test(tests-bypass-email): Use mocked email on testing by christopherferreira9 · Pull Request #318 · zerodevapp/zerodev-wallet-sdk

christopherferreira9 · 2026-07-08T17:16:23Z

Summary

Previously, all E2E and integration tests required hitting Guerrilla Mail and Turnkey to complete OTP flows, making them brittle and slow due to external rate limits. This PR introduces a USE_REAL_EMAIL flag that switches tests between real and mocked backends — PR runs use mocked mode (no external dependencies), and a new daily scheduled workflow runs with real email to catch live-service regressions.

SDK side changes

packages/core/src/core/createZeroDevWalletCore.ts

Added dangerouslyOverrideOtpSignerPublicKey?: string to ZeroDevWalletConfigCore. When present, it's forwarded to encryptOtpAttempt as dangerouslyOverrideSignerPublicKey, bypassing the production-pinned TLS Fetcher key check. The spread conditional (...(config.x && { ... })) ensures the property is only passed when explicitly set — it never appears in a normal integrator's call.

packages/react/src/core/connector.ts

Same option added to ConnectorCoreParams. It's forwarded into createZeroDevWallet() using the same conditional spread — so an integrator who doesn't set it gets no property at all, not undefined.

Both additions are marked @internal with a "Never set this in production" JSDoc comment.

Tests added

packages/core/src/utils/encryptOtpAttempt.test.ts — new test: generates a fresh ephemeral key pair (not the production pinned key), builds a test bundle signed with it, and asserts that calling encryptOtpAttempt without the override throws does not match pinned signing key. This proves the default path enforces the production key.

packages/react/src/connector.test.ts — two new tests in a dangerouslyOverrideOtpSignerPublicKey security guard describe block:

A connector created without the option must not forward it to createZeroDevWallet — guards against accidental propagation.
A connector explicitly configured with it must forward it correctly — proves the intentional path works.

Workflow changes

`ci.yml`

Renamed test job from "Test" → "Unit Tests"
Extracted integration and E2E jobs into a reusable workflow (test.yml). The two inline jobs (integration-test, e2e-test) were removed from ci.yml and replaced with a single call-tests job that delegates to test.yml. This also drops the dependency on the build job for parallel execution in favor of faster feedback from tests.
Added all-checks-pass gate job - a job that acts as a single source of truth for what jobs require a passing status in order for the merge to be possible. This reduces management on the repository settings as we can remove and add mandatory jobs through code. The repository then only needs to have all-checks-pass passing.

`test.yml` - new workflow

Reusable workflow extracted from ci.yml. It contains:

Integration Tests — runs pnpm test:integration
Browser E2E Tests — builds the SDK, starts the demo app, runs Playwright
Both of these workflows accept a newly added input called use_real_email with the default value being true. ci.yml then sends use_real_email as false in order to remove the dependency on the email service on PRs and main runs (we may consider using the real email service for main runs - to be discussed).

`test.yml` - new workflow

Runs test.yml daily at 08:00 UTC with use_real_email: true (real Guerrilla Mail + Turnkey). Also triggerable manually via workflow_dispatch with the option to toggle email mode.

Concerns

1. Mock fidelity
As the payload returned by the backend can change, fixtures can become stale and results would not be reliable. A fixture-shape.test.ts test has been created to catch this drift on real email mode. On a future development, the PR t update the fixture can be made automatically on failure.

2. The rejection test tests the mock, not the logic
"should reject an invalid OTP code" in mock mode stacks setupNodeMocks({ rejectOtpVerify: true }), which unconditionally returns HTTP 400 regardless of what was sent. It doesn't verify that a semantically wrong OTP (wrong code, wrong encryption) is actually detected — it verifies that an HTTP 400 throws an exception. This test is still valued as we have UI checks - we should rename this test if we intend to keep it.

3. dangerouslyOverrideSignerPublicKey is a scattered pattern
Every integration test call site that invokes encryptOtpAttempt directly must manually pass dangerouslyOverrideSignerPublicKey: isRealEmail() ? undefined : MOCK_OTP_SIGNER_PUBLIC_KEY. This is currently in three places. Anyone writing a new integration test that calls encryptOtpAttempt directly will get a cryptic key-mismatch error in mock mode until they discover the pattern. This can be mitigated.

4. Fork PRs have no integration test coverage at all
call-tests is skipped on fork PRs (no secret access). all-checks-pass treats skipped as OK, so external contributors get zero integration or E2E feedback. A fork PR that breaks the OTP flow in a way that unit tests don't catch can pass all required checks. I personally think this is acceptable.

5. otp-init-shape.test.ts is permanently skipped in mock mode
This test exists specifically to validate the shape of the real backend's OTP init response and verify the production pinned key. Skipping it in mock mode means the CI run that runs on every PR never exercises it. It only runs in the daily scheduled run. If the production key rotates or the bundle shape changes, a PR that breaks the integration won't be caught at PR time.

6. Passkeys can't be tested when the mock mode is enabled

…on fixture

…shared tracing

…AL_EMAIL

…se a mocked publicKey updates integration tests to also follow the same logic for using a real email or use a mocked email

vercel · 2026-07-08T17:16:28Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
zerodev-signer-demo	Ready	Preview, Comment	Jul 9, 2026 1:54pm

pkg-pr-new · 2026-07-08T17:18:57Z

Open in StackBlitz

npm i https://pkg.pr.new/zerodevapp/zerodev-wallet-sdk/@zerodev/wallet-core@318

npm i https://pkg.pr.new/zerodevapp/zerodev-wallet-sdk/@zerodev/wallet-react@318

npm i https://pkg.pr.new/zerodevapp/zerodev-wallet-sdk/@zerodev/react-ui@318

npm i https://pkg.pr.new/zerodevapp/zerodev-wallet-sdk/@zerodev/wallet-react-ui@318

commit: 26afb76

… unit test job

…catch fixture drift

christopherferreira9 · 2026-07-09T10:58:43Z


  test:
-    name: Test
+    name: Unit Tests


Renamed for a clear read on the pipeline since it hasn't been extracted to the dedicated test workflow.

christopherferreira9 · 2026-07-09T10:59:31Z

+      use_real_email: false
+    secrets: inherit
+
+  all-checks-pass:


single job to have a mandatory success status. Easier to maintain through code.

christopherferreira9 · 2026-07-09T11:00:33Z

+
+on:
+  schedule:
+    - cron: '0 8 * * *'


Currently scheduled to run daily using using real email keeping the original behavior and reducing the amount of flakiness due to rate limiting from the email service probider.

christopherferreira9 · 2026-07-09T11:02:08Z

+          # Pin the bundler/paymaster to staging so the AA stack matches the
+          # staging KMS above (the SDK default host is prod).
+          NEXT_PUBLIC_ZERODEV_AA_HOST: https://staging-meta-aa-provider.onrender.com
+          USE_REAL_EMAIL: ${{ inputs.use_real_email }}


Demo is built with this env variable which is then passed downstream to the wagmi options.

christopherferreira9 · 2026-07-09T11:05:01Z

-    const otpCode = extractOtpCodeFromMagicLinkUrl(emailContent)
+    // Step 6: Resolve OTP code — use fixture value in mock mode, poll inbox in real mode
+    const otpCode =
+      magicLinkSession.otpCode ??


when in mock mode, otpCode comes directly from the fixture. The fixture handles the real vs mocked email logic.

christopherferreira9 added 10 commits July 8, 2026 15:01

test(avoid-temp-email) use a different test structure

aa0b71d

test(avoid-temp-email) update connector and WalletCore to use bypass

2558372

test(avoid-temp-email): adds test OTP generation logic

dbd558a

test(avoid-temp-email): updates the demo app to use bypass

20bc675

test(avoid-temp-email): adds mocking

62398bc

test(avoid-temp-email): updates tests to use fixtures

0f0e24c

test(avoid-temp-email): add signing mocks and adds authenticatedSessi…

50383a7

…on fixture

test(avoid-temp-email): fix mock gaps and add CI observability; adds …

0525d0a

…shared tracing

test(avoid-temp-email): adapt reuseExistingServer depending on USE_RE…

19a916a

…AL_EMAIL

test(avoid-temp-email): adds unit tests to cover internal option to u…

b19dd8f

…se a mocked publicKey updates integration tests to also follow the same logic for using a real email or use a mocked email

vercel Bot deployed to Preview July 8, 2026 17:19 View deployment

christopherferreira9 added 2 commits July 8, 2026 18:24

test(avoid-temp-email): annotates email mode in workflows and renames…

6bb546c

… unit test job

test(avoid-temp-email): decouples the main build step from the tests

a1c0644

vercel Bot deployed to Preview July 8, 2026 17:28 View deployment

vercel Bot deployed to Preview July 8, 2026 17:40 View deployment

test(avoid-temp-email): adds single required check

2d40b8a

christopherferreira9 changed the title ~~Cferreira/avoid temp email dependency~~ test(tests-bypass-email): Use mocked email on testing Jul 9, 2026

vercel Bot deployed to Preview July 9, 2026 08:38 View deployment

test(avoid-temp-email): adds a shared backend mocking approach

9d5e9f1

vercel Bot deployed to Preview July 9, 2026 09:56 View deployment

test(avoid-temp-email): updates fixture and adds intgration tests to …

b184e13

…catch fixture drift

vercel Bot deployed to Preview July 9, 2026 10:16 View deployment

Merge branch 'main' into cferreira/avoid-temp-email-dependency

eb5b385

vercel Bot deployed to Preview July 9, 2026 10:31 View deployment

christopherferreira9 commented Jul 9, 2026

View reviewed changes

chore: trigger CI

031b45d

vercel Bot temporarily deployed to Preview July 9, 2026 13:47 Inactive

Merge branch 'main' into cferreira/avoid-temp-email-dependency

26afb76

vercel Bot deployed to Preview July 9, 2026 13:54 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

test(tests-bypass-email): Use mocked email on testing #318

test(tests-bypass-email): Use mocked email on testing #318
christopherferreira9 wants to merge 18 commits into
mainfrom
cferreira/avoid-temp-email-dependency

christopherferreira9 commented Jul 8, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

christopherferreira9 Jul 9, 2026

Uh oh!

christopherferreira9 Jul 9, 2026

Uh oh!

christopherferreira9 Jul 9, 2026

Uh oh!

christopherferreira9 Jul 9, 2026

Uh oh!

christopherferreira9 Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

christopherferreira9 commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

SDK side changes

Workflow changes

ci.yml

test.yml - new workflow

test.yml - new workflow

Concerns

Uh oh!

vercel Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

christopherferreira9 Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

christopherferreira9 Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

christopherferreira9 Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

christopherferreira9 Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

christopherferreira9 Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

christopherferreira9 commented Jul 8, 2026 •

edited

Loading

`ci.yml`

`test.yml` - new workflow

`test.yml` - new workflow

vercel Bot commented Jul 8, 2026 •

edited

Loading

pkg-pr-new Bot commented Jul 8, 2026 •

edited

Loading