Skip to content

Conversation

@FrederikBolding
Copy link
Member

@FrederikBolding FrederikBolding commented Jan 29, 2026

Several endowments had half-baked support for maxRequestTime that would then fail their getters or had validation setup but didn't allow the caveat at the permission level. This PR standardizes and allows the caveat everywhere as intended.


Note

Medium Risk
Touches snap permission specifications and caveat getters, which can affect runtime permission validation and how endowment requests are interpreted. Changes are straightforward but broad across multiple endowments and tests.

Overview
Standardizes endowment caveat support for maxRequestTime. Updates multiple endowment permission specs (assets, cronjob, signature-insight, plus previously caveat-less page-home, page-settings, and lifecycle-hooks) to explicitly allow maxRequestTime and wire up a generic validator where missing.

Fixes caveat getters to handle multiple caveats. getCronjobCaveatJobs, getRpcCaveatOrigins, getKeyringCaveatOrigins, getSignatureOriginCaveat, and getTransactionOriginCaveat now search for the relevant caveat type instead of asserting there is exactly one caveat, with tests updated accordingly.

Updates inline snapshots in permissions and snaps-simulation to reflect the new allowed caveats/validators, and tweaks Jest coverage thresholds.

Written by Cursor Bugbot for commit 5fb24d5. This will update automatically on new commits. Configure here.

@FrederikBolding FrederikBolding requested a review from a team as a code owner January 29, 2026 14:36
Comment on lines 99 to 101
@@ -100,12 +100,11 @@ export function getCronjobCaveatJobs(
return null;
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wondering if this check (or assertion in some other endowments) is still necessary. We can maybe just rewrite to permission?.caveats?.find?.(...), right?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, good point!

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For assertions, I've kept those around when the caveat is required.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, but we assert after permission.caveats.find() in those cases as well.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, yes, we can dedupe

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@codecov
Copy link

codecov bot commented Jan 29, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.40%. Comparing base (413290c) to head (5fb24d5).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #3826   +/-   ##
=======================================
  Coverage   98.39%   98.40%           
=======================================
  Files         430      430           
  Lines       12454    12448    -6     
  Branches     1936     1933    -3     
=======================================
- Hits        12254    12249    -5     
+ Misses        200      199    -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@FrederikBolding FrederikBolding added this pull request to the merge queue Jan 29, 2026
Merged via the queue into main with commit 5ab30ee Jan 29, 2026
128 checks passed
@FrederikBolding FrederikBolding deleted the fb/cleanup-endowments branch January 29, 2026 14:57
Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants