fix: bind approval consumption to actual Flex Auth submissions
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-09 08:55:46 +02:00
parent 89bc31460f
commit ee4e901611
23 changed files with 612 additions and 1023 deletions

View file

@ -15,7 +15,7 @@ from datetime import datetime, timedelta, timezone
from http.server import BaseHTTPRequestHandler, HTTPServer
from secrets_engine.approval_claim import binding_from_check_request
from secrets_engine.authorization import request_digest
from secrets_engine.authorization import request_digest, approval_binding_digest
def _now():
@ -152,6 +152,9 @@ class AuthorizationStub:
if request.get("context") is not None:
binding["context"] = request["context"]
binding["request_digest"] = request_digest(request)
binding["submitted_request_digest"] = request_digest(request)
if "approval" in request.get("context", {}):
binding["approval_binding_digest"] = approval_binding_digest(request)
return {
"id": "decision:stub-" + request["action"],
"contract_version": "flex-auth.decision-record.v1",