coulomb/approval-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish approval engine spine

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2
This commit is contained in:
tegwick 2026-09-01 23:45:48 +02:00
parent e7c210bf56
commit c3f1dfbc07
18 changed files with 526 additions and 75 deletions
Download patch file Download diff file Expand all files Collapse all files

24
tests/test_t06_replay.py
View file

@ -4,13 +4,14 @@ Reuse a previously valid approval artifact for a different target, parameter
set, or later time. Pass: parameter binding, expiry, or replay protection
rejects the request.
Consume-side replay (use twice) waits on GH-WP-0002-T06. This suite covers
the object and claim side: wrong binding, expiry, revocation, supersession.
Consume-side replay follows GH-DEC-2026-003: same-digest retries are
idempotent; a different digest against a consumed object conflicts.
"""
from datetime import datetime, timezone
from approval_engine.binding import binding_digest
from approval_engine.errors import Conflict
from approval_engine.store import Engine
from tests.conftest import approve, binding, validity
@ -65,3 +66,22 @@ def test_t06_superseded_rejected(engine):
obj = approve(engine)
engine.supersede(obj.id)
assert _consumer_accepts(engine.claim(obj.id), binding()) is False
def test_t06_consumed_approval_rejects_different_request_digest(engine):
obj = approve(engine)
first = "sha256:" + "56" * 32
engine.consume(obj.id, first)
try:
engine.consume(obj.id, "sha256:" + "78" * 32)
raise AssertionError("consume-side replay must conflict")
except Conflict:
pass
def test_t06_consumed_approval_allows_same_request_retry(engine):
obj = approve(engine)
digest = "sha256:" + "9a" * 32
engine.consume(obj.id, digest)
retry = engine.consume(obj.id, digest)
assert retry["idempotent"] is True