feat: send the MetaMask auth token to built-in Infura endpoints

packages/network-controller/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Add optional `getInfuraAuthToken` constructor option, a function returning a token to present as a bearer credential in the `Authorization` header on requests to built-in Infura RPC endpoints ([#9927](https://github.com/MetaMask/core/pull/9927))
+  - Only endpoints of type `infura` (those reached through `infuraProjectId`) carry the token. Custom RPC endpoints and failover endpoints never do, even when hosted by Infura, so a user-supplied Infura key is never paired with it.
+  - The function is called once per request. If it returns `undefined` or throws, the request is made without the credential.
+
 ### Changed
 
 - **BREAKING:** `NetworkControllerMessenger` now requires the `ConfigRegistryController:stateChanged` event and `ConfigRegistryController:getNetworkConfigByCaip2ChainId` action to be delegated from the root messenger ([#9879](https://github.com/MetaMask/core/pull/9879))

packages/network-controller/src/NetworkController.ts

@@ -795,6 +795,21 @@ export type NetworkControllerOptions = {
   getBlockTrackerOptions?: (
     rpcEndpointUrl: string,
   ) => Omit<PollingBlockTrackerOptions, 'provider'>;
+  /**
+   * A function that returns the MetaMask authentication token to present as a
+   * bearer credential on requests to built-in Infura RPC endpoints, i.e. those
+   * of type `infura`, which are reached through `infuraProjectId`. The token
+   * travels in the `Authorization` header alongside the project ID in the URL;
+   * it is not an Infura-issued JWT (which uses the same header and is not
+   * supported).
+   *
+   * The function is called once per request, so a token refreshed during the
+   * lifetime of a network client is picked up on the next request. If it
+   * returns `undefined` or throws, the request is made without the credential.
+   * Requests to custom RPC endpoints and to failover endpoints never carry the
+   * token, even when the endpoint is hosted by Infura.
+   */
+  getInfuraAuthToken?: () => Promise<string | undefined>;
   /**
    * Configuration for the "RPC Service Unavailable" and "RPC Service Degraded"
    * analytics events the controller emits via the `AnalyticsController:trackEvent`
@@ -1305,6 +1320,8 @@ export class NetworkController extends BaseController<
 
   readonly #getBlockTrackerOptions: NetworkControllerOptions['getBlockTrackerOptions'];
 
+  readonly #getInfuraAuthToken: NetworkControllerOptions['getInfuraAuthToken'];
+
   readonly #analyticsOptions: ResolvedNetworkControllerAnalyticsOptions;
 
   #networkConfigurationsByNetworkClientId: Map<
@@ -1328,6 +1345,7 @@ export class NetworkController extends BaseController<
       log,
       getRpcServiceOptions,
       getBlockTrackerOptions,
+      getInfuraAuthToken,
       analyticsOptions,
     } = options;
     const initialState = {
@@ -1372,6 +1390,7 @@ export class NetworkController extends BaseController<
     this.#log = log;
     this.#getRpcServiceOptions = getRpcServiceOptions;
     this.#getBlockTrackerOptions = getBlockTrackerOptions;
+    this.#getInfuraAuthToken = getInfuraAuthToken;
     this.#analyticsOptions = {
       isRpcEndpointUrlPublic: (): boolean => false,
       rpcServiceEventsSampleRate: 0,
@@ -2866,6 +2885,7 @@ export class NetworkController extends BaseController<
           },
           getRpcServiceOptions: this.#getRpcServiceOptions,
           getBlockTrackerOptions: this.#getBlockTrackerOptions,
+          getInfuraAuthToken: this.#getInfuraAuthToken,
           messenger: this.messenger,
           rpcFailoverMode: this.#rpcFailoverMode,
           logger: this.#log,
@@ -2885,6 +2905,7 @@ export class NetworkController extends BaseController<
           },
           getRpcServiceOptions: this.#getRpcServiceOptions,
           getBlockTrackerOptions: this.#getBlockTrackerOptions,
+          getInfuraAuthToken: this.#getInfuraAuthToken,
           messenger: this.messenger,
           rpcFailoverMode: this.#rpcFailoverMode,
           logger: this.#log,
@@ -3051,6 +3072,7 @@ export class NetworkController extends BaseController<
               },
               getRpcServiceOptions: this.#getRpcServiceOptions,
               getBlockTrackerOptions: this.#getBlockTrackerOptions,
+              getInfuraAuthToken: this.#getInfuraAuthToken,
               messenger: this.messenger,
               rpcFailoverMode: this.#rpcFailoverMode,
               logger: this.#log,
@@ -3070,6 +3092,7 @@ export class NetworkController extends BaseController<
             },
             getRpcServiceOptions: this.#getRpcServiceOptions,
             getBlockTrackerOptions: this.#getBlockTrackerOptions,
+            getInfuraAuthToken: this.#getInfuraAuthToken,
             messenger: this.messenger,
             rpcFailoverMode: this.#rpcFailoverMode,
             logger: this.#log,

packages/network-controller/src/create-auto-managed-network-client.test.ts

@@ -156,13 +156,15 @@ describe('createAutoManagedNetworkClient', () => {
           const getBlockTrackerOptions = (): PollingBlockTrackerOptions => ({
             pollingInterval: 5000,
           });
+          const getInfuraAuthToken = async (): Promise<string> => 'some-token';
           const messenger = buildNetworkControllerMessenger();
 
           const { provider } = createAutoManagedNetworkClient({
             networkClientId: 'some-network-client-id',
             networkClientConfiguration,
             getRpcServiceOptions,
             getBlockTrackerOptions,
+            getInfuraAuthToken,
             messenger,
             rpcFailoverMode: 'enabled',
           });
@@ -185,6 +187,7 @@ describe('createAutoManagedNetworkClient', () => {
             configuration: networkClientConfiguration,
             getRpcServiceOptions,
             getBlockTrackerOptions,
+            getInfuraAuthToken,
             messenger,
             rpcFailoverMode: 'enabled',
           });

packages/network-controller/src/create-auto-managed-network-client.ts

@@ -77,6 +77,8 @@ const UNINITIALIZED_TARGET = { __UNINITIALIZED__: true };
  * options. See {@link NetworkControllerOptions.getRpcServiceOptions}.
  * @param args.getBlockTrackerOptions - Factory for constructing block tracker
  * options. See {@link NetworkControllerOptions.getBlockTrackerOptions}.
+ * @param args.getInfuraAuthToken - Returns the token to present on requests to
+ * a built-in Infura endpoint. See {@link NetworkControllerOptions.getInfuraAuthToken}.
  * @param args.messenger - The network controller messenger.
  * @param args.rpcFailoverMode - The RPC failover mode to apply: `disabled`,
  * `enabled` (divert to the failover URLs when the primary is unavailable), or
@@ -95,6 +97,7 @@ export function createAutoManagedNetworkClient<
     PollingBlockTrackerOptions,
     'provider'
   > => ({}),
+  getInfuraAuthToken,
   messenger,
   rpcFailoverMode: givenRpcFailoverMode,
   logger,
@@ -107,6 +110,7 @@ export function createAutoManagedNetworkClient<
   getBlockTrackerOptions?: (
     rpcEndpointUrl: string,
   ) => Omit<PollingBlockTrackerOptions, 'provider'>;
+  getInfuraAuthToken?: () => Promise<string | undefined>;
   messenger: NetworkControllerMessenger;
   rpcFailoverMode: RpcFailoverMode;
   logger?: Logger;
@@ -120,6 +124,7 @@ export function createAutoManagedNetworkClient<
       configuration: networkClientConfiguration,
       getRpcServiceOptions,
       getBlockTrackerOptions,
+      getInfuraAuthToken,
       messenger,
       rpcFailoverMode,
       logger,