@startuml

title PISP Linking: Request consent (OTP)

participant "PISP" as PISP

box "Mojaloop"
    participant Switch
end box

participant DFSP
participant DFSPAuthorizeSimulator

autonumber 1 "<b>REQ-#</b>"

activate PISP

...

note over PISP, DFSP
    The user initiated some sort of account linking by choosing the appropriate DFSP from a screen inside the PISP application.
end note

...

PISP -> Switch ++: ""POST /consentRequests""\n\
  ""  FSIOP-Source: pispa""\n\
  ""  FSIOP-Destination: dfspa""\n\
""{""\n\
  ""  consentRequestId: "456",""\n\
  ""  **userId: "username1234", //so the dfsp can associate this request with GET /accounts/**""\n\
  ""  scopes: [ ""\n\
  ""    { **accountId: "dfsp.username.1234", // Required for OTP!**""\n\
  ""      actions: [ "accounts.transfer", "accounts.getBalance" ] },""\n\
  ""    { accountId: "dfsp.username.5678",""\n\
  ""      actions: [ "accounts.transfer", "accounts.getBalance" ] },""\n\
  ""  ],""\n\
  ""  authChannels: [ "Web", "OTP" ],""\n\
  ""  callbackUri: "pisp-app://callback..."""\n\
  ""}""
Switch --> PISP: ""202 Accepted""
deactivate PISP

Switch -> DFSP ++:  ""POST /consentRequests""\n\
  ""  FSIOP-Source: pispa""\n\
  ""  FSIOP-Destination: dfspa""\n\
""{""\n\
  ""  consentRequestId: "456",""\n\
  ""  userId: "username1234",""\n\
  ""  scopes: [ ""\n\
  ""    { accountId: "dfsp.username.1234",""\n\
  ""      actions: [ "accounts.transfer", "accounts.getBalance" ] },""\n\
  ""    { accountId: "dfsp.username.5678",""\n\
  ""      actions: [ "accounts.transfer", "accounts.getBalance" ] },""\n\
  ""  ],""\n\
  ""  authChannels: [ "Web", "OTP" ],""\n\
  ""  callbackUri: "pisp-app://callback..."""\n\
  ""}""
DFSP --> Switch: ""202 Accepted""
deactivate Switch

autonumber 1 "<b>DFSP-#</b>"

DFSP -> DFSP: Verify the consentRequest is valid or not?
autonumber 1 "<b>SIM-#</b>"

DFSP -> DFSPAuthorizeSimulator : ""POST /sendOTP""\n\
  ""{""\n\
  ""  consentRequestId: "456",""\n\
  ""  username:"username.1234", ""\n\
  ""  message: "0987" ""\n\
  ""}""

DFSPAuthorizeSimulator -> DFSPAuthorizeSimulator: take action on **TTK defined rule for username**
DFSPAuthorizeSimulator -> DFSP: 201 OK
autonumber 5 "<b>REQ-#</b>"
DFSP -> Switch ++: ""PUT /consentRequests/456""\n\
  ""  FSIOP-Source: dfspa""\n\
  ""  FSIOP-Destination: pispa""\n\
"" {""\n\
  ""  **authChannels: [ "OTP" ], // This is updated with the channel in use**""\n\
  ""  scopes: [ ""\n\
  ""    { accountId: "dfsp.username.1234",""\n\
  ""      actions: [ "accounts.transfer", "accounts.getBalance" ] },""\n\
  ""    { accountId: "dfsp.username.5678",""\n\
  ""      actions: [ "accounts.transfer", "accounts.getBalance" ] },""\n\
  ""  ],""\n\
  ""  callbackUri: "pisp-app://callback..."""\n\
  ""  **//note: no authUri for OTP flow**""\n\
  ""}""
Switch --> DFSP: ""202 Accepted""

note over PISP, DFSP
  Here, the DFSP sends an OTP directly to the user (e.g., via SMS).
end note

deactivate DFSP

Switch -> PISP: ""PUT /consentRequests/456""\n\
  ""  FSIOP-Source: dfspa""\n\
  ""  FSIOP-Destination: pispa""\n\
""{""\n\
  ""  **authChannels: [ "OTP" ], // This is updated with the channel in use**""\n\
  ""  scopes: [ ""\n\
  ""    { accountId: "dfsp.username.1234",""\n\
  ""      actions: [ "accounts.transfer", "accounts.getBalance" ] },""\n\
  ""    { accountId: "dfsp.username.5678",""\n\
  ""      actions: [ "accounts.transfer", "accounts.getBalance" ] },""\n\
  ""  ],""\n\
  ""  callbackUri: "pisp-app://callback..."""\n\
  ""  **//note: no authUri for OTP flow**""\n\
  ""}""
PISP --> Switch: ""202 Accepted""
deactivate Switch

note over PISP, DFSP
  At this point, the PISP knows that the OTP authChannel is in use and the PISP App should prompt the user to provide the OTP.
end note

@enduml
