test(e2e): mock Polymarket endpoints to remove from allowlist (MMQA-1800) (#29811)

chrisleewilcox · claude · web-flow · commit ea334d0b85f1 · 2026-05-08T14:47:44.000Z
## **Description** Removes both Polymarket entries from `ALLOWLISTED_HOSTS` by adding default mocks for the Polymarket endpoints fired by the wallet's Explore tab and shoring up several pre-existing test-mock gaps the wildcard had been masking. Parent epic [MMQA-1364](https://consensyssoftware.atlassian.net/browse/MMQA-1364). **Why these were allowlisted in the first place** The wallet's Explore tab (`TrendingView` / `usePredictMarketData`) fetches data from `gamma-api.polymarket.com` and other Polymarket hosts when rendered. Many specs pass through Explore on the way to the browser — `tests/flows/browser.flow.ts:118` calls `navigateToBrowserView()` via `Explore → Trending → Browser`, so Polymarket calls fire across many specs that have nothing to do with prediction markets. **What this PR adds** 1. **New default mocks under `defaults/polymarket-apis.ts`** for the Explore-render endpoints: | Endpoint | Default response | | --- | --- | | `gamma-api.polymarket.com/events/pagination?...` | `{ data: [] }` | | `gamma-api.polymarket.com/public-search?...` | `{ events: [] }` | | `gamma-api.polymarket.com/markets?...` | `[]` | | `gamma-api.polymarket.com/teams?...` | `[]` (defensive — non-predict specs that hit the new TeamsCache get an empty payload to absorb the leak) | | `polymarket.com/api/homepage/carousel` | `[]` | | `polymarket.com/api/crypto/crypto-price?...` | `{}` | | `data-api.polymarket.com/positions?...` | `[]` | | `data-api.polymarket.com/activity?...` | `[]` | | `data-api.polymarket.com/upnl?...` | `[]` | `gamma-api.polymarket.com/events/{id}` and `events?parent_event_id=...` are intentionally **not** in defaults — empty payloads for those routes caused the wallet's detail screens to render the legacy layout (no picks list). They're now covered by spec-specific mocks instead. 2. **Extended `POLYMARKET_COMPLETE_MOCKS`** with two new helpers: - `POLYMARKET_PRICES_HISTORY_MOCKS` — `clob.polymarket.com/prices-history` returning `{ history: [] }`. Predict happy-path specs were making live calls here via the wildcard. - `POLYMARKET_TEAMS_MOCKS` — `gamma-api.polymarket.com/teams?league=...` returning realistic NBA + NFL team rosters via a callback. Required because the new `TeamsCache`/`buildGameData` path (recently added on main) drops `market.game` to `undefined` when teams aren't found, causing `PredictMarketDetails.tsx:370` to render the legacy layout (no picks list, no cash-out button). 3. **Tightened `POLYMARKET_EVENT_DETAILS_MOCKS`**: - Bumped to explicit `PRIORITY.BASE` (was at default mockttp priority, tied with the proxy fallback handler — the wildcard was masking cases where the fallback won). - Tightened matcher to `/events/{numericId}` only, after Cursor Bugbot flagged that `includes('events/')` also matches `events/pagination` because `events/` is a substring of `events/pagination`. The new regex `gamma-api\.polymarket\.com\/events\/[0-9]+` ensures pagination requests fall through to their dedicated mock regardless of registration order. 4. **Extended `trending-api-mocks.ts`** with three new entries used by the trending feed's prediction detail flow: - `gamma-api.polymarket.com/events/1` returning the same Bitcoin event payload as the existing `events/pagination` mock - `clob.polymarket.com/prices-history` returning `{ history: [] }` - `clob.polymarket.com/prices` (POST) returning `{}` **Allowlist entries removed:** - `gamma-api.polymarket.com` (was redundant — covered by the wildcard) - `*.polymarket.com` (covered all subdomains + apex) `ALLOWLISTED_HOSTS` is now down to **5** entries: 4 local + `metamask.github.io`. ## **Changelog** CHANGELOG entry: null ## **Related issues** [MMQA-1800](https://consensyssoftware.atlassian.net/browse/MMQA-1800) Parent epic: [MMQA-1364](https://consensyssoftware.atlassian.net/browse/MMQA-1364) Fixes: ## **Manual testing steps** ```gherkin Feature: E2E mock coverage for Polymarket Explore-tab calls Scenario: browser specs that pass through Explore no longer leak Polymarket requests Given an E2E spec calls navigateToBrowserView() And the flow taps Explore → Trending → Browser When TrendingView renders sports market feeds via usePredictMarketData Then requests to gamma-api.polymarket.com (events/pagination, public-search, markets, teams) are answered by the default mocks And requests to data-api.polymarket.com (positions, activity, upnl) are answered by the default mocks And requests to polymarket.com (homepage/carousel, crypto/crypto-price) are answered by the default mocks And no entries for Polymarket hosts are required in mock-e2e-allowlist.ts Scenario: predict specs render market detail with picks list and cash-out button Given the spec registers POLYMARKET_COMPLETE_MOCKS as its testSpecificMock And the production default for predictLiveSports has leagues ['nfl','nba'] When the test taps a position and navigates to PredictMarketDetails Then gamma-api.polymarket.com/teams returns realistic team payloads for the requested league And buildGameData populates market.game with home/away team data And PredictMarketDetails renders PredictGameDetailsContent with the picks list And the predict-picks-cash-out-button-{positionId} element is present for the test to tap Scenario: trending-feed renders prediction detail without leaking Given the spec registers TRENDING_API_MOCKS as its testSpecificMock When the test taps a prediction row and the wallet navigates to the detail screen Then events/{id}, prices, and prices-history are answered by the trending mocks And the spec passes without a live request leak ``` ## **Screenshots/Recordings** ### **Before** `tests/api-mocking/mock-e2e-allowlist.ts`: ```ts export const ALLOWLISTED_HOSTS = [ '0.0.0.0', '127.0.0.1', 'localhost', '10.0.2.2', 'gamma-api.polymarket.com', '*.polymarket.com', 'metamask.github.io', ]; ``` `tests/api-mocking/mock-responses/defaults/polymarket-apis.ts` had a single entry: the geoblock mock. All other Polymarket calls leaked to live via the wildcard, masking gaps in test-specific mocks. ### **After** `tests/api-mocking/mock-e2e-allowlist.ts`: ```ts export const ALLOWLISTED_HOSTS = [ '0.0.0.0', '127.0.0.1', 'localhost', '10.0.2.2', 'metamask.github.io', ]; ``` `defaults/polymarket-apis.ts` now has 10 default GET matchers (geoblock + 9 new) covering Explore-render endpoints. `POLYMARKET_COMPLETE_MOCKS` covers `clob.polymarket.com/prices-history` and `gamma-api.polymarket.com/teams` with realistic NBA + NFL rosters. `POLYMARKET_EVENT_DETAILS_MOCKS` has explicit `PRIORITY.BASE` and a tightened numeric-ID matcher. `TRENDING_API_MOCKS` covers `events/1`, `prices-history`, and `prices`. **CI verification (commit `a3d232d3`):** All E2E smoke suites pass with **zero leak warnings** sampled across `prediction-market-{android,ios}-smoke`, `wallet-platform-{android,ios}-smoke` (which includes `trending-feed.spec.ts`), `confirmations-{android,ios}-smoke`, and `browser-ios-smoke`. Run: https://github.com/MetaMask/metamask-mobile/actions/runs/25526071329 ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. #### Performance checks (if applicable) - [ ] I've tested on Android - Ideally on a mid-range device; emulator is acceptable - [ ] I've tested with a power user scenario - Use these [power-user SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93) to import wallets with many accounts and tokens - [ ] I've instrumented key operations with Sentry traces for production performance metrics - See [`trace()`](/app/util/trace.ts) for usage and [`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274) for an example For performance guidelines and tooling, see the [Performance Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers). ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots. [MMQA-1364]: https://consensyssoftware.atlassian.net/browse/MMQA-1364?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [MMQA-1800]: https://consensyssoftware.atlassian.net/browse/MMQA-1800?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
diff --git a/tests/api-mocking/mock-e2e-allowlist.ts b/tests/api-mocking/mock-e2e-allowlist.ts
@@ -6,8 +6,6 @@ export const ALLOWLISTED_HOSTS = [
   '127.0.0.1',
   'localhost',
   '10.0.2.2', // Android emulator host
-  'gamma-api.polymarket.com',
-  '*.polymarket.com',
   'metamask.github.io', // Test-snaps and test-dapp pages loaded in browser
 ];
 
diff --git a/tests/api-mocking/mock-responses/defaults/polymarket-apis.ts b/tests/api-mocking/mock-responses/defaults/polymarket-apis.ts
@@ -1,5 +1,14 @@
 /**
- * Default mock responses for Polymarket API endpoints
+ * Default mock responses for Polymarket API endpoints.
+ *
+ * These defaults cover the calls fired by the wallet's Explore tab
+ * (TrendingView / usePredictMarketData) so that non-predict specs that pass
+ * through Explore (e.g. via navigateToBrowserView()) don't leak live requests
+ * to Polymarket. Predict and trending specs override these via
+ * POLYMARKET_COMPLETE_MOCKS registered as testSpecificMock at higher priority.
+ *
+ * clob.polymarket.com is intentionally not covered here — it only fires on
+ * trade actions, never during Explore render.
  */
 
 /** Single source of truth for geoblock mock (eligible region). Reused in defaults and in POLYMARKET_COMPLETE_MOCKS. */
@@ -13,7 +22,63 @@ export const POLYMARKET_GEOBLOCK_ELIGIBLE = {
 } as const;
 
 export const POLYMARKET_API_MOCKS = {
-  GET: [POLYMARKET_GEOBLOCK_ELIGIBLE],
+  GET: [
+    POLYMARKET_GEOBLOCK_ELIGIBLE,
+    // gamma-api: events pagination — consumer reads `data?.data`
+    {
+      urlEndpoint:
+        /^https:\/\/gamma-api\.polymarket\.com\/events\/pagination(\?.*)?$/,
+      responseCode: 200,
+      response: { data: [] },
+    },
+    // gamma-api: public-search — consumer reads `data?.events`
+    {
+      urlEndpoint:
+        /^https:\/\/gamma-api\.polymarket\.com\/public-search(\?.*)?$/,
+      responseCode: 200,
+      response: { events: [] },
+    },
+    // gamma-api: markets list
+    {
+      urlEndpoint: /^https:\/\/gamma-api\.polymarket\.com\/markets(\?.*)?$/,
+      responseCode: 200,
+      response: [],
+    },
+    // gamma-api: sports league team metadata (TeamsCache)
+    {
+      urlEndpoint: /^https:\/\/gamma-api\.polymarket\.com\/teams(\?.*)?$/,
+      responseCode: 200,
+      response: [],
+    },
+    // polymarket.com: homepage carousel
+    {
+      urlEndpoint: 'https://polymarket.com/api/homepage/carousel',
+      responseCode: 200,
+      response: [],
+    },
+    // polymarket.com: crypto price feed
+    {
+      urlEndpoint: /^https:\/\/polymarket\.com\/api\/crypto\/crypto-price.*$/,
+      responseCode: 200,
+      response: {},
+    },
+    // data-api: positions / activity / upnl
+    {
+      urlEndpoint: /^https:\/\/data-api\.polymarket\.com\/positions(\?.*)?$/,
+      responseCode: 200,
+      response: [],
+    },
+    {
+      urlEndpoint: /^https:\/\/data-api\.polymarket\.com\/activity(\?.*)?$/,
+      responseCode: 200,
+      response: [],
+    },
+    {
+      urlEndpoint: /^https:\/\/data-api\.polymarket\.com\/upnl(\?.*)?$/,
+      responseCode: 200,
+      response: [],
+    },
+  ],
   POST: [],
   PUT: [],
   DELETE: [],
diff --git a/tests/api-mocking/mock-responses/polymarket/polymarket-mocks.ts b/tests/api-mocking/mock-responses/polymarket/polymarket-mocks.ts
@@ -211,8 +211,13 @@ export const POLYMARKET_EVENT_DETAILS_MOCKS = async (mockServer: Mockttp) => {
     .forGet('/proxy')
     .matching((request) => {
       const url = new URL(request.url).searchParams.get('url');
-      return Boolean(url?.includes('gamma-api.polymarket.com/events/'));
+      // Match only /events/{numericId}, NOT /events/pagination or
+      // /events?parent_event_id=... — those have their own dedicated mocks.
+      return Boolean(
+        url && /gamma-api\.polymarket\.com\/events\/[0-9]+/.test(url),
+      );
     })
+    .asPriority(PRIORITY.BASE)
     .thenCallback((request) => {
       const url = new URL(request.url).searchParams.get('url');
       const eventIdMatch = url?.match(/\/events\/([0-9]+)$/);
@@ -656,6 +661,254 @@ export const POLYMARKET_FEE_RATE_MOCKS = async (mockServer: Mockttp) => {
     });
 };
 
+/**
+ * Mock for Polymarket CLOB prices-history API
+ * Returns an empty history series — sufficient for predict happy-path specs
+ * that render the chart (consumer treats non-array history as empty).
+ */
+export const POLYMARKET_PRICES_HISTORY_MOCKS = async (mockServer: Mockttp) => {
+  await mockServer
+    .forGet('/proxy')
+    .matching((request) => {
+      const url = new URL(request.url).searchParams.get('url');
+      return Boolean(url?.includes('clob.polymarket.com/prices-history'));
+    })
+    .asPriority(PRIORITY.BASE)
+    .thenReply(200, JSON.stringify({ history: [] }), {
+      'content-type': 'application/json',
+    });
+};
+
+/**
+ * Static team metadata for sports leagues used by predict E2E fixtures.
+ * Covers NBA + NFL teams referenced in event slugs (see polymarket-positions-response.ts).
+ *
+ * The wallet's TeamsCache stores teams by abbreviation, and buildGameData
+ * (gameParser.ts) returns null when either home or away team is missing —
+ * which causes market.game to be undefined and the wallet to fall back to
+ * the non-game market detail layout (no picks list). So returning realistic
+ * team data here is required for the new PredictGameDetailsContent path.
+ */
+const POLYMARKET_TEAMS_BY_LEAGUE: Record<
+  string,
+  {
+    id: string;
+    name: string;
+    logo: string;
+    abbreviation: string;
+    color: string;
+    alias: string;
+    league: string;
+  }[]
+> = {
+  nba: [
+    {
+      id: 'nba-sas',
+      name: 'San Antonio Spurs',
+      logo: '',
+      abbreviation: 'sas',
+      color: '#000000',
+      alias: 'Spurs',
+      league: 'nba',
+    },
+    {
+      id: 'nba-nop',
+      name: 'New Orleans Pelicans',
+      logo: '',
+      abbreviation: 'nop',
+      color: '#0C2340',
+      alias: 'Pelicans',
+      league: 'nba',
+    },
+    {
+      id: 'nba-bos',
+      name: 'Boston Celtics',
+      logo: '',
+      abbreviation: 'bos',
+      color: '#007A33',
+      alias: 'Celtics',
+      league: 'nba',
+    },
+    {
+      id: 'nba-bkn',
+      name: 'Brooklyn Nets',
+      logo: '',
+      abbreviation: 'bkn',
+      color: '#000000',
+      alias: 'Nets',
+      league: 'nba',
+    },
+  ],
+  nfl: [
+    {
+      id: 'nfl-buf',
+      name: 'Buffalo Bills',
+      logo: '',
+      abbreviation: 'buf',
+      color: '#00338D',
+      alias: 'Bills',
+      league: 'nfl',
+    },
+    {
+      id: 'nfl-atl',
+      name: 'Atlanta Falcons',
+      logo: '',
+      abbreviation: 'atl',
+      color: '#A71930',
+      alias: 'Falcons',
+      league: 'nfl',
+    },
+    {
+      id: 'nfl-chi',
+      name: 'Chicago Bears',
+      logo: '',
+      abbreviation: 'chi',
+      color: '#0B162A',
+      alias: 'Bears',
+      league: 'nfl',
+    },
+    {
+      id: 'nfl-was',
+      name: 'Washington Commanders',
+      logo: '',
+      abbreviation: 'was',
+      color: '#5A1414',
+      alias: 'Commanders',
+      league: 'nfl',
+    },
+    {
+      id: 'nfl-den',
+      name: 'Denver Broncos',
+      logo: '',
+      abbreviation: 'den',
+      color: '#FB4F14',
+      alias: 'Broncos',
+      league: 'nfl',
+    },
+    {
+      id: 'nfl-nyj',
+      name: 'New York Jets',
+      logo: '',
+      abbreviation: 'nyj',
+      color: '#125740',
+      alias: 'Jets',
+      league: 'nfl',
+    },
+    {
+      id: 'nfl-det',
+      name: 'Detroit Lions',
+      logo: '',
+      abbreviation: 'det',
+      color: '#0076B6',
+      alias: 'Lions',
+      league: 'nfl',
+    },
+    {
+      id: 'nfl-kc',
+      name: 'Kansas City Chiefs',
+      logo: '',
+      abbreviation: 'kc',
+      color: '#E31837',
+      alias: 'Chiefs',
+      league: 'nfl',
+    },
+    {
+      id: 'nfl-jax',
+      name: 'Jacksonville Jaguars',
+      logo: '',
+      abbreviation: 'jax',
+      color: '#006778',
+      alias: 'Jaguars',
+      league: 'nfl',
+    },
+    {
+      id: 'nfl-pit',
+      name: 'Pittsburgh Steelers',
+      logo: '',
+      abbreviation: 'pit',
+      color: '#FFB612',
+      alias: 'Steelers',
+      league: 'nfl',
+    },
+    {
+      id: 'nfl-cin',
+      name: 'Cincinnati Bengals',
+      logo: '',
+      abbreviation: 'cin',
+      color: '#FB4F14',
+      alias: 'Bengals',
+      league: 'nfl',
+    },
+    {
+      id: 'nfl-sea',
+      name: 'Seattle Seahawks',
+      logo: '',
+      abbreviation: 'sea',
+      color: '#002244',
+      alias: 'Seahawks',
+      league: 'nfl',
+    },
+    {
+      id: 'nfl-sf',
+      name: 'San Francisco 49ers',
+      logo: '',
+      abbreviation: 'sf',
+      color: '#AA0000',
+      alias: '49ers',
+      league: 'nfl',
+    },
+    {
+      id: 'nfl-tb',
+      name: 'Tampa Bay Buccaneers',
+      logo: '',
+      abbreviation: 'tb',
+      color: '#D50A0A',
+      alias: 'Buccaneers',
+      league: 'nfl',
+    },
+    {
+      id: 'nfl-dal',
+      name: 'Dallas Cowboys',
+      logo: '',
+      abbreviation: 'dal',
+      color: '#003594',
+      alias: 'Cowboys',
+      league: 'nfl',
+    },
+  ],
+};
+
+/**
+ * Mock for Polymarket gamma-api /teams API
+ * Returns the full list of teams for the queried league. The wallet's
+ * TeamsCache filters by requested abbreviations, so returning all teams
+ * for the league is safe and avoids per-test fixture maintenance.
+ */
+export const POLYMARKET_TEAMS_MOCKS = async (mockServer: Mockttp) => {
+  await mockServer
+    .forGet('/proxy')
+    .matching((request) => {
+      const url = new URL(request.url).searchParams.get('url');
+      return Boolean(url?.includes('gamma-api.polymarket.com/teams'));
+    })
+    .asPriority(PRIORITY.BASE)
+    .thenCallback((request) => {
+      const proxiedUrlParam = new URL(request.url).searchParams.get('url');
+      let league = '';
+      try {
+        const polymarketUrl = new URL(proxiedUrlParam ?? '');
+        league = polymarketUrl.searchParams.get('league') ?? '';
+      } catch {
+        league = '';
+      }
+      const teams = POLYMARKET_TEAMS_BY_LEAGUE[league] ?? [];
+      return {
+        statusCode: 200,
+        json: teams,
+      };
+    });
+};
+
 /**
  * Mock for Polymarket CLOB order book API
  * Returns order book data for specific token IDs with correct market mapping
@@ -2214,6 +2467,8 @@ export const POLYMARKET_COMPLETE_MOCKS = async (mockServer: Mockttp) => {
   await POLYMARKET_EVENT_DETAILS_MOCKS(mockServer);
   await POLYMARKET_ORDER_BOOK_MOCKS(mockServer);
   await POLYMARKET_PRICES_MOCKS(mockServer); // Mock for CLOB prices API
+  await POLYMARKET_PRICES_HISTORY_MOCKS(mockServer); // Mock for CLOB prices-history API (chart series)
+  await POLYMARKET_TEAMS_MOCKS(mockServer); // Mock for gamma-api /teams (sports league team metadata)
   await POLYMARKET_FEE_RATE_MOCKS(mockServer);
   await POLYMARKET_MARKET_FEEDS_MOCKS(mockServer);
   await POLYMARKET_CLOB_AUTH_MOCKS(mockServer);
diff --git a/tests/api-mocking/mock-responses/trending-api-mocks.ts b/tests/api-mocking/mock-responses/trending-api-mocks.ts
