What happened?
Description
AP2 defines payment.execution_date as a constraint on when a payment may be executed. The closed Payment Mandate's execution_date must be within the open mandate's not_before / not_after window.
The Python SDK's ExecutionDateEvaluator does not enforce that window when the closed mandate omits execution_date. It reads the missing value and immediately returns no violations.
If omission is intended to mean immediate execution, the evaluator should compare a trusted effective execution time against the authorized window instead of passing automatically.
Impact
A closed Payment Mandate can satisfy an open mandate with an execution-date window while omitting execution_date.
The mandate signatures and chain may still verify, but the user's authorized execution window is not enforced before credential release or payment execution.
Steps to Reproduce
-
Review docs/ap2/payment_mandate.md:246-257. payment.execution_date requires the Payment Mandate execution date to be within not_before / not_after.
-
Review code/sdk/python/ap2/sdk/generated/payment_mandate.py:42-45. The closed mandate allows execution_date=None and describes omission as immediate execution.
-
Review code/sdk/python/ap2/sdk/constraints.py:316-345. ExecutionDateEvaluator.evaluate() returns [] when closed_mandate.execution_date is missing.
-
Review code/sdk/python/ap2/tests/constraints_tests.py:537-547. The existing test creates an open mandate with an execution window, passes a closed mandate with execution_date=None, and asserts that there are no violations.
Relevant log output
Code of Conduct
What happened?
Description
AP2 defines
payment.execution_dateas a constraint on when a payment may be executed. The closed Payment Mandate'sexecution_datemust be within the open mandate'snot_before/not_afterwindow.The Python SDK's
ExecutionDateEvaluatordoes not enforce that window when the closed mandate omitsexecution_date. It reads the missing value and immediately returns no violations.If omission is intended to mean immediate execution, the evaluator should compare a trusted effective execution time against the authorized window instead of passing automatically.
Impact
A closed Payment Mandate can satisfy an open mandate with an execution-date window while omitting
execution_date.The mandate signatures and chain may still verify, but the user's authorized execution window is not enforced before credential release or payment execution.
Steps to Reproduce
Review
docs/ap2/payment_mandate.md:246-257.payment.execution_daterequires the Payment Mandate execution date to be withinnot_before/not_after.Review
code/sdk/python/ap2/sdk/generated/payment_mandate.py:42-45. The closed mandate allowsexecution_date=Noneand describes omission as immediate execution.Review
code/sdk/python/ap2/sdk/constraints.py:316-345.ExecutionDateEvaluator.evaluate()returns[]whenclosed_mandate.execution_dateis missing.Review
code/sdk/python/ap2/tests/constraints_tests.py:537-547. The existing test creates an open mandate with an execution window, passes a closed mandate withexecution_date=None, and asserts that there are no violations.Relevant log output
Code of Conduct