OAuth2 Consent — User Consent Management in Authorization Code Flows

from flask import Flask, request, render_template, redirect, session
import uuid

app = Flask(__name__)

@app.route('/oauth/authorize', methods=['GET'])
def authorize():
    """Show consent screen to user."""
    client_id = request.args.get('client_id')
    scope = request.args.get('scope', '').split()
    redirect_uri = request.args.get('redirect_uri')
    state = request.args.get('state')

    client = get_client(client_id)
    scope_descriptions = get_scope_descriptions(scope)
    user = get_current_user()

    # Check for previously remembered consent
    previous_consent = get_consent(user.id, client_id)
    if previous_consent and set(scope).issubset(set(previous_consent['scopes'])):
        # Auto-approve if previously consented
        return auto_approve(client, user, scope, redirect_uri, state)

    return render_template('consent.html',
        client_name=client.name,
        client_logo=client.logo_url,
        publisher=client.publisher,
        scope_descriptions=scope_descriptions,
        requested_scopes=scope,
        redirect_uri=redirect_uri,
        state=state,
        client_id=client_id
    )

def get_scope_descriptions(scopes):
    descriptions = {
        'read:threats': 'View threat reports and indicators',
        'write:threats': 'Create and update threat reports',
        'read:remediation': 'View remediation guides',
        'write:remediation': 'Execute remediation actions',
        'read:users': 'View user profiles',
        'admin': 'Full administrative access'
    }
    return [{'scope': s, 'description': descriptions.get(s, s)}
            for s in scopes]

@app.route('/oauth/consent', methods=['POST'])
def process_consent():
    """Process user consent decision."""
    user = get_current_user()
    client_id = request.form.get('client_id')
    approved_scopes = request.form.getlist('scopes')
    remember = 'remember' in request.form
    decision = request.form.get('decision')

    if decision == 'deny':
        return redirect_with_error('access_denied')

    # Record consent
    consent_record = {
        'user_id': user.id,
        'client_id': client_id,
        'scopes': approved_scopes,
        'granted_at': datetime.now(timezone.utc).isoformat(),
        'remember': remember
    }
    save_consent(consent_record)

    # Generate authorization code
    auth_code = str(uuid.uuid4())
    save_auth_code(auth_code, {
        'client_id': client_id,
        'user_id': user.id,
        'scopes': approved_scopes,
        'redirect_uri': request.form.get('redirect_uri'),
        'expires_at': datetime.now(timezone.utc) + timedelta(minutes=5)
    })

    # Redirect to client
    redirect_uri = request.form.get('redirect_uri')
    state = request.form.get('state')
    return redirect(f"{redirect_uri}?code={auth_code}&state={state}")

def redirect_with_error(error):
    redirect_uri = request.form.get('redirect_uri')
    state = request.form.get('state')
    return redirect(f"{redirect_uri}?error={error}&state={state}")

@app.route('/oauth/consent/revoke', methods=['POST'])
def revoke_consent():
    """User revokes previously granted consent."""
    user = get_current_user()
    client_id = request.form.get('client_id')
    scope = request.form.getlist('scopes')

    if scope:
        # Revoke specific scopes only
        revoke_scopes(user.id, client_id, scope)
        print(f"Revoked scopes for client {client_id}: {scope}")
    else:
        # Revoke all consent for this client
        revoke_all_consent(user.id, client_id)
        print(f"Revoked all consent for client {client_id}")

    return render_template('consent-revoked.html',
        client_name=get_client(client_id).name)

@app.route('/oauth/consent/manage')
def manage_consent():
    """Show all clients the user has consented to."""
    user = get_current_user()
    consents = get_user_consents(user.id)

    return render_template('consent-manage.html',
        consents=[{
            'client': get_client(c['client_id']),
            'scopes': c['scopes'],
            'granted_at': c['granted_at']
        } for c in consents]
    )