Skip to content

[Bug]: Execution-date constraints pass when the closed mandate omits execution_date #317

Description

@mh-yu

What happened?

Description

AP2 defines payment.execution_date as a constraint on when a payment may be executed. The closed Payment Mandate's execution_date must be within the open mandate's not_before / not_after window.

The Python SDK's ExecutionDateEvaluator does not enforce that window when the closed mandate omits execution_date. It reads the missing value and immediately returns no violations.

If omission is intended to mean immediate execution, the evaluator should compare a trusted effective execution time against the authorized window instead of passing automatically.

Impact

A closed Payment Mandate can satisfy an open mandate with an execution-date window while omitting execution_date.

The mandate signatures and chain may still verify, but the user's authorized execution window is not enforced before credential release or payment execution.

Steps to Reproduce

  1. Review docs/ap2/payment_mandate.md:246-257. payment.execution_date requires the Payment Mandate execution date to be within not_before / not_after.

  2. Review code/sdk/python/ap2/sdk/generated/payment_mandate.py:42-45. The closed mandate allows execution_date=None and describes omission as immediate execution.

  3. Review code/sdk/python/ap2/sdk/constraints.py:316-345. ExecutionDateEvaluator.evaluate() returns [] when closed_mandate.execution_date is missing.

  4. Review code/sdk/python/ap2/tests/constraints_tests.py:537-547. The existing test creates an open mandate with an execution window, passes a closed mandate with execution_date=None, and asserts that there are no violations.

Relevant log output

Code of Conduct

  • I agree to follow this project's Code of Conduct

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions