Skip to content

Add "total exposure" notice to stream permissions#279

Merged
jeffsmale90 merged 13 commits intomainfrom
feat/exposure-notice
Mar 11, 2026
Merged

Add "total exposure" notice to stream permissions#279
jeffsmale90 merged 13 commits intomainfrom
feat/exposure-notice

Conversation

@jeffsmale90
Copy link
Contributor

@jeffsmale90 jeffsmale90 commented Mar 9, 2026

Description

The "stream" permissions are very complex, and it's difficult to determine the total amount that a given permission exposes to the recipient.

This PR updates erc20-token-stream and native-token-stream permissions to add a "total exposure" notice. This will show as a field similar to "Amount per second".

  • "Amount per second" and "Total exposure" have been rerendered as text fields instead of disabled input fields.
  • Updates test for "no expiry" notice.

Minor refresh of uneditable fields:

  • Display with label above the value, identical to "Stream rate" and "Total exposure"
  • Will not be rendered if they don't have a value (previously rendered with just a label and no context about why there's no value)
image Note: no "Max amount"

Manual testing steps

  • Request an erc20-token-stream or native-token-stream permission
  • If an expiry or max-amount is specified, expect "This permission grants a total of amount token"
  • if neither expiry or max-amount is specified, expect "This permission grants an unlimited amount"

Add / remove expiry and max amount and adjust the token amounts to validate different outcomes.

Screenshots/Recordings

image image

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Adds new exposure calculation and surfaces it in the confirmation UI for stream permissions; incorrect math/formatting could misrepresent a permission’s effective limits to users.

Overview
Adds a “Total exposure” display to erc20-token-stream and native-token-stream confirmation screens, derived from max amount and/or stream duration (expiry) and shown as Unlimited when uncapped.

Introduces deriveExposureForStreamingPermission in permissions/rules.ts, threads totalExposure through stream deriveMetadata/metadata types, and updates stream rate rendering to use display-style Field components instead of disabled inputs.

Refreshes uneditable field rendering across InputField, DateTimePickerField, DropdownField, TextField, and Field (vertical layout + hide empty uneditable values), updates English copy from expiry to expiration date, and adjusts snapshots/tests accordingly.

Written by Cursor Bugbot for commit 32981b3. This will update automatically on new commits. Configure here.

…total exposure over the lifetime of the permission
@jeffsmale90 jeffsmale90 requested a review from a team as a code owner March 9, 2026 01:29
- TextField now has direction parameter that allows for vertical (label above) and horizontal (label left)
- stream rate and Total exposure also use TextField
- Fields with no value are not displayed when they are uneditable (isAdjustmentAllowed: false)
@jeffsmale90 jeffsmale90 force-pushed the feat/exposure-notice branch from c1d159d to 32981b3 Compare March 11, 2026 06:30
Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Copy link
Contributor

@mj-kiwi mj-kiwi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jeffsmale90 jeffsmale90 merged commit 1ac611e into main Mar 11, 2026
16 checks passed
@jeffsmale90 jeffsmale90 deleted the feat/exposure-notice branch March 11, 2026 15:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants