Added getAccounts suppressUnauthorized param

src/wallet.ts

@@ -21,7 +21,12 @@ interface TypedMessageParams extends MessageParams {
   version: string;
 }
 interface WalletMiddlewareOptions {
-  getAccounts: (req: JsonRpcRequest<unknown>) => Promise<string[]>;
+  getAccounts: (
+    req: JsonRpcRequest<unknown>,
+    options?: {
+      suppressUnauthorized?: boolean;
+    },
+  ) => Promise<string[]>;
   processDecryptMessage?: (
     msgParams: MessageParams,
     req: JsonRpcRequest<unknown>,
@@ -376,9 +381,17 @@ export function createWalletMiddleware({
     address: string,
     req: JsonRpcRequest<unknown>,
   ): Promise<string> {
-    if (typeof address === 'string' && address.length > 0) {
-      // ensure address is included in provided accounts
-      const accounts: string[] = await getAccounts(req);
+    if (
+      typeof address === 'string' &&
+      address.length > 0 &&
+      resemblesAddress(address)
+    ) {
+      // ensure address is included in provided accounts. `suppressUnauthorized: false` is passed to `getAccounts`
+      // so that an "unauthorized" error is thrown if the requester does not have the `eth_accounts`
+      // permission.
+      const accounts: string[] = await getAccounts(req, {
+        suppressUnauthorized: false,
+      });
       const normalizedAccounts: string[] = accounts.map((_address) =>
         _address.toLowerCase(),
       );
@@ -387,6 +400,7 @@ export function createWalletMiddleware({
       if (normalizedAccounts.includes(normalizedAddress)) {
         return normalizedAddress;
       }
+      throw ethErrors.provider.unauthorized();
     }
     throw ethErrors.rpc.invalidParams({
       message: `Invalid parameters: must provide an Ethereum address.`,

test/wallet.test.ts

@@ -91,7 +91,7 @@ describe('wallet', () => {
       };
       engine.push(createWalletMiddleware({ getAccounts, processTransaction }));
       const txParams = {
-        from: testUnkownAddress,
+        from: '0x3d',
       };
 
       const payload = { method: 'eth_sendTransaction', params: [txParams] };
@@ -103,6 +103,26 @@ describe('wallet', () => {
         );
       }
     });
+
+    it('throws unauthorized for unknown addresses', async () => {
+      const { engine } = createTestSetup();
+      const getAccounts = async () => testAddresses.slice(0, 2);
+      const witnessedTxParams: TransactionParams[] = [];
+      const processTransaction = async (_txParams: TransactionParams) => {
+        witnessedTxParams.push(_txParams);
+        return testTxHash;
+      };
+      engine.push(createWalletMiddleware({ getAccounts, processTransaction }));
+      const txParams = {
+        from: testUnkownAddress,
+      };
+
+      const payload = { method: 'eth_sendTransaction', params: [txParams] };
+      const promise = pify(engine.handle).call(engine, payload);
+      await expect(promise).rejects.toThrow(
+        'The requested account and/or method has not been authorized by the user.',
+      );
+    });
   });
 
   describe('signTransaction', () => {
@@ -144,7 +164,7 @@ describe('wallet', () => {
         createWalletMiddleware({ getAccounts, processSignTransaction }),
       );
       const txParams = {
-        from: testAddresses[0],
+        from: '0x3',
       };
 
       const payload = { method: 'eth_signTransaction', params: [txParams] };
@@ -156,6 +176,29 @@ describe('wallet', () => {
         );
       }
     });
+
+    it('should throw when provided unknown address', async () => {
+      const { engine } = createTestSetup();
+      const getAccounts = async () => testAddresses.slice(0, 2);
+      const witnessedTxParams: TransactionParams[] = [];
+      const processSignTransaction = async (_txParams: TransactionParams) => {
+        witnessedTxParams.push(_txParams);
+        return testTxHash;
+      };
+
+      engine.push(
+        createWalletMiddleware({ getAccounts, processSignTransaction }),
+      );
+      const txParams = {
+        from: testUnkownAddress,
+      };
+
+      const payload = { method: 'eth_signTransaction', params: [txParams] };
+      const promise = pify(engine.handle).call(engine, payload);
+      await expect(promise).rejects.toThrow(
+        'The requested account and/or method has not been authorized by the user.',
+      );
+    });
   });
 
   describe('signTypedData', () => {
@@ -213,7 +256,7 @@ describe('wallet', () => {
 
       const payload = {
         method: 'eth_signTypedData',
-        params: [message, testUnkownAddress],
+        params: [message, '0x3d'],
       };
       try {
         await pify(engine.handle).call(engine, payload);
@@ -223,6 +266,34 @@ describe('wallet', () => {
         );
       }
     });
+
+    it('should throw with unknown address', async () => {
+      const { engine } = createTestSetup();
+      const getAccounts = async () => testAddresses.slice();
+      const witnessedMsgParams: MessageParams[] = [];
+      const processTypedMessage = async (msgParams: MessageParams) => {
+        witnessedMsgParams.push(msgParams);
+        return testMsgSig;
+      };
+
+      engine.push(createWalletMiddleware({ getAccounts, processTypedMessage }));
+      const message = [
+        {
+          type: 'string',
+          name: 'message',
+          value: 'Hi, Alice!',
+        },
+      ];
+
+      const payload = {
+        method: 'eth_signTypedData',
+        params: [message, testUnkownAddress],
+      };
+      const promise = pify(engine.handle).call(engine, payload);
+      await expect(promise).rejects.toThrow(
+        'The requested account and/or method has not been authorized by the user.',
+      );
+    });
   });
 
   describe('sign', () => {
@@ -272,7 +343,7 @@ describe('wallet', () => {
       const message = 'haay wuurl';
       const payload = {
         method: 'personal_sign',
-        params: [message, testUnkownAddress],
+        params: [message, '0x3d'],
       };
 
       try {
@@ -283,6 +354,31 @@ describe('wallet', () => {
         );
       }
     });
+
+    it('should error when provided unknown address', async () => {
+      const { engine } = createTestSetup();
+      const getAccounts = async () => testAddresses.slice();
+      const witnessedMsgParams: MessageParams[] = [];
+      const processPersonalMessage = async (msgParams: MessageParams) => {
+        witnessedMsgParams.push(msgParams);
+        return testMsgSig;
+      };
+
+      engine.push(
+        createWalletMiddleware({ getAccounts, processPersonalMessage }),
+      );
+
+      const message = 'haay wuurl';
+      const payload = {
+        method: 'personal_sign',
+        params: [message, testUnkownAddress],
+      };
+
+      const promise = pify(engine.handle).call(engine, payload);
+      await expect(promise).rejects.toThrow(
+        'The requested account and/or method has not been authorized by the user.',
+      );
+    });
   });
 
   describe('personalRecover', () => {