fix: Add PPOM validation for deeplink requests (#22473)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

This PR aims to add PPOM validation requests for deeplinks.

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: null

## **Related issues**

Fixes: MetaMask/mobile-planning#2370
Fixes: #17358

## **Manual testing steps**

```gherkin
Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [X] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [X] I've completed the PR template to the best of my ability
- [X] I’ve included tests if applicable
- [X] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [X] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Integrates PPOM validation into deeplink transfer/approve flows,
generating a securityAlertId and passing it to addTransaction, with
refactors and tests.
> 
> - **Deeplink handling
(`app/components/Views/confirmations/utils/deeplink.ts`)**:
> - Add `validateWithPPOM` to build a PPOM request (with uuid-based
`securityAlertId`) and call `ppomUtil.validateRequest`.
> - Pass returned `securityAlertResponse` to `addTransaction` for both
native and ERC20 transfers.
> - Refactor tx construction to derive `txParams` and `transactionType`;
downgrade duplicate-request log from error to log.
> - **Approve flow
(`app/core/DeeplinkManager/TransactionManager/approveTransaction.ts`)**:
> - Compute `chainId`/`networkClientId`, call `validateWithPPOM`, and
include `securityAlertResponse` in `addTransaction`.
> - **Tests**:
> - Extend deeplink and approve tests to mock PPOM and UUID, assert PPOM
validation payload, `securityAlertResponse`, and `networkClientId`
wiring.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
daa4941. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: OGPoyraz

app/components/Views/confirmations/utils/deeplink.test.ts

@@ -4,10 +4,12 @@ import { ETH_ACTIONS } from '../../../../constants/deeplinks';
 import { selectConfirmationRedesignFlagsFromRemoteFeatureFlags } from '../../../../selectors/featureFlagController/confirmations';
 import Engine from '../../../../core/Engine';
 import { generateTransferData } from '../../../../util/transactions';
+import ppomUtil from '../../../../lib/ppom/ppom-util';
 
 import {
   addTransactionForDeeplink,
   isDeeplinkRedesignedConfirmationCompatible,
+  validateWithPPOM,
   type DeeplinkRequest,
 } from './deeplink';
 
@@ -53,6 +55,14 @@ jest.mock('../../../../util/transactions', () => ({
   generateTransferData: jest.fn(),
 }));
 
+jest.mock('../../../../lib/ppom/ppom-util', () => ({
+  validateRequest: jest.fn(),
+}));
+
+jest.mock('uuid', () => ({
+  v4: jest.fn(),
+}));
+
 describe('isDeeplinkRedesignedConfirmationCompatible', () => {
   const enabledTransferFlags = {
     approve: false,
@@ -161,6 +171,9 @@ describe('addTransactionForDeeplink', () => {
         networkClientId: 'another-network',
         origin: ORIGIN_MOCK,
         type: TransactionType.simpleSend,
+        securityAlertResponse: {
+          securityAlertId: undefined,
+        },
       },
     );
   });
@@ -184,6 +197,9 @@ describe('addTransactionForDeeplink', () => {
         networkClientId: 'mainnet',
         origin: ORIGIN_MOCK,
         type: TransactionType.simpleSend,
+        securityAlertResponse: {
+          securityAlertId: undefined,
+        },
       },
     );
   });
@@ -245,6 +261,50 @@ describe('addTransactionForDeeplink', () => {
         networkClientId: 'mainnet',
         origin: ORIGIN_MOCK,
         type: TransactionType.tokenMethodTransfer,
+        securityAlertResponse: {
+          securityAlertId: undefined,
+        },
+      },
+    );
+  });
+});
+
+describe('validateWithPPOM', () => {
+  const mockPpomUtil = jest.mocked(ppomUtil);
+  const mockUuid = jest.requireMock('uuid').v4;
+
+  const txParams = {
+    from: '0x0b2C639c533813f4Aa9D7837CAf62653d097Ff85',
+    to: '0x6D404AfE1a6A07Aa3CbcBf9Fd027671Df628ebFc',
+    value: '0x3e8',
+  };
+  const origin = 'example.test-dapp.com';
+  const chainId = '0x1';
+  const networkClientId = 'mainnet';
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockUuid.mockReturnValue('test-uuid-123');
+  });
+
+  it('calls ppomUtil.validateRequest with correct parameters', () => {
+    validateWithPPOM({ txParams, origin, chainId, networkClientId });
+
+    expect(mockPpomUtil.validateRequest).toHaveBeenCalledWith(
+      {
+        id: 'test-uuid-123',
+        jsonrpc: '2.0',
+        method: 'eth_sendTransaction',
+        origin: 'example.test-dapp.com',
+        params: [txParams],
+      },
+      {
+        transactionMeta: {
+          chainId: '0x1',
+          networkClientId: 'mainnet',
+          txParams,
+        },
+        securityAlertId: 'test-uuid-123',
       },
     );
   });

app/components/Views/confirmations/utils/deeplink.ts

@@ -2,10 +2,13 @@ import {
   CHAIN_IDS,
   TransactionType,
   type TransactionParams,
+  type SecurityAlertResponse,
+  type TransactionMeta,
 } from '@metamask/transaction-controller';
 import { Hex } from '@metamask/utils';
 import { toHex } from '@metamask/controller-utils';
 import { ParseOutput } from 'eth-url-parser';
+import { v4 as uuid } from 'uuid';
 
 import { selectConfirmationRedesignFlagsFromRemoteFeatureFlags } from '../../../../selectors/featureFlagController/confirmations';
 import { addTransaction } from '../../../../util/transaction-controller';
@@ -15,6 +18,7 @@ import { getGlobalNetworkClientId } from '../../../../util/networks/global-netwo
 import { ETH_ACTIONS } from '../../../../constants/deeplinks';
 import Engine from '../../../../core/Engine';
 import Logger from '../../../../util/Logger';
+import ppomUtil from '../../../../lib/ppom/ppom-util';
 
 export type DeeplinkRequest = ParseOutput & { origin: string };
 
@@ -68,7 +72,7 @@ export async function addTransactionForDeeplink({
 
   // Temporary solution for preventing back to back deeplink requests
   if (isAddingDeeplinkTransaction) {
-    Logger.error(new Error('Cannot add another deeplink transaction'));
+    Logger.log('Cannot add another deeplink transaction');
     return;
   }
 
@@ -92,36 +96,72 @@ export async function addTransactionForDeeplink({
     parameters?.address ?? '',
   );
 
-  if (function_name === ETH_ACTIONS.TRANSFER) {
-    // ERC20 transfer
-    const txParams: TransactionParams = {
-      from,
-      to,
-      data: generateTransferData('transfer', {
-        toAddress: checkSummedParamAddress,
-        amount: toHex(parameters?.uint256 as string),
-      }),
-    };
-
-    await addTransaction(txParams, {
-      networkClientId,
-      origin,
-      type: TransactionType.tokenMethodTransfer,
-    });
-  } else {
-    // Native transfer
-    const txParams: TransactionParams = {
-      from,
-      to,
-      value: toHex(parameters?.value as string),
-    };
-
-    await addTransaction(txParams, {
-      networkClientId,
-      origin,
-      type: TransactionType.simpleSend,
-    });
-  }
+  const isErc20Transfer = function_name === ETH_ACTIONS.TRANSFER;
+
+  const txParams: TransactionParams = isErc20Transfer
+    ? {
+        from,
+        to,
+        data: generateTransferData('transfer', {
+          toAddress: checkSummedParamAddress,
+          amount: toHex(parameters?.uint256 as string),
+        }),
+      }
+    : {
+        from,
+        to,
+        value: toHex(parameters?.value as string),
+      };
+
+  const transactionType = isErc20Transfer
+    ? TransactionType.tokenMethodTransfer
+    : TransactionType.simpleSend;
+
+  const securityAlertResponse = validateWithPPOM({
+    txParams,
+    origin,
+    chainId,
+    networkClientId,
+  });
+
+  await addTransaction(txParams, {
+    networkClientId,
+    origin,
+    type: transactionType,
+    securityAlertResponse,
+  });
 
   isAddingDeeplinkTransaction = false;
 }
+
+export function validateWithPPOM({
+  txParams,
+  origin,
+  chainId,
+  networkClientId,
+}: {
+  txParams: TransactionParams;
+  origin: string;
+  chainId: Hex;
+  networkClientId: string;
+}) {
+  const securityAlertId = uuid();
+  ppomUtil.validateRequest(
+    {
+      id: securityAlertId,
+      jsonrpc: '2.0',
+      method: 'eth_sendTransaction',
+      origin,
+      params: [txParams],
+    },
+    {
+      transactionMeta: {
+        chainId,
