1
0
mirror of https://github.com/kremalicious/metamask-extension.git synced 2024-12-23 09:52:26 +01:00
Commit Graph

446 Commits

Author SHA1 Message Date
kumavis
07da8ce589
LavaMoat - UI upgrade - secure package naming (#14565)
* lavamoat - update lavamoat-browserify to v15

* lavamoat/ui - unify override across build types

* lavamoat/ui - update policy overrides

* lavamoat - update to lavapack@3 to match lavamoat-browserify@15

* lavamoat - add missing policy

* lavamoat - add missing nanoid policy

* lavamoat - regenerate policy

* deps - update lock

* lavamoat - update policy

* lavamoat - update policy
2022-05-05 12:47:51 -10:00
Mark Stacey
91fd8342dc
Reproducible .zip files (#14623)
* Create `.zip` files deterministically

Our build system now creates `.zip` archives deterministically.
Previously the `.zip` file would differ between builds even when the
files being archived were identical. This was because the order the
files were passed in was non-deterministic, and the `mtime` for each
file was different between builds.

The files are now sorted before being zipped, and the `mtime` for each
file has been set to the unix epoch.

* Update lavamoat build policy
2022-05-05 11:58:24 -02:30
PeterYinusa
4127583224
Jest tests - incremental coverage (#14612)
* add jest-it-up dependancy

* add reporter

* post test run jest-it-up

* Add CI check

* update coverage

* deduplicate dependancies
2022-05-04 17:02:42 +01:00
Erik Marks
6915dd1a57
Fix development build scripts (#14594)
#14583 broke the development build scripts (e.g. `yarn start`) by adding a positional argument to a package script (`build:dev`) that is used and passed positional arguments in the build script itself. This PR removes the positional argument from the `build:dev` script and `yarn start` now works again. In addition, the `--apply-lavamoat` flag is properly forwarded to child processes, which was not the case in the original implementation.

To test, `yarn start` should work and LavaMoat should _not_ be applied, in distinction to `yarn build:dev dev --apply-lavamoat=true`. Whether LavaMoat is applied can be determined by checking whether `Object.isFrozen(Object.prototype)` is `true` (with LavaMoat) or `false` (without LavaMoat).
2022-05-02 15:35:52 -07:00
Erik Marks
73a7ce9e39
Add applyLavaMoat build flag (#14583)
Adds a new flag, `--apply-lavamoat`, to the main build script. The flag controls whether LavaMoat is actually applied to the output of the build process. The flag defaults to `true`, but we explicitly set it to `false` in the `start` package script. Meanwhile, the `start:lavamoat` script is modified such that it applies LavaMoat to the build output in development mode, but it no longer runs the build process itself under LavaMoat as there aren't very compelling reasons to do so.

This change is motivated by the fact that development builds do not have their own dedicated LavaMoat policies, which causes development builds to fail since #14537. The downside of this change is that LavaMoat-related failures will not be detected when running `yarn start`. @kumavis has plans for fixing this problem in a future major version of the `@lavamoat` suite.
2022-04-29 15:56:30 -07:00
kumavis
66bd172980
Lavamoat - protect all UI contexts (#14537)
* lavamoat - apply lavamoat protections to popup and notification

* build - enable lavamoat for home

* lavamoat - add missing ui overrides for react family

* deps/patches - patch zxcvbn for ses compat
2022-04-28 08:45:46 -10:00
kumavis
223124a561
lavamoat@6 - update to secure package naming (#14488) 2022-04-26 07:36:57 -10:00
PeterYinusa
273c1dedb7
Docs - segment metrics (#14435)
* expand docs for metrics

* link to docs

* link to docs

* remove obsolete docs

* fix broken link
2022-04-19 16:15:41 +01:00
Dan J Miller
073a6e0613
Run main, flask and beta in sequence in generate-lavamoat-policies.sh (#14470) 2022-04-19 11:13:47 -02:30
Mark Stacey
2d08fe35e5
Restore version missing from certain build steps (#14344)
Certain build steps accidentally omitted the `version` variable. It has
now been restored to all steps, ensuring that all environment variables
are correctly injected into all bundles.

A check has been added to the Sentry setup module to ensure the release
is not omitted in the future.
2022-04-04 16:44:32 -02:30
kumavis
fd32d3eb2b
Update metamaskbot-build-announce.js (#14320)
* Update metamaskbot-build-announce.js

* Update metamaskbot-build-announce.js
2022-03-31 16:11:59 -10:00
Elliot Winkler
53006d4cf0
Add TypeScript to the build system (#13489)
This commit modifies the build system so that TypeScript files can be
transpiled into ES5 just like JavaScript files.

Note that this commit does NOT change the build system to run TypeScript
files through the TypeScript compiler. In other words, no files will be
type-checked at the build stage, as we expect type-checking to be
handled elsewhere (live, via your editor integration with `tsserver`,
and before a PR is merged, via `yarn lint`). Rather, we merely instruct
Babel to strip TypeScript-specific syntax from any files that have it,
as if those files had been written using JavaScript syntax alone.

Why take this approach? Because it prevents the build process from being
negatively impacted with respect to performance (as TypeScript takes a
significant amount of time to run).

It's worth noting the downside of this approach: because we aren't
running files through TypeScript, but relying on Babel's [TypeScript
transform][1] to identify TypeScript syntax, this transform has to keep
up with any syntax changes that TypeScript adds in the future. In fact
there are a few syntactical forms that Babel already does not recognize.
These forms are rare or are deprecated by TypeScript, so I don't
consider them to be a blocker, but it's worth noting just in case it
comes up later. Also, any settings we place in `tsconfig.json` will be
completely ignored by Babel. Again, this isn't a blocker because there
are some analogs for the most important settings reflected in the
options we can pass to the transform. These and other caveats are
detailed in the [documentation for the transform][2].

[1]: https://babeljs.io/docs/en/babel-plugin-transform-typescript
[2]: https://babeljs.io/docs/en/babel-plugin-transform-typescript#caveats
2022-03-28 16:33:40 -06:00
David Walsh
7f239997dc
Dark Mode: Remove feature flag (#14207) 2022-03-25 20:42:52 -05:00
Niranjana Binoy
90d6143071
Move Token Detection toggle to Advanced tab. (#13977) 2022-03-22 15:14:59 -04:00
Elliot Winkler
4447727eb6
Add TypeScript to the linting process (#13495)
This commit allows developers to write TypeScript files and lint them
(either via a language server in their editor of choice or through the
`yarn lint` command).

The new TypeScript configuration as well as the updated ESLint
configuration not only includes support for parsing TypeScript files,
but also provides some compatibility between JavaScript and TypeScript.
That is, it makes it possible for a TypeScript file that imports a
JavaScript file or a JavaScript file that imports a TypeScript file to
be linted.

Note that this commit does not integrate TypeScript into the build
system yet, so we cannot start converting files to TypeScript and
pushing them to the repo until that final step is complete.
2022-03-21 12:54:47 -06:00
PeterYinusa
c07e477c13
E2e metrics (#13904)
* remove metrics build

* remove segment server from tests

* enable cors

* mock segment globally

* metrics e2e test

* running test builds

* move file

* destructuring
2022-03-15 13:17:48 -03:00
Mark Stacey
6aaeab2f24
Automate the Flask release process (#13898)
* Automate the Flask release

A Flask release will now be published alongside each main extension
release. The version of each Flask release will be the same as the
extension version except it will have the suffix `-flask.0`.

* Programmatically remove build prefix

The create GH release Bash script derives the Flask version from the
Flask build filename by removing the build prefix, leaving just the
version. Rather than hard-coding the prefix size to remove, it is now
calculated programmatically so that it is easier to read and update.

