Description

Card: authentication and session state → CardController

This PR migrates Card authentication to CardController so session state is no longer owned by the Redux card slice and coordinated through Card SDK helpers (logout, resetAuthenticatedData, global CardVerification, etc.). Call sites use Engine.context.CardController and selectIsCardAuthenticated (and related selectors in app/selectors/cardController.ts) as the source of truth.

Why: One place for sign-in state, logout, token/session refresh, and cardholder checks avoids duplicated logic between Redux and the SDK and removes the old side-effect verification flow.

What changed (Card-focused):

• CardAuthentication + useCardAuth
  • Removes useCardProviderAuthentication (hook deleted; large test file removed). The screen uses useCardAuth for the login / OTP flow, with resetToLogin on useCardAuth to reset mutations and step state.
  • CardAuthentication.test.tsx expanded; snapshot updated.
• CardController
  • Owns isAuthenticated, session/cardholder fields, and logout() / validateAndRefreshSession(); expanded CardController.test.ts, messenger, and types.
• Selectors (app/selectors/cardController.ts)
  • UI and hooks read selectIsCardAuthenticated, selectCardholderAccounts, selectIsCardholder, selectCardUserLocation, etc., instead of Redux auth fields.
• Redux card slice
  • Removes auth-related state and actions; slice keeps onboarding-only concerns (e.g. IDs, hasViewedCardButton).
• Card SDK (sdk/index.tsx)
  • Logout delegates to CardController.logout() instead of provider sdk.logout() + resetAuthenticatedData.
  • Removes CardVerification and the hooks it mounted.
  • fetchUserData updates controller location only when countryOfResidence is set (avoids bad auth/region sync when the API returns null); related fixes for nullable location / effectiveLocation to avoid unnecessary SDK reloads.
• Removed
  • useCardholderCheck, getCardholder, handleLocalAuthentication, useCardAuthenticationVerification (and tests).
• Screens / hooks / deeplinks
  • CardHome, CardWelcome, onboarding (SignUp, SetPhoneNumber, PhysicalAddress, etc.), EarnRewardsPreview, push provisioning, and legacy deeplink handlers updated to controller-backed auth; tests adjusted.
• Onboarding (OnboardingNavigator.tsx)
  • Fixes routing/modal edge cases for auth resume (ACCOUNT vs contactVerificationId, keep-going modal waits for user).
• Fixtures & tests
  • default-fixture.json; AddToWalletButton mock path fix.

Changelog

CHANGELOG entry: Card authentication and session/cardholder state are sourced from CardController and selectIsCardAuthenticated (and related selectors) instead of the Redux Card slice and Card SDK auth helpers; the global CardVerification flow and legacy auth utilities are removed.

Related issues

Fixes:

Manual testing steps

Feature: Card authentication via CardController

  Scenario: Session and sign-out
    Given I use Card with a provider account
    When I sign in, cold-start the app, or sign out
    Then authenticated state matches CardController and logout clears session as expected

  Scenario: Logout
    When I log out from Card
    Then CardController handles provider logout and local state clears without relying on removed Redux auth actions

  Scenario: Onboarding resume
    Given I am mid-onboarding with a non-ACCOUNT phase
    When I return to the onboarding flow
    Then I am not incorrectly sent to sign-up solely due to missing contact verification id

  Scenario: Keep-going modal
    Given a returning session with an in-progress phase
    When user data finishes loading
    Then the keep-going modal uses the correct step

  Scenario: Entry points still work
    Given Card entry from Earn (e.g. UK banner) or deeplinks
    When I navigate via those paths
    Then behavior matches pre-migration expectations

Screenshots/Recordings

Include Card home after login/logout and any onboarding resume path you exercised while validating auth.

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.