@redacto.io/consent-sdk-react-native 5.0.0-beta.1 → 5.0.0-beta.11

package/README.md

@@ -64,6 +64,81 @@ pnpm add @tanstack/react-query i18next react-i18next dayjs \
 
 > **Note:** `react-native-svg` must be linked for native builds. Follow the [react-native-svg setup guide](https://github.com/software-mansion/react-native-svg#installation).
 
+## Sandbox Mode (No Backend Required)
+
+Sandbox mode lets you build and test a full consent PoC — **notice → Privacy Center → DSAR** — straight from your app, with **no backend and no token minting**. Instead of your server generating a JWT, you paste a **static sandbox token** into the SDK. Everything you create is recorded as test data, isolated from your live records.
+
+Going live is a config swap, not a rewrite: drop the sandbox props and pass a real JWT (see [Backend Server Setup](#backend-server-setup)).
+
+### 1. Get your sandbox credentials
+
+In the **Redacto Dashboard → API Keys → Sandbox** tab, copy:
+
+- your **Sandbox token** (a static string; it never expires and needs no refresh)
+- your **Organization ID** and **Workspace ID** (shown under *Workspace identifiers* on the same page)
+
+### 2. Collect consent
+
+Pass the sandbox `token`, org/workspace, and a test identity (`email`, `mobile`, or `ucic`). No `accessToken` is needed:
+
+```tsx
+import { RedactoNoticeConsent } from "@redacto.io/consent-sdk-react-native";
+
+<RedactoNoticeConsent
+  noticeId={NOTICE_UUID}
+  token={SANDBOX_TOKEN}
+  organisationUuid={ORG_UUID}
+  workspaceUuid={WORKSPACE_UUID}
+  email="test.user@example.com" // or `mobile`, or `ucic`
+  onAccept={() => console.log("consent recorded (test)")}
+  onDecline={() => {}}
+/>;
+```
+
+### 3. Manage consent & raise a DSAR
+
+Point the Privacy Center at the same sandbox token and test identity. The same test user can now review the consent from step 2, withdraw it, and file a DSAR — end to end, all as test data:
+
+```tsx
+import { RedactoPrivacyCenter } from "@redacto.io/consent-sdk-react-native/privacy-center";
+
+<RedactoPrivacyCenter
+  baseUrl={BASE_URL}
+  slug="acme-co"
+  token={SANDBOX_TOKEN}
+  organisationUuid={ORG_UUID}
+  workspaceUuid={WORKSPACE_UUID}
+  email="test.user@example.com" // or `mobile`, or `ucic`
+  onError={(error) => {
+    console.error(error);
+    return false;
+  }}
+/>;
+```
+
+### Sandbox props
+
+Both `RedactoNoticeConsent` and `RedactoPrivacyCenter` accept the same sandbox props:
+
+| Prop                        | Required     | Description                                                                          |
+| --------------------------- | ------------ | ----------------------------------------------------------------------------------- |
+| `token`                     | Yes          | Static sandbox token from the Dashboard. Its presence activates sandbox mode.        |
+| `organisationUuid`          | Yes          | Organization ID from the Dashboard.                                                 |
+| `workspaceUuid`             | Yes          | Workspace ID from the Dashboard.                                                    |
+| `email` / `mobile` / `ucic` | One required | The test subject. Precedence when more than one is set: `ucic` > `email` > `mobile`. |
+
+### How it works
+
+- The SDK sends the sandbox token as an `X-Consent-Token` header and the test identity inside each request (query params on reads, body on writes) — no JWT decode, no token refresh (a `401` fails fast).
+- The server records everything under `environment=test`, namespaced so sandbox data never mixes with — or reads — your live records.
+- Sandbox always talks to the consent server; it never routes to the Go ledger.
+
+### Going live
+
+Sandbox and production use the same components. To ship, remove the sandbox props and pass a real `accessToken` / `refreshToken` (JWT) minted by your backend — see [Backend Server Setup](#backend-server-setup) below. New records are then written as `environment=live`.
+
+> Sandbox is available on `RedactoNoticeConsent` and `RedactoPrivacyCenter`. The inline widget (`RedactoNoticeConsentInline`) is JWT-only.
+
 ## Backend Server Setup
 
 The SDK never talks to Redacto with your CMS API key directly — your backend acts as a token broker. Obtain your **CMS-API-Key** from the Redacto Dashboard, store it in your backend's environment, and expose two endpoints to your mobile app:

package/dist/chunk-B2TXWC2C.mjs

@@ -0,0 +1,60 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/shared/languages.ts
+var languageOptions = [
+  { value: "en", label: "English" },
+  { value: "hi", label: "\u0939\u093F\u0928\u094D\u0926\u0940 (Hindi)" },
+  { value: "te", label: "\u0C24\u0C46\u0C32\u0C41\u0C17\u0C41 (Telugu)" },
+  { value: "mr", label: "\u092E\u0930\u093E\u0920\u0940 (Marathi)" },
+  { value: "ta", label: "\u0BA4\u0BAE\u0BBF\u0BB4\u0BCD (Tamil)" },
+  { value: "ur", label: "\u0627\u0631\u062F\u0648 (Urdu)" },
+  { value: "gu", label: "\u0A97\u0AC1\u0A9C\u0AB0\u0ABE\u0AA4\u0AC0 (Gujarati)" },
+  { value: "kn", label: "\u0C95\u0CA8\u0CCD\u0CA8\u0CA1 (Kannada)" },
+  { value: "ml", label: "\u0D2E\u0D32\u0D2F\u0D3E\u0D33\u0D02 (Malayalam)" },
+  { value: "pa", label: "\u0A2A\u0A70\u0A1C\u0A3E\u0A2C\u0A40 (Punjabi)" },
+  { value: "or", label: "\u0B13\u0B21\u0B3C\u0B3F\u0B06 (Odia)" },
+  { value: "as", label: "\u0985\u09B8\u09AE\u09C0\u09AF\u09BC\u09BE (Assamese)" },
+  { value: "bn", label: "\u09AC\u09BE\u0982\u09B2\u09BE (Bengali)" },
+  { value: "mai", label: "\u092E\u0948\u0925\u093F\u0932\u0940 (Maithili)" },
+  { value: "ne", label: "\u0928\u0947\u092A\u093E\u0932\u0940 (Nepali)" },
+  { value: "sd", label: "\u0633\u0646\u068C\u064A (Sindhi)" },
+  { value: "doi", label: "\u0921\u094B\u0917\u0930\u0940 (Dogri)" },
+  { value: "mni-Mtei", label: "\uABC3\uABE9\uABC7\uABE9\uABC2\uABE3\uABDF (Manipuri)" },
+  { value: "gom", label: "\u0915\u094B\u0902\u0915\u0923\u0940 (Goan Konkani)" },
+  { value: "sa", label: "\u0938\u0902\u0938\u094D\u0915\u0943\u0924\u092E\u094D (Sanskrit)" },
+  { value: "brx", label: "\u092C\u0921\u093C\u094B (Bodo)" },
+  { value: "ks", label: "\u0643\u0672\u0634\u064F\u0631 (Kashmiri)" },
+  { value: "sat", label: "\u1C65\u1C5F\u1C71\u1C5B\u1C5F\u1C72\u1C64 (Santali)" }
+];
+var codeByLabel = new Map(languageOptions.map((o) => [o.label, o.value]));
+var codeByLower = new Map(languageOptions.map((o) => [o.value.toLowerCase(), o.value]));
+var englishName = (label) => {
+  var _a, _b;
+  return (_b = (_a = label.match(/\(([^)]+)\)\s*$/)) == null ? void 0 : _a[1]) != null ? _b : label;
+};
+var codeByName = new Map(
+  languageOptions.map((o) => [englishName(o.label).toLowerCase(), o.value])
+);
+function toLanguageCode(lang) {
+  var _a, _b, _c;
+  if (!lang) return void 0;
+  const trimmed = lang.trim();
+  if (!trimmed) return void 0;
+  const lower = trimmed.toLowerCase();
+  return (_c = (_b = (_a = codeByLabel.get(trimmed)) != null ? _a : codeByName.get(lower)) != null ? _b : codeByLower.get(lower)) != null ? _c : trimmed;
+}
+
+// src/shared/sandbox.ts
+var SANDBOX_TOKEN_HEADER = "X-Consent-Token";
+
+export {
+  __require,
+  SANDBOX_TOKEN_HEADER,
+  languageOptions,
+  toLanguageCode
+};

package/dist/index.d.mts

@@ -28,8 +28,34 @@ type Settings$1 = {
 
 type Props$1 = Readonly<{
     noticeId: string;
-    accessToken: string;
-    refreshToken: string;
+    /**
+     * JWT access token. Optional so sandbox integrations (see `token`) can
+     * omit it. Required in the normal JWT flow.
+     */
+    accessToken?: string;
+    /** JWT refresh token. Optional; accepted for source-compat, currently unused. */
+    refreshToken?: string;
+    /**
+     * Sandbox PoC: a pasted static token. When set, the SDK runs against the
+     * sandbox with no JWT — it sends the single `X-Consent-Token` header, carries
+     * the acting identity (`email` || `mobile` || `ucic`) in each request's own
+     * payload, takes org/workspace from `organisationUuid`/`workspaceUuid`, and
+     * does no token refresh.
+     */
+    token?: string;
+    /** Sandbox test subject email (carried in the request payload when set). */
+    email?: string;
+    /** Sandbox test subject mobile (fallback subject when `email` is absent). */
+    mobile?: string;
+    /**
+     * Sandbox UCIC: the client's own user id / org_user_id, e.g. a UUID or
+     * customer code; optional third identifier alongside email/mobile.
+     */
+    ucic?: string;
+    /** Sandbox org UUID (replaces the JWT-decoded org in sandbox mode). */
+    organisationUuid?: string;
+    /** Sandbox workspace UUID (replaces the JWT-decoded workspace in sandbox mode). */
+    workspaceUuid?: string;
     baseUrl?: string;
     /** Go ledger base URL — serves check-consent and the consent write; omit to use the legacy consent server. */
     ledgerBaseUrl?: string;

package/dist/index.d.ts

@@ -28,8 +28,34 @@ type Settings$1 = {
 
 type Props$1 = Readonly<{
     noticeId: string;
-    accessToken: string;
-    refreshToken: string;
+    /**
+     * JWT access token. Optional so sandbox integrations (see `token`) can
+     * omit it. Required in the normal JWT flow.
+     */
+    accessToken?: string;
+    /** JWT refresh token. Optional; accepted for source-compat, currently unused. */
+    refreshToken?: string;
+    /**
+     * Sandbox PoC: a pasted static token. When set, the SDK runs against the
+     * sandbox with no JWT — it sends the single `X-Consent-Token` header, carries
+     * the acting identity (`email` || `mobile` || `ucic`) in each request's own
+     * payload, takes org/workspace from `organisationUuid`/`workspaceUuid`, and
+     * does no token refresh.
+     */
+    token?: string;
+    /** Sandbox test subject email (carried in the request payload when set). */
+    email?: string;
+    /** Sandbox test subject mobile (fallback subject when `email` is absent). */
+    mobile?: string;
+    /**
+     * Sandbox UCIC: the client's own user id / org_user_id, e.g. a UUID or
+     * customer code; optional third identifier alongside email/mobile.
+     */
+    ucic?: string;
+    /** Sandbox org UUID (replaces the JWT-decoded org in sandbox mode). */
+    organisationUuid?: string;
+    /** Sandbox workspace UUID (replaces the JWT-decoded workspace in sandbox mode). */
+    workspaceUuid?: string;
     baseUrl?: string;
     /** Go ledger base URL — serves check-consent and the consent write; omit to use the legacy consent server. */
     ledgerBaseUrl?: string;