Skip to content

Feat/tsa 317 social service#8335

Open
Bigshmow wants to merge 20 commits intomainfrom
feat/TSA-317-social-service
Open

Feat/tsa 317 social service#8335
Bigshmow wants to merge 20 commits intomainfrom
feat/TSA-317-social-service

Conversation

@Bigshmow
Copy link
Copy Markdown
Contributor

@Bigshmow Bigshmow commented Mar 30, 2026

Explanation

Adds SocialService — a stateless data service that wraps all social-api endpoints with TypeScript types and superstruct response validation. This is the data layer that a future SocialController (TSA-318) will consume.

We intentionally shipped the service without the controller so callers can weigh in on what state shape and messenger actions they actually need before we wire up BaseController. The service stands on its own and can be used directly for testing integration with the social-api once it's deployed.

See CHANGELOG.md for the full list of additions.

References

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've communicated my changes to consumers by updating changelogs for packages I've changed
  • I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

Medium Risk
Introduces new network-facing SocialService endpoints with runtime schema validation and a persisted-state SocialController, so integration/caching/state update semantics could impact consumers despite being additive.

Overview
Adds a new SocialService (extends BaseDataService) that wraps social-api endpoints (leaderboard, trader profile, positions, followers/following, follow/unfollow) with superstruct response validation and consistent HttpError handling, and exposes these methods over the messenger.

Adds a new SocialController (extends BaseController) that persists simple UI state (leaderboardEntries, followingAddresses) and provides messenger-callable actions to updateLeaderboard, followTrader, unfollowTrader, and updateFollowing by delegating to SocialService.

Updates package exports/tests/changelog, and adds required dependencies plus TS project references to support the new controller/service architecture.

Written by Cursor Bugbot for commit 26038d8. This will update automatically on new commits. Configure here.

@Bigshmow Bigshmow marked this pull request as ready for review March 30, 2026 16:57
@Bigshmow Bigshmow requested review from a team as code owners March 30, 2026 16:57
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…ord validation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@mcmire mcmire mentioned this pull request Mar 30, 2026
4 tasks
* Follows the `AiDigestService` pattern: plain class with `baseUrl` config,
* direct `fetch()` calls, and superstruct response validation.
*/
export class SocialService implements SocialDataService {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Our team recently released the BaseDataService class under @metamask/base-data-service. This superclass is designed to represent our latest patterns and best practices for fetching data that we've developed in collaboration with other teams. Would you mind implementing this in your class?

The main things are:

  • Data services inherit from BaseDataService.
  • They have a messenger associated with them. This allows the service to used anywhere within a client without needing a direct reference to the instance of the class itself. SampleGasPricesService has an example of how to set up the types for this as well as the constructor and expose methods on your class through the messenger.
  • In each method you are making a request, you do this:
    • Use fetchQuery and pass a queryKey that matches the name of the method in <ServiceName>:<method> format.
    • Inside of the queryFn, you call fetch, throwing if the response is not 200. (If there is an HTTP error you want to represent, use HttpError from @metamask/controller-utils:
      export class HttpError extends Error {
      )
    • Outside of fetchQuery call, you validate the response and throw an error if it is not valid.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok happy to adopt the new pattern, this is great stuff! Just wanted to flag that the SampleGasPricesService you linked doesn't extend BaseDataService yet, so we initially followed its pattern (along with AiDigestService). I'll use the notion doc and ExampleDataService from base-data-service/tests as our reference going forward.

);
return response.json();
},
});
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mutation operations cached by fetchQuery skip repeated requests

High Severity

The follow (PUT) and unfollow (DELETE) methods wrap their HTTP requests in this.fetchQuery, which delegates to QueryClient.fetchQuery from @tanstack/query-core. This caches results keyed by queryKey and returns stale-but-fresh data without re-executing queryFn. BaseDataService sets a default staleTime of 1 minute, so calling follow or unfollow with the same parameters within that window silently returns the cached response — the actual HTTP request is never sent. Write operations must not be cached this way.

Additional Locations (1)
Fix in Cursor Fix in Web

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mcmire This unresolved bugbot comment brings up an interesting gap in the new BaseDataService. It only exposes fetchQuery and fetchInfiniteQuery, which are read-oriented (TanStack Query caches results by queryKey). Our follow and unfollow methods are write operations (PUT/DELETE) that shouldn't be cached or deduplicated (else they'll never return new data). We worked around this with staleTime: 0, but that still feels like a read API being used for writes. Is there a recommended pattern for mutations in data services, or would it make sense to add something like executeMutation to BaseDataService?

