@metamask/profile-sync-controller 34.0.3 → 34.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +20 -1
- package/dist/controllers/authentication/AuthenticationController-method-action-types.d.ts +23 -2
- package/dist/controllers/authentication/AuthenticationController-method-action-types.d.ts.map +1 -1
- package/dist/controllers/authentication/AuthenticationController-method-action-types.js.map +1 -1
- package/dist/controllers/authentication/AuthenticationController.d.ts +19 -1
- package/dist/controllers/authentication/AuthenticationController.d.ts.map +1 -1
- package/dist/controllers/authentication/AuthenticationController.js +48 -2
- package/dist/controllers/authentication/AuthenticationController.js.map +1 -1
- package/dist/controllers/authentication/index.d.ts +1 -1
- package/dist/controllers/authentication/index.d.ts.map +1 -1
- package/dist/controllers/authentication/index.js.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/flow-srp.d.ts +13 -2
- package/dist/sdk/authentication-jwt-bearer/flow-srp.d.ts.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/flow-srp.js +19 -4
- package/dist/sdk/authentication-jwt-bearer/flow-srp.js.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/services.d.ts +12 -1
- package/dist/sdk/authentication-jwt-bearer/services.d.ts.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/services.js +56 -14
- package/dist/sdk/authentication-jwt-bearer/services.js.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/types.d.ts +9 -0
- package/dist/sdk/authentication-jwt-bearer/types.d.ts.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/types.js.map +1 -1
- package/dist/sdk/authentication.d.ts +3 -2
- package/dist/sdk/authentication.d.ts.map +1 -1
- package/dist/sdk/authentication.js +6 -2
- package/dist/sdk/authentication.js.map +1 -1
- package/dist/sdk/constants.d.ts +1 -0
- package/dist/sdk/constants.d.ts.map +1 -1
- package/dist/sdk/constants.js +1 -0
- package/dist/sdk/constants.js.map +1 -1
- package/dist/sdk/errors.d.ts +8 -0
- package/dist/sdk/errors.d.ts.map +1 -1
- package/dist/sdk/errors.js +11 -0
- package/dist/sdk/errors.js.map +1 -1
- package/dist/sdk/mocks/auth.d.ts +12 -0
- package/dist/sdk/mocks/auth.d.ts.map +1 -1
- package/dist/sdk/mocks/auth.js +13 -1
- package/dist/sdk/mocks/auth.js.map +1 -1
- package/package.json +9 -9
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [34.1.0]
|
|
11
|
+
|
|
12
|
+
### Added
|
|
13
|
+
|
|
14
|
+
- Add `AuthenticationController.exchangeSocialAccessToken` and the `AuthenticationController:exchangeSocialAccessToken` messenger action, exchanging the wallet's Google, Apple or Telegram social access token (`POST /api/v2/social/login`) for an access token and the canonical profile, without storing them ([#10886](https://github.com/MetaMask/core/pull/10886))
|
|
15
|
+
- Add `exchangeSocialAccessToken` to the SDK's `JwtBearerAuth`, the `SocialLoginParams` type, and `SocialIdentifierNotPairedError`, thrown when the identifier was never paired to a profile
|
|
16
|
+
|
|
17
|
+
### Changed
|
|
18
|
+
|
|
19
|
+
- Bump `loglevel` from `^1.8.1` to `^1.9.2` ([#10724](https://github.com/MetaMask/core/pull/10724))
|
|
20
|
+
- Bump `@metamask/keyring-controller` from `^28.1.0` to `^28.2.0` ([#10851](https://github.com/MetaMask/core/pull/10851))
|
|
21
|
+
- Bump `@metamask/base-controller` from `^10.0.0` to `^10.1.0` ([#10864](https://github.com/MetaMask/core/pull/10864))
|
|
22
|
+
|
|
23
|
+
### Fixed
|
|
24
|
+
|
|
25
|
+
- Fix `AuthenticationController.completeCredentialEnrollment` failing with `aal2_required` when adding a second factor, by sending the verification token that began the enrollment, which the server now requires to complete it too ([#10900](https://github.com/MetaMask/core/pull/10900))
|
|
26
|
+
- `JwtBearerAuth.completeMfaEnrollment` accepts an optional `accessToken`, like `beginMfaEnrollment`
|
|
27
|
+
|
|
10
28
|
## [34.0.3]
|
|
11
29
|
|
|
12
30
|
### Changed
|
|
@@ -1061,7 +1079,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
1061
1079
|
|
|
1062
1080
|
- Initial release
|
|
1063
1081
|
|
|
1064
|
-
[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@34.0
|
|
1082
|
+
[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@34.1.0...HEAD
|
|
1083
|
+
[34.1.0]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@34.0.3...@metamask/profile-sync-controller@34.1.0
|
|
1065
1084
|
[34.0.3]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@34.0.2...@metamask/profile-sync-controller@34.0.3
|
|
1066
1085
|
[34.0.2]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@34.0.1...@metamask/profile-sync-controller@34.0.2
|
|
1067
1086
|
[34.0.1]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@34.0.0...@metamask/profile-sync-controller@34.0.1
|
|
@@ -7,6 +7,23 @@ export type AuthenticationControllerPerformSignInAction = {
|
|
|
7
7
|
type: `AuthenticationController:performSignIn`;
|
|
8
8
|
handler: AuthenticationController['performSignIn'];
|
|
9
9
|
};
|
|
10
|
+
/**
|
|
11
|
+
* Exchanges the social access token SeedlessOnboarding holds for the
|
|
12
|
+
* wallet's Google/Apple/Telegram login (`POST /api/v2/social/login`) for an
|
|
13
|
+
* access token and the canonical profile it is paired to. Shows no UI and
|
|
14
|
+
* stores nothing: SRP sessions remain the source of truth for
|
|
15
|
+
* `getBearerToken`.
|
|
16
|
+
*
|
|
17
|
+
* Throws when the wallet has no social vault or no social token, and
|
|
18
|
+
* `SocialIdentifierNotPairedError` when the identifier was never paired to
|
|
19
|
+
* a profile.
|
|
20
|
+
*
|
|
21
|
+
* @returns The access token and canonical profile.
|
|
22
|
+
*/
|
|
23
|
+
export type AuthenticationControllerExchangeSocialAccessTokenAction = {
|
|
24
|
+
type: `AuthenticationController:exchangeSocialAccessToken`;
|
|
25
|
+
handler: AuthenticationController['exchangeSocialAccessToken'];
|
|
26
|
+
};
|
|
10
27
|
/**
|
|
11
28
|
* Marks profile pairing as needed. Clients call this when the SRP set
|
|
12
29
|
* changes (e.g. a new keyring was added) so the next auto-sign-in cycle
|
|
@@ -38,6 +55,9 @@ export type AuthenticationControllerBeginCredentialEnrollmentAction = {
|
|
|
38
55
|
/**
|
|
39
56
|
* Completes credential enrollment and refreshes the credential cache.
|
|
40
57
|
*
|
|
58
|
+
* It is sent with the verification token that began the enrollment, if
|
|
59
|
+
* any: once a factor is enrolled, the server requires AAL2 for both steps.
|
|
60
|
+
*
|
|
41
61
|
* The server returns an assertion for the new credential, which opens a
|
|
42
62
|
* verification session like `completeCredentialVerification`, replacing
|
|
43
63
|
* any earlier one. If that exchange fails, the earlier session is kept:
|
|
@@ -103,7 +123,8 @@ export type AuthenticationControllerGetVerificationTokenAction = {
|
|
|
103
123
|
handler: AuthenticationController['getVerificationToken'];
|
|
104
124
|
};
|
|
105
125
|
/**
|
|
106
|
-
* Clears every in-memory verification session and its expiration timer
|
|
126
|
+
* Clears every in-memory verification session and its expiration timer,
|
|
127
|
+
* and the tokens kept for enrollments in progress.
|
|
107
128
|
*/
|
|
108
129
|
export type AuthenticationControllerClearVerificationSessionAction = {
|
|
109
130
|
type: `AuthenticationController:clearVerificationSession`;
|
|
@@ -216,5 +237,5 @@ export type AuthenticationControllerIsSignedInAction = {
|
|
|
216
237
|
/**
|
|
217
238
|
* Union of all AuthenticationController action types.
|
|
218
239
|
*/
|
|
219
|
-
export type AuthenticationControllerMethodActions = AuthenticationControllerPerformSignInAction | AuthenticationControllerRequestProfilePairingAction | AuthenticationControllerRefreshEnrolledCredentialsAction | AuthenticationControllerBeginCredentialEnrollmentAction | AuthenticationControllerCompleteCredentialEnrollmentAction | AuthenticationControllerBeginCredentialVerificationAction | AuthenticationControllerCompleteCredentialVerificationAction | AuthenticationControllerGetVerificationTokenAction | AuthenticationControllerClearVerificationSessionAction | AuthenticationControllerPerformSignOutAction | AuthenticationControllerClearStateAction | AuthenticationControllerGetBearerTokenAction | AuthenticationControllerGetSessionProfileAction | AuthenticationControllerRefreshCanonicalProfileIdAction | AuthenticationControllerGetUserProfileLineageAction | AuthenticationControllerGetCustomerServiceTokenAction | AuthenticationControllerGetPartnerIdentityTokenAction | AuthenticationControllerIsSignedInAction;
|
|
240
|
+
export type AuthenticationControllerMethodActions = AuthenticationControllerPerformSignInAction | AuthenticationControllerExchangeSocialAccessTokenAction | AuthenticationControllerRequestProfilePairingAction | AuthenticationControllerRefreshEnrolledCredentialsAction | AuthenticationControllerBeginCredentialEnrollmentAction | AuthenticationControllerCompleteCredentialEnrollmentAction | AuthenticationControllerBeginCredentialVerificationAction | AuthenticationControllerCompleteCredentialVerificationAction | AuthenticationControllerGetVerificationTokenAction | AuthenticationControllerClearVerificationSessionAction | AuthenticationControllerPerformSignOutAction | AuthenticationControllerClearStateAction | AuthenticationControllerGetBearerTokenAction | AuthenticationControllerGetSessionProfileAction | AuthenticationControllerRefreshCanonicalProfileIdAction | AuthenticationControllerGetUserProfileLineageAction | AuthenticationControllerGetCustomerServiceTokenAction | AuthenticationControllerGetPartnerIdentityTokenAction | AuthenticationControllerIsSignedInAction;
|
|
220
241
|
//# sourceMappingURL=AuthenticationController-method-action-types.d.ts.map
|
package/dist/controllers/authentication/AuthenticationController-method-action-types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthenticationController-method-action-types.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,wBAAwB,CAAC,4BAA4B,CAAC,CAAC;CACjE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF
|
|
1
|
+
{"version":3,"file":"AuthenticationController-method-action-types.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,wBAAwB,CAAC,4BAA4B,CAAC,CAAC;CACjE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,wBAAwB,CAAC,8BAA8B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,wBAAwB,CAAC,6BAA6B,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4DAA4D,GAAG;IACzE,IAAI,EAAE,yDAAyD,CAAC;IAChE,OAAO,EAAE,wBAAwB,CAAC,gCAAgC,CAAC,CAAC;CACrE,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,wBAAwB,CAAC,sBAAsB,CAAC,CAAC;CAC3D,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,sDAAsD,GAAG;IACnE,IAAI,EAAE,mDAAmD,CAAC;IAC1D,OAAO,EAAE,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;CAC/D,CAAC;AAEF,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qCAAqC,GAC7C,2CAA2C,GAC3C,uDAAuD,GACvD,mDAAmD,GACnD,wDAAwD,GACxD,uDAAuD,GACvD,0DAA0D,GAC1D,yDAAyD,GACzD,4DAA4D,GAC5D,kDAAkD,GAClD,sDAAsD,GACtD,4CAA4C,GAC5C,wCAAwC,GACxC,4CAA4C,GAC5C,+CAA+C,GAC/C,uDAAuD,GACvD,mDAAmD,GACnD,qDAAqD,GACrD,qDAAqD,GACrD,wCAAwC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthenticationController-method-action-types.js","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController.js';\n\nexport type AuthenticationControllerPerformSignInAction = {\n type: `AuthenticationController:performSignIn`;\n handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n type: `AuthenticationController:requestProfilePairing`;\n handler: AuthenticationController['requestProfilePairing'];\n};\n\n/**\n * Refreshes credentials enrolled on the canonical profile.\n *\n * @returns The current supported credentials.\n */\nexport type AuthenticationControllerRefreshEnrolledCredentialsAction = {\n type: `AuthenticationController:refreshEnrolledCredentials`;\n handler: AuthenticationController['refreshEnrolledCredentials'];\n};\n\n/**\n * Begins enrollment of a passkey or email OTP credential.\n *\n * @param request - Credential, optional email address, and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginCredentialEnrollmentAction = {\n type: `AuthenticationController:beginCredentialEnrollment`;\n handler: AuthenticationController['beginCredentialEnrollment'];\n};\n\n/**\n * Completes credential enrollment and refreshes the credential cache.\n *\n * The server returns an assertion for the new credential, which opens a\n * verification session like `completeCredentialVerification`, replacing\n * any earlier one. If that exchange fails, the earlier session is kept:\n * the credential is enrolled either way.\n *\n * A cache-refresh failure does not undo successful enrollment. Email\n * enrollment invalidates the primary SRP session *after* refresh so the\n * credentials call can reuse the still-valid access token; the next token\n * fetch then includes the newly verified email claim. That invalidation\n * happens even if the session ends mid-request: the enrollment succeeded\n * on the server, so a token cached across a lock must not be reused\n * without the new claim.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The refreshed credentials, or the existing cache if refresh fails.\n */\nexport type AuthenticationControllerCompleteCredentialEnrollmentAction = {\n type: `AuthenticationController:completeCredentialEnrollment`;\n handler: AuthenticationController['completeCredentialEnrollment'];\n};\n\n/**\n * Begins verification with an enrolled credential.\n *\n * @param request - Credential type and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginCredentialVerificationAction = {\n type: `AuthenticationController:beginCredentialVerification`;\n handler: AuthenticationController['beginCredentialVerification'];\n};\n\n/**\n * Completes verification and opens a short-lived verification session.\n *\n * The assertion returned by the MFA service is exchanged at Hydra for an\n * access token. Its assurance level is not checked: the services receiving\n * the token enforce their own requirements. The token itself never enters\n * controller state.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The verification token.\n */\nexport type AuthenticationControllerCompleteCredentialVerificationAction = {\n type: `AuthenticationController:completeCredentialVerification`;\n handler: AuthenticationController['completeCredentialVerification'];\n};\n\n/**\n * Returns the active verification token when it meets the requested\n * freshness.\n *\n * Low-level: features should go through the client MFA kit\n * (`verifyOrEnroll`), which reuses a matching session without showing any\n * screen and checks which method proved it. Read the token directly only\n * from code that cannot show UI, and treat `null` as \"let the UI layer\n * ask\".\n *\n * @param request - Optional maximum session age in milliseconds, measured\n * from when the token was obtained. Zero always requires a new ceremony.\n * @returns A live verification token, or null when no reusable session\n * exists.\n */\nexport type AuthenticationControllerGetVerificationTokenAction = {\n type: `AuthenticationController:getVerificationToken`;\n handler: AuthenticationController['getVerificationToken'];\n};\n\n/**\n * Clears every in-memory verification session and its expiration timer.\n */\nexport type AuthenticationControllerClearVerificationSessionAction = {\n type: `AuthenticationController:clearVerificationSession`;\n handler: AuthenticationController['clearVerificationSession'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n type: `AuthenticationController:performSignOut`;\n handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Resets the controller to `defaultState`. Clients call this on wallet reset\n * so the next wallet starts unsigned with both pairing gates re-armed.\n */\nexport type AuthenticationControllerClearStateAction = {\n type: `AuthenticationController:clearState`;\n handler: AuthenticationController['clearState'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n type: `AuthenticationController:getBearerToken`;\n handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n type: `AuthenticationController:getSessionProfile`;\n handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n type: `AuthenticationController:refreshCanonicalProfileId`;\n handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n type: `AuthenticationController:getUserProfileLineage`;\n handler: AuthenticationController['getUserProfileLineage'];\n};\n\n/**\n * Returns a Customer Service specific access token for the specified SRP,\n * logging in if needed.\n *\n * Exchanges the OIDC access token for a short-lived token scoped to the\n * customer-service audience. Customer Service tooling consumes this token to\n * identify and authenticate the user.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The customer-service access token.\n */\nexport type AuthenticationControllerGetCustomerServiceTokenAction = {\n type: `AuthenticationController:getCustomerServiceToken`;\n handler: AuthenticationController['getCustomerServiceToken'];\n};\n\n/**\n * Mints a partner identity token for the specified SRP, logging in if needed.\n *\n * Calls `POST /api/v2/oidc/token` with the Hydra login bearer and returns\n * the minted `access_token`. Email on live tokens is under JWT `ext`.\n * HTTP 422 throws `EmailRequiredError` when this profile has no\n * verified email.\n *\n * @param claims - Claim names to embed. Only `email` is supported.\n * @param audience - Partner audience (`kyc` or `iron`).\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The partner identity access token.\n */\nexport type AuthenticationControllerGetPartnerIdentityTokenAction = {\n type: `AuthenticationController:getPartnerIdentityToken`;\n handler: AuthenticationController['getPartnerIdentityToken'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n type: `AuthenticationController:isSignedIn`;\n handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n | AuthenticationControllerPerformSignInAction\n | AuthenticationControllerRequestProfilePairingAction\n | AuthenticationControllerRefreshEnrolledCredentialsAction\n | AuthenticationControllerBeginCredentialEnrollmentAction\n | AuthenticationControllerCompleteCredentialEnrollmentAction\n | AuthenticationControllerBeginCredentialVerificationAction\n | AuthenticationControllerCompleteCredentialVerificationAction\n | AuthenticationControllerGetVerificationTokenAction\n | AuthenticationControllerClearVerificationSessionAction\n | AuthenticationControllerPerformSignOutAction\n | AuthenticationControllerClearStateAction\n | AuthenticationControllerGetBearerTokenAction\n | AuthenticationControllerGetSessionProfileAction\n | AuthenticationControllerRefreshCanonicalProfileIdAction\n | AuthenticationControllerGetUserProfileLineageAction\n | AuthenticationControllerGetCustomerServiceTokenAction\n | AuthenticationControllerGetPartnerIdentityTokenAction\n | AuthenticationControllerIsSignedInAction;\n"]}
|
|
1
|
+
{"version":3,"file":"AuthenticationController-method-action-types.js","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController.js';\n\nexport type AuthenticationControllerPerformSignInAction = {\n type: `AuthenticationController:performSignIn`;\n handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Exchanges the social access token SeedlessOnboarding holds for the\n * wallet's Google/Apple/Telegram login (`POST /api/v2/social/login`) for an\n * access token and the canonical profile it is paired to. Shows no UI and\n * stores nothing: SRP sessions remain the source of truth for\n * `getBearerToken`.\n *\n * Throws when the wallet has no social vault or no social token, and\n * `SocialIdentifierNotPairedError` when the identifier was never paired to\n * a profile.\n *\n * @returns The access token and canonical profile.\n */\nexport type AuthenticationControllerExchangeSocialAccessTokenAction = {\n type: `AuthenticationController:exchangeSocialAccessToken`;\n handler: AuthenticationController['exchangeSocialAccessToken'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n type: `AuthenticationController:requestProfilePairing`;\n handler: AuthenticationController['requestProfilePairing'];\n};\n\n/**\n * Refreshes credentials enrolled on the canonical profile.\n *\n * @returns The current supported credentials.\n */\nexport type AuthenticationControllerRefreshEnrolledCredentialsAction = {\n type: `AuthenticationController:refreshEnrolledCredentials`;\n handler: AuthenticationController['refreshEnrolledCredentials'];\n};\n\n/**\n * Begins enrollment of a passkey or email OTP credential.\n *\n * @param request - Credential, optional email address, and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginCredentialEnrollmentAction = {\n type: `AuthenticationController:beginCredentialEnrollment`;\n handler: AuthenticationController['beginCredentialEnrollment'];\n};\n\n/**\n * Completes credential enrollment and refreshes the credential cache.\n *\n * It is sent with the verification token that began the enrollment, if\n * any: once a factor is enrolled, the server requires AAL2 for both steps.\n *\n * The server returns an assertion for the new credential, which opens a\n * verification session like `completeCredentialVerification`, replacing\n * any earlier one. If that exchange fails, the earlier session is kept:\n * the credential is enrolled either way.\n *\n * A cache-refresh failure does not undo successful enrollment. Email\n * enrollment invalidates the primary SRP session *after* refresh so the\n * credentials call can reuse the still-valid access token; the next token\n * fetch then includes the newly verified email claim. That invalidation\n * happens even if the session ends mid-request: the enrollment succeeded\n * on the server, so a token cached across a lock must not be reused\n * without the new claim.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The refreshed credentials, or the existing cache if refresh fails.\n */\nexport type AuthenticationControllerCompleteCredentialEnrollmentAction = {\n type: `AuthenticationController:completeCredentialEnrollment`;\n handler: AuthenticationController['completeCredentialEnrollment'];\n};\n\n/**\n * Begins verification with an enrolled credential.\n *\n * @param request - Credential type and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginCredentialVerificationAction = {\n type: `AuthenticationController:beginCredentialVerification`;\n handler: AuthenticationController['beginCredentialVerification'];\n};\n\n/**\n * Completes verification and opens a short-lived verification session.\n *\n * The assertion returned by the MFA service is exchanged at Hydra for an\n * access token. Its assurance level is not checked: the services receiving\n * the token enforce their own requirements. The token itself never enters\n * controller state.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The verification token.\n */\nexport type AuthenticationControllerCompleteCredentialVerificationAction = {\n type: `AuthenticationController:completeCredentialVerification`;\n handler: AuthenticationController['completeCredentialVerification'];\n};\n\n/**\n * Returns the active verification token when it meets the requested\n * freshness.\n *\n * Low-level: features should go through the client MFA kit\n * (`verifyOrEnroll`), which reuses a matching session without showing any\n * screen and checks which method proved it. Read the token directly only\n * from code that cannot show UI, and treat `null` as \"let the UI layer\n * ask\".\n *\n * @param request - Optional maximum session age in milliseconds, measured\n * from when the token was obtained. Zero always requires a new ceremony.\n * @returns A live verification token, or null when no reusable session\n * exists.\n */\nexport type AuthenticationControllerGetVerificationTokenAction = {\n type: `AuthenticationController:getVerificationToken`;\n handler: AuthenticationController['getVerificationToken'];\n};\n\n/**\n * Clears every in-memory verification session and its expiration timer,\n * and the tokens kept for enrollments in progress.\n */\nexport type AuthenticationControllerClearVerificationSessionAction = {\n type: `AuthenticationController:clearVerificationSession`;\n handler: AuthenticationController['clearVerificationSession'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n type: `AuthenticationController:performSignOut`;\n handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Resets the controller to `defaultState`. Clients call this on wallet reset\n * so the next wallet starts unsigned with both pairing gates re-armed.\n */\nexport type AuthenticationControllerClearStateAction = {\n type: `AuthenticationController:clearState`;\n handler: AuthenticationController['clearState'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n type: `AuthenticationController:getBearerToken`;\n handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n type: `AuthenticationController:getSessionProfile`;\n handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n type: `AuthenticationController:refreshCanonicalProfileId`;\n handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n type: `AuthenticationController:getUserProfileLineage`;\n handler: AuthenticationController['getUserProfileLineage'];\n};\n\n/**\n * Returns a Customer Service specific access token for the specified SRP,\n * logging in if needed.\n *\n * Exchanges the OIDC access token for a short-lived token scoped to the\n * customer-service audience. Customer Service tooling consumes this token to\n * identify and authenticate the user.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The customer-service access token.\n */\nexport type AuthenticationControllerGetCustomerServiceTokenAction = {\n type: `AuthenticationController:getCustomerServiceToken`;\n handler: AuthenticationController['getCustomerServiceToken'];\n};\n\n/**\n * Mints a partner identity token for the specified SRP, logging in if needed.\n *\n * Calls `POST /api/v2/oidc/token` with the Hydra login bearer and returns\n * the minted `access_token`. Email on live tokens is under JWT `ext`.\n * HTTP 422 throws `EmailRequiredError` when this profile has no\n * verified email.\n *\n * @param claims - Claim names to embed. Only `email` is supported.\n * @param audience - Partner audience (`kyc` or `iron`).\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The partner identity access token.\n */\nexport type AuthenticationControllerGetPartnerIdentityTokenAction = {\n type: `AuthenticationController:getPartnerIdentityToken`;\n handler: AuthenticationController['getPartnerIdentityToken'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n type: `AuthenticationController:isSignedIn`;\n handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n | AuthenticationControllerPerformSignInAction\n | AuthenticationControllerExchangeSocialAccessTokenAction\n | AuthenticationControllerRequestProfilePairingAction\n | AuthenticationControllerRefreshEnrolledCredentialsAction\n | AuthenticationControllerBeginCredentialEnrollmentAction\n | AuthenticationControllerCompleteCredentialEnrollmentAction\n | AuthenticationControllerBeginCredentialVerificationAction\n | AuthenticationControllerCompleteCredentialVerificationAction\n | AuthenticationControllerGetVerificationTokenAction\n | AuthenticationControllerClearVerificationSessionAction\n | AuthenticationControllerPerformSignOutAction\n | AuthenticationControllerClearStateAction\n | AuthenticationControllerGetBearerTokenAction\n | AuthenticationControllerGetSessionProfileAction\n | AuthenticationControllerRefreshCanonicalProfileIdAction\n | AuthenticationControllerGetUserProfileLineageAction\n | AuthenticationControllerGetCustomerServiceTokenAction\n | AuthenticationControllerGetPartnerIdentityTokenAction\n | AuthenticationControllerIsSignedInAction;\n"]}
|
|
@@ -95,6 +95,20 @@ export declare class AuthenticationController extends BaseController<typeof cont
|
|
|
95
95
|
trace?: TraceCallback;
|
|
96
96
|
});
|
|
97
97
|
performSignIn(): Promise<string[]>;
|
|
98
|
+
/**
|
|
99
|
+
* Exchanges the social access token SeedlessOnboarding holds for the
|
|
100
|
+
* wallet's Google/Apple/Telegram login (`POST /api/v2/social/login`) for an
|
|
101
|
+
* access token and the canonical profile it is paired to. Shows no UI and
|
|
102
|
+
* stores nothing: SRP sessions remain the source of truth for
|
|
103
|
+
* `getBearerToken`.
|
|
104
|
+
*
|
|
105
|
+
* Throws when the wallet has no social vault or no social token, and
|
|
106
|
+
* `SocialIdentifierNotPairedError` when the identifier was never paired to
|
|
107
|
+
* a profile.
|
|
108
|
+
*
|
|
109
|
+
* @returns The access token and canonical profile.
|
|
110
|
+
*/
|
|
111
|
+
exchangeSocialAccessToken(): Promise<LoginResponse>;
|
|
98
112
|
/**
|
|
99
113
|
* Marks profile pairing as needed. Clients call this when the SRP set
|
|
100
114
|
* changes (e.g. a new keyring was added) so the next auto-sign-in cycle
|
|
@@ -117,6 +131,9 @@ export declare class AuthenticationController extends BaseController<typeof cont
|
|
|
117
131
|
/**
|
|
118
132
|
* Completes credential enrollment and refreshes the credential cache.
|
|
119
133
|
*
|
|
134
|
+
* It is sent with the verification token that began the enrollment, if
|
|
135
|
+
* any: once a factor is enrolled, the server requires AAL2 for both steps.
|
|
136
|
+
*
|
|
120
137
|
* The server returns an assertion for the new credential, which opens a
|
|
121
138
|
* verification session like `completeCredentialVerification`, replacing
|
|
122
139
|
* any earlier one. If that exchange fails, the earlier session is kept:
|
|
@@ -170,7 +187,8 @@ export declare class AuthenticationController extends BaseController<typeof cont
|
|
|
170
187
|
*/
|
|
171
188
|
getVerificationToken(request?: GetVerificationTokenRequest): VerificationToken | null;
|
|
172
189
|
/**
|
|
173
|
-
* Clears every in-memory verification session and its expiration timer
|
|
190
|
+
* Clears every in-memory verification session and its expiration timer,
|
|
191
|
+
* and the tokens kept for enrollments in progress.
