feat: shield controller wire in wallet package

.github/CODEOWNERS

@@ -155,6 +155,7 @@
 /packages/wallet/src/initialization/instances/passkey-controller/                @MetaMask/web3auth
 /packages/wallet/src/initialization/instances/remote-feature-flag-controller/    @MetaMask/extension-platform @MetaMask/mobile-platform @MetaMask/core-platform
 /packages/wallet/src/initialization/instances/seedless-onboarding-controller/    @MetaMask/web3auth
+/packages/wallet/src/initialization/instances/shield-controller/                 @MetaMask/web3auth
 /packages/wallet/src/initialization/instances/storage-service/                   @MetaMask/extension-platform @MetaMask/mobile-platform @MetaMask/core-platform
 /packages/wallet/src/initialization/instances/transaction-controller/            @MetaMask/confirmations
 

README.md

@@ -656,6 +656,8 @@ linkStyle default opacity:0.5
   wallet --> passkey_controller;
   wallet --> remote_feature_flag_controller;
   wallet --> seedless_onboarding_controller;
+  wallet --> shield_controller;
+  wallet --> signature_controller;
   wallet --> storage_service;
   wallet --> transaction_controller;
   wallet_cli --> base_controller;

codeowners.ts

@@ -310,6 +310,7 @@ const PACKAGES: Record<string, PackageInfo> = {
   },
   'shield-controller': {
     teams: ['@MetaMask/web3auth'],
+    initializationPath: 'shield-controller',
   },
   'signature-controller': {
     teams: ['@MetaMask/confirmations'],

packages/shield-controller/src/backend.test.ts

@@ -50,7 +50,7 @@ function setup({
     getCoverageResultTimeout,
     getCoverageResultPollInterval,
     fetch,
-    baseUrl: 'https://rule-engine.metamask.io',
+    baseUrl: 'https://ruleset-engine.api.cx.metamask.io',
     captureException: mockCaptureException,
   });
 

packages/wallet-cli/CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Wire the `shieldController` slot in the daemon wallet's instance options with the production rule-engine base URL and `fetch`, so the daemon constructs `ShieldController` with explicit host configuration rather than relying on implicit defaults ([#9616](https://github.com/MetaMask/core/pull/9616))
 - Wire the `transactionController` slot in the daemon wallet's instance options, so the daemon runs the `TransactionController` with an explicit CLI-appropriate configuration (swaps processing disabled, no client hooks) rather than relying on the controller's implicit defaults ([#9509](https://github.com/MetaMask/core/pull/9509))
 - Wire the `gasFeeController` slot in the daemon wallet's instance options, passing `clientId: 'cli'` so the CLI identifies itself to the gas estimation API, now that `@metamask/wallet` requires this option ([#9527](https://github.com/MetaMask/core/pull/9527))
 - Add the `mm wallet unlock` command, which dispatches `KeyringController:submitPassword` over the daemon socket, allowing the keyring to be unlocked after a daemon start with no password or after a `mm daemon call KeyringController:setLocked` ([#8821](https://github.com/MetaMask/core/pull/8821))

packages/wallet-cli/src/daemon/wallet-factory.test.ts

@@ -121,6 +121,12 @@ describe('createWallet', () => {
     );
     expect(instanceOptions.transactionController?.disableSwaps).toBe(true);
     expect(instanceOptions.transactionController?.hooks).toStrictEqual({});
+    expect(instanceOptions.shieldController.baseUrl).toBe(
+      'https://ruleset-engine.api.cx.metamask.io',
+    );
+    expect(instanceOptions.shieldController.fetchFunction).toBe(
+      globalThis.fetch,
+    );
     expect(ClientConfigApiService).toHaveBeenCalled();
 
     await dispose();

packages/wallet-cli/src/daemon/wallet-factory.ts

@@ -65,6 +65,9 @@ export type CreateWalletResult = {
  * - `transactionController` — swaps processing disabled and no client hooks;
  *   see the slot's inline comment for why the daemon relies on the
  *   controller's defaults for everything else.
+ * - `shieldController` — production rule-engine base URL and `fetch`; the daemon
+ *   does not register `AuthenticationController` or `SignatureController`, so
+ *   hosts must call `ShieldController:start` only after wiring those peers.
  *
  * The optional `keyringController` slot is intentionally omitted so the
  * controller's built-in defaults (e.g. the PBKDF2 encryptor) apply.
@@ -121,6 +124,10 @@ function buildInstanceOptions(
       // the controller's default.
       hooks: {},
     },
+    shieldController: {
+      baseUrl: 'https://ruleset-engine.api.cx.metamask.io',
+      fetchFunction: globalThis.fetch,
+    },
   };
 }
 

packages/wallet/CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **BREAKING:** Wire `ShieldController` into the default wallet initialization ([#9616](https://github.com/MetaMask/core/pull/9616))
+  - Adds required `shieldController` slot to `instanceOptions` with `baseUrl` and `fetchFunction` (or an injected `backend` override)
+  - Default backend construction uses `ShieldRemoteBackend` with optional `getAccessToken`, `captureException`, polling, history limits, and `normalizeSignatureRequest`
+  - Delegates `AuthenticationController:getBearerToken` plus `TransactionController:stateChange` and `SignatureController:stateChange` on the shared messenger bus
+  - Hosts must register `AuthenticationController` and `SignatureController` on the wallet root messenger and explicitly call `ShieldController:start` after wiring
+
 ## [8.0.0]
 
 ### Added

packages/wallet/package.json

@@ -70,6 +70,8 @@
     "@metamask/remote-feature-flag-controller": "^4.2.2",
     "@metamask/scure-bip39": "^2.1.1",
     "@metamask/seedless-onboarding-controller": "^10.1.0",
+    "@metamask/shield-controller": "^5.1.3",
+    "@metamask/signature-controller": "^39.2.7",
     "@metamask/storage-service": "^1.0.2",
     "@metamask/transaction-controller": "^69.2.1",
     "@metamask/utils": "^11.11.0"

packages/wallet/src/Wallet.test.ts

@@ -1,13 +1,18 @@
 import { getDefaultAddressBookControllerState } from '@metamask/address-book-controller';
 import { CONNECTIVITY_STATUSES } from '@metamask/connectivity-controller';
 import { Messenger } from '@metamask/messenger';
+import {
+  getDefaultShieldControllerState,
+  ShieldController,
+} from '@metamask/shield-controller';
 import { InMemoryStorageAdapter } from '@metamask/storage-service';
 import { Json } from '@metamask/utils';
 import { webcrypto } from 'crypto';
 
 import MockEncryptor from '../../keyring-controller/tests/mocks/mockEncryptor.js';
 import * as initializationModule from './initialization/initialization.js';
 import { AlwaysOnlineAdapter } from './initialization/instances/connectivity-controller/always-online-adapter.js';
+import type { WalletOptions } from './types.js';
 import { importSecretRecoveryPhrase } from './utilities.js';
 import { Wallet } from './Wallet.js';
 
@@ -23,23 +28,39 @@ const REMOTE_FEATURE_FLAG_OPTIONS = {
   },
 };
 
+const SHIELD_CONTROLLER_OPTIONS = {
+  baseUrl: 'https://ruleset-engine.api.cx.metamask.io',
+  fetchFunction: jest.fn(),
+  backend: {
+    checkCoverage: jest.fn(),
+    checkSignatureCoverage: jest.fn(),
+    logSignature: jest.fn(),
+    logTransaction: jest.fn(),
+  },
+};
+
+function getInstanceOptions(): WalletOptions['instanceOptions'] {
+  return {
+    connectivityController: {
+      connectivityAdapter: new AlwaysOnlineAdapter(),
+    },
+    gasFeeController: {
+      clientId: 'test',
+    },
+    networkController: {
+      infuraProjectId: 'fake-infura-project-id',
+    },
+    storageService: {
+      storage: new InMemoryStorageAdapter(),
+    },
+    remoteFeatureFlagController: REMOTE_FEATURE_FLAG_OPTIONS,
+    shieldController: SHIELD_CONTROLLER_OPTIONS,
+  };
+}
+
 async function setupWallet(): Promise<Wallet> {
   const wallet = new Wallet({
-    instanceOptions: {
-      connectivityController: {
-        connectivityAdapter: new AlwaysOnlineAdapter(),
-      },
-      gasFeeController: {
-        clientId: 'test',
-      },
-      networkController: {
-        infuraProjectId: 'fake-infura-project-id',
-      },
-      storageService: {
-        storage: new InMemoryStorageAdapter(),
-      },
-      remoteFeatureFlagController: REMOTE_FEATURE_FLAG_OPTIONS,
-    },
+    instanceOptions: getInstanceOptions(),
   });
 
   await importSecretRecoveryPhrase(wallet, TEST_PASSWORD, TEST_SRP);
@@ -89,22 +110,10 @@ describe('Wallet', () => {
   it('supports passing instance options', async () => {
     const wallet = new Wallet({
       instanceOptions: {
-        connectivityController: {
-          connectivityAdapter: new AlwaysOnlineAdapter(),
-        },
-        gasFeeController: {
-          clientId: 'test',
-        },
+        ...getInstanceOptions(),
         keyringController: {
           encryptor: new MockEncryptor(),
         },
-        networkController: {
-          infuraProjectId: 'fake-infura-project-id',
-        },
-        storageService: {
-          storage: new InMemoryStorageAdapter(),
-        },
-        remoteFeatureFlagController: REMOTE_FEATURE_FLAG_OPTIONS,
       },
     });
 
@@ -143,21 +152,7 @@ describe('Wallet', () => {
           init: (): DummyService => new DummyService(),
         },
       ],
-      instanceOptions: {
-        connectivityController: {
-          connectivityAdapter: new AlwaysOnlineAdapter(),
-        },
-        gasFeeController: {
-          clientId: 'test',
-        },
-        networkController: {
-          infuraProjectId: 'fake-infura-project-id',
-        },
-        storageService: {
-          storage: new InMemoryStorageAdapter(),
-        },
-        remoteFeatureFlagController: REMOTE_FEATURE_FLAG_OPTIONS,
-      },
+      instanceOptions: getInstanceOptions(),
     });
     const { state } = wallet;
 
@@ -189,21 +184,7 @@ describe('Wallet', () => {
     });
 
     const wallet = new Wallet({
-      instanceOptions: {
-        connectivityController: {
-          connectivityAdapter: new AlwaysOnlineAdapter(),
-        },
-        gasFeeController: {
-          clientId: 'test',
-        },
-        networkController: {
-          infuraProjectId: 'fake-infura-project-id',
-        },
-        storageService: {
-          storage: new InMemoryStorageAdapter(),
-        },
-        remoteFeatureFlagController: REMOTE_FEATURE_FLAG_OPTIONS,
-      },
+      instanceOptions: getInstanceOptions(),
     });
 
     expect(wallet.controllerMetadata).toStrictEqual({
@@ -302,21 +283,7 @@ describe('Wallet', () => {
             addressBook: { '0x1': { [ADDRESS]: entry } },
           },
         },
-        instanceOptions: {
-          connectivityController: {
-            connectivityAdapter: new AlwaysOnlineAdapter(),
-          },
-          gasFeeController: {
-            clientId: 'test',
-          },
-          networkController: {
-            infuraProjectId: 'fake-infura-project-id',
-          },
-          storageService: {
-            storage: new InMemoryStorageAdapter(),
-          },
-          remoteFeatureFlagController: REMOTE_FEATURE_FLAG_OPTIONS,
-        },
+        instanceOptions: getInstanceOptions(),
       });
 
       expect(
@@ -337,21 +304,7 @@ describe('Wallet', () => {
   describe('ConnectivityController', () => {
     it('reports online connectivity status', () => {
       const wallet = new Wallet({
-        instanceOptions: {
-          connectivityController: {
-            connectivityAdapter: new AlwaysOnlineAdapter(),
-          },
-          gasFeeController: {
-            clientId: 'test',
-          },
-          networkController: {
-            infuraProjectId: 'fake-infura-project-id',
-          },
-          storageService: {
-            storage: new InMemoryStorageAdapter(),
-          },
-          remoteFeatureFlagController: REMOTE_FEATURE_FLAG_OPTIONS,
-        },
+        instanceOptions: getInstanceOptions(),
       });
 
       expect(wallet.state.ConnectivityController.connectivityStatus).toBe(
@@ -380,21 +333,7 @@ describe('Wallet', () => {
             vault,
           },
         },
-        instanceOptions: {
-          connectivityController: {
-            connectivityAdapter: new AlwaysOnlineAdapter(),
-          },
-          gasFeeController: {
-            clientId: 'test',
-          },
-          networkController: {
-            infuraProjectId: 'fake-infura-project-id',
-          },
-          storageService: {
-            storage: new InMemoryStorageAdapter(),
-          },
-          remoteFeatureFlagController: REMOTE_FEATURE_FLAG_OPTIONS,
-        },
+        instanceOptions: getInstanceOptions(),
       });
 
       await wallet.messenger.call(
@@ -454,6 +393,19 @@ describe('Wallet', () => {
     });
   });
 
+  describe('ShieldController', () => {
+    it('is wired and exposes its state on the wallet messenger', async () => {
+      const wallet = await setupWallet();
+
+      expect(wallet.getInstance('ShieldController')).toBeInstanceOf(
+        ShieldController,
+      );
+      expect(wallet.messenger.call('ShieldController:getState')).toStrictEqual(
+        getDefaultShieldControllerState(),
+      );
+    });
+  });
+
   describe('RemoteFeatureFlagController', () => {
     it('is wired and exposes its state on the wallet messenger', async () => {
       const wallet = await setupWallet();
@@ -472,17 +424,8 @@ describe('Wallet', () => {
     it('routes injected instanceOptions through to the controller', async () => {
       const wallet = new Wallet({
         instanceOptions: {
-          connectivityController: {
-            connectivityAdapter: new AlwaysOnlineAdapter(),
-          },
-          gasFeeController: {
-            clientId: 'test',
-          },
-          networkController: {
-            infuraProjectId: 'fake-infura-project-id',
-          },
+          ...getInstanceOptions(),
           keyringController: { encryptor: new MockEncryptor() },
-          storageService: { storage: new InMemoryStorageAdapter() },
           remoteFeatureFlagController: {
             clientConfigApiService: {
               fetchRemoteFeatureFlags: async (): Promise<{

packages/wallet/src/initialization/instances/index.ts

@@ -8,5 +8,6 @@ export { networkController } from './network-controller/network-controller.js';
 export { passkeyController } from './passkey-controller/passkey-controller.js';
 export { remoteFeatureFlagController } from './remote-feature-flag-controller/remote-feature-flag-controller.js';
 export { seedlessOnboardingController } from './seedless-onboarding-controller/seedless-onboarding-controller.js';
+export { shieldController } from './shield-controller/shield-controller.js';
 export { storageService } from './storage-service/storage-service.js';
 export { transactionController } from './transaction-controller/transaction-controller.js';