Skip to content

fix(spend-permission): throw instead of console.warn in createSpendPermissionTypedDataWithSeconds production guard#327

Open
Nexory wants to merge 2 commits into
base:masterfrom
Nexory:fix/spend-permission-testonly-throw
Open

fix(spend-permission): throw instead of console.warn in createSpendPermissionTypedDataWithSeconds production guard#327
Nexory wants to merge 2 commits into
base:masterfrom
Nexory:fix/spend-permission-testonly-throw

Conversation

@Nexory

@Nexory Nexory commented May 29, 2026

Copy link
Copy Markdown

Closes #325

@testonly function should throw in production, not console.warn — Issue #325

The diff is a 1-line behavioral fix. See Issue #325 for the full rationale.

…rmissionTypedDataWithSeconds production guard

The function is marked @testonly but the production guard previously
emitted only a console.warn before returning valid typed data. In a
bundled production build the warning is typically suppressed or
unobserved, so a caller who accidentally imports this helper still
receives the typed data and can submit a spend permission with raw
seconds (instead of days) as the period unit.

This patch throws instead, so the guard actually prevents misuse.

Closes base#325
@cb-heimdall

cb-heimdall commented May 29, 2026

Copy link
Copy Markdown
Collaborator

🟡 Heimdall Review Status

Requirement Status More Info
Reviews 🟡 0/1
Denominator calculation
Show calculation
1 if user is bot 0
1 if user is external 0
2 if repo is sensitive 0
From .codeflow.yml 1
Additional review requirements
Show calculation
Max 0
0
From CODEOWNERS 0
Global minimum 0
Max 1
1
1 if commit is unverified 0
Sum 1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

createSpendPermissionTypedDataWithSeconds: soft production guard (console.warn) should be a hard throw to prevent silent misuse

2 participants