feat(gator-permissions-controller): Added payee rule

packages/gator-permissions-controller/CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Add `payee` rule to execution permission decoding for all known permission types ([#8668](https://github.com/MetaMask/core/pull/8668))
 - Support `RedeemerEnforcer` caveat when decoding execution permissions ([#8537](https://github.com/MetaMask/core/pull/8537))
   - Permission decoding now recognizes the `RedeemerEnforcer` as an optional caveat on all execution permission types and extracts a `redeemer` rule containing the allowlisted addresses.
   - `DecodedPermission` type now includes an optional `rules` property for rules recovered from caveats.

packages/gator-permissions-controller/package.json

@@ -56,8 +56,8 @@
     "@metamask/7715-permission-types": "^0.6.0",
     "@metamask/abi-utils": "^2.0.3",
     "@metamask/base-controller": "^9.1.0",
-    "@metamask/delegation-core": "^1.1.0",
-    "@metamask/delegation-deployments": "^0.12.0",
+    "@metamask/delegation-core": "^2.0.0",
+    "@metamask/delegation-deployments": "^1.3.0",
     "@metamask/messenger": "^1.2.0",
     "@metamask/network-controller": "^30.1.0",
     "@metamask/snaps-controllers": "^19.0.0",

packages/gator-permissions-controller/src/constants.ts

@@ -10,3 +10,11 @@ export const DELEGATION_FRAMEWORK_VERSION = '1.3.0';
  * supported execution permission type.
  */
 export const EXECUTION_PERMISSION_REDEEMER_RULE_TYPE = 'redeemer' as const;
+
+/**
+ * `Rule.type` / `wallet_getSupportedExecutionPermissions` `ruleTypes` entry for
+ * payee allowlists (AllowedCalldataEnforcer / AllowedTargetsEnforcer). Hosts
+ * should advertise this for every supported execution permission type that supports
+ * payee restrictions.
+ */
+export const EXECUTION_PERMISSION_PAYEE_RULE_TYPE = 'payee' as const;

packages/gator-permissions-controller/src/decodePermission/rules/erc20TokenAllowance.ts

@@ -33,12 +33,23 @@ export function makeErc20TokenAllowanceRule(
     erc20PeriodicEnforcer,
     valueLteEnforcer,
     nonceEnforcer,
+    allowedCalldataEnforcer,
+    allowedTargetsEnforcer,
     redeemerEnforcer,
   } = enforcers;
   return makePermissionRule({
     permissionType: 'erc20-token-allowance',
-    optionalEnforcers: [timestampEnforcer, redeemerEnforcer],
+    optionalEnforcers: [
+      timestampEnforcer,
+      redeemerEnforcer,
+      allowedCalldataEnforcer,
+    ],
     redeemerEnforcer,
+    payeeEnforcers: {
+      allowedCalldataEnforcer,
+      allowedTargetsEnforcer,
+      singlePayeeEnforcer: allowedCalldataEnforcer,
+    },
     timestampEnforcer,
     requiredEnforcers: {
       [erc20PeriodicEnforcer]: 1,

packages/gator-permissions-controller/src/decodePermission/rules/erc20TokenPeriodic.ts

@@ -29,12 +29,23 @@ export function makeErc20TokenPeriodicRule(
     erc20PeriodicEnforcer,
     valueLteEnforcer,
     nonceEnforcer,
+    allowedCalldataEnforcer,
+    allowedTargetsEnforcer,
     redeemerEnforcer,
   } = enforcers;
   return makePermissionRule({
     permissionType: 'erc20-token-periodic',
-    optionalEnforcers: [timestampEnforcer, redeemerEnforcer],
+    optionalEnforcers: [
+      timestampEnforcer,
+      redeemerEnforcer,
+      allowedCalldataEnforcer,
+    ],
     redeemerEnforcer,
+    payeeEnforcers: {
+      allowedCalldataEnforcer,
+      allowedTargetsEnforcer,
+      singlePayeeEnforcer: allowedCalldataEnforcer,
+    },
     timestampEnforcer,
     requiredEnforcers: {
       [erc20PeriodicEnforcer]: 1,

packages/gator-permissions-controller/src/decodePermission/rules/erc20TokenRevocation.test.ts

