From 8a747a2be80c2eec6e4576a96a319ebf014b3a67 Mon Sep 17 00:00:00 2001
From: Maarten Zuidhoorn <maarten@zuidhoorn.com>
Date: Tue, 4 Mar 2025 16:57:30 +0100
Subject: [PATCH] Unlock client before calling `getEntropySources` in
 `snap_listEntropySources` method

---
 .../src/permitted/listEntropySources.test.ts  |  7 ++++++
 .../src/permitted/listEntropySources.ts       | 23 +++++++++++++++----
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/packages/snaps-rpc-methods/src/permitted/listEntropySources.test.ts b/packages/snaps-rpc-methods/src/permitted/listEntropySources.test.ts
index f0fde80366..591ee3e219 100644
--- a/packages/snaps-rpc-methods/src/permitted/listEntropySources.test.ts
+++ b/packages/snaps-rpc-methods/src/permitted/listEntropySources.test.ts
@@ -16,6 +16,7 @@ describe('snap_listEntropySources', () => {
         hookNames: {
           hasPermission: true,
           getEntropySources: true,
+          getUnlockPromise: true,
         },
       });
     });
@@ -25,6 +26,7 @@ describe('snap_listEntropySources', () => {
     it('returns the result from the `getEntropySources` hook', async () => {
       const { implementation } = listEntropySourcesHandler;
 
+      const getUnlockPromise = jest.fn();
       const getEntropySources = jest.fn().mockReturnValue([
         {
           name: 'Secret recovery phrase 1',
@@ -49,6 +51,7 @@ describe('snap_listEntropySources', () => {
       const hooks = {
         hasPermission: jest.fn().mockReturnValue(true),
         getEntropySources,
+        getUnlockPromise,
       };
 
       const engine = new JsonRpcEngine();
@@ -71,6 +74,7 @@ describe('snap_listEntropySources', () => {
         method: 'snap_listEntropySources',
       });
 
+      expect(getUnlockPromise).toHaveBeenCalledWith(true);
       expect(response).toStrictEqual({
         jsonrpc: '2.0',
         id: 1,
@@ -100,9 +104,11 @@ describe('snap_listEntropySources', () => {
     it('returns an unauthorized error if the requesting origin does not have the required permission', async () => {
       const { implementation } = listEntropySourcesHandler;
 
+      const getUnlockPromise = jest.fn();
       const hooks = {
         hasPermission: jest.fn().mockReturnValue(false),
         getEntropySources: jest.fn(),
+        getUnlockPromise,
       };
 
       const engine = new JsonRpcEngine();
@@ -125,6 +131,7 @@ describe('snap_listEntropySources', () => {
         method: 'snap_listEntropySources',
       });
 
+      expect(getUnlockPromise).not.toHaveBeenCalled();
       expect(response).toStrictEqual({
         jsonrpc: '2.0',
         id: 1,
diff --git a/packages/snaps-rpc-methods/src/permitted/listEntropySources.ts b/packages/snaps-rpc-methods/src/permitted/listEntropySources.ts
index 2ca739d808..ee443a6e0f 100644
--- a/packages/snaps-rpc-methods/src/permitted/listEntropySources.ts
+++ b/packages/snaps-rpc-methods/src/permitted/listEntropySources.ts
@@ -29,6 +29,7 @@ const REQUIRED_PERMISSIONS = [
 const hookNames: MethodHooksObject<ListEntropySourcesHooks> = {
   hasPermission: true,
   getEntropySources: true,
+  getUnlockPromise: true,
 };
 
 export type ListEntropySourcesHooks = {
@@ -46,6 +47,13 @@ export type ListEntropySourcesHooks = {
    * @returns The entropy sources.
    */
   getEntropySources: () => EntropySource[];
+
+  /**
+   * Wait for the extension to be unlocked.
+   *
+   * @returns A promise that resolves once the extension is unlocked.
+   */
+  getUnlockPromise: (shouldShowUnlockRequest: boolean) => Promise<void>;
 };
 
 export const listEntropySourcesHandler: PermittedHandlerExport<
@@ -59,7 +67,7 @@ export const listEntropySourcesHandler: PermittedHandlerExport<
 };
 
 /**
- * The `snap_getInterfaceContext` method implementation.
+ * The `snap_listEntropySources` method implementation.
  *
  * @param _request - The JSON-RPC request object. Not used by this function.
  * @param response - The JSON-RPC response object.
@@ -70,20 +78,27 @@ export const listEntropySourcesHandler: PermittedHandlerExport<
  * @param hooks.hasPermission - The function to check if the origin has a
  * permission.
  * @param hooks.getEntropySources - The function to get the entropy sources.
+ * @param hooks.getUnlockPromise - The function to get the unlock promise.
  * @returns Noting.
  */
-function listEntropySourcesImplementation(
+async function listEntropySourcesImplementation(
   _request: JsonRpcRequest<ListEntropySourcesParams>,
   response: PendingJsonRpcResponse<ListEntropySourcesResult>,
   _next: unknown,
   end: JsonRpcEngineEndCallback,
-  { hasPermission, getEntropySources }: ListEntropySourcesHooks,
-): void {
+  {
+    hasPermission,
+    getEntropySources,
+    getUnlockPromise,
+  }: ListEntropySourcesHooks,
+): Promise<void> {
   const isPermitted = REQUIRED_PERMISSIONS.some(hasPermission);
   if (!isPermitted) {
     return end(providerErrors.unauthorized());
   }
 
+  await getUnlockPromise(true);
+
   response.result = getEntropySources();
   return end();
 }