feat: add account ordering to Multichain API #41068
Conversation
| this.permissionController.state, | ||
| ); | ||
|
|
||
| // TODO: Remove this setTimeout once https://github.com/MetaMask/core/pull/8261 is released |
There was a problem hiding this comment.
MetaMask/core#8261 is merged but we will need to wait until its released (supposed happening this Friday 3/27/26)
…tSession, and wallet_createSession (#8255) ## Explanation ### `@metamask/chain-agnostic-permission` - **Added** optional `sortAccountIdsByLastSelected` parameter to `getSessionScopes` function - Type: `(accounts: CaipAccountId[]) => CaipAccountId[]` - When provided, sorts the `accounts` array within each scope (both required and optional scopes) - When not provided, preserves original account order ### `@metamask/multichain-api-middleware` - **Added** required `sortAccountIdsByLastSelected` hook to `wallet_getSession` handler - Passes the hook to `getSessionScopes` when building session response - **Added** required `sortAccountIdsByLastSelected` hook to `wallet_createSession` handler - Passes the hook to `getSessionScopes` when building session scopes for approval ## References See: MetaMask/metamask-extension#41068 ## Checklist - [x] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Medium risk because it changes handler hook contracts in `multichain-api-middleware` (breaking for integrators) and alters ordering of accounts returned in session scopes, which could impact downstream UI/logic expectations. > > **Overview** > Adds an optional `sortAccountIdsByLastSelected` hook to `@metamask/chain-agnostic-permission` `getSessionScopes`, applying it to the `accounts` list for every merged scope before returning session scopes. > > Updates `wallet_getSession`, `wallet_createSession`, and `wallet_invokeMethod` handlers in `@metamask/multichain-api-middleware` to require and pass through this new sorting hook, with corresponding test updates and changelog entries noting the breaking hook requirement. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 4fc3d03. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: Alex Mendonca <alex.mendonca@consensys.net> Co-authored-by: Alex Donesky <adonesky@gmail.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
adonesky1
left a comment
There was a problem hiding this comment.
LGTM. I agree however that we should switch the wallet-standard package separately to isolate the commit from other unrelated changes in that package
| sortedAddresses.map((address, index) => [address, index]), | ||
| ); | ||
|
|
||
| return [...accountIds].sort( |
There was a problem hiding this comment.
right?
| return [...accountIds].sort( | |
| return accountIds.sort( |
There was a problem hiding this comment.
.sort() isn't pure and modifies the array in place.
If we make this change, then i'd prefer to not return anything at all to make it clear that the original array is getting mutated, but that would also require changes to the middleware and permission packages again
…-ordering-2' into jl/wallet_sessionChanged-account-ordering-2
|
@metamaskbot update-policies |
1 similar comment
|
@metamaskbot update-policies |
|
Policies updated. Tip Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers. ✅ lavamoat/browserify/beta/policy.json changes match main/policy.json policy changes |
|
Policy update failed. You can review the logs or retry the policy update here |
Builds ready [faf3c5e]
⚡ Performance Benchmarks (Total: 🟢 18 pass · 🟡 0 warn · 🔴 0 fail)
🌐 Dapp Page Load BenchmarksCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
|
Builds ready [28e58b8]
⚡ Performance Benchmarks (Total: 🟢 18 pass · 🟡 0 warn · 🔴 0 fail)
🌐 Dapp Page Load BenchmarksCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|



Description
Adds ordering to the
accountsproperty in the wallet_getSession response, wallet_createSession response, and wallet_sessionChanged event. Accounts are now ordered by most recently used (lastSelected)This is needed as pre-req work to getting rid of ecosystem specific (solana, tron, other multichain) metamask_accountsChanged events.
Changelog
CHANGELOG entry: null
Not end user facing.
Related issues
Core: MetaMask/core#8255
Manual testing steps
Screenshots/Recordings
Before
After
Screen.Recording.2026-03-26.at.10.33.36.AM.mov
Pre-merge author checklist
Pre-merge reviewer checklist
Note
Medium Risk
Touches Multichain API session notifications and adds a delayed
wallet_sessionChangedbroadcast, which could affect dapp session state timing/order. Dependency bumps to@metamask/multichain-api-middlewareand@metamask/chain-agnostic-permissionmay introduce behavior changes in session scope shaping.Overview
Adds deterministic ordering to Multichain API session
accountsby sorting CAIP account IDs using each address’slastSelectedrank, and wires this sorter intogetSessionScopesforwallet_getSession,wallet_createSession, andwallet_sessionChanged.Also triggers a
wallet_sessionChangednotification to all authorized origins onselectedAccountGroupChange(currently via a temporary 1ssetTimeoutworkaround), with new/updated unit tests covering both the sorting behavior and the broadcast.Written by Cursor Bugbot for commit 28e58b8. This will update automatically on new commits. Configure here.