Skip to content

fix(flashcard): stop logging withdraw parameters from NFC reads - #721

Open
islandbitcoin wants to merge 2 commits into
mainfrom
fix/flashcard-log-withdraw-params
Open

islandbitcoin wants to merge 2 commits into
mainfrom
fix/flashcard-log-withdraw-params

Conversation

@islandbitcoin

Copy link
Copy Markdown
Contributor

Why

app/contexts/Flashcard.tsx logged the LNURL-withdraw k1 and callback on every payment tap, the card's LNURL on every balance read, and the raw error object on failure. An axios error embeds the request URL, which carries the card's p/c parameters. Together those values authorise a withdrawal from the card, and there is no transform-remove-console in babel.config.js, so they ship in release builds too.

What

  • Remove the four debug dumps (k1, callback, LNURL, balance).
  • On the two failure paths, log only the error message via a small errorMessage helper instead of the whole error.
  • Add __tests__/contexts/flashcard-no-withdraw-logging.spec.tsx: drives both tap paths (payment and balance) and the fetch-failure path through FlashcardProvider with the NFC, lnurl and axios boundaries mocked, and asserts the parameters land in context state but never reach any console method.

No payment, custody, or NFC behaviour changes. No dependency changes. No native changes.

Adjacent logging reviewed

console.warn("Oops!", ex) at the top of handleTag catches NfcManager errors, which do not carry card parameters, so it is left alone. The redeem-lnurl-withdrawal screens log the LNURL server response (status/reason) only. Out of scope but worth a follow-up: the error toast in getPayDetails renders the raw lnurlw payload on screen.

Validation

  • yarn check-code (tsc, translations, codegen, graphql) passes.
  • yarn test: 97 suites, 962 tests pass.
  • eslint clean on the test file; the five eslint errors on Flashcard.tsx are pre-existing lines this PR does not touch.
  • Physical NFC read on TEST is still to be done: it needs a debug build on a real device plus a Flashcard tap. Tracked on the Buzz issue.

Buzz issue: 461d8d90cfa90173cf2de35e582cfd222a90e6719dcad5287094ea65dac6d479

🤖 Generated with Claude Code

Dread and others added 2 commits September 15, 2026 11:38
The Flashcard context logged the LNURL-withdraw k1 and callback on every
payment tap, the card's LNURL on every balance read, and the raw error
object (which for axios embeds the request URL with the card's p/c
parameters) on failure. Together those values authorise a withdrawal
from the card, and nothing strips console output from release builds.

Remove the debug dumps, log only the error message on failure, and add a
unit guard that drives both tap paths through the provider and asserts
the parameters land in state but never reach any console method.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Review on #721: an Error message or a thrown string can itself contain
the card's withdraw URL, so passing message text to console.warn still
leaked it. Replace the helper with one that emits only the error class
name (or typeof for non-Errors) and, when present, the numeric HTTP
status. Cover both failure paths with synthetic parameter-bearing
messages: an axios-style Error with the URL in message and config plus
a 500 status, an Error from the lnurl lookup, and a thrown string.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants