feat(consent): persist anonymous session consent after expiry checks - #181
Draft
cursor[bot] wants to merge 6 commits into
Draft
feat(consent): persist anonymous session consent after expiry checks#181cursor[bot] wants to merge 6 commits into
cursor[bot] wants to merge 6 commits into
Conversation
Require ManageOwnConsent on the participant ledger before any later consent or outbox composition. Foreign participants, foreign tenants, missing participant identity, and numeric tenants fail closed. Service consent still does not imply research contribution. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Compose ManageOwnConsent with persist_consent_ledger so a foreign participant cannot insert another person's consent row. Keep the low-level persist adapter for isolation tests. Outbox tail and HTTP POST /v1/consents stay later slices. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Prove persist_authorized_consent_ledger inserts no consent row when the actor is in another tenant or lacks a participant identity. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
A current anonymous assessment session may persist its own purpose-specific ledger. An expired session, unknown server time, or foreign participant inserts no consent row, so anonymous research opt-in cannot bypass owner authorization. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Protected-main #81 requires claim_deadline_at on processing integration_consumption rows. Recovery fixtures that omit the column fail constraint integration_consumption_claim_deadline_shape.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
PR #170 composes
ManageOwnConsentwithpersist_consent_ledgerfor a Keyverse-shaped actor. Anonymous assessment is first-class, but that write path has no current-session expiry or binding check. A later HTTP adapter would have to invent a subject and skip session lifetime.What this PR does
persist_authorized_anonymous_consent_ledger: a currentAnonymousSessionContextmay persist its own ledger after expiry and exact participant binding.consent_ledgerorconsent_eventrow.Out of scope
POST /v1/consents/ OpenAPI / RFC 9457Test plan
cargo test --test consent_anonymous_authorization_write_path --test consent_authorization_write_path --test documentation_architecture_contract --test traceability_active_pr_contractcargo clippy --all-targets -- -D warningscargo test --test postgres_consent_anonymous_persist --test postgres_consent_authorized_persist(needsTEST_DATABASE_URL)This is the successor to #170. Prefer this head over owner-only #170 and authorize-only #145. Prefer #142 for durable-tail outbox. Do not merge #70, #112, #120, #123, #134, #145, or #170. Do not merge until exact-head checks and independent last-push approval are satisfied. Never self-approve.
Operator next action
Review the anonymous-session expiry and binding no-row proofs. Keep outbox work on #142. Do not treat this head as HTTP consent.