fix(signing): add the webhook target-uri code and reject authorities that empty

Two review corrections.

1. The spec DOES define the webhook twin. security.mdx's webhook checklist
   lists `webhook_target_uri_malformed` in the error taxonomy and requires it
   at step 10 for a malformed or mismatched authority. The earlier claim that
   no webhook twin existed came from grepping this repo rather than the spec,
   and retagging onto `webhook_signature_header_malformed` put a stable but
   WRONG code on the wire. Adds WEBHOOK_TARGET_URI_MALFORMED and maps
   REQUEST_TARGET_URI_MALFORMED to it. The name breaks the
   `webhook_signature_` prefix the rest of the family carries because the spec
   names it that way.

2. `_canon_host` stripped the trailing root dot AFTER
   `_malformed_authority_reason` had already accepted the netloc, and the raw
   netloc `.` is non-empty and passes as a host. So `https://./p`
   canonicalized to `https:///p` -- the empty authority this module rejects as
   `malformed-empty-authority`, reached by a path that ran the gate too early.
   `https://../p` yielded the authority `.`.

   The check now re-runs after the strip and is stated as "no empty label", so
   `https://a..b/p` is covered too.

Refs #978, #977.

Author: KonstantinMirin

src/adcp/signing/canonical.py

@@ -267,6 +267,14 @@ def _canon_host(host: str, netloc: str) -> str:
     """
     if host.endswith("."):
         host = host[:-1]
+    if not host or any(label == "" for label in host.split(".")):
+        # Re-checked AFTER the strip. `_malformed_authority_reason` runs on the
+        # raw netloc, where `.` and `..` are non-empty and look like hosts; it
+        # is only stripping the root dot that empties them. Without this,
+        # `https://./p` canonicalized to `https:///p` -- the empty authority
+        # this very module rejects two functions up, reached by a path that
+        # skipped the check.
+        raise TargetUriMalformedError(netloc, "the authority carries no host once normalized")
     if not host_has_raw_non_ascii(host):
         return host.lower()
     try:

src/adcp/signing/errors.py

@@ -116,21 +116,21 @@ def __init__(
 WEBHOOK_SIGNATURE_KEY_ORIGIN_MISMATCH = "webhook_signature_key_origin_mismatch"
 WEBHOOK_SIGNATURE_KEY_ORIGIN_MISSING = "webhook_signature_key_origin_missing"
 
+# Structural code for a malformed authority on the webhook profile. Named
+# without the ``webhook_signature_`` prefix the rest of this family carries
+# because the spec names it that way: security.mdx's webhook checklist lists
+# ``webhook_target_uri_malformed`` in the error taxonomy and requires it at
+# step 10 for a malformed or mismatched authority.
+WEBHOOK_TARGET_URI_MALFORMED = "webhook_target_uri_malformed"
+
 # Code-family translation used by the webhook verifier wrapper. The verifier
 # pipeline raises request_signature_* codes; the wrapper retags them into
 # webhook_signature_* before exposing to callers. Keeps the 300-line verifier
 # unchanged and guarantees webhook routes never leak request-family codes.
 REQUEST_TO_WEBHOOK_CODE = {
     REQUEST_SIGNATURE_REQUIRED: WEBHOOK_SIGNATURE_REQUIRED,
     REQUEST_SIGNATURE_HEADER_MALFORMED: WEBHOOK_SIGNATURE_HEADER_MALFORMED,
-    # Deliberately NOT a new `webhook_target_uri_malformed`. The AdCP spec
-    # defines `request_target_uri_malformed` (it is graded by the shipped
-    # canonicalization vectors) but names no webhook twin, and no bundled
-    # schema enumerates webhook signing codes. Minting one here would put a
-    # string on the wire that nothing upstream defines. A malformed target URI
-    # is the same failure class as a malformed header, so it retags onto the
-    # existing code until the spec says otherwise.
-    REQUEST_TARGET_URI_MALFORMED: WEBHOOK_SIGNATURE_HEADER_MALFORMED,
+    REQUEST_TARGET_URI_MALFORMED: WEBHOOK_TARGET_URI_MALFORMED,
     REQUEST_SIGNATURE_PARAMS_INCOMPLETE: WEBHOOK_SIGNATURE_PARAMS_INCOMPLETE,
     REQUEST_SIGNATURE_TAG_INVALID: WEBHOOK_SIGNATURE_TAG_INVALID,
     REQUEST_SIGNATURE_ALG_NOT_ALLOWED: WEBHOOK_SIGNATURE_ALG_NOT_ALLOWED,

tests/conformance/signing/test_canonicalization.py

@@ -203,3 +203,28 @@ def test_multi_label_signature_input_selects_sig1() -> None:
     assert labels["sig2"].components == ("@method", "@target-uri")
     assert labels["sig1"].params["nonce"] == "KXYnfEfJ0PBRZXQyVXfVQA"
     assert labels["sig2"].params["nonce"] == "DIFFERENT-NONCE-FOR-SIG2____"
+
+
+@pytest.mark.parametrize(
+    "url",
+    ["https://./p", "https://../p", "https://.:443/p", "https://a..b/p"],
+    ids=["root-dot-only", "double-dot", "root-dot-with-port", "interior-empty-label"],
+)
+def test_authority_that_empties_after_normalization_is_rejected(url: str) -> None:
+    """A host must still be a host once the root dot comes off.
+
+    ``_malformed_authority_reason`` judges the raw netloc, where ``.`` and
+    ``..`` are non-empty and pass as hosts. Stripping the root dot is what
+    empties them, so the check has to run again afterwards. Without it
+    ``https://./p`` canonicalized to ``https:///p`` -- the empty authority
+    ``malformed-empty-authority`` rejects, reached by a path that skipped the
+    gate.
+
+    ``a..b`` is here because the rule is "no empty label", not merely
+    "not empty".
+    """
+    with pytest.raises(ValueError) as excinfo:
+        canonicalize_target_uri(url)
+    assert getattr(excinfo.value, "code", None) == "request_target_uri_malformed"
+    with pytest.raises(ValueError):
+        canonicalize_authority(url)

tests/conformance/signing/test_target_uri_malformed_boundary.py

@@ -38,7 +38,7 @@
     verify_request_signature,
 )
 from adcp.signing.errors import (
-    WEBHOOK_SIGNATURE_HEADER_MALFORMED,
+    WEBHOOK_TARGET_URI_MALFORMED,
     SignatureVerificationError,
 )
 from adcp.webhooks import (
@@ -164,9 +164,12 @@ def test_webhook_verifier_retags_target_uri_malformed_without_map_warning(
     no entry is therefore silently *tolerated* -- the caller just gets a vaguer
     code and the receiver's logs get noisier.
 
-    The expected twin is the EXISTING ``webhook_signature_header_malformed``: same
-    failure class, and no new wire-visible string is minted for a code the AdCP
-    webhook taxonomy does not define anywhere in this repo.
+    The expected twin is ``webhook_target_uri_malformed``. It is named without
+    the ``webhook_signature_`` prefix the rest of the family carries because the
+    spec names it that way: security.mdx's webhook checklist lists it in the
+    error taxonomy and requires it at step 10 for a malformed or mismatched
+    authority. Retagging onto ``webhook_signature_header_malformed`` instead
+    would put a stable but WRONG code on the wire.
     """
     headers = _signed_webhook_headers()
 
@@ -180,9 +183,9 @@ def test_webhook_verifier_retags_target_uri_malformed_without_map_warning(
                 options=_webhook_verify_options(),
             )
 
-    assert exc_info.value.code == WEBHOOK_SIGNATURE_HEADER_MALFORMED, (
+    assert exc_info.value.code == WEBHOOK_TARGET_URI_MALFORMED, (
         f"verify_webhook_signature({MALFORMED_URL!r}) must retag "
-        f"{REQUEST_TARGET_URI_MALFORMED!r} to {WEBHOOK_SIGNATURE_HEADER_MALFORMED!r}; "
+        f"{REQUEST_TARGET_URI_MALFORMED!r} to {WEBHOOK_TARGET_URI_MALFORMED!r}; "
         f"got {exc_info.value.code!r}"
     )
     unmapped = [