feat: add decoding rules for erc20-token-allowance and native-token-allowance

[jeffsmale90]

Explanation

Adds Advanced Permission type decoding rules for new permission types:

• erc20-token-allowance - grants a fixed allowance of a specified ERC20 token
• native-token-allowance - grants a fixed allowance of the native token

Previous to this change, the decoding logic required a single permission type to match the caveat types included in the delegation. Because these new permissions use the same caveats as the periodic permission types, the decoding logic is updated to filter permission types where the rules match, and require a single matching permission type to successfully validate and decode. erc20-token-periodic and native-token-periodic rules were updated to require periodDuration be less than the maximum allowed by the snap (10 years).

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Updates permission-type decoding to handle multiple rules sharing the same enforcer set and adds new allowance permission decoders; mistakes could cause misclassification/failed decoding of delegations. Adds stricter validation (e.g., max period duration) which may reject previously accepted caveats.

Overview
Adds new decoding rules for native-token-allowance and erc20-token-allowance (UINT256_MAX-based “allowance” variants of periodic enforcers), including comprehensive term validation and new unit tests.

Updates the decode flow to allow multiple rules to match the same enforcer-address pattern (findRulesWithMatchingCaveatAddresses) and then select a single validating rule via selectUniqueRuleAndDecodedPermission, with improved error reporting for no match vs ambiguous match.

Tightens validation for native-token-periodic and erc20-token-periodic by enforcing periodDuration <= MAX_PERIOD_DURATION (10 years). Also bumps @metamask/7715-permission-types to ^0.6.0 and updates the changelog.

^{Reviewed by Cursor Bugbot for commit c633a82. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​7715-permission-types@​0.5.0 ⏵ 0.6.0			+1	+1

View full report