@metamask/profile-sync-controller 34.0.3 → 35.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +36 -1
- package/dist/controllers/authentication/AuthenticationController-method-action-types.d.ts +25 -3
- package/dist/controllers/authentication/AuthenticationController-method-action-types.d.ts.map +1 -1
- package/dist/controllers/authentication/AuthenticationController-method-action-types.js.map +1 -1
- package/dist/controllers/authentication/AuthenticationController.d.ts +21 -2
- package/dist/controllers/authentication/AuthenticationController.d.ts.map +1 -1
- package/dist/controllers/authentication/AuthenticationController.js +50 -3
- package/dist/controllers/authentication/AuthenticationController.js.map +1 -1
- package/dist/controllers/authentication/index.d.ts +1 -1
- package/dist/controllers/authentication/index.d.ts.map +1 -1
- package/dist/controllers/authentication/index.js.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/flow-srp.d.ts +15 -4
- package/dist/sdk/authentication-jwt-bearer/flow-srp.d.ts.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/flow-srp.js +34 -6
- package/dist/sdk/authentication-jwt-bearer/flow-srp.js.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/mfa/schemas.d.ts +23 -10
- package/dist/sdk/authentication-jwt-bearer/mfa/schemas.d.ts.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/mfa/schemas.js +20 -8
- package/dist/sdk/authentication-jwt-bearer/mfa/schemas.js.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/mfa/services.d.ts +19 -0
- package/dist/sdk/authentication-jwt-bearer/mfa/services.d.ts.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/mfa/services.js +65 -10
- package/dist/sdk/authentication-jwt-bearer/mfa/services.js.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/mfa/types.d.ts +44 -22
- package/dist/sdk/authentication-jwt-bearer/mfa/types.d.ts.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/mfa/types.js.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/services.d.ts +12 -1
- package/dist/sdk/authentication-jwt-bearer/services.d.ts.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/services.js +56 -14
- package/dist/sdk/authentication-jwt-bearer/services.js.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/types.d.ts +9 -0
- package/dist/sdk/authentication-jwt-bearer/types.d.ts.map +1 -1
- package/dist/sdk/authentication-jwt-bearer/types.js.map +1 -1
- package/dist/sdk/authentication.d.ts +3 -2
- package/dist/sdk/authentication.d.ts.map +1 -1
- package/dist/sdk/authentication.js +6 -2
- package/dist/sdk/authentication.js.map +1 -1
- package/dist/sdk/constants.d.ts +1 -0
- package/dist/sdk/constants.d.ts.map +1 -1
- package/dist/sdk/constants.js +1 -0
- package/dist/sdk/constants.js.map +1 -1
- package/dist/sdk/errors.d.ts +10 -1
- package/dist/sdk/errors.d.ts.map +1 -1
- package/dist/sdk/errors.js +12 -0
- package/dist/sdk/errors.js.map +1 -1
- package/dist/sdk/mocks/auth.d.ts +18 -0
- package/dist/sdk/mocks/auth.d.ts.map +1 -1
- package/dist/sdk/mocks/auth.js +19 -1
- package/dist/sdk/mocks/auth.js.map +1 -1
- package/package.json +9 -9
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,39 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [35.0.0]
|
|
11
|
+
|
|
12
|
+
### Added
|
|
13
|
+
|
|
14
|
+
- Add authenticator app (TOTP) support to MFA enrollment and verification ([#10914](https://github.com/MetaMask/core/pull/10914))
|
|
15
|
+
- `AuthenticationController.beginCredentialEnrollment({ type: 'totp' })` returns a `totp` challenge with the base32 `secret`, a PNG data URL `qrCode`, and a `setupUri` (`otpauth://` link) that opens an authenticator app on the same device
|
|
16
|
+
- `completeCredentialEnrollment` and `completeCredentialVerification` accept a `{ type: 'totp', code }` proof, and `beginCredentialVerification({ type: 'totp' })` returns a `totp` challenge
|
|
17
|
+
- Enrolled authenticator apps are listed in `enrolledCredentials` as `{ type: 'totp' }`
|
|
18
|
+
- The server's `totp_already_enrolled` error is thrown as `CredentialAlreadyEnrolledError`
|
|
19
|
+
- Add `lastUsedAt` to every `EnrolledCredential`, from the server's `last_used_at` ([#10914](https://github.com/MetaMask/core/pull/10914))
|
|
20
|
+
|
|
21
|
+
### Changed
|
|
22
|
+
|
|
23
|
+
- **BREAKING:** `MFA_CREDENTIAL_TYPES`, `MfaCredentialType`, `EnrolledCredential`, `EnrollmentChallenge`, `EnrollmentProof`, `VerificationChallenge`, `VerificationProof` and `MfaErrorCode` now include TOTP (`'totp'` and `'totp_already_enrolled'`) ([#10914](https://github.com/MetaMask/core/pull/10914))
|
|
24
|
+
|
|
25
|
+
## [34.1.0]
|
|
26
|
+
|
|
27
|
+
### Added
|
|
28
|
+
|
|
29
|
+
- Add `AuthenticationController.exchangeSocialAccessToken` and the `AuthenticationController:exchangeSocialAccessToken` messenger action, exchanging the wallet's Google, Apple or Telegram social access token (`POST /api/v2/social/login`) for an access token and the canonical profile, without storing them ([#10886](https://github.com/MetaMask/core/pull/10886))
