my metrics and test for like for like field values across CallContext

and CallContextLight so they can never diverge.

Author: simonredfern

obp-api/src/main/scala/code/api/ResourceDocs1_4_0/SwaggerDefinitionsJSON.scala

@@ -3208,6 +3208,16 @@ object SwaggerDefinitionsJSON {
   lazy val metricsJsonV600 = MetricsJsonV600(
     metrics = List(metricJsonV600)
   )
+  lazy val aggregateMetricJsonV600 = AggregateMetricJsonV600(
+    count = 7076,
+    average_response_time = 65.21,
+    minimum_response_time = 1,
+    maximum_response_time = 9039,
+    distinct_user_count = 41,
+    distinct_consumer_count = 12,
+    consent_call_count = 1024,
+    distinct_consent_count = 9
+  )
 
   lazy val branchJsonPut = BranchJsonPutV210("gh.29.fi", "OBP",
     addressJsonV140,

obp-api/src/main/scala/code/api/util/ApiSession.scala

@@ -29,8 +29,25 @@ case class CallContext(
                         dauthRequestPayload: Option[JSONFactoryDAuth.PayloadOfJwtJSON] = None, //Never update these values inside the case class !!!
                         dauthResponseHeader: Option[String] = None,
                         spelling: Option[String] = None,
+                        // The AUTHENTICATED principal. Not always a person: under a consent this is the
+                        // consent's own shadow user. Stored data (metric rows, created_by_user_id columns)
+                        // always records this id — the human is resolved at read time via the consent table.
                         user: Box[User] = Empty,
+                        // The human who CREATED the consent this request runs under. Populated only by the
+                        // OBP-native consent path (applyConsentRulesCommon) from the consent JWT's
+                        // createdByUserId claim, resolved against the users table. For OBP-native consents
+                        // the creator is the granting human (they create their own consent in the Portal).
+                        // Not set by Berlin Group / UK flows, where the consent may be created by a TPP flow
+                        // with no human logged in — see `consenter` for those.
+                        // Read via humanUser / effectiveHumanUserId, where it takes precedence over consenter.
                         onBehalfOfUser: Box[User] = Empty,
+                        // The human (PSU) who AUTHORISED the consent this request runs under — the owner of
+                        // record, from the consent table's userId (bound by updateConsentUser during the
+                        // authorise ceremony). Populated by the Berlin Group and UK consent paths, whose
+                        // consents are created by TPP flows and only gain their human at authorisation.
+                        // The UK ownership check (checkUKConsent) compares the consent's userId against this.
+                        // In practice onBehalfOfUser and consenter are never both set: each consent standard
+                        // populates the one whose source is authoritative for it.
                         consenter: Box[User] = Empty,
                         consumer: Box[Consumer] = Empty,
                         ipAddress: String = "",
@@ -94,7 +111,9 @@ case class CallContext(
    * `user` is not always a person: a consent resolves to a shadow user that exists only for that
    * consent (Berlin Group, OBP-native, and -- since UK consents moved to the same model -- UK too).
    * Anything that must name a human rather than a principal reads this instead: the CBS adapter,
-   * which tells the core banking system who is asking, and metric attribution.
+   * which tells the core banking system who is asking, and the consent ownership checks.
+   * Stored data (metric rows included) always carries the authenticated principal; the human is
+   * resolved at read time via the consent table (see effectiveHumanUserId).
    */
   def humanUser: Box[User] = onBehalfOfUser.or(consenter).or(user)
 
@@ -159,12 +178,13 @@ case class CallContext(
     CallContextLight(
       gatewayLoginRequestPayload = this.gatewayLoginRequestPayload,
       gatewayLoginResponseHeader = this.gatewayLoginResponseHeader,
-      // Metrics name the human, not the principal. A consent's shadow user would record a per-consent
-      // UUID and an empty username, which is what Berlin Group and OBP-native traffic has always
-      // looked like on the metrics table; the consent itself stays identifiable via
-      // consentReferenceId below.
-      userId = this.humanUser.map(_.userId).toOption,
-      userName = this.humanUser.map(_.name).toOption,
+      // Like for like with CallContext: userId/userName are the AUTHENTICATED principal
+      // (CallContext.user), never a resolved human. Under a consent that principal is the
+      // consent's own shadow user (a per-consent UUID with an empty name) — the on-behalf-of
+      // human is not stored here but resolved at read time via the consent table
+      // (consentReferenceId below -> consent.userId), see CallContext.effectiveHumanUserId.
+      userId = this.user.map(_.userId).toOption,
+      userName = this.user.map(_.name).toOption,
       consumerId = this.consumer.map(_.consumerId.get).toOption,
       appName = this.consumer.map(_.name.get).toOption,
       developerEmail = this.consumer.map(_.developerEmail.get).toOption,

