Skip to content

chore: Improve unlockWallet password check#25091

Merged
Cal-L merged 2 commits intomainfrom
chore/MCWP-238-improve-unlock-wallet
Jan 23, 2026
Merged

chore: Improve unlockWallet password check#25091
Cal-L merged 2 commits intomainfrom
chore/MCWP-238-improve-unlock-wallet

Conversation

@Cal-L
Copy link
Copy Markdown
Contributor

@Cal-L Cal-L commented Jan 23, 2026 •
edited by cursor bot
Loading

Description

This PR is a small change that improves the password triaging condition in unlockWallet method in the Authentication service. The condition is to check for a non undefined password and if detected, will skip deriving password from generic password (aka biometrics).

PR that introduced unlockWallet - #23958

Changelog

CHANGELOG entry:

Related issues

Fixes: 2nd iteration of https://consensyssoftware.atlassian.net/browse/MCWP-238

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Authentication.unlockWallet logic

  • Treats any provided password (including empty string) as explicit input; derives from SecureKeychain.getGenericPassword only when password is undefined.

Tests

  • Adds unit tests ensuring keychain lookup is skipped when password is provided (empty or non-empty) and executed when omitted.

Impact

  • Small behavioral tweak that avoids unintended biometric lookup when an empty password is passed.

Written by Cursor Bugbot for commit 21f5d99. This will update automatically on new commits. Configure here.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Jan 23, 2026

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@metamaskbot metamaskbot added the team-mobile-platform Mobile Platform team label Jan 23, 2026
@Cal-L Cal-L added the needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) label Jan 23, 2026
@github-project-automation github-project-automation bot moved this to Needs dev review in PR review queue Jan 23, 2026
@Cal-L Cal-L added No QA Needed Apply this label when your PR does not need any QA effort. no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed no changelog required No changelog entry is required for this change labels Jan 23, 2026
cursor[bot]
cursor bot reviewed Jan 23, 2026
View reviewed changes
Copy link
Copy Markdown

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

@Cal-L Cal-L added the skip-sonar-cloud Only used for bypassing sonar cloud when failures are not relevant to the changes. label Jan 23, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Jan 23, 2026

🔍 Smart E2E Test Selection

  • Selected E2E tags: SmokeAccounts, SmokeWalletPlatform
  • Risk Level: medium
  • AI Confidence: 75%
click to see 🤖 AI reasoning details

The change is a one-line bug fix in the core Authentication service (app/core/Authentication/Authentication.ts), changing if (password) to if (password !== undefined). This allows empty string passwords to be explicitly used instead of falling back to keychain derivation.

Impact Analysis:

  • The unlockWallet method is fundamental to wallet authentication
  • It's used by Login screen, store sagas, Card authentication, OAuth rehydration, and security settings
  • The change is in a critical path (app/core/) but is a targeted, well-tested fix

Why these tags:

  1. SmokeAccounts: Tests account security and management which relies on authentication. Includes password-related flows like reveal SRP, wallet details, and account management.
  2. SmokeWalletPlatform: Tests core wallet features including multi-SRP architecture and wallet lifecycle which depend on authentication.

Why not more tags:

  • The change is a bug fix that makes behavior more correct (handling empty string passwords explicitly)
  • Unit tests have been added covering the specific behavior change
  • Most E2E tests use non-empty passwords, so the edge case being fixed is unlikely to affect them
  • The change doesn't alter the fundamental authentication flow, just how empty passwords are handled

Why not SmokeCard:

  • While Card components import Authentication, the Card tests focus on Card-specific UI flows rather than authentication edge cases

View GitHub Actions results

@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Jan 23, 2026

Quality Gate Failed Quality Gate failed

Failed conditions
E Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@github-project-automation github-project-automation bot moved this from Needs dev review to Review finalised - Ready to be merged in PR review queue Jan 23, 2026
@Cal-L Cal-L added this pull request to the merge queue Jan 23, 2026
Merged via the queue into main with commit de1c060 Jan 23, 2026
97 of 98 checks passed
@Cal-L Cal-L deleted the chore/MCWP-238-improve-unlock-wallet branch January 23, 2026 20:04
@github-actions github-actions bot locked and limited conversation to collaborators Jan 23, 2026
@github-actions github-actions bot removed the needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) label Jan 23, 2026
@metamaskbot metamaskbot added the release-7.65.0 Issue or pull request that will be included in release 7.65.0 label Jan 23, 2026
@metamaskbot metamaskbot added release-7.64.0 Issue or pull request that will be included in release 7.64.0 and removed release-7.65.0 Issue or pull request that will be included in release 7.65.0 labels Feb 3, 2026
@metamaskbot
Copy link
Copy Markdown
Collaborator

metamaskbot commented Feb 3, 2026

Missing release label release-7.64.0 on PR. Adding release label release-7.64.0 on PR and removing other release labels(release-7.65.0), as PR was added to branch 7.64.0 when release was cut.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

@tommasini tommasini tommasini approved these changes

Assignees

No one assigned

Labels

no changelog required No changelog entry is required for this change No QA Needed Apply this label when your PR does not need any QA effort. no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed release-7.64.0 Issue or pull request that will be included in release 7.64.0 size-S skip-sonar-cloud Only used for bypassing sonar cloud when failures are not relevant to the changes. team-mobile-platform Mobile Platform team

Projects

PR review queue
Archived in project

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@Cal-L @metamaskbot @tommasini