feat: notify the user when a scene writes to the clipboard (#9660)

SEC-001: copyToClipboard had no user-gesture gate, permission, or feedback,
so a scene could silently overwrite the OS clipboard. Raise a top-of-screen
toast on every scene-driven clipboard write.

Collapse repeats in NewNotificationController: only one clipboard toast is on
screen or queued at a time, so a scene writing every tick cannot grow a
backlog. The slot frees as soon as the toast is dismissed or expires, so the
next write raises a fresh toast with no cooldown.

Author: alejandro-jimenez-dcl

Explorer/Assets/DCL/Infrastructure/CrdtEcsBridge/JsModulesImplementation/RestrictedActions/RestrictedActionsAPIImplementation.cs

@@ -10,6 +10,8 @@
 using Utility.Arch;
 using DCL.ExternalUrlPrompt;
 using DCL.NftPrompt;
+using DCL.NotificationsBus;
+using DCL.NotificationsBus.NotificationTypes;
 using DCL.SceneRuntime.Apis.RestrictedActionsApi;
 using DCL.TeleportPrompt;
 using DCL.Utilities;
@@ -296,6 +298,11 @@ private async UniTask CopyToClipboardAsync(string text)
         {
             await UniTask.SwitchToMainThread();
             systemClipboard.Set(text);
+
+            // Raised on every write so a clipboard change driven by the scene, instead of by the user, is never
+            // silent: whatever the user had copied is gone and pasting now yields scene-controlled text. A scene
+            // can write on every tick, so the type is collapsible — the toast never queues more than one deep.
+            NotificationsBusController.Instance.AddNotification(new SceneClipboardWriteNotification());
         }
 
         /// <summary>

Explorer/Assets/DCL/Infrastructure/CrdtEcsBridge/JsModulesImplementation/RestrictedActions/Tests/RestrictedActionsAPIImplementationShould.cs

@@ -7,6 +7,8 @@
 using DCL.ECSComponents;
 using DCL.ExternalUrlPrompt;
 using DCL.NftPrompt;
+using DCL.NotificationsBus;
+using DCL.NotificationsBus.NotificationTypes;
 using DCL.TeleportPrompt;
 using DCL.UI;
 using Decentraland.Kernel.Apis;
@@ -33,12 +35,17 @@ public class RestrictedActionsAPIImplementationShould
         private ISystemClipboard systemClipboard;
         private IExplorerUiActions explorerUiActions;
         private World sceneWorld;
+        private int clipboardNotificationsReceived;
 
         [SetUp]
         public void SetUp()
         {
             EcsTestsUtils.SetUpFeaturesRegistry();
 
+            NotificationsBusController.Initialize(new NotificationsBusController());
+            clipboardNotificationsReceived = 0;
+            NotificationsBusController.Instance.SubscribeToNotificationTypeReceived(NotificationType.INTERNAL_SCENE_CLIPBOARD_WRITE, _ => clipboardNotificationsReceived++);
+
             mvcManager = Substitute.For<IMVCManager>();
             sceneStateProvider = Substitute.For<ISceneStateProvider>();
             sceneStateProvider.IsCurrent.Returns(true);
@@ -78,6 +85,7 @@ public void TearDown()
         {
             World.Destroy(sceneWorld);
             EcsTestsUtils.TearDownFeaturesRegistry();
+            NotificationsBusController.Reset();
         }
 
         [Test]
@@ -272,6 +280,42 @@ public void CopyToClipboard()
             systemClipboard.Received(1).Set(TEST_TEXT);
         }
 
+        [Test]
+        public void CopyToClipboard_NotifiesTheUser()
+        {
+            // Act
+            restrictedActionsAPIImplementation.TryCopyToClipboard("Ia Ia! Cthulhu Ftaghn!");
+
+            // Assert
+            Assert.AreEqual(1, clipboardNotificationsReceived);
+        }
+
+        [Test]
+        public void CopyToClipboard_NotifiesOnEveryWrite()
+        {
+            // Act: a scene calling from onUpdate writes on every tick
+            for (var i = 0; i < 10; i++)
+                restrictedActionsAPIImplementation.TryCopyToClipboard($"0xATTACKER{i}");
+
+            // Assert: the API reports every write; collapsing repeats into a single toast is the
+            // notification controller's job, so that it can uncollapse as soon as the toast is gone.
+            systemClipboard.Received(10).Set(Arg.Any<string>());
+            Assert.AreEqual(10, clipboardNotificationsReceived);
+        }
+
+        [Test]
+        public void CopyToClipboard_DoesNotNotify_WhenSceneIsNotCurrent()
+        {
+            // Arrange
+            sceneStateProvider.IsCurrent.Returns(false);
+
+            // Act
+            restrictedActionsAPIImplementation.TryCopyToClipboard("This should not be copied");
+
+            // Assert
+            Assert.AreEqual(0, clipboardNotificationsReceived);
+        }
+
         [Test]
         public void CopyToClipboard_DoesNotCopy_WhenSceneIsNotCurrent()
         {

Explorer/Assets/DCL/Notifications/Assets/NotificationIcons.asset

@@ -65,6 +65,8 @@ MonoBehaviour:
     value: {fileID: 21300000, guid: be351c6750a9f4b3c92f55ba96046a81, type: 3}
   - key: 57
     value: {fileID: 21300000, guid: 68f219c76f1104541b1be7ee15787e14, type: 3}
+  - key: 58
+    value: {fileID: 21300000, guid: 11e50157680834b92b7f75220b425747, type: 3}
   defaultIcon: {fileID: 21300000, guid: 93b9e2f69bc2e4cada2159afb0632935, type: 3}
   notificationIconBackgrounds:
   - key: 28

Explorer/Assets/DCL/Notifications/NewNotification/NewNotificationController.cs

@@ -26,13 +26,24 @@ public class NewNotificationController : ControllerBase<NewNotificationView>
         private static readonly int HIDE_TRIGGER = Animator.StringToHash("Hide");
         private static readonly TimeSpan TIME_BEFORE_HIDE_NOTIFICATION_TIME_SPAN = TimeSpan.FromSeconds(5f);
 
+        /// <summary>
+        ///     Types that carry a standing condition rather than a one-off event, so a second one while the first is
+        ///     still on screen would say nothing new. Only one instance of these is ever queued or displayed at a
+        ///     time; further ones are dropped instead of piling up behind it.
+        /// </summary>
+        private static readonly List<NotificationType> COLLAPSIBLE_NOTIFICATION_TYPES = new ()
+        {
+            NotificationType.INTERNAL_SCENE_CLIPBOARD_WRITE,
+        };
+
         private readonly NotificationIconTypes notificationIconTypes;
         private readonly NotificationDefaultThumbnails notificationDefaultThumbnails;
         private readonly NftTypeIconSO rarityBackgroundMapping;
         private readonly IProfileRepository profileRepository;
         private readonly ImageControllerProvider imageControllerProvider;
         private readonly Queue<INotification> notificationQueue = new ();
         private bool isDisplaying;
+        private NotificationType? displayingNotificationType;
         private ImageController? thumbnailImageController;
         private ImageController badgeThumbnailImageController;
         private ImageController friendsThumbnailImageController;
@@ -93,6 +104,10 @@ private void StopAnimation()
             cts.SafeCancelAndDispose();
             cts = new CancellationTokenSource();
             cts.Token.ThrowIfCancellationRequested();
+
+            // Dismissing hands the screen slot back immediately — the fade-out that follows is cosmetic, so a
+            // collapsible type must not stay suppressed for its duration.
+            displayingNotificationType = null;
         }
 
         private void ClickedNotification(NotificationType notificationType, INotification notification)
@@ -104,11 +119,32 @@ private void ClickedNotification(NotificationType notificationType, INotificatio
         private void QueueNewNotification(INotification newNotification)
         {
             ReportHub.Log(ReportCategory.GIFTING, $"{newNotification.Type}");
+
+            if (COLLAPSIBLE_NOTIFICATION_TYPES.Contains(newNotification.Type) && IsPending(newNotification.Type))
+                return;
+
             notificationQueue.Enqueue(newNotification);
 
             if (!isDisplaying) { DisplayNewNotificationAsync().Forget(); }
         }
 
+        /// <summary>
+        ///     Whether a notification of this type is on screen right now or waiting behind the one that is.
+        /// </summary>
+        private bool IsPending(NotificationType type)
+        {
+            if (displayingNotificationType == type)
+                return true;
+
+            foreach (INotification queued in notificationQueue)
+            {
+                if (queued.Type == type)
+                    return true;
+            }
+
+            return false;
+        }
+
         private async UniTaskVoid DisplayNewNotificationAsync()
         {
             if (viewInstance == null)
@@ -118,11 +154,13 @@ private async UniTaskVoid DisplayNewNotificationAsync()
             {
                 isDisplaying = true;
                 INotification notification = notificationQueue.Dequeue();
+                displayingNotificationType = notification.Type;
 
                 switch (notification.Type)
                 {
                     case NotificationType.INTERNAL_ARRIVED_TO_DESTINATION:
                     case NotificationType.INTERNAL_SERVER_ERROR:
+                    case NotificationType.INTERNAL_SCENE_CLIPBOARD_WRITE:
                         await ProcessArrivedNotificationAsync(notification);
                         break;
                     case NotificationType.COMMUNITY_VOICE_CHAT_STARTED:
@@ -158,6 +196,9 @@ private async UniTaskVoid DisplayNewNotificationAsync()
                         await ProcessDefaultNotificationAsync(notification);
                         break;
                 }
+
+                // The natural-expiry counterpart to the reset in StopAnimation, which covers early dismissal.
+                displayingNotificationType = null;
             }
 
             isDisplaying = false;

Explorer/Assets/DCL/Notifications/NotificationsMenu/NotificationsPanelController.cs

@@ -41,6 +41,7 @@ public class NotificationsPanelController : ControllerBase<NotificationsMenuView
             NotificationType.COMMUNITY_DEEP_LINK,
             NotificationType.INTERNAL_DEFAULT_SUCCESS,
             NotificationType.INTERNAL_SERVER_ERROR,
+            NotificationType.INTERNAL_SCENE_CLIPBOARD_WRITE,
         };
 
         private readonly NotificationsRequestController notificationsRequestController;

Explorer/Assets/DCL/NotificationsBus/NotificationTypes/NotificationType.cs

@@ -73,5 +73,7 @@ public enum NotificationType
         BAN_WARNING,
         BANNED,
         BAN_LIFTED,
+
+        INTERNAL_SCENE_CLIPBOARD_WRITE,
     }
 }

Explorer/Assets/DCL/NotificationsBus/NotificationTypes/SceneClipboardWriteNotification.cs

@@ -0,0 +1,21 @@
+
+namespace DCL.NotificationsBus.NotificationTypes
+{
+    /// <summary>
+    /// An internal notification used to let the user know that the scene they are in wrote to the system clipboard,
+    /// discarding whatever they had copied before.
+    /// It will appear at the top of the screen, and not in the notifications feed.
+    /// </summary>
+    public class SceneClipboardWriteNotification : NotificationBase
+    {
+        private const string HEADER_TEXT = "A scene has replaced your clipboard content";
+
+        public override string GetHeader() =>
+            HEADER_TEXT;
+
+        public SceneClipboardWriteNotification()
+        {
+            Type = NotificationType.INTERNAL_SCENE_CLIPBOARD_WRITE;
+        }
+    }
+}