obp-api/src/main/scala/code/api/util/OBPParam.scala

@@ -70,6 +70,9 @@ case class OBPConsentReferenceId(value: String) extends OBPQueryParam
 // PeerTrust.Resolution.mode on the metric row: "direct", "forwarded" or "none".
 case class OBPCertificateTrust(value: String) extends OBPQueryParam
 case class OBPUserId(value: String) extends OBPQueryParam
+// Multiple user ids, matched with SQL IN — used by self-service endpoints that lock the
+// user filter to a server-resolved set (e.g. /my/metrics: the human plus their consent-agents).
+case class OBPUserIds(values: List[String]) extends OBPQueryParam
 case class ProviderProviderId(value: String) extends OBPQueryParam
 case class OBPStatus(value: String) extends OBPQueryParam
 case class OBPBankId(value: String) extends OBPQueryParam

obp-api/src/main/scala/code/api/v6_0_0/Http4s600.scala

@@ -666,10 +666,13 @@ object Http4s600 {
             }
             (obpQueryParams, callContext) <- createQueriesByHttpParamsFuture(
               APIMetrics.applyMetricsFromDateDefault(httpParams), cc.callContext)
-            aggregateMetrics <- APIMetrics.apiMetrics.vend.getAllAggregateMetricsFuture(obpQueryParams, false) map {
+            // isNewVersion = true: v6 is include_* style (exclude_* is rejected above). With
+            // false the include_app_names / include_url_patterns /
+            // include_implemented_by_partial_functions filters were silently ignored.
+            aggregateMetrics <- APIMetrics.apiMetrics.vend.getAllAggregateMetricsFuture(obpQueryParams, true) map {
               APIUtil.unboxFullOrFail(_, callContext, GetAggregateMetricsError)
             }
-          } yield JSONFactory300.createAggregateMetricJson(aggregateMetrics)
+          } yield JSONFactory600.createAggregateMetricJsonV600(aggregateMetrics)
         }
     }
 
@@ -7516,9 +7519,18 @@ object Http4s600 {
            |
            |15 http_status_code (if null ignore) - Filter by HTTP status code. eg: http_status_code=200 returns only successful calls, http_status_code=500 returns server errors
            |
+           |**Response fields added in v6.0.0:**
+           |
+           |- `distinct_user_count` - distinct humans behind the calls. Calls made under a Consent
+           |(e.g. by an agent or TPP) are attributed to the granting (on-behalf-of) user resolved via
+           |the consent table, not to the consent's technical shadow user. Anonymous calls are excluded.
+           |- `distinct_consumer_count` - distinct Consumers (apps) that made calls.
+           |- `consent_call_count` - calls that arrived under a Consent.
+           |- `distinct_consent_count` - distinct Consents exercised in the window.
+           |
         """.stripMargin,
         EmptyBody,
-        aggregateMetricsJSONV300,
+        aggregateMetricJsonV600,
         List(
           AuthenticatedUserIsRequired,
           UserHasMissingRoles,

obp-api/src/main/scala/code/api/v6_0_0/JSONFactory6.0.0.scala

@@ -479,6 +479,20 @@ case class MetricJsonV600(
 )
 case class MetricsJsonV600(metrics: List[MetricJsonV600])
 
+case class AggregateMetricJsonV600(
+    count: Int,
+    average_response_time: Double,
+    minimum_response_time: Double,
+    maximum_response_time: Double,
+    // Distinct humans: consent-borne calls are attributed to the granting (on-behalf-of)
+    // user via the consent table, not to the consent's technical shadow user.
+    distinct_user_count: Int,
+    distinct_consumer_count: Int,
+    // Calls made under a consent, and the number of distinct consents exercised.
+    consent_call_count: Int,
+    distinct_consent_count: Int
+)
+
 case class CacheNamespaceJsonV600(
     prefix: String,
     description: String,
@@ -1746,6 +1760,23 @@ object JSONFactory600 extends CustomJsonFormats with MdcLoggable {
     createMetricsJsonV600(metrics, lookupMap)
   }
 
+  // Same list shape as JSONFactory300.createAggregateMetricJson (a single-element array),
+  // extended with the distinct/consent counts introduced in v6.0.0.
+  def createAggregateMetricJsonV600(aggregateMetrics: List[code.metrics.AggregateMetrics]): List[AggregateMetricJsonV600] = {
+    aggregateMetrics.map(aggregateMetric =>
+      AggregateMetricJsonV600(
+        aggregateMetric.totalCount,
+        aggregateMetric.avgResponseTime,
+        aggregateMetric.minResponseTime,
+        aggregateMetric.maxResponseTime,
+        aggregateMetric.distinctUserCount,
+        aggregateMetric.distinctConsumerCount,
+        aggregateMetric.consentCallCount,
+        aggregateMetric.distinctConsentCount
+      )
+    )
+  }
+
   def createBankJSON600(
       bank: Bank,
       attributes: List[BankAttributeTrait] = Nil

obp-api/src/main/scala/code/api/v7_0_0/Http4s700.scala

@@ -1134,8 +1134,13 @@ object Http4s700 {
               cc = Some(cc)) {
               identityParams.isEmpty
             }
+            // "My" spans the delegation family: the human plus every agent user minted
+            // from a Consent they granted (metric rows record the authenticated principal,
+            // so an agent's calls sit under the agent's own user id). Resolve up to the
+            // human, then fan down — both via server-written columns only.
             (metrics, _) <- APIMetrics.getMetricsFromHttpParams(
-              httpParams, cc.callContext, lockedUserId = Some(user.userId))
+              httpParams, cc.callContext,
+              lockedUserIds = Some(humanAndAgentUserIds(cc.effectiveHumanUserId)))
           } yield JSONFactory600.createMetricsJsonV600(metrics)
         }
     }
@@ -1148,10 +1153,13 @@ object Http4s700 {
       "Get Metrics (My)",
       s"""Get the API metrics rows of the currently authenticated user — a record of each REST API call this user has made.
         |
-        |No role is required: this endpoint only ever returns the logged in user's own calls.
+        |No role is required: this endpoint only ever returns calls belonging to the logged in user —
+        |their own calls, plus calls made by agent users minted from Consents this user granted
+        |(e.g. an AI agent calling on their behalf). Called under such a Consent, it returns the
+        |same family of calls, resolved through the granting user.
         |The identity filter parameters accepted by `GET /management/metrics` (`user_id`, `username`, `email`,
         |`provider_provider_id`, `anon`) are NOT supported here and are rejected with an error —
-        |the user filter is always the current user.
+        |the user filter is always the current user's delegation family.
         |
         |**NOTE: Automatic from_date Default**
         |