* Fix tag publishing

The tab publishing step used the wrong credentials, and didn't properly
identify the commit author. This has now been fixed.
2022-03-15 08:54:37 -02:30
Mark Stacey
75a8aedc32
Derive version suffix from build type and version (#13895)
The version of a build is now derived from both the `version` field in
`package.json` and the requested build type and version. The build type
and version are added onto the manifest version as a suffix, according
to the SemVer prerelease format.

We already have support in the extension for versions of this format,
but to apply a Flask or Beta version required manual updates to
`package.json`. Now it can be done just with build arguments.

A `get-version` module was created to make it easier to generate the
version in the various places we do that during the build. It was
created in the `development/lib` directory because it will be used by
other non-build development scripts in a future PR.

The `BuildType` constant was extracted to its own module as well, and
moved to the `development/lib` directory. This was to make it clear
that it's used by various different development scripts, not just the
build.
2022-03-10 12:31:50 -03:30
PeterYinusa
d1c05195dd
E2e improve mocking (#13841)
* improve mocking

* improve mocking

* Unnecessary await
2022-03-07 19:23:04 +00:00
Niranjana Binoy
4bb3ba4aef
Adding new settings dropdown for Dark mode in Experimental tab (#13097) 2022-03-07 12:53:19 -06:00
Dan Finlay
1cb0a1bb87
Document Flask build flag (#13597)
* Document Flask build flag

Co-authored-by: Erik Marks <25517051+rekmarks@users.noreply.github.com>
2022-03-02 23:56:04 -08:00
Elliot Winkler
1e494f3004
Refactor ESLint config (#13482)
We would like to insert TypeScript into the ESLint configuration, and
because of the way that the current config is organized, that is not
easy to do.

Most files are assumed to be files that are suited for running in a
browser context. This isn't correct, as we should expect most files to
work in a Node context instead. This is because all browser-based files
will be run through a transpiler that is able to make use of
Node-specific variables anyway.

There are a couple of important ways we can categories files which our
ESLint config should be capable of handling well:

* Is the file a script or a module? In other words, does the file run
  procedurally or is the file intended to be brought into an existing
  file?
* If the file is a module, does it use the CommonJS syntax (`require()`)
  or does it use the ES syntax (`import`/`export`)?

When we introduce TypeScript, this set of questions will become:

* Is the file a script or a module?
* If the file is a module, is it a JavaScript module or a TypeScript
  module?
* If the file is a JavaScript module, does it use the CommonJS syntax
  (`require()`) or does it use the ES syntax (`import`/`export`)?

To represent these divisions, this commit removes global rules — so now
all of the rules are kept in `overrides` for explicitness — and sets up
rules for CommonJS- and ES-module-compatible files that intentionally do
not overlap with each other. This way TypeScript (which has its own set
of rules independent from JavaScript and therefore shouldn't overlap
with the other rules either) can be easily added later.

Finally, this commit splits up the ESLint config into separate files and
adds documentation to each section. This way sets of rules which are
connected to a particular plugin (`jsdoc`, `@babel`, etc.) can be easily
understood instead of being obscured.
2022-02-28 10:42:09 -07:00
PeterYinusa
30b2afe7bc
E2e phishing detection (#13704)
* phishing detection test

* remove unused arg
2022-02-22 16:48:12 +00:00
Elliot Winkler
b1b4e64ad0
Prevent Browserify error from being swallowed (#13647)
If an error occurs while running Browserify, the stream that Browserify
creates will emit an `error` event. However, this event is not being
handled, so Node will catch it instead. But the error message it
produces is very nebulous, as it merely spits out the stream object and
completely ignores the actual error that occurred. So this commit
listens for the `error` event and outputs the error.

One note here is that when we are outputting the error, we must get
around a bug that exists in Endo where if you pass an Error object to
`console.{log,error,info,debug}` then you will just see `{}` on-screen.
We get around this by printing `err.stack`.
2022-02-17 13:47:50 -07:00
PeterYinusa
ebeb2668ea
E2e mocking (#13640)
* mock gas price api

* fix error

* full url

* remove duplicated packages

* full url

* customise mock per test

* customise mock per test

* enable mocking

* enable mocking

* enable mocking by default

* duplicated packages

* update mockttp

* pass through

* pass through
2022-02-16 14:21:41 +00:00
Erik Marks
35ac762e10
Add Snaps via Flask (#13462)
This PR adds `snaps` under Flask build flags to the extension. This branch is mostly equivalent to the current production version of Flask, excepting some bug fixes and tweaks.

Closes #11626
2022-02-14 16:02:51 -08:00
Jyoti Puri
760ed3457d
Removing EIP_1559_V2 feature flag (#13481) 2022-02-03 05:58:28 +05:30
Jyoti Puri
9a3c917a48
Adding support for EIP-1559 in E2E tests (#13282) 2022-01-19 04:38:41 +05:30
Hassan Malik
ff27f24ef9
Flask devx fix (#13280)
* added fix for snaps devx issue

* reordered lines

* updated comment

* added test that ensures removeFencedCode detects a file with sourceMap inclusion

* fixed test

* Update development/build/transforms/remove-fenced-code.test.js

Co-authored-by: Erik Marks <25517051+rekmarks@users.noreply.github.com>
2022-01-12 12:37:29 -05:00
Mark Stacey
3732c5f71e
Add JSDoc ESLint rules (#12112)
ESLint rules have been added to enforce our JSDoc conventions. These
rules were introduced by updating `@metamask/eslint-config` to v9.

Some of the rules have been disabled because the effort to fix all lint
errors was too high. It might be easiest to enable these rules one
directory at a time, or one rule at a time.

Most of the changes in this PR were a result of running
`yarn lint:fix`. There were a handful of manual changes that seemed
obvious and simple to make. Anything beyond that and the rule was left
disabled.
2022-01-07 12:27:33 -03:30
Elliot Winkler
af971cd5b6
Remove dupe Prettier config from ESLint config (#13234)
The ESLint config for the extension explicitly includes support for
Prettier. However, this is already being provided by our global ESLint
config (`@metamask/eslint-config`). Therefore there is no need to
include it here. In fact, this is causing weird issues where the `curly`
option is getting overridden somehow. After this change, these syntaxes
are invalid:

``` javascript
if (foo) return;
```

``` javascript
if (foo) return 'bar';
```
2022-01-06 15:56:51 -07:00
Erik Marks
dbfdf3b0eb
Update Flask support links and home footer (#13226)
* Update support links for Flask

* Disable 'prefer-const' in code fence linting

* Add bespoke home footer for Flask and update logic

* fixup! Add bespoke home footer for Flask and update logic

* Fix code fence lint failure

* Fix support request link in account menu

* Fix unit test failure
2022-01-05 21:25:20 -03:30
Mark Stacey
8866c39623
Update the Firefox prerelease version format (#13158)
The Firefox extension version format does not support the version
format we use (SemVer), so we have to specially format the extension
version to be compatible. The format we chose was
`[major].[minor].[patch].[buildType][buildVersion]`. But when we tried
to submit a build with a version in that format, it was rejected as
invalid for unknown reasons.

The Firefox extension format has been updated to
`[major].[minor].[patch][buildType][buildVersion]`. This seems to pass
validation.
2022-01-03 12:48:10 -03:30
Mark Stacey
ae97e91443
Fix how version_name manifest field is used (#13155)
The `version_name` manifest field was being used on Chrome to store the
build type. However, Chrome intended this field to be a full
representation of the version, for display purposes. This was evident
when uploading this version to the Chrome Web Store, because it used
`flask` as the entire version.

Instead the `version_name` field now includes the full SemVer version
string. The version parsing code within the build script and in the
wallet itself have been updated accordingly.
2022-01-03 10:30:13 -03:30
Mark Stacey
0cd4fb1da0
Allow Flask prerelease versions (#13156)
The build script only allowed prerelease versions for the "beta" build
type (e.g. `X.Y.Z-beta.0`). Now it allows Flask prerelease versions as
well.

