test(wallet): strengthen permission/subject-metadata coverage from review

- Add `Wallet.test.ts` integration coverage: both controllers are reachable on
  the assembled wallet, and persisted subject metadata hydrates without throwing
  (proving the default wiring initializes `PermissionController` before
  `SubjectMetadataController`, which calls `PermissionController:hasPermissions`
  during hydration).
- Verify `PermissionController` can reach its delegated `ApprovalController` and
  `SubjectMetadataController` actions, so a dropped allowlist entry now fails.
- Prove the injected permission specifications are forwarded (via `grantPermissions`)
  rather than only exercising the empty default.
- Replace the weak "defaults to 100" test with a boundary test (100 retained,
  101st evicts the oldest) and add coverage for retaining subjects that hold
  permissions past the cache limit.
- Document the construction-order dependency and soften cross-repo comments.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sirtimid

packages/wallet/src/Wallet.test.ts

@@ -417,4 +417,70 @@ describe('Wallet', () => {
       ).toStrictEqual({ testFlag: true });
     });
   });
+
+  describe('PermissionController', () => {
+    it('is wired and exposes its state on the wallet messenger', async () => {
+      const wallet = await setupWallet();
+
+      expect(
+        wallet.messenger.call('PermissionController:getState'),
+      ).toStrictEqual({ subjects: {} });
+    });
+  });
+
+  describe('SubjectMetadataController', () => {
+    it('is wired and exposes its state on the wallet messenger', async () => {
+      const wallet = await setupWallet();
+
+      expect(
+        wallet.messenger.call('SubjectMetadataController:getState'),
+      ).toStrictEqual({ subjectMetadata: {} });
+    });
+
+    it('hydrates persisted subject metadata, consulting the wired PermissionController for retention', () => {
+      // Constructing the controller from persisted state calls
+      // `PermissionController:hasPermissions`, so this proves the default
+      // wiring initializes `PermissionController` before
+      // `SubjectMetadataController` (otherwise construction would throw).
+      const origin = 'https://metamask.io';
+
+      const wallet = new Wallet({
+        state: {
+          PermissionController: {
+            subjects: {
+              [origin]: { origin, permissions: { somePermission: {} } },
+            },
+          },
+          SubjectMetadataController: {
+            subjectMetadata: {
+              [origin]: {
+                origin,
+                name: 'MetaMask',
+                subjectType: null,
+                extensionId: null,
+                iconUrl: null,
+              },
+            },
+          },
+        },
+        instanceOptions: {
+          connectivityController: {
+            connectivityAdapter: new AlwaysOnlineAdapter(),
+          },
+          networkController: {
+            infuraProjectId: 'fake-infura-project-id',
+          },
+          storageService: {
+            storage: new InMemoryStorageAdapter(),
+          },
+          remoteFeatureFlagController: REMOTE_FEATURE_FLAG_OPTIONS,
+        },
+      });
+
+      // The subject holds permissions, so its metadata is retained on hydration.
+      expect(
+        Object.keys(wallet.state.SubjectMetadataController.subjectMetadata),
+      ).toContain(origin);
+    });
+  });
 });

packages/wallet/src/initialization/instances/permission-controller/permission-controller.test.ts

@@ -1,5 +1,8 @@
 import { Messenger } from '@metamask/messenger';
-import { PermissionController } from '@metamask/permission-controller';
+import {
+  PermissionController,
+  PermissionType,
+} from '@metamask/permission-controller';
 
 import { defaultConfigurations } from '../../defaults';
 import type {
@@ -58,23 +61,48 @@ describe('permissionController', () => {
     expect(instance.state.subjects).toStrictEqual(subjects);
   });
 
-  it('forwards injected specifications and unrestricted methods', () => {
+  it('forwards injected unrestrictedMethods to the controller', () => {
     const messenger = permissionController.getMessenger(getRootMessenger());
 
     const instance = permissionController.init({
       state: undefined,
       messenger,
-      options: {
-        caveatSpecifications: {},
-        permissionSpecifications: {},
-        unrestrictedMethods: ['eth_chainId', 'eth_blockNumber'],
-      },
+      options: { unrestrictedMethods: ['eth_chainId', 'eth_blockNumber'] },
     });
 
     expect(instance.hasUnrestrictedMethod('eth_chainId')).toBe(true);
     expect(instance.hasUnrestrictedMethod('eth_sendTransaction')).toBe(false);
   });
 
+  it('forwards injected permission specifications to the controller', () => {
+    const messenger = permissionController.getMessenger(getRootMessenger());
+    const origin = 'https://metamask.io';
+
+    const instance = permissionController.init({
+      state: undefined,
+      messenger,
+      options: {
+        permissionSpecifications: {
+          wallet_noop: {
+            permissionType: PermissionType.RestrictedMethod,
+            targetName: 'wallet_noop',
+            allowedCaveats: null,
+            methodImplementation: () => null,
+          },
+        },
+      },
+    });
+
+    // Granting the injected permission only succeeds if its specification was
+    // forwarded to the controller; an unknown target would throw.
+    instance.grantPermissions({
+      subject: { origin },
+      approvedPermissions: { wallet_noop: {} },
+    });
+
+    expect(instance.getPermissions(origin)).toHaveProperty('wallet_noop');
+  });
+
   it('exposes its actions through the root messenger', () => {
     const rootMessenger = getRootMessenger();
     const messenger = permissionController.getMessenger(rootMessenger);
@@ -85,4 +113,40 @@ describe('permissionController', () => {
       subjects: {},
     });
   });
+
+  it('can reach the actions delegated to its messenger', () => {
+    const rootMessenger = getRootMessenger();
+
+    // Register stub handlers as the real ApprovalController and
+    // SubjectMetadataController would, then confirm the PermissionController's
+    // messenger can call them — proving the delegation allowlist is wired.
+    const approvalControllerMessenger = new Messenger({
+      namespace: 'ApprovalController',
+      parent: rootMessenger,
+    });
+    approvalControllerMessenger.registerActionHandler(
+      'ApprovalController:hasRequest',
+      () => true,
+    );
+    const subjectMetadataControllerMessenger = new Messenger({
+      namespace: 'SubjectMetadataController',
+      parent: rootMessenger,
+    });
+    subjectMetadataControllerMessenger.registerActionHandler(
+      'SubjectMetadataController:getSubjectMetadata',
+      () => undefined,
+    );
+
+    const messenger = permissionController.getMessenger(rootMessenger);
+
+    expect(messenger.call('ApprovalController:hasRequest', { id: 'x' })).toBe(
+      true,
+    );
+    expect(
+      messenger.call(
+        'SubjectMetadataController:getSubjectMetadata',
+        'https://metamask.io',
+      ),
+    ).toBeUndefined();
+  });
 });

