_NONCE_RESPONSE as SDK_MOCK_NONCE_RESPONSE,\n  MOCK_JWT as SDK_MOCK_JWT,\n  MOCK_SRP_LOGIN_RESPONSE as SDK_MOCK_SRP_LOGIN_RESPONSE,\n  MOCK_OIDC_TOKEN_RESPONSE as SDK_MOCK_OIDC_TOKEN_RESPONSE,\n  MOCK_PAIR_PROFILES_RESPONSE as SDK_MOCK_PAIR_PROFILES_RESPONSE,\n  MOCK_NONCE_URL,\n  MOCK_SRP_LOGIN_URL,\n  MOCK_OIDC_TOKEN_URL,\n  MOCK_PAIR_PROFILES_URL,\n} from '../../../sdk/mocks/auth';\n\ntype MockResponse = {\n  url: string;\n  requestMethod: 'GET' | 'POST' | 'PUT';\n  response: unknown;\n};\n\nexport const MOCK_NONCE_RESPONSE = SDK_MOCK_NONCE_RESPONSE;\nexport const MOCK_NONCE = MOCK_NONCE_RESPONSE.nonce;\nexport const MOCK_JWT = SDK_MOCK_JWT;\n\nexport const getMockAuthNonceResponse = (): MockResponse => {\n  return {\n    url: MOCK_NONCE_URL,\n    requestMethod: 'GET',\n    response: (\n      _?: unknown,\n      path?: string,\n      getE2ESrpIdentifierForPublicKey?: (publicKey: string) => string,\n    ): typeof MOCK_NONCE_RESPONSE => {\n      // The goal here is to have this identifier bubble all the way up to being the access token\n      // That way, we can use it to segregate data in the test environment\n      const identifier = path?.split('?identifier=')[1];\n      const e2eIdentifier = getE2ESrpIdentifierForPublicKey?.(identifier ?? '');\n\n      return {\n        ...MOCK_NONCE_RESPONSE,\n        nonce: e2eIdentifier ?? MOCK_NONCE_RESPONSE.nonce,\n        identifier: MOCK_NONCE_RESPONSE.identifier,\n      };\n    },\n  } satisfies MockResponse;\n};\n\nexport const MOCK_LOGIN_RESPONSE = SDK_MOCK_SRP_LOGIN_RESPONSE;\n\nexport const getMockAuthLoginResponse = (): MockResponse => {\n  return {\n    url: MOCK_SRP_LOGIN_URL,\n    requestMethod: 'POST',\n    // In case this mock is used in an E2E test, we populate token, profile_id and identifier_id with the e2eIdentifier\n    // to make it easier to segregate data in the test environment.\n    response: (requestJsonBody?: {\n      raw_message: string;\n    }): typeof MOCK_LOGIN_RESPONSE => {\n      const splittedRawMessage = requestJsonBody?.raw_message.split(':');\n      const e2eIdentifier = splittedRawMessage?.[splittedRawMessage.length - 2];\n\n      return {\n        ...MOCK_LOGIN_RESPONSE,\n        token: e2eIdentifier ?? MOCK_LOGIN_RESPONSE.token,\n        profile: {\n          ...MOCK_LOGIN_RESPONSE.profile,\n          profile_id: e2eIdentifier ?? MOCK_LOGIN_RESPONSE.profile.profile_id,\n          identifier_id:\n            e2eIdentifier ?? MOCK_LOGIN_RESPONSE.profile.identifier_id,\n        },\n      };\n    },\n  } satisfies MockResponse;\n};\n\nexport const MOCK_OATH_TOKEN_RESPONSE = SDK_MOCK_OIDC_TOKEN_RESPONSE;\n\nconst MOCK_JWT_FAR_FUTURE_EXP = 4102444800; // 2100-01-01\n\n/**\n * Wraps a plain-text identifier in a minimal JWT so that client-side\n * JWT validation (exp check) passes in E2E tests. The identifier is\n * stored in the `sub` claim and can be extracted via {@link getE2EIdentifierFromJwt}.\n *\n * @param identifier - The plain-text E2E identifier to wrap.\n * @returns A JWT-shaped string containing the identifier.\n */\nconst wrapInMockJwt = (identifier: string): string => {\n  const header = btoa(JSON.stringify({ alg: 'none', typ: 'JWT' }));\n  const payload = btoa(\n    JSON.stringify({ sub: identifier, exp: MOCK_JWT_FAR_FUTURE_EXP }),\n  );\n  return `${header}.${payload}.mock`;\n};\n\n/**\n * Extracts the E2E identifier (`sub` claim) from a mock JWT created\n * by {@link wrapInMockJwt}. Falls back to returning the raw token if\n * decoding fails (backward compatibility with raw-identifier headers).\n *\n * @param token - A bearer token string (JWT or raw identifier).\n * @returns The decoded identifier, or the original token as-is.\n */\nexport const getE2EIdentifierFromJwt = (token: string): string => {\n  try {\n    const parts = token.split('.');\n    if (parts.length === 3) {\n      const { sub } = JSON.parse(atob(parts[1]));\n      if (typeof sub === 'string' && sub.length > 0) {\n        return sub;\n      }\n    }\n  } catch {\n    // not a JWT — fall through\n  }\n  return token;\n};\n\nexport const MOCK_PAIR_PROFILES_RESPONSE = SDK_MOCK_PAIR_PROFILES_RESPONSE;\n\nexport const getMockAuthPairResponse = (): MockResponse => {\n  return {\n    url: MOCK_PAIR_PROFILES_URL,\n    requestMethod: 'POST',\n    response: MOCK_PAIR_PROFILES_RESPONSE,\n  } satisfies MockResponse;\n};\n\nexport const getMockAuthAccessTokenResponse = (): MockResponse => {\n  return {\n    url: MOCK_OIDC_TOKEN_URL,\n    requestMethod: 'POST',\n    response: (requestJsonBody?: string): typeof MOCK_OATH_TOKEN_RESPONSE => {\n      // We wrap the e2eIdentifier in a JWT so client-side JWT validation passes.\n      // The mock server extracts the identifier back via getE2EIdentifierFromJwt.\n      const e2eIdentifier = new URLSearchParams(requestJsonBody).get(\n        'assertion',\n      );\n\n      return {\n        ...MOCK_OATH_TOKEN_RESPONSE,\n        access_token: e2eIdentifier\n          ? wrapInMockJwt(e2eIdentifier)\n          : MOCK_OATH_TOKEN_RESPONSE.access_token,\n      };\n    },\n  } satisfies MockResponse;\n};\n"]}
+{"version":3,"file":"mockResponses.mjs","sourceRoot":"","sources":["../../../../src/controllers/authentication/mocks/mockResponses.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,IAAI,uBAAuB,EAC9C,QAAQ,IAAI,YAAY,EACxB,uBAAuB,IAAI,2BAA2B,EACtD,wBAAwB,IAAI,4BAA4B,EACxD,2BAA2B,IAAI,+BAA+B,EAC9D,oCAAoC,IAAI,wCAAwC,EAChF,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,+BAA+B,EAChC,oCAAgC;AAQjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAC3D,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC;AACpD,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAiB,EAAE;IACzD,OAAO;QACL,GAAG,EAAE,cAAc;QACnB,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,CACR,CAAW,EACX,IAAa,EACb,+BAA+D,EACnC,EAAE;YAC9B,2FAA2F;YAC3F,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,+BAA+B,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAE1E,OAAO;gBACL,GAAG,mBAAmB;gBACtB,KAAK,EAAE,aAAa,IAAI,mBAAmB,CAAC,KAAK;gBACjD,UAAU,EAAE,mBAAmB,CAAC,UAAU;aAC3C,CAAC;QACJ,CAAC;KACqB,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAiB,EAAE;IACzD,OAAO;QACL,GAAG,EAAE,kBAAkB;QACvB,aAAa,EAAE,MAAM;QACrB,mHAAmH;QACnH,+DAA+D;QAC/D,QAAQ,EAAE,CAAC,eAEV,EAA8B,EAAE;YAC/B,MAAM,kBAAkB,GAAG,eAAe,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnE,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAE1E,OAAO;gBACL,GAAG,mBAAmB;gBACtB,KAAK,EAAE,aAAa,IAAI,mBAAmB,CAAC,KAAK;gBACjD,OAAO,EAAE;oBACP,GAAG,mBAAmB,CAAC,OAAO;oBAC9B,UAAU,EAAE,aAAa,IAAI,mBAAmB,CAAC,OAAO,CAAC,UAAU;oBACnE,aAAa,EACX,aAAa,IAAI,mBAAmB,CAAC,OAAO,CAAC,aAAa;iBAC7D;aACF,CAAC;QACJ,CAAC;KACqB,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAErE,MAAM,uBAAuB,GAAG,UAAU,CAAC,CAAC,aAAa;AAEzD;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAU,EAAE;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAClE,CAAC;IACF,OAAO,GAAG,MAAM,IAAI,OAAO,OAAO,CAAC;AACrC,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAa,EAAU,EAAE;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9C,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,CAAC;AAE3E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAiB,EAAE;IACxD,OAAO;QACL,GAAG,EAAE,sBAAsB;QAC3B,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,2BAA2B;KACf,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAiB,EAAE;IAC/D,OAAO;QACL,GAAG,EAAE,mBAAmB;QACxB,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,CAAC,eAAwB,EAAmC,EAAE;YACtE,2EAA2E;YAC3E,4EAA4E;YAC5E,MAAM,aAAa,GAAG,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC,GAAG,CAC5D,WAAW,CACZ,CAAC;YAEF,OAAO;gBACL,GAAG,wBAAwB;gBAC3B,YAAY,EAAE,aAAa;oBACzB,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC;oBAC9B,CAAC,CAAC,wBAAwB,CAAC,YAAY;aAC1C,CAAC;QACJ,CAAC;KACqB,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAC/C,wCAAwC,CAAC;AAE3C,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAiB,EAAE;IACpE,OAAO;QACL,GAAG,EAAE,+BAA+B;QACpC,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,oCAAoC;KACxB,CAAC;AAC3B,CAAC,CAAC","sourcesContent":["import {\n  MOCK_NONCE_RESPONSE as SDK_MOCK_NONCE_RESPONSE,\n  MOCK_JWT as SDK_MOCK_JWT,\n  MOCK_SRP_LOGIN_RESPONSE as SDK_MOCK_SRP_LOGIN_RESPONSE,\n  MOCK_OIDC_TOKEN_RESPONSE as SDK_MOCK_OIDC_TOKEN_RESPONSE,\n  MOCK_PAIR_PROFILES_RESPONSE as SDK_MOCK_PAIR_PROFILES_RESPONSE,\n  MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE as SDK_MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE,\n  MOCK_NONCE_URL,\n  MOCK_SRP_LOGIN_URL,\n  MOCK_OIDC_TOKEN_URL,\n  MOCK_PAIR_PROFILES_URL,\n  MOCK_CUSTOMER_SERVICE_TOKEN_URL,\n} from '../../../sdk/mocks/auth';\n\ntype MockResponse = {\n  url: string;\n  requestMethod: 'GET' | 'POST' | 'PUT';\n  response: unknown;\n};\n\nexport const MOCK_NONCE_RESPONSE = SDK_MOCK_NONCE_RESPONSE;\nexport const MOCK_NONCE = MOCK_NONCE_RESPONSE.nonce;\nexport const MOCK_JWT = SDK_MOCK_JWT;\n\nexport const getMockAuthNonceResponse = (): MockResponse => {\n  return {\n    url: MOCK_NONCE_URL,\n    requestMethod: 'GET',\n    response: (\n      _?: unknown,\n      path?: string,\n      getE2ESrpIdentifierForPublicKey?: (publicKey: string) => string,\n    ): typeof MOCK_NONCE_RESPONSE => {\n      // The goal here is to have this identifier bubble all the way up to being the access token\n      // That way, we can use it to segregate data in the test environment\n      const identifier = path?.split('?identifier=')[1];\n      const e2eIdentifier = getE2ESrpIdentifierForPublicKey?.(identifier ?? '');\n\n      return {\n        ...MOCK_NONCE_RESPONSE,\n        nonce: e2eIdentifier ?? MOCK_NONCE_RESPONSE.nonce,\n        identifier: MOCK_NONCE_RESPONSE.identifier,\n      };\n    },\n  } satisfies MockResponse;\n};\n\nexport const MOCK_LOGIN_RESPONSE = SDK_MOCK_SRP_LOGIN_RESPONSE;\n\nexport const getMockAuthLoginResponse = (): MockResponse => {\n  return {\n    url: MOCK_SRP_LOGIN_URL,\n    requestMethod: 'POST',\n    // In case this mock is used in an E2E test, we populate token, profile_id and identifier_id with the e2eIdentifier\n    // to make it easier to segregate data in the test environment.\n    response: (requestJsonBody?: {\n      raw_message: string;\n    }): typeof MOCK_LOGIN_RESPONSE => {\n      const splittedRawMessage = requestJsonBody?.raw_message.split(':');\n      const e2eIdentifier = splittedRawMessage?.[splittedRawMessage.length - 2];\n\n      return {\n        ...MOCK_LOGIN_RESPONSE,\n        token: e2eIdentifier ?? MOCK_LOGIN_RESPONSE.token,\n        profile: {\n          ...MOCK_LOGIN_RESPONSE.profile,\n          profile_id: e2eIdentifier ?? MOCK_LOGIN_RESPONSE.profile.profile_id,\n          identifier_id:\n            e2eIdentifier ?? MOCK_LOGIN_RESPONSE.profile.identifier_id,\n        },\n      };\n    },\n  } satisfies MockResponse;\n};\n\nexport const MOCK_OATH_TOKEN_RESPONSE = SDK_MOCK_OIDC_TOKEN_RESPONSE;\n\nconst MOCK_JWT_FAR_FUTURE_EXP = 4102444800; // 2100-01-01\n\n/**\n * Wraps a plain-text identifier in a minimal JWT so that client-side\n * JWT validation (exp check) passes in E2E tests. The identifier is\n * stored in the `sub` claim and can be extracted via {@link getE2EIdentifierFromJwt}.\n *\n * @param identifier - The plain-text E2E identifier to wrap.\n * @returns A JWT-shaped string containing the identifier.\n */\nconst wrapInMockJwt = (identifier: string): string => {\n  const header = btoa(JSON.stringify({ alg: 'none', typ: 'JWT' }));\n  const payload = btoa(\n    JSON.stringify({ sub: identifier, exp: MOCK_JWT_FAR_FUTURE_EXP }),\n  );\n  return `${header}.${payload}.mock`;\n};\n\n/**\n * Extracts the E2E identifier (`sub` claim) from a mock JWT created\n * by {@link wrapInMockJwt}. Falls back to returning the raw token if\n * decoding fails (backward compatibility with raw-identifier headers).\n *\n * @param token - A bearer token string (JWT or raw identifier).\n * @returns The decoded identifier, or the original token as-is.\n */\nexport const getE2EIdentifierFromJwt = (token: string): string => {\n  try {\n    const parts = token.split('.');\n    if (parts.length === 3) {\n      const { sub } = JSON.parse(atob(parts[1]));\n      if (typeof sub === 'string' && sub.length > 0) {\n        return sub;\n      }\n    }\n  } catch {\n    // not a JWT — fall through\n  }\n  return token;\n};\n\nexport const MOCK_PAIR_PROFILES_RESPONSE = SDK_MOCK_PAIR_PROFILES_RESPONSE;\n\nexport const getMockAuthPairResponse = (): MockResponse => {\n  return {\n    url: MOCK_PAIR_PROFILES_URL,\n    requestMethod: 'POST',\n    response: MOCK_PAIR_PROFILES_RESPONSE,\n  } satisfies MockResponse;\n};\n\nexport const getMockAuthAccessTokenResponse = (): MockResponse => {\n  return {\n    url: MOCK_OIDC_TOKEN_URL,\n    requestMethod: 'POST',\n    response: (requestJsonBody?: string): typeof MOCK_OATH_TOKEN_RESPONSE => {\n      // We wrap the e2eIdentifier in a JWT so client-side JWT validation passes.\n      // The mock server extracts the identifier back via getE2EIdentifierFromJwt.\n      const e2eIdentifier = new URLSearchParams(requestJsonBody).get(\n        'assertion',\n      );\n\n      return {\n        ...MOCK_OATH_TOKEN_RESPONSE,\n        access_token: e2eIdentifier\n          ? wrapInMockJwt(e2eIdentifier)\n          : MOCK_OATH_TOKEN_RESPONSE.access_token,\n      };\n    },\n  } satisfies MockResponse;\n};\n\nexport const MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE =\n  SDK_MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE;\n\nexport const getMockCustomerServiceTokenResponse = (): MockResponse => {\n  return {\n    url: MOCK_CUSTOMER_SERVICE_TOKEN_URL,\n    requestMethod: 'POST',\n    response: MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE,\n  } satisfies MockResponse;\n};\n"]}

package/dist/controllers/user-storage/UserStorageController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
     return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
 };
-var _UserStorageController_instances, _UserStorageController_userStorage, _UserStorageController_auth, _UserStorageController_config, _UserStorageController_trace, _UserStorageController_isUnlocked, _UserStorageController_storageKeyCache, _UserStorageController_keyringController, _UserStorageController_nativeScryptCrypto, _UserStorageController__snapSignMessageCache, _UserStorageController_snapSignMessage, _UserStorageController_setIsBackupAndSyncUpdateLoading;
+var _UserStorageController_instances, _UserStorageController_userStorage, _UserStorageController_auth, _UserStorageController_config, _UserStorageController_trace, _UserStorageController_isUnlocked, _UserStorageController_storageKeyCache, _UserStorageController_snapSignMessageCache, _UserStorageController_keyringController, _UserStorageController_nativeScryptCrypto, _UserStorageController_getHdKeyringEntropySourceIds, _UserStorageController_getPrimaryEntropySourceId, _UserStorageController_scopedCacheKey, _UserStorageController_snapSignMessage, _UserStorageController_setIsBackupAndSyncUpdateLoading;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UserStorageController = exports.defaultState = void 0;
 const base_controller_1 = require("@metamask/base-controller");
@@ -110,7 +110,12 @@ class UserStorageController extends base_controller_1.BaseController {
         });
         _UserStorageController_trace.set(this, void 0);
         _UserStorageController_isUnlocked.set(this, false);
+        // Both caches are keyed by `${entropySourceId}:${message}` (the primary SRP
+        // resolves to its HD keyring metadata ID) so two SRPs that transiently
+        // resolve to the same `profileId` can never share a cached storage key /
+        // signature and leak data across each other's user storage.
         _UserStorageController_storageKeyCache.set(this, {});
+        _UserStorageController_snapSignMessageCache.set(this, {});
         _UserStorageController_keyringController.set(this, {
             setupLockedStateSubscriptions: () => {
                 const { isUnlocked } = this.messenger.call('KeyringController:getState');
@@ -125,7 +130,6 @@ class UserStorageController extends base_controller_1.BaseController {
         });
         _UserStorageController_nativeScryptCrypto.set(this, undefined);
         this.eventQueue = new event_queue_1.EventQueue();
-        _UserStorageController__snapSignMessageCache.set(this, {});
         __classPrivateFieldSet(this, _UserStorageController_config, {
             ...__classPrivateFieldGet(this, _UserStorageController_config, "f"),
             ...config,
@@ -148,9 +152,17 @@ class UserStorageController extends base_controller_1.BaseController {
             },
         }, {
             storage: {
-                getStorageKey: async (message) => __classPrivateFieldGet(this, _UserStorageController_storageKeyCache, "f")[message] ?? null,
-                setStorageKey: async (message, key) => {
-                    __classPrivateFieldGet(this, _UserStorageController_storageKeyCache, "f")[message] = key;
+                getStorageKey: async (message, entropySourceId) => {
+                    // No derived key can exist while locked (the KeyringController
+                    // clears its keyrings on lock, so the scope is unresolvable).
+                    if (!__classPrivateFieldGet(this, _UserStorageController_isUnlocked, "f")) {
+                        return null;
+                    }
+                    return (__classPrivateFieldGet(this, _UserStorageController_storageKeyCache, "f")[__classPrivateFieldGet(this, _UserStorageController_instances, "m", _UserStorageController_scopedCacheKey).call(this, message, entropySourceId)] ?? null);
+                },
+                // Only ever reached after a successful signature, i.e. while unlocked.
