Fixes attestation authorization

phase2-coordinator/src/coordinator.rs

@@ -793,7 +793,14 @@ impl Coordinator {
     }
 
     ///
-    /// Returns `true` if the given participant has finished contributing
+    /// Returns `true` if the given participant has finished contributing in the provided round
+    ///
+    pub fn is_finished_contributor_at_round(&self, participant: &Participant, round: u64) -> bool {
+        self.state.is_finished_contributor_at_round(participant, round)
+    }
+
+    ///
+    /// Returns `true` if the given participant has finished contributing in the current round
     ///
     #[inline]
     pub fn is_finished_contributor(&self, participant: &Participant) -> bool {

phase2-coordinator/src/coordinator_state.rs

@@ -1357,6 +1357,19 @@ impl CoordinatorState {
         Ok(self.dropped_participants().contains(participant_info))
     }
 
+    ///
+    /// Returns `true` if the given participant has finished contributing
+    /// in the provided round.
+    ///
+    pub fn is_finished_contributor_at_round(&self, participant: &Participant, round: u64) -> bool {
+        participant.is_contributor()
+            && self
+                .finished_contributors
+                .get(&round)
+                .get_or_insert(&HashMap::new())
+                .contains_key(participant)
+    }
+
     ///
     /// Returns `true` if the given participant has finished contributing
     /// in the current round.

phase2-coordinator/src/rest.rs

@@ -366,8 +366,8 @@ pub async fn post_attestation(
 
     let read_lock = (*coordinator).clone().read_owned().await;
     task::spawn_blocking(move || {
-        if !read_lock.is_current_contributor(&participant) && !read_lock.is_finished_contributor(&participant) {
-            // Only current or finished contributors are allowed to query this endpoint
+        if !read_lock.is_finished_contributor_at_round(&participant, round) {
+            // Only finished contributors are allowed to query this endpoint
             return Err(ResponseError::UnauthorizedParticipant(
                 participant,
                 "/contributor/attestation".to_string(),