Loosen allowlist requirements

Author: FrederikBolding

packages/snaps-controllers/coverage.json

@@ -1,6 +1,6 @@
 {
   "branches": 91.17,
-  "functions": 96.92,
+  "functions": 96.93,
   "lines": 98,
-  "statements": 97.72
+  "statements": 97.73
 }

packages/snaps-controllers/src/snaps/SnapController.test.ts

@@ -584,7 +584,11 @@ describe('SnapController', () => {
     );
 
     expect(messenger.call).toHaveBeenNthCalledWith(2, 'SnapsRegistry:get', {
-      [MOCK_SNAP_ID]: { version: '1.0.0', checksum: DEFAULT_SNAP_SHASUM },
+      [MOCK_SNAP_ID]: {
+        version: '1.0.0',
+        checksum: DEFAULT_SNAP_SHASUM,
+        permissions: getSnapManifest().initialPermissions,
+      },
     });
 
     expect(messenger.call).toHaveBeenNthCalledWith(
@@ -768,11 +772,22 @@ describe('SnapController', () => {
   });
 
   it('throws an error if snap is not on allowlist and allowlisting is required', async () => {
+    const { manifest, sourceCode, svgIcon } = await getMockSnapFilesWithUpdatedChecksum({
+      manifest: getSnapManifest({
+        initialPermissions: {
+          // eslint-disable-next-line @typescript-eslint/naming-convention
+          snap_getBip44Entropy: [{ coinType: 1 }],
+        },
+      }),
+    });
+
     const controller = getSnapController(
       getSnapControllerOptions({
         featureFlags: { requireAllowlist: true },
-        detectSnapLocation: (_location, options) =>
-          new LoopbackLocation(options),
+        detectSnapLocation: loopbackDetect({
+          manifest: manifest.result,
+          files: [sourceCode, svgIcon as VirtualFile],
+        }),
       }),
     );
 
@@ -781,7 +796,7 @@ describe('SnapController', () => {
         [MOCK_SNAP_ID]: { version: DEFAULT_REQUESTED_SNAP_VERSION },
       }),
     ).rejects.toThrow(
-      'Failed to fetch snap "npm:@metamask/example-snap": The snap is not on the allowlist.',
+      'Cannot install version "1.0.0" of snap "npm:@metamask/example-snap": The snap is not on the allowlist.',
     );
 
     controller.destroy();

packages/snaps-controllers/src/snaps/SnapController.ts

@@ -45,6 +45,7 @@ import type {
   PersistedSnap,
   Snap,
   SnapManifest,
+  SnapPermissions,
   SnapRpcHookArgs,
   StatusContext,
   StatusEvents,
@@ -107,6 +108,7 @@ import type {
   TerminateSnapAction,
 } from '../services';
 import { fetchSnap, hasTimedOut, setDiff, withTimeout } from '../utils';
+import { ALLOWED_PERMISSIONS } from './constants';
 import {
   getMaxRequestTimeCaveat,
   handlerEndowments,
@@ -1197,7 +1199,10 @@ export class SnapController extends BaseController<
     this.messagingSystem.publish(`${controllerName}:snapUnblocked`, snapId);
   }
 
-  async #assertIsInstallAllowed(snapId: SnapId, snapInfo: SnapsRegistryInfo) {
+  async #assertIsInstallAllowed(
+    snapId: SnapId,
+    snapInfo: SnapsRegistryInfo & { permissions: SnapPermissions },
+  ) {
     const results = await this.messagingSystem.call('SnapsRegistry:get', {
       [snapId]: snapInfo,
     });
@@ -1210,8 +1215,15 @@ export class SnapController extends BaseController<
           result.reason?.explanation ?? ''
         }`,
       );
-    } else if (
+    }
+
+    const isAllowlistingRequired = !Object.keys(snapInfo.permissions).every(
+      (permission) => ALLOWED_PERMISSIONS.includes(permission),
+    );
+
+    if (
       this.#featureFlags.requireAllowlist &&
+      isAllowlistingRequired &&
       result.status !== SnapsRegistryStatus.Verified
     ) {
       throw new Error(
@@ -2194,6 +2206,7 @@ export class SnapController extends BaseController<
       await this.#assertIsInstallAllowed(snapId, {
         version: newVersion,
         checksum: manifest.source.shasum,
+        permissions: manifest.initialPermissions,
       });
 
       const processedPermissions = processSnapPermissions(
@@ -2367,6 +2380,7 @@ export class SnapController extends BaseController<
         await this.#assertIsInstallAllowed(snapId, {
           version: manifest.version,
           checksum: manifest.source.shasum,
+          permissions: manifest.initialPermissions,
         });
 
         return this.#set({

packages/snaps-controllers/src/snaps/constants.ts

@@ -0,0 +1,12 @@
+import { SnapEndowments } from './endowments';
+
+// These permissions are allowed without being on the allowlist.
+export const ALLOWED_PERMISSIONS = Object.freeze([
+  'snap_dialog',
+  'snap_manageState',
+  'snap_notify',
+  'snap_getLocale',
+  SnapEndowments.Cronjob,
+  SnapEndowments.HomePage,
+  SnapEndowments.LifecycleHooks,
+]);