fix: access token not persisted after token refresh#40013
fix: access token not persisted after token refresh#40013chaitanyapotti merged 9 commits intomainfrom
Conversation
|
CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes. |
✨ Files requiring CODEOWNER review ✨🔐 @MetaMask/web3auth (1 files, +1 -4)
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Builds ready [c66ef43]
UI Startup Metrics (1341 ± 90 ms)
📊 Page Load Benchmark ResultsCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
|
@metamaskbot update-policies |
|
Policies updated. 🧠 Learn how: https://lavamoat.github.io/guides/policy-diff/#what-to-look-for-when-reviewing-a-policy-diff 👀 lavamoat/browserify/beta/policy.json changes differ from main/policy.json policy changes |
…into fix/access-token-not-persisted
Builds ready [14b32a8]
UI Startup Metrics (1378 ± 107 ms)
📊 Page Load Benchmark ResultsCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
Builds ready [5db5ced]
UI Startup Metrics (1407 ± 105 ms)
📊 Page Load Benchmark ResultsCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
Description
This PR fixes the
accessTokennot being persisted across lock/unlock cycles issue in the seedless onboarding flow and upgrades@metamask/seedless-onboarding-controllerfrom v7.1.0 to v8.0.0.Problem:
Previously, the
OAuthServicewas reading theaccessTokendirectly fromSeedlessOnboardingControllerstate viaSeedlessOnboardingController:getState. The access token was not persisted in the controller state, causing it to be lost after a lock/unlock cycle. Additionally, when the token expired, there was no mechanism to automatically refresh it before making API calls (e.g., marketing opt-in).Solution:
@metamask/seedless-onboarding-controllerv8.0.0 which exposes a newSeedlessOnboardingController:getAccessTokenaction that handles token retrieval and automatic refresh when expired.SeedlessOnboardingController:getState→accessToken) with the newSeedlessOnboardingController:getAccessTokenaction inOAuthService.BaseLoginHandlerby introducingcreateErrorFromNetworkRequestutility to provide more descriptive error messages (including status codes and response body) for token-related network failures (auth token, refresh, revoke, renew).OAuthErrorMessagesenum entries for granular error categorization.NO_AUTH_CODE_FOUND_ERRORenum value and updated the welcome page error handling accordingly.Changelog
CHANGELOG entry: Fixed access token not persisting across lock/unlock cycles for seedless onboarding users
Related issues
Fixes: #39566
Relates to: #40011
Manual testing steps
yarn start)Screenshots/Recordings
Before
After
Pre-merge author checklist
Pre-merge reviewer checklist
Note
Medium Risk
Touches seedless onboarding OAuth token retrieval/refresh paths and bumps a core controller dependency, which could affect authentication and downstream API calls if integration mismatches. Changes are mitigated by added unit/E2E coverage around failure cases and lock/unlock refresh flows.
Overview
Fixes seedless onboarding marketing-consent calls failing after lock/unlock by switching
OAuthServiceto fetch tokens via the newSeedlessOnboardingController:getAccessTokenaction (delegated through the OAuth service messenger/types) instead of readingaccessTokenfrom controller state.Improves OAuth/Auth-server failure visibility by adding
createErrorFromNetworkRequestand expandingOAuthErrorMessages, then wiring these intoBaseLoginHandler(token/refresh/revoke/renew) and updating unit tests accordingly; also removes the unusedNO_AUTH_CODE_FOUND_ERRORhandling in the onboarding welcome UI.Upgrades
@metamask/seedless-onboarding-controllerto^8.0.0and adds/updates E2E mocking + a new E2E spec to validate token refresh behavior and access-token validity across lock/unlock cycles.Written by Cursor Bugbot for commit 5db5ced. This will update automatically on new commits. Configure here.