packages/wallet/src/initialization/instances/subject-metadata-controller/subject-metadata-controller.test.ts

@@ -116,30 +116,54 @@ describe('subjectMetadataController', () => {
     instance.addSubjectMetadata({ origin: 'https://a.example' });
     instance.addSubjectMetadata({ origin: 'https://b.example' });
 
-    // With a cache limit of 1 and neither subject holding permissions, the
-    // first is evicted when the second is added.
     expect(Object.keys(instance.state.subjectMetadata)).toStrictEqual([
       'https://b.example',
     ]);
   });
 
-  it('defaults subjectCacheLimit to 100 when omitted, retaining subjects past a small count', () => {
+  it('retains a subject with permissions even when the cache limit is exceeded', () => {
     const rootMessenger = getRootMessenger();
-    registerHasPermissionsStub(rootMessenger, false);
+    // Every subject reports as holding permissions.
+    registerHasPermissionsStub(rootMessenger, true);
     const messenger = subjectMetadataController.getMessenger(rootMessenger);
 
     const instance = subjectMetadataController.init({
       state: undefined,
       messenger,
-      options: {},
+      options: { subjectCacheLimit: 1 },
     });
 
     instance.addSubjectMetadata({ origin: 'https://a.example' });
     instance.addSubjectMetadata({ origin: 'https://b.example' });
 
+    // Metadata for subjects with permissions is never evicted.
     expect(Object.keys(instance.state.subjectMetadata)).toStrictEqual([
       'https://a.example',
       'https://b.example',
     ]);
   });
+
+  it('does not evict until the default cache limit of 100 is exceeded', () => {
+    const rootMessenger = getRootMessenger();
+    registerHasPermissionsStub(rootMessenger, false);
+    const messenger = subjectMetadataController.getMessenger(rootMessenger);
+
+    const instance = subjectMetadataController.init({
+      state: undefined,
+      messenger,
+      options: {},
+    });
+
+    for (let index = 0; index < 100; index++) {
+      instance.addSubjectMetadata({ origin: `https://${index}.example` });
+    }
+    expect(Object.keys(instance.state.subjectMetadata)).toHaveLength(100);
+
+    // The 101st permissionless subject evicts the oldest (FIFO).
+    instance.addSubjectMetadata({ origin: 'https://overflow.example' });
+    const origins = Object.keys(instance.state.subjectMetadata);
+    expect(origins).toHaveLength(100);
+    expect(origins).not.toContain('https://0.example');
+    expect(origins).toContain('https://overflow.example');
+  });
 });

packages/wallet/src/initialization/instances/subject-metadata-controller/subject-metadata-controller.ts

@@ -12,9 +12,9 @@ import type {
 import type { InitializationConfiguration } from '../../types';
 
 /**
- * Maximum number of distinct permissionless subjects to cache metadata for
- * before the oldest is evicted. Both the extension and mobile clients use
- * `100`; clients can override via
+ * Default maximum number of distinct permissionless subjects to cache metadata
+ * for before the oldest is evicted. `100` matches the value MetaMask clients
+ * currently use; clients can override via
  * `instanceOptions.subjectMetadataController.subjectCacheLimit`.
  */
 const DEFAULT_SUBJECT_CACHE_LIMIT = 100;
@@ -38,6 +38,10 @@ export const subjectMetadataController: InitializationConfiguration<
         parent,
       });
 
+    // `SubjectMetadataController` calls `PermissionController:hasPermissions`
+    // while hydrating persisted subjects, so `PermissionController` must be
+    // initialized first (it registers that handler in its constructor). The
+    // alphabetical export order in `instances/index.ts` guarantees this.
     parent.delegate({
       messenger: subjectMetadataControllerMessenger,
       actions: ['PermissionController:hasPermissions'],

packages/wallet/src/initialization/instances/subject-metadata-controller/types.ts

@@ -6,9 +6,8 @@ import type { SubjectMetadataController } from '@metamask/permission-controller'
 export type SubjectMetadataControllerInstanceOptions = {
   /**
    * Maximum number of distinct permissionless subjects (origins) to retain
-   * metadata for. Once exceeded, the oldest permissionless subject is evicted
-   * (FIFO). Defaults to `100` when omitted, matching the extension and mobile
-   * clients.
+   * metadata for, evicted oldest-first once exceeded. Defaults to a
+   * platform-agnostic value when omitted.
    */
   subjectCacheLimit?: ConstructorParameters<
     typeof SubjectMetadataController