Remove obsolete Consent hashing code

[kayjoosten]

In pr #1137 we have made a stable solution for hashing the consent. This was needed as users sometimes would get asked to give consent even tho nothing changed.

Too make it backwards compatible we made a new column where the new hashes are safed for that reason.

After sometime the code should be dead and not used anymore. This is why we should remove it from the codebase and only support he new stable hashes

[kayjoosten]

@baszoetekouw here is the cleanup ticket

[kayjoosten]

Cleanup Checklist — What to Remove

Once all existing consent rows have been migrated to attribute_stable (i.e. attribute IS NULL for all active rows), the entire backwards-compatibility layer can be dropped. Here is the full list of what to remove.

Monitoring: After PR #1137 is deployed, rows are migrated on the next login. You can track progress with:

-- Rows still using the old hash (not yet migrated)
SELECT COUNT(*) FROM consent WHERE attribute IS NOT NULL AND deleted_at IS NULL;
-- Rows fully migrated to stable hash
SELECT COUNT(*) FROM consent WHERE attribute IS NULL AND deleted_at IS NULL;

When the first query returns 0, migration is complete and the cleanup below can proceed.

---

Database

• Drop column attribute from the consent table (new migration: ALTER TABLE consent DROP COLUMN attribute)
• migrations/DoctrineMigrations/Version20220503092351.php — can be deleted once all installs have run it; no longer needed after column is dropped

---

Entity

• src/OpenConext/EngineBlockBundle/Authentication/Entity/Consent.php — remove the attribute property (lines 55–60 area), remove its ORM column annotation

---

Repository

src/OpenConext/EngineBlockBundle/Authentication/Repository/DbalConsentRepository.php:

• updateConsentHash() — entire method can be removed (no more upgrade queries needed)
• hasConsentHash() — simplify SELECT/WHERE: remove OR attribute = ? from the query and reduce `` from 5 to 4 entries; return type can be simplified to bool
• findAllFor() — remove attribute from SELECT; simplify ['attribute_stable'] ?? ['attribute'] → ['attribute_stable']

src/OpenConext/EngineBlock/Authentication/Repository/ConsentRepository.php (interface):

• updateConsentHash() method declaration

---

Service layer

src/OpenConext/EngineBlock/Service/Consent/ConsentHashService.php:

• getUnstableAttributesHash() method
• updateConsentHash() delegate method

src/OpenConext/EngineBlock/Service/Consent/ConsentHashServiceInterface.php:

• updateConsentHash() method declaration
• Consider removing getUnstableAttributesHash() declaration too

---

Value object

src/OpenConext/EngineBlock/Authentication/Value/ConsentVersion.php:

• UNSTABLE constant
• unstable() named constructor
• isUnstable() method
• (Optional) simplify the entire class to a bool, or remove it if hasConsentHash is changed to return bool

---

Legacy model

library/EngineBlock/Corto/Model/Consent.php:

• upgradeAttributeHashFor() method (lines ~95–190)
• The unstable hash generation call on line ~148 (getUnstableAttributesHash)

library/EngineBlock/Corto/Module/Service/ProcessConsent.php:

• $consentRepository->upgradeAttributeHashFor(...) call (line ~106) and its enclosing if (ConsentVersion::unstable) branch

library/EngineBlock/Corto/Module/Service/ProvideConsent.php:

• Both $consentRepository->upgradeAttributeHashFor(...) calls (lines ~153, ~172) and their branches

---

Tests to remove

• ConsentIntegrationTest::test_upgrade_not_applied_when_no_consent_given
• ConsentIntegrationTest::test_upgrade_continues_gracefully_when_attributes_changed
• ConsentTest::testUpgradeAttributeHashSkippedWhenConsentDisabled
• ConsentVersionTest — the isUnstable() assertion and unstable() constructor case
• Any test mocking updateConsentHash or getUnstableAttributesHash

---

New migration needed for the cleanup

-- In a new Version file, e.g. Version20260210000001.php
ALTER TABLE consent DROP COLUMN attribute;

Also update migrations/DoctrineMigrations/Version20260210000000.php (fresh-install baseline) to not include the attribute column at all.