Reusing Consents. Delete all ACCEPTED or INITIATED consents button.

simonredfern · simonredfern · commit 5b4654533872 · 2026-05-23T20:49:07.000+02:00
diff --git a/apps/api-manager/src/routes/backend/opey/consent/+server.ts b/apps/api-manager/src/routes/backend/opey/consent/+server.ts
@@ -6,7 +6,7 @@ import { obp_requests } from '$lib/obp/requests';
 import { obpErrorResponse } from '$lib/obp/errors';
 import { env } from '$env/dynamic/private';
 import { deduplicateRoles, pickConsentRole } from '@obp/shared/opey';
-import { capConsentTtlSeconds } from '@obp/shared/server/obp';
+import { capConsentTtlSeconds, findReusableConsent } from '@obp/shared/server/obp';
 
 /**
  * POST /api/opey/consent
@@ -119,6 +119,27 @@ export async function POST(event: RequestEvent) {
 			bank_id: bank_id || ''
 		}));
 
+		// Try to reuse an existing consent that already covers this scope. Without
+		// this, every consent_request from Opey mints a new consent at OBP — even
+		// when an identical one already exists for the user, leading to consent
+		// proliferation and "asking the same view again and again" UX.
+		const reusable = await findReusableConsent({
+			obpGet: (p, t) => obp_requests.get(p, t),
+			accessToken,
+			opeyConsumerId,
+			requiredEntitlements: entitlements,
+			requiredViews: normalizedViews
+		});
+		if (reusable) {
+			return json({
+				consent_jwt: reusable.jwt,
+				consent_id: reusable.consent_id,
+				status: reusable.status,
+				roles: normalizedRequiredRoles,
+				reused: true
+			});
+		}
+
 		const now = new Date().toISOString().split('.')[0] + 'Z';
 
 		// Cap against OBP's `consents.max_time_to_live` (via /obp/v7.0.0/consents/config)
diff --git a/apps/portal/src/routes/(protected)/user/consents/+page.server.ts b/apps/portal/src/routes/(protected)/user/consents/+page.server.ts
@@ -152,6 +152,85 @@ export const actions = {
 		};
 	},
 
+	deleteAll: async ({ locals }) => {
+		const token = locals.session.data.oauth?.access_token;
+		if (!token) {
+			return { message: 'No access token found in session.' };
+		}
+
+		// Page through /my/consents so we delete every record, not just the
+		// 10 the load function fetches for display.
+		const pageLimit = 50;
+		const all: OBPConsent[] = [];
+		try {
+			let offset = 0;
+			while (true) {
+				const resp: { consents?: OBPConsent[] } = await obp_requests.get(
+					`/obp/v5.1.0/my/consents?limit=${pageLimit}&offset=${offset}`,
+					token
+				);
+				const batch = resp?.consents ?? [];
+				all.push(...batch);
+				if (batch.length < pageLimit) break;
+				offset += pageLimit;
+			}
+		} catch (err) {
+			logger.error('deleteAll: failed to list consents:', err);
+			const msg =
+				err instanceof OBPRequestError
+					? err.message
+					: err instanceof Error
+						? err.message
+						: 'Failed to list consents for deletion.';
+			return { message: msg };
+		}
+
+		// Only ACCEPTED or INITIATED consents are meaningfully deletable via
+		// DELETE /my/consents/{ID} — REVOKED/REJECTED/EXPIRED rows can't be
+		// revoked again. Skip them so the response stays clean instead of
+		// surfacing one error per skipped row.
+		const DELETABLE_STATUSES = new Set(['ACCEPTED', 'INITIATED']);
+		const deletable = all.filter((c) => DELETABLE_STATUSES.has(c.status));
+		const skipped = all.length - deletable.length;
+
+		if (deletable.length === 0) {
+			return {
+				success: true,
+				message:
+					skipped > 0
+						? `No ACCEPTED or INITIATED consents to delete (${skipped} skipped).`
+						: 'No consents to delete.'
+			};
+		}
+
+		let deleted = 0;
+		const errors: string[] = [];
+		for (const c of deletable) {
+			try {
+				await obp_requests.delete(`/obp/v5.1.0/my/consents/${c.consent_id}`, token);
+				deleted++;
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				errors.push(`${String(c.consent_id ?? 'unknown').slice(0, 8)}: ${msg}`);
+			}
+		}
+
+		const skippedNote = skipped > 0 ? ` (${skipped} skipped — not ACCEPTED or INITIATED)` : '';
+
+		if (errors.length > 0) {
+			const sample = errors.slice(0, 3).join('; ');
+			const more = errors.length > 3 ? ` (and ${errors.length - 3} more)` : '';
+			return {
+				message: `Deleted ${deleted} consent${deleted === 1 ? '' : 's'}${skippedNote}. ${errors.length} failed: ${sample}${more}`
+			};
+		}
+
+		return {
+			success: true,
+			message: `Deleted ${deleted} consent${deleted === 1 ? '' : 's'}${skippedNote}.`
+		};
+	},
+
 	setConsentTtl: async ({ request, locals }) => {
 		const data = await request.formData();
 		const rawSeconds = data.get('seconds');
diff --git a/apps/portal/src/routes/(protected)/user/consents/+page.svelte b/apps/portal/src/routes/(protected)/user/consents/+page.svelte
@@ -17,8 +17,33 @@
     );
     let selectedTtl = $state<number>(data.currentConsentTtlSeconds ?? 604800);
     let savingTtl = $state(false);
+    let deletingAll = $state(false);
 </script>
 
+<div class="mb-6 flex items-center justify-between gap-4">
+    <h1 class="text-2xl font-bold text-gray-900 dark:text-gray-100">My Consents</h1>
+    <form
+        method="post"
+        action="?/deleteAll"
+        use:enhance={() => {
+            deletingAll = true;
+            return async ({ update }) => {
+                await update({ reset: false });
+                deletingAll = false;
+            };
+        }}
+    >
+        <button
+            type="submit"
+            class="rounded-md bg-red-600 px-4 py-2 text-sm font-medium text-white hover:bg-red-700 disabled:opacity-60 dark:bg-red-700 dark:hover:bg-red-800"
+            disabled={deletingAll}
+            data-testid="delete-all-consents"
+        >
+            {deletingAll ? 'Deleting all consents…' : 'Delete all consents'}
+        </button>
+    </form>
+</div>
+
 {#if form?.success}
     <div class="mb-8 rounded-lg border border-green-200 bg-green-50 p-4 text-center dark:border-green-800 dark:bg-green-900/20">
         <p class="font-semibold text-green-600 dark:text-green-400">{form.message}</p>
diff --git a/apps/portal/src/routes/backend/opey/consent/+server.ts b/apps/portal/src/routes/backend/opey/consent/+server.ts
@@ -7,7 +7,7 @@ import { obpErrorResponse } from '@obp/shared/obp';
 import { env } from '$env/dynamic/private';
 import { deduplicateRoles, pickConsentRole } from '@obp/shared/opey';
 import { getOpeyConsentTtlSeconds } from '$lib/server/userPreferences';
-import { capConsentTtlSeconds } from '@obp/shared/server/obp';
+import { capConsentTtlSeconds, findReusableConsent } from '@obp/shared/server/obp';
 
 /**
  * POST /backend/opey/consent
@@ -156,6 +156,27 @@ export async function POST(event: RequestEvent) {
 			entitlements.push({ role_name: preferred.role_name, bank_id: preferred.bank_id });
 		}
 
+		// Try to reuse an existing consent that already covers this scope. Without
+		// this, every consent_request from Opey mints a new consent at OBP — even
+		// when an identical one already exists for the user, leading to consent
+		// proliferation and "asking the same view again and again" UX.
+		const reusable = await findReusableConsent({
+			obpGet: (p, t) => obp_requests.get(p, t),
+			accessToken,
+			opeyConsumerId,
+			requiredEntitlements: entitlements,
+			requiredViews: normalizedViews
+		});
+		if (reusable) {
+			return json({
+				consent_jwt: reusable.jwt,
+				consent_id: reusable.consent_id,
+				status: reusable.status,
+				roles: normalizedRequiredRoles,
+				reused: true
+			});
+		}
+
 		const now = new Date().toISOString().split('.')[0] + 'Z';
 
 		// Per-user TTL preference (OBP personal data field) → env default → built-in 7 days,
diff --git a/packages/shared/src/lib/server/obp/consentReuse.ts b/packages/shared/src/lib/server/obp/consentReuse.ts
@@ -0,0 +1,158 @@
+/**
+ * Reuse logic for per-tool-call consents.
+ *
+ * Without this, every consent_request from Opey mints a fresh consent at OBP
+ * even when an existing one already covers the required scope. That's what
+ * was causing "asking for the same views again and again" in the chat: every
+ * tool call resulted in a new consent record with identical claims.
+ *
+ * "Covers" is a subset check:
+ *   - consumer_id matches the Opey consumer.
+ *   - status === 'ACCEPTED'.
+ *   - `jwt_expires_at` is in the future. (Note: OBP returns `jwt_payload` as a
+ *     JSON STRING in this listing, so we don't trust `consent.jwt_payload.exp`
+ *     here either — same trap as the baseline session-consent reuse fix. See
+ *     [[reference-obp-consents-jwt-payload-is-string]].)
+ *   - Every required `(role_name, bank_id)` is present in the consent's
+ *     entitlements (subset, not equality — broader consents still cover).
+ *   - Every required `(bank_id, account_id, view_id)` is present in the
+ *     consent's views (likewise subset).
+ *
+ * OBP returns consents sorted by `created_date:desc` by default, so the first
+ * match is the most recent — gives a stable, predictable reuse target.
+ */
+
+import { createLogger } from '$shared/utils/logger';
+import type { ObpGet } from './consentsConfig.js';
+
+const logger = createLogger('ConsentReuse');
+
+export interface RequiredEntitlement {
+	role_name: string;
+	/** Empty string for system-wide roles. */
+	bank_id: string;
+}
+
+export interface RequiredView {
+	bank_id: string;
+	account_id: string;
+	view_id: string;
+}
+
+export interface ReusableConsent {
+	consent_id: string;
+	jwt: string;
+	status: string;
+}
+
+export async function findReusableConsent(opts: {
+	obpGet: ObpGet;
+	accessToken: string;
+	opeyConsumerId: string;
+	requiredEntitlements: RequiredEntitlement[];
+	requiredViews: RequiredView[];
+}): Promise<ReusableConsent | null> {
+	const {
+		obpGet,
+		accessToken,
+		opeyConsumerId,
+		requiredEntitlements,
+		requiredViews
+	} = opts;
+
+	logger.info(
+		`findReusableConsent: scanning for reuse — consumer=${opeyConsumerId}, required entitlements=${JSON.stringify(requiredEntitlements)}, required views=${JSON.stringify(requiredViews)}`
+	);
+
+	let list: any;
+	try {
+		list = await obpGet('/obp/v5.1.0/my/consents', accessToken);
+	} catch (err) {
+		logger.info('findReusableConsent: failed to fetch /my/consents — skipping reuse', err);
+		return null;
+	}
+
+	const consents: any[] = Array.isArray(list?.consents) ? list.consents : [];
+	if (consents.length === 0) {
+		logger.info('findReusableConsent: /my/consents returned no consents');
+		return null;
+	}
+
+	const now = new Date();
+	const reasons: string[] = [];
+
+	for (const c of consents) {
+		const cid = String(c.consent_id ?? 'unknown').slice(0, 8);
+
+		if (c.consumer_id !== opeyConsumerId) {
+			reasons.push(`${cid}: wrong consumer_id (${String(c.consumer_id ?? '').slice(0, 8)})`);
+			continue;
+		}
+		if (c.status !== 'ACCEPTED') {
+			reasons.push(`${cid}: status=${c.status}`);
+			continue;
+		}
+		if (!c.jwt_expires_at) {
+			reasons.push(`${cid}: no jwt_expires_at field`);
+			continue;
+		}
+		if (new Date(c.jwt_expires_at) < now) {
+			reasons.push(`${cid}: expired at ${c.jwt_expires_at}`);
+			continue;
+		}
+
+		// jwt_payload is a JSON string in the listing — parse it.
+		let payload: any;
+		try {
+			payload =
+				typeof c.jwt_payload === 'string' ? JSON.parse(c.jwt_payload) : c.jwt_payload;
+		} catch {
+			reasons.push(`${cid}: jwt_payload JSON.parse failed`);
+			continue;
+		}
+
+		const existingEntitlements: any[] = Array.isArray(payload?.entitlements)
+			? payload.entitlements
+			: [];
+		const existingViews: any[] = Array.isArray(payload?.views) ? payload.views : [];
+
+		const entitlementsOk = requiredEntitlements.every((req) =>
+			existingEntitlements.some(
+				(e: any) =>
+					typeof e === 'object' &&
+					e?.role_name === req.role_name &&
+					(e?.bank_id ?? '') === (req.bank_id ?? '')
+			)
+		);
+		if (!entitlementsOk) {
+			reasons.push(
+				`${cid}: entitlements mismatch — existing=${JSON.stringify(existingEntitlements)}`
+			);
+			continue;
+		}
+
+		const viewsOk = requiredViews.every((req) =>
+			existingViews.some(
+				(v: any) =>
+					typeof v === 'object' &&
+					v?.bank_id === req.bank_id &&
+					v?.account_id === req.account_id &&
+					v?.view_id === req.view_id
+			)
+		);
+		if (!viewsOk) {
+			reasons.push(`${cid}: views mismatch — existing=${JSON.stringify(existingViews)}`);
+			continue;
+		}
+
+		logger.info(
+			`findReusableConsent: ✓ reusing consent ${c.consent_id} — covers ${requiredEntitlements.length} role(s) and ${requiredViews.length} view(s).`
+		);
+		return { consent_id: c.consent_id, jwt: c.jwt, status: c.status };
+	}
+
+	logger.info(
+		`findReusableConsent: ✗ no reusable consent found among ${consents.length} candidates. Rejection reasons:\n  ${reasons.join('\n  ')}`
+	);
+	return null;
+}
diff --git a/packages/shared/src/lib/server/obp/index.ts b/packages/shared/src/lib/server/obp/index.ts
@@ -8,3 +8,9 @@ export {
 	_resetConsentsConfigCache
 } from './consentsConfig.js';
 export type { ObpGet } from './consentsConfig.js';
+export { findReusableConsent } from './consentReuse.js';
+export type {
+	RequiredEntitlement,
+	RequiredView,
+	ReusableConsent
+} from './consentReuse.js';
diff --git a/packages/shared/src/routes/api/opey/consent/+server.ts b/packages/shared/src/routes/api/opey/consent/+server.ts
@@ -6,6 +6,7 @@ import { obpRequests } from '../../../../hooks.server';
 import { env } from '$env/dynamic/private';
 import { deduplicateRoles, pickConsentRole } from '$lib/opey/utils/roles';
 import { capConsentTtlSeconds } from '$lib/server/obp/consentsConfig';
+import { findReusableConsent } from '$lib/server/obp/consentReuse';
 
 /**
  * POST /api/opey/consent
@@ -116,6 +117,27 @@ export async function POST(event: RequestEvent) {
 			bank_id: bank_id || ''
 		}));
 
+		// Try to reuse an existing consent that already covers this scope. Without
+		// this, every consent_request from Opey mints a new consent at OBP — even
+		// when an identical one already exists for the user, leading to consent
+		// proliferation and "asking the same view again and again" UX.
+		const reusable = await findReusableConsent({
+			obpGet: (p, t) => obpRequests.get(p, t),
+			accessToken,
+			opeyConsumerId,
+			requiredEntitlements: entitlements,
+			requiredViews: normalizedViews
+		});
+		if (reusable) {
+			return json({
+				consent_jwt: reusable.jwt,
+				consent_id: reusable.consent_id,
+				status: reusable.status,
+				roles: normalizedRequiredRoles,
+				reused: true
+			});
+		}
+
 		const now = new Date().toISOString().split('.')[0] + 'Z';
 
 		// Cap against OBP's `consents.max_time_to_live` (via /obp/v7.0.0/consents/config)
