Feat/seedless refresh token

packages/seedless-onboarding-controller/CHANGELOG.md

@@ -16,6 +16,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - renamed `fetchAllSeedPhrases` method to `fetchAllSecretData` and updated the return value to `Record<SecretType, Uint8Array[]>`.
   - added new error message, `MissingKeyringId` which will throw if no `keyringId` is provided during seed phrase (Mnemonic) backup.
 
+### Changed
+
+- Refresh and revoke token handling ([#5917](https://github.com/MetaMask/core/pull/5917))
+  - **BREAKING:** `authenticate` need extra `refreshToken` and `revokeToken` params, persist refresh token in state and store revoke token temporarily for user in next step
+  - `createToprfKeyAndBackupSeedPhrase`, `fetchAllSecretData` store revoke token in vault
+  - check for token expired in toprf call, refresh token and retry if expired
+  - `submitPassword` revoke refresh token and replace with new one after password submit to prevent malicious use if refresh token leak in persisted state
+
 ## [1.0.0]
 
 ### Added