fix: correct Berlin Group SCA authorisation URL segment order

apps/portal/src/lib/obp/types.ts

@@ -312,6 +312,18 @@ export interface OBPBGPaymentAuthorisation {
     sca_status: string;
 }
 
+// Berlin Group Consent Authorisation (SCA) types
+export interface OBPBGStartConsentAuthorisation {
+    scaStatus: string;
+    authorisationId: string;
+    pushMessage: string;
+    _links: { scaStatus: string };
+}
+export interface OBPBGConsentAuthorisationResult {
+    scaStatus: string;
+    _links?: { scaStatus?: { href?: string } };
+}
+
 // Personal Data Field (User Attribute)
 export interface OBPPersonalDataField {
     user_attribute_id: string;

apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.server.ts

@@ -4,56 +4,82 @@ import type { RequestEvent, Actions } from '@sveltejs/kit';
 import { redirect, isRedirect } from '@sveltejs/kit';
 import { obp_requests } from '$lib/obp/requests';
 import { OBPRequestError } from '@obp/shared/obp';
-import { env } from '$env/dynamic/private';
+import type {
+	OBPBGStartConsentAuthorisation,
+	OBPBGConsentAuthorisationResult
+} from '$lib/obp/types';
 
 export async function load(event: RequestEvent) {
 	const consentId = event.url.searchParams.get('CONSENT_ID');
 
-
 	if (!consentId) {
 		return {
 			loadError: 'Missing required parameter: CONSENT_ID.',
 			consentId: '',
-			};
+			authorisationId: ''
+		};
+	}
+
+	const token = event.locals.session.data.oauth?.access_token;
+	if (!token) {
+		return {
+			loadError: 'No access token found in session.',
+			consentId,
+			authorisationId: ''
+		};
 	}
 
-	return { consentId };
+	try {
+		const startResponse: OBPBGStartConsentAuthorisation = await obp_requests.post(
+			`/berlin-group/v1.3/consents/${consentId}/authorisations`,
+			{ scaAuthenticationData: '' },
+			token
+		);
+
+		return { consentId, authorisationId: startResponse.authorisationId };
+	} catch (e) {
+		logger.error('Error starting BG consent authorisation:', e);
+		let errorMessage = 'Failed to start consent authorisation.';
+		if (e instanceof OBPRequestError) {
+			errorMessage = e.message;
+		}
+		return { loadError: errorMessage, consentId, authorisationId: '' };
+	}
 }
 
 export const actions = {
 	default: async ({ request, locals }) => {
 		const formData = await request.formData();
 		const otp = formData.get('otp') as string;
 		const consentId = formData.get('consentId') as string;
+		const authorisationId = formData.get('authorisationId') as string;
 
 		if (!otp) {
 			return { message: 'Please enter the OTP code.' };
 		}
 
+		if (!authorisationId) {
+			return { message: 'Missing authorisation id. Please reload the page.' };
+		}
+
 		const token = locals.session.data.oauth?.access_token;
 		if (!token) {
 			return { message: 'No access token found in session.' };
 		}
 
-		const defaultBankId = env.DEFAULT_BANK_ID;
-		if (!defaultBankId) {
-			logger.error('DEFAULT_BANK_ID environment variable is not set');
-			return { message: 'Server configuration error: DEFAULT_BANK_ID is not set.' };
-		}
-
 		try {
-			const response = await obp_requests.post(
-				`/obp/v3.1.0/banks/${defaultBankId}/consents/${consentId}/challenge`,
-				{ answer: otp },
+			const response: OBPBGConsentAuthorisationResult = await obp_requests.put(
+				`/berlin-group/v1.3/consents/${consentId}/authorisations/${authorisationId}`,
+				{ scaAuthenticationData: otp },
 				token
 			);
 
-			if (response.status === 'ACCEPTED' || response.status === 'VALID') {
+			if (response.scaStatus === 'valid') {
 				redirect(303, `/confirm-bg-consent-request-redirect-uri?CONSENT_ID=${consentId}`);
 			}
 
 			return {
-				message: `Challenge was not accepted. Status: ${response.status}`
+				message: `Challenge was not accepted. Status: ${response.scaStatus}`
 			};
 		} catch (e) {
 			if (isRedirect(e)) throw e;

apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.svelte

@@ -25,6 +25,7 @@
 
 			<form method="post" class="space-y-4">
 				<input type="hidden" name="consentId" value={data.consentId} />
+				<input type="hidden" name="authorisationId" value={data.authorisationId} />
 
