Description

Tier 2 of MMQA-1364 (allowlist reduction). Adds default mock matchers for three categories of static asset / health-check requests, then removes the corresponding entries from mock-e2e-allowlist.ts.

Why regex, not exact URLs. The previous allowlist enumerated five specific token icons that today's specs happened to load. Any new spec, new default token, branch rename (master → main), or platform-subset divergence would reintroduce live requests. Regex matchers cover the entire category (any branch, any future token icon) with one entry — a one-time fix instead of a moving target.

generate_204 origin. Confirmed it is fired by @react-native-community/netinfo's InternetReachability._checkInternetReachability via JS-layer fetch. That path is patched by shim.js, so the request reaches mockttp at /proxy?url=… and the matcher fires. (Method is HEAD, hence the new HEAD field on DEFAULT_MOCKS.)

Files changed

• tests/api-mocking/mock-responses/defaults/static-assets.ts — new default mock file with the three matchers
• tests/api-mocking/mock-responses/defaults/index.ts — imported and spread into DEFAULT_MOCKS.GET + new HEAD field
• tests/api-mocking/mock-e2e-allowlist.ts — removed 7 entries (1 generate_204, 5 GitHub raw token SVGs, 1 token.api nativeCurrencyLogos ethereum.svg)

Out of scope

• https://api.avax.network/ext/bc/C/rpc — Tier 4 investigation
• https://metamask.github.io/test-dapp/metamask-fox.svg — handled by MMQA-1367
• Polymarket hosts — separate follow-up tracked in MMQA-1755

Changelog

CHANGELOG entry: null

Related issues

MMQA-1778 — parent epic MMQA-1364

Manual testing steps

Feature: Static asset mocks for E2E tests

  Scenario: NetInfo reachability probe is mocked
    Given the E2E mock server is running with default mocks loaded
    When the app fires the NetInfo reachability probe (HEAD https://clients3.google.com/generate_204)
    Then mockttp returns 204 with empty body
    And validateLiveRequests() does not record a live request

  Scenario: Token icon SVGs are mocked
    Given a spec loads a token list that includes contract-metadata icons
    When the app requests https://raw.githubusercontent.com/MetaMask/contract-metadata/<branch>/images/<token>.svg
    Then mockttp returns 200 with a placeholder SVG
    And the request never reaches GitHub live

  Scenario: Native currency logo SVGs are mocked
    Given a spec loads a chain whose native currency logo is fetched from token.api
    When the app requests https://token.api.cx.metamask.io/assets/nativeCurrencyLogos/<chain>.svg
    Then mockttp returns 200 with a placeholder SVG
    And the request never reaches the live token.api endpoint

Screenshots/Recordings

Before

tests/api-mocking/mock-e2e-allowlist.ts allowlisted 7 entries that bypassed validateLiveRequests():

What this meant on every E2E run:

• NetInfo's reachability probe fired a live HEAD https://clients3.google.com/generate_204 and Google answered. The allowlist silenced the warning, so validateLiveRequests() did not flag it.
• 5 GitHub raw SVG fetches went live whenever notifications rendered token icons (USDC/SHIB/USDT/stETH/rETH from the mocked notification fixtures in @metamask/notification-services-controller).
• 1 token.api SVG went live whenever the Ethereum native-currency logo was loaded (referenced in app/constants/urls.ts:144 and the Ramp Quotes constants).

After

Allowlist with the 7 entries gone — ALLOWLISTED_URLS drops from 16 to 9:

What happens on every E2E run now:

• NetInfo reachability probe → mockttp returns 204 with empty body. NetInfo's reachabilityTest (response.status === 204) passes; the wallet sees the network as reachable. No live request to Google.
• Notification SVG fetches → mockttp returns a placeholder SVG (<svg xmlns="http://www.w3.org/2000/svg"/>). Icons render (visual fidelity not asserted in E2E). No live request to raw.githubusercontent.com for any token icon — current or future.
• Native currency logo fetch → same placeholder SVG. No live request to token.api.cx.metamask.io for any chain's logo.
• validateLiveRequests() records zero leaks for these endpoints.

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

• I've tested on Android
  • Ideally on a mid-range device; emulator is acceptable
• I've tested with a power user scenario
  • Use these power-user SRPs to import wallets with many accounts and tokens
• I've instrumented key operations with Sentry traces for production performance metrics
  • See trace() for usage and addToken for an example

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.