Interface IConsentService

Namespace

Fdyay.IdentityServer.Services

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Decides whether a request needs the user's consent, and records the answer.

public interface IConsentService

Remarks

One policy with two halves, which is why it is one service. The halves were previously in different assemblies — the authorize endpoint asked whether consent was needed, the interaction service recorded what the user said — and a policy split across two files is a policy that can disagree with itself. It did: Client.AllowRememberConsent was honoured where the decision was written and ignored where it was read, so a client that forbids remembering had its decisions remembered anyway, briefly.

Replace it to make consent conditional on something this server does not know about — a policy per tenant, a re-consent interval, an administrator's revocation list. Both halves are here, so a replacement that changes when consent is required cannot leave the recording half disagreeing with it.

One consequence worth stating, because it is a trade rather than an oversight: what carries a decision back to the request that prompted it is the consent message, not the store. A decision that is not to be remembered leaves nothing behind, so a browser that loses the consent cookie between the decision and the return leg is asked again rather than answered from a row it should never have had. That browser is not signed in either — the two cookies travel the same same-site navigation — so the loop it would otherwise enter is a sign-in loop already.

Methods

RequiresConsentAsync(string, Client, IEnumerable<ParsedScopeValue>, CancellationToken)

Whether the user must be asked before this request can be answered.

Task<bool> RequiresConsentAsync(string subjectId, Client client, IEnumerable<ParsedScopeValue> parsedScopes, CancellationToken cancellationToken = default)

Parameters

subjectId string

The signed-in user.

client Client

The client whose request is waiting.

parsedScopes IEnumerable<ParsedScopeValue>

The scopes the request asked for, as the scope parser read them — Duende's type, so a parameterized scope can be told from a plain one. Enumerated once and not held, so a caller can hand over the request's own collection rather than copying it.

cancellationToken CancellationToken

Cancels the lookup.

Returns

Task<bool>

UpdateConsentAsync(string, Client, ConsentResponse, CancellationToken)

Records the user's decision, so far as it is to outlive the request that prompted it.

Task UpdateConsentAsync(string subjectId, Client client, ConsentResponse consent, CancellationToken cancellationToken = default)

Parameters

subjectId string

client Client

consent ConsentResponse

cancellationToken CancellationToken

Returns

Task