there should also be no padding in the interaction hash

src/auth_server/tests/test_app.py

@@ -1016,7 +1016,7 @@ def test_transaction_jws_continue(self):
         jws_header["created"] = int(utc_now().timestamp())
         # calculate ath header value
         access_token_hash = hash_with(SHA256(), continue_response["access_token"]["value"].encode())
-        jws_header["ath"] = base64.urlsafe_b64encode(access_token_hash).decode("utf-8").rstrip("=")
+        jws_header["ath"] = base64.urlsafe_b64encode(access_token_hash).decode("ascii").rstrip("=")
         _jws = jws.JWS(payload="{}")
         _jws.add_signature(
             key=self.client_jwk,
@@ -1112,14 +1112,14 @@ def test_transaction_jws_continue_redirect_finish(self):
         hash_alg = get_hash_by_name(hash_name=HashMethod.SHA_256.value)  # defaults to SHA256
         plaintext = f"{client_nonce}\n{as_nonce}\n{interact_ref}\n{transaction_url}".encode(encoding="ascii")
         hash_res = hash_with(hash_alg, plaintext)
-        assert base64.urlsafe_b64encode(hash_res).decode(encoding="ascii") == interact_hash
+        assert base64.urlsafe_b64encode(hash_res).decode(encoding="ascii").rstrip("=") == interact_hash
 
         # continue request after interaction is completed
         jws_header["uri"] = continue_response["uri"]
         jws_header["created"] = int(utc_now().timestamp())
         # calculate ath header value
         access_token_hash = hash_with(SHA256(), continue_response["access_token"]["value"].encode())
-        jws_header["ath"] = base64.urlsafe_b64encode(access_token_hash).decode("utf-8").rstrip("=")
+        jws_header["ath"] = base64.urlsafe_b64encode(access_token_hash).decode("ascii").rstrip("=")
         # create jws from continue request
         _jws = jws.JWS(payload=ContinueRequest(interact_ref=interact_ref).json(exclude_unset=True))
         _jws.add_signature(
@@ -1205,7 +1205,7 @@ def test_transaction_jwsd_continue(self):
         jws_header["created"] = int(utc_now().timestamp())
         # calculate ath header value
         access_token_hash = hash_with(SHA256(), continue_response["access_token"]["value"].encode())
-        jws_header["ath"] = base64.urlsafe_b64encode(access_token_hash).decode("utf-8").rstrip("=")
+        jws_header["ath"] = base64.urlsafe_b64encode(access_token_hash).decode("ascii").rstrip("=")
         _jws = jws.JWS(payload="{}")
         _jws.add_signature(
             key=self.client_jwk,

src/auth_server/utils.py

@@ -150,14 +150,15 @@ def get_interaction_hash(
     The party then hashes this string with the appropriate algorithm
     based on the "hash_method" parameter of the "callback".  If the
     "hash_method" value is not present in the client instance's request,
-    the algorithm defaults to "sha-256".
+    the algorithm defaults to "sha-256". The resulting byte array from
+    the hash function is then encoded using URL-Safe Base64 with no padding.
 
     https://datatracker.ietf.org/doc/html/draft-ietf-gnap-core-protocol-16#section-4.2.3
     """
     hash_alg = get_hash_by_name(hash_name=hash_method.value)
     plaintext = f"{client_nonce}\n{as_nonce}\n{interact_ref}\n{transaction_url}".encode()
     hash_res = hash_with(hash_alg, plaintext)
-    return urlsafe_b64encode(hash_res).decode(encoding="utf-8")
+    return urlsafe_b64encode(hash_res).decode(encoding="utf-8").rstrip("=")
 
 
 async def push_interaction_finish(url: str, interaction_hash: str, interaction_reference: str) -> None: