Merge remote-tracking branch 'origin/master' into fix/send-flow-asset-list-formatting

# Conflicts:
#	extension/e2e-tests/blockaidScan.malicious.test.ts
#	extension/e2e-tests/blockaidScan.safe.test.ts
#	extension/e2e-tests/blockaidScan.suspicious.test.ts
#	extension/e2e-tests/blockaidScan.unable.test.ts
#	extension/e2e-tests/sendPayment.test.ts

Author: piyalbasu

@shared/api/helpers/__tests__/fixtures/sep0042-assetlist.schema.ts

@@ -0,0 +1,133 @@
+// Upstream SEP-0042 asset-list JSON schema, pinned verbatim for deterministic tests.
+/* eslint-disable */
+export const SEP0042_ASSETLIST_SCHEMA = {
+  $schema: "http://json-schema.org/draft-07/schema#",
+  title: "Stellar Asset List",
+  description: "Schema for Stellar Asset Lists (SAL)",
+  type: "object",
+  definitions: {
+    CleanString: {
+      type: "string",
+      pattern: "^[\\w\\u0020.,-@]*$",
+    },
+  },
+  properties: {
+    name: {
+      $ref: "#/definitions/CleanString",
+      maxLength: 30,
+      minLength: 5,
+      description: "Short descriptive title of the list",
+    },
+    network: {
+      type: "string",
+      enum: ["public", "testnet"],
+    },
+    provider: {
+      $ref: "#/definitions/CleanString",
+      maxLength: 50,
+      minLength: 5,
+      description: "Organization or entity that put together the list",
+    },
+    description: {
+      type: "string",
+      maxLength: 400,
+      description:
+        "Text description of the list to display alongside with the name",
+    },
+    version: {
+      type: "string",
+      pattern: "^\\d{1,4}\\.\\d{1,4}$",
+      description: "Current list revision",
+    },
+    feedback: {
+      type: "string",
+      format: "uri",
+      maxLength: 100,
+      description:
+        "URL or Github repository address where users can report bad actors or request addition of new assets",
+    },
+    assets: {
+      type: "array",
+      minItems: 1,
+      maxItems: 1000,
+      description: "Array of asset metadata entries",
+      items: {
+        type: "object",
+        properties: {
+          name: {
+            $ref: "#/definitions/CleanString",
+            maxLength: 30,
+            minLength: 5,
+            description: "Array of asset metadata entries",
+          },
+          contract: {
+            type: "string",
+            pattern: "^C[A-Z0-9]{55}$",
+            description:
+              "Asset contract address in StrKey encoding (for Soroban assets)",
+          },
+          code: {
+            type: "string",
+            pattern: "^[A-Za-z0-9]{1,12}$",
+            description: "Asset code (for Classic assets)",
+          },
+          issuer: {
+            type: "string",
+            pattern: "^G[A-Z0-9]{55}$",
+            description: "Asset issuer address (for Classic assets)",
+          },
+          org: {
+            $ref: "#/definitions/CleanString",
+            maxLength: 30,
+            minLength: 5,
+            description: "Issuer organization/company",
+          },
+          domain: {
+            type: "string",
+            pattern:
+              "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9]$",
+            description:
+              "FQDN of the site that hosts asset-related stellar.toml format",
+          },
+          icon: {
+            type: "string",
+            oneOf: [
+              {
+                format: "uri",
+              },
+              {
+                pattern: "^baf[a-zA-Z0-9]+$",
+              },
+            ],
+            description:
+              "Icon URL (only HTTPS protocol is supported) or IPFS hash",
+          },
+          decimals: {
+            type: "integer",
+            minimum: 0,
+            maximum: 38,
+            description: "Number of decimals to display",
+          },
+          comment: {
+            type: "string",
+            maxLength: 150,
+            description:
+              "Alerts, messages, or other additional information specified by the provider",
+          },
+        },
+        required: ["name", "org"],
+        anyOf: [
+          {
+            required: ["contract"],
+          },
+          {
+            required: ["code", "issuer"],
+          },
+        ],
+        additionalProperties: false,
+      },
+    },
+  },
+  required: ["name", "provider", "version", "assets"],
+  additionalProperties: false,
+} as const;

@shared/api/helpers/__tests__/token-list.schema.test.ts

@@ -0,0 +1,138 @@
+import {
+  schemaValidatedAssetList,
+  __resetSep0042SchemaCache,
+} from "../token-list";
+import { AssetListResponse } from "@shared/constants/soroban/asset-list";
+import { SEP0042_ASSETLIST_SCHEMA } from "./fixtures/sep0042-assetlist.schema";
+
+jest.mock("@sentry/browser", () => ({
+  captureException: jest.fn(),
+}));
+
+import { captureException } from "@sentry/browser";
+
+const VALID_CONTRACT = `C${"A".repeat(55)}`; // ^C[A-Z0-9]{55}$
+const VALID_ISSUER = `G${"A".repeat(55)}`; // ^G[A-Z0-9]{55}$
+
+const baseAsset = (overrides: Record<string, unknown> = {}) => ({
+  name: "Test Asset",
+  org: "Test Org",
+  code: "TEST",
+  issuer: VALID_ISSUER,
+  contract: VALID_CONTRACT,
+  domain: "test.com",
+  icon: "https://test.com/icon.png",
+  decimals: 7,
+  ...overrides,
+});
+
+const baseList = (overrides: Record<string, unknown> = {}): AssetListResponse =>
+  ({
+    name: "Test List",
+    provider: "Test Provider",
+    description: "A test list",
+    version: "1.0",
+    network: "public",
+    assets: [baseAsset()],
+    ...overrides,
+  }) as AssetListResponse;
+
+describe("schemaValidatedAssetList", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    // The schema is memoized across validations, so clear the cache between
+    // cases (each mocks its own fetch response).
+    __resetSep0042SchemaCache();
+    // The SEP-0042 schema is fetched over the network; return the fixture
+    // so validation is deterministic and offline.
+    global.fetch = jest.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => SEP0042_ASSETLIST_SCHEMA,
+    }) as jest.Mock;
+  });
+
+  it("accepts 'mainnet' as a network value", async () => {
+    const result = await schemaValidatedAssetList(
+      baseList({ network: "mainnet" }),
+    );
+    expect(result.errors).toBeNull();
+    expect(result.assets).toHaveLength(1);
+  });
+
+  it("accepts a three-segment version", async () => {
+    const result = await schemaValidatedAssetList(
+      baseList({ version: "1.4.4" }),
+    );
+    expect(result.errors).toBeNull();
+    expect(result.assets).toHaveLength(1);
+  });
+
+  it("strips an invalid name but keeps the asset and its other fields", async () => {
+    const result = await schemaValidatedAssetList(
+      baseList({ assets: [baseAsset({ name: "Carbon tCO₂e offset" })] }),
+    );
+    expect(result.errors).toBeNull();
+    expect(result.assets).toHaveLength(1);
+    expect(result.assets[0].name).toBeUndefined();
+    expect(result.assets[0].code).toBe("TEST");
+    expect(result.assets[0].contract).toBe(VALID_CONTRACT);
+  });
+
+  it("strips an invalid contract but keeps the asset via code+issuer", async () => {
+    const result = await schemaValidatedAssetList(
+      baseList({
+        assets: [baseAsset({ contract: "deadbeef-not-a-contract" })],
+      }),
+    );
+    expect(result.errors).toBeNull();
+    expect(result.assets).toHaveLength(1);
+    expect(result.assets[0].contract).toBeUndefined();
+    expect(result.assets[0].code).toBe("TEST");
+    expect(result.assets[0].issuer).toBe(VALID_ISSUER);
+  });
+
+  it("tolerates assets missing both name and org", async () => {
+    const asset = baseAsset();
+    delete (asset as Record<string, unknown>).name;
+    delete (asset as Record<string, unknown>).org;
+    const result = await schemaValidatedAssetList(
+      baseList({ assets: [asset] }),
+    );
+    expect(result.errors).toBeNull();
+    expect(result.assets).toHaveLength(1);
+  });
+
+  it("still rejects a list with a non-relaxed violation (bad domain)", async () => {
+    const result = await schemaValidatedAssetList(
+      baseList({ assets: [baseAsset({ domain: "NOT A DOMAIN!!" })] }),
+    );
+    expect(result.assets).toHaveLength(0);
+    expect(result.errors).not.toBeNull();
+    expect(result.errors!.length).toBeGreaterThan(0);
+  });
+
+  it("returns empty assets and null errors when the schema cannot be fetched", async () => {
+    (global.fetch as jest.Mock).mockResolvedValue({ ok: false, status: 500 });
+    const result = await schemaValidatedAssetList(baseList());
+    expect(result.assets).toHaveLength(0);
+    expect(result.errors).toBeNull();
+    expect(captureException).toHaveBeenCalled();
+  });
+
+  it("does not mutate the input list when stripping fields", async () => {
+    const list = baseList({
+      assets: [baseAsset({ contract: "deadbeef-not-a-contract" })],
+    });
+    const snapshot = JSON.stringify(list);
+    await schemaValidatedAssetList(list);
+    expect(JSON.stringify(list)).toBe(snapshot);
+  });
+
+  it("fetches the SEP-0042 schema only once across multiple validations", async () => {
+    await schemaValidatedAssetList(baseList());
+    await schemaValidatedAssetList(baseList());
+    await schemaValidatedAssetList(baseList());
+    expect(global.fetch).toHaveBeenCalledTimes(1);
+  });
+});