This is required for the Flask release, where the prerelease version
helps distinguish the Flask error reports and metrics.
2022-01-03 10:29:57 -03:30
Mark Stacey
ba54a3d83b
Update ESLint config to v8 (#12886)
The ESLint config has been updated to v8. The breaking changes are:

* The Prettier rule `quoteProps` has been changed from `consistent` to
`as-needed`, meaning that if one key requires quoting, only that key is
quoted rather than all keys.
* The ESLint rule `no-shadow` has been made more strict. It now
prevents globals from being shadowed as well.

Most of these changes were applied with `yarn lint:fix`. Only the
shadowing changes required manual fixing (shadowing variable names were
either replaced with destructuring or renamed).

The dependency `globalThis` was added to the list of dynamic
dependencies in the build system, where it should have been already.
This was causing `depcheck` to fail because the new lint rules required
removing the one place where `globalThis` had been erroneously imported
previously.

A rule requiring a newline between multiline blocks and expressions has
been disabled temporarily to make this PR smaller and to avoid
introducing conflicts with other PRs.
2021-12-09 15:36:24 -03:30
kumavis
7dac6f2517
Fix browser specific manifest generation (#13007) 2021-12-07 16:31:01 -06:00
Mark Stacey
b983971bfd
Disable remote-redux-devtools in non-dev builds (#12956)
`remote-redux-devtools` is now explicitly excluded and disabled in non-
dev builds, and in the `testDev` build. This was causing console errors
in the `testDev` build during e2e tests, which would cause certain
tests to fail.

This was already only supposed to be enabled for development builds,
but this library used the `NODE_ENV` environment variable to make that
determination. This gives us more control over when it's disabled.
2021-12-06 11:55:40 -03:30
Mark Stacey
56c91262e9
Disable React dev tools in testDev builds (#12955)
The React dev tools can result in console errors if dev tools is not
open during the test. Some of our e2e tests fail if there are any
console errors, so these errors break those tests.

`react-devtools` has been completely disabled for `testDev` builds to
make debugging e2e tests easier. The React dev tools can still be used
from development builds.
2021-12-03 11:22:43 -03:30
Mark Stacey
7226357422
Fix isMainnet propType error (#12951)
A propType error was showing up during e2e tests with a `testDev`
build. It was caused by `process.env.IN_TEST` being treated as a
boolean, when in fact it is either the string `'true'` or a boolean.

`IN_TEST` has been updated to always be a boolean. `loose-envify` has
no trouble injecting boolean values, so there's no reason to treat this
as a string.
2021-12-02 14:46:46 -03:30
Mark Stacey
267cdc4e6b
Update Jest coverage reporters (#12845)
The coverage reporter for the console has been changed from `text` to
`text-summary` because `text` was too long. It exceeded the maximum
length of the CircleCI terminal output shown on their jobs page, making
it very difficult to see why the unit test coverage job failed.

The text summary only displays overall coverage metrics, but that is
usually enough to indicate when the test fails due to a drop in
coverage. The more detailed breakdown is still available as a HTML
report linked in the `metamaskbot` comment, and in the `jest-coverage`
directory when run locally.

The three on-disk coverage reports used previously (`lcov`, `json`, and
`clover`) have been replaced with just `html`. The HTML report was part
of the `lcov` report, and it was the only one we were using.
2021-12-01 15:16:34 -03:30
Mark Stacey
e8b7fcf8dc
Fix LavaMoat background policy generation (#12844)
The LavaMoat policy generation script would sporadically fail because
it ran the build concurrently three times, and the build includes
steps that delete the `dist` directory and write to it. So if one build
process tried to write to the directory after another deleted it, it
would fail.

This was solved by adding a new `--policy-only` flag to the build
script, and a new `scripts:prod` task. The `scripts:prod` task only
runs the script tasks for prod, rather than the entire build process.
The `--policy-only` flag stops the script tasks once the policy has
been written, and stops any other files from being written to disk.

This prevents the three concurrent build processes from getting in each
others way, and it dramatically speeds up the process.
2021-11-26 16:38:23 -03:30
Mark Stacey
609f541b76
Fix environment variables used during test builds (#12855)
The environment variables used for test builds was wrong for certain
bundles because the `testing` flag wasn't passed through to the
function that determines which environment variables to inject.
Effectively this means that test builds on `master` were going to the
production `metamask` Sentry project rather than the `test-metamask`
project. This has been the case since #11080.

The `testing` flag is now included for all bundles, and test builds now
use the `test-metamask` Sentry project in all cases.
2021-11-26 15:39:32 -03:30
Erik Marks
d89e5336a6
Improve code fence transform error handling (#12742)
This PR improves the error handling of the code fence removal transform stream by catching errors thrown by the `removeFencedCode` function and passing them to the `end` callback. This appears to resolve a problem where watched builds would blow up whenever a file with fences was reloaded.
2021-11-19 08:35:04 -08:00
Erik Marks
0e4005b1e7
Fix manifest i18n substitutions for Beta and Flask (#12717) 2021-11-16 08:43:21 -08:00
Erik Marks
d4c71b8683
Add per-build type LavaMoat policies (#12702)
This PR adds one LavaMoat background script policy or each build type. It also renames the build system policy directory from `node` to `build-system` to make its purpose more clear. Each build type has the original `policy-override.json` for `main` builds. The `.prettierignore` file has been updated to match the locations of the new auto-generated policy files.

We need to maintain separate policies for each build type because each type will produce different bundles with different internal and external modules.

Co-authored-by: Mark Stacey <markjstacey@gmail.com>
2021-11-15 14:23:46 -08:00
Mark Stacey
faebdd0ccd
Add platform-specific build type manifest modifications (#12638)
The build system now supports platform-specific modifications to the
manifest for each build type. The need to customize the `id` on Firefox
motivated this change.

To support this, a new directory was made in each build type directory
for manifest changes. The images currently in this directory were moved
into an `images` subdirectory.

This new `manifest` directory can include each manifest file currently
in `app/manifest`. The `_base.json` file is assumed to exist, but the
platform manifest modifications are optional.
2021-11-10 19:33:59 -03:30
kumavis
a4053b6b88
Lavamoat - enable lavamoat for the webapp background (#12566)
* lavamoat - update policy for current repo state

* lavamoat - enable for webapp background

* lavamoat - update policy for current repo state
2021-11-10 09:33:19 -10:00
Alex Miller
722c4e5b63
Support for GridPlus Lattice1 hardware wallet (#12053)
* GridPlus: Adds support for GridPlus Lattice1 hardware wallet

* Fixes issue with switching hardware HD path
The main `Select HD Path` piece of the account selection component was not
properly hooked up to the state manager (`onPathChange`) and the extra
`Popover` component was being used instead.
I'm not sure what the origin of this is, but I don't see why the Popover
is needed at all. I have remove it and hooked `onPathChange` directly into
the HD path selector dropdown.
This was an issue that nearly every Lattice user who had come from Ledger
has contacted us about.

* GridPlus: Addresses QA issues
* Adds Lattice tutorial + image
* Cleans up connectivity issues (see: https://github.com/GridPlus/eth-lattice-keyring/pull/16)

* GridPlus: Adds Firefox support
To connect to the Lattice you need to open a new tab/window and get
login data from it. We were not able to do this for Firefox because
we relied on the `window` API. This is now fixed.
See corresponding changes:
* `eth-lattice-keyring`: https://github.com/GridPlus/eth-lattice-keyring/pull/17
* Lattice connector: https://github.com/GridPlus/wallet-web/pull/152

* GridPlus: Adds missing error path for Firefox
See: 242a93f559
2021-11-08 11:18:41 -03:30
Jyoti Puri
3dfc1cc5f6
Edit transaction screen changes for EIP-1559 V2 (#12493)
Edit transaction screen changes for EIP-1559 V2
2021-11-05 22:53:15 +05:30