coulomb/approval-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: confirm exact canonical consumed act binding

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 09:20:33 +02:00
parent 8624fa20bb
commit eece796b8b
3 changed files with 98 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
approval_engine/execution_confirmation.py
View file

@ -8,7 +8,7 @@ from datetime import datetime
from typing import Any
from urllib.parse import quote
from .binding import DIGEST_RE, canonical_binding
from .binding import DIGEST_RE, binding_digest
from .pep import ApprovalHTTPClient, ApprovalProtocolError, _ID_RE
@ -71,7 +71,7 @@ class ExecutionConfirmationClient(ApprovalHTTPClient):
if not isinstance(expected_pdp_digest, str) or not DIGEST_RE.fullmatch(expected_pdp_digest):
raise ApprovalProtocolError("exact approval-free PDP digest is required")
try:
expected = canonical_binding(expected_binding)
expected = binding_digest(expected_binding)
except (TypeError, ValueError, KeyError):
raise ApprovalProtocolError("expected act binding is invalid") from None
obj = self._request("GET", f"/v1/approvals/{quote(approval_id, safe='')}")
@ -81,7 +81,11 @@ class ExecutionConfirmationClient(ApprovalHTTPClient):
raise ApprovalProtocolError("consumption object is not a decision")
served = obj.get("binding")
try:
same_act = isinstance(served, dict) and canonical_binding(served) == expected
same_act = (
isinstance(served, dict)
and binding_digest(served) == expected
and served.get("digest") == expected
)
except (TypeError, ValueError, KeyError):
same_act = False
if not same_act or served.get("pdp_digest") != expected_pdp_digest: