Skip to content

Upgrade Consent Portal to Support Consent Management API v0.3.0 - #65

Open
rashmithachamikara wants to merge 112 commits into
wso2:feature/portalfrom
rashmithachamikara:feature/portal-update-to-v0.3.0
Open

Upgrade Consent Portal to Support Consent Management API v0.3.0#65
rashmithachamikara wants to merge 112 commits into
wso2:feature/portalfrom
rashmithachamikara:feature/portal-update-to-v0.3.0

Conversation

@rashmithachamikara

@rashmithachamikara rashmithachamikara commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Purpose

Migrate the portal to Consent Management API v0.3.0. The previous portal contract depended on legacy client identifiers, fields, headers, update payloads, routes, and BFF-side metadata enrichment that are no longer required by the new API.

⚠️ EDIT: This PR merges the latest changes from the main branch (api v.0.3.0) into the feature/portal branch, then updates portal to support the new api changes. Nothing from the consent api or outside feature/portal is modified as part of this feature.

Only the changes starting from 7c0d5bd (~ last 10 commits) are explicitly introduced here.

Commits before these were already reviewed when those were merged to the main branch

Goals

  • Align the portal BFF and frontend with Consent API v0.3.0.
  • Remove all legacy API compatibility behavior.
  • Use the detailed consent response directly without recursive purpose and element enrichment calls.
  • Improve consent registry pagination responsiveness.

Approach

Backend

  • Replaced client-oriented configuration and headers with group-oriented equivalents:
    • PlaceholderClientIDPlaceholderGroupID
    • BFF_PROXY__PLACEHOLDER_CLIENT_IDBFF_PROXY__PLACEHOLDER_GROUP_ID
    • TPP-client-idgroup-id
  • Updated the proxy allowlist for the v0.3 routes and HTTP methods.
  • Migrated consent models to groupId, expirationTime, approved, mandatory, and versioned purpose/element identifiers.
  • Updated approval requests to use stable purpose and element IDs and versions.
  • Changed consent revocation from DELETE to POST.
  • Made the BFF request detailed consent responses from the upstream API.
  • Removed recursive purpose and element metadata enrichment. Consent details now come from a single detailed consent request.
  • Updated the BFF OpenAPI contract, configuration examples, documentation, and integration tests.

Frontend

  • Migrated consent types, fixtures, API requests, and components to the v0.3 contract.
  • Displayed purpose and element display names where available.
  • Replaced Client ID presentation with Group ID.
  • Updated approval state and payloads to use purpose/element IDs and versions.
  • Updated revocation requests to use POST.
  • Prefetched the next consent registry page and removed the delayed loading-skeleton debounce to improve pagination responsiveness.
  • Retained the existing consent registry, details, approval, and revocation user experience without adding administration or audit UI.

Screenshot/GIF:

image image

User stories

  • As a portal user, I can view consent details supplied by Consent API v0.3.0.
  • As a portal user, I can see readable purpose and element display names.
  • As a portal user, I can approve optional consent elements while mandatory and existing approvals are preserved.
  • As a portal user, I can revoke a consent using the updated API operation.
  • As a portal user, I can navigate between consent registry pages with reduced loading delay.

Release note

Updated the portal to support Consent Management API v0.3.0 and improved consent registry pagination performance.

Documentation

Updated:

  • portal/backend/openapi/bff.yaml
  • portal/backend/README.md
  • portal/backend/.env.example
  • portal/frontend/README.md

Automation tests

  • Unit tests

    • Updated backend proxy and configuration tests for v0.3 routes, headers, and configuration.
    • Updated frontend component and API tests with v0.3 payloads.
    • Added coverage for next-page prefetching.
    • Coverage percentage was not measured.
  • Integration tests

    • Updated BFF integration tests for detailed consent retrieval, version-aware approvals, and POST revocation.
    • Verified that consent details no longer trigger purpose or element metadata requests.
    • go test ./... passed.
    • pnpm lint, pnpm test, pnpm build, and pnpm format:check passed.

Security checks

  • Followed secure coding standards: Yes
  • Ran FindSecurityBugs plugin and verified report: N/A — the changed portal uses Go and TypeScript
  • Confirmed that this PR does not commit keys, passwords, tokens, usernames, or other secrets: Yes

Migrations (if applicable)

This is a full migration with no backward-compatibility layer.

  • Configure the BFF to use the Consent API v0.3.0 server.
  • Replace BFF_PROXY__PLACEHOLDER_CLIENT_ID with BFF_PROXY__PLACEHOLDER_GROUP_ID.
  • Remove any remaining deployment configuration that supplies the legacy key.
  • Ensure upstream integrations use group-id instead of TPP-client-id.
  • No portal database migration is required; the new database is configured separately.

The portal must not be deployed independently of the corresponding Consent API v0.3.0 deployment.

Test environment

  • Operating system: Windows
  • Backend: Go 1.26.3
  • Frontend package manager: pnpm 10.6.5
  • Frontend test environment: Vitest with jsdom
  • Database: N/A for portal testing
  • Browser: Not manually verified

Learning

The migration follows the v0.3 API contract as the authoritative source. With detailed consent responses now containing purpose and element metadata, the BFF can avoid sequential enrichment requests and return consent details with a single upstream call. TanStack Query prefetching is used to reduce perceived delay during registry pagination.

rashmithachamikara and others added 26 commits June 22, 2026 15:34
- Fix response examples to match the documented schema fields and time units.
- Created a new test file for consent history tests, covering scenarios such as:
  - New consent having empty history.
  - Updating consent creating history with pre-update snapshot.
  - Revoking consent creating history.
  - Expiry of consent creating history.
  - Adding and updating authorizations creating history.
  - Testing inclusion of status history in consent retrieval.
- Enabled history tracking in integration test deployment configurations.
- Update readme
- Update test suite
- Update /consents/
- Update /consents/{consentId}
- Update tests
- Update docs
…mes-in-consent-get

Add element and purpose display names to consent get response
- Introduce details flag to consent endpoints
- Update documentation
- Update stores and queries
- Update tests
- Update docs
…mes-in-consent-get

Display names in consent get and purpose get
- Merge after adding display name and description to consent get
…ortal backend

Instead, now it rely on details=true flag of consent endpoints
@coderabbitai

coderabbitai Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 84ae19ee-6d50-4508-8eee-07871d2d65a8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • ✅ Review completed - (🔄 Check again to review again)
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

sleep 2
done
- name: 🔨 Build Server Binary for Integration Tests

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need this for the main branch only?

@rashmithachamikara rashmithachamikara Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These are not introduced as part of this PR.

This PR merges the latest changes from the main branch (api v.0.3.0) into the feature/portal branch, then makes changes to portal to support new api changes. Nothing from the consent api or outside feature/portal is modified.

Only the changes starting from 7c0d5bd are explicitly introduced here.

Commits before these were already reviewed when those were merged to the main branch

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reason this was originally removed is that it is now built automatically by build.sh test_integration. There is no need to build it separately beforehand.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shall we send a separate PR to sync the main branch into the feature/portal branch? And then update this PR?
Otherwise it's hard to review just the features this PR is intended for.

@@ -18,7 +18,7 @@ info:
name: Apache 2.0
url: http://www.apache.org/licenses/LICENSE-2.0.html
servers:
- url: http://localhost:8080/api/v1
- url: http://localhost:8060/api/v1

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why does a port change is required?

@rashmithachamikara rashmithachamikara Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also not part of this feature.

8080 is commonly used for many applications. Conventionally, it is widely used as an alternative web server port. The port change is to avoid potential port clashes with other applications running on a system. Additionally, openfgc does not function as a publicly exposed web server (which commonly uses 8080)


servers:
- url: https://localhost:3000/api/v1
- url: https://localhost:8060/api/v1

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Port change required?

@rashmithachamikara rashmithachamikara Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as above

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants