diff --git a/components/org.wso2.carbon.identity.api.user.consent/org.wso2.carbon.identity.api.user.consent.v1/src/main/java/org/wso2/carbon/identity/api/user/consent/v1/impl/core/UserConsentService.java b/components/org.wso2.carbon.identity.api.user.consent/org.wso2.carbon.identity.api.user.consent.v1/src/main/java/org/wso2/carbon/identity/api/user/consent/v1/impl/core/UserConsentService.java index 6732611d..dc601099 100644 --- a/components/org.wso2.carbon.identity.api.user.consent/org.wso2.carbon.identity.api.user.consent.v1/src/main/java/org/wso2/carbon/identity/api/user/consent/v1/impl/core/UserConsentService.java +++ b/components/org.wso2.carbon.identity.api.user.consent/org.wso2.carbon.identity.api.user.consent.v1/src/main/java/org/wso2/carbon/identity/api/user/consent/v1/impl/core/UserConsentService.java @@ -208,8 +208,7 @@ public ConsentResponse getConsent(String consentId) { String subjectId = ContextLoader.getUsernameFromContext(); try { - Receipt receipt = consentManager.getReceiptWithExtendedSchema(consentId); - validateOwnership(receipt, consentId, subjectId); + Receipt receipt = consentManager.getReceiptWithExtendedSchema(consentId, subjectId); return toConsentResponse(receipt); } catch (ConsentManagementException e) { throw handleException(e); @@ -221,8 +220,7 @@ public void revokeConsent(String consentId) { String subjectId = ContextLoader.getUsernameFromContext(); try { - Receipt receipt = consentManager.getReceiptWithExtendedSchema(consentId); - validateOwnership(receipt, consentId, subjectId); + consentManager.getReceiptWithExtendedSchema(consentId, subjectId); consentManager.authorizeConsent(consentId, subjectId, REVOKE_STATE); } catch (ConsentManagementException e) { throw handleException(e); @@ -238,9 +236,7 @@ public void authorizeConsent(String consentId, AuthorizationRequest authorizatio String authStatus = requestState != null ? requestState.value() : AuthorizationRequest.StateEnum.APPROVED.value(); - Receipt receipt = consentManager.getReceiptWithExtendedSchema(consentId); - List authorizations = consentManager.getConsentAuthorizations(consentId); - validateAuthorizer(receipt, consentId, subjectId, authorizations); + consentManager.getConsentAuthorizations(consentId, subjectId); consentManager.authorizeConsent(consentId, subjectId, authStatus); } catch (ConsentManagementException e) { throw handleException(e); @@ -252,8 +248,7 @@ public ConsentValidationResponse validateConsent(String consentId) { String subjectId = ContextLoader.getUsernameFromContext(); try { - Receipt receipt = consentManager.getReceiptWithExtendedSchema(consentId); - validateOwnership(receipt, consentId, subjectId); + Receipt receipt = consentManager.getReceiptWithExtendedSchema(consentId, subjectId); String status = consentManager.validateConsentStatus(consentId); ConsentValidationResponse response = new ConsentValidationResponse(); @@ -290,60 +285,6 @@ private List buildPurposeBindings(ConsentInput consen return purposeBindings; } - private void validateOwnership(Receipt receipt, String consentId, String subjectId) { - - if (receipt == null) { - throw consentNotFoundError(consentId); - } - if (!subjectId.equals(receipt.getPiiPrincipalId())) { - throw userNotAuthorizedError(); - } - } - - private void validateAuthorizer(Receipt receipt, String consentId, String subjectId, - List authorizations) { - - if (receipt == null) { - throw consentNotFoundError(consentId); - } - if (subjectId.equals(receipt.getPiiPrincipalId())) { - return; - } - if (findUserAuthorization(authorizations, subjectId) != null) { - return; - } - throw userNotAuthorizedError(); - } - - private ConsentAuthorization findUserAuthorization(List authorizations, String subjectId) { - - if (authorizations != null) { - for (ConsentAuthorization auth : authorizations) { - if (subjectId.equals(auth.getUserId())) { - return auth; - } - } - } - return null; - } - - private APIError consentNotFoundError(String consentId) { - - return new APIError(Response.Status.NOT_FOUND, new ErrorResponse.Builder() - .withCode(ErrorMessages.ERROR_CODE_RECEIPT_ID_INVALID.getCode()) - .withMessage("Consent not found.") - .withDescription("No consent found for ID: " + consentId) - .build()); - } - - private APIError userNotAuthorizedError() { - - return new APIError(Response.Status.FORBIDDEN, new ErrorResponse.Builder() - .withCode(ErrorMessages.ERROR_CODE_USER_NOT_AUTHORIZED.getCode()) - .withMessage(ErrorMessages.ERROR_CODE_USER_NOT_AUTHORIZED.getMessage()) - .build()); - } - private ConsentResponse toConsentResponse(Receipt receipt) { ConsentResponse dto = new ConsentResponse(); diff --git a/pom.xml b/pom.xml index 01ce67d5..152bddb4 100644 --- a/pom.xml +++ b/pom.xml @@ -556,7 +556,7 @@ 1.4.122 4.1.2 1.1.6 - 2.9.10 + 2.9.14