fix(sdk): match allowed payment instruments by (type, id), not id alone

[chopmob-cloud]

Summary

Addresses the allowed-instrument matching defect reported in #299 (item 2): the Python evaluator matches an allowed PaymentInstrument on id alone.

AllowedPaymentInstrumentEvaluator.evaluate compared only allowed.id == instrument.id (constraints.py#L246-L251). Because PaymentInstrument.id uniqueness is not defined across types, a closed instrument of a different type satisfied the constraint.

Failure scenario

Allowed set: [{id: "pi-1", type: "card"}]. A closed mandate carrying {id: "pi-1", type: "bank"} passed the constraint under id-only matching. Where type selects the payment profile (or ids are scoped by type / credential provider), a different profile than the one the user authorized could satisfy the allowed_payment_instrument constraint, and at minimum inconsistent signed instrument metadata is accepted.

Fix

Require both type and id to match, and include type in the violation message so a mismatch is diagnosable:

if any(
    allowed.type == instrument.type and allowed.id == instrument.id
    for allowed in self.constraint.allowed
):
    return []

Tests

code/sdk/python/ap2/tests/constraints_tests.py:

• test_payment_allowed_payment_instrument_same_id_different_type_rejected : same id, different type is a violation.
• test_payment_allowed_payment_instrument_type_and_id_match : an allowed (type, id) still passes.

The two existing allowed-instrument tests are unchanged and still pass.

Validated with pip install . in a clean python:3.12-slim container: constraints_tests.py 49 passed.

Scope

This PR is intentionally limited to the matching semantics. The other two items in #299 are handled separately:

• The x402 sample's fallback-to-a-fixed-amount behavior is fixed in fix(samples): authorize the verified mandate amount in x402 credential provider #300 (fail closed on a missing verified amount rather than authorizing 1250).
• Preserving type-specific instrument fields through parsing and signing ([Bug]: Python SDK drops PaymentInstrument extensions and matches allowed instruments by ID only #299 item 1) is a schema and generated-model design decision (payment_instrument.json plus the datamodel-codegen output), which I have left for maintainers rather than editing a generated file. Happy to follow up if you want a direction on it.

[gemini-code-assist]

Code Review

This pull request updates the payment instrument evaluation logic to match on both type and id instead of only id, preventing potential instrument-type confusion across different types sharing the same ID. It also updates the error message to include both type and ID, and adds corresponding unit tests to verify this behavior. There are no review comments, so I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.