 				<div>
 					<label

apps/portal/src/routes/(protected)/otp/+page.server.ts

@@ -81,7 +81,7 @@ export const actions = {
 
 				// Step 1: Create authorisation
 				const authResponse = await obp_requests.post(
-					`/obp/v1.3/berlin-group/${paymentService}/${paymentProduct}/${paymentId}/authorisations`,
+					`/berlin-group/v1.3/${paymentService}/${paymentProduct}/${paymentId}/authorisations`,
 					{},
 					token
 				);
@@ -90,7 +90,7 @@ export const actions = {
 
 				// Step 2: Submit OTP to authorisation
 				await obp_requests.put(
-					`/obp/v1.3/berlin-group/${paymentService}/${paymentProduct}/${paymentId}/authorisations/${authorisationId}`,
+					`/berlin-group/v1.3/${paymentService}/${paymentProduct}/${paymentId}/authorisations/${authorisationId}`,
 					{ scaAuthenticationData: otp },
 					token
 				);

apps/portal/src/routes/(protected)/uk-consent-request-sca/+page.server.ts

@@ -18,20 +18,31 @@ export async function load(event: RequestEvent) {
 	const bankId = event.url.searchParams.get('bank_id');
 	const challengeId = event.url.searchParams.get('challenge_id');
 	const requestedOidcReturnUrl = event.url.searchParams.get('oidc_return_url');
+	// The accounts the PSU selected on /uk-consent-request, carried through as a comma-joined
+	// query param -- OBP-API's authorise endpoint requires account_ids in the final POST body.
+	const accountIds = event.url.searchParams.get('account_ids') || '';
 
 	if (!consentId || !bankId || !challengeId) {
 		return {
 			loadError: 'Missing required parameter (CONSENT_ID, bank_id or challenge_id).',
 			consentId: consentId || '',
 			bankId: bankId || '',
 			challengeId: challengeId || '',
-			oidcReturnUrl: ''
+			oidcReturnUrl: '',
+			accountIds: ''
 		};
 	}
 
 	const token = event.locals.session.data.oauth?.access_token;
 	if (!token) {
-		return { loadError: 'Unauthorized: No access token found in session.', consentId, bankId, challengeId, oidcReturnUrl: '' };
+		return {
+			loadError: 'Unauthorized: No access token found in session.',
+			consentId,
+			bankId,
+			challengeId,
+			oidcReturnUrl: '',
+			accountIds: ''
+		};
 	}
 
 	const oidcReturnUrl =
@@ -42,7 +53,7 @@ export async function load(event: RequestEvent) {
 		logger.warn(`Rejected untrusted oidc_return_url: ${requestedOidcReturnUrl}`);
 	}
 
-	return { consentId, bankId, challengeId, oidcReturnUrl };
+	return { consentId, bankId, challengeId, oidcReturnUrl, accountIds };
 }
 
 export const actions = {
@@ -53,10 +64,17 @@ export const actions = {
 		const bankId = formData.get('bankId') as string;
 		const challengeId = formData.get('challengeId') as string;
 		const oidcReturnUrlRaw = formData.get('oidcReturnUrl') as string;
+		const accountIds = ((formData.get('accountIds') as string) || '')
+			.split(',')
+			.map((id) => id.trim())
+			.filter(Boolean);
 
 		if (!otp) {
 			return { message: 'Please enter the OTP code.' };
 		}
+		if (accountIds.length === 0) {
+			return { message: 'No accounts were selected for this consent. Please start over.' };
+		}
 
 		const token = locals.session.data.oauth?.access_token;
 		if (!token) {
@@ -76,7 +94,7 @@ export const actions = {
 			// the PSU only if the challenge answer is correct; a wrong answer leaves it unauthorised.
 			await obp_requests.post(
 				`/obp/v5.1.0/banks/${bankId}/consents/${consentId}/authorise`,
-				{ challenge_id: challengeId, answer: otp },
+				{ challenge_id: challengeId, answer: otp, account_ids: accountIds },
 				token
 			);
 		} catch (e) {

apps/portal/src/routes/(protected)/uk-consent-request-sca/+page.svelte

@@ -40,6 +40,7 @@
 			<input type="hidden" name="bankId" value={data.bankId} />
 			<input type="hidden" name="challengeId" value={data.challengeId} />
 			<input type="hidden" name="oidcReturnUrl" value={data.oidcReturnUrl} />
+			<input type="hidden" name="accountIds" value={data.accountIds} />
 
 			<button type="submit" class="btn preset-filled-primary-500 w-full">
 				Verify &amp; Authorise

apps/portal/src/routes/(protected)/uk-consent-request/+page.server.ts

@@ -31,15 +31,33 @@ export async function load(event: RequestEvent) {
 	const requestedOidcReturnUrl = event.url.searchParams.get('oidc_return_url');
 
 	if (!consentId) {
-		return { loadError: 'Missing required parameter: CONSENT_ID.', consentId: '', bankId: bankId || '', apiStandard, oidcReturnUrl: '' };
+		return {
+			loadError: 'Missing required parameter: CONSENT_ID.',
+			consentId: '',
+			bankId: bankId || '',
+			apiStandard,
+			oidcReturnUrl: ''
+		};
 	}
 	if (!bankId) {
-		return { loadError: 'Missing required parameter: bank_id.', consentId, bankId: '', apiStandard, oidcReturnUrl: '' };
+		return {
+			loadError: 'Missing required parameter: bank_id.',
+			consentId,
+			bankId: '',
+			apiStandard,
+			oidcReturnUrl: ''
+		};
 	}
 
 	const token = event.locals.session.data.oauth?.access_token;
 	if (!token) {
-		return { loadError: 'Unauthorized: No access token found in session.', consentId, bankId, apiStandard, oidcReturnUrl: '' };
+		return {
+			loadError: 'Unauthorized: No access token found in session.',
+			consentId,
+			bankId,
+			apiStandard,
+			oidcReturnUrl: ''
+		};
 	}
 
 	// oidc_return_url must point back to a configured OIDC provider host — otherwise it becomes
@@ -69,7 +87,32 @@ export async function load(event: RequestEvent) {
 		logger.warn('Could not fetch UK consent details:', e);
 	}
 
-	return { consentId, bankId, apiStandard, oidcReturnUrl, status, permissions, expirationDateTime };
+	// The PSU must pick which of their own accounts this consent's permissions apply to --
+	// OBP-API only binds/grants access for accounts the authorising user actually holds
+	// (POST .../authorise requires account_ids, and rejects any account the PSU doesn't hold).
+	let userAccounts: { accountId: string; label: string }[] = [];
+	try {
+		const accountsResponse = await obp_requests.get('/obp/v6.0.0/my/accounts', token);
+		userAccounts = (accountsResponse.accounts || [])
+			.filter((account: any) => account.bank_id === bankId)
+			.map((account: any) => ({
+				accountId: account.id,
+				label: account.label || account.id
+			}));
+	} catch (e) {
+		logger.warn('Could not fetch user accounts:', e);
+	}
+
+	return {
+		consentId,
+		bankId,
+		apiStandard,
+		oidcReturnUrl,
+		status,
+		permissions,
+		expirationDateTime,
+		userAccounts
+	};
 }
 
 export const actions = {
@@ -78,6 +121,7 @@ export const actions = {
 		const consentId = formData.get('consentId') as string;
 		const bankId = formData.get('bankId') as string;
 		const oidcReturnUrlRaw = formData.get('oidcReturnUrl') as string;
+		const selectedAccountIds = formData.getAll('selectedAccountIds') as string[];
 
 		const token = locals.session.data.oauth?.access_token;
 		if (!token) {
@@ -94,6 +138,10 @@ export const actions = {
 			return { message: 'No valid return URL was provided to complete the flow.' };
 		}
 
+		if (selectedAccountIds.length === 0) {
+			return { message: 'Please select at least one account to grant access to.' };
+		}
+
 		let challengeId = '';
 		try {
 			// Start SCA: OBP-API issues a one-time challenge (OTP) to the PSU. The consent is only
@@ -117,7 +165,8 @@ export const actions = {
 			CONSENT_ID: consentId,
 			bank_id: bankId,
 			challenge_id: challengeId,
-			oidc_return_url: oidcReturnUrl
+			oidc_return_url: oidcReturnUrl,
+			account_ids: selectedAccountIds.join(',')
 		});
 		redirect(303, `/uk-consent-request-sca?${params.toString()}`);
 	},