Let CreateSessionOnMissing mint a sign_in session - #133
Merged
Conversation
A kind field on CreateSessionOnMissing rides through to POST /v1/sessions. A gate running an empty compliance policy that only needs an account to key state on could previously mint only the KYC kind, which asks the buyer for documents nothing checks. For sign_in the denial's default message says what the session actually asks for instead of the KYC copy. Parity with the node library. Takes agentscore-py 2.6.9, which carries the option. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CreateSessionOnMissinggains an optionalkind("kyc" | "sign_in") that rides through toPOST /v1/sessions. A gate running an empty compliance policy that only needs an account to key durable state on (a prepaid balance, say) could previously auto-mint only the KYC kind, which asks the buyer for identity documents nothing in that merchant ever checks;sign_inis registration-only and still yields an operator token. When the kind issign_inthe minted denial carries amessagedescribing an account sign-in instead of the KYC default, so a merchant using the default 403 body does not tell the agent something false. WhenkindisNonenothing changes: the body omits it and the API default applies. Parity with the node library change of the same day. Takesagentscore-py2.6.9, which carries the option.Type of change
Public API
CreateSessionOnMissing.kind: Literal["kyc", "sign_in"] | None = None(new, optional). No migration for existing callers.Test plan
tests/test_sessions.py: a new case asserts the POST body carrieskind: "sign_in"and that the returned reason'smessagetalks about signing in with an AgentScore account and not about KYC; the existing forwarding case additionally assertskindis absent when unset. Locally:uv run ruff check,uv run ruff format --check,uv run ty check agentscore_commerce/,uv run pytest(1869 passed, 4 skipped, 95.37% coverage against the 95% floor).Checklist
Worked with Varun. Version bumped to 2.9.0; the tag follows the merge. The README carries no
CreateSessionOnMissingexample today, so the field's docstring is its documentation.🤖 Generated with Claude Code