feat(profile-sync): add MFA credential enrollment

README.md

@@ -619,6 +619,7 @@ linkStyle default opacity:0.5
   profile_metrics_controller --> utils;
   profile_sync_controller --> address_book_controller;
   profile_sync_controller --> base_controller;
+  profile_sync_controller --> controller_utils;
   profile_sync_controller --> keyring_controller;
   profile_sync_controller --> messenger;
   profile_sync_controller --> seedless_onboarding_controller;

eslint-suppressions.json

@@ -1412,11 +1412,6 @@
       "count": 1
     }
   },
-  "packages/profile-sync-controller/src/controllers/authentication/__fixtures__/mockServices.ts": {
-    "@typescript-eslint/explicit-function-return-type": {
-      "count": 3
-    }
-  },
   "packages/profile-sync-controller/src/controllers/authentication/mocks/mockResponses.ts": {
     "@typescript-eslint/naming-convention": {
       "count": 1

packages/profile-sync-controller/CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Add `refreshEnrolledCredentials`, `beginCredentialEnrollment` and `completeCredentialEnrollment` to `AuthenticationController`, backed by a memory-only `enrolledCredentials` state and an optional `trace` callback ([#10266](https://github.com/MetaMask/core/pull/10266))
 - Add passkey and email OTP enrollment, verification, credential-list, and elevated-token exchange SDK methods ([#10265](https://github.com/MetaMask/core/pull/10265))
 - Add validated MFA domain types and structured `MfaError` classes with a serialization-safe `mfaCode` ([#10264](https://github.com/MetaMask/core/pull/10264))
 - Add `rampsOrders` to `USER_STORAGE_FEATURE_NAMES` ([#10227](https://github.com/MetaMask/core/pull/10227))

packages/profile-sync-controller/package.json

@@ -75,6 +75,7 @@
   "dependencies": {
     "@metamask/address-book-controller": "^8.0.0",
     "@metamask/base-controller": "^10.0.0",
+    "@metamask/controller-utils": "^13.0.0",
     "@metamask/key-tree": "^10.1.1",
     "@metamask/keyring-controller": "^28.0.0",
     "@metamask/messenger": "^3.0.0",

packages/profile-sync-controller/src/controllers/authentication/AuthenticationController-method-action-types.ts

@@ -20,6 +20,46 @@ export type AuthenticationControllerRequestProfilePairingAction = {
   handler: AuthenticationController['requestProfilePairing'];
 };
 
+/**
+ * Refreshes credentials enrolled on the canonical profile.
+ *
+ * @returns The current supported credentials.
+ */
+export type AuthenticationControllerRefreshEnrolledCredentialsAction = {
+  type: `AuthenticationController:refreshEnrolledCredentials`;
+  handler: AuthenticationController['refreshEnrolledCredentials'];
+};
+
+/**
+ * Begins enrollment of a passkey or email OTP credential.
+ *
+ * @param request - Credential, optional email address, and trace reason.
+ * @returns A challenge for the client-owned ceremony.
+ */
+export type AuthenticationControllerBeginCredentialEnrollmentAction = {
+  type: `AuthenticationController:beginCredentialEnrollment`;
+  handler: AuthenticationController['beginCredentialEnrollment'];
+};
+
+/**
+ * Completes credential enrollment and refreshes the credential cache.
+ *
+ * A cache-refresh failure does not undo successful enrollment. Email
+ * enrollment invalidates the primary SRP session *after* refresh so the
+ * credentials call can reuse the still-valid access token; the next token
+ * fetch then includes the newly verified email claim. That invalidation
+ * happens even if the session ends mid-request: the enrollment succeeded
+ * on the server, so a token cached across a lock must not be reused
+ * without the new claim.
+ *
+ * @param request - Flow identifier, platform or email proof, and trace reason.
+ * @returns The refreshed credentials, or the existing cache if refresh fails.
+ */
+export type AuthenticationControllerCompleteCredentialEnrollmentAction = {
+  type: `AuthenticationController:completeCredentialEnrollment`;
+  handler: AuthenticationController['completeCredentialEnrollment'];
+};
+
 export type AuthenticationControllerPerformSignOutAction = {
   type: `AuthenticationController:performSignOut`;
   handler: AuthenticationController['performSignOut'];
@@ -139,6 +179,9 @@ export type AuthenticationControllerIsSignedInAction = {
 export type AuthenticationControllerMethodActions =
   | AuthenticationControllerPerformSignInAction
   | AuthenticationControllerRequestProfilePairingAction
+  | AuthenticationControllerRefreshEnrolledCredentialsAction
+  | AuthenticationControllerBeginCredentialEnrollmentAction
+  | AuthenticationControllerCompleteCredentialEnrollmentAction
   | AuthenticationControllerPerformSignOutAction
   | AuthenticationControllerClearStateAction
   | AuthenticationControllerGetBearerTokenAction