Let the AI-consent card grant again after a withdrawal

POST /api/consent/ai/web now accepts an optional { intent } body. Without
one (the AI-settings mount heal) a standing revocation still blocks the
mint; intent "affirmative" is the user's own consent act and may
supersede an earlier revocation, exactly as a first grant would. The
consent card offers the explicit grant control whenever consent does not
stand, and the audit row records which intent minted the receipt.

The document auto-read opt-in already declared "affirmative" on enable;
the settings-mount heal posts no body. Both stay as they are.
This commit is contained in:
Marc-André Bombeck committed 2026-08-13 02:27:05 +02:00
1 parent fd104dd0ac
commit e83b58c9da
13 files changed
+268 -41

No files matched your search

+18 -4
View File
@@ -8904,10 +8904,24 @@ paths:
tags:
- Consent
summary: Grant web AI consent (idempotent ai_full)
description: Mint an `ai_full` consent receipt for the calling web user if none is active; a no-op when one already
exists. Mirrors the iOS master grant; the web AI-settings surface calls this on mount so existing web accounts
on a shared-key deployment gain a receipt without a re-consent step. Revocation flows through DELETE
/api/consent/ai/latest.
description: "Mint an `ai_full` consent receipt for the calling web user if none is active; a no-op when one already
exists. Mirrors the iOS master grant. Without a body (the mount heal) it grants only to an account with no
consent history, so a revocation stands until the user grants again; with `intent: \"affirmative\"` (the
explicit grant control) it records the user's own consent act, which may supersede an earlier revocation.
Revocation flows through DELETE /api/consent/ai/latest."
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
intent:
default: heal
type: string
enum:
- heal
- affirmative
responses:
"200":
description: Grant outcome.