test(auth-client): add engine verifyContext wiring regression

Author: exodus-jee

packages/auth-client/src/utils/verifyContext.ts

@@ -14,6 +14,21 @@ export const buildVerifyContext = async (
   attestationId: string,
   metadata: AuthClientTypes.Metadata,
 ): Promise<Verify.Context> => {
+  if (!metadata?.url) {
+    const context: Verify.Context = {
+      verified: { verifyUrl: "", validation: "UNKNOWN", origin: "" },
+    };
+    try {
+      const attestation = await resolve({ attestationId });
+      if (typeof attestation === "object" && attestation?.isScam) {
+        context.verified.isScam = true;
+      }
+    } catch (e) {
+      logError?.(e);
+    }
+    return context;
+  }
+
   const context: Verify.Context = {
     verified: {
       verifyUrl: metadata.verifyUrl || "",

packages/auth-client/test/engineVerifyWiring.spec.ts

@@ -0,0 +1,90 @@
+import { expect, describe, it, vi, beforeEach } from "vitest";
+import { AuthEngine } from "../src/controllers/engine";
+import { AuthClientTypes } from "../src/types";
+
+const WALLET_URL = "https://mywallet.app";
+const DAPP_URL = "https://app.uniswap.org";
+
+const walletMetadata: AuthClientTypes.Metadata = {
+  name: "My Wallet",
+  description: "",
+  url: WALLET_URL,
+  icons: [],
+};
+
+const dappMetadata: AuthClientTypes.Metadata = {
+  name: "Uniswap",
+  description: "",
+  url: DAPP_URL,
+  icons: [],
+};
+
+const authRequestPayload = {
+  id: 1,
+  jsonrpc: "2.0" as const,
+  method: "wc_authRequest" as const,
+  params: {
+    requester: {
+      publicKey: "abc123",
+      metadata: dappMetadata,
+    },
+    payloadParams: {
+      type: "eip4361" as const,
+      chainId: "eip155:1",
+      domain: "app.uniswap.org",
+      aud: "https://app.uniswap.org/login",
+      version: "1",
+      nonce: "deadbeef",
+      iat: new Date().toISOString(),
+    },
+  },
+};
+
+function createMockClient(verifyResolveReturn: unknown) {
+  return {
+    metadata: walletMetadata,
+    logger: {
+      info: vi.fn(),
+      error: vi.fn(),
+      debug: vi.fn(),
+    },
+    requests: {
+      set: vi.fn().mockResolvedValue(undefined),
+    },
+    core: {
+      verify: {
+        resolve: vi.fn().mockResolvedValue(verifyResolveReturn),
+      },
+      pairing: {
+        register: vi.fn(),
+      },
+    },
+    emit: vi.fn(),
+  } as any;
+}
+
+describe("AuthEngine.onAuthRequest verifyContext wiring", () => {
+  it("produces VALID when attested origin matches requester (dApp) URL", async () => {
+    const mockClient = createMockClient({ origin: DAPP_URL });
+    const engine = new AuthEngine(mockClient);
+
+    await (engine as any).onAuthRequest("topic", authRequestPayload);
+
+    const [eventName, eventArgs] = mockClient.emit.mock.calls[0];
+    expect(eventName).toBe("auth_request");
+    expect(eventArgs.verifyContext.verified.validation).toBe("VALID");
+    expect(eventArgs.verifyContext.verified.origin).toBe(DAPP_URL);
+  });
+
+  it("produces INVALID when attested origin matches wallet URL but not requester URL (regression guard)", async () => {
+    const mockClient = createMockClient({ origin: WALLET_URL });
+    const engine = new AuthEngine(mockClient);
+
+    await (engine as any).onAuthRequest("topic", authRequestPayload);
+
+    const [eventName, eventArgs] = mockClient.emit.mock.calls[0];
+    expect(eventName).toBe("auth_request");
+    expect(eventArgs.verifyContext.verified.validation).toBe("INVALID");
+    expect(eventArgs.verifyContext.verified.origin).toBe(WALLET_URL);
+  });
+});

packages/auth-client/test/verifyContext.spec.ts

@@ -121,4 +121,48 @@ describe("buildVerifyContext", () => {
     );
     expect(ctx.verified.validation).toBe("VALID");
   });
+
+  it("returns UNKNOWN with empty origin when metadata is undefined", async () => {
+    const ctx = await buildVerifyContext(
+      { resolve: () => Promise.resolve(undefined), logError: noopLog },
+      "hash",
+      undefined as any,
+    );
+    expect(ctx.verified.validation).toBe("UNKNOWN");
+    expect(ctx.verified.origin).toBe("");
+    expect(ctx.verified.verifyUrl).toBe("");
+  });
+
+  it("returns UNKNOWN with empty origin when metadata is null", async () => {
+    const ctx = await buildVerifyContext(
+      { resolve: () => Promise.resolve(undefined), logError: noopLog },
+      "hash",
+      null as any,
+    );
+    expect(ctx.verified.validation).toBe("UNKNOWN");
+    expect(ctx.verified.origin).toBe("");
+  });
+
+  it("returns UNKNOWN with empty origin when metadata.url is empty string", async () => {
+    const ctx = await buildVerifyContext(
+      { resolve: () => Promise.resolve(undefined), logError: noopLog },
+      "hash",
+      { name: "x", description: "", url: "", icons: [] },
+    );
+    expect(ctx.verified.validation).toBe("UNKNOWN");
+    expect(ctx.verified.origin).toBe("");
+  });
+
+  it("propagates isScam even when metadata is undefined", async () => {
+    const ctx = await buildVerifyContext(
+      {
+        resolve: () => Promise.resolve({ origin: "https://attacker.com", isScam: true }),
+        logError: noopLog,
+      },
+      "hash",
+      undefined as any,
+    );
+    expect(ctx.verified.isScam).toBe(true);
+    expect(ctx.verified.validation).toBe("UNKNOWN");
+  });
 });