Repository navigation
Gw/kyc generalized demo - #11277
Gw/kyc generalized demo#11277georgeweiler wants to merge 3 commits into
Conversation
Replace the single-session KycController state with `sessions`, keyed by
vendor, so a second vendor (e.g. Kalshi) can hold its own session next to
Iron. Every session method takes `{ vendor }`; there is no active vendor.
- Add getSessionDecision (none/new/pending/approved/rejected/retry), moved
from RampsController's resolveVbaKycStatus
- Add acceptVendorDisclaimers so vendor terms accepted before a session
exists are stored on the controller, then submitted by
recordVendorDisclaimers({ vendor })
- Drop the stored email/vendor/geoCountry and their 'different X' guards;
email is only required when creating a session
- One SumSub flow on screen at a time; per-vendor polling loops
- Make vendor required on KycService.fetchVendorDisclaimers and
createUkycSession
- Remove dead KycPhase / KycProduct types
- RampsController passes vendor 'iron' and reads getSessionDecision
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ions Also require a session id in the controller's session lookup, stop recordVendorDisclaimers recreating an entry cleared mid-request, and update ARCHITECTURE.md's state and selectors sections. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 7cf90a1. Configure here.
| session = await this.messenger.call( | ||
| 'KycController:fetchSessionStatusOnce', | ||
| session.id, | ||
| vendorParams, |
There was a problem hiding this comment.
KYC reset wipes every vendor
Medium Severity
VBA hydration still calls KycController:clearState when the Iron session is from another profile or the status GET returns 404. That action now deletes every vendor entry and stops every poll loop, so a valid MoonPay session, its accepted terms, and in-flight polling are discarded even though only the Iron session is invalid.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 7cf90a1. Configure here.
Explanation
References
Checklist
Note
High Risk
Large breaking API and persisted-state shape changes in identity/KYC orchestration, with downstream ramps integration; clients must migrate stored state and every KycController call site.
Overview
BREAKING:
@metamask/kyc-controllerreplaces the single active session with a persistedsessionsmap keyed by identity vendor. Top-levelemail,vendor, andgeoCountryare removed; each entry holds that vendor'ssessionStatus, disclaimer acceptance, provider flow state, andresidenceCountry. Session APIs now take{ vendor },startSessionno longer rejects vendor/email/country mismatches, and vendor is required onKycService.fetchVendorDisclaimers/createUkycSession(no defaultmoonpay).New flows split vendor T&Cs into
acceptVendorDisclaimers(local, pre-session,submitted: false) andrecordVendorDisclaimers(POST stored acceptance once a session exists).getSessionDecision({ vendor })(plus exportedgetKycSessionDecision) collapses session + provider flow intonone|new|pending|approved|rejected|retry. Selectors becomeselectKycSession(state, vendor)andselectKycSessionStatus(state, vendor);KycPhase,KycProduct, and related legacy types are dropped.launchProviderFlowonly allows one SumSub UI at a time; per-vendor status polling andclearState/resetclear all vendors.@metamask/ramps-controlleradopts the new messenger contract for Iron VBA onboarding: KYC calls pass{ vendor: 'iron' },KycController:getSessionDecisionis required, andhydrateVbaOnboardinguses that action instead of localresolveVbaKycStatus.Reviewed by Cursor Bugbot for commit 7cf90a1. Bugbot is set up for automated code reviews on this repo. Configure here.