fix(samples): authorize the verified mandate amount in x402 credential provider

[chopmob-cloud]

Addresses part of #299: the fail-open amount handling in the x402 credential provider sample.

Problem

In x402_credentials_provider_mcp/server.py, after the mandate chain is cryptographically verified, the handler extracts the transfer amount like this:

try:
    payee_address = chain.closed_mandate.payment_instrument.payee_address
    amount_cents = chain.closed_mandate.payment_amount.amount
    ...
except AttributeError:
    payee_address = (
        os.environ.get("MERCHANT_WALLET_ADDRESS") or DEFAULT_MERCHANT_ADDRESS
    )
    amount_cents = 1250

PaymentInstrument has no payee_address field, so the first line raises AttributeError before amount_cents is read from the verified mandate. The except then assigns a hardcoded amount_cents = 1250. As a result the EIP-3009 authorization is signed for a fixed 1250 cents regardless of the amount the user actually mandated: verification passes, but the on-chain authorization ignores the verified payment_amount.

Fix

Read the amount from the verified mandate's REQUIRED, signed payment_amount, and fail closed (return a verification error) if it is somehow absent, rather than substituting a hardcoded value:

try:
    amount_cents = _verified_amount_cents(chain)
except AttributeError:
    return {
        "error": "verification_failed",
        "message": "verified mandate is missing a payment amount",
    }

The destination is left as the credential provider's configured payout address. Sourcing it from the verified instrument instead depends on preserving type-specific instrument fields through signing (the other half of #299), which is out of scope here.

Adds server_tests.py asserting the handler authorizes the signed amount for any value, never a hardcoded fallback, and fails closed when the amount is absent.

Scope

This change fixes only the amount fail-open in the sample. The related items in #299 (type-specific instrument fields dropped before signing; AllowedPaymentInstrumentEvaluator matching on id only) are separate and better addressed on their own.

[gemini-code-assist]

Code Review

This pull request refactors the x402 credentials provider to extract and verify the signed payment amount from the mandate chain, removing a hardcoded fallback of 1250 cents to ensure the system fails closed when the amount is missing. Regression tests are also introduced to verify this behavior. The review feedback highlights a potential TypeError if the payment amount is explicitly None instead of missing, and suggests raising an AttributeError in this case to prevent a crash, along with adding a corresponding unit test.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.