diff --git a/apps/api-manager/src/routes/health/+server.ts b/apps/api-manager/src/routes/health/+server.ts index 2fe11f12..fee9f917 100644 --- a/apps/api-manager/src/routes/health/+server.ts +++ b/apps/api-manager/src/routes/health/+server.ts @@ -1,14 +1,25 @@ import type { RequestHandler } from './$types'; -import { healthCheckRegistry } from '@obp/shared/health-check'; -import { get } from 'svelte/store'; +/** + * Liveness probe: this process is up and serving HTTP. It deliberately checks nothing else. + * + * It used to require every monitored dependency to be healthy and answer 503 otherwise, which is + * readiness logic in a liveness endpoint. An orchestrator polling /health would then restart a + * perfectly functional API Manager because a secondary OAuth2 provider was down — it keeps serving + * pages either way, so killing it only widens an unrelated outage. + * + * It also flattened the nuance /status already encodes: summarizeHealth treats the OAuth2 providers + * as one group, so one dead provider alongside a working one is 'partial', not a failure. `every()` + * turned any single unhealthy check — including a provider that was never configured — into a hard + * 503. And it counted "no checks registered" as healthy, the opposite of the rule summarizeHealth + * states for that case ('unknown', never 'healthy'). + * + * Ask /status for dependency health: it reports per-service detail and its own overall verdict. + * This matches the /health that OBP-API and Hola serve. + */ export const GET: RequestHandler = async () => { - const snapshots = get(healthCheckRegistry.getStore()); - const services = Object.values(snapshots); - const healthy = services.length === 0 || services.every((s) => s.status === 'healthy'); - - return new Response(JSON.stringify({ status: healthy ? 'ok' : 'error' }), { - status: healthy ? 200 : 503, + return new Response(JSON.stringify({ status: 'ok' }), { + status: 200, headers: { 'Content-Type': 'application/json' } }); }; diff --git a/apps/portal/src/lib/obp/types.ts b/apps/portal/src/lib/obp/types.ts index 62a9e5eb..641c4bba 100644 --- a/apps/portal/src/lib/obp/types.ts +++ b/apps/portal/src/lib/obp/types.ts @@ -312,6 +312,18 @@ export interface OBPBGPaymentAuthorisation { sca_status: string; } +// Berlin Group Consent Authorisation (SCA) types +export interface OBPBGStartConsentAuthorisation { + scaStatus: string; + authorisationId: string; + pushMessage: string; + _links: { scaStatus: string }; +} +export interface OBPBGConsentAuthorisationResult { + scaStatus: string; + _links?: { scaStatus?: { href?: string } }; +} + // Personal Data Field (User Attribute) export interface OBPPersonalDataField { user_attribute_id: string; diff --git a/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.server.ts b/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.server.ts index 5e74f7b2..f3edb51b 100644 --- a/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.server.ts +++ b/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.server.ts @@ -4,20 +4,47 @@ import type { RequestEvent, Actions } from '@sveltejs/kit'; import { redirect, isRedirect } from '@sveltejs/kit'; import { obp_requests } from '$lib/obp/requests'; import { OBPRequestError } from '@obp/shared/obp'; -import { env } from '$env/dynamic/private'; +import type { + OBPBGStartConsentAuthorisation, + OBPBGConsentAuthorisationResult +} from '$lib/obp/types'; export async function load(event: RequestEvent) { const consentId = event.url.searchParams.get('CONSENT_ID'); - if (!consentId) { return { loadError: 'Missing required parameter: CONSENT_ID.', consentId: '', - }; + authorisationId: '' + }; + } + + const token = event.locals.session.data.oauth?.access_token; + if (!token) { + return { + loadError: 'No access token found in session.', + consentId, + authorisationId: '' + }; } - return { consentId }; + try { + const startResponse: OBPBGStartConsentAuthorisation = await obp_requests.post( + `/berlin-group/v1.3/consents/${consentId}/authorisations`, + { scaAuthenticationData: '' }, + token + ); + + return { consentId, authorisationId: startResponse.authorisationId }; + } catch (e) { + logger.error('Error starting BG consent authorisation:', e); + let errorMessage = 'Failed to start consent authorisation.'; + if (e instanceof OBPRequestError) { + errorMessage = e.message; + } + return { loadError: errorMessage, consentId, authorisationId: '' }; + } } export const actions = { @@ -25,35 +52,34 @@ export const actions = { const formData = await request.formData(); const otp = formData.get('otp') as string; const consentId = formData.get('consentId') as string; + const authorisationId = formData.get('authorisationId') as string; if (!otp) { return { message: 'Please enter the OTP code.' }; } + if (!authorisationId) { + return { message: 'Missing authorisation id. Please reload the page.' }; + } + const token = locals.session.data.oauth?.access_token; if (!token) { return { message: 'No access token found in session.' }; } - const defaultBankId = env.DEFAULT_BANK_ID; - if (!defaultBankId) { - logger.error('DEFAULT_BANK_ID environment variable is not set'); - return { message: 'Server configuration error: DEFAULT_BANK_ID is not set.' }; - } - try { - const response = await obp_requests.post( - `/obp/v3.1.0/banks/${defaultBankId}/consents/${consentId}/challenge`, - { answer: otp }, + const response: OBPBGConsentAuthorisationResult = await obp_requests.put( + `/berlin-group/v1.3/consents/${consentId}/authorisations/${authorisationId}`, + { scaAuthenticationData: otp }, token ); - if (response.status === 'ACCEPTED' || response.status === 'VALID') { + if (response.scaStatus === 'valid') { redirect(303, `/confirm-bg-consent-request-redirect-uri?CONSENT_ID=${consentId}`); } return { - message: `Challenge was not accepted. Status: ${response.status}` + message: `Challenge was not accepted. Status: ${response.scaStatus}` }; } catch (e) { if (isRedirect(e)) throw e; diff --git a/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.svelte b/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.svelte index 41d65eb9..2f999ee4 100644 --- a/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.svelte +++ b/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.svelte @@ -25,6 +25,7 @@
+