+        networkClientId,
+        txParams,
+      } as TransactionMeta,
+      securityAlertId,
+    },
+  );
+  return { securityAlertId } as SecurityAlertResponse;
+}

app/core/DeeplinkManager/TransactionManager/approveTransaction.test.ts

@@ -8,6 +8,7 @@ import approveTransaction from './approveTransaction';
 import { addTransaction } from '../../../util/transaction-controller';
 import { createMockInternalAccount } from '../../../util/test/accountsControllerTestUtils';
 import { toHex } from '@metamask/controller-utils';
+import { validateWithPPOM } from '../../../components/Views/confirmations/utils/deeplink';
 
 const MOCK_SENDER_ADDRESS = '0xMockSenderAddress';
 const MOCK_TARGET_ADDRESS = '0xTargetAddress';
@@ -46,6 +47,7 @@ jest.mock('../../../util/transaction-controller', () => ({
   __esModule: true,
   addTransaction: jest.fn(),
 }));
+jest.mock('../../../components/Views/confirmations/utils/deeplink');
 
 const mockEthUrl = {
   parameters: { uint256: '123', address: '0xMockAddress' },
@@ -85,11 +87,19 @@ describe('approveTransaction', () => {
     'showSimpleNotification',
   );
 
+  const spyValidateWithPPOM = validateWithPPOM as jest.Mock;
+
+  const spyFindNetworkClientIdByChainId = jest.spyOn(
+    Engine.context.NetworkController,
+    'findNetworkClientIdByChainId',
+  );
+
   beforeEach(() => {
     jest.clearAllMocks();
 
     spyGetNetworkTypeById.mockReturnValue('fakeNetworkType');
     spyGenerateApproveData.mockReturnValue('fakeApproveData');
+    spyFindNetworkClientIdByChainId.mockReturnValue('mockNetworkClientId');
   });
 
   it('should call setProviderType with the correct network type', async () => {
@@ -151,7 +161,9 @@ describe('approveTransaction', () => {
       },
       {
         deviceConfirmedOn: 'metamask_mobile',
+        networkClientId: 'mockNetworkClientId',
         origin: mockOrigin,
+        securityAlertResponse: undefined,
       },
     );
   });
@@ -304,4 +316,30 @@ describe('approveTransaction', () => {
 
     expect(spySetProviderType).toHaveBeenCalledWith(fakeNetworkType);
   });
+
+  it('calls validateWithPPOM with the correct parameters', async () => {
+    spyGetAddress.mockResolvedValue('0xMockAddress');
+
+    await approveTransaction({
+      // TODO: Replace "any" with type
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      deeplinkManager: mockDeeplinkManager as any,
+      // TODO: Replace "any" with type
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      ethUrl: mockEthUrl as any,
+      origin: mockOrigin,
+    });
+
+    expect(spyValidateWithPPOM).toHaveBeenCalledWith({
+      txParams: {
+        to: MOCK_TARGET_ADDRESS,
+        from: MOCK_SENDER_ADDRESS,
+        value: '0x0',
+        data: 'fakeApproveData',
+      },
+      origin: mockOrigin,
+      chainId: toHex(mockEthUrl.chain_id),
+      networkClientId: 'mockNetworkClientId',
+    });
+  });
 });

app/core/DeeplinkManager/TransactionManager/approveTransaction.ts

@@ -3,6 +3,7 @@ import { generateApprovalData } from '../../../util/transactions';
 import { ParseOutput } from 'eth-url-parser';
 import { strings } from '../../../../locales/i18n';
 import { getAddress } from '../../../util/address';
+import { validateWithPPOM } from '../../../components/Views/confirmations/utils/deeplink';
 import { addTransaction } from '../../../util/transaction-controller';
 import DeeplinkManager from '../DeeplinkManager';
 import Engine from '../../Engine';
@@ -70,14 +71,22 @@ async function approveTransaction({
     data: generateApprovalData({ spender: spenderAddress, value }),
   };
 
-  const networkClientId = NetworkController.findNetworkClientIdByChainId(
-    toHexOrFallback(chain_id as string),
-  );
+  const chainId = toHexOrFallback(chain_id as string);
+  const networkClientId =
+    NetworkController.findNetworkClientIdByChainId(chainId);
+
+  const securityAlertResponse = validateWithPPOM({
+    txParams,
+    origin,
+    chainId,
+    networkClientId,
+  });
 
   addTransaction(txParams, {
     deviceConfirmedOn: WalletDevice.MM_MOBILE,
     networkClientId,
     origin,
+    securityAlertResponse,
   });
 }