|
|
30
|
+
- Add `exchangeSocialAccessToken` to the SDK's `JwtBearerAuth`, the `SocialLoginParams` type, and `SocialIdentifierNotPairedError`, thrown when the identifier was never paired to a profile
|
|
31
|
+
|
|
32
|
+
### Changed
|
|
33
|
+
|
|
34
|
+
- Bump `loglevel` from `^1.8.1` to `^1.9.2` ([#10724](https://github.com/MetaMask/core/pull/10724))
|
|
35
|
+
- Bump `@metamask/keyring-controller` from `^28.1.0` to `^28.2.0` ([#10851](https://github.com/MetaMask/core/pull/10851))
|
|
36
|
+
- Bump `@metamask/base-controller` from `^10.0.0` to `^10.1.0` ([#10864](https://github.com/MetaMask/core/pull/10864))
|
|
37
|
+
|
|
38
|
+
### Fixed
|
|
39
|
+
|
|
40
|
+
- Fix `AuthenticationController.completeCredentialEnrollment` failing with `aal2_required` when adding a second factor, by sending the verification token that began the enrollment, which the server now requires to complete it too ([#10900](https://github.com/MetaMask/core/pull/10900))
|
|
41
|
+
- `JwtBearerAuth.completeMfaEnrollment` accepts an optional `accessToken`, like `beginMfaEnrollment`
|
|
42
|
+
|
|
10
43
|
## [34.0.3]
|
|
11
44
|
|
|
12
45
|
### Changed
|
|
@@ -1061,7 +1094,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
1061
1094
|
|
|
1062
1095
|
- Initial release
|
|
1063
1096
|
|
|
1064
|
-
[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@
|
|
1097
|
+
[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@35.0.0...HEAD
|
|
1098
|
+
[35.0.0]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@34.1.0...@metamask/profile-sync-controller@35.0.0
|
|
1099
|
+
[34.1.0]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@34.0.3...@metamask/profile-sync-controller@34.1.0
|
|
1065
1100
|
[34.0.3]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@34.0.2...@metamask/profile-sync-controller@34.0.3
|
|
1066
1101
|
[34.0.2]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@34.0.1...@metamask/profile-sync-controller@34.0.2
|
|
1067
1102
|
[34.0.1]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@34.0.0...@metamask/profile-sync-controller@34.0.1
|
|
@@ -7,6 +7,23 @@ export type AuthenticationControllerPerformSignInAction = {
|
|
|
7
7
|
type: `AuthenticationController:performSignIn`;
|
|
8
8
|
handler: AuthenticationController['performSignIn'];
|
|
9
9
|
};
|
|
10
|
+
/**
|
|
11
|
+
* Exchanges the social access token SeedlessOnboarding holds for the
|
|
12
|
+
* wallet's Google/Apple/Telegram login (`POST /api/v2/social/login`) for an
|
|
13
|
+
* access token and the canonical profile it is paired to. Shows no UI and
|
|
14
|
+
* stores nothing: SRP sessions remain the source of truth for
|
|
15
|
+
* `getBearerToken`.
|
|
16
|
+
*
|
|
17
|
+
* Throws when the wallet has no social vault or no social token, and
|
|
18
|
+
* `SocialIdentifierNotPairedError` when the identifier was never paired to
|
|
19
|
+
* a profile.
|
|
20
|
+
*
|
|
21
|
+
* @returns The access token and canonical profile.
|
|
22
|
+
*/
|
|
23
|
+
export type AuthenticationControllerExchangeSocialAccessTokenAction = {
|
|
24
|
+
type: `AuthenticationController:exchangeSocialAccessToken`;
|
|
25
|
+
handler: AuthenticationController['exchangeSocialAccessToken'];
|
|
26
|
+
};
|
|
10
27
|
/**
|
|
11
28
|
* Marks profile pairing as needed. Clients call this when the SRP set
|
|
12
29
|
* changes (e.g. a new keyring was added) so the next auto-sign-in cycle
|
|
@@ -26,7 +43,8 @@ export type AuthenticationControllerRefreshEnrolledCredentialsAction = {
|
|
|
26
43
|
handler: AuthenticationController['refreshEnrolledCredentials'];
|
|
27
44
|
};
|
|
28
45
|
/**
|
|
29
|
-
* Begins enrollment of a passkey
|
|
46
|
+
* Begins enrollment of a passkey, email OTP or authenticator app (TOTP)
|
|
47
|
+
* credential.
|
|
30
48
|
*
|
|
31
49
|
* @param request - Credential, optional email address, and trace reason.
|
|
32
50
|
* @returns A challenge for the client-owned ceremony.
|
|
@@ -38,6 +56,9 @@ export type AuthenticationControllerBeginCredentialEnrollmentAction = {
|
|
|
38
56
|
/**
|
|
39
57
|
* Completes credential enrollment and refreshes the credential cache.
|
|
40
58
|
*
|
|
59
|
+
* It is sent with the verification token that began the enrollment, if
|
|
60
|
+
* any: once a factor is enrolled, the server requires AAL2 for both steps.
|
|
61
|
+
*
|
|
41
62
|
* The server returns an assertion for the new credential, which opens a
|
|
42
63
|
* verification session like `completeCredentialVerification`, replacing
|
|
43
64
|
* any earlier one. If that exchange fails, the earlier session is kept:
|
|
@@ -103,7 +124,8 @@ export type AuthenticationControllerGetVerificationTokenAction = {
|
|
|
103
124
|
handler: AuthenticationController['getVerificationToken'];
|
|
104
125
|
};
|
|
105
126
|
/**
|
|
106
|
-
* Clears every in-memory verification session and its expiration timer
|
|
127
|
+
* Clears every in-memory verification session and its expiration timer,
|
|
128
|
+
* and the tokens kept for enrollments in progress.
|
|
107
129
|
*/
|
|
108
130
|
export type AuthenticationControllerClearVerificationSessionAction = {
|
|
109
131
|
type: `AuthenticationController:clearVerificationSession`;
|
|
@@ -216,5 +238,5 @@ export type AuthenticationControllerIsSignedInAction = {
|
|
|
216
238
|
/**
|
|
217
239
|
* Union of all AuthenticationController action types.
|
|
218
240
|
*/
|
|
219
|
-
export type AuthenticationControllerMethodActions = AuthenticationControllerPerformSignInAction | AuthenticationControllerRequestProfilePairingAction | AuthenticationControllerRefreshEnrolledCredentialsAction | AuthenticationControllerBeginCredentialEnrollmentAction | AuthenticationControllerCompleteCredentialEnrollmentAction | AuthenticationControllerBeginCredentialVerificationAction | AuthenticationControllerCompleteCredentialVerificationAction | AuthenticationControllerGetVerificationTokenAction | AuthenticationControllerClearVerificationSessionAction | AuthenticationControllerPerformSignOutAction | AuthenticationControllerClearStateAction | AuthenticationControllerGetBearerTokenAction | AuthenticationControllerGetSessionProfileAction | AuthenticationControllerRefreshCanonicalProfileIdAction | AuthenticationControllerGetUserProfileLineageAction | AuthenticationControllerGetCustomerServiceTokenAction | AuthenticationControllerGetPartnerIdentityTokenAction | AuthenticationControllerIsSignedInAction;
|
|
241
|
+
export type AuthenticationControllerMethodActions = AuthenticationControllerPerformSignInAction | AuthenticationControllerExchangeSocialAccessTokenAction | AuthenticationControllerRequestProfilePairingAction | AuthenticationControllerRefreshEnrolledCredentialsAction | AuthenticationControllerBeginCredentialEnrollmentAction | AuthenticationControllerCompleteCredentialEnrollmentAction | AuthenticationControllerBeginCredentialVerificationAction | AuthenticationControllerCompleteCredentialVerificationAction | AuthenticationControllerGetVerificationTokenAction | AuthenticationControllerClearVerificationSessionAction | AuthenticationControllerPerformSignOutAction | AuthenticationControllerClearStateAction | AuthenticationControllerGetBearerTokenAction | AuthenticationControllerGetSessionProfileAction | AuthenticationControllerRefreshCanonicalProfileIdAction | AuthenticationControllerGetUserProfileLineageAction | AuthenticationControllerGetCustomerServiceTokenAction | AuthenticationControllerGetPartnerIdentityTokenAction | AuthenticationControllerIsSignedInAction;
|
|
220
242
|
//# sourceMappingURL=AuthenticationController-method-action-types.d.ts.map
|
package/dist/controllers/authentication/AuthenticationController-method-action-types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthenticationController-method-action-types.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,wBAAwB,CAAC,4BAA4B,CAAC,CAAC;CACjE,CAAC;AAEF
|
|
1
|
+
{"version":3,"file":"AuthenticationController-method-action-types.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,wBAAwB,CAAC,4BAA4B,CAAC,CAAC;CACjE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,wBAAwB,CAAC,8BAA8B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,wBAAwB,CAAC,6BAA6B,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4DAA4D,GAAG;IACzE,IAAI,EAAE,yDAAyD,CAAC;IAChE,OAAO,EAAE,wBAAwB,CAAC,gCAAgC,CAAC,CAAC;CACrE,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,wBAAwB,CAAC,sBAAsB,CAAC,CAAC;CAC3D,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,sDAAsD,GAAG;IACnE,IAAI,EAAE,mDAAmD,CAAC;IAC1D,OAAO,EAAE,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;CAC/D,CAAC;AAEF,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qCAAqC,GAC7C,2CAA2C,GAC3C,uDAAuD,GACvD,mDAAmD,GACnD,wDAAwD,GACxD,uDAAuD,GACvD,0DAA0D,GAC1D,yDAAyD,GACzD,4DAA4D,GAC5D,kDAAkD,GAClD,sDAAsD,GACtD,4CAA4C,GAC5C,wCAAwC,GACxC,4CAA4C,GAC5C,+CAA+C,GAC/C,uDAAuD,GACvD,mDAAmD,GACnD,qDAAqD,GACrD,qDAAqD,GACrD,wCAAwC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthenticationController-method-action-types.js","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController.js';\n\nexport type AuthenticationControllerPerformSignInAction = {\n type: `AuthenticationController:performSignIn`;\n handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n type: `AuthenticationController:requestProfilePairing`;\n handler: AuthenticationController['requestProfilePairing'];\n};\n\n/**\n * Refreshes credentials enrolled on the canonical profile.\n *\n * @returns The current supported credentials.\n */\nexport type AuthenticationControllerRefreshEnrolledCredentialsAction = {\n type: `AuthenticationController:refreshEnrolledCredentials`;\n handler: AuthenticationController['refreshEnrolledCredentials'];\n};\n\n/**\n * Begins enrollment of a passkey or email OTP credential.\n *\n * @param request - Credential, optional email address, and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginCredentialEnrollmentAction = {\n type: `AuthenticationController:beginCredentialEnrollment`;\n handler: AuthenticationController['beginCredentialEnrollment'];\n};\n\n/**\n * Completes credential enrollment and refreshes the credential cache.\n *\n * The server returns an assertion for the new credential, which opens a\n * verification session like `completeCredentialVerification`, replacing\n * any earlier one. If that exchange fails, the earlier session is kept:\n * the credential is enrolled either way.\n *\n * A cache-refresh failure does not undo successful enrollment. Email\n * enrollment invalidates the primary SRP session *after* refresh so the\n * credentials call can reuse the still-valid access token; the next token\n * fetch then includes the newly verified email claim. That invalidation\n * happens even if the session ends mid-request: the enrollment succeeded\n * on the server, so a token cached across a lock must not be reused\n * without the new claim.