fix(signing): validate the port per RFC 3986 instead of trusting int()

Review follow-up. `_malformed_authority_reason` judged the host but never the
port, so `portstr` went straight into `int()` -- far more permissive than the
grammar `port = *DIGIT`, in three distinct ways:

- `int("-80")` produced the authority `host:-80`, which is not an authority.
- `int("8_0")` is 80: Python accepts underscore digit separators.
- `int("٨٠")` is also 80: `int()` accepts non-ASCII digits, so `host:٨٠` and
  `host:80` collapsed to the SAME canonical authority. That is a
  raw-vs-canonical differential -- a peer that does not fold Arabic-Indic
  digits derives a different @authority from identical bytes and the signature
  fails for a reason neither side can see in its own logs.

`str.isdigit()` does NOT close the third case -- `"٨٠".isdigit()` is True --
so the gate tests ASCII digits specifically.

An empty port is NOT rejected. RFC 3986 §3.2.3 makes it legal (`*DIGIT`),
meaning "default", and directs normalizers to drop the port and its colon, so
`https://host:/p` normalizes to `host`. `urlsplit` agrees (`port=None`).
Rejecting it would refuse a valid URI; it previously raised a bare `ValueError`
from `int("")` carrying no code -- the same "passes on someone else's
exception" failure `_split_or_reject` exists to prevent, one frame lower.

Refs #978.

Author: KonstantinMirin

src/adcp/signing/canonical.py

@@ -236,10 +236,10 @@ def _canon_authority(netloc: str, scheme: str) -> str:
         host = netloc[: end + 1]
         tail = netloc[end + 1 :]
         if tail.startswith(":"):
-            port = int(tail[1:])
+            port = _port_or_reject(tail[1:], netloc)
     elif ":" in netloc:
         host, portstr = netloc.rsplit(":", 1)
-        port = int(portstr)
+        port = _port_or_reject(portstr, netloc)
     else:
         host = netloc
     host = _canon_host(host, netloc)
@@ -248,6 +248,39 @@ def _canon_authority(netloc: str, scheme: str) -> str:
     return host
 
 
+_ASCII_DIGITS = frozenset("0123456789")
+
+
+def _port_or_reject(portstr: str, netloc: str) -> int | None:
+    """Parse a port per RFC 3986 §3.2.3 (`port = *DIGIT`), or reject.
+
+    The port used to go straight into `int()`, which is far more permissive
+    than the grammar and produced three distinct problems:
+
+    * `int("-80")` gave the authority `host:-80`, which is not an authority.
+    * `int("8_0")` is 80 -- Python accepts underscore digit separators.
+    * `int("٨٠")` is also 80 -- `int()` accepts non-ASCII digits, so
+      `host:٨٠` and `host:80` collapsed to the SAME canonical authority. A
+      peer that does not fold Arabic-Indic digits derives a different
+      `@authority` from identical bytes, and the signature fails for a reason
+      neither side can see in its own logs.
+
+    `str.isdigit()` does not close that last one -- `"٨٠".isdigit()` is True --
+    so the test is ASCII digits specifically.
+
+    An EMPTY port is legal and means "default": the grammar is `*DIGIT`, and
+    §3.2.3 says a normalizer should drop the port and its colon when empty. So
+    `https://host:/p` normalizes to `host` rather than being rejected.
+    """
+    if not portstr:
+        return None
+    if not all(ch in _ASCII_DIGITS for ch in portstr):
+        raise TargetUriMalformedError(
+            netloc, f"the port {portstr!r} is not a sequence of ASCII digits"
+        )
+    return int(portstr)
+
+
 def _canon_host(host: str, netloc: str) -> str:
     """Lower-case an ASCII host, or convert a U-label to its A-label form.
 

tests/conformance/signing/test_canonicalization.py

@@ -228,3 +228,45 @@ def test_authority_that_empties_after_normalization_is_rejected(url: str) -> Non
     assert getattr(excinfo.value, "code", None) == "request_target_uri_malformed"
     with pytest.raises(ValueError):
         canonicalize_authority(url)
+
+
+@pytest.mark.parametrize(
+    ("url", "expected"),
+    [
+        # RFC 3986 §3.2.3: `port = *DIGIT`, so an EMPTY port is legal and means
+        # "default" -- normalizers SHOULD drop it and its colon. Rejecting it
+        # would refuse a valid URI.
+        ("https://host:/p", "host"),
+        ("https://[::1]:/p", "[::1]"),
+        # ...and a real port still survives.
+        ("https://host:8443/p", "host:8443"),
+    ],
+    ids=["empty-port", "empty-port-ipv6", "real-port"],
+)
+def test_empty_port_is_normalized_away_not_rejected(url: str, expected: str) -> None:
+    assert canonicalize_authority(url) == expected
+
+
+@pytest.mark.parametrize(
+    "url",
+    ["https://host:-80/p", "https://host:8_0/p", "https://host:٨٠/p", "https://host:8a/p"],
+    ids=["negative", "underscore-separator", "arabic-indic-digits", "alphanumeric"],
+)
+def test_non_digit_port_is_rejected_with_the_spec_code(url: str) -> None:
+    """The port was never validated -- it went straight into `int()`.
+
+    Three distinct failures came out of that. `int("-80")` yielded the
+    authority ``host:-80``, which is not a valid authority at all. `int("8_0")`
+    is 80, because Python accepts underscore digit separators. And
+    `int("٨٠")` is also 80, because `int()` accepts non-ASCII digits -- so
+    ``host:٨٠`` and ``host:80`` collapsed to the SAME canonical authority.
+    That last one is a raw-vs-canonical differential: a peer that does not
+    fold Arabic-Indic digits computes a different `@authority` for the same
+    bytes, and the signature fails for a reason neither side can see.
+
+    Note `str.isdigit()` alone does not close this -- `"٨٠".isdigit()` is
+    True. The gate has to be ASCII digits specifically.
+    """
+    with pytest.raises(ValueError) as excinfo:
+        canonicalize_authority(url)
+    assert getattr(excinfo.value, "code", None) == "request_target_uri_malformed"