> For the complete documentation index, see [llms.txt](https://docs.openg2p.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openg2p.org/platform/platform-services/consent-management/development.md).

# Development

Developing the Consent Manager: technology stack, repository layout, local setup, tests and configuration.

{% hint style="info" %}
**Source repository:** <https://github.com/OpenG2P/consent-manager>. Clone, raise issues, and open pull requests there.
{% endhint %}

The Consent Manager is a FastAPI service built on [`openg2p-fastapi-common`](https://github.com/OpenG2P/openg2p-fastapi-common), backed by **PostgreSQL** (async SQLAlchemy). It is the Policy Decision Point (PDP) described in the [design](/platform/platform-services/consent-management/design.md); this section covers building and running it.

## Technology stack

| Concern    | Choice                                                                      |
| ---------- | --------------------------------------------------------------------------- |
| Framework  | `openg2p-fastapi-common` (`BaseService` / `BaseController` / `Initializer`) |
| Language   | Python ≥ 3.10                                                               |
| Database   | PostgreSQL via async SQLAlchemy (`asyncpg`)                                 |
| Migrations | `create_migrate()` per model (no Alembic)                                   |
| Crypto     | `cryptography` (Ed25519 / ES256 / RS256) + canonical-JSON signing           |
| Auth       | Keycloak bearer tokens, validated via JWKS (PyJWT)                          |
| Serving    | gunicorn + uvicorn workers                                                  |

## Repository layout

The [`consent-manager`](https://github.com/OpenG2P/consent-manager) repository holds the service (`backend/`), the staff console (`ui/`), the partner portal (`partner-portal/`), the Helm chart and scripts (`deployment/`), Dockerfiles (`docker/`) and the in-cluster sanity suite (`test/sanity/`).

```
backend/src/openg2p_consent_manager/
  config.py            Settings (env prefix CONSENT_MANAGER_)
  db.py                Shared async session factory
  auth.py              Keycloak bearer auth (staff and partner realms)
  models/              SQLAlchemy models (consent, audit, exchange); no partner tables
  schemas/             Pydantic request/response models
  services/            verification · policy · partner + pm_policy_client (Partner Management) ·
                       crypto · receipt · consent · lifecycle · exchange · assisted · evidence ·
                       subject_auth · consent_record · master_data_client · composite_client
  controllers/         verification · well-known · decisions · consent verification ·
                       partner portal · lifecycle · subject
  utils/               canonical JSON, JWKS, caches
  app.py               Initializer (wires services and controllers per API audience, runs migrations)
  main.py              ASGI entrypoint (gunicorn/uvicorn)
  expire.py            Standalone expiry runner (for the CronJob)
```

The HTTP surface is documented in the [API Reference](/platform/platform-services/consent-management/api.md).

## Local setup

```bash
cd backend
cp .env.example .env          # adjust DB, signing key, and auth settings
pip install -e .              # pulls openg2p-fastapi-common + deps
python -m openg2p_consent_manager.main migrate   # create tables
uvicorn openg2p_consent_manager.main:app --reload
```

For local dev without Keycloak, set `CONSENT_MANAGER_AUTH_ENABLED=false` (staff tokens are then accepted unverified and role checks pass; partner-portal tokens are always verified). With no signing key configured, an ephemeral key is generated — fine for dev, but receipts will not verify across restarts.

The whole stack (Postgres + service) also runs via Docker Compose from the repo root:

```bash
docker compose up --build
```

FastAPI serves an interactive OpenAPI/Swagger UI at `/docs` once running.

## Tests

`backend/tests/` runs the services, controllers and the migration against a real Postgres. It **wipes the database it is given**, and is skipped if the database cannot be reached:

```bash
cd backend
pip install -e '.[test]'
CM_TEST_DB_DATASOURCE=postgresql+asyncpg://postgres@localhost:5432/cm_test pytest tests
```

## Configuration

All settings use the `CONSENT_MANAGER_` env prefix; see `backend/.env.example` for the full list (database, `.p12` signing key, Keycloak auth, replay window, Partner Management URL and the partner key and policy caches). Without a Partner Management URL every `/validate` fails closed; tests stand in for PM with an in-memory fake. Chart values for each setting: [Deployment](/platform/platform-services/consent-management/deployment.md).

## Background expiry

Expiry is not an in-process scheduler, so API pods stay stateless. It is a standalone command, run by the chart's CronJob: `python -m openg2p_consent_manager.expire`.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openg2p.org/platform/platform-services/consent-management/development.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.