Retrieve sessionDataKeyConsent in pre issue access token actions#3122
Open
anjuchamantha wants to merge 12 commits intowso2-extensions:masterfrom
Open
Retrieve sessionDataKeyConsent in pre issue access token actions#3122anjuchamantha wants to merge 12 commits intowso2-extensions:masterfrom
anjuchamantha wants to merge 12 commits intowso2-extensions:masterfrom
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe changes introduce session data consent key tracking throughout the OAuth token request lifecycle. The Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant AuthzUtil
participant GrantCache as AuthorizationGrantCache
participant GrantHandler as AuthorizationCodeGrantHandler
participant EventBuilder as PreIssueAccessTokenRequestBuilder
participant Event as PreIssueAccessTokenEvent
Client->>AuthzUtil: addUserAttributesToOAuthMessage()
AuthzUtil->>GrantCache: store AuthorizationGrantCacheEntry<br/>with sessionDataKeyConsent
Client->>GrantHandler: setPropertiesForTokenGeneration()
GrantHandler->>GrantCache: getValueFromCacheByCode(authCode)
GrantCache-->>GrantHandler: AuthorizationGrantCacheEntry
GrantHandler->>GrantHandler: setSessionDataKeyConsentProperty()<br/>from cache entry
Client->>EventBuilder: buildActionExecutionRequest()
EventBuilder->>EventBuilder: getEvent()<br/>reads SESSION_DATA_KEY_CONSENT<br/>from context
EventBuilder->>Event: create Session<br/>with sessionDataKeyConsent
EventBuilder-->>Client: PreIssueAccessTokenEvent<br/>with session data
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![wso2-engineering[bot]](https://avatars.githubusercontent.com/in/1856828?s=60&v=4){kind=small}
...ity.oauth.endpoint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/util/AuthzUtil.java
Show resolved
Hide resolved
.../java/org/wso2/carbon/identity/oauth/action/execution/PreIssueAccessTokenRequestBuilder.java
Outdated
Show resolved
Hide resolved
.../java/org/wso2/carbon/identity/oauth/action/execution/PreIssueAccessTokenRequestBuilder.java
Outdated
Show resolved
Hide resolved
...entity.oauth/src/main/java/org/wso2/carbon/identity/oauth/cache/AuthorizationGrantCache.java
Outdated
Show resolved
Hide resolved
...java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandler.java
Show resolved
Hide resolved
...java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandler.java
Show resolved
Hide resolved
Contributor
There was a problem hiding this comment.
AI Agent Log Improvement Checklist
- The log-related comments and suggestions in this review were generated by an AI tool to assist with identifying potential improvements. Purpose of reviewing the code for log improvements is to improve the troubleshooting capabilities of our products.
- Please make sure to manually review and validate all suggestions before applying any changes. Not every code suggestion would make sense or add value to our purpose. Therefore, you have the freedom to decide which of the suggestions are helpful.
✅ Before merging this pull request:
- Review all AI-generated comments for accuracy and relevance.
- Complete and verify the table below. We need your feedback to measure the accuracy of these suggestions and the value they add. If you are rejecting a certain code suggestion, please mention the reason briefly in the suggestion for us to capture it.
Thumimku
reviewed
Mar 19, 2026
| * @param key CacheKey wrapping the authorization code. | ||
| * @return Cached entry, or null if not found in the local JVM cache. | ||
| */ | ||
| public AuthorizationGrantCacheEntry getValueFromLocalCacheByCode(AuthorizationGrantCacheKey key) { |
Contributor
There was a problem hiding this comment.
why we need this local cache method cause this is getting call when we have the code right, so session store can be invoked to retrived for multi node deployment
Contributor
Author
There was a problem hiding this comment.
Fixed for multi node safety with ce74398
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #3122 +/- ##
============================================
- Coverage 58.70% 58.28% -0.43%
- Complexity 10399 10591 +192
============================================
Files 708 709 +1
Lines 57424 58516 +1092
Branches 13579 14164 +585
============================================
+ Hits 33713 34105 +392
- Misses 19213 19826 +613
- Partials 4498 4585 +87
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| LOG.debug(String.format("Retrieve sessionDataKeyConsent: %s from tokenMessageContext and add to " + | ||
| "additionalParams of the token request in preIssueAccessToken action", sessionDataKeyConsent)); | ||
| } | ||
| tokenRequestBuilder.addAdditionalParam( |
Contributor
There was a problem hiding this comment.
Let's avoid adding this to the additional params, as it is intended to denote the parameters added in the token request.
Let's have a first class object in the event object for this.
Contributor
Author
There was a problem hiding this comment.
Changed with 4f615a3
Can retrieve sessionDataKeyConsent from event.session.sessionDataKeyConsent in action
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@components/org.wso2.carbon.identity.oauth.endpoint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/util/AuthzUtil.java`:
- Around line 2345-2348: AuthzUtil currently logs the raw sessionDataKeyConsent
value via oAuthMessage.getSessionDataKeyFromConsent(), which may expose
sensitive session identifiers; update the debug log in the AuthzUtil code path
that sets authorizationGrantCacheEntry to avoid printing the raw value—either
remove the raw key from the message or log a non-reversible derivative (e.g.,
hash or masked version such as showing only first 4 chars and replacing the rest
with ****) and include clear context in the log; ensure you reference and change
the log call that uses oAuthMessage.getSessionDataKeyFromConsent() so the
sensitive identifier is never emitted in plaintext even at debug level.
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/action/execution/PreIssueAccessTokenRequestBuilder.java`:
- Around line 145-146: The debug log in PreIssueAccessTokenRequestBuilder
currently prints the full sessionDataKeyConsent value via
LOG.debug(String.format(... sessionDataKeyConsent)); change it to avoid logging
the raw value — instead log only its presence or state (e.g.,
"sessionDataKeyConsent present" or "sessionDataKeyConsent is null/empty") by
checking the sessionDataKeyConsent variable before logging and outputting a
boolean or descriptive text; update the LOG.debug call accordingly where
sessionDataKeyConsent is referenced in the event-building path to preserve
privacy.
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandler.java`:
- Around line 703-705: The debug line in AuthorizationCodeGrantHandler that
calls log.debug(String.format(..., grantCacheEntry.getSessionDataKeyConsent()))
must not log the raw sessionDataKeyConsent; change it to either omit the value
or log a redacted/masked version (e.g., replace most characters with asterisks
or only show a safe suffix/prefix) before passing to log.debug, so update the
call site that uses grantCacheEntry.getSessionDataKeyConsent() to use a
redaction helper or constant placeholder instead of the full identifier.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 2729b836-c5df-4309-844f-63c69a74bef6
📒 Files selected for processing (10)
components/org.wso2.carbon.identity.oauth.endpoint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/util/AuthzUtil.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/action/execution/PreIssueAccessTokenRequestBuilder.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/action/model/PreIssueAccessTokenEvent.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/action/model/Session.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/cache/AuthorizationGrantCache.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/cache/AuthorizationGrantCacheEntry.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandler.javacomponents/org.wso2.carbon.identity.oauth/src/test/java/org/wso2/carbon/identity/oauth/action/execution/PreIssueAccessTokenRequestBuilderTest.javacomponents/org.wso2.carbon.identity.oauth/src/test/java/org/wso2/carbon/identity/oauth/cache/AuthorizationGrantCacheTest.javacomponents/org.wso2.carbon.identity.oauth/src/test/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandlerTest.java
...ity.oauth.endpoint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/util/AuthzUtil.java
Show resolved
Hide resolved
.../java/org/wso2/carbon/identity/oauth/action/execution/PreIssueAccessTokenRequestBuilder.java
Show resolved
Hide resolved
...java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandler.java
Show resolved
Hide resolved
| } | ||
|
|
||
| private Request getRequest(OAuth2AccessTokenReqDTO tokenRequestDTO) { | ||
| private Request getRequest(OAuthTokenReqMessageContext tokenMessageContext) { |
Contributor
There was a problem hiding this comment.
Hope this signature change is not required now.
20 tasks
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandler.java`:
- Around line 697-699: The current check uses
AuthorizationGrantCache.getInstance().getValueFromCacheByCode(new
AuthorizationGrantCacheKey(authzCode)) which only looks up the JVM cache and can
miss sessionDataKeyConsent in multi-node setups; update the logic in
AuthorizationCodeGrantHandler so that if grantCacheEntry is null or
grantCacheEntry.getSessionDataKeyConsent() is empty you perform the
distributed/session-store fallback (retrieve the AuthorizationGrantCacheEntry or
the sessionDataKeyConsent from the shared session store using the
authzCode/session key) and then use that value—ensure you still prefer the cache
result when present but fall back to the session store to preserve behavior
across nodes.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: d74b8ae5-7fe0-4768-b83f-c53775f34a9b
📒 Files selected for processing (2)
components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandler.javacomponents/org.wso2.carbon.identity.oauth/src/test/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandlerTest.java
✅ Files skipped from review due to trivial changes (1)
- components/org.wso2.carbon.identity.oauth/src/test/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandlerTest.java
...java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandler.java
Show resolved
Hide resolved
|
PR builder started |
|
PR builder completed |
jenkins-is-staging
approved these changes
Mar 25, 2026
jenkins-is-staging
left a comment
jenkins-is-staging
left a comment
There was a problem hiding this comment.
Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/23551459404
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes in this pull request
Sessionmodel class to represent session context in the pre-issue access token event payloadsessionDataKeyConsentfield toPreIssueAccessTokenEventand its builderAuthzUtilnow storessessionDataKeyConsentfrom the OAuth message context intoAuthorizationGrantCacheEntryduring the authorization endpoint flowAuthorizationGrantCacheEntrygains asessionDataKeyConsentfield with getter/setterAuthorizationCodeGrantHandlerreadssessionDataKeyConsentfrom the cache entry and sets it on the token message context before action executionPreIssueAccessTokenRequestBuilderincludessession.sessionDataKeyConsentin the action event payload sent to external actionsAuthorizationGrantCache,PreIssueAccessTokenRequestBuilder, andAuthorizationCodeGrantHandlerSample Pre Issue Access Token Action request body with sessionDataKeyConsent:
Public Issue:
When should this PR be merged
N/A
Follow up actions
N/A
Developer Checklist (Mandatory)
product-isissue to track any behavioral change or migration impact.Checklist (for reviewing)
General
Functionality
Code
Tests
Security
Documentation
Summary by CodeRabbit
New Features
Tests