@@ -3,14 +3,19 @@ import {
   CHAIN_ID,
   DELEGATOR_CONTRACTS,
 } from '@metamask/delegation-deployments';
+import { getChecksumAddress } from '@metamask/utils';
 
 import { createPermissionRulesForContracts } from '.';
 
 describe('erc20-token-revocation rule', () => {
   const chainId = CHAIN_ID.sepolia;
   const contracts = DELEGATOR_CONTRACTS['1.3.0'][chainId];
-  const { TimestampEnforcer, AllowedCalldataEnforcer, ValueLteEnforcer } =
-    contracts;
+  const {
+    TimestampEnforcer,
+    AllowedCalldataEnforcer,
+    ValueLteEnforcer,
+    RedeemerEnforcer,
+  } = contracts;
   const permissionRules = createPermissionRulesForContracts(contracts);
   const rule = permissionRules.find(
     (candidate) => candidate.permissionType === 'erc20-token-revocation',
@@ -217,5 +222,56 @@ describe('erc20-token-revocation rule', () => {
 
     expect(result.expiry).toBe(1720000);
     expect(result.data).toStrictEqual({});
+    expect(result.rules).toBeUndefined();
+  });
+
+  it('includes redeemer rule but not payee when RedeemerEnforcer caveat is present', () => {
+    const packedAddr = '1111111111111111111111111111111111111111' as const;
+    const approveSelectorTerms =
+      '0x0000000000000000000000000000000000000000000000000000000000000000095ea7b3' as const;
+    const zeroAmountTerms =
+      '0x00000000000000000000000000000000000000000000000000000000000000240000000000000000000000000000000000000000000000000000000000000000' as const;
+    const zeroValueLteTerms =
+      '0x0000000000000000000000000000000000000000000000000000000000000000' as const;
+    const caveats = [
+      expiryCaveat,
+      {
+        enforcer: AllowedCalldataEnforcer,
+        terms: approveSelectorTerms,
+        args: '0x' as const,
+      },
+      {
+        enforcer: AllowedCalldataEnforcer,
+        terms: zeroAmountTerms,
+        args: '0x' as const,
+      },
+      {
+        enforcer: ValueLteEnforcer,
+        terms: zeroValueLteTerms,
+        args: '0x' as const,
+      },
+      {
+        enforcer: RedeemerEnforcer,
+        terms: `0x${packedAddr}` as const,
+        args: '0x' as const,
+      },
+    ];
+    const result = rule.validateAndDecodePermission(caveats);
+    expect(result.isValid).toBe(true);
+    if (!result.isValid) {
+      throw new Error('Expected valid result');
+    }
+    expect(result.rules).toStrictEqual([
+      {
+        type: 'redeemer',
+        data: {
+          addresses: [
+            getChecksumAddress(
+              '0x1111111111111111111111111111111111111111' as const,
+            ),
+          ],
+        },
+      },
+    ]);
   });
 });

packages/gator-permissions-controller/src/decodePermission/rules/erc20TokenRevocation.ts

@@ -24,6 +24,7 @@ export function makeErc20TokenRevocationRule(
   const {
     timestampEnforcer,
     allowedCalldataEnforcer,
+    allowedTargetsEnforcer,
     valueLteEnforcer,
     nonceEnforcer,
     redeemerEnforcer,
@@ -32,6 +33,11 @@ export function makeErc20TokenRevocationRule(
     permissionType: 'erc20-token-revocation',
     optionalEnforcers: [timestampEnforcer, redeemerEnforcer],
     redeemerEnforcer,
+    payeeEnforcers: {
+      allowedCalldataEnforcer,
+      allowedTargetsEnforcer,
+      singlePayeeEnforcer: allowedCalldataEnforcer,
+    },
     timestampEnforcer,
     requiredEnforcers: {
       [allowedCalldataEnforcer]: 2,

packages/gator-permissions-controller/src/decodePermission/rules/erc20TokenStream.ts

@@ -28,12 +28,23 @@ export function makeErc20TokenStreamRule(
     erc20StreamingEnforcer,
     valueLteEnforcer,
     nonceEnforcer,
+    allowedCalldataEnforcer,
+    allowedTargetsEnforcer,
     redeemerEnforcer,
   } = enforcers;
   return makePermissionRule({
     permissionType: 'erc20-token-stream',
-    optionalEnforcers: [timestampEnforcer, redeemerEnforcer],
+    optionalEnforcers: [
+      timestampEnforcer,
+      redeemerEnforcer,
+      allowedCalldataEnforcer,
+    ],
     redeemerEnforcer,
+    payeeEnforcers: {
+      allowedCalldataEnforcer,
+      allowedTargetsEnforcer,
+      singlePayeeEnforcer: allowedCalldataEnforcer,
+    },
     timestampEnforcer,
     requiredEnforcers: {
       [erc20StreamingEnforcer]: 1,