@redacto.io/consent-sdk-react-native 5.0.0 → 5.0.1-beta.1

package/dist/privacy-center.d.mts

@@ -395,6 +395,8 @@ type ManageConsentParams = {
     dataElementUuids?: string[];
 };
 type Activity = {
+    /** Stable per-activity id (source event/case uuid) for list keys and de-duplication. */
+    id?: string;
     activity_type: string;
     activity_type_display?: string;
     timestamp: string;
@@ -691,8 +693,15 @@ declare function createConsentClient(baseUrl: string, ledgerBaseUrl?: string): {
     createOtp(organisationId: string, workspaceId: string, email: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<unknown>;
     /**
      * Verify OTP (public)
+     *
+     * Defaults to `purpose: "login"` — the branch the backend uses to mint an
+     * `auth`-scoped token (and to resolve shared-contact principals via the
+     * ledger). `purpose: "consent"` is reserved for consent flows. A login that
+     * omits the purpose falls back server-side to `purpose: "consent"`, which
+     * mints a scope-less notice token — every `/dsar/privacy-center/*` endpoint
+     * then rejects it with 403 "Token scope is not permitted".
      */
-    verifyOtp(organisationId: string, workspaceId: string, otpId: string, otp: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<unknown>;
+    verifyOtp(organisationId: string, workspaceId: string, otpId: string, otp: string, options?: Omit<ApiFetchOptions, "getAuthToken">, purpose?: "login" | "consent"): Promise<unknown>;
     /**
      * Exchange one-time token for JWT tokens (public)
      */
@@ -943,10 +952,12 @@ interface AuthProviderProps {
      * payload, and never calls `/otp/refresh`.
      */
     token?: string;
-    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence over the subject. */
+    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence for the principal. */
     sandboxUcic?: string;
-    /** Sandbox subject (email or mobile) — carried in the request payload. */
-    sandboxSubject?: string;
+    /** Sandbox email — carried on every request, like a live JWT's `user_data.primary_email`. */
+    sandboxEmail?: string;
+    /** Sandbox mobile — carried on every request, like a live JWT's `user_data.primary_mobile`. */
+    sandboxMobile?: string;
     /** Sandbox org UUID (replaces the JWT-decoded org). */
     organisationUuid?: string;
     /** Sandbox workspace UUID (replaces the JWT-decoded workspace). */

package/dist/privacy-center.d.ts

@@ -395,6 +395,8 @@ type ManageConsentParams = {
     dataElementUuids?: string[];
 };
 type Activity = {
+    /** Stable per-activity id (source event/case uuid) for list keys and de-duplication. */
+    id?: string;
     activity_type: string;
     activity_type_display?: string;
     timestamp: string;
@@ -691,8 +693,15 @@ declare function createConsentClient(baseUrl: string, ledgerBaseUrl?: string): {
     createOtp(organisationId: string, workspaceId: string, email: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<unknown>;
     /**
      * Verify OTP (public)
+     *
+     * Defaults to `purpose: "login"` — the branch the backend uses to mint an
+     * `auth`-scoped token (and to resolve shared-contact principals via the
+     * ledger). `purpose: "consent"` is reserved for consent flows. A login that
+     * omits the purpose falls back server-side to `purpose: "consent"`, which
+     * mints a scope-less notice token — every `/dsar/privacy-center/*` endpoint
+     * then rejects it with 403 "Token scope is not permitted".
      */
-    verifyOtp(organisationId: string, workspaceId: string, otpId: string, otp: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<unknown>;
+    verifyOtp(organisationId: string, workspaceId: string, otpId: string, otp: string, options?: Omit<ApiFetchOptions, "getAuthToken">, purpose?: "login" | "consent"): Promise<unknown>;
     /**
      * Exchange one-time token for JWT tokens (public)
      */
@@ -943,10 +952,12 @@ interface AuthProviderProps {
      * payload, and never calls `/otp/refresh`.
      */
     token?: string;
-    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence over the subject. */
+    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence for the principal. */
     sandboxUcic?: string;
-    /** Sandbox subject (email or mobile) — carried in the request payload. */
-    sandboxSubject?: string;
+    /** Sandbox email — carried on every request, like a live JWT's `user_data.primary_email`. */
+    sandboxEmail?: string;
+    /** Sandbox mobile — carried on every request, like a live JWT's `user_data.primary_mobile`. */
+    sandboxMobile?: string;
     /** Sandbox org UUID (replaces the JWT-decoded org). */
     organisationUuid?: string;
     /** Sandbox workspace UUID (replaces the JWT-decoded workspace). */

package/dist/privacy-center.js

@@ -10046,13 +10046,20 @@ var sandboxBodyIdentity = () => {
   if (!sandboxConfig) {
     return null;
   }
+  const payload = {};
   if (sandboxConfig.ucic) {
-    return { org_user_id: sandboxConfig.ucic };
+    payload.org_user_id = sandboxConfig.ucic;
   }
-  return sandboxConfig.subject.includes("@") ? { primary_email: sandboxConfig.subject } : { primary_mobile: sandboxConfig.subject };
+  if (sandboxConfig.email) {
+    payload.primary_email = sandboxConfig.email;
+  }
+  if (sandboxConfig.mobile) {
+    payload.primary_mobile = sandboxConfig.mobile;
+  }
+  return payload;
 };
 var sandboxQueryIdentity = () => sandboxBodyIdentity();
-var sandboxContact = () => sandboxConfig ? sandboxConfig.ucic || sandboxConfig.subject : null;
+var sandboxContact = () => sandboxConfig ? sandboxConfig.ucic || sandboxConfig.email || sandboxConfig.mobile || null : null;
 
 // src/RedactoPrivacyCenter/api/fetcher.ts
 var ApiError = class _ApiError extends Error {
@@ -10214,7 +10221,9 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
     const identity = sandboxQueryIdentity();
     if (identity) {
       Object.entries(identity).forEach(([key, value]) => {
-        queryParams.append(key, value);
+        if (value) {
+          queryParams.append(key, value);
+        }
       });
     }
   }
@@ -10369,13 +10378,20 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
     },
     /**
      * Verify OTP (public)
+     *
+     * Defaults to `purpose: "login"` — the branch the backend uses to mint an
+     * `auth`-scoped token (and to resolve shared-contact principals via the
+     * ledger). `purpose: "consent"` is reserved for consent flows. A login that
+     * omits the purpose falls back server-side to `purpose: "consent"`, which
+     * mints a scope-less notice token — every `/dsar/privacy-center/*` endpoint
+     * then rejects it with 403 "Token scope is not permitted".
      */
-    async verifyOtp(organisationId, workspaceId, otpId, otp, options) {
+    async verifyOtp(organisationId, workspaceId, otpId, otp, options, purpose = "login") {
       const url = `${baseUrl}/public/organisations/${organisationId}/workspaces/${workspaceId}/otp/verify`;
       return apiFetch(url, {
         ...options,
         method: "POST",
-        body: JSON.stringify({ uuid: otpId, otp })
+        body: JSON.stringify({ uuid: otpId, otp, purpose })
       });
     },
     /**
@@ -10613,7 +10629,7 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
      * the RN UI writes to a temp file to open/share. 404 => not found.
      */
     async getReceiptPdf(baseRequest, receiptUuid, authToken) {
-      const url = useLedger() ? ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`) : `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/receipts/${receiptUuid}/pdf`;
+      const url = useLedger() ? ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`) : `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/receipts/${receiptUuid}/pdf${sandboxIdentitySuffix()}`;
       const token = authToken || baseRequest.authToken;
       const requestHeaders = new Headers();
       requestHeaders.set("Accept", "application/pdf");
@@ -10694,7 +10710,7 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
      * Submit a document for a document request (privacy center)
      */
     async submitDocumentForRequest(baseRequest, caseUuid, requestEventUuid, documentUuid, body, authToken, options) {
-      const url = `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/cases/${caseUuid}/document-requests/${requestEventUuid}/submit`;
+      const url = `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/cases/${caseUuid}/document-requests/${requestEventUuid}/submit${sandboxIdentitySuffix()}`;
       return privacyCenterApiFetch(url, {
         ...options,
         method: "POST",
@@ -12178,7 +12194,7 @@ function syncJwtDataToStore(token) {
   return authData;
 }
 function configureSandbox(props) {
-  var _a3, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+  var _a3, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m;
   const token = (_a3 = props.token) == null ? void 0 : _a3.trim();
   if (!token) {
     setSandboxConfig(null);
@@ -12187,23 +12203,25 @@ function configureSandbox(props) {
   const organisationUuid = (_c = (_b = props.organisationUuid) == null ? void 0 : _b.trim()) != null ? _c : "";
   const workspaceUuid = (_e = (_d = props.workspaceUuid) == null ? void 0 : _d.trim()) != null ? _e : "";
   const ucic = (_g = (_f = props.sandboxUcic) == null ? void 0 : _f.trim()) != null ? _g : "";
-  const subject = (_i = (_h = props.sandboxSubject) == null ? void 0 : _h.trim()) != null ? _i : "";
-  const slug = (_k = (_j = props.slug) == null ? void 0 : _j.trim()) != null ? _k : "";
+  const email = (_i = (_h = props.sandboxEmail) == null ? void 0 : _h.trim()) != null ? _i : "";
+  const mobile = (_k = (_j = props.sandboxMobile) == null ? void 0 : _j.trim()) != null ? _k : "";
+  const slug = (_m = (_l = props.slug) == null ? void 0 : _l.trim()) != null ? _m : "";
   if (!organisationUuid || !workspaceUuid) {
     throw new Error("Sandbox mode requires organisationUuid and workspaceUuid props");
   }
-  if (!ucic && !subject) {
+  if (!ucic && !email && !mobile) {
     throw new Error("Sandbox mode requires a UCIC, email, or mobile");
   }
   setSandboxConfig({
     token,
     ucic: ucic || void 0,
-    subject,
+    email: email || void 0,
+    mobile: mobile || void 0,
     organisationUuid,
     workspaceUuid,
     slug
   });
-  const contact = ucic || subject;
+  const contact = ucic || email || mobile;
   setStoredValue("access_token", token);
   if (organisationUuid) setStoredValue("pc_org_id", organisationUuid);
   if (workspaceUuid) setStoredValue("pc_workspace_id", workspaceUuid);
@@ -12222,7 +12240,8 @@ function AuthProvider(props) {
     refreshToken: initialRefreshToken,
     token: sandboxToken,
     sandboxUcic,
-    sandboxSubject,
+    sandboxEmail,
+    sandboxMobile,
     organisationUuid,
     workspaceUuid,
     slug,
@@ -12265,7 +12284,7 @@ function AuthProvider(props) {
       setOrganizationName(seeded.organizationName);
     }
     return () => setSandboxConfig(null);
-  }, [sandboxActive, sandboxToken, sandboxUcic, sandboxSubject, organisationUuid, workspaceUuid, slug]);
+  }, [sandboxActive, sandboxToken, sandboxUcic, sandboxEmail, sandboxMobile, organisationUuid, workspaceUuid, slug]);
   (0, import_react3.useEffect)(() => {
     if (sandboxActive) return;
     if (accessToken) {
@@ -16014,7 +16033,7 @@ function ActivitiesList() {
     {
       data: activities,
       style: { backgroundColor: colors.canvasSubtle },
-      keyExtractor: (item, idx) => `${item.case_id || item.timestamp}-${idx}`,
+