Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@tuna1207
Copy link
Member

Explanation

Add refresh token and revoke refresh token handling to SeedlessOnboardingController

  • persist refresh token in state
  • store revoke token in vault
  • check for token expired in toprf call, refresh token and retry
  • revoke refresh token and replace with new one after password submit

References

Changelog

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've communicated my changes to consumers by updating changelogs for packages I've changed, highlighting breaking changes as necessary
  • I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes

lwin-kyaw and others added 30 commits April 10, 2025 12:40
…Mask/core into feat/seedless-onboarding-controller
@tuna1207 tuna1207 changed the base branch from feat/toprf-sdk-update to main June 2, 2025 06:32
Copy link
Member

@himanshuchawla009 himanshuchawla009 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Skip lock usage comment should improved
  • Incorrect comment on skip lock, currently it mentions about aggregate verifier.
  • rename doAuthenticate to doAuthenticateWithNodes
  • Incorrect jsdocs for passwordd field on createToprfKeyAndBackupSeedPhrase function
  • refreshToken error is incorrect in assertIsAuthenticatedUser
  • assertIsAuthenticatedUser doesn’t check for expiry of node auth tokens.
  • I think we should refresh tokens proactively meaning we should first check if node auth tokens are expired on client side thn thn refresh instead of just relying on 401 from server, 401 should be the fallback
  • assertIsAuthenticatedUser should be moved inside withControllerLock callback so that it can prevent doing multiple refresh tokens when token expires parallely for more thn 1 call.

* The refresh token used to refresh expired nodeAuthTokens.
* This is temporarily stored in state during authentication and then persisted in the vault.
*/
refreshToken?: string;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i think we can't persist refresh token in the vault as it can be used even before wallet is unlocked, only revokeToken should be in vault

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@himanshuchawla009 oh this one is in state, not the vault
the vault data type is in

/**
 * The structure of the data which is serialized and stored in the vault.
 */
export type VaultData = {

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah need to fix the code comment, comment says its persisted in vault

Copy link
Member

@himanshuchawla009 himanshuchawla009 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants