-
Notifications
You must be signed in to change notification settings - Fork 645
feat: Add middleware to validate wallet_snap permission request
#3838
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3838 +/- ##
=======================================
Coverage 98.47% 98.47%
=======================================
Files 429 430 +1
Lines 12421 12433 +12
Branches 1924 1929 +5
=======================================
+ Hits 12231 12243 +12
Misses 190 190 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| * | ||
| * @returns The middleware. | ||
| */ | ||
| export function createWalletSnapPermissionMiddleware(): JsonRpcMiddleware< |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can v2 middlewares be dropped in where we need them in clients as-is?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, there's a function to use it as legacy middleware.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We should probably make note to start converting our code to use v2
This adds middleware which validates
wallet_snappermission requests. It ensureswallet_snapis not requested together with other permissions.https://consensyssoftware.atlassian.net/browse/WPC-398
Note
Medium Risk
Adds new request-validation middleware for
wallet_requestPermissions, which can reject previously-accepted multi-permission requests that includewallet_snapand may impact dapp compatibility.Overview
Adds a new JSON-RPC middleware (
createWalletSnapPermissionMiddleware) that validateswallet_requestPermissionsand throwsinvalidParamswhenwallet_snapis requested together with any other permission.Exports the middleware via
src/middleware/index.ts, adds unit tests covering rejection/allow cases, and nudges Jest coverage thresholds to account for the new test file.Written by Cursor Bugbot for commit 8c88edc. This will update automatically on new commits. Configure here.