## Scenario 1: Onboard a contract

### Role: Administrator

[Outside of the consent management]
Lawyer sent a new agreement with the data analytics company and shared it to the administrator to define a contract into consent management system. Earlier policy for the same is sent and its outside this flow.

The administrator sends the contract to the data protection team to get the dpia score and lifecycle details.

Once received the dpia and lifecycle details the administrator uses ``POST /config/agreement/ to upload the agreement.``
(Not possible to point to the original PDF that lawyer sent. I mean no way to have referenceable url to the document management system where this contract is kept.)

A form is shown to the administrator to fill.

The form needs
A dropdown for senstivitity [Assume its a configuration, but do we need an api or we hard code this dropdown.].
A dropdown for category?
A drop down for lawful_basis [Assume its a configuration, but do we need an api or we hard code this dropdown.].
A drop down for data_use [Assume its a configuration, but do we need an api or we hard code this dropdown.].
Is dpia a string or a bitmap? How to show in the UI?
By default the agreement is not active? [No definition for default]
Hash format? how is admin expected to get it? or its JWS without the payload (assume pdf as payload)?
Is Controller a drop down? [Api is available? I was not able to find am i missing something? ]

Scenario 2: User calls the customer care

### Role: Individual

The user calls the customer care to withdraw a consent.

The user heard from his friend about a possible misuse of data and feels strongly about withdrawing his consent given for a specific purpose to a specific organisation.

User goes to the consent management site of the respective organization. Lists all the agreements using his individual id using the ``GET /service/record/{individualId}/agreement/``
Then picks the consent that he feels insecure about using ``GET /service/record/{individualId}/agreement/{agreementId}/``
Prints this on a paper and starts a discussion with his lawyer.
Once the lawyer confirms, The user calls the customer care and provides his individual id and consent id to withdraw.
The customer care calls the ``GET /service/admin/consentrecord/{recordId}/``. Looks at the content and gets one more confirmation from the user on phone. [How will the Customer care know that its the specific user calling? i mean not the authentication but should the api have an individual id? so we know the customer care has not mistyped the consentrecord of other individual].

Then the customer care then withdraws the consent record and all its revisions by clicking the withdraw button and it calls the ``PUT /service/admin/consentrecord/{recordId}/withdraw/. [missing individual id?]``

Scenario 3: User signup for consent management

### Role: Individual

A new user in the consent management.

User visits the consent management portal of the organization. Clicks signup. The signup takes to the id block and returns with an openidconnect access token.

The backend of the consent management calls the ``POST /service/individual/ `` with the details from the userinfo api (id bb/openid connect)

An unique individual is created with random individual id, foundation_id token (a unique token per user issued to this org).

Scenario 4: User login and CM dashboard

### Role: Individual

The user clicks login and is taken to the ID BB.

After the dance of openid connect the user is taken to the dashboard page. [Openid connect call back api? Looks like we need an api that acts as a landing api for the access code flow of openid connect and that intern has to return back a individual id or session. For a given session we will need to get the individual id]

The page has to get individual id but how?

In the backend of the callback for access token api we will call the userinfo api of IDBB and get the updated userinfo details. The same is updated using ``PUT /service/individual/{individualId}/`` [But we dont know how to get the individual id yet from an openid auth].

[We will never know if the IDBB is a functional or foundational so why have two columns]

Once we get the individual id we will call ``GET /service/individual/`` [note registryreference need some id. its better to have the individual id exposed rather than the id block tokens.]

All the consents are shown in the UI. If the api returns empty then the page displays appropriate message.

Scenario 5: User deleting

### Role: Individual

The user goes to the dashboard. Clicks on delete button from his profile page.
The ``DELETE /service/individual/{individualId}/`` is called. The user waits for this api to come back. [Is it practical to expect that all consent will be deleted within this short time period?] Should we rather provide this as a async mode?

[What if the users wants to export all the consent records before deleting ? What happens to expired records, i assume all are deleted. ]