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The refreshed credentials, or the existing cache if refresh fails.\n */\nexport type AuthenticationControllerCompleteCredentialEnrollmentAction = {\n type: `AuthenticationController:completeCredentialEnrollment`;\n handler: AuthenticationController['completeCredentialEnrollment'];\n};\n\n/**\n * Begins verification with an enrolled credential.\n *\n * @param request - Credential type and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginCredentialVerificationAction = {\n type: `AuthenticationController:beginCredentialVerification`;\n handler: AuthenticationController['beginCredentialVerification'];\n};\n\n/**\n * Completes verification and opens a short-lived verification session.\n *\n * The assertion returned by the MFA service is exchanged at Hydra for an\n * access token. Its assurance level is not checked: the services receiving\n * the token enforce their own requirements. The token itself never enters\n * controller state.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The verification token.\n */\nexport type AuthenticationControllerCompleteCredentialVerificationAction = {\n type: `AuthenticationController:completeCredentialVerification`;\n handler: AuthenticationController['completeCredentialVerification'];\n};\n\n/**\n * Returns the active verification token when it meets the requested\n * freshness.\n *\n * Low-level: features should go through the client MFA kit\n * (`verifyOrEnroll`), which reuses a matching session without showing any\n * screen and checks which method proved it. Read the token directly only\n * from code that cannot show UI, and treat `null` as \"let the UI layer\n * ask\".\n *\n * @param request - Optional maximum session age in milliseconds, measured\n * from when the token was obtained. Zero always requires a new ceremony.\n * @returns A live verification token, or null when no reusable session\n * exists.\n */\nexport type AuthenticationControllerGetVerificationTokenAction = {\n type: `AuthenticationController:getVerificationToken`;\n handler: AuthenticationController['getVerificationToken'];\n};\n\n/**\n * Clears every in-memory verification session and its expiration timer.\n */\nexport type AuthenticationControllerClearVerificationSessionAction = {\n type: `AuthenticationController:clearVerificationSession`;\n handler: AuthenticationController['clearVerificationSession'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n type: `AuthenticationController:performSignOut`;\n handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Resets the controller to `defaultState`. Clients call this on wallet reset\n * so the next wallet starts unsigned with both pairing gates re-armed.\n */\nexport type AuthenticationControllerClearStateAction = {\n type: `AuthenticationController:clearState`;\n handler: AuthenticationController['clearState'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n type: `AuthenticationController:getBearerToken`;\n handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n type: `AuthenticationController:getSessionProfile`;\n handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n type: `AuthenticationController:refreshCanonicalProfileId`;\n handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n type: `AuthenticationController:getUserProfileLineage`;\n handler: AuthenticationController['getUserProfileLineage'];\n};\n\n/**\n * Returns a Customer Service specific access token for the specified SRP,\n * logging in if needed.\n *\n * Exchanges the OIDC access token for a short-lived token scoped to the\n * customer-service audience. Customer Service tooling consumes this token to\n * identify and authenticate the user.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The customer-service access token.\n */\nexport type AuthenticationControllerGetCustomerServiceTokenAction = {\n type: `AuthenticationController:getCustomerServiceToken`;\n handler: AuthenticationController['getCustomerServiceToken'];\n};\n\n/**\n * Mints a partner identity token for the specified SRP, logging in if needed.\n *\n * Calls `POST /api/v2/oidc/token` with the Hydra login bearer and returns\n * the minted `access_token`. Email on live tokens is under JWT `ext`.\n * HTTP 422 throws `EmailRequiredError` when this profile has no\n * verified email.\n *\n * @param claims - Claim names to embed. Only `email` is supported.\n * @param audience - Partner audience (`kyc` or `iron`).\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The partner identity access token.\n */\nexport type AuthenticationControllerGetPartnerIdentityTokenAction = {\n type: `AuthenticationController:getPartnerIdentityToken`;\n handler: AuthenticationController['getPartnerIdentityToken'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n type: `AuthenticationController:isSignedIn`;\n handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n | AuthenticationControllerPerformSignInAction\n | AuthenticationControllerRequestProfilePairingAction\n | AuthenticationControllerRefreshEnrolledCredentialsAction\n | AuthenticationControllerBeginCredentialEnrollmentAction\n | AuthenticationControllerCompleteCredentialEnrollmentAction\n | AuthenticationControllerBeginCredentialVerificationAction\n | AuthenticationControllerCompleteCredentialVerificationAction\n | AuthenticationControllerGetVerificationTokenAction\n | AuthenticationControllerClearVerificationSessionAction\n | AuthenticationControllerPerformSignOutAction\n | AuthenticationControllerClearStateAction\n | AuthenticationControllerGetBearerTokenAction\n | AuthenticationControllerGetSessionProfileAction\n | AuthenticationControllerRefreshCanonicalProfileIdAction\n | AuthenticationControllerGetUserProfileLineageAction\n | AuthenticationControllerGetCustomerServiceTokenAction\n | AuthenticationControllerGetPartnerIdentityTokenAction\n | AuthenticationControllerIsSignedInAction;\n"]}
|
|
1
|
+
{"version":3,"file":"AuthenticationController-method-action-types.js","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController.js';\n\nexport type AuthenticationControllerPerformSignInAction = {\n type: `AuthenticationController:performSignIn`;\n handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Exchanges the social access token SeedlessOnboarding holds for the\n * wallet's Google/Apple/Telegram login (`POST /api/v2/social/login`) for an\n * access token and the canonical profile it is paired to. Shows no UI and\n * stores nothing: SRP sessions remain the source of truth for\n * `getBearerToken`.\n *\n * Throws when the wallet has no social vault or no social token, and\n * `SocialIdentifierNotPairedError` when the identifier was never paired to\n * a profile.\n *\n * @returns The access token and canonical profile.\n */\nexport type AuthenticationControllerExchangeSocialAccessTokenAction = {\n type: `AuthenticationController:exchangeSocialAccessToken`;\n handler: AuthenticationController['exchangeSocialAccessToken'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n type: `AuthenticationController:requestProfilePairing`;\n handler: AuthenticationController['requestProfilePairing'];\n};\n\n/**\n * Refreshes credentials enrolled on the canonical profile.\n *\n * @returns The current supported credentials.\n */\nexport type AuthenticationControllerRefreshEnrolledCredentialsAction = {\n type: `AuthenticationController:refreshEnrolledCredentials`;\n handler: AuthenticationController['refreshEnrolledCredentials'];\n};\n\n/**\n * Begins enrollment of a passkey, email OTP or authenticator app (TOTP)\n * credential.\n *\n * @param request - Credential, optional email address, and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginCredentialEnrollmentAction = {\n type: `AuthenticationController:beginCredentialEnrollment`;\n handler: AuthenticationController['beginCredentialEnrollment'];\n};\n\n/**\n * Completes credential enrollment and refreshes the credential cache.\n *\n * It is sent with the verification token that began the enrollment, if\n * any: once a factor is enrolled, the server requires AAL2 for both steps.\n *\n * The server returns an assertion for the new credential, which opens a\n * verification session like `completeCredentialVerification`, replacing\n * any earlier one. If that exchange fails, the earlier session is kept:\n * the credential is enrolled either way.\n *\n * A cache-refresh failure does not undo successful enrollment. Email\n * enrollment invalidates the primary SRP session *after* refresh so the\n * credentials call can reuse the still-valid access token; the next token\n * fetch then includes the newly verified email claim. That invalidation\n * happens even if the session ends mid-request: the enrollment succeeded\n * on the server, so a token cached across a lock must not be reused\n * without the new claim.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The refreshed credentials, or the existing cache if refresh fails.\n */\nexport type AuthenticationControllerCompleteCredentialEnrollmentAction = {\n type: `AuthenticationController:completeCredentialEnrollment`;\n handler: AuthenticationController['completeCredentialEnrollment'];\n};\n\n/**\n * Begins verification with an enrolled credential.\n *\n * @param request - Credential type and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginCredentialVerificationAction = {\n type: `AuthenticationController:beginCredentialVerification`;\n handler: AuthenticationController['beginCredentialVerification'];\n};\n\n/**\n * Completes verification and opens a short-lived verification session.\n *\n * The assertion returned by the MFA service is exchanged at Hydra for an\n * access token. Its assurance level is not checked: the services receiving\n * the token enforce their own requirements. The token itself never enters\n * controller state.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The verification token.\n */\nexport type AuthenticationControllerCompleteCredentialVerificationAction = {\n type: `AuthenticationController:completeCredentialVerification`;\n handler: AuthenticationController['completeCredentialVerification'];\n};\n\n/**\n * Returns the active verification token when it meets the requested\n * freshness.\n *\n * Low-level: features should go through the client MFA kit\n * (`verifyOrEnroll`), which reuses a matching session without showing any\n * screen and checks which method proved it. Read the token directly only\n * from code that cannot show UI, and treat `null` as \"let the UI layer\n * ask\".\n *\n * @param request - Optional maximum session age in milliseconds, measured\n * from when the token was obtained. Zero always requires a new ceremony.\n * @returns A live verification token, or null when no reusable session\n * exists.\n */\nexport type AuthenticationControllerGetVerificationTokenAction = {\n type: `AuthenticationController:getVerificationToken`;\n handler: AuthenticationController['getVerificationToken'];\n};\n\n/**\n * Clears every in-memory verification session and its expiration timer,\n * and the tokens kept for enrollments in progress.\n */\nexport type AuthenticationControllerClearVerificationSessionAction = {\n type: `AuthenticationController:clearVerificationSession`;\n handler: AuthenticationController['clearVerificationSession'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n type: `AuthenticationController:performSignOut`;\n handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Resets the controller to `defaultState`. Clients call this on wallet reset\n * so the next wallet starts unsigned with both pairing gates re-armed.\n */\nexport type AuthenticationControllerClearStateAction = {\n type: `AuthenticationController:clearState`;\n handler: AuthenticationController['clearState'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n type: `AuthenticationController:getBearerToken`;\n handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n type: `AuthenticationController:getSessionProfile`;\n handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n type: `AuthenticationController:refreshCanonicalProfileId`;\n handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n type: `AuthenticationController:getUserProfileLineage`;\n handler: AuthenticationController['getUserProfileLineage'];\n};\n\n/**\n * Returns a Customer Service specific access token for the specified SRP,\n * logging in if needed.\n *\n * Exchanges the OIDC access token for a short-lived token scoped to the\n * customer-service audience. Customer Service tooling consumes this token to\n * identify and authenticate the user.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The customer-service access token.\n */\nexport type AuthenticationControllerGetCustomerServiceTokenAction = {\n type: `AuthenticationController:getCustomerServiceToken`;\n handler: AuthenticationController['getCustomerServiceToken'];\n};\n\n/**\n * Mints a partner identity token for the specified SRP, logging in if needed.\n *\n * Calls `POST /api/v2/oidc/token` with the Hydra login bearer and returns\n * the minted `access_token`. Email on live tokens is under JWT `ext`.\n * HTTP 422 throws `EmailRequiredError` when this profile has no\n * verified email.\n *\n * @param claims - Claim names to embed. Only `email` is supported.\n * @param audience - Partner audience (`kyc` or `iron`).\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The partner identity access token.\n */\nexport type AuthenticationControllerGetPartnerIdentityTokenAction = {\n type: `AuthenticationController:getPartnerIdentityToken`;\n handler: AuthenticationController['getPartnerIdentityToken'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n type: `AuthenticationController:isSignedIn`;\n handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n | AuthenticationControllerPerformSignInAction\n | AuthenticationControllerExchangeSocialAccessTokenAction\n | AuthenticationControllerRequestProfilePairingAction\n | AuthenticationControllerRefreshEnrolledCredentialsAction\n | AuthenticationControllerBeginCredentialEnrollmentAction\n | AuthenticationControllerCompleteCredentialEnrollmentAction\n | AuthenticationControllerBeginCredentialVerificationAction\n | AuthenticationControllerCompleteCredentialVerificationAction\n | AuthenticationControllerGetVerificationTokenAction\n | AuthenticationControllerClearVerificationSessionAction\n | AuthenticationControllerPerformSignOutAction\n | AuthenticationControllerClearStateAction\n | AuthenticationControllerGetBearerTokenAction\n | AuthenticationControllerGetSessionProfileAction\n | AuthenticationControllerRefreshCanonicalProfileIdAction\n | AuthenticationControllerGetUserProfileLineageAction\n | AuthenticationControllerGetCustomerServiceTokenAction\n | AuthenticationControllerGetPartnerIdentityTokenAction\n | AuthenticationControllerIsSignedInAction;\n"]}
|
|
@@ -95,6 +95,20 @@ export declare class AuthenticationController extends BaseController<typeof cont
|
|
|
95
95
|
trace?: TraceCallback;
|
|
96
96
|
});
|
|
97
97
|
performSignIn(): Promise<string[]>;
|
|
98
|
+
/**
|
|
99
|
+
* Exchanges the social access token SeedlessOnboarding holds for the
|
|
100
|
+
* wallet's Google/Apple/Telegram login (`POST /api/v2/social/login`) for an
|
|
101
|
+
* access token and the canonical profile it is paired to. Shows no UI and
|
|
102
|
+
* stores nothing: SRP sessions remain the source of truth for
|
|
103
|
+
* `getBearerToken`.
|
|
104
|
+
*
|
|
105
|
+
* Throws when the wallet has no social vault or no social token, and
|
|
106
|
+
* `SocialIdentifierNotPairedError` when the identifier was never paired to
|
|
107
|
+
* a profile.
|
|
108
|
+
*
|
|
109
|
+
* @returns The access token and canonical profile.
|
|
110
|
+
*/
|
|
111
|
+
exchangeSocialAccessToken(): Promise<LoginResponse>;
|
|
98
112
|
/**
|
|
99
113
|
* Marks profile pairing as needed. Clients call this when the SRP set
|
|
100
114
|
* changes (e.g. a new keyring was added) so the next auto-sign-in cycle
|
|
@@ -108,7 +122,8 @@ export declare class AuthenticationController extends BaseController<typeof cont
|
|
|
108
122
|
*/
|
|
109
123
|
refreshEnrolledCredentials(): Promise<EnrolledCredential[]>;
|
|
110
124
|
/**
|
|
111
|
-
* Begins enrollment of a passkey
|
|
125
|
+
* Begins enrollment of a passkey, email OTP or authenticator app (TOTP)
|
|
126
|
+
* credential.
|
|
112
127
|
*
|
|
113
128
|
* @param request - Credential, optional email address, and trace reason.
|
|
114
129
|
* @returns A challenge for the client-owned ceremony.
|
|
@@ -117,6 +132,9 @@ export declare class AuthenticationController extends BaseController<typeof cont
|
|
|
117
132
|
/**
|
|
118
133
|
* Completes credential enrollment and refreshes the credential cache.
|
|
119
134
|
*
|
|
135
|
+
* It is sent with the verification token that began the enrollment, if
|
|
136
|
+
* any: once a factor is enrolled, the server requires AAL2 for both steps.
|
|
137
|
+
*
|
|
120
138
|
* The server returns an assertion for the new credential, which opens a
|
|
121
139
|
* verification session like `completeCredentialVerification`, replacing
|
|
122
140
|
* any earlier one. If that exchange fails, the earlier session is kept:
|
|
@@ -170,7 +188,8 @@ export declare class AuthenticationController extends BaseController<typeof cont
|
|
|
170
188
|
*/
|
|
171
189
|
getVerificationToken(request?: GetVerificationTokenRequest): VerificationToken | null;
|
|
172
190
|
/**
|
|
173
|
-
* Clears every in-memory verification session and its expiration timer
|
|
191
|
+
* Clears every in-memory verification session and its expiration timer,
|
|
192
|
+
* and the tokens kept for enrollments in progress.