obp-api/src/main/scala/code/metrics/APIMetrics.scala

@@ -52,22 +52,29 @@ object APIMetrics extends SimpleInjector {
 
   // One shared fetch path for metrics-reading endpoints: builds OBPQueryParams
   // from the http params (with the from_date default applied) and runs the query.
-  // lockedUserId pins the user filter server-side (for self-service endpoints
+  // lockedUserIds pins the user filter server-side (for self-service endpoints
   // like GET /my/metrics); when set it overrides anything in httpParams.
   def getMetricsFromHttpParams(
       httpParams: List[HTTPParam],
       callContext: Option[CallContext],
-      lockedUserId: Option[String] = None
+      lockedUserIds: Option[List[String]] = None
   ): Future[(List[APIMetric], Option[CallContext])] = {
-    val effectiveParams = lockedUserId match {
-      case Some(userId) =>
-        httpParams.filterNot(_.name == "user_id") :+ HTTPParam("user_id", List(userId))
+    // The lock replaces any caller-supplied user filter outright: the ids are
+    // server-resolved (e.g. the human plus their consent-agents for /my/metrics)
+    // and nothing from the request may widen or narrow them.
+    val effectiveParams = lockedUserIds match {
+      case Some(_) => httpParams.filterNot(_.name == "user_id")
       case None => httpParams
     }
     for {
       (obpQueryParams, cc) <- createQueriesByHttpParamsFuture(
         applyMetricsFromDateDefault(effectiveParams), callContext)
-      metrics <- Future(apiMetrics.vend.getAllMetrics(obpQueryParams))
+      lockedParams = lockedUserIds match {
+        case Some(userIds) =>
+          code.api.util.OBPUserIds(userIds) :: obpQueryParams.filterNot(_.isInstanceOf[code.api.util.OBPUserId])
+        case None => obpQueryParams
+      }
+      metrics <- Future(apiMetrics.vend.getAllMetrics(lockedParams))
     } yield (metrics, cc)
   }
 
@@ -194,7 +201,15 @@ case class AggregateMetrics(
   totalCount: Int,
   avgResponseTime: Double,
   minResponseTime: Double,
-  maxResponseTime: Double
+  maxResponseTime: Double,
+  // Distinct humans behind the calls: consent-borne rows are attributed to the granting
+  // (on-behalf-of) user via the consent table, mirroring CallContext.effectiveHumanUserId.
+  distinctUserCount: Int,
+  distinctConsumerCount: Int,
+  // Calls that arrived under a consent (metric.consent_reference_id not null), and how many
+  // distinct consents were exercised in the window.
+  consentCallCount: Int,
+  distinctConsentCount: Int
 )
 
 case class TopApi(

obp-api/src/main/scala/code/metrics/DoobieMetricsQueries.scala

@@ -67,23 +67,35 @@ object DoobieMetricsQueries {
     val toTs = new java.sql.Timestamp(toDate.getTime)
 
     // Build dynamic WHERE conditions
+    // Consent-borne calls are attributed to the granting (on-behalf-of) human via the consent
+    // table (COALESCE below) — see MappedMetrics.getAllAggregateMetricsBox for the rationale.
+    // The consent side of the join is unique-indexed on consent_reference_id (no row fan-out).
     val baseQuery = fr"""
-      SELECT count(*), avg(duration), min(duration), max(duration)
-      FROM metric
+      SELECT count(*), avg(duration), min(duration), max(duration),
+        count(DISTINCT CASE WHEN COALESCE(c.muserid, m.userid) <> 'null' THEN COALESCE(c.muserid, m.userid) END),
+        count(DISTINCT CASE WHEN m.consumerid <> '' AND m.consumerid <> 'null' THEN m.consumerid END),
+        count(NULLIF(m.consent_reference_id, '')),
+        count(DISTINCT NULLIF(m.consent_reference_id, ''))
+      FROM metric m
+      LEFT JOIN mappedconsent c ON m.consent_reference_id = c.consent_reference_id
       WHERE date_c >= $fromTs
         AND date_c <= $toTs
     """
 
     val conditions = buildFilterConditions(filters, isNewVersion)
     val fullQuery = baseQuery ++ conditions
 
-    fullQuery.query[(Long, Option[Double], Option[Double], Option[Double])].to[List].map { rows =>
-      rows.map { case (count, avgOpt, minOpt, maxOpt) =>
+    fullQuery.query[(Long, Option[Double], Option[Double], Option[Double], Long, Long, Long, Long)].to[List].map { rows =>
+      rows.map { case (count, avgOpt, minOpt, maxOpt, distinctUsers, distinctConsumers, consentCalls, distinctConsents) =>
         AggregateMetrics(
           count.toInt,
           avgOpt.map(d => BigDecimal(d).setScale(2, BigDecimal.RoundingMode.HALF_UP).toDouble).getOrElse(0.0),
           minOpt.getOrElse(0.0),
-          maxOpt.getOrElse(0.0)
+          maxOpt.getOrElse(0.0),
+          distinctUsers.toInt,
+          distinctConsumers.toInt,
+          consentCalls.toInt,
+          distinctConsents.toInt
         )
       }
     }