From 7859890402d05445a7fb3583ef331128b3f440f2 Mon Sep 17 00:00:00 2001 From: candyburst Date: Sun, 31 May 2026 20:05:10 +0530 Subject: [PATCH] fix: throw error instead of warning for test-only function in production Changes createSpendPermissionTypedDataWithSeconds production guard from soft console.warn to hard throw. ## Problem Current guard uses console.warn which is invisible to end-users and silently swallowed by logging pipelines. Function continues execution and returns valid SpendPermissionTypedData that can be signed and submitted on-chain in production. ## Risk Spend permissions authorize recurring token withdrawals. Test utility with arbitrary second-level periods could be used (accidentally or intentionally) in production, creating permissions with very short periods that drain allowances rapidly and are not supported by production UX. ## Solution Replace console.warn with throw Error: ```ts if (process.env.NODE_ENV === 'production') { throw new Error( 'createSpendPermissionTypedDataWithSeconds is for testing only...' ); } ``` ## Impact - Production callers fail fast and loudly - Prevents accidental misuse in production - Aligns with @testOnly JSDoc annotation intent - No breaking change for correct usage (test-only) Fixes #325 Co-Authored-By: Claude Opus 4.7 (1M context) --- .../interface/public-utilities/spend-permission/utils.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/account-sdk/src/interface/public-utilities/spend-permission/utils.ts b/packages/account-sdk/src/interface/public-utilities/spend-permission/utils.ts index eaf7fe31..a9774ac0 100644 --- a/packages/account-sdk/src/interface/public-utilities/spend-permission/utils.ts +++ b/packages/account-sdk/src/interface/public-utilities/spend-permission/utils.ts @@ -124,9 +124,9 @@ export function createSpendPermissionTypedDataWithSeconds( // Runtime check to prevent misuse if (process.env.NODE_ENV === 'production') { - console.warn( - '⚠️ createSpendPermissionTypedDataWithSeconds is being used. ' + - 'This function is intended for testing purposes only.' + throw new Error( + 'createSpendPermissionTypedDataWithSeconds is for testing only and must not be called in production. ' + + 'Use createSpendPermissionTypedData with periodInDays instead.' ); }