|
|
174
192
|
*/
|
|
175
193
|
clearVerificationSession(): void;
|
|
176
194
|
performSignOut(): void;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthenticationController.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,4BAA4B,CAAC;AAE9E,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC5B,0CAA0C,EAC3C,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EACV,gDAAgD,EAChD,0CAA0C,EAC3C,MAAM,0CAA0C,CAAC;AAYlD,OAAO,KAAK,EAEV,aAAa,EACb,YAAY,EAIZ,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,2BAA2B,EAG3B,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,GAAG,EAKJ,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAOtE,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAE1G,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAK1B,CAAC;AAmEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAa,CAAC;AAaxD,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;IACT;;;;OAIG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC;CACvC,CAAC;
|
|
1
|
+
{"version":3,"file":"AuthenticationController.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,4BAA4B,CAAC;AAE9E,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC5B,0CAA0C,EAC3C,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EACV,gDAAgD,EAChD,0CAA0C,EAC3C,MAAM,0CAA0C,CAAC;AAYlD,OAAO,KAAK,EAEV,aAAa,EACb,YAAY,EAIZ,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,2BAA2B,EAG3B,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,GAAG,EAKJ,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAOtE,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAE1G,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAK1B,CAAC;AAmEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAa,CAAC;AAaxD,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;IACT;;;;OAIG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC;CACvC,CAAC;AAwBF,MAAM,MAAM,OAAO,GACf,sCAAsC,GACtC,qCAAqC,CAAC;AAE1C,MAAM,MAAM,sCAAsC,GAAG,wBAAwB,CAC3E,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAClD,0BAA0B,CACxB,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEJ,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,MAAM,GACd,wCAAwC,GACxC,0CAA0C,CAAC;AAG/C,KAAK,cAAc,GACf,+BAA+B,GAC/B,0CAA0C,GAC1C,0CAA0C,GAC1C,gDAAgD,CAAC;AAErD,KAAK,aAAa,GAAG,0BAA0B,GAAG,4BAA4B,CAAC;AAG/E,MAAM,MAAM,iCAAiC,GAAG,SAAS,CACvD,OAAO,cAAc,EACrB,OAAO,GAAG,cAAc,EACxB,MAAM,GAAG,aAAa,CACvB,CAAC;AAEF;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAC1D,OAAO,cAAc,EACrB,6BAA6B,EAC7B,iCAAiC,CAClC;;IAuEC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,EACX,KAAK,GACN,EAAE;QACD,SAAS,EAAE,iCAAiC,CAAC;QAC7C,KAAK,CAAC,EAAE,6BAA6B,CAAC;QACtC,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnC;;;WAGG;QACH,WAAW,EAAE,eAAe,CAAC;QAC7B,KAAK,CAAC,EAAE,aAAa,CAAC;KACvB,EAkDA;IAkLY,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAc9C;IAyID;;;;;;;;;;;;OAYG;IACU,yBAAyB,IAAI,OAAO,CAAC,aAAa,CAAC,CAqB/D;IAUD;;;;OAIG;IACI,qBAAqB,IAAI,IAAI,CAOnC;IA8LD;;;;OAIG;IACU,0BAA0B,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA+BvE;IAED;;;;;OAKG;IACU,yBAAyB,CACpC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CA4B9B;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,4BAA4B,CACvC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAyD/B;IAED;;;;;OAKG;IACU,2BAA2B,CACtC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,qBAAqB,CAAC,CAiBhC;IAED;;;;;;;;;;OAUG;IACU,8BAA8B,CACzC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,iBAAiB,CAAC,CA4B5B;IAsDD;;;;;;;;;;;;;;OAcG;IACI,oBAAoB,CACzB,OAAO,GAAE,2BAAgC,GACxC,iBAAiB,GAAG,IAAI,CAoB1B;IAmCD;;;OAGG;IACI,wBAAwB,IAAI,IAAI,CAMtC;IAoBM,cAAc,IAAI,IAAI,CAQ5B;IAED;;;OAGG;IACI,UAAU,IAAI,IAAI,CAMxB;IAED;;;;;;;;;;OAUG;IACU,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIrE;IAED;;;;;;;;;;;;OAYG;IACU,iBAAiB,CAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC,CAItB;IAED;;;;;;;;;;;;;;;OAeG;IACU,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAgBxD;IAcY,qBAAqB,CAChC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAI7B;IAED;;;;;;;;;;OAUG;IACU,uBAAuB,CAClC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAIjB;IAED;;;;;;;;;;;;OAYG;IACU,uBAAuB,CAClC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAQjB;IAEM,UAAU,IAAI,OAAO,CAE3B;CA8EF"}
|
|
@@ -85,6 +85,7 @@ export const ENROLLMENT_MAX_SESSION_AGE_MS = 2 * 60_000;
|
|
|
85
85
|
const DEFAULT_AUDIENCE = '';
|
|
86
86
|
const MESSENGER_EXPOSED_METHODS = [
|
|
87
87
|
'performSignIn',
|
|
88
|
+
'exchangeSocialAccessToken',
|
|
88
89
|
'performSignOut',
|
|
89
90
|
'getBearerToken',
|
|
90
91
|
'getSessionProfile',
|
|
@@ -127,6 +128,13 @@ export class AuthenticationController extends BaseController {
|
|
|
127
128
|
* exist.
|
|
128
129
|
*/
|
|
129
130
|
#verificationSessions = new Map();
|
|
131
|
+
/**
|
|
132
|
+
* Verification tokens that authorized an enrollment's begin, by flow ID.
|
|
133
|
+
* The server asks for the same AAL2 proof when it is completed, which can
|
|
134
|
+
* be minutes later (for example, while the user finds an email code), past
|
|
135
|
+
* the default session age.
|
|
136
|
+
*/
|
|
137
|
+
#enrollmentAccessTokens = new Map();
|
|
130
138
|
/**
|
|
131
139
|
* Sequence number of the most recently started credentials refresh. Only
|
|
132
140
|
* that refresh may write the cache, so a slower, earlier request cannot
|
|
@@ -473,6 +481,33 @@ export class AuthenticationController extends BaseController {
|
|
|
473
481
|
throw error;
|
|
474
482
|
}
|
|
475
483
|
}
|
|
484
|
+
/**
|
|
485
|
+
* Exchanges the social access token SeedlessOnboarding holds for the
|
|
486
|
+
* wallet's Google/Apple/Telegram login (`POST /api/v2/social/login`) for an
|
|
487
|
+
* access token and the canonical profile it is paired to. Shows no UI and
|
|
488
|
+
* stores nothing: SRP sessions remain the source of truth for
|
|
489
|
+
* `getBearerToken`.
|
|
490
|
+
*
|
|
491
|
+
* Throws when the wallet has no social vault or no social token, and
|
|
492
|
+
* `SocialIdentifierNotPairedError` when the identifier was never paired to
|
|
493
|
+
* a profile.
|
|
494
|
+
*
|
|
495
|
+
* @returns The access token and canonical profile.
|
|
496
|
+
*/
|
|
497
|
+
async exchangeSocialAccessToken() {
|
|
498
|
+
const identifierType = this.#identifierTypeFromSeedlessState(this.messenger.call('SeedlessOnboardingController:getState'));
|
|
499
|
+
if (identifierType === 'SRP') {
|
|
500
|
+
throw new Error('exchangeSocialAccessToken - the wallet has no social login');
|
|
501
|
+
}
|
|
502
|
+
const socialJwt = await this.messenger.call('SeedlessOnboardingController:getAccessToken');
|
|
503
|
+
if (!socialJwt) {
|
|
504
|
+
throw new Error('exchangeSocialAccessToken - no social access token');
|
|
505
|
+
}
|
|
506
|
+
return await this.#auth.exchangeSocialAccessToken({
|
|
507
|
+
identifierType,
|
|
508
|
+
socialJwt,
|
|
509
|
+
});
|
|
510
|
+
}
|
|
476
511
|
#clearNeedsSocialPairing() {
|
|
477
512
|
if (this.state.needsSocialPairing !== false) {
|
|
478
513
|
this.update((state) => {
|
|
@@ -698,11 +733,17 @@ export class AuthenticationController extends BaseController {
|
|
|
698
733
|
accessToken,
|
|
699
734
|
}));
|
|
700
735
|
this.#assertAuthSessionEpoch(sessionEpoch, 'beginCredentialEnrollment');
|
|
736
|
+
if (accessToken) {
|
|
737
|
+
this.#enrollmentAccessTokens.set(challenge.flowId, accessToken);
|
|
738
|
+
}
|
|
701
739
|
return challenge;
|
|
702
740
|
}
|
|
703
741
|
/**
|
|
704
742
|
* Completes credential enrollment and refreshes the credential cache.
|
|
705
743
|
*
|
|
744
|
+
* It is sent with the verification token that began the enrollment, if
|
|
745
|
+
* any: once a factor is enrolled, the server requires AAL2 for both steps.
|
|
746
|
+
*
|
|
706
747
|
* The server returns an assertion for the new credential, which opens a
|
|
707
748
|
* verification session like `completeCredentialVerification`, replacing
|
|
708
749
|
* any earlier one. If that exchange fails, the earlier session is kept:
|
|
@@ -726,7 +767,10 @@ export class AuthenticationController extends BaseController {
|
|
|
726
767
|
const { type } = request.proof;
|
|
727
768
|
const { operation } = request.reason;
|
|
728
769
|
const primaryEntropySourceId = this.#getPrimaryEntropySourceId();
|
|
729
|
-
const assertion = await this.#runMfaRequest('MFA Enroll Complete', operation, type, async () => await this.#auth.completeMfaEnrollment(request.flowId, request.proof, primaryEntropySourceId));
|
|
770
|
+
const assertion = await this.#runMfaRequest('MFA Enroll Complete', operation, type, async () => await this.#auth.completeMfaEnrollment(request.flowId, request.proof, primaryEntropySourceId, this.#enrollmentAccessTokens.get(request.flowId)));
|
|
771
|
+
// Only after success: a failed attempt can be retried on this flow, and
|
|
772
|
+
// needs the same token.
|
|
773
|
+
this.#enrollmentAccessTokens.delete(request.flowId);
|
|
730
774
|
try {
|
|
731
775
|
await this.#openVerificationSessionFromAssertion(assertion, {
|
|
732
776
|
operation,
|
|
@@ -898,13 +942,15 @@ export class AuthenticationController extends BaseController {
|
|
|
898
942
|
}
|
|
899
943
|
}
|
|
900
944
|
/**
|
|
901
|
-
* Clears every in-memory verification session and its expiration timer
|
|
945
|
+
* Clears every in-memory verification session and its expiration timer,
|
|
946
|
+
* and the tokens kept for enrollments in progress.
|
|
902
947
|
*/
|
|
903
948
|
clearVerificationSession() {
|
|
904
949
|
for (const { timer } of this.#verificationSessions.values()) {
|
|
905
950
|
clearTimeout(timer);
|
|
906
951
|
}
|
|
907
952
|
this.#verificationSessions.clear();
|
|
953
|
+
this.#enrollmentAccessTokens.clear();
|
|
908
954
|
}
|
|
909
955
|
/**
|
|
910
956
|
* Drops the cached credential list. Callers that wipe profile state must go
|