fix(auth): authenticate producer-signed decisions before authorization

Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
2026-10-16 07:51:44 +02:00 · 2026-10-16 07:51:44 +02:00 · c80a944105
commit c80a944105
parent 6bd7129eac
30 changed files with 2059 additions and 32 deletions
--- a/tests/test_decision_replay.py
+++ b/tests/test_decision_replay.py
@ -176,7 +176,7 @@ def test_the_guard_runs_before_the_token_is_read(tmp_path):
    """
    missing = tmp_path / "never-read.token"
    with pytest.raises(DecisionError, match="in-cluster Service name"):
-        check_decision(
+        check_decision(allow_unsigned_test_fixture=True,
            base_url="http://flex-auth-secrets-engine.flex-auth.svc.cluster.local:8080",
            token_file=missing,
            request={},