refactor(seedless-onboarding-controller): keep accessToken out of the vault - #9890
Draft
matthiasgeihs wants to merge 2 commits into
Draft
refactor(seedless-onboarding-controller): keep accessToken out of the vault#9890matthiasgeihs wants to merge 2 commits into
matthiasgeihs wants to merge 2 commits into
Conversation
… vault Cache the short-lived JWT in memory and refresh it from refreshToken when missing or near expiry, including while locked. Revoke the previous refresh pair immediately after a successful rotation instead of waiting on the client. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
accessTokenJWT in the seedless vault. The vault now holds TOPRF keys andrevokeTokenonly;accessTokenstays in memory and is refreshed fromrefreshTokenwhen missing or near expiry, including while locked.rotateRefreshTokenrevokes the previous refresh pair immediately after a successful vault write, and only queues it inpendingToBeRevokedTokensif revocation fails.getIsUserAuthenticatedno longer requiresaccessTokenin state (social-auth details +revokeTokenare enough for vault creation).Test plan
yarn workspace @metamask/seedless-onboarding-controller run testgetAccessTokenstill works while locked and after a process restart (missing token triggers refresh)accessTokenaccessTokencontinue to unlock (legacy extra field is ignored)Made with Cursor