This Epic aims to provide endpoints for voiding consents and consent requests along with returning the state of given consents and requests

Endpoints

Get State of Consent

/consent/state/v1/:consentId

Should return the TXN_STATUS for the given consentId. Should return:

{
   "consent" : <STATUS_OF_CONSENT>,
   "consent_request": <STATUS_OF_CONSENT_REQUEST>
}

Void Consent Request

VALID FOR REQUESTER ONLY

/consent/state/v1/void/request/:requestId

Should void a consent request type

Void Consent

VALID FOR CONSENT OWNER AND CONSENTER

/consent/state/v1/void/consent/:consentId

Should set the state of the given consent to VOIDED

Void Consent as Org

VALID FOR ANYONE WITH REQUESTER PERMISSION IN REQUESTER'S ORG

/consent/state/v1/void/consent/:orgId/:consentId

Should void the consent from the org-side

Some Kind of CI-based action for Build -> Test

Deployment can take place later on

Populate the UI for filling out a ConsentRequest form and submitting to endpoint

• UI takes schema and generates a UI form for that Consent
• Submit button packages it into a response type and sends data to endpoint
• Endpoint will send a CallbackUrl which the page should now redirect to

• #5

• Fix authentication bug in Server
• Add Guards for RBAC #11

Once the User has completed the request form, an endpoint is required to submit the data

• Authenticated Endpoint which will take the response form and return the callbackUrl defined by the org for that consent
• Save given data to a db for lookups
• Validate Users
• Update Txn and Consent tables in database

Create Implementations for Landing Pages:

From Planning:

User Not Logged In:

User Logged In (Dashboard)

Two Endpoints must be created

1. Endpoint which can be used by Requester to get consent data. Must also run checks against Expiry etc before fulfilment
2. Endpoint to be used by User to get consent data. Allow expired consents too but add flag. This endpoint should be added to UserConsentController

Role Based Access Control (RBAC) also known as role-based security, is a mechanism that restricts system access. It involves setting permissions and privileges to enable access to authorized users.

This needs to be implemented in the server in order to restrict user movements around the API. The roles will be managed via Auth0 and they will store the data we require for implementing RBAC.

Roles

We can expect the following roles to apply:

The URI will have a consentId onboard which must be sent to the API in order to retrieve the ConsentRequest and Schema

• Add Endpoint on Server to request a ConsentRequestModel and ConsentDataSchema from a given ConsentId with statuses CREATED
• Add User Authenticated Endpoint on Server to request ConsentRequestModel and ConsentDataSchema for a given UserId and ConsentId with status of WAITING
• Add api code in NextJs to handle these endpoints
• Documentation

For any consent request made by an org user, The service should generate a unique token which in turn is used as part of the URL query to the frontend for creating the UI

Consent Record:

model Consent {
  id            Int                   @id@default(autoincrement())
  consentId     String                @default(uuid())
  userid        String?
  orgid         String                @db.VarChar(255)
  expiry        DateTime?              @db.DateTime(0)
  consentState  Consent_consentState
  consentRequestId String
}

As part of this request, we won't have userid or an expiry (This is only given by the user). The ConsentId will be to form the URI but only when it's still in it's CREATED or WAITING phase

• Endpoint must validate inputs
• Generate a basic consent (1st phase) which generates a partial Consent record
• Use the record's consentId to form part of the url returned to the Requester
• Documentation

• #7
• #8
• #9
• #10

Create a Page which can manage consents

See Here

Current configuration is repetative

Consent Form is missing Expiry. Add It

Create a Simple Demo site using svelte to show consenting

Create a NextJS page for handling new consent requests

• Require User to sign in if they haven't already
• Placeholder screen