Bigshmow and others added 2 commits March 30, 2026 20:02
…ibility

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…esponses

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Copy link
Copy Markdown

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

@Bigshmow Bigshmow requested review from mcmire and zone-live March 31, 2026 03:07
## Explanation

Adds SocialController — a BaseController extension that manages social
trading state for the extension UI. Consumes the SocialService from
TSA-317 and exposes 4 messenger actions for leaderboard and follow state
management.

### Why no TTL or caching logic

The controller acts as a simple store — no TTL, no eviction, no
staleness checks. The social-api already caches upstream (leaderboard at
5min, positions at 30s), and the UI knows best when to re-fetch (screen
focus, pull-to-refresh, user actions). Double-caching adds complexity
without meaningful benefit. State is persisted across sessions so the UI
can render immediately on startup while a fresh fetch is in flight.

See CHANGELOG.md for the full list of additions.

<!--
Thanks for your contribution! Take a moment to answer these questions so
that reviewers have the information they need to properly understand
your changes:

* What is the current state of things and why does it need to change?
* What is the solution your changes offer and how does it work?
* Are there any changes whose purpose might not obvious to those
unfamiliar with the domain?
* If your primary goal was to update one package but you found you had
to update another one along the way, why did you do so?
* If you had to upgrade a dependency, why did you do so?
-->

## References

<!--
Are there any issues that this pull request is tied to?
Are there other links that reviewers should consult to understand these
changes better?
Are there client or consumer pull requests to adopt any breaking
changes?

For example:

* Fixes #12345
* Related to #67890
-->

## Checklist

- [x] I've updated the test suite for new or updated code as appropriate
- [x] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [x] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md)
- [ ] I've introduced [breaking
changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md)
in this PR and have prepared draft pull requests for clients and
consumer packages to resolve them

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Adds a new persisted `BaseController` with messenger-exposed methods
that update stored follow/leaderboard state, which could affect UI
behavior and state persistence if wiring or state updates are incorrect.
Changes are scoped to the new `@metamask/social-controllers` package
with good test coverage.
> 
> **Overview**
> Introduces **`SocialController`** (a `BaseController`) that persists
social trading UI state and exposes messenger actions
`updateLeaderboard`, `followTrader`, `unfollowTrader`, and
`updateFollowing`, updating `leaderboardEntries` and
`followingAddresses` based on `SocialService` responses.
> 
> Exports the new controller/types from `index.ts`, adds
`SocialControllerState` to `social-types`, and wires in the
`@metamask/base-controller` dependency/TS project references. Adds
comprehensive unit tests covering state updates, messenger callability,
and error propagation, and updates the changelog accordingly.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
a6a3c13. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@socket-security
Copy link
Copy Markdown

socket-security bot commented Mar 31, 2026

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

@zone-live
Copy link
Copy Markdown
Contributor

@metamaskbot publish-preview

@github-actions
Copy link
Copy Markdown
Contributor

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.
@metamask-previews/account-tree-controller@7.0.0-preview-26038d8d3
@metamask-previews/accounts-controller@37.1.1-preview-26038d8d3
@metamask-previews/address-book-controller@7.1.1-preview-26038d8d3
@metamask-previews/ai-controllers@0.6.3-preview-26038d8d3
@metamask-previews/analytics-controller@1.0.1-preview-26038d8d3
@metamask-previews/analytics-data-regulation-controller@0.0.0-preview-26038d8d3
@metamask-previews/announcement-controller@8.1.0-preview-26038d8d3
@metamask-previews/app-metadata-controller@2.0.1-preview-26038d8d3
@metamask-previews/approval-controller@9.0.1-preview-26038d8d3
@metamask-previews/assets-controller@3.2.1-preview-26038d8d3
@metamask-previews/assets-controllers@103.0.0-preview-26038d8d3
@metamask-previews/base-controller@9.0.1-preview-26038d8d3
@metamask-previews/base-data-service@0.1.1-preview-26038d8d3
@metamask-previews/bridge-controller@70.0.0-preview-26038d8d3
@metamask-previews/bridge-status-controller@70.0.4-preview-26038d8d3
@metamask-previews/build-utils@3.0.4-preview-26038d8d3
@metamask-previews/chain-agnostic-permission@1.5.0-preview-26038d8d3
@metamask-previews/claims-controller@0.5.0-preview-26038d8d3
@metamask-previews/client-controller@1.0.1-preview-26038d8d3
@metamask-previews/compliance-controller@1.0.2-preview-26038d8d3
@metamask-previews/composable-controller@12.0.1-preview-26038d8d3
@metamask-previews/config-registry-controller@0.2.0-preview-26038d8d3
@metamask-previews/connectivity-controller@0.2.0-preview-26038d8d3
@metamask-previews/controller-utils@11.20.0-preview-26038d8d3
@metamask-previews/core-backend@6.2.1-preview-26038d8d3
@metamask-previews/delegation-controller@2.1.0-preview-26038d8d3
@metamask-previews/earn-controller@11.2.1-preview-26038d8d3
@metamask-previews/eip-5792-middleware@3.0.2-preview-26038d8d3
@metamask-previews/eip-7702-internal-rpc-middleware@0.1.0-preview-26038d8d3
@metamask-previews/eip1193-permission-middleware@1.0.3-preview-26038d8d3
@metamask-previews/ens-controller@19.1.1-preview-26038d8d3
@metamask-previews/eth-block-tracker@15.0.1-preview-26038d8d3
@metamask-previews/eth-json-rpc-middleware@23.1.1-preview-26038d8d3
@metamask-previews/eth-json-rpc-provider@6.0.1-preview-26038d8d3
@metamask-previews/foundryup@1.0.1-preview-26038d8d3
@metamask-previews/gas-fee-controller@26.1.1-preview-26038d8d3
@metamask-previews/gator-permissions-controller@3.0.0-preview-26038d8d3
@metamask-previews/geolocation-controller@0.1.2-preview-26038d8d3
@metamask-previews/json-rpc-engine@10.2.4-preview-26038d8d3
@metamask-previews/json-rpc-middleware-stream@8.0.8-preview-26038d8d3
@metamask-previews/keyring-controller@25.1.1-preview-26038d8d3
@metamask-previews/logging-controller@8.0.1-preview-26038d8d3
@metamask-previews/message-manager@14.1.1-preview-26038d8d3
@metamask-previews/messenger@1.0.0-preview-26038d8d3
@metamask-previews/multichain-account-service@8.0.1-preview-26038d8d3
@metamask-previews/multichain-api-middleware@2.0.0-preview-26038d8d3
@metamask-previews/multichain-network-controller@3.0.6-preview-26038d8d3
@metamask-previews/multichain-transactions-controller@7.0.4-preview-26038d8d3
@metamask-previews/name-controller@9.1.1-preview-26038d8d3
@metamask-previews/network-controller@30.0.1-preview-26038d8d3
@metamask-previews/network-enablement-controller@5.0.1-preview-26038d8d3
@metamask-previews/notification-services-controller@23.0.1-preview-26038d8d3
@metamask-previews/permission-controller@12.3.0-preview-26038d8d3
@metamask-previews/permission-log-controller@5.1.0-preview-26038d8d3
@metamask-previews/perps-controller@2.0.0-preview-26038d8d3
@metamask-previews/phishing-controller@17.1.0-preview-26038d8d3
@metamask-previews/polling-controller@16.0.4-preview-26038d8d3
@metamask-previews/preferences-controller@23.1.0-preview-26038d8d3
@metamask-previews/profile-metrics-controller@3.1.2-preview-26038d8d3
@metamask-previews/profile-sync-controller@28.0.2-preview-26038d8d3
@metamask-previews/ramps-controller@12.1.0-preview-26038d8d3
@metamask-previews/rate-limit-controller@7.0.1-preview-26038d8d3
@metamask-previews/react-data-query@0.2.0-preview-26038d8d3
@metamask-previews/remote-feature-flag-controller@4.2.0-preview-26038d8d3
@metamask-previews/sample-controllers@4.0.4-preview-26038d8d3
@metamask-previews/seedless-onboarding-controller@9.1.0-preview-26038d8d3
@metamask-previews/selected-network-controller@26.1.0-preview-26038d8d3
@metamask-previews/shield-controller@5.1.0-preview-26038d8d3
@metamask-previews/signature-controller@39.1.2-preview-26038d8d3
@metamask-previews/social-controllers@0.0.0-preview-26038d8d3
@metamask-previews/storage-service@1.0.1-preview-26038d8d3
@metamask-previews/subscription-controller@6.1.1-preview-26038d8d3
@metamask-previews/transaction-controller@63.3.1-preview-26038d8d3
@metamask-previews/transaction-pay-controller@19.0.1-preview-26038d8d3
@metamask-previews/user-operation-controller@41.1.1-preview-26038d8d3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants