feat: jwt auth accounts api + handle pending requests #7084
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
salimtb
changed the title
Contributor
Author
|
@metamaskbot publish-preview |
Contributor
|
Preview builds have been published. See these instructions for more information about preview builds. Expand for full list of packages and versions. |
Contributor
Author
|
@metamaskbot publish-preview |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
No dependency changes detected. Learn more about Socket for GitHub. 👍 No dependency changes detected in pull request |
Contributor
Author
|
@metamaskbot publish-preview |
Contributor
|
Preview builds have been published. See these instructions for more information about preview builds. Expand for full list of packages and versions. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Explanation
What is the current state and why does it need to change?
Currently, the multi-chain accounts API calls in
TokenDetectionControllerandTokenBalancesControllerare made without authentication. This limits the ability to provide user-specific data and secure API endpoints that require authenticated requests. Additionally, there is no timeout protection for these API calls, which means a hanging request could block token detection indefinitely without falling back to RPC methods.What is the solution and how does it work?
This PR adds optional JWT token authentication and timeout protection to the accounts API calls:
API Layer Changes (
multi-chain-accounts.ts):jwtTokenparameter tofetchMultiChainBalancesandfetchMultiChainBalancesV4Authorization: Bearer <token>headerController Integration:
AuthenticationController:getBearerTokenand passes it tofetchMultiChainBalanceswhen detecting tokens via Accounts APIACCOUNTS_API_TIMEOUT_MS) usingPromise.race()to prevent hanging API callsfetchMultiChainBalancesV4Balance Fetcher Updates (
api-balance-fetcher.ts):AccountsApiBalanceFetcherto accept and pass JWT token through the fetch chainupdateBalances→fetch→#fetchBalances→ API callsTimeout Protection:
ACCOUNTS_API_TIMEOUT_MS = 30000constant (30 seconds)#attemptAccountAPIDetectionwith timeout logicPromise.race()between the API call and a timeout promise{ result: 'failed' }to trigger RPC fallbackKey Design Decisions
References
Checklist
TokenDetectionController.test.tsto verify JWT token is passed correctlyTokenDetectionController.test.tsto verify 30-second timeout triggers RPC fallbackTokenBalancesController.test.tsto verify JWT token flows through balance fetchermulti-chain-accounts.test.tsto verify Authorization header is set correctlyadvanceTimehelperfetchMultiChainBalancesandfetchMultiChainBalancesV4Note
Adds optional JWT authentication to Accounts API calls and 30s timeout + RPC fallback, and replaces single-call token balances with Multicall3; plumbs JWT through controllers with tests and deps updates.
fetchMultiChainBalances/fetchMultiChainBalancesV4accept optionaljwtToken; sent asAuthorization: Bearer <token>.TokenDetectionControllerandTokenBalancesControllerfetch JWT viaAuthenticationController:getBearerTokenand pass it through fetchers.TokenDetectionController: 30s timeout guard for Accounts API; on timeout/error, logs and falls back to RPC detection.AssetsContractController.getBalancesInSingleCallnow usesmulticall.getTokenBalancesForMultipleAddresses(Multicall3) for broad network support; returns non‑zero balances only.AccountsApiBalanceFetcher.@metamask/profile-sync-controlleras (dev/peer) dependency for auth token access.Written by Cursor Bugbot for commit 92708ad. This will update automatically on new commits. Configure here.