fix(sdjwt): dump cnf.jwk in JSON mode so keys with "use" verify

code/sdk/python/ap2/sdk/sdjwt/common.py

@@ -15,7 +15,7 @@
 from ap2.sdk.utils import b64url_decode, b64url_encode
 from jwcrypto.jwk import JWK
 from pydantic import BaseModel
 from sd_jwt.issuer import SDJWTIssuer
 
 
 HashMode = Literal['sd_hash', 'issuer_jwt_hash']
@@ -83,7 +83,7 @@
         cnf = self._find_cnf()
         if isinstance(cnf, dict) and 'jwk' in cnf:
             jwk_model = JsonWebKey.model_validate(cnf['jwk'])
-            return JWK(**jwk_model.model_dump(exclude_none=True))
+            return JWK(**jwk_model.model_dump(mode='json', exclude_none=True))
         return None
 
     def _find_cnf(self) -> dict[str, Any] | None:
@@ -276,9 +276,9 @@
     header_params: dict[str, Any],
     add_decoy_claims: bool,
     serialization_format: str,
 ) -> SDJWTIssuer:
     """Create an ``SDJWTIssuer`` with AP2's common issuer options."""
     return SDJWTIssuer(
         user_claims=claims,
         issuer_key=issuer_key,
         holder_key=None,

code/sdk/python/ap2/tests/kb_sd_jwt_tests.py

@@ -12,7 +12,7 @@
 import pytest
 
 from ap2.sdk.generated.open_payment_mandate import OpenPaymentMandate
 from ap2.sdk.sdjwt import (
     compute_issuer_jwt_hash,
     compute_sd_hash,
     kb_sd_jwt,
@@ -137,6 +137,27 @@
     )
 
 
+def test_verify_accepts_cnf_jwk_with_use_and_alg(issuer_key):
+    """A prior hop whose ``cnf.jwk`` carries ``use`` and ``alg`` still verifies."""
+    holder = JWK.generate(kty='EC', crv='P-256', use='sig', alg='ES256')
+    assert json.loads(holder.export_public())['use'] == 'sig'
+    prev = _root_open(issuer_key, holder)
+    result = _create(
+        prev_token=prev,
+        holder_key=holder,
+        payload=sample_payment_mandate(),
+        aud='a',
+        nonce='n',
+    )
+    _verify(
+        result.sd_jwt_issuance,
+        prev,
+        issuer_key,
+        expected_aud='a',
+        expected_nonce='n',
+    )
+
+
 def test_verify_accepts_issuer_jwt_hash_mode(issuer_key):
     holder = JWK.generate(kty='EC', crv='P-256')
     prev = _root_open(issuer_key, holder)