|
|
174
193
|
*/
|
|
175
194
|
clearVerificationSession(): void;
|
|
176
195
|
performSignOut(): void;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthenticationController.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,4BAA4B,CAAC;AAE9E,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC5B,0CAA0C,EAC3C,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EACV,gDAAgD,EAChD,0CAA0C,EAC3C,MAAM,0CAA0C,CAAC;AAYlD,OAAO,KAAK,EAEV,aAAa,EACb,YAAY,EAIZ,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,2BAA2B,EAG3B,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,GAAG,EAKJ,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAOtE,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAE1G,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAK1B,CAAC;AAmEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAa,CAAC;AAaxD,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;IACT;;;;OAIG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC;CACvC,CAAC;
|
|
1
|
+
{"version":3,"file":"AuthenticationController.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,4BAA4B,CAAC;AAE9E,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC5B,0CAA0C,EAC3C,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EACV,gDAAgD,EAChD,0CAA0C,EAC3C,MAAM,0CAA0C,CAAC;AAYlD,OAAO,KAAK,EAEV,aAAa,EACb,YAAY,EAIZ,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,2BAA2B,EAG3B,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,GAAG,EAKJ,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAOtE,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAE1G,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAK1B,CAAC;AAmEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAa,CAAC;AAaxD,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;IACT;;;;OAIG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC;CACvC,CAAC;AAwBF,MAAM,MAAM,OAAO,GACf,sCAAsC,GACtC,qCAAqC,CAAC;AAE1C,MAAM,MAAM,sCAAsC,GAAG,wBAAwB,CAC3E,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAClD,0BAA0B,CACxB,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEJ,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,MAAM,GACd,wCAAwC,GACxC,0CAA0C,CAAC;AAG/C,KAAK,cAAc,GACf,+BAA+B,GAC/B,0CAA0C,GAC1C,0CAA0C,GAC1C,gDAAgD,CAAC;AAErD,KAAK,aAAa,GAAG,0BAA0B,GAAG,4BAA4B,CAAC;AAG/E,MAAM,MAAM,iCAAiC,GAAG,SAAS,CACvD,OAAO,cAAc,EACrB,OAAO,GAAG,cAAc,EACxB,MAAM,GAAG,aAAa,CACvB,CAAC;AAEF;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAC1D,OAAO,cAAc,EACrB,6BAA6B,EAC7B,iCAAiC,CAClC;;IAuEC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,EACX,KAAK,GACN,EAAE;QACD,SAAS,EAAE,iCAAiC,CAAC;QAC7C,KAAK,CAAC,EAAE,6BAA6B,CAAC;QACtC,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnC;;;WAGG;QACH,WAAW,EAAE,eAAe,CAAC;QAC7B,KAAK,CAAC,EAAE,aAAa,CAAC;KACvB,EAkDA;IAkLY,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAc9C;IAyID;;;;;;;;;;;;OAYG;IACU,yBAAyB,IAAI,OAAO,CAAC,aAAa,CAAC,CAqB/D;IAUD;;;;OAIG;IACI,qBAAqB,IAAI,IAAI,CAOnC;IA8LD;;;;OAIG;IACU,0BAA0B,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA+BvE;IAED;;;;;;OAMG;IACU,yBAAyB,CACpC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CA4B9B;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,4BAA4B,CACvC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAyD/B;IAED;;;;;OAKG;IACU,2BAA2B,CACtC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,qBAAqB,CAAC,CAiBhC;IAED;;;;;;;;;;OAUG;IACU,8BAA8B,CACzC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,iBAAiB,CAAC,CA4B5B;IAsDD;;;;;;;;;;;;;;OAcG;IACI,oBAAoB,CACzB,OAAO,GAAE,2BAAgC,GACxC,iBAAiB,GAAG,IAAI,CAoB1B;IAmCD;;;OAGG;IACI,wBAAwB,IAAI,IAAI,CAMtC;IAoBM,cAAc,IAAI,IAAI,CAQ5B;IAED;;;OAGG;IACI,UAAU,IAAI,IAAI,CAMxB;IAED;;;;;;;;;;OAUG;IACU,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIrE;IAED;;;;;;;;;;;;OAYG;IACU,iBAAiB,CAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC,CAItB;IAED;;;;;;;;;;;;;;;OAeG;IACU,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAgBxD;IAcY,qBAAqB,CAChC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAI7B;IAED;;;;;;;;;;OAUG;IACU,uBAAuB,CAClC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAIjB;IAED;;;;;;;;;;;;OAYG;IACU,uBAAuB,CAClC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAQjB;IAEM,UAAU,IAAI,OAAO,CAE3B;CA8EF"}
|
|
@@ -85,6 +85,7 @@ export const ENROLLMENT_MAX_SESSION_AGE_MS = 2 * 60_000;
|
|
|
85
85
|
const DEFAULT_AUDIENCE = '';
|
|
86
86
|
const MESSENGER_EXPOSED_METHODS = [
|
|
87
87
|
'performSignIn',
|
|
88
|
+
'exchangeSocialAccessToken',
|
|
88
89
|
'performSignOut',
|
|
89
90
|
'getBearerToken',
|
|
90
91
|
'getSessionProfile',
|
|
@@ -127,6 +128,13 @@ export class AuthenticationController extends BaseController {
|
|
|
127
128
|
* exist.
|
|
128
129
|
*/
|
|
129
130
|
#verificationSessions = new Map();
|
|
131
|
+
/**
|
|
132
|
+
* Verification tokens that authorized an enrollment's begin, by flow ID.
|
|
133
|
+
* The server asks for the same AAL2 proof when it is completed, which can
|
|
134
|
+
* be minutes later (for example, while the user finds an email code), past
|
|
135
|
+
* the default session age.
|
|
136
|
+
*/
|
|
137
|
+
#enrollmentAccessTokens = new Map();
|
|
130
138
|
/**
|
|
131
139
|
* Sequence number of the most recently started credentials refresh. Only
|
|
132
140
|
* that refresh may write the cache, so a slower, earlier request cannot
|
|
@@ -473,6 +481,33 @@ export class AuthenticationController extends BaseController {
|
|
|
473
481
|
throw error;
|
|
474
482
|
}
|
|
475
483
|
}
|
|
484
|
+
/**
|
|
485
|
+
* Exchanges the social access token SeedlessOnboarding holds for the
|
|
486
|
+
* wallet's Google/Apple/Telegram login (`POST /api/v2/social/login`) for an
|
|
487
|
+
* access token and the canonical profile it is paired to. Shows no UI and
|
|
488
|
+
* stores nothing: SRP sessions remain the source of truth for
|
|
489
|
+
* `getBearerToken`.
