createSpendPermissionTypedDataWithSeconds: soft production guard (console.warn) should be a hard throw to prevent silent misuse
- Dominant language
- TypeScript
- Stars
- 172
- Forks
- 207
- Avg merge
- 49m
- Merged PRs (30d)
- 1
Description
**File:** `packages/account-sdk/src/interface/public-utilities/spend-permission/utils.ts`
**Lines:** 109–154 (HEAD `24ab30c`)
**Summary**
`createSpendPermissionTypedDataWithSeconds` is documented as test-only (`@testOnly` JSDoc, warning comment). Its production guard (line 126–131) is:
```ts
if (process.env.NODE_ENV === 'production') {
console.warn(
'⚠️ createSpendPermissionTypedDataWithSeconds is being used. ' +
'This function is intended for testing purposes only.'
);
}
```
The function then **continues and returns valid `SpendPermissionTypedData`** regardless of environment. A `console.warn` in a production bundle is typically invisible to end-users and silently swallowed by logging pipelines. The "guard" does not guard: a developer who accidentally ships a call to this function in production will receive a fully-formed typed-data object that can be signed and submitted on-chain.
**Expected behavior**
The guard should be a hard `throw` (or at minimum prevent returning typed data) so that production callers fail fast and loudly:
```ts
if (process.env.NODE_ENV === 'production') {
throw new Error(
'createSpendPermissionTypedDataWithSeconds is for testing only and must not be called in production.'
);
}
```
**Why this matters**
Spend permissions authorise recurring token withdrawals from user accounts. A test utility that creates permissions with arbitrary second-level periods could be used (accidentally or intentionally) in production, creating permissions with very short periods that drain allowances rapidly and are not supported by the production UX.
**No existing issue found** (searched `createSpendPermissionTypedDataWithSeconds`, `testOnly production guard`, `console.warn throw` across all states).
Contributor guide
Research direction
Open packages/account-sdk/src/interface/public-utilities/spend-permission/utils.ts and inspect createSpendPermissionTypedDataWithSeconds around lines 109–154, especially the production guard at lines 126–131. Replace the soft warning behavior with the requested fail-fast behavior, then verify that production calls no longer return typed data while non-production behavior remains usable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- testing
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100