+                setStorageKey: async (message, key, entropySourceId) => {
+                    __classPrivateFieldGet(this, _UserStorageController_storageKeyCache, "f")[__classPrivateFieldGet(this, _UserStorageController_instances, "m", _UserStorageController_scopedCacheKey).call(this, message, entropySourceId)] = key;
                 },
             },
         }), "f");
@@ -290,10 +302,7 @@ class UserStorageController extends base_controller_1.BaseController {
         if (!__classPrivateFieldGet(this, _UserStorageController_isUnlocked, "f")) {
             throw new Error('listEntropySources - unable to list entropy sources, wallet is locked');
         }
-        const { keyrings } = this.messenger.call('KeyringController:getState');
-        return keyrings
-            .filter((keyring) => keyring.type === keyring_controller_1.KeyringTypes.hd.toString())
-            .map((keyring) => keyring.metadata.id);
+        return __classPrivateFieldGet(this, _UserStorageController_instances, "m", _UserStorageController_getHdKeyringEntropySourceIds).call(this);
     }
     async setIsBackupAndSyncFeatureEnabled(feature, enabled) {
         try {
@@ -363,7 +372,20 @@ class UserStorageController extends base_controller_1.BaseController {
     }
 }
 exports.UserStorageController = UserStorageController;
-_UserStorageController_userStorage = new WeakMap(), _UserStorageController_auth = new WeakMap(), _UserStorageController_config = new WeakMap(), _UserStorageController_trace = new WeakMap(), _UserStorageController_isUnlocked = new WeakMap(), _UserStorageController_storageKeyCache = new WeakMap(), _UserStorageController_keyringController = new WeakMap(), _UserStorageController_nativeScryptCrypto = new WeakMap(), _UserStorageController__snapSignMessageCache = new WeakMap(), _UserStorageController_instances = new WeakSet(), _UserStorageController_snapSignMessage = 
+_UserStorageController_userStorage = new WeakMap(), _UserStorageController_auth = new WeakMap(), _UserStorageController_config = new WeakMap(), _UserStorageController_trace = new WeakMap(), _UserStorageController_isUnlocked = new WeakMap(), _UserStorageController_storageKeyCache = new WeakMap(), _UserStorageController_snapSignMessageCache = new WeakMap(), _UserStorageController_keyringController = new WeakMap(), _UserStorageController_nativeScryptCrypto = new WeakMap(), _UserStorageController_instances = new WeakSet(), _UserStorageController_getHdKeyringEntropySourceIds = function _UserStorageController_getHdKeyringEntropySourceIds() {
+    const { keyrings } = this.messenger.call('KeyringController:getState');
+    return (keyrings ?? [])
+        .filter((keyring) => keyring.type === keyring_controller_1.KeyringTypes.hd.toString())
+        .map((keyring) => keyring.metadata.id);
+}, _UserStorageController_getPrimaryEntropySourceId = function _UserStorageController_getPrimaryEntropySourceId() {
+    const [primaryEntropySourceId] = __classPrivateFieldGet(this, _UserStorageController_instances, "m", _UserStorageController_getHdKeyringEntropySourceIds).call(this);
+    if (!primaryEntropySourceId) {
+        throw new Error('#getPrimaryEntropySourceId - no HD keyring available');
+    }
+    return primaryEntropySourceId;
+}, _UserStorageController_scopedCacheKey = function _UserStorageController_scopedCacheKey(message, entropySourceId) {
+    return `${entropySourceId ?? __classPrivateFieldGet(this, _UserStorageController_instances, "m", _UserStorageController_getPrimaryEntropySourceId).call(this)}:${message}`;
+}, _UserStorageController_snapSignMessage = 
 /**
  * Signs a specific message using an underlying auth snap.
  *
@@ -373,15 +395,15 @@ _UserStorageController_userStorage = new WeakMap(), _UserStorageController_auth
  * @returns A Signature created by the snap.
  */
 async function _UserStorageController_snapSignMessage(message, entropySourceId) {
-    // the message is SRP specific already, so there's no need to use the entropySourceId in the cache
-    if (__classPrivateFieldGet(this, _UserStorageController__snapSignMessageCache, "f")[message]) {
-        return __classPrivateFieldGet(this, _UserStorageController__snapSignMessageCache, "f")[message];
-    }
     if (!__classPrivateFieldGet(this, _UserStorageController_isUnlocked, "f")) {
         throw new Error('#snapSignMessage - unable to call snap, wallet is locked');
     }
+    const cacheKey = __classPrivateFieldGet(this, _UserStorageController_instances, "m", _UserStorageController_scopedCacheKey).call(this, message, entropySourceId);
+    if (__classPrivateFieldGet(this, _UserStorageController_snapSignMessageCache, "f")[cacheKey]) {
+        return __classPrivateFieldGet(this, _UserStorageController_snapSignMessageCache, "f")[cacheKey];
+    }
     const result = (await this.messenger.call('SnapController:handleRequest', (0, auth_snap_requests_1.createSnapSignMessageRequest)(message, entropySourceId)));
-    __classPrivateFieldGet(this, _UserStorageController__snapSignMessageCache, "f")[message] = result;
+    __classPrivateFieldGet(this, _UserStorageController_snapSignMessageCache, "f")[cacheKey] = result;
     return result;
 }, _UserStorageController_setIsBackupAndSyncUpdateLoading = function _UserStorageController_setIsBackupAndSyncUpdateLoading(isBackupAndSyncUpdateLoading) {
     this.update((state) => {

package/dist/controllers/user-storage/UserStorageController.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UserStorageController.cjs","sourceRoot":"","sources":["../../../src/controllers/user-storage/UserStorageController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAQA,+DAA2D;AAW3D,qEAA4D;AAc5D,6CAA6C;AAE7C,oEAA4D;AAC5D,iFAAoF;AAOpF,+CAAqD;AACrD,yFAAuF;AACvF,mFAAyF;AAGzF,MAAM,cAAc,GAAG,uBAAuB,CAAC;AA0BlC,QAAA,YAAY,GAA+B;IACtD,sBAAsB,EAAE,IAAI;IAC5B,4BAA4B,EAAE,KAAK;IACnC,uBAAuB,EAAE,IAAI;IAC7B,uBAAuB,EAAE,IAAI;IAC7B,0BAA0B,EAAE,KAAK;CAClC,CAAC;AAEF,MAAM,QAAQ,GAA8C;IAC1D,sBAAsB,EAAE;QACtB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,4BAA4B,EAAE;QAC5B,kBAAkB,EAAE,KAAK;QACzB,OAAO,EAAE,KAAK;QACd,sBAAsB,EAAE,KAAK;QAC7B,QAAQ,EAAE,IAAI;KACf;IACD,uBAAuB,EAAE;QACvB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,uBAAuB,EAAE;QACvB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,0BAA0B,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,OAAO,EAAE,KAAK;QACd,sBAAsB,EAAE,KAAK;QAC7B,QAAQ,EAAE,IAAI;KACf;CACF,CAAC;AA6BF,MAAM,yBAAyB,GAAG;IAChC,mBAAmB;IACnB,oCAAoC;IACpC,mBAAmB;IACnB,wBAAwB;IACxB,sBAAsB;IACtB,2BAA2B;IAC3B,eAAe;IACf,uCAAuC;IACvC,oBAAoB;IACpB,kCAAkC;IAClC,+BAA+B;IAC/B,6BAA6B;CACrB,CAAC;AAgDX;;;;;;;GAOG;AACH,MAAa,qBAAsB,SAAQ,gCAI1C;IAkDC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,kBAAkB,EAClB,KAAK,GAON;QACC,KAAK,CAAC;YACJ,SAAS;YACT,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,EAAE,GAAG,oBAAY,EAAE,GAAG,KAAK,EAAE;SACrC,CAAC,CAAC;;QAnEI,qDAA0B;QAE1B,sCAAQ;YACf,YAAY,EAAE,KAAK,EAAE,eAAwB,EAAE,EAAE;gBAC/C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9C,4CAA4C,EAC5C,eAAe,CAChB,CAAC;gBACF,OAAO,cAAc,EAAE,SAAS,CAAC;YACnC,CAAC;YACD,UAAU,EAAE,GAAG,EAAE;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9B,wCAAwC,CACzC,CAAC;YACJ,CAAC;SACF,EAAC;QAEO,wCAA4B;YACnC,GAAG,EAAE,SAAG,CAAC,GAAG;SACb,EAAC;QAEO,+CAAsB;QAE/B,4CAAc,KAAK,EAAC;QAEpB,iDAAyD,EAAE,EAAC;QAEnD,mDAAqB;YAC5B,6BAA6B,EAAE,GAAG,EAAE;gBAClC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBACzE,uBAAA,IAAI,qCAAe,UAAU,MAAA,CAAC;gBAE9B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,0BAA0B,EAAE,GAAG,EAAE;oBACxD,uBAAA,IAAI,qCAAe,IAAI,MAAA,CAAC;gBAC1B,CAAC,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wBAAwB,EAAE,GAAG,EAAE;oBACtD,uBAAA,IAAI,qCAAe,KAAK,MAAA,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACL,CAAC;SACF,EAAC;QAEO,oDAAgD,SAAS,EAAC;QAEnE,eAAU,GAAG,IAAI,wBAAU,EAAE,CAAC;QA+P9B,uDAA+D,EAAE,EAAC;QAzOhE,uBAAA,IAAI,iCAAW;YACb,GAAG,uBAAA,IAAI,qCAAQ;YACf,GAAG,MAAM;SACV,MAAA,CAAC;QACF,uBAAA,IAAI,gCACF,KAAK;YACL,CAAC,KAAK,EACJ,QAAsB,EACtB,EAA2C,EACtB,EAAE;gBACvB,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,OAAO,SAAuB,CAAC;gBACjC,CAAC;gBACD,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,CAAC,CAAC,MAAA,CAAC;QAEL,uBAAA,IAAI,sCAAgB,IAAI,iBAAW,CACjC;YACE,GAAG,EAAE,uBAAA,IAAI,qCAAQ,CAAC,GAAG;YACrB,IAAI,EAAE;gBACJ,cAAc,EAAE,CAAC,eAAwB,EAAE,EAAE,CAC3C,IAAI,CAAC,SAAS,CAAC,IAAI,CACjB,yCAAyC,EACzC,eAAe,CAChB;gBACH,cAAc,EAAE,KAAK,EAAE,eAAwB,EAAE,EAAE;oBACjD,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9B,4CAA4C,EAC5C,eAAe,CAChB,CAAC;gBACJ,CAAC;gBACD,WAAW,EAAE,CAAC,OAAe,EAAE,eAAwB,EAAE,EAAE,CACzD,uBAAA,IAAI,gFAAiB,MAArB,IAAI,EACF,OAA+B,EAC/B,eAAe,CAChB;aACJ;SACF,EACD;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAC/B,uBAAA,IAAI,8CAAiB,CAAC,OAAO,CAAC,IAAI,IAAI;gBACxC,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;oBACpC,uBAAA,IAAI,8CAAiB,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;gBACvC,CAAC;aACF;SACF,CACF,MAAA,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,IAAI,EACJ,yBAAyB,CAC1B,CAAC;QAEF,uBAAA,IAAI,gDAAmB,CAAC,6BAA6B,EAAE,CAAC;QACxD,uBAAA,IAAI,6CAAuB,kBAAkB,MAAA,CAAC;QAE9C,kBAAkB;QAClB,IAAA,sDAAgC,EAAC;YAC/B,gCAAgC,EAAE,GAAG,EAAE,CAAC,IAAI;YAC5C,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS;YAClC,KAAK,EAAE,uBAAA,IAAI,oCAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,iBAAiB,CAC5B,IAA6C,EAC7C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,OAAO,CAAC,IAAI,EAAE;YAC3C,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,kCAAkC,CAC7C,IAA2C,EAC3C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,kBAAkB,CAAC,IAAI,EAAE;YACtD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,iBAAiB,CAC5B,IAA6C,EAC7C,KAAa,EACb,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAClD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,sBAAsB,CACjC,IAA2C,EAC3C,MAAgD,EAChD,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE;YACzD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,oBAAoB,CAC/B,IAA6C,EAC7C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,UAAU,CAAC,IAAI,EAAE;YAC9C,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,qCAAqC,CAChD,IAA2C,EAC3C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,qBAAqB,CAAC,IAAI,EAAE;YACzD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,yBAAyB,CACpC,IAA2C,EAC3C,MAAsC,EACtC,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE;YAC5D,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,aAAa;QACxB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACI,oBAAoB;QACzB,uBAAA,IAAI,0CAAoB,EAAE,MAAA,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB;QACtB,IAAI,CAAC,uBAAA,IAAI,yCAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACvE,OAAO,QAAQ;aACZ,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,iCAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC;aAChE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAqCM,KAAK,CAAC,gCAAgC,CAC3C,OAA4C,EAC5C,OAAgB;QAEhB,IAAI,CAAC;YACH,uBAAA,IAAI,gGAAiC,MAArC,IAAI,EAAkC,IAAI,CAAC,CAAC;YAE5C,IAAI,OAAO,EAAE,CAAC;gBACZ,8EAA8E;gBAC9E,MAAM,UAAU,GAAG,uBAAA,IAAI,mCAAM,CAAC,UAAU,EAAE,CAAC;gBAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,uBAAA,IAAI,mCAAM,CAAC,MAAM,EAAE,CAAC;gBAC5B,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,IAAI,OAAO,KAAK,kCAAsB,CAAC,IAAI,EAAE,CAAC;oBAC5C,KAAK,CAAC,sBAAsB,GAAG,OAAO,CAAC;gBACzC,CAAC;gBAED,IAAI,OAAO,KAAK,kCAAsB,CAAC,cAAc,EAAE,CAAC;oBACtD,KAAK,CAAC,uBAAuB,GAAG,OAAO,CAAC;gBAC1C,CAAC;gBAED,IAAI,OAAO,KAAK,kCAAsB,CAAC,cAAc,EAAE,CAAC;oBACtD,KAAK,CAAC,uBAAuB,GAAG,OAAO,CAAC;gBAC1C,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,uBAAuB;YACvB,MAAM,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACxE,uBAAuB;YACvB,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,gBAAgB,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,MAAM,YAAY,EAAE,CAC/F,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,uBAAA,IAAI,gGAAiC,MAArC,IAAI,EAAkC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAUD;;;;OAIG;IACH,KAAK,CAAC,6BAA6B,CACjC,0BAAmC;QAEnC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,0BAA0B,GAAG,0BAA0B,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,2BAA2B;QAC/B,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,mCAAM,CAAC,YAAY,EAAE,CAAC;QAElD,MAAM,MAAM,GAAG;YACb,gBAAgB,EAAE,GAAG,EAAE;gBACrB,uBAAA,IAAI,qCAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9D,CAAC;YACD,gBAAgB,EAAE,GAAG,EAAE;gBACrB,uBAAA,IAAI,qCAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9D,CAAC;YACD,+BAA+B,EAAE,CAC/B,YAAoB,EACpB,aAAuC,EACvC,EAAE;gBACF,uBAAA,IAAI,qCAAQ,EAAE,cAAc,EAAE,+BAA+B,EAAE,CAC7D,SAAS,EACT,YAAY,EACZ,aAAa,CACd,CAAC;YACJ,CAAC;SACF,CAAC;QAEF,MAAM,IAAA,oDAA2B,EAAC,MAAM,EAAE;YACxC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS;YAClC,gCAAgC,EAAE,GAAG,EAAE,CAAC,IAAI;YAC5C,KAAK,EAAE,uBAAA,IAAI,oCAAO;SACnB,CAAC,CAAC;IACL,CAAC;CACF;AApbD,sDAobC;;AA/HC;;;;;;;GAOG;AACH,KAAK,iDACH,OAA6B,EAC7B,eAAwB;IAExB,kGAAkG;IAClG,IAAI,uBAAA,IAAI,oDAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO,uBAAA,IAAI,oDAAuB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,uBAAA,IAAI,yCAAY,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,IAAA,iDAA4B,EAAC,OAAO,EAAE,eAAe,CAAC,CACvD,CAAW,CAAC;IAEb,uBAAA,IAAI,oDAAuB,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;IAE9C,OAAO,MAAM,CAAC;AAChB,CAAC,2HA2CC,4BAAqC;IAErC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,CAAC,4BAA4B,GAAG,4BAA4B,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  AddressBookControllerContactUpdatedEvent,\n  AddressBookControllerContactDeletedEvent,\n  AddressBookControllerActions,\n  AddressBookControllerListAction,\n  AddressBookControllerSetAction,\n  AddressBookControllerDeleteAction,\n} from '@metamask/address-book-controller';\nimport { BaseController } from '@metamask/base-controller';\nimport type {\n  ControllerGetStateAction,\n  ControllerStateChangeEvent,\n  StateMetadata,\n} from '@metamask/base-controller';\nimport type {\n  TraceCallback,\n  TraceContext,\n  TraceRequest,\n} from '@metamask/controller-utils';\nimport { KeyringTypes } from '@metamask/keyring-controller';\nimport type {\n  KeyringControllerGetStateAction,\n  KeyringControllerLockEvent,\n  KeyringControllerUnlockEvent,\n} from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\nimport type { SnapControllerHandleRequestAction } from '@metamask/snaps-controllers';\n\nimport type {\n  UserStorageGenericFeatureKey,\n  UserStorageGenericPathWithFeatureAndKey,\n  UserStorageGenericPathWithFeatureOnly,\n} from '../../sdk';\nimport { Env, UserStorage } from '../../sdk';\nimport type { NativeScrypt } from '../../shared/types/encryption';\nimport { EventQueue } from '../../shared/utils/event-queue';\nimport { createSnapSignMessageRequest } from '../authentication/auth-snap-requests';\nimport type {\n  AuthenticationControllerGetBearerTokenAction,\n  AuthenticationControllerGetSessionProfileAction,\n  AuthenticationControllerIsSignedInAction,\n  AuthenticationControllerPerformSignInAction,\n} from '../authentication/AuthenticationController-method-action-types';\nimport { BACKUPANDSYNC_FEATURES } from './constants';\nimport { syncContactsWithUserStorage } from './contact-syncing/controller-integration';\nimport { setupContactSyncingSubscriptions } from './contact-syncing/setup-subscriptions';\nimport type { UserStorageControllerMethodActions } from './UserStorageController-method-action-types';\n\nconst controllerName = 'UserStorageController';\n\n// State\nexport type UserStorageControllerState = {\n  /**\n   * Condition used by UI and to determine if we can use some of the User Storage methods.\n   */\n  isBackupAndSyncEnabled: boolean;\n  /**\n   * Loading state for the backup and sync update\n   */\n  isBackupAndSyncUpdateLoading: boolean;\n  /**\n   * Condition used by UI to determine if account syncing is enabled.\n   */\n  isAccountSyncingEnabled: boolean;\n  /**\n   * Condition used by UI to determine if contact syncing is enabled.\n   */\n  isContactSyncingEnabled: boolean;\n  /**\n   * Condition used by UI to determine if contact syncing is in progress.\n   */\n  isContactSyncingInProgress: boolean;\n};\n\nexport const defaultState: UserStorageControllerState = {\n  isBackupAndSyncEnabled: true,\n  isBackupAndSyncUpdateLoading: false,\n  isAccountSyncingEnabled: true,\n  isContactSyncingEnabled: true,\n  isContactSyncingInProgress: false,\n};\n\nconst metadata: StateMetadata<UserStorageControllerState> = {\n  isBackupAndSyncEnabled: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  isBackupAndSyncUpdateLoading: {\n    includeInStateLogs: false,\n    persist: false,\n    includeInDebugSnapshot: false,\n    usedInUi: true,\n  },\n  isAccountSyncingEnabled: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  isContactSyncingEnabled: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  isContactSyncingInProgress: {\n    includeInStateLogs: false,\n    persist: false,\n    includeInDebugSnapshot: false,\n    usedInUi: true,\n  },\n};\n\ntype ControllerConfig = {\n  env: Env;\n  contactSyncing?: {\n    /**\n     * Callback that fires when contact sync updates a contact.\n     * This is used for analytics.\n     */\n    onContactUpdated?: (profileId: string) => void;\n\n    /**\n     * Callback that fires when contact sync deletes a contact.\n     * This is used for analytics.\n     */\n    onContactDeleted?: (profileId: string) => void;\n\n    /**\n     * Callback that fires when an erroneous situation happens during contact sync.\n     * This is used for analytics.\n     */\n    onContactSyncErroneousSituation?: (\n      profileId: string,\n      situationMessage: string,\n      sentryContext?: Record<string, unknown>,\n    ) => void;\n  };\n};\n\nconst MESSENGER_EXPOSED_METHODS = [\n  'performGetStorage',\n  'performGetStorageAllFeatureEntries',\n  'performSetStorage',\n  'performBatchSetStorage',\n  'performDeleteStorage',\n  'performBatchDeleteStorage',\n  'getStorageKey',\n  'performDeleteStorageAllFeatureEntries',\n  'listEntropySources',\n  'setIsBackupAndSyncFeatureEnabled',\n  'setIsContactSyncingInProgress',\n  'syncContactsWithUserStorage',\n] as const;\n\nexport type UserStorageControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  UserStorageControllerState\n>;\nexport type Actions =\n  | UserStorageControllerGetStateAction\n  | UserStorageControllerMethodActions;\n\nexport type AllowedActions =\n  // Keyring Requests\n  | KeyringControllerGetStateAction\n  // Snap Requests\n  | SnapControllerHandleRequestAction\n  // Auth Requests\n  | AuthenticationControllerGetBearerTokenAction\n  | AuthenticationControllerGetSessionProfileAction\n  | AuthenticationControllerPerformSignInAction\n  | AuthenticationControllerIsSignedInAction\n  // Contact Syncing\n  | AddressBookControllerListAction\n  | AddressBookControllerSetAction\n  | AddressBookControllerDeleteAction\n  | AddressBookControllerActions;\n\n// Messenger events\nexport type UserStorageControllerStateChangeEvent = ControllerStateChangeEvent<\n  typeof controllerName,\n  UserStorageControllerState\n>;\n\nexport type Events = UserStorageControllerStateChangeEvent;\n\nexport type AllowedEvents =\n  | KeyringControllerLockEvent\n  | KeyringControllerUnlockEvent\n  // Address Book Events\n  | AddressBookControllerContactUpdatedEvent\n  | AddressBookControllerContactDeletedEvent;\n\n// Messenger\nexport type UserStorageControllerMessenger = Messenger<\n  typeof controllerName,\n  Actions | AllowedActions,\n  Events | AllowedEvents\n>;\n\n/**\n * Reusable controller that allows any team to store synchronized data for a given user.\n * These can be settings shared cross MetaMask clients, or data we want to persist when uninstalling/reinstalling.\n *\n * NOTE:\n * - data stored on UserStorage is FULLY encrypted, with the only keys stored/managed on the client.\n * - No one can access this data unless they are have the SRP and are able to run the signing snap.\n */\nexport class UserStorageController extends BaseController<\n  typeof controllerName,\n  UserStorageControllerState,\n  UserStorageControllerMessenger\n> {\n  readonly #userStorage: UserStorage;\n\n  readonly #auth = {\n    getProfileId: async (entropySourceId?: string) => {\n      const sessionProfile = await this.messenger.call(\n        'AuthenticationController:getSessionProfile',\n        entropySourceId,\n      );\n      return sessionProfile?.profileId;\n    },\n    isSignedIn: () => {\n      return this.messenger.call('AuthenticationController:isSignedIn');\n    },\n    signIn: async () => {\n      return await this.messenger.call(\n        'AuthenticationController:performSignIn',\n      );\n    },\n  };\n\n  readonly #config: ControllerConfig = {\n    env: Env.PRD,\n  };\n\n  readonly #trace: TraceCallback;\n\n  #isUnlocked = false;\n\n  #storageKeyCache: Record<`metamask:${string}`, string> = {};\n\n  readonly #keyringController = {\n    setupLockedStateSubscriptions: () => {\n      const { isUnlocked } = this.messenger.call('KeyringController:getState');\n      this.#isUnlocked = isUnlocked;\n\n      this.messenger.subscribe('KeyringController:unlock', () => {\n        this.#isUnlocked = true;\n      });\n\n      this.messenger.subscribe('KeyringController:lock', () => {\n        this.#isUnlocked = false;\n      });\n    },\n  };\n\n  readonly #nativeScryptCrypto: NativeScrypt | undefined = undefined;\n\n  eventQueue = new EventQueue();\n\n  constructor({\n    messenger,\n    state,\n    config,\n    nativeScryptCrypto,\n    trace,\n  }: {\n    messenger: UserStorageControllerMessenger;\n    state?: UserStorageControllerState;\n    config?: Partial<ControllerConfig>;\n    nativeScryptCrypto?: NativeScrypt;\n    trace?: TraceCallback;\n  }) {\n    super({\n      messenger,\n      metadata,\n      name: controllerName,\n      state: { ...defaultState, ...state },\n    });\n\n    this.#config = {\n      ...this.#config,\n      ...config,\n    };\n    this.#trace =\n      trace ??\n      (async <ReturnType>(\n        _request: TraceRequest,\n        fn?: (context?: TraceContext) => ReturnType,\n      ): Promise<ReturnType> => {\n        if (!fn) {\n          return undefined as ReturnType;\n        }\n        return await Promise.resolve(fn());\n      });\n\n    this.#userStorage = new UserStorage(\n      {\n        env: this.#config.env,\n        auth: {\n          getAccessToken: (entropySourceId?: string) =>\n            this.messenger.call(\n              'AuthenticationController:getBearerToken',\n              entropySourceId,\n            ),\n          getUserProfile: async (entropySourceId?: string) => {\n            return await this.messenger.call(\n              'AuthenticationController:getSessionProfile',\n              entropySourceId,\n            );\n          },\n          signMessage: (message: string, entropySourceId?: string) =>\n            this.#snapSignMessage(\n              message as `metamask:${string}`,\n              entropySourceId,\n            ),\n        },\n      },\n      {\n        storage: {\n          getStorageKey: async (message) =>\n            this.#storageKeyCache[message] ?? null,\n          setStorageKey: async (message, key) => {\n            this.#storageKeyCache[message] = key;\n          },\n        },\n      },\n    );\n\n    this.messenger.registerMethodActionHandlers(\n      this,\n      MESSENGER_EXPOSED_METHODS,\n    );\n\n    this.#keyringController.setupLockedStateSubscriptions();\n    this.#nativeScryptCrypto = nativeScryptCrypto;\n\n    // Contact Syncing\n    setupContactSyncingSubscriptions({\n      getUserStorageControllerInstance: () => this,\n      getMessenger: () => this.messenger,\n      trace: this.#trace,\n    });\n  }\n\n  /**\n   * Allows retrieval of stored data. Data stored is string formatted.\n   * Developers can extend the entry path and entry name through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}.${key}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns the decrypted string contents found from user storage (or null if not found)\n   */\n  public async performGetStorage(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    entropySourceId?: string,\n  ): Promise<string | null> {\n    return await this.#userStorage.getItem(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows retrieval of all stored data for a specific feature. Data stored is formatted as an array of strings.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns the array of decrypted string contents found from user storage (or null if not found)\n   */\n  public async performGetStorageAllFeatureEntries(\n    path: UserStorageGenericPathWithFeatureOnly,\n    entropySourceId?: string,\n  ): Promise<string[] | null> {\n    return await this.#userStorage.getAllFeatureItems(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows storage of user data. Data stored must be string formatted.\n   * Developers can extend the entry path and entry name through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}.${key}` that matches schema\n   * @param value - The string data you want to store.\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to store data.\n   */\n  public async performSetStorage(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    value: string,\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.setItem(path, value, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows storage of multiple user data entries for one specific feature. Data stored must be string formatted.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param values - data to store, in the form of an array of `[entryKey, entryValue]` pairs\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to store data.\n   */\n  public async performBatchSetStorage(\n    path: UserStorageGenericPathWithFeatureOnly,\n    values: [UserStorageGenericFeatureKey, string][],\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.batchSetItems(path, values, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows deletion of user data. Developers can extend the entry path and entry name through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}.${key}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to delete data.\n   */\n  public async performDeleteStorage(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.deleteItem(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows deletion of all user data entries for a specific feature.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to delete data.\n   */\n  public async performDeleteStorageAllFeatureEntries(\n    path: UserStorageGenericPathWithFeatureOnly,\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.deleteAllFeatureItems(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows delete of multiple user data entries for one specific feature. Data deleted must be string formatted.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param values - data to store, in the form of an array of entryKey[]\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to store data.\n   */\n  public async performBatchDeleteStorage(\n    path: UserStorageGenericPathWithFeatureOnly,\n    values: UserStorageGenericFeatureKey[],\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.batchDeleteItems(path, values, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Retrieves the storage key, for internal use only!\n   *\n   * @returns the storage key\n   */\n  public async getStorageKey(): Promise<string> {\n    return await this.#userStorage.getStorageKey();\n  }\n\n  /**\n   * Flushes the storage key cache.\n   * CAUTION: This is only public for testing purposes.\n   * It should not be used in production code.\n   */\n  public flushStorageKeyCache(): void {\n    this.#storageKeyCache = {};\n  }\n\n  /**\n   * Lists all the available HD keyring metadata IDs.\n   * These IDs can be used in a multi-SRP context to segregate data specific to different SRPs.\n   *\n   * @returns A promise that resolves to an array of HD keyring metadata IDs.\n   */\n  async listEntropySources(): Promise<string[]> {\n    if (!this.#isUnlocked) {\n      throw new Error(\n        'listEntropySources - unable to list entropy sources, wallet is locked',\n      );\n    }\n\n    const { keyrings } = this.messenger.call('KeyringController:getState');\n    return keyrings\n      .filter((keyring) => keyring.type === KeyringTypes.hd.toString())\n      .map((keyring) => keyring.metadata.id);\n  }\n\n  #_snapSignMessageCache: Record<`metamask:${string}`, string> = {};\n\n  /**\n   * Signs a specific message using an underlying auth snap.\n   *\n   * @param message - A specific tagged message to sign.\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns A Signature created by the snap.\n   */\n  async #snapSignMessage(\n    message: `metamask:${string}`,\n    entropySourceId?: string,\n  ): Promise<string> {\n    // the message is SRP specific already, so there's no need to use the entropySourceId in the cache\n    if (this.#_snapSignMessageCache[message]) {\n      return this.#_snapSignMessageCache[message];\n    }\n\n    if (!this.#isUnlocked) {\n      throw new Error(\n        '#snapSignMessage - unable to call snap, wallet is locked',\n      );\n    }\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapSignMessageRequest(message, entropySourceId),\n    )) as string;\n\n    this.#_snapSignMessageCache[message] = result;\n\n    return result;\n  }\n\n  public async setIsBackupAndSyncFeatureEnabled(\n    feature: keyof typeof BACKUPANDSYNC_FEATURES,\n    enabled: boolean,\n  ): Promise<void> {\n    try {\n      this.#setIsBackupAndSyncUpdateLoading(true);\n\n      if (enabled) {\n        // If any of the features are enabled, we need to ensure the user is signed in\n        const isSignedIn = this.#auth.isSignedIn();\n        if (!isSignedIn) {\n          await this.#auth.signIn();\n        }\n      }\n\n      this.update((state) => {\n        if (feature === BACKUPANDSYNC_FEATURES.main) {\n          state.isBackupAndSyncEnabled = enabled;\n        }\n\n        if (feature === BACKUPANDSYNC_FEATURES.accountSyncing) {\n          state.isAccountSyncingEnabled = enabled;\n        }\n\n        if (feature === BACKUPANDSYNC_FEATURES.contactSyncing) {\n          state.isContactSyncingEnabled = enabled;\n        }\n      });\n    } catch (e) {\n      // istanbul ignore next\n      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);\n      // istanbul ignore next\n      throw new Error(\n        `${controllerName} - failed to ${enabled ? 'enable' : 'disable'} ${feature} - ${errorMessage}`,\n      );\n    } finally {\n      this.#setIsBackupAndSyncUpdateLoading(false);\n    }\n  }\n\n  #setIsBackupAndSyncUpdateLoading(\n    isBackupAndSyncUpdateLoading: boolean,\n  ): void {\n    this.update((state) => {\n      state.isBackupAndSyncUpdateLoading = isBackupAndSyncUpdateLoading;\n    });\n  }\n\n  /**\n   * Sets the isContactSyncingInProgress flag to prevent infinite loops during contact synchronization\n   *\n   * @param isContactSyncingInProgress - Whether contact syncing is in progress\n   */\n  async setIsContactSyncingInProgress(\n    isContactSyncingInProgress: boolean,\n  ): Promise<void> {\n    this.update((state) => {\n      state.isContactSyncingInProgress = isContactSyncingInProgress;\n    });\n  }\n\n  /**\n   * Syncs the address book list with the user storage address book list.\n   * This method is used to make sure that the address book list is up-to-date with the user storage address book list and vice-versa.\n   * It will add new contacts to the address book list, update/merge conflicting contacts and re-upload the results in some cases to the user storage.\n   */\n  async syncContactsWithUserStorage(): Promise<void> {\n    const profileId = await this.#auth.getProfileId();\n\n    const config = {\n      onContactUpdated: () => {\n        this.#config?.contactSyncing?.onContactUpdated?.(profileId);\n      },\n      onContactDeleted: () => {\n        this.#config?.contactSyncing?.onContactDeleted?.(profileId);\n      },\n      onContactSyncErroneousSituation: (\n        errorMessage: string,\n        sentryContext?: Record<string, unknown>,\n      ) => {\n        this.#config?.contactSyncing?.onContactSyncErroneousSituation?.(\n          profileId,\n          errorMessage,\n          sentryContext,\n        );\n      },\n    };\n\n    await syncContactsWithUserStorage(config, {\n      getMessenger: () => this.messenger,\n      getUserStorageControllerInstance: () => this,\n      trace: this.#trace,\n    });\n  }\n}\n"]}
+{"version":3,"file":"UserStorageController.cjs","sourceRoot":"","sources":["../../../src/controllers/user-storage/UserStorageController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAQA,+DAA2D;AAW3D,qEAA4D;AAc5D,6CAA6C;AAE7C,oEAA4D;AAC5D,iFAAoF;AAOpF,+CAAqD;AACrD,yFAAuF;AACvF,mFAAyF;AAGzF,MAAM,cAAc,GAAG,uBAAuB,CAAC;AA0BlC,QAAA,YAAY,GAA+B;IACtD,sBAAsB,EAAE,IAAI;IAC5B,4BAA4B,EAAE,KAAK;IACnC,uBAAuB,EAAE,IAAI;IAC7B,uBAAuB,EAAE,IAAI;IAC7B,0BAA0B,EAAE,KAAK;CAClC,CAAC;AAEF,MAAM,QAAQ,GAA8C;IAC1D,sBAAsB,EAAE;QACtB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,4BAA4B,EAAE;QAC5B,kBAAkB,EAAE,KAAK;QACzB,OAAO,EAAE,KAAK;QACd,sBAAsB,EAAE,KAAK;QAC7B,QAAQ,EAAE,IAAI;KACf;IACD,uBAAuB,EAAE;QACvB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,uBAAuB,EAAE;QACvB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,0BAA0B,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,OAAO,EAAE,KAAK;QACd,sBAAsB,EAAE,KAAK;QAC7B,QAAQ,EAAE,IAAI;KACf;CACF,CAAC;AA6BF,MAAM,yBAAyB,GAAG;IAChC,mBAAmB;IACnB,oCAAoC;IACpC,mBAAmB;IACnB,wBAAwB;IACxB,sBAAsB;IACtB,2BAA2B;IAC3B,eAAe;IACf,uCAAuC;IACvC,oBAAoB;IACpB,kCAAkC;IAClC,+BAA+B;IAC/B,6BAA6B;CACrB,CAAC;AAgDX;;;;;;;GAOG;AACH,MAAa,qBAAsB,SAAQ,gCAI1C;IAwDC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,kBAAkB,EAClB,KAAK,GAON;QACC,KAAK,CAAC;YACJ,SAAS;YACT,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,EAAE,GAAG,oBAAY,EAAE,GAAG,KAAK,EAAE;SACrC,CAAC,CAAC;;QAzEI,qDAA0B;QAE1B,sCAAQ;YACf,YAAY,EAAE,KAAK,EAAE,eAAwB,EAAE,EAAE;gBAC/C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9C,4CAA4C,EAC5C,eAAe,CAChB,CAAC;gBACF,OAAO,cAAc,EAAE,SAAS,CAAC;YACnC,CAAC;YACD,UAAU,EAAE,GAAG,EAAE;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9B,wCAAwC,CACzC,CAAC;YACJ,CAAC;SACF,EAAC;QAEO,wCAA4B;YACnC,GAAG,EAAE,SAAG,CAAC,GAAG;SACb,EAAC;QAEO,+CAAsB;QAE/B,4CAAc,KAAK,EAAC;QAEpB,4EAA4E;QAC5E,uEAAuE;QACvE,yEAAyE;QACzE,4DAA4D;QAC5D,iDAA2C,EAAE,EAAC;QAE9C,sDAAgD,EAAE,EAAC;QAE1C,mDAAqB;YAC5B,6BAA6B,EAAE,GAAG,EAAE;gBAClC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBACzE,uBAAA,IAAI,qCAAe,UAAU,MAAA,CAAC;gBAE9B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,0BAA0B,EAAE,GAAG,EAAE;oBACxD,uBAAA,IAAI,qCAAe,IAAI,MAAA,CAAC;gBAC1B,CAAC,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wBAAwB,EAAE,GAAG,EAAE;oBACtD,uBAAA,IAAI,qCAAe,KAAK,MAAA,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACL,CAAC;SACF,EAAC;QAEO,oDAAgD,SAAS,EAAC;QAEnE,eAAU,GAAG,IAAI,wBAAU,EAAE,CAAC;QAsB5B,uBAAA,IAAI,iCAAW;YACb,GAAG,uBAAA,IAAI,qCAAQ;YACf,GAAG,MAAM;SACV,MAAA,CAAC;QACF,uBAAA,IAAI,gCACF,KAAK;YACL,CAAC,KAAK,EACJ,QAAsB,EACtB,EAA2C,EACtB,EAAE;gBACvB,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,OAAO,SAAuB,CAAC;gBACjC,CAAC;gBACD,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,CAAC,CAAC,MAAA,CAAC;QAEL,uBAAA,IAAI,sCAAgB,IAAI,iBAAW,CACjC;YACE,GAAG,EAAE,uBAAA,IAAI,qCAAQ,CAAC,GAAG;YACrB,IAAI,EAAE;gBACJ,cAAc,EAAE,CAAC,eAAwB,EAAE,EAAE,CAC3C,IAAI,CAAC,SAAS,CAAC,IAAI,CACjB,yCAAyC,EACzC,eAAe,CAChB;gBACH,cAAc,EAAE,KAAK,EAAE,eAAwB,EAAE,EAAE;oBACjD,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9B,4CAA4C,EAC5C,eAAe,CAChB,CAAC;gBACJ,CAAC;gBACD,WAAW,EAAE,CAAC,OAAe,EAAE,eAAwB,EAAE,EAAE,CACzD,uBAAA,IAAI,gFAAiB,MAArB,IAAI,EACF,OAA+B,EAC/B,eAAe,CAChB;aACJ;SACF,EACD;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE;oBAChD,+DAA+D;oBAC/D,8DAA8D;oBAC9D,IAAI,CAAC,uBAAA,IAAI,yCAAY,EAAE,CAAC;wBACtB,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,OAAO,CACL,uBAAA,IAAI,8CAAiB,CACnB,uBAAA,IAAI,+EAAgB,MAApB,IAAI,EAAiB,OAAO,EAAE,eAAe,CAAC,CAC/C,IAAI,IAAI,CACV,CAAC;gBACJ,CAAC;gBACD,uEAAuE;gBACvE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE;oBACrD,uBAAA,IAAI,8CAAiB,CACnB,uBAAA,IAAI,+EAAgB,MAApB,IAAI,EAAiB,OAAO,EAAE,eAAe,CAAC,CAC/C,GAAG,GAAG,CAAC;gBACV,CAAC;aACF;SACF,CACF,MAAA,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,IAAI,EACJ,yBAAyB,CAC1B,CAAC;QAEF,uBAAA,IAAI,gDAAmB,CAAC,6BAA6B,EAAE,CAAC;QACxD,uBAAA,IAAI,6CAAuB,kBAAkB,MAAA,CAAC;QAE9C,kBAAkB;QAClB,IAAA,sDAAgC,EAAC;YAC/B,gCAAgC,EAAE,GAAG,EAAE,CAAC,IAAI;YAC5C,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS;YAClC,KAAK,EAAE,uBAAA,IAAI,oCAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,iBAAiB,CAC5B,IAA6C,EAC7C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,OAAO,CAAC,IAAI,EAAE;YAC3C,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,kCAAkC,CAC7C,IAA2C,EAC3C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,kBAAkB,CAAC,IAAI,EAAE;YACtD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,iBAAiB,CAC5B,IAA6C,EAC7C,KAAa,EACb,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAClD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,sBAAsB,CACjC,IAA2C,EAC3C,MAAgD,EAChD,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE;YACzD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,oBAAoB,CAC/B,IAA6C,EAC7C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,UAAU,CAAC,IAAI,EAAE;YAC9C,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,qCAAqC,CAChD,IAA2C,EAC3C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,qBAAqB,CAAC,IAAI,EAAE;YACzD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,yBAAyB,CACpC,IAA2C,EAC3C,MAAsC,EACtC,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE;YAC5D,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,aAAa;QACxB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACI,oBAAoB;QACzB,uBAAA,IAAI,0CAAoB,EAAE,MAAA,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB;QACtB,IAAI,CAAC,uBAAA,IAAI,yCAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;QACJ,CAAC;QAED,OAAO,uBAAA,IAAI,6FAA8B,MAAlC,IAAI,CAAgC,CAAC;IAC9C,CAAC;IAyFM,KAAK,CAAC,gCAAgC,CAC3C,OAA4C,EAC5C,OAAgB;QAEhB,IAAI,CAAC;YACH,uBAAA,IAAI,gGAAiC,MAArC,IAAI,EAAkC,IAAI,CAAC,CAAC;YAE5C,IAAI,OAAO,EAAE,CAAC;gBACZ,8EAA8E;gBAC9E,MAAM,UAAU,GAAG,uBAAA,IAAI,mCAAM,CAAC,UAAU,EAAE,CAAC;gBAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,uBAAA,IAAI,mCAAM,CAAC,MAAM,EAAE,CAAC;gBAC5B,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,IAAI,OAAO,KAAK,kCAAsB,CAAC,IAAI,EAAE,CAAC;oBAC5C,KAAK,CAAC,sBAAsB,GAAG,OAAO,CAAC;gBACzC,CAAC;gBAED,IAAI,OAAO,KAAK,kCAAsB,CAAC,cAAc,EAAE,CAAC;oBACtD,KAAK,CAAC,uBAAuB,GAAG,OAAO,CAAC;gBAC1C,CAAC;gBAED,IAAI,OAAO,KAAK,kCAAsB,CAAC,cAAc,EAAE,CAAC;oBACtD,KAAK,CAAC,uBAAuB,GAAG,OAAO,CAAC;gBAC1C,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,uBAAuB;YACvB,MAAM,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACxE,uBAAuB;YACvB,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,gBAAgB,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,MAAM,YAAY,EAAE,CAC/F,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,uBAAA,IAAI,gGAAiC,MAArC,IAAI,EAAkC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAUD;;;;OAIG;IACH,KAAK,CAAC,6BAA6B,CACjC,0BAAmC;QAEnC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,0BAA0B,GAAG,0BAA0B,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,2BAA2B;QAC/B,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,mCAAM,CAAC,YAAY,EAAE,CAAC;QAElD,MAAM,MAAM,GAAG;YACb,gBAAgB,EAAE,GAAG,EAAE;gBACrB,uBAAA,IAAI,qCAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9D,CAAC;YACD,gBAAgB,EAAE,GAAG,EAAE;gBACrB,uBAAA,IAAI,qCAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9D,CAAC;YACD,+BAA+B,EAAE,CAC/B,YAAoB,EACpB,aAAuC,EACvC,EAAE;gBACF,uBAAA,IAAI,qCAAQ,EAAE,cAAc,EAAE,+BAA+B,EAAE,CAC7D,SAAS,EACT,YAAY,EACZ,aAAa,CACd,CAAC;YACJ,CAAC;SACF,CAAC;QAEF,MAAM,IAAA,oDAA2B,EAAC,MAAM,EAAE;YACxC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS;YAClC,gCAAgC,EAAE,GAAG,EAAE,CAAC,IAAI;YAC5C,KAAK,EAAE,uBAAA,IAAI,oCAAO;SACnB,CAAC,CAAC;IACL,CAAC;CACF;AAxfD,sDAwfC;;IA7KG,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACvE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,iCAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC;SAChE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC3C,CAAC;IAaC,MAAM,CAAC,sBAAsB,CAAC,GAAG,uBAAA,IAAI,6FAA8B,MAAlC,IAAI,CAAgC,CAAC;IACtE,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC,yFAkBC,OAA6B,EAC7B,eAAwB;IAExB,OAAO,GAAG,eAAe,IAAI,uBAAA,IAAI,0FAA2B,MAA/B,IAAI,CAA6B,IAAI,OAAO,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,iDACH,OAA6B,EAC7B,eAAwB;IAExB,IAAI,CAAC,uBAAA,IAAI,yCAAY,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,uBAAA,IAAI,+EAAgB,MAApB,IAAI,EAAiB,OAAO,EAAE,eAAe,CAAC,CAAC;IAChE,IAAI,uBAAA,IAAI,mDAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,uBAAA,IAAI,mDAAsB,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,IAAA,iDAA4B,EAAC,OAAO,EAAE,eAAe,CAAC,CACvD,CAAW,CAAC;IAEb,uBAAA,IAAI,mDAAsB,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;IAE9C,OAAO,MAAM,CAAC;AAChB,CAAC,2HA2CC,4BAAqC;IAErC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,CAAC,4BAA4B,GAAG,4BAA4B,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  AddressBookControllerContactUpdatedEvent,\n  AddressBookControllerContactDeletedEvent,\n  AddressBookControllerActions,\n  AddressBookControllerListAction,\n  AddressBookControllerSetAction,\n  AddressBookControllerDeleteAction,\n} from '@metamask/address-book-controller';\nimport { BaseController } from '@metamask/base-controller';\nimport type {\n  ControllerGetStateAction,\n  ControllerStateChangeEvent,\n  StateMetadata,\n} from '@metamask/base-controller';\nimport type {\n  TraceCallback,\n  TraceContext,\n  TraceRequest,\n} from '@metamask/controller-utils';\nimport { KeyringTypes } from '@metamask/keyring-controller';\nimport type {\n  KeyringControllerGetStateAction,\n  KeyringControllerLockEvent,\n  KeyringControllerUnlockEvent,\n} from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\nimport type { SnapControllerHandleRequestAction } from '@metamask/snaps-controllers';\n\nimport type {\n  UserStorageGenericFeatureKey,\n  UserStorageGenericPathWithFeatureAndKey,\n  UserStorageGenericPathWithFeatureOnly,\n} from '../../sdk';\nimport { Env, UserStorage } from '../../sdk';\nimport type { NativeScrypt } from '../../shared/types/encryption';\nimport { EventQueue } from '../../shared/utils/event-queue';\nimport { createSnapSignMessageRequest } from '../authentication/auth-snap-requests';\nimport type {\n  AuthenticationControllerGetBearerTokenAction,\n  AuthenticationControllerGetSessionProfileAction,\n  AuthenticationControllerIsSignedInAction,\n  AuthenticationControllerPerformSignInAction,\n} from '../authentication/AuthenticationController-method-action-types';\nimport { BACKUPANDSYNC_FEATURES } from './constants';\nimport { syncContactsWithUserStorage } from './contact-syncing/controller-integration';\nimport { setupContactSyncingSubscriptions } from './contact-syncing/setup-subscriptions';\nimport type { UserStorageControllerMethodActions } from './UserStorageController-method-action-types';\n\nconst controllerName = 'UserStorageController';\n\n// State\nexport type UserStorageControllerState = {\n  /**\n   * Condition used by UI and to determine if we can use some of the User Storage methods.