|
|
490
|
+
*
|
|
491
|
+
* Throws when the wallet has no social vault or no social token, and
|
|
492
|
+
* `SocialIdentifierNotPairedError` when the identifier was never paired to
|
|
493
|
+
* a profile.
|
|
494
|
+
*
|
|
495
|
+
* @returns The access token and canonical profile.
|
|
496
|
+
*/
|
|
497
|
+
async exchangeSocialAccessToken() {
|
|
498
|
+
const identifierType = this.#identifierTypeFromSeedlessState(this.messenger.call('SeedlessOnboardingController:getState'));
|
|
499
|
+
if (identifierType === 'SRP') {
|
|
500
|
+
throw new Error('exchangeSocialAccessToken - the wallet has no social login');
|
|
501
|
+
}
|
|
502
|
+
const socialJwt = await this.messenger.call('SeedlessOnboardingController:getAccessToken');
|
|
503
|
+
if (!socialJwt) {
|
|
504
|
+
throw new Error('exchangeSocialAccessToken - no social access token');
|
|
505
|
+
}
|
|
506
|
+
return await this.#auth.exchangeSocialAccessToken({
|
|
507
|
+
identifierType,
|
|
508
|
+
socialJwt,
|
|
509
|
+
});
|
|
510
|
+
}
|
|
476
511
|
#clearNeedsSocialPairing() {
|
|
477
512
|
if (this.state.needsSocialPairing !== false) {
|
|
478
513
|
this.update((state) => {
|
|
@@ -675,7 +710,8 @@ export class AuthenticationController extends BaseController {
|
|
|
675
710
|
return credentials;
|
|
676
711
|
}
|
|
677
712
|
/**
|
|
678
|
-
* Begins enrollment of a passkey
|
|
713
|
+
* Begins enrollment of a passkey, email OTP or authenticator app (TOTP)
|
|
714
|
+
* credential.
|
|
679
715
|
*
|
|
680
716
|
* @param request - Credential, optional email address, and trace reason.
|
|
681
717
|
* @returns A challenge for the client-owned ceremony.
|
|
@@ -698,11 +734,17 @@ export class AuthenticationController extends BaseController {
|
|
|
698
734
|
accessToken,
|
|
699
735
|
}));
|
|
700
736
|
this.#assertAuthSessionEpoch(sessionEpoch, 'beginCredentialEnrollment');
|
|
737
|
+
if (accessToken) {
|
|
738
|
+
this.#enrollmentAccessTokens.set(challenge.flowId, accessToken);
|
|
739
|
+
}
|
|
701
740
|
return challenge;
|
|
702
741
|
}
|
|
703
742
|
/**
|
|
704
743
|
* Completes credential enrollment and refreshes the credential cache.
|
|
705
744
|
*
|
|
745
|
+
* It is sent with the verification token that began the enrollment, if
|
|
746
|
+
* any: once a factor is enrolled, the server requires AAL2 for both steps.
|
|
747
|
+
*
|
|
706
748
|
* The server returns an assertion for the new credential, which opens a
|
|
707
749
|
* verification session like `completeCredentialVerification`, replacing
|
|
708
750
|
* any earlier one. If that exchange fails, the earlier session is kept:
|
|
@@ -726,7 +768,10 @@ export class AuthenticationController extends BaseController {
|
|
|
726
768
|
const { type } = request.proof;
|
|
727
769
|
const { operation } = request.reason;
|
|
728
770
|
const primaryEntropySourceId = this.#getPrimaryEntropySourceId();
|
|
729
|
-
const assertion = await this.#runMfaRequest('MFA Enroll Complete', operation, type, async () => await this.#auth.completeMfaEnrollment(request.flowId, request.proof, primaryEntropySourceId));
|
|
771
|
+
const assertion = await this.#runMfaRequest('MFA Enroll Complete', operation, type, async () => await this.#auth.completeMfaEnrollment(request.flowId, request.proof, primaryEntropySourceId, this.#enrollmentAccessTokens.get(request.flowId)));
|
|
772
|
+
// Only after success: a failed attempt can be retried on this flow, and
|
|
773
|
+
// needs the same token.
|
|
774
|
+
this.#enrollmentAccessTokens.delete(request.flowId);
|
|
730
775
|
try {
|
|
731
776
|
await this.#openVerificationSessionFromAssertion(assertion, {
|
|
732
777
|
operation,
|
|
@@ -898,13 +943,15 @@ export class AuthenticationController extends BaseController {
|
|
|
898
943
|
}
|
|
899
944
|
}
|
|
900
945
|
/**
|
|
901
|
-
* Clears every in-memory verification session and its expiration timer
|
|
946
|
+
* Clears every in-memory verification session and its expiration timer,
|
|
947
|
+
* and the tokens kept for enrollments in progress.
|
|
902
948
|
*/
|
|
903
949
|
clearVerificationSession() {
|
|
904
950
|
for (const { timer } of this.#verificationSessions.values()) {
|
|
905
951
|
clearTimeout(timer);
|
|
906
952
|
}
|
|
907
953
|
this.#verificationSessions.clear();
|
|
954
|
+
this.#enrollmentAccessTokens.clear();
|
|
908
955
|
}
|
|
909
956
|
/**
|
|
910
957
|
* Drops the cached credential list. Callers that wipe profile state must go
|