@redacto.io/consent-sdk-react-native 5.0.0-beta.0 → 5.0.0-beta.10

package/README.md

@@ -64,6 +64,81 @@ pnpm add @tanstack/react-query i18next react-i18next dayjs \
 
 > **Note:** `react-native-svg` must be linked for native builds. Follow the [react-native-svg setup guide](https://github.com/software-mansion/react-native-svg#installation).
 
+## Sandbox Mode (No Backend Required)
+
+Sandbox mode lets you build and test a full consent PoC — **notice → Privacy Center → DSAR** — straight from your app, with **no backend and no token minting**. Instead of your server generating a JWT, you paste a **static sandbox token** into the SDK. Everything you create is recorded as test data, isolated from your live records.
+
+Going live is a config swap, not a rewrite: drop the sandbox props and pass a real JWT (see [Backend Server Setup](#backend-server-setup)).
+
+### 1. Get your sandbox credentials
+
+In the **Redacto Dashboard → API Keys → Sandbox** tab, copy:
+
+- your **Sandbox token** (a static string; it never expires and needs no refresh)
+- your **Organization ID** and **Workspace ID** (shown under *Workspace identifiers* on the same page)
+
+### 2. Collect consent
+
+Pass the sandbox `token`, org/workspace, and a test identity (`email`, `mobile`, or `ucic`). No `accessToken` is needed:
+
+```tsx
+import { RedactoNoticeConsent } from "@redacto.io/consent-sdk-react-native";
+
+<RedactoNoticeConsent
+  noticeId={NOTICE_UUID}
+  token={SANDBOX_TOKEN}
+  organisationUuid={ORG_UUID}
+  workspaceUuid={WORKSPACE_UUID}
+  email="test.user@example.com" // or `mobile`, or `ucic`
+  onAccept={() => console.log("consent recorded (test)")}
+  onDecline={() => {}}
+/>;
+```
+
+### 3. Manage consent & raise a DSAR
+
+Point the Privacy Center at the same sandbox token and test identity. The same test user can now review the consent from step 2, withdraw it, and file a DSAR — end to end, all as test data:
+
+```tsx
+import { RedactoPrivacyCenter } from "@redacto.io/consent-sdk-react-native/privacy-center";
+
+<RedactoPrivacyCenter
+  baseUrl={BASE_URL}
+  slug="acme-co"
+  token={SANDBOX_TOKEN}
+  organisationUuid={ORG_UUID}
+  workspaceUuid={WORKSPACE_UUID}
+  email="test.user@example.com" // or `mobile`, or `ucic`
+  onError={(error) => {
+    console.error(error);
+    return false;
+  }}
+/>;
+```
+
+### Sandbox props
+
+Both `RedactoNoticeConsent` and `RedactoPrivacyCenter` accept the same sandbox props:
+
+| Prop                        | Required     | Description                                                                          |
+| --------------------------- | ------------ | ----------------------------------------------------------------------------------- |
+| `token`                     | Yes          | Static sandbox token from the Dashboard. Its presence activates sandbox mode.        |
+| `organisationUuid`          | Yes          | Organization ID from the Dashboard.                                                 |
+| `workspaceUuid`             | Yes          | Workspace ID from the Dashboard.                                                    |
+| `email` / `mobile` / `ucic` | One required | The test subject. Precedence when more than one is set: `ucic` > `email` > `mobile`. |
+
+### How it works
+
+- The SDK sends the sandbox token as an `X-Consent-Token` header and the test identity inside each request (query params on reads, body on writes) — no JWT decode, no token refresh (a `401` fails fast).
+- The server records everything under `environment=test`, namespaced so sandbox data never mixes with — or reads — your live records.
+- Sandbox always talks to the consent server; it never routes to the Go ledger.
+
+### Going live
+
+Sandbox and production use the same components. To ship, remove the sandbox props and pass a real `accessToken` / `refreshToken` (JWT) minted by your backend — see [Backend Server Setup](#backend-server-setup) below. New records are then written as `environment=live`.
+
+> Sandbox is available on `RedactoNoticeConsent` and `RedactoPrivacyCenter`. The inline widget (`RedactoNoticeConsentInline`) is JWT-only.
+
 ## Backend Server Setup
 
 The SDK never talks to Redacto with your CMS API key directly — your backend acts as a token broker. Obtain your **CMS-API-Key** from the Redacto Dashboard, store it in your backend's environment, and expose two endpoints to your mobile app:
@@ -136,6 +211,7 @@ import { RedactoNoticeConsent } from "@redacto.io/consent-sdk-react-native";
 | `accessToken`               | `string`                      | ✓        | JWT access token                                         |
 | `refreshToken`              | `string`                      | ✓        | JWT refresh token                                        |
 | `baseUrl`                   | `string`                      |          | Override API base URL                                    |
+| `ledgerBaseUrl`             | `string`                      |          | Go ledger base URL. When set, consent writes and prior-consent checks route through the ledger (falls back: ledger → baseUrl → default). Omit to keep the legacy consent-server path. |
 | `settings`                  | `Partial<Settings>`           |          | UI customisation (colours, border radius, fonts)         |
 | `language`                  | `string`                      |          | Initial language code (e.g. `"en"`)                      |
 | `blockUI`                   | `boolean`                     |          | Block the modal from being dismissed                     |
@@ -173,6 +249,7 @@ import { RedactoNoticeConsentInline } from "@redacto.io/consent-sdk-react-native
 | `notice_uuid`        | `string`                     | ✓        | Notice UUID                                       |
 | `accessToken`        | `string`                     |          | JWT access token (triggers auto-submit when set)  |
 | `baseUrl`            | `string`                     |          | Override API base URL                             |
+| `ledgerBaseUrl`      | `string`                     |          | Go ledger base URL. When set, consent writes and already-consented checks route through the ledger. Omit for legacy behavior. |
 | `language`           | `string`                     |          | Language code                                     |
 | `settings`           | `Partial<Settings>`          |          | UI customisation                                  |
 | `applicationId`      | `string`                     |          | Application-specific UUID                         |
@@ -217,6 +294,7 @@ import { RedactoPrivacyCenter } from "@redacto.io/consent-sdk-react-native/priva
 | Prop           | Type                                                                          | Required | Default              | Description                              |
 | -------------- | ----------------------------------------------------------------------------- | -------- | -------------------- | ---------------------------------------- |
 | `baseUrl`      | `string`                                                                      | ✓        | -                    | Consent server base URL                  |
+| `ledgerBaseUrl` | `string`                                                                     |          | -                    | Go ledger base URL. When set, user consents, group purposes, receipts, and manage-consent route through the ledger. Omit to use the legacy `/dsar/privacy-center/*` routes. See the note below on the DSAR form picker. |
 | `slug`         | `string`                                                                      | ✓        | -                    | Workspace slug                           |
 | `accessToken`  | `string`                                                                      | ✓        | -                    | JWT access token                         |
 | `refreshToken` | `string`                                                                      | ✓        | -                    | JWT refresh token                        |
@@ -274,6 +352,18 @@ For consumers who want fully custom UI, the headless core exposes the API client
 - Keep API keys and server secrets on your backend only.
 - In Expo apps, values read from `EXPO_PUBLIC_*` are bundled into the app and should only contain non-sensitive config like UUIDs and URLs.
 - If you do not pass `baseUrl`, the SDK defaults to `https://api.redacto.io/consent` for both notice and Privacy Center surfaces.
+- `ledgerBaseUrl` is optional and independent of `baseUrl` — pass both when routing consent through the Go ledger. Omitting it keeps the legacy consent-server behavior.
+
+## Ledger mode
+
+Passing `ledgerBaseUrl` routes consent-bearing reads and writes to the Go ledger:
+
+- **Notice components** — `submit-consent` goes to the ledger, and the already-consented check uses the ledger's `check-consent` endpoint instead of the legacy HTTP 409 signal. Notice content, tokens, and TTS always stay on `baseUrl`.
+- **Privacy Center** — user consents, group purposes, receipts (including the `/download` PDF path), and manage-consent (sent as a `partial: true` write) route to the ledger. DSAR form, cases, activities, OTP, and notifications stay on `baseUrl`.
+
+Every ledger read degrades to the legacy path on failure, so a ledger outage does not break the consent flow.
+
+> **Known limitation.** Unlike the React SDK, the DSAR form's product picker is **not** overlaid from ledger-served consents. Against a workspace cut over to the ledger — where the legacy `form/data` response carries no product groups — the picker renders empty. If your DSAR form depends on the product picker, stay on the legacy path until this is addressed.
 
 ## License
 

package/dist/chunk-B2TXWC2C.mjs

@@ -0,0 +1,60 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/shared/languages.ts
+var languageOptions = [
+  { value: "en", label: "English" },
+  { value: "hi", label: "\u0939\u093F\u0928\u094D\u0926\u0940 (Hindi)" },
+  { value: "te", label: "\u0C24\u0C46\u0C32\u0C41\u0C17\u0C41 (Telugu)" },
+  { value: "mr", label: "\u092E\u0930\u093E\u0920\u0940 (Marathi)" },
+  { value: "ta", label: "\u0BA4\u0BAE\u0BBF\u0BB4\u0BCD (Tamil)" },
+  { value: "ur", label: "\u0627\u0631\u062F\u0648 (Urdu)" },
+  { value: "gu", label: "\u0A97\u0AC1\u0A9C\u0AB0\u0ABE\u0AA4\u0AC0 (Gujarati)" },
+  { value: "kn", label: "\u0C95\u0CA8\u0CCD\u0CA8\u0CA1 (Kannada)" },
+  { value: "ml", label: "\u0D2E\u0D32\u0D2F\u0D3E\u0D33\u0D02 (Malayalam)" },
+  { value: "pa", label: "\u0A2A\u0A70\u0A1C\u0A3E\u0A2C\u0A40 (Punjabi)" },
+  { value: "or", label: "\u0B13\u0B21\u0B3C\u0B3F\u0B06 (Odia)" },
+  { value: "as", label: "\u0985\u09B8\u09AE\u09C0\u09AF\u09BC\u09BE (Assamese)" },
+  { value: "bn", label: "\u09AC\u09BE\u0982\u09B2\u09BE (Bengali)" },
+  { value: "mai", label: "\u092E\u0948\u0925\u093F\u0932\u0940 (Maithili)" },
+  { value: "ne", label: "\u0928\u0947\u092A\u093E\u0932\u0940 (Nepali)" },
+  { value: "sd", label: "\u0633\u0646\u068C\u064A (Sindhi)" },
+  { value: "doi", label: "\u0921\u094B\u0917\u0930\u0940 (Dogri)" },
+  { value: "mni-Mtei", label: "\uABC3\uABE9\uABC7\uABE9\uABC2\uABE3\uABDF (Manipuri)" },
+  { value: "gom", label: "\u0915\u094B\u0902\u0915\u0923\u0940 (Goan Konkani)" },
+  { value: "sa", label: "\u0938\u0902\u0938\u094D\u0915\u0943\u0924\u092E\u094D (Sanskrit)" },
+  { value: "brx", label: "\u092C\u0921\u093C\u094B (Bodo)" },
+  { value: "ks", label: "\u0643\u0672\u0634\u064F\u0631 (Kashmiri)" },
+  { value: "sat", label: "\u1C65\u1C5F\u1C71\u1C5B\u1C5F\u1C72\u1C64 (Santali)" }
+];
+var codeByLabel = new Map(languageOptions.map((o) => [o.label, o.value]));
+var codeByLower = new Map(languageOptions.map((o) => [o.value.toLowerCase(), o.value]));
+var englishName = (label) => {
+  var _a, _b;
+  return (_b = (_a = label.match(/\(([^)]+)\)\s*$/)) == null ? void 0 : _a[1]) != null ? _b : label;
+};
+var codeByName = new Map(
+  languageOptions.map((o) => [englishName(o.label).toLowerCase(), o.value])
+);
+function toLanguageCode(lang) {
+  var _a, _b, _c;
+  if (!lang) return void 0;
+  const trimmed = lang.trim();
+  if (!trimmed) return void 0;
+  const lower = trimmed.toLowerCase();
+  return (_c = (_b = (_a = codeByLabel.get(trimmed)) != null ? _a : codeByName.get(lower)) != null ? _b : codeByLower.get(lower)) != null ? _c : trimmed;
+}
+
+// src/shared/sandbox.ts
+var SANDBOX_TOKEN_HEADER = "X-Consent-Token";
+
+export {
+  __require,
+  SANDBOX_TOKEN_HEADER,
+  languageOptions,
+  toLanguageCode
+};

package/dist/index.d.mts

@@ -28,8 +28,34 @@ type Settings$1 = {
 
 type Props$1 = Readonly<{
     noticeId: string;
-    accessToken: string;
-    refreshToken: string;
+    /**
+     * JWT access token. Optional so sandbox integrations (see `token`) can
+     * omit it. Required in the normal JWT flow.
+     */
+    accessToken?: string;
+    /** JWT refresh token. Optional; accepted for source-compat, currently unused. */
+    refreshToken?: string;
+    /**
+     * Sandbox PoC: a pasted static token. When set, the SDK runs against the
+     * sandbox with no JWT — it sends the single `X-Consent-Token` header, carries
+     * the acting identity (`email` || `mobile` || `ucic`) in each request's own
+     * payload, takes org/workspace from `organisationUuid`/`workspaceUuid`, and
+     * does no token refresh.
+     */
+    token?: string;
+    /** Sandbox test subject email (carried in the request payload when set). */
+    email?: string;
+    /** Sandbox test subject mobile (fallback subject when `email` is absent). */
+    mobile?: string;
+    /**
+     * Sandbox UCIC: the client's own user id / org_user_id, e.g. a UUID or
+     * customer code; optional third identifier alongside email/mobile.
+     */
+    ucic?: string;
+    /** Sandbox org UUID (replaces the JWT-decoded org in sandbox mode). */
+    organisationUuid?: string;
+    /** Sandbox workspace UUID (replaces the JWT-decoded workspace in sandbox mode). */
+    workspaceUuid?: string;
     baseUrl?: string;
     /** Go ledger base URL — serves check-consent and the consent write; omit to use the legacy consent server. */
     ledgerBaseUrl?: string;

package/dist/index.d.ts

@@ -28,8 +28,34 @@ type Settings$1 = {
 
 type Props$1 = Readonly<{
     noticeId: string;
-    accessToken: string;
-    refreshToken: string;
+    /**
+     * JWT access token. Optional so sandbox integrations (see `token`) can
+     * omit it. Required in the normal JWT flow.
+     */
+    accessToken?: string;
+    /** JWT refresh token. Optional; accepted for source-compat, currently unused. */
+    refreshToken?: string;
+    /**
+     * Sandbox PoC: a pasted static token. When set, the SDK runs against the
+     * sandbox with no JWT — it sends the single `X-Consent-Token` header, carries
+     * the acting identity (`email` || `mobile` || `ucic`) in each request's own
+     * payload, takes org/workspace from `organisationUuid`/`workspaceUuid`, and
+     * does no token refresh.
+     */
+    token?: string;
+    /** Sandbox test subject email (carried in the request payload when set). */
+    email?: string;
+    /** Sandbox test subject mobile (fallback subject when `email` is absent). */
+    mobile?: string;
+    /**
+     * Sandbox UCIC: the client's own user id / org_user_id, e.g. a UUID or
+     * customer code; optional third identifier alongside email/mobile.
+     */
+    ucic?: string;
+    /** Sandbox org UUID (replaces the JWT-decoded org in sandbox mode). */
+    organisationUuid?: string;
+    /** Sandbox workspace UUID (replaces the JWT-decoded workspace in sandbox mode). */
+    workspaceUuid?: string;
     baseUrl?: string;
     /** Go ledger base URL — serves check-consent and the consent write; omit to use the legacy consent server. */
     ledgerBaseUrl?: string;