Skip to content

Feat/seedless onboarding controller #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 75 commits into
base: main
Choose a base branch
from

Conversation

lwin-kyaw
Copy link

@lwin-kyaw lwin-kyaw commented May 6, 2025

Explanation

Adds new seedless onboarding controller. This controller allows MM extension and mobile users to login with google, apple accounts. This controller communicates with web3auth nodes + relies on toprf sdk (unreleased) to perform CRU operations related to backing up srps.

The full list of operations supported are as follows:

  • Authenticate OAuth user using the seedless onboarding flow and determine if the user is already registered or not
  • Create a new Toprf key and backup seed phrase
  • Add a new seed phrase backup to the metadata store
  • Add array of new seed phrase backups to the metadata store in batch (useful in multi-srp flow)
  • Fetch seed phrase metadata from the metadata store
  • Update the password of the seedless onboarding flow

The controller also persists some data to the local encrypted vault similar to keyring controller. This vault is encrypted with user password and contains ek, sk related to toprf flow.
We also store backupHashes locally to showcase in settings page whether a srp is backed up or not

The following items are not included in this PR and will be included in the next one

  • what to do when nodeAuthTokens are expired? - expires based on login timeout - adding support for refresh tokens
  • what to do when toprfEncryptionKey, toprfAuthKeyPair expire? - expires when user changes password - solved by password syncing
  • support password syncing when available (currently under design)

References

Please refer to seedless onboarding feature narrative

Changelog

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've communicated my changes to consumers by updating changelogs for packages I've changed, highlighting breaking changes as necessary
  • I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes

lwin-kyaw and others added 30 commits April 10, 2025 12:40
…Mask/core into feat/seedless-onboarding-controller
lwin-kyaw and others added 26 commits April 20, 2025 18:55
…ler' into feat/seedless-onboarding-controller
Sync with upstream `feat/seedless-onboarding-controller` branch
Copy link
Member

@chaitanyapotti chaitanyapotti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Copy link
Member

@chaitanyapotti chaitanyapotti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/MetaMask/toprf-secure-backup/issues/106
Need to wait until this issue is resolved.

@lwin-kyaw lwin-kyaw marked this pull request as ready for review May 19, 2025 04:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants