Add relation, timestamp filter and attributes to /me consents; allow authorizer access

[RovinKYK]

Purpose

Brings the consent delegation model to the self-service API: a user can now list consents they authorize as well as those they gave, filter by creation time, expand list responses selectively, and read, validate and revoke a consent they are a listed authorizer of.

Related Issue: wso2/product-is#28322
Merge After: wso2/carbon-consent-management#285

API changes

GET /me/consents

Parameter	Change
relation	New. SUBJECT (default) | AUTHORIZER | ANY.
attributes	New. Comma-separated: purposes, authorizations, properties.
filter	Now also accepts timestamp with ge / le (milliseconds since epoch).

ConsentSummary gains subjectId, plus optional purposes, authorizations and properties populated only when requested via attributes. With relation=AUTHORIZER or ANY, subjectId identifies the user who gave the consent, which may be someone other than the caller.

A 400 response is now documented on the listing operation.

GET, POST /revoke and POST /validate on /me/consents/{consent-id} now admit the consent subject or any user in the consent's authorization list; an unrelated user still receives 403. This means a listed authorizer can revoke the whole consent, including one who never approved it.

Changes

• consent.yaml updated; src/gen regenerated (new ConsentPurposeSummary, extended ConsentSummary).
• MeApiServiceImpl passes relation and attributes through.
• UserConsentService:
  • listConsents takes relation (parsed to ConsentRelation, defaulting to SUBJECT when blank) and attributes; the context username is passed as the user identifier.
  • timestamp accepted in the filter attribute check, restricted to ge / le.
  • attributes parsed into a set, unknown values rejected with 400 CM_00118.
  • Requested attributes populated through the batch lookups from the core PR; no extra queries when attributes is omitted.
  • getConsent, revokeConsent and validateConsent now call getReceiptForInvolvedUserWithExtendedSchema.
  • subjectId set on ConsentSummary.
  • Authorization response mapping extracted into a reusable toAuthorizationResponses.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b3c7eb36-341a-4a2e-8e7e-d40062e237ab

📥 Commits

Reviewing files that changed from the base of the PR and between 8a38142 and 999744e.

📒 Files selected for processing (1)

• pom.xml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Summary

• Added consent delegation support for subjects and authorizers.
• Added relation, attributes, and timestamp filters to GET /me/consents.
• Added optional purposes, authorizations, and properties data to ConsentSummary.
• Added subjectId and ConsentPurposeSummary.
• Updated consent access operations for authorized users.
• Preserved the deprecated listConsents overload for backward compatibility.

Walkthrough

The consent API now supports SUBJECT, AUTHORIZER, and ANY relation-based access. Consent listing accepts purposes, authorizations, and properties attributes. Consent summaries include subjectId and optional expanded data. Retrieval, revocation, and validation use involved-user receipt lookups. Timestamp filtering supports ge and le operations.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant MeApiServiceImpl
  participant UserConsentService
  participant ConsentManager
  Client->>MeApiServiceImpl: Request consents with relation and attributes
  MeApiServiceImpl->>UserConsentService: Forward consent list parameters
  UserConsentService->>ConsentManager: List receipts for the authenticated user
  ConsentManager-->>UserConsentService: Return matching receipts
  UserConsentService-->>MeApiServiceImpl: Return populated consent summaries
  MeApiServiceImpl-->>Client: Return consent list response

Loading

Suggested reviewers: wso2-jenkins-bot

Merge Risk: ⚪ Minimal · up to 99974

The PR expands consent listing and authorizer access with documented filtering and optional response attributes; no actionable merge-blocking risk remains based on the supplied evidence.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the purpose and implementation but omits most required template sections, including the mandatory checklist, tests, security checks, and test environment.	Add and complete the missing template sections, including Goals, User stories, the mandatory Developer Checklist, release note, tests, security, documentation, migrations, and test environment.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main API changes and authorizer access introduced by the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR extends the User Consent “me” API to support listing and retrieving consents beyond only the authenticated subject, and to optionally enrich list responses with additional consent details.

Changes:

• Adds relation (SUBJECT/AUTHORIZER/ANY) and attributes query parameters to the list consents endpoint, and updates the OpenAPI contract accordingly.
• Expands list response payload (ConsentSummary) with subjectId and optional purposes, authorizations, and properties (populated on-demand via attributes).
• Updates consent access behavior/documentation to allow “involved users” (subject or authorized users) to retrieve/revoke/validate consent records, and adds timestamp filtering support.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
components/org.wso2.carbon.identity.api.user.consent/org.wso2.carbon.identity.api.user.consent.v1/src/main/resources/consent.yaml	Updates OpenAPI: new query params (relation, attributes), timestamp filter docs, richer ConsentSummary, and 400 response for list.
components/org.wso2.carbon.identity.api.user.consent/org.wso2.carbon.identity.api.user.consent.v1/src/main/java/org/wso2/carbon/identity/api/user/consent/v1/impl/MeApiServiceImpl.java	Wires new query params through the REST implementation to the core service.
components/org.wso2.carbon.identity.api.user.consent/org.wso2.carbon.identity.api.user.consent.v1/src/main/java/org/wso2/carbon/identity/api/user/consent/v1/impl/core/UserConsentService.java	Implements relation/attribute handling, timestamp filter validation, involved-user access, and optional attribute population for list responses.
components/org.wso2.carbon.identity.api.user.consent/org.wso2.carbon.identity.api.user.consent.v1/src/gen/java/org/wso2/carbon/identity/api/user/consent/v1/model/ConsentSummary.java	Updates generated model to include new fields returned by list responses.
components/org.wso2.carbon.identity.api.user.consent/org.wso2.carbon.identity.api.user.consent.v1/src/gen/java/org/wso2/carbon/identity/api/user/consent/v1/model/ConsentPurposeSummary.java	Adds new generated model used when attributes includes purposes.
components/org.wso2.carbon.identity.api.user.consent/org.wso2.carbon.identity.api.user.consent.v1/src/gen/java/org/wso2/carbon/identity/api/user/consent/v1/MeApiService.java	Updates generated service interface signature for list endpoint.
components/org.wso2.carbon.identity.api.user.consent/org.wso2.carbon.identity.api.user.consent.v1/src/gen/java/org/wso2/carbon/identity/api/user/consent/v1/MeApi.java	Updates generated JAX-RS resource for new query params and updated endpoint notes/responses.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jenkins-is-staging]

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/32728748671

[jenkins-is-staging]

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/32728748671
Status: failure

[jenkins-is-staging]

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/32812216503

[jenkins-is-staging]

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/32812216503
Status: success

[jenkins-is-staging]

Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/32812216503