Function verify_challenge

src/orgkernel/pyapi/router.py:311–324

Full challenge-response verification. Verifies: 1. Challenge exists, not expired, and not already used 2. Agent's signature over the nonce is valid 3. Certificate is ACTIVE and not expired

(
    response: ChallengeResponse,
    db: Annotated[AsyncSession, Depends(get_db)],
)

    description="Step 5-6: verify agent's signed challenge to confirm key possession.",
)
async def verify_challenge(
    response: ChallengeResponse,
    db: Annotated[AsyncSession, Depends(get_db)],
) -> ChallengeVerificationResult:
    """
    Full challenge-response verification.

    Verifies:
        1. Challenge exists, not expired, and not already used
        2. Agent's signature over the nonce is valid
        3. Certificate is ACTIVE and not expired
    """
    svc = AgentIdentityService(db)
    return await svc.verify_challenge(response)


@_identity.post(