Skip to main content

approve_consent

headless_lms_server::controllers::main_frontend::oauth::consent

Function approve_consent 

Source 
pub async fn approve_consent(
    pool: Data<PgPool>,
    form: Json<ConsentQuery>,
    user: AuthUser,
) -> ControllerResult<HttpResponse>
Expand description

Handles /consent approval after the user agrees to grant requested scopes.

This endpoint:

  • Validates the redirect URI and the approved scopes against the registered client.
  • Records the approved scopes for the user-client pair.
  • Redirects back to /authorize with the approved scopes, so the code is issued for them.

scope is what the user approved, which may be fewer scopes than requested. If it contains any MCP scope it must contain material:read.

ยงExample

POST /api/v0/main-frontend/oauth/consent HTTP/1.1
Cookie: session=abc123

{"client_id":"test-client-id","redirect_uri":"http://localhost","scope":"openid profile","state":"random123","nonce":"secure_nonce_abc","response_type":"code"}

Response:

{"redirect_uri": "/api/v0/main-frontend/oauth/authorize?client_id=..."}