\n   */\n  isBackupAndSyncEnabled: boolean;\n  /**\n   * Loading state for the backup and sync update\n   */\n  isBackupAndSyncUpdateLoading: boolean;\n  /**\n   * Condition used by UI to determine if account syncing is enabled.\n   */\n  isAccountSyncingEnabled: boolean;\n  /**\n   * Condition used by UI to determine if contact syncing is enabled.\n   */\n  isContactSyncingEnabled: boolean;\n  /**\n   * Condition used by UI to determine if contact syncing is in progress.\n   */\n  isContactSyncingInProgress: boolean;\n};\n\nexport const defaultState: UserStorageControllerState = {\n  isBackupAndSyncEnabled: true,\n  isBackupAndSyncUpdateLoading: false,\n  isAccountSyncingEnabled: true,\n  isContactSyncingEnabled: true,\n  isContactSyncingInProgress: false,\n};\n\nconst metadata: StateMetadata<UserStorageControllerState> = {\n  isBackupAndSyncEnabled: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  isBackupAndSyncUpdateLoading: {\n    includeInStateLogs: false,\n    persist: false,\n    includeInDebugSnapshot: false,\n    usedInUi: true,\n  },\n  isAccountSyncingEnabled: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  isContactSyncingEnabled: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  isContactSyncingInProgress: {\n    includeInStateLogs: false,\n    persist: false,\n    includeInDebugSnapshot: false,\n    usedInUi: true,\n  },\n};\n\ntype ControllerConfig = {\n  env: Env;\n  contactSyncing?: {\n    /**\n     * Callback that fires when contact sync updates a contact.\n     * This is used for analytics.\n     */\n    onContactUpdated?: (profileId: string) => void;\n\n    /**\n     * Callback that fires when contact sync deletes a contact.\n     * This is used for analytics.\n     */\n    onContactDeleted?: (profileId: string) => void;\n\n    /**\n     * Callback that fires when an erroneous situation happens during contact sync.\n     * This is used for analytics.\n     */\n    onContactSyncErroneousSituation?: (\n      profileId: string,\n      situationMessage: string,\n      sentryContext?: Record<string, unknown>,\n    ) => void;\n  };\n};\n\nconst MESSENGER_EXPOSED_METHODS = [\n  'performGetStorage',\n  'performGetStorageAllFeatureEntries',\n  'performSetStorage',\n  'performBatchSetStorage',\n  'performDeleteStorage',\n  'performBatchDeleteStorage',\n  'getStorageKey',\n  'performDeleteStorageAllFeatureEntries',\n  'listEntropySources',\n  'setIsBackupAndSyncFeatureEnabled',\n  'setIsContactSyncingInProgress',\n  'syncContactsWithUserStorage',\n] as const;\n\nexport type UserStorageControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  UserStorageControllerState\n>;\nexport type Actions =\n  | UserStorageControllerGetStateAction\n  | UserStorageControllerMethodActions;\n\nexport type AllowedActions =\n  // Keyring Requests\n  | KeyringControllerGetStateAction\n  // Snap Requests\n  | SnapControllerHandleRequestAction\n  // Auth Requests\n  | AuthenticationControllerGetBearerTokenAction\n  | AuthenticationControllerGetSessionProfileAction\n  | AuthenticationControllerPerformSignInAction\n  | AuthenticationControllerIsSignedInAction\n  // Contact Syncing\n  | AddressBookControllerListAction\n  | AddressBookControllerSetAction\n  | AddressBookControllerDeleteAction\n  | AddressBookControllerActions;\n\n// Messenger events\nexport type UserStorageControllerStateChangeEvent = ControllerStateChangeEvent<\n  typeof controllerName,\n  UserStorageControllerState\n>;\n\nexport type Events = UserStorageControllerStateChangeEvent;\n\nexport type AllowedEvents =\n  | KeyringControllerLockEvent\n  | KeyringControllerUnlockEvent\n  // Address Book Events\n  | AddressBookControllerContactUpdatedEvent\n  | AddressBookControllerContactDeletedEvent;\n\n// Messenger\nexport type UserStorageControllerMessenger = Messenger<\n  typeof controllerName,\n  Actions | AllowedActions,\n  Events | AllowedEvents\n>;\n\n/**\n * Reusable controller that allows any team to store synchronized data for a given user.\n * These can be settings shared cross MetaMask clients, or data we want to persist when uninstalling/reinstalling.\n *\n * NOTE:\n * - data stored on UserStorage is FULLY encrypted, with the only keys stored/managed on the client.\n * - No one can access this data unless they are have the SRP and are able to run the signing snap.\n */\nexport class UserStorageController extends BaseController<\n  typeof controllerName,\n  UserStorageControllerState,\n  UserStorageControllerMessenger\n> {\n  readonly #userStorage: UserStorage;\n\n  readonly #auth = {\n    getProfileId: async (entropySourceId?: string) => {\n      const sessionProfile = await this.messenger.call(\n        'AuthenticationController:getSessionProfile',\n        entropySourceId,\n      );\n      return sessionProfile?.profileId;\n    },\n    isSignedIn: () => {\n      return this.messenger.call('AuthenticationController:isSignedIn');\n    },\n    signIn: async () => {\n      return await this.messenger.call(\n        'AuthenticationController:performSignIn',\n      );\n    },\n  };\n\n  readonly #config: ControllerConfig = {\n    env: Env.PRD,\n  };\n\n  readonly #trace: TraceCallback;\n\n  #isUnlocked = false;\n\n  // Both caches are keyed by `${entropySourceId}:${message}` (the primary SRP\n  // resolves to its HD keyring metadata ID) so two SRPs that transiently\n  // resolve to the same `profileId` can never share a cached storage key /\n  // signature and leak data across each other's user storage.\n  #storageKeyCache: Record<string, string> = {};\n\n  #snapSignMessageCache: Record<string, string> = {};\n\n  readonly #keyringController = {\n    setupLockedStateSubscriptions: () => {\n      const { isUnlocked } = this.messenger.call('KeyringController:getState');\n      this.#isUnlocked = isUnlocked;\n\n      this.messenger.subscribe('KeyringController:unlock', () => {\n        this.#isUnlocked = true;\n      });\n\n      this.messenger.subscribe('KeyringController:lock', () => {\n        this.#isUnlocked = false;\n      });\n    },\n  };\n\n  readonly #nativeScryptCrypto: NativeScrypt | undefined = undefined;\n\n  eventQueue = new EventQueue();\n\n  constructor({\n    messenger,\n    state,\n    config,\n    nativeScryptCrypto,\n    trace,\n  }: {\n    messenger: UserStorageControllerMessenger;\n    state?: UserStorageControllerState;\n    config?: Partial<ControllerConfig>;\n    nativeScryptCrypto?: NativeScrypt;\n    trace?: TraceCallback;\n  }) {\n    super({\n      messenger,\n      metadata,\n      name: controllerName,\n      state: { ...defaultState, ...state },\n    });\n\n    this.#config = {\n      ...this.#config,\n      ...config,\n    };\n    this.#trace =\n      trace ??\n      (async <ReturnType>(\n        _request: TraceRequest,\n        fn?: (context?: TraceContext) => ReturnType,\n      ): Promise<ReturnType> => {\n        if (!fn) {\n          return undefined as ReturnType;\n        }\n        return await Promise.resolve(fn());\n      });\n\n    this.#userStorage = new UserStorage(\n      {\n        env: this.#config.env,\n        auth: {\n          getAccessToken: (entropySourceId?: string) =>\n            this.messenger.call(\n              'AuthenticationController:getBearerToken',\n              entropySourceId,\n            ),\n          getUserProfile: async (entropySourceId?: string) => {\n            return await this.messenger.call(\n              'AuthenticationController:getSessionProfile',\n              entropySourceId,\n            );\n          },\n          signMessage: (message: string, entropySourceId?: string) =>\n            this.#snapSignMessage(\n              message as `metamask:${string}`,\n              entropySourceId,\n            ),\n        },\n      },\n      {\n        storage: {\n          getStorageKey: async (message, entropySourceId) => {\n            // No derived key can exist while locked (the KeyringController\n            // clears its keyrings on lock, so the scope is unresolvable).\n            if (!this.#isUnlocked) {\n              return null;\n            }\n            return (\n              this.#storageKeyCache[\n                this.#scopedCacheKey(message, entropySourceId)\n              ] ?? null\n            );\n          },\n          // Only ever reached after a successful signature, i.e. while unlocked.\n          setStorageKey: async (message, key, entropySourceId) => {\n            this.#storageKeyCache[\n              this.#scopedCacheKey(message, entropySourceId)\n            ] = key;\n          },\n        },\n      },\n    );\n\n    this.messenger.registerMethodActionHandlers(\n      this,\n      MESSENGER_EXPOSED_METHODS,\n    );\n\n    this.#keyringController.setupLockedStateSubscriptions();\n    this.#nativeScryptCrypto = nativeScryptCrypto;\n\n    // Contact Syncing\n    setupContactSyncingSubscriptions({\n      getUserStorageControllerInstance: () => this,\n      getMessenger: () => this.messenger,\n      trace: this.#trace,\n    });\n  }\n\n  /**\n   * Allows retrieval of stored data. Data stored is string formatted.\n   * Developers can extend the entry path and entry name through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}.${key}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns the decrypted string contents found from user storage (or null if not found)\n   */\n  public async performGetStorage(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    entropySourceId?: string,\n  ): Promise<string | null> {\n    return await this.#userStorage.getItem(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows retrieval of all stored data for a specific feature. Data stored is formatted as an array of strings.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns the array of decrypted string contents found from user storage (or null if not found)\n   */\n  public async performGetStorageAllFeatureEntries(\n    path: UserStorageGenericPathWithFeatureOnly,\n    entropySourceId?: string,\n  ): Promise<string[] | null> {\n    return await this.#userStorage.getAllFeatureItems(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows storage of user data. Data stored must be string formatted.\n   * Developers can extend the entry path and entry name through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}.${key}` that matches schema\n   * @param value - The string data you want to store.\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to store data.\n   */\n  public async performSetStorage(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    value: string,\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.setItem(path, value, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows storage of multiple user data entries for one specific feature. Data stored must be string formatted.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param values - data to store, in the form of an array of `[entryKey, entryValue]` pairs\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to store data.\n   */\n  public async performBatchSetStorage(\n    path: UserStorageGenericPathWithFeatureOnly,\n    values: [UserStorageGenericFeatureKey, string][],\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.batchSetItems(path, values, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows deletion of user data. Developers can extend the entry path and entry name through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}.${key}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to delete data.\n   */\n  public async performDeleteStorage(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.deleteItem(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows deletion of all user data entries for a specific feature.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to delete data.\n   */\n  public async performDeleteStorageAllFeatureEntries(\n    path: UserStorageGenericPathWithFeatureOnly,\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.deleteAllFeatureItems(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows delete of multiple user data entries for one specific feature. Data deleted must be string formatted.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param values - data to store, in the form of an array of entryKey[]\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to store data.\n   */\n  public async performBatchDeleteStorage(\n    path: UserStorageGenericPathWithFeatureOnly,\n    values: UserStorageGenericFeatureKey[],\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.batchDeleteItems(path, values, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Retrieves the storage key, for internal use only!\n   *\n   * @returns the storage key\n   */\n  public async getStorageKey(): Promise<string> {\n    return await this.#userStorage.getStorageKey();\n  }\n\n  /**\n   * Flushes the storage key cache.\n   * CAUTION: This is only public for testing purposes.\n   * It should not be used in production code.\n   */\n  public flushStorageKeyCache(): void {\n    this.#storageKeyCache = {};\n  }\n\n  /**\n   * Lists all the available HD keyring metadata IDs.\n   * These IDs can be used in a multi-SRP context to segregate data specific to different SRPs.\n   *\n   * @returns A promise that resolves to an array of HD keyring metadata IDs.\n   */\n  async listEntropySources(): Promise<string[]> {\n    if (!this.#isUnlocked) {\n      throw new Error(\n        'listEntropySources - unable to list entropy sources, wallet is locked',\n      );\n    }\n\n    return this.#getHdKeyringEntropySourceIds();\n  }\n\n  /**\n   * Reads the HD keyring entropy source IDs (metadata IDs) from the\n   * KeyringController, primary first. Returns an empty array when none are\n   * available (e.g. the wallet is locked, where `keyrings` is cleared).\n   *\n   * @returns The HD keyring metadata IDs, primary first.\n   */\n  #getHdKeyringEntropySourceIds(): string[] {\n    const { keyrings } = this.messenger.call('KeyringController:getState');\n    return (keyrings ?? [])\n      .filter((keyring) => keyring.type === KeyringTypes.hd.toString())\n      .map((keyring) => keyring.metadata.id);\n  }\n\n  /**\n   * Resolves the primary SRP's entropy source ID (the first HD keyring's\n   * metadata ID), used to scope the primary's cache entries. The ID is randomly\n   * regenerated whenever the vault is recreated (e.g. on restore), so a new\n   * primary can never inherit a previous vault's cached key.\n   *\n   * @returns The primary HD keyring metadata ID.\n   * @throws If no HD keyring is available; callers must only resolve the scope\n   * while the wallet is unlocked.\n   */\n  #getPrimaryEntropySourceId(): string {\n    const [primaryEntropySourceId] = this.#getHdKeyringEntropySourceIds();\n    if (!primaryEntropySourceId) {\n      throw new Error('#getPrimaryEntropySourceId - no HD keyring available');\n    }\n    return primaryEntropySourceId;\n  }\n\n  /**\n   * Builds a cache key scoped to a specific entropy source, so each SRP's\n   * signature/storage key derivation stays isolated even when two SRPs\n   * transiently resolve to the same `profileId` (see `#storageKeyCache`).\n   *\n   * When `entropySourceId` is omitted (primary SRP), it is resolved to the\n   * primary HD keyring's metadata ID rather than a stable literal. Because that\n   * ID is randomly regenerated whenever the vault is recreated (e.g. on\n   * restore), the cached entry is naturally invalidated across vaults — a\n   * different SRP can never inherit the previous primary's cached key.\n   *\n   * @param message - The tagged message used for signing.\n   * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n   * @returns The scoped cache key.\n   */\n  #scopedCacheKey(\n    message: `metamask:${string}`,\n    entropySourceId?: string,\n  ): string {\n    return `${entropySourceId ?? this.#getPrimaryEntropySourceId()}:${message}`;\n  }\n\n  /**\n   * Signs a specific message using an underlying auth snap.\n   *\n   * @param message - A specific tagged message to sign.\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns A Signature created by the snap.\n   */\n  async #snapSignMessage(\n    message: `metamask:${string}`,\n    entropySourceId?: string,\n  ): Promise<string> {\n    if (!this.#isUnlocked) {\n      throw new Error(\n        '#snapSignMessage - unable to call snap, wallet is locked',\n      );\n    }\n\n    const cacheKey = this.#scopedCacheKey(message, entropySourceId);\n    if (this.#snapSignMessageCache[cacheKey]) {\n      return this.#snapSignMessageCache[cacheKey];\n    }\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapSignMessageRequest(message, entropySourceId),\n    )) as string;\n\n    this.#snapSignMessageCache[cacheKey] = result;\n\n    return result;\n  }\n\n  public async setIsBackupAndSyncFeatureEnabled(\n    feature: keyof typeof BACKUPANDSYNC_FEATURES,\n    enabled: boolean,\n  ): Promise<void> {\n    try {\n      this.#setIsBackupAndSyncUpdateLoading(true);\n\n      if (enabled) {\n        // If any of the features are enabled, we need to ensure the user is signed in\n        const isSignedIn = this.#auth.isSignedIn();\n        if (!isSignedIn) {\n          await this.#auth.signIn();\n        }\n      }\n\n      this.update((state) => {\n        if (feature === BACKUPANDSYNC_FEATURES.main) {\n          state.isBackupAndSyncEnabled = enabled;\n        }\n\n        if (feature === BACKUPANDSYNC_FEATURES.accountSyncing) {\n          state.isAccountSyncingEnabled = enabled;\n        }\n\n        if (feature === BACKUPANDSYNC_FEATURES.contactSyncing) {\n          state.isContactSyncingEnabled = enabled;\n        }\n      });\n    } catch (e) {\n      // istanbul ignore next\n      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);\n      // istanbul ignore next\n      throw new Error(\n        `${controllerName} - failed to ${enabled ? 'enable' : 'disable'} ${feature} - ${errorMessage}`,\n      );\n    } finally {\n      this.#setIsBackupAndSyncUpdateLoading(false);\n    }\n  }\n\n  #setIsBackupAndSyncUpdateLoading(\n    isBackupAndSyncUpdateLoading: boolean,\n  ): void {\n    this.update((state) => {\n      state.isBackupAndSyncUpdateLoading = isBackupAndSyncUpdateLoading;\n    });\n  }\n\n  /**\n   * Sets the isContactSyncingInProgress flag to prevent infinite loops during contact synchronization\n   *\n   * @param isContactSyncingInProgress - Whether contact syncing is in progress\n   */\n  async setIsContactSyncingInProgress(\n    isContactSyncingInProgress: boolean,\n  ): Promise<void> {\n    this.update((state) => {\n      state.isContactSyncingInProgress = isContactSyncingInProgress;\n    });\n  }\n\n  /**\n   * Syncs the address book list with the user storage address book list.\n   * This method is used to make sure that the address book list is up-to-date with the user storage address book list and vice-versa.\n   * It will add new contacts to the address book list, update/merge conflicting contacts and re-upload the results in some cases to the user storage.\n   */\n  async syncContactsWithUserStorage(): Promise<void> {\n    const profileId = await this.#auth.getProfileId();\n\n    const config = {\n      onContactUpdated: () => {\n        this.#config?.contactSyncing?.onContactUpdated?.(profileId);\n      },\n      onContactDeleted: () => {\n        this.#config?.contactSyncing?.onContactDeleted?.(profileId);\n      },\n      onContactSyncErroneousSituation: (\n        errorMessage: string,\n        sentryContext?: Record<string, unknown>,\n      ) => {\n        this.#config?.contactSyncing?.onContactSyncErroneousSituation?.(\n          profileId,\n          errorMessage,\n          sentryContext,\n        );\n      },\n    };\n\n    await syncContactsWithUserStorage(config, {\n      getMessenger: () => this.messenger,\n      getUserStorageControllerInstance: () => this,\n      trace: this.#trace,\n    });\n  }\n}\n"]}