Skip to content

Add dataSuffix to pay() with input validation#254

Merged
spencerstock merged 5 commits intomasterfrom
spencer/payment-data-suffix
Mar 4, 2026
Merged

Add dataSuffix to pay() with input validation#254
spencerstock merged 5 commits intomasterfrom
spencer/payment-data-suffix

Conversation

@spencerstock
Copy link
Copy Markdown
Collaborator

@spencerstock spencerstock commented Mar 3, 2026

Summary

Add optional dataSuffix parameter to pay() for attribution data. The suffix is threaded through to the SDK's attribution.dataSuffix preference and validated as a 0x-prefixed hex string. Removes the previous fixed 16-byte constraint on data suffix length.

Changes:

  • Add dataSuffix?: 0x${string}`` field to PaymentOptions type
  • Thread dataSuffix through pay() -> executePaymentWithSDK -> createEphemeralSDK
  • Set attribution.dataSuffix on SDK preference when dataSuffix is provided
  • Add validateDataSuffix() to sdkManager and base-account/utils
  • Remove fixed 16-byte length constraint from makeDataSuffix — accept any valid 0x-prefixed hex string
  • Update root README and payment README with dataSuffix usage examples
  • Simplify attribution comment in provider interface

How did you test your changes?

  • Unit tests for dataSuffix passthrough in pay.test.ts: verifies executePaymentWithSDK is called with the correct suffix
  • Unit tests for makeDataSuffix in utils.test.ts: validates rejection of non-0x-prefixed strings, acceptance of valid hex suffixes, and removal of the 16-byte length restriction

- Add optional `dataSuffix` field to `PaymentOptions` type (0x-prefixed hex)
- Thread dataSuffix through pay() -> executePaymentWithSDK -> createEphemeralSDK
- Set attribution.dataSuffix on SDK preference when dataSuffix is provided
- Add validateDataSuffix() to both sdkManager and base-account utils
- Remove fixed 16-byte length constraint from makeDataSuffix
- Update README and payment README with dataSuffix usage examples
- Add test coverage for dataSuffix passthrough and validation

Made-with: Cursor
@cb-heimdall
Copy link
Copy Markdown
Collaborator

cb-heimdall commented Mar 3, 2026

✅ Heimdall Review Status

Requirement Status More Info
Reviews 2/1
Denominator calculation
Show calculation
1 if user is bot 0
1 if user is external 0
2 if repo is sensitive 0
From .codeflow.yml 1
Additional review requirements
Show calculation
Max 0
0
From CODEOWNERS 0
Global minimum 0
Max 1
1
1 if commit is unverified 0
Sum 1

@spencerstock spencerstock marked this pull request as ready for review March 3, 2026 22:12
@spencerstock spencerstock changed the title Add dataSuffix to pay() with attribution validation Add dataSuffix to pay() with input validation Mar 3, 2026
Copy link
Copy Markdown
Collaborator

@ilikesymmetry ilikesymmetry left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm missing where we're actually leveraging the provided dataSuffix in our request to Keys? I'd expect to see something touching our prepared wallet_sendCalls request to add the dataSuffix capability to our existing one.

import type { PayerInfoResponses } from '../types.js';

function validateDataSuffix(dataSuffix: string): Hex {
if (!/^0x[0-9a-fA-F]*$/.test(dataSuffix)) {
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also could use isHex. I think they should also enforce that length is even # characters for complete bytes

Copy link
Copy Markdown
Collaborator Author

@spencerstock spencerstock Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think they should also enforce that length is even # characters for complete bytes

Is this enforced on-chain? I don't want to add any failures that could actually execute in other contexts

chainId: number,
walletUrl?: string,
telemetry: boolean = true,
dataSuffix?: string
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we want to make type Hex or 0x${string} throughout for consistency?

@spencerstock
Copy link
Copy Markdown
Collaborator Author

I'm missing where we're actually leveraging the provided dataSuffix in our request to Keys? I'd expect to see something touching our prepared wallet_sendCalls request to add the dataSuffix capability to our existing one.

I'm not touching the config vs capability question right now, this is just to hook up into the existing config based approach.

@spencerstock
Copy link
Copy Markdown
Collaborator Author

PR for docs changes here: base/docs#1177

@spencerstock spencerstock merged commit ccfa6bf into master Mar 4, 2026
9 checks passed
@spencerstock spencerstock deleted the spencer/payment-data-suffix branch March 4, 2026 10:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants