base / base/account-sdk

createSpendPermissionTypedDataWithSeconds: soft production guard (console.warn) should be a hard throw to prevent silent misuse

Open Beginner friendly
#325 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
172
Forks
207
Avg merge
49m
Merged PRs (30d)
1

Description

**File:** `packages/account-sdk/src/interface/public-utilities/spend-permission/utils.ts`
**Lines:** 109–154 (HEAD `24ab30c`)

**Summary**

`createSpendPermissionTypedDataWithSeconds` is documented as test-only (`@testOnly` JSDoc, warning comment). Its production guard (line 126–131) is:

```ts
if (process.env.NODE_ENV === 'production') {
console.warn(
'⚠️ createSpendPermissionTypedDataWithSeconds is being used. ' +
'This function is intended for testing purposes only.'
);
}
```

The function then **continues and returns valid `SpendPermissionTypedData`** regardless of environment. A `console.warn` in a production bundle is typically invisible to end-users and silently swallowed by logging pipelines. The "guard" does not guard: a developer who accidentally ships a call to this function in production will receive a fully-formed typed-data object that can be signed and submitted on-chain.

**Expected behavior**

The guard should be a hard `throw` (or at minimum prevent returning typed data) so that production callers fail fast and loudly:

```ts
if (process.env.NODE_ENV === 'production') {
throw new Error(
'createSpendPermissionTypedDataWithSeconds is for testing only and must not be called in production.'
);
}
```

**Why this matters**

Spend permissions authorise recurring token withdrawals from user accounts. A test utility that creates permissions with arbitrary second-level periods could be used (accidentally or intentionally) in production, creating permissions with very short periods that drain allowances rapidly and are not supported by the production UX.

**No existing issue found** (searched `createSpendPermissionTypedDataWithSeconds`, `testOnly production guard`, `console.warn throw` across all states).

Contributor guide

Open the contributing guide

Research direction

Open packages/account-sdk/src/interface/public-utilities/spend-permission/utils.ts and inspect createSpendPermissionTypedDataWithSeconds around lines 109–154, especially the production guard at lines 126–131. Replace the soft warning behavior with the requested fail-fast behavior, then verify that production calls no longer return typed data while non-production behavior remains usable.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
testing
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.