Merge pull request #668 from Foundation-Devices/fix/refuse-untrusted-multisig

### CHANGELOG.md
@@ -5,6 +5,8 @@ SPDX-License-Identifier: GPL-3.0-or-later
 -->
 
 ## Head
+- Require confirmation before using PSBT-proposed multisig wallets with temporary seeds,
+  and cancel signing if import is declined
 - Added Coconut Wallet as a single-sig Connect Wallet option
 - Improved self-send transaction information formatting (PASS1-638)
 - Added the key manager extension, compatible with BIP85 and Nostr (PASS1-24)

### ports/stm32/boards/Passport/modules/flows/sign_psbt_common_flow.py
@@ -42,17 +42,14 @@ async def validate_psbt(self):
 
     async def check_multisig_import(self):
         from flows import ImportMultisigWalletFlow
-        from pages import ErrorPage
 
         # Based on the import mode and whether this already exists, the validation step
         # will have set this flag.
         if self.psbt.multisig_import_needs_approval:
             result = await ImportMultisigWalletFlow(self.psbt.active_multisig).run()
             if not result:
-                text = 'The transaction can still be signed, but this multisig config will not be saved.'
-                result2 = await ErrorPage(text=text, left_micron=microns.Back).show()
-                if not result2:
-                    return
+                self.set_result(None)
+                return
 
         self.goto(self.show_transaction_details)
 

### ports/stm32/boards/Passport/modules/public_constants.py
@@ -116,7 +116,7 @@
 MUSIG_ASK = const(1)
 MUSIG_SKIP = const(2)
 MUSIG_DEFAULT = MUSIG_ASK
-MUSIG_TEMP_DEFAULT = MUSIG_SKIP
+MUSIG_TEMP_DEFAULT = MUSIG_ASK
 
 # Default Directories
 DIR_BACKUPS = 'backups'

### ports/stm32/boards/Passport/modules/tests/test_unit.py
@@ -20,6 +20,10 @@ def test_ext_settings(test):
     assert test('ext_settings.py') == b'OK'
 
 
+def test_psbt_multisig_approval(test):
+    assert test('psbt_multisig_approval.py') == b'OK'
+
+
 def test_ui(test):
     assert test('ui.py') == b'OK'
 

### ports/stm32/boards/Passport/modules/tests/unit/psbt_multisig_approval.py
@@ -0,0 +1,105 @@
+# SPDX-FileCopyrightText: © 2026 Foundation Devices, Inc. <hello@foundation.xyz>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# Test approval of multisig wallets proposed by PSBTs.
+
+import common
+import flows
+import uasyncio as asyncio
+from flows import SignPsbtCommonFlow
+from public_constants import MUSIG_ASK, MUSIG_SKIP
+from utils import get_multisig_policy
+
+
+class FakeImportMultisigWalletFlow:
+    result = None
+    calls = 0
+
+    def __init__(self, wallet):
+        assert wallet == 'proposed-wallet'
+        FakeImportMultisigWalletFlow.calls += 1
+
+    async def run(self):
+        return self.result
+
+
+class FakePsbt:
+    def __init__(self, needs_approval):
+        self.multisig_import_needs_approval = needs_approval
+        self.active_multisig = 'proposed-wallet'
+
+
+class FakeSettings:
+    temporary_mode = True
+
+    def __init__(self, policy=None):
+        self.policy = policy
+
+    def get(self, key, default=None):
+        if key == 'temporary_seed':
+            return 'temporary-seed'
+        if key == 'multisig_policy' and self.policy is not None:
+            return self.policy
+        return default
+
+
+class FakeSignFlow:
+    def __init__(self, needs_approval):
+        self.psbt = FakePsbt(needs_approval)
+        self.show_transaction_details = 'transaction-details'
+        self.completed = False
+        self.result = 'unset'
+        self.next_state = None
+
+    def set_result(self, result):
+        self.completed = True
+        self.result = result
+
+    def goto(self, state):
+        self.next_state = state
+
+
+async def run_tests():
+    original_import_flow = flows.ImportMultisigWalletFlow
+    original_settings = common.settings
+
+    try:
+        flows.ImportMultisigWalletFlow = FakeImportMultisigWalletFlow
+
+        FakeImportMultisigWalletFlow.result = False
+        FakeImportMultisigWalletFlow.calls = 0
+        flow = FakeSignFlow(needs_approval=True)
+        await SignPsbtCommonFlow.check_multisig_import(flow)
+        assert FakeImportMultisigWalletFlow.calls == 1
+        assert flow.completed
+        assert flow.result is None
+        assert flow.next_state is None
+
+        FakeImportMultisigWalletFlow.result = True
+        FakeImportMultisigWalletFlow.calls = 0
+        flow = FakeSignFlow(needs_approval=True)
+        await SignPsbtCommonFlow.check_multisig_import(flow)
+        assert FakeImportMultisigWalletFlow.calls == 1
+        assert not flow.completed
+        assert flow.next_state == flow.show_transaction_details
+
+        FakeImportMultisigWalletFlow.calls = 0
+        flow = FakeSignFlow(needs_approval=False)
+        await SignPsbtCommonFlow.check_multisig_import(flow)
+        assert FakeImportMultisigWalletFlow.calls == 0
+        assert not flow.completed
+        assert flow.next_state == flow.show_transaction_details
+
+        common.settings = FakeSettings()
+        assert get_multisig_policy() == MUSIG_ASK
+
+        common.settings = FakeSettings(policy=MUSIG_SKIP)
+        assert get_multisig_policy() == MUSIG_SKIP
+
+        return_value.write(b'OK')
+    finally:
+        flows.ImportMultisigWalletFlow = original_import_flow
+        common.settings = original_settings
+
+
+asyncio.run(run_tests())