@startuml

title PISP Linking: Authentication (Web)

participant "PISP" as PISP

box "Mojaloop"
    participant Switch
end box

participant "DFSP" as DFSP

autonumber 1 "<b>WEB-AUTH-#</b>"

...

note over PISP, DFSP
  Here the user goes through the web authentication process with their DFSP.
  The end result is a redirect back to the PISP with a special URL parameter with a secret provided by the DFSP.
end note

...

autonumber 1 "<b>AUTH-#</b>"

PISP -> Switch ++: ""PUT /consentRequests/456""\n\
    ""  FSIOP-Source: pispa""\n\
    ""  FSIOP-Destination: dfspa""\n\
""  {""\n\
    ""  initiatorId: "pispa",""\n\
    ""  authChannels: [ "Web", "OTP" ],""\n\
    ""  scopes: [ ""\n\
    ""    { accountId: "dfsp.username.1234",""\n\
    ""      actions: [ "accounts.transfer", "accounts.getBalance" ] },""\n\
    ""    { accountId: "dfsp.username.5678",""\n\
    ""      actions: [ "accounts.transfer", "accounts.getBalance" ] },""\n\
    ""  ],""\n\
    ""  callbackUri: "pisp-app://callback..."""\n\
    ""  authUri: "dfspa.com/authorize?consentRequestId=456",""\n\
    ""  **authToken: "<OTP or SECRET>" // This is new !**""\n\
    ""}""
Switch --> PISP: ""202 Accepted""
deactivate PISP

Switch -> DFSP ++: ""PUT /consentRequests/456""\n\
    ""  FSIOP-Source: pispa""\n\
    ""  FSIOP-Destination: dfspa""\n\
""  {""\n\
    ""  initiatorId: "pispa",""\n\
    ""  authChannels: [ "Web", "OTP" ],""\n\
    ""  scopes: [ ""\n\
    ""    { accountId: "dfsp.username.1234",""\n\
    ""      actions: [ "accounts.transfer", "accounts.getBalance" ] },""\n\
    ""    { accountId: "dfsp.username.5678",""\n\
    ""      actions: [ "accounts.transfer", "accounts.getBalance" ] },""\n\
    ""  ],""\n\
    ""  callbackUri: "pisp-app://callback..."""\n\
    ""  authUri: "dfspa.com/authorize?consentRequestId=456",""\n\
    ""  **authToken: "<OTP or SECRET>" // This is new !**""\n\
    ""}""
DFSP --> Switch: ""202 Accepted""
deactivate Switch

DFSP -> DFSP: Verify the auth token is correct.

note over PISP, DFSP
  At this point, the DFSP believes that the User is their customer and that User trusts the PISP. This means that the DFSP can continue by granting consent.

  Note that the DFSP never "responds" to the Consent Request itself. Instead, it will create a Consent resource in the Grant phase.
end note

@enduml
