test(e2e): mock Polymarket endpoints to remove from allowlist (MMQA-1800)

[chrisleewilcox]

Description

Removes both Polymarket entries from ALLOWLISTED_HOSTS by adding default mocks for the Polymarket endpoints fired by the wallet's Explore tab and shoring up several pre-existing test-mock gaps the wildcard had been masking. Parent epic MMQA-1364.

Why these were allowlisted in the first place

The wallet's Explore tab (TrendingView / usePredictMarketData) fetches data from gamma-api.polymarket.com and other Polymarket hosts when rendered. Many specs pass through Explore on the way to the browser — tests/flows/browser.flow.ts:118 calls navigateToBrowserView() via Explore → Trending → Browser, so Polymarket calls fire across many specs that have nothing to do with prediction markets.

What this PR adds

1. New default mocks under defaults/polymarket-apis.ts for the Explore-render endpoints:

Endpoint	Default response
gamma-api.polymarket.com/events/pagination?...	{ data: [] }
gamma-api.polymarket.com/public-search?...	{ events: [] }
gamma-api.polymarket.com/markets?...	[]
gamma-api.polymarket.com/teams?...	[] (defensive — non-predict specs that hit the new TeamsCache get an empty payload to absorb the leak)
polymarket.com/api/homepage/carousel	[]
polymarket.com/api/crypto/crypto-price?...	{}
data-api.polymarket.com/positions?...	[]
data-api.polymarket.com/activity?...	[]
data-api.polymarket.com/upnl?...	[]

gamma-api.polymarket.com/events/{id} and events?parent_event_id=... are intentionally not in defaults — empty payloads for those routes caused the wallet's detail screens to render the legacy layout (no picks list). They're now covered by spec-specific mocks instead.

2. Extended POLYMARKET_COMPLETE_MOCKS with two new helpers:

• POLYMARKET_PRICES_HISTORY_MOCKS — clob.polymarket.com/prices-history returning { history: [] }. Predict happy-path specs were making live calls here via the wildcard.
• POLYMARKET_TEAMS_MOCKS — gamma-api.polymarket.com/teams?league=... returning realistic NBA + NFL team rosters via a callback. Required because the new TeamsCache/buildGameData path (recently added on main) drops market.game to undefined when teams aren't found, causing PredictMarketDetails.tsx:370 to render the legacy layout (no picks list, no cash-out button).

3. Tightened POLYMARKET_EVENT_DETAILS_MOCKS:

• Bumped to explicit PRIORITY.BASE (was at default mockttp priority, tied with the proxy fallback handler — the wildcard was masking cases where the fallback won).
• Tightened matcher to /events/{numericId} only, after Cursor Bugbot flagged that includes('events/') also matches events/pagination because events/ is a substring of events/pagination. The new regex gamma-api\.polymarket\.com\/events\/[0-9]+ ensures pagination requests fall through to their dedicated mock regardless of registration order.

4. Extended trending-api-mocks.ts with three new entries used by the trending feed's prediction detail flow:

• gamma-api.polymarket.com/events/1 returning the same Bitcoin event payload as the existing events/pagination mock
• clob.polymarket.com/prices-history returning { history: [] }
• clob.polymarket.com/prices (POST) returning {}

Allowlist entries removed:

• gamma-api.polymarket.com (was redundant — covered by the wildcard)
• *.polymarket.com (covered all subdomains + apex)

ALLOWLISTED_HOSTS is now down to 5 entries: 4 local + metamask.github.io.

Changelog

CHANGELOG entry: null

Related issues

MMQA-1800
Parent epic: MMQA-1364

Fixes:

Manual testing steps

Feature: E2E mock coverage for Polymarket Explore-tab calls

  Scenario: browser specs that pass through Explore no longer leak Polymarket requests
    Given an E2E spec calls navigateToBrowserView()
    And the flow taps Explore → Trending → Browser

    When TrendingView renders sports market feeds via usePredictMarketData
    Then requests to gamma-api.polymarket.com (events/pagination, public-search, markets, teams) are answered by the default mocks
    And requests to data-api.polymarket.com (positions, activity, upnl) are answered by the default mocks
    And requests to polymarket.com (homepage/carousel, crypto/crypto-price) are answered by the default mocks
    And no entries for Polymarket hosts are required in mock-e2e-allowlist.ts

  Scenario: predict specs render market detail with picks list and cash-out button
    Given the spec registers POLYMARKET_COMPLETE_MOCKS as its testSpecificMock
    And the production default for predictLiveSports has leagues ['nfl','nba']

    When the test taps a position and navigates to PredictMarketDetails
    Then gamma-api.polymarket.com/teams returns realistic team payloads for the requested league
    And buildGameData populates market.game with home/away team data
    And PredictMarketDetails renders PredictGameDetailsContent with the picks list
    And the predict-picks-cash-out-button-{positionId} element is present for the test to tap

  Scenario: trending-feed renders prediction detail without leaking
    Given the spec registers TRENDING_API_MOCKS as its testSpecificMock

    When the test taps a prediction row and the wallet navigates to the detail screen
    Then events/{id}, prices, and prices-history are answered by the trending mocks
    And the spec passes without a live request leak

Screenshots/Recordings

Before

tests/api-mocking/mock-e2e-allowlist.ts:

export const ALLOWLISTED_HOSTS = [
  '0.0.0.0', '127.0.0.1', 'localhost', '10.0.2.2',
  'gamma-api.polymarket.com',
  '*.polymarket.com',
  'metamask.github.io',
];

tests/api-mocking/mock-responses/defaults/polymarket-apis.ts had a single entry: the geoblock mock. All other Polymarket calls leaked to live via the wildcard, masking gaps in test-specific mocks.

After

tests/api-mocking/mock-e2e-allowlist.ts:

export const ALLOWLISTED_HOSTS = [
  '0.0.0.0', '127.0.0.1', 'localhost', '10.0.2.2',
  'metamask.github.io',
];

defaults/polymarket-apis.ts now has 10 default GET matchers (geoblock + 9 new) covering Explore-render endpoints.

POLYMARKET_COMPLETE_MOCKS covers clob.polymarket.com/prices-history and gamma-api.polymarket.com/teams with realistic NBA + NFL rosters. POLYMARKET_EVENT_DETAILS_MOCKS has explicit PRIORITY.BASE and a tightened numeric-ID matcher. TRENDING_API_MOCKS covers events/1, prices-history, and prices.

CI verification (commit a3d232d3):

All E2E smoke suites pass with zero leak warnings sampled across prediction-market-{android,ios}-smoke, wallet-platform-{android,ios}-smoke (which includes trending-feed.spec.ts), confirmations-{android,ios}-smoke, and browser-ios-smoke. Run: https://github.com/MetaMask/metamask-mobile/actions/runs/25526071329

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

• I've tested on Android
  • Ideally on a mid-range device; emulator is acceptable
• I've tested with a power user scenario
  • Use these power-user SRPs to import wallets with many accounts and tokens
• I've instrumented key operations with Sentry traces for production performance metrics
  • See trace() for usage and addToken for an example

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ef93a06. Configure here.}

[chrisleewilcox]

@metamaskbot update-mobile-fixture

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: SmokePredictions, SmokeWalletPlatform, SmokeConfirmations
• Selected Performance tags: None (no tests recommended)
• Risk Level: medium
• AI Confidence: 88%

click to see 🤖 AI reasoning details

E2E Test Selection:
All four changed files are E2E test infrastructure (API mocking layer), not app code. The changes:

1. mock-e2e-allowlist.ts: Removes gamma-api.polymarket.com and *.polymarket.com from the allowlist, meaning Polymarket traffic will now be intercepted by the mock server instead of passing through live. This is a correctness fix to prevent live API leakage in tests.

2. defaults/polymarket-apis.ts: Massively expands default Polymarket mock responses (events/pagination, public-search, markets, teams, homepage carousel, crypto-price, positions, activity, upnl). These defaults apply to ALL tests that navigate through the Explore/Trending tab, preventing live Polymarket requests from leaking in non-predict specs.

3. polymarket-mocks.ts: Adds POLYMARKET_PRICES_HISTORY_MOCKS and POLYMARKET_TEAMS_MOCKS to POLYMARKET_COMPLETE_MOCKS, and refines the event details regex to avoid matching /events/pagination. These are used by SmokePredictions tests.

4. trending-api-mocks.ts: Adds mocks for Polymarket event details (event ID 1), prices-history, and CLOB prices endpoints used when rendering prediction rows in the Trending feed. Used by SmokeWalletPlatform trending tests.

Selected tags:

• SmokePredictions: Directly affected — POLYMARKET_COMPLETE_MOCKS (used by all predict specs) now includes new mocks for prices-history and teams. The event details regex fix could affect how predict tests match event detail requests. These tests must be validated.
• SmokeWalletPlatform: Directly affected — TRENDING_API_MOCKS (used by trending-feed.spec.ts, trending-search.spec.ts, trending-browser.spec.ts) now includes additional Polymarket endpoint mocks for event details and chart data. The Trending tab renders Predictions section which fires these APIs.
• SmokeConfirmations: Required per SmokePredictions tag description — opening/closing positions are on-chain transactions that go through the confirmations flow.

No app code was changed, so no performance tests are needed.

Performance Test Selection:
All changes are in the E2E test infrastructure (API mocking layer). No app code, UI components, controllers, or data loading logic was modified. Performance characteristics of the app are unaffected by these changes.

View GitHub Actions results

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud