From 1ae483d5d91737f76820a1b4186b96b2158f17b8 Mon Sep 17 00:00:00 2001
From: Shubham Patil <shubham.patil@espressif.com>
Date: Wed, 2 Feb 2022 21:59:00 +0530
Subject: [PATCH] OTA-Provider: Implementation for obtaining user consent
 (#13816)

* ota-provider: Implementation for obtaining user consent

* ota-provider: Support for user consent in linux app

* Added an API SourceNodeId() in CommandHandler

Using PRIu16 for logging endpoint and ChipLogFormatX64/ChipLogValueX64
for logging Node Id.

Use Clock::Seconds32 insetead of Clock::Milliseconds32

* Modified the UserConsent delegate and added default implementation

UserConsent is not a SHALL so, using it when its available.
Default implementation returns true by default, also added APIs to grant
and revoke the UserConsent.

* Do not crash if it's a group session

* Keep supporting query behaviour option and set DelayedActionTime in Busy
and NotAvailable Case

* restyled

* Fixing error after resolving merge conflict

* Remove unnecessary chip:: resolution usage

* Use GetSubjectDescriptor() to get SourceNodeId

* Addressed review comments

* minor changes

* Addressed review comments and removed per subject handling, for now
supporting only global user consent poliy.
---
 examples/ota-provider-app/linux/main.cpp      |  45 +++-
 .../ota-provider-common/BUILD.gn              |   3 +
 .../DefaultUserConsentProvider.cpp            |  51 +++++
 .../DefaultUserConsentProvider.h              |  62 ++++++
 .../OTAProviderExample.cpp                    | 192 +++++++++++-------
 .../ota-provider-common/OTAProviderExample.h  |   9 +
 .../ota-provider-common/UserConsentDelegate.h |  93 +++++++++
 src/app/CommandHandler.h                      |   2 +
 8 files changed, 380 insertions(+), 77 deletions(-)
 create mode 100644 examples/ota-provider-app/ota-provider-common/DefaultUserConsentProvider.cpp
 create mode 100644 examples/ota-provider-app/ota-provider-common/DefaultUserConsentProvider.h
 create mode 100644 examples/ota-provider-app/ota-provider-common/UserConsentDelegate.h

diff --git a/examples/ota-provider-app/linux/main.cpp b/examples/ota-provider-app/linux/main.cpp
index 641c06ed0..349acd5bd 100644
--- a/examples/ota-provider-app/linux/main.cpp
+++ b/examples/ota-provider-app/linux/main.cpp
@@ -30,8 +30,8 @@
 #include <lib/support/CHIPArgParser.hpp>
 #include <lib/support/CHIPMem.h>
 #include <lib/support/logging/CHIPLogging.h>
-
 #include <ota-provider-common/BdxOtaSender.h>
+#include <ota-provider-common/DefaultUserConsentProvider.h>
 #include <ota-provider-common/OTAProviderExample.h>
 
 #include <fstream>
@@ -54,12 +54,14 @@ constexpr uint16_t kOptionFilepath             = 'f';
 constexpr uint16_t kOptionOtaImageList         = 'o';
 constexpr uint16_t kOptionQueryImageBehavior   = 'q';
 constexpr uint16_t kOptionDelayedActionTimeSec = 'd';
+constexpr uint16_t kOptionUserConsent          = 'u';
 
 // Global variables used for passing the CLI arguments to the OTAProviderExample object
-static OTAProviderExample::QueryImageBehaviorType gQueryImageBehavior = OTAProviderExample::kRespondWithUpdateAvailable;
+static OTAProviderExample::QueryImageBehaviorType gQueryImageBehavior = OTAProviderExample::kRespondWithUnknown;
 static uint32_t gDelayedActionTimeSec                                 = 0;
 static const char * gOtaFilepath                                      = nullptr;
 static const char * gOtaImageListFilepath                             = nullptr;
+static chip::ota::UserConsentState gUserConsentState                  = chip::ota::UserConsentState::kUnknown;
 
 // Parses the JSON filepath and extracts DeviceSoftwareVersionModel parameters
 static bool ParseJsonFileAndPopulateCandidates(const char * filepath,
@@ -183,6 +185,30 @@ bool HandleOptions(const char * aProgram, OptionSet * aOptions, int aIdentifier,
     case kOptionDelayedActionTimeSec:
         gDelayedActionTimeSec = static_cast<uint32_t>(strtol(aValue, NULL, 0));
         break;
+    case kOptionUserConsent:
+        if (aValue == NULL)
+        {
+            PrintArgError("%s: ERROR: NULL UserConsent parameter\n", aProgram);
+            retval = false;
+        }
+        else if (strcmp(aValue, "granted") == 0)
+        {
+            gUserConsentState = chip::ota::UserConsentState::kGranted;
+        }
+        else if (strcmp(aValue, "denied") == 0)
+        {
+            gUserConsentState = chip::ota::UserConsentState::kDenied;
+        }
+        else if (strcmp(aValue, "deferred") == 0)
+        {
+            gUserConsentState = chip::ota::UserConsentState::kObtaining;
+        }
+        else
+        {
+            PrintArgError("%s: ERROR: Invalid UserConsent parameter:  %s\n", aProgram, aValue);
+            retval = false;
+        }
+        break;
     default:
         PrintArgError("%s: INTERNAL ERROR: Unhandled option: %s\n", aProgram, aName);
         retval = false;
@@ -197,6 +223,7 @@ OptionDef cmdLineOptionsDef[] = {
     { "otaImageList", chip::ArgParser::kArgumentRequired, kOptionOtaImageList },
     { "QueryImageBehavior", chip::ArgParser::kArgumentRequired, kOptionQueryImageBehavior },
     { "DelayedActionTimeSec", chip::ArgParser::kArgumentRequired, kOptionDelayedActionTimeSec },
+    { "UserConsent", chip::ArgParser::kArgumentRequired, kOptionUserConsent },
     {},
 };
 
@@ -209,7 +236,12 @@ OptionSet cmdLineOptions = { HandleOptions, cmdLineOptionsDef, "PROGRAM OPTIONS"
                              "        Status value in the Query Image Response\n"
                              "  -d/--DelayedActionTimeSec <time>\n"
                              "        Value in seconds for the DelayedActionTime in the Query Image Response\n"
-                             "        and Apply Update Response\n" };
+                             "        and Apply Update Response\n"
+                             "  -u/--UserConsent <granted | denied | deferred>\n"
+                             "        granted: Status value in QueryImageResponse is set to UpdateAvailable\n"
+                             "        denied: Status value in QueryImageResponse is set to UpdateNotAvailable\n"
+                             "        deferred: Status value in QueryImageResponse is set to Busy\n"
+                             "        -q/--QueryImageBehavior overrides this option\n" };
 
 HelpOptions helpOptions("ota-provider-app", "Usage: ota-provider-app [options]", "1.0");
 
@@ -219,6 +251,7 @@ int main(int argc, char * argv[])
 {
     CHIP_ERROR err = CHIP_NO_ERROR;
     OTAProviderExample otaProvider;
+    chip::ota::DefaultUserConsentProvider userConsentProvider;
 
     if (chip::Platform::MemoryInit() != CHIP_NO_ERROR)
     {
@@ -263,6 +296,12 @@ int main(int argc, char * argv[])
     otaProvider.SetQueryImageBehavior(gQueryImageBehavior);
     otaProvider.SetDelayedActionTimeSec(gDelayedActionTimeSec);
 
+    if (gUserConsentState != chip::ota::UserConsentState::kUnknown)
+    {
+        userConsentProvider.SetGlobalUserConsentState(gUserConsentState);
+        otaProvider.SetUserConsentDelegate(&userConsentProvider);
+    }
+
     ChipLogDetail(SoftwareUpdate, "Using ImageList file: %s", gOtaImageListFilepath ? gOtaImageListFilepath : "(none)");
 
     if (gOtaImageListFilepath != nullptr)
diff --git a/examples/ota-provider-app/ota-provider-common/BUILD.gn b/examples/ota-provider-app/ota-provider-common/BUILD.gn
index 63c5f2d1d..f8f154bfa 100644
--- a/examples/ota-provider-app/ota-provider-common/BUILD.gn
+++ b/examples/ota-provider-app/ota-provider-common/BUILD.gn
@@ -29,8 +29,11 @@ chip_data_model("ota-provider-common") {
   sources = [
     "BdxOtaSender.cpp",
     "BdxOtaSender.h",
+    "DefaultUserConsentProvider.cpp",
+    "DefaultUserConsentProvider.h",
     "OTAProviderExample.cpp",
     "OTAProviderExample.h",
+    "UserConsentDelegate.h",
   ]
 
   deps = [ "${chip_root}/src/protocols/bdx" ]
diff --git a/examples/ota-provider-app/ota-provider-common/DefaultUserConsentProvider.cpp b/examples/ota-provider-app/ota-provider-common/DefaultUserConsentProvider.cpp
new file mode 100644
index 000000000..8a804a82f
--- /dev/null
+++ b/examples/ota-provider-app/ota-provider-common/DefaultUserConsentProvider.cpp
@@ -0,0 +1,51 @@
+/*
+ *
+ *    Copyright (c) 2022 Project CHIP Authors
+ *    All rights reserved.
+ *
+ *    Licensed under the Apache License, Version 2.0 (the "License");
+ *    you may not use this file except in compliance with the License.
+ *    You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *    Unless required by applicable law or agreed to in writing, software
+ *    distributed under the License is distributed on an "AS IS" BASIS,
+ *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *    See the License for the specific language governing permissions and
+ *    limitations under the License.
+ */
+#include <lib/support/logging/CHIPLogging.h>
+#include <ota-provider-common/DefaultUserConsentProvider.h>
+
+namespace chip {
+namespace ota {
+
+void DefaultUserConsentProvider::LogUserConsentSubject(const UserConsentSubject & subject)
+{
+    ChipLogDetail(SoftwareUpdate, "User consent request for:");
+    ChipLogDetail(SoftwareUpdate, ":  FabricIndex: %" PRIu8, subject.fabricIndex);
+    ChipLogDetail(SoftwareUpdate, ":  RequestorNodeId: " ChipLogFormatX64, ChipLogValueX64(subject.requestorNodeId));
+    ChipLogDetail(SoftwareUpdate, ":  ProviderEndpointId: %" PRIu16, subject.providerEndpointId);
+    ChipLogDetail(SoftwareUpdate, ":  RequestorVendorId: %" PRIu16, subject.requestorVendorId);
+    ChipLogDetail(SoftwareUpdate, ":  RequestorProductId: %" PRIu16, subject.requestorProductId);
+    ChipLogDetail(SoftwareUpdate, ":  RequestorCurrentVersion: %" PRIu32, subject.requestorCurrentVersion);
+    ChipLogDetail(SoftwareUpdate, ":  RequestorTargetVersion: %" PRIu32, subject.requestorTargetVersion);
+    ChipLogDetail(SoftwareUpdate, ":  Metadata:");
+    ChipLogByteSpan(SoftwareUpdate, subject.metadata);
+}
+
+UserConsentState DefaultUserConsentProvider::GetUserConsentState(const UserConsentSubject & subject)
+{
+    LogUserConsentSubject(subject);
+
+    if (mUseGlobalConsent)
+    {
+        return mGlobalConsentState;
+    }
+
+    return UserConsentState::kGranted;
+}
+
+} // namespace ota
+} // namespace chip
diff --git a/examples/ota-provider-app/ota-provider-common/DefaultUserConsentProvider.h b/examples/ota-provider-app/ota-provider-common/DefaultUserConsentProvider.h
new file mode 100644
index 000000000..fc9e467c8
--- /dev/null
+++ b/examples/ota-provider-app/ota-provider-common/DefaultUserConsentProvider.h
@@ -0,0 +1,62 @@
+/*
+ *
+ *    Copyright (c) 2022 Project CHIP Authors
+ *    All rights reserved.
+ *
+ *    Licensed under the Apache License, Version 2.0 (the "License");
+ *    you may not use this file except in compliance with the License.
+ *    You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *    Unless required by applicable law or agreed to in writing, software
+ *    distributed under the License is distributed on an "AS IS" BASIS,
+ *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *    See the License for the specific language governing permissions and
+ *    limitations under the License.
+ */
+#pragma once
+
+#include <lib/core/CHIPError.h>
+#include <ota-provider-common/UserConsentDelegate.h>
+
+namespace chip {
+namespace ota {
+
+class DefaultUserConsentProvider : public UserConsentDelegate
+{
+public:
+    DefaultUserConsentProvider() = default;
+
+    ~DefaultUserConsentProvider() = default;
+
+    // This method returns kGranted unless explicitly denied by the user by calling RevokeUserConsent()
+    UserConsentState GetUserConsentState(const UserConsentSubject & subject) override;
+
+    // If this is set to true, all the user consent requests will be replied with global consent.
+    void SetGlobalUserConsentState(UserConsentState state)
+    {
+        mUseGlobalConsent   = true;
+        mGlobalConsentState = state;
+    }
+
+    // state is only valid if isGlobalConsentSet is true
+    void GetGlobalUserConsentState(bool & isGlobalConsentSet, UserConsentState & state)
+    {
+        isGlobalConsentSet = mUseGlobalConsent;
+        state              = mGlobalConsentState;
+    }
+
+    // Clear the global user consent state
+    void ClearGlobalUserConsentState() { mUseGlobalConsent = false; }
+
+private:
+    bool mUseGlobalConsent = false;
+
+    UserConsentState mGlobalConsentState = UserConsentState::kGranted;
+
+    void LogUserConsentSubject(const UserConsentSubject & subject);
+};
+
+} // namespace ota
+} // namespace chip
diff --git a/examples/ota-provider-app/ota-provider-common/OTAProviderExample.cpp b/examples/ota-provider-app/ota-provider-common/OTAProviderExample.cpp
index ab4193842..6e8f83b81 100644
--- a/examples/ota-provider-app/ota-provider-common/OTAProviderExample.cpp
+++ b/examples/ota-provider-app/ota-provider-common/OTAProviderExample.cpp
@@ -43,12 +43,15 @@ using chip::Server;
 using chip::Span;
 using chip::app::Clusters::OTAProviderDelegate;
 using chip::bdx::TransferControlFlags;
+using namespace chip;
+using namespace chip::ota;
 using namespace chip::app::Clusters::OtaSoftwareUpdateProvider;
 using namespace chip::app::Clusters::OtaSoftwareUpdateProvider::Commands;
 
-constexpr uint8_t kUpdateTokenLen    = 32;                      // must be between 8 and 32
-constexpr uint8_t kUpdateTokenStrLen = kUpdateTokenLen * 2 + 1; // Hex string needs 2 hex chars for every byte
-constexpr size_t kUriMaxLen          = 256;
+constexpr uint8_t kUpdateTokenLen            = 32;                      // must be between 8 and 32
+constexpr uint8_t kUpdateTokenStrLen         = kUpdateTokenLen * 2 + 1; // Hex string needs 2 hex chars for every byte
+constexpr size_t kUriMaxLen                  = 256;
+constexpr uint32_t kMinimumDelayedActionTime = 120; // Spec mentions delayed action time should be at least 120 seconds
 
 // Arbitrary BDX Transfer Params
 constexpr uint32_t kMaxBdxBlockSize                 = 1024;
@@ -125,51 +128,117 @@ bool OTAProviderExample::SelectOTACandidate(const uint16_t requestorVendorID, co
     return candidateFound;
 }
 
+UserConsentSubject OTAProviderExample::GetUserConsentSubject(const app::CommandHandler * commandObj,
+                                                             const app::ConcreteCommandPath & commandPath,
+                                                             const QueryImage::DecodableType & commandData, uint32_t targetVersion)
+{
+    UserConsentSubject subject;
+    subject.fabricIndex             = commandObj->GetSubjectDescriptor().fabricIndex;
+    subject.requestorNodeId         = commandObj->GetSubjectDescriptor().subject;
+    subject.providerEndpointId      = commandPath.mEndpointId;
+    subject.requestorVendorId       = commandData.vendorId;
+    subject.requestorProductId      = commandData.productId;
+    subject.requestorCurrentVersion = commandData.softwareVersion;
+    subject.requestorTargetVersion  = targetVersion;
+    if (commandData.metadataForProvider.HasValue())
+    {
+        subject.metadata = commandData.metadataForProvider.Value();
+    }
+    return subject;
+}
+
 EmberAfStatus OTAProviderExample::HandleQueryImage(chip::app::CommandHandler * commandObj,
                                                    const chip::app::ConcreteCommandPath & commandPath,
                                                    const QueryImage::DecodableType & commandData)
 {
-    // TODO: add confiuration for returning BUSY status
-
     OTAQueryStatus queryStatus = OTAQueryStatus::kNotAvailable;
     OTAProviderExample::DeviceSoftwareVersionModel candidate;
-    bool otaAvailable                     = false;
     uint32_t newSoftwareVersion           = 0;
     const char * newSoftwareVersionString = nullptr;
     const char * otaFilePath              = nullptr;
-    bool userConsentNeeded                = false;
     uint8_t updateToken[kUpdateTokenLen]  = { 0 };
     char strBuf[kUpdateTokenStrLen]       = { 0 };
     char uriBuf[kUriMaxLen]               = { 0 };
+    uint32_t delayedActionTimeSec         = mDelayedActionTimeSec;
+    bool requestorCanConsent              = commandData.requestorCanConsent.ValueOr(false);
+    QueryImageResponse::Type response;
 
-    // This use-case is a subset of the ota-candidates-file option.
-    // Can be removed once all other platforms (ESP, etc.)
-    // start using the ota-candidates-file method.
-    if (strlen(mOTAFilePath)) // If OTA file is directly provided
-    {
-        otaAvailable       = true;
-        newSoftwareVersion = commandData.softwareVersion + 1; // This implementation will always indicate that an update is
-                                                              // available (if the user provides a file).
-        newSoftwareVersionString = "Example-Image-V0.1";
-        otaFilePath              = mOTAFilePath;
-    }
-    else if (!mCandidates.empty()) // If list of OTA candidates is supplied instead
+    switch (mQueryImageBehavior)
     {
-        otaAvailable = SelectOTACandidate(commandData.vendorId, commandData.productId, commandData.softwareVersion, candidate);
-        if (otaAvailable)
+    case kRespondWithUnknown:
+        // This use-case is a subset of the ota-candidates-file option.
+        // Can be removed once all other platforms start using the ota-candidates-file method.
+        if (strlen(mOTAFilePath) > 0) // If OTA file is directly provided
         {
-            newSoftwareVersion       = candidate.softwareVersion;
-            newSoftwareVersionString = candidate.softwareVersionString;
-            otaFilePath              = candidate.otaURL;
+            // TODO: Following details shall be read from the OTA file
+            newSoftwareVersion = commandData.softwareVersion + 1; // This implementation will always indicate that an update is
+                                                                  // available (if the user provides a file).
+            newSoftwareVersionString = "Example-Image-V0.1";
+            otaFilePath              = mOTAFilePath;
+            queryStatus              = OTAQueryStatus::kUpdateAvailable;
+        }
+        else if (!mCandidates.empty()) // If list of OTA candidates is supplied instead
+        {
+            if (SelectOTACandidate(commandData.vendorId, commandData.productId, commandData.softwareVersion, candidate))
+            {
+                newSoftwareVersion       = candidate.softwareVersion;
+                newSoftwareVersionString = candidate.softwareVersionString;
+                otaFilePath              = candidate.otaURL;
+                queryStatus              = OTAQueryStatus::kUpdateAvailable;
+            }
         }
-    }
 
-    GenerateUpdateToken(updateToken, kUpdateTokenLen);
-    GetUpdateTokenString(ByteSpan(updateToken), strBuf, kUpdateTokenStrLen);
-    ChipLogDetail(SoftwareUpdate, "generated updateToken: %s", strBuf);
+        if (queryStatus == OTAQueryStatus::kUpdateAvailable && mUserConsentDelegate != nullptr)
+        {
+            UserConsentState state = mUserConsentDelegate->GetUserConsentState(
+                GetUserConsentSubject(commandObj, commandPath, commandData, newSoftwareVersion));
+            ChipLogProgress(SoftwareUpdate, "User Consent state: %s", mUserConsentDelegate->UserConsentStateToString(state));
+            switch (state)
+            {
+            case UserConsentState::kGranted:
+                queryStatus = OTAQueryStatus::kUpdateAvailable;
+                break;
+
+            case UserConsentState::kObtaining:
+                queryStatus          = OTAQueryStatus::kBusy;
+                delayedActionTimeSec = std::max(kMinimumDelayedActionTime, delayedActionTimeSec);
+                break;
+
+            case UserConsentState::kDenied:
+            case UserConsentState::kUnknown:
+                queryStatus          = OTAQueryStatus::kNotAvailable;
+                delayedActionTimeSec = std::max(kMinimumDelayedActionTime, delayedActionTimeSec);
+                break;
+            }
+        }
+        break;
+
+    case kRespondWithUpdateAvailable:
+        queryStatus = OTAQueryStatus::kUpdateAvailable;
+        break;
 
-    if (otaAvailable)
+    case kRespondWithBusy:
+        queryStatus          = OTAQueryStatus::kBusy;
+        delayedActionTimeSec = std::max(kMinimumDelayedActionTime, delayedActionTimeSec);
+        break;
+
+    case kRespondWithNotAvailable:
+        queryStatus          = OTAQueryStatus::kNotAvailable;
+        delayedActionTimeSec = std::max(kMinimumDelayedActionTime, delayedActionTimeSec);
+        break;
+
+    default:
+        queryStatus          = OTAQueryStatus::kNotAvailable;
+        delayedActionTimeSec = std::max(kMinimumDelayedActionTime, delayedActionTimeSec);
+        break;
+    }
+
+    if (queryStatus == OTAQueryStatus::kUpdateAvailable)
     {
+        GenerateUpdateToken(updateToken, kUpdateTokenLen);
+        GetUpdateTokenString(ByteSpan(updateToken), strBuf, kUpdateTokenStrLen);
+        ChipLogDetail(SoftwareUpdate, "generated updateToken: %s", strBuf);
+
         // TODO: This uses the current node as the provider to supply the OTA image. This can be configurable such that the provider
         // supplying the response is not the provider supplying the OTA image.
         FabricIndex fabricIndex = commandObj->GetAccessingFabricIndex();
@@ -178,62 +247,37 @@ EmberAfStatus OTAProviderExample::HandleQueryImage(chip::app::CommandHandler * c
 
         // Only doing BDX transport for now
         MutableCharSpan uri(uriBuf, kUriMaxLen);
-        chip::bdx::MakeURI(nodeId, CharSpan::fromCharString(mOTAFilePath), uri);
+        chip::bdx::MakeURI(nodeId, CharSpan::fromCharString(otaFilePath), uri);
         ChipLogDetail(SoftwareUpdate, "Generated URI: %.*s", static_cast<int>(uri.size()), uri.data());
-    }
 
-    // Set Status for the Query Image Response
-    switch (mQueryImageBehavior)
-    {
-    case kRespondWithUpdateAvailable: {
-        if (otaAvailable)
-        {
-            queryStatus = OTAQueryStatus::kUpdateAvailable;
-
-            // Initialize the transfer session in prepartion for a BDX transfer
-            mBdxOtaSender.SetFilepath(otaFilePath);
-            BitFlags<TransferControlFlags> bdxFlags;
-            bdxFlags.Set(TransferControlFlags::kReceiverDrive);
-            CHIP_ERROR err = mBdxOtaSender.PrepareForTransfer(&chip::DeviceLayer::SystemLayer(), chip::bdx::TransferRole::kSender,
-                                                              bdxFlags, kMaxBdxBlockSize, kBdxTimeout, kBdxPollFreq);
-            if (err != CHIP_NO_ERROR)
-            {
-                ChipLogError(BDX, "Failed to initialize BDX transfer session: %s", chip::ErrorStr(err));
-                return EMBER_ZCL_STATUS_FAILURE;
-            }
-        }
-        else
+        // Initialize the transfer session in prepartion for a BDX transfer
+        mBdxOtaSender.SetFilepath(otaFilePath);
+        BitFlags<TransferControlFlags> bdxFlags;
+        bdxFlags.Set(TransferControlFlags::kReceiverDrive);
+        CHIP_ERROR err = mBdxOtaSender.PrepareForTransfer(&chip::DeviceLayer::SystemLayer(), chip::bdx::TransferRole::kSender,
+                                                          bdxFlags, kMaxBdxBlockSize, kBdxTimeout, kBdxPollFreq);
+        if (err != CHIP_NO_ERROR)
         {
-            queryStatus = OTAQueryStatus::kNotAvailable;
-            ChipLogError(SoftwareUpdate, "No OTA file configured on the Provider");
+            ChipLogError(BDX, "Failed to initialize BDX transfer session: %s", chip::ErrorStr(err));
+            return EMBER_ZCL_STATUS_FAILURE;
         }
-        break;
-    }
-    case kRespondWithBusy: {
-        queryStatus = OTAQueryStatus::kBusy;
-        break;
-    }
-    case kRespondWithNotAvailable: {
-        queryStatus = OTAQueryStatus::kNotAvailable;
-        break;
-    }
-    default:
-        queryStatus = OTAQueryStatus::kNotAvailable;
-    }
 
-    QueryImageResponse::Type response;
-    response.status = queryStatus;
-    response.delayedActionTime.Emplace(mDelayedActionTimeSec);
-    if (queryStatus == OTAQueryStatus::kUpdateAvailable)
-    {
         response.imageURI.Emplace(chip::CharSpan::fromCharString(uriBuf));
         response.softwareVersion.Emplace(newSoftwareVersion);
         response.softwareVersionString.Emplace(chip::CharSpan::fromCharString(newSoftwareVersionString));
         response.updateToken.Emplace(chip::ByteSpan(updateToken));
-        response.userConsentNeeded.Emplace(userConsentNeeded);
-        // Could also just not send metadataForRequestor at all.
+    }
+
+    response.status = queryStatus;
+    response.delayedActionTime.Emplace(delayedActionTimeSec);
+    response.userConsentNeeded.Emplace(requestorCanConsent);
+
+    // For test coverage, sending empty metadata when (requestorNodeId % 2) == 0 and not sending otherwise.
+    if (commandObj->GetSubjectDescriptor().subject % 2 == 0)
+    {
         response.metadataForRequestor.Emplace(chip::ByteSpan());
     }
+
     VerifyOrReturnError(commandObj->AddResponseData(commandPath, response) == CHIP_NO_ERROR, EMBER_ZCL_STATUS_FAILURE);
     return EMBER_ZCL_STATUS_SUCCESS;
 }
diff --git a/examples/ota-provider-app/ota-provider-common/OTAProviderExample.h b/examples/ota-provider-app/ota-provider-common/OTAProviderExample.h
index 564a51995..0aee80471 100644
--- a/examples/ota-provider-app/ota-provider-common/OTAProviderExample.h
+++ b/examples/ota-provider-app/ota-provider-common/OTAProviderExample.h
@@ -21,6 +21,7 @@
 #include <app/CommandHandler.h>
 #include <app/clusters/ota-provider/ota-provider-delegate.h>
 #include <ota-provider-common/BdxOtaSender.h>
+#include <ota-provider-common/UserConsentDelegate.h>
 #include <vector>
 
 /**
@@ -47,6 +48,7 @@ class OTAProviderExample : public chip::app::Clusters::OTAProviderDelegate
 
     enum QueryImageBehaviorType
     {
+        kRespondWithUnknown,
         kRespondWithUpdateAvailable,
         kRespondWithBusy,
         kRespondWithNotAvailable
@@ -68,6 +70,7 @@ class OTAProviderExample : public chip::app::Clusters::OTAProviderDelegate
     void SetOTACandidates(std::vector<OTAProviderExample::DeviceSoftwareVersionModel> candidates);
     void SetQueryImageBehavior(QueryImageBehaviorType behavior) { mQueryImageBehavior = behavior; }
     void SetDelayedActionTimeSec(uint32_t time) { mDelayedActionTimeSec = time; }
+    void SetUserConsentDelegate(chip::ota::UserConsentDelegate * delegate) { mUserConsentDelegate = delegate; }
 
 private:
     BdxOtaSender mBdxOtaSender;
@@ -79,4 +82,10 @@ class OTAProviderExample : public chip::app::Clusters::OTAProviderDelegate
     bool SelectOTACandidate(const uint16_t requestorVendorID, const uint16_t requestorProductID,
                             const uint32_t requestorSoftwareVersion,
                             OTAProviderExample::DeviceSoftwareVersionModel & finalCandidate);
+    chip::ota::UserConsentDelegate * mUserConsentDelegate = nullptr;
+
+    chip::ota::UserConsentSubject
+    GetUserConsentSubject(const chip::app::CommandHandler * commandObj, const chip::app::ConcreteCommandPath & commandPath,
+                          const chip::app::Clusters::OtaSoftwareUpdateProvider::Commands::QueryImage::DecodableType & commandData,
+                          uint32_t targetVersion);
 };
diff --git a/examples/ota-provider-app/ota-provider-common/UserConsentDelegate.h b/examples/ota-provider-app/ota-provider-common/UserConsentDelegate.h
new file mode 100644
index 000000000..f34426a3d
--- /dev/null
+++ b/examples/ota-provider-app/ota-provider-common/UserConsentDelegate.h
@@ -0,0 +1,93 @@
+/*
+ *
+ *    Copyright (c) 2022 Project CHIP Authors
+ *    All rights reserved.
+ *
+ *    Licensed under the Apache License, Version 2.0 (the "License");
+ *    you may not use this file except in compliance with the License.
+ *    You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *    Unless required by applicable law or agreed to in writing, software
+ *    distributed under the License is distributed on an "AS IS" BASIS,
+ *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *    See the License for the specific language governing permissions and
+ *    limitations under the License.
+ */
+#pragma once
+#include <lib/core/DataModelTypes.h>
+#include <lib/core/NodeId.h>
+#include <lib/support/Span.h>
+
+namespace chip {
+namespace ota {
+
+enum UserConsentState
+{
+    // User consent is granted.
+    kGranted,
+    // Obtaining user consent is in progress, async implementations should return this state.
+    kObtaining,
+    // User consent is denied.
+    kDenied,
+    kUnknown,
+};
+
+/**
+ * @brief User consent subject contains the information of the OTA requestor
+ * that requires obtaining user consent for performing the OTA update.
+ */
+struct UserConsentSubject
+{
+    // Fabric Index
+    FabricIndex fabricIndex;
+
+    // Node ID of the OTA Requestor
+    NodeId requestorNodeId;
+
+    // Endpoint of the OTA Provider
+    EndpointId providerEndpointId;
+
+    // Vendor ID of the OTA Requestor
+    uint16_t requestorVendorId;
+
+    // Product ID of the OTA Requestor
+    uint16_t requestorProductId;
+
+    // Current software version of the OTA Requestor
+    uint32_t requestorCurrentVersion;
+
+    // Target software version available for the OTA Requestor
+    uint32_t requestorTargetVersion;
+
+    // This data is not owned by UserConsentSubject and therefore any user of this field
+    // has to copy the data and own it if not immediately used from an argument having a UserConsentSubject
+    ByteSpan metadata;
+};
+
+class UserConsentDelegate
+{
+public:
+    virtual ~UserConsentDelegate() = default;
+
+    virtual UserConsentState GetUserConsentState(const UserConsentSubject & subject) = 0;
+
+    const char * UserConsentStateToString(UserConsentState state)
+    {
+        switch (state)
+        {
+        case kGranted:
+            return "Granted";
+        case kObtaining:
+            return "Obtaining";
+        case kDenied:
+            return "Denied";
+        default:
+            return "Unknown";
+        }
+    }
+};
+
+} // namespace ota
+} // namespace chip
diff --git a/src/app/CommandHandler.h b/src/app/CommandHandler.h
index a8c0d6442..690bc6e10 100644
--- a/src/app/CommandHandler.h
+++ b/src/app/CommandHandler.h
@@ -193,6 +193,8 @@ class CommandHandler
      */
     Messaging::ExchangeContext * GetExchangeContext() const { return mpExchangeCtx; }
 
+    Access::SubjectDescriptor GetSubjectDescriptor() const { return mpExchangeCtx->GetSessionHandle()->GetSubjectDescriptor(); }
+
 private:
     friend class TestCommandInteraction;
     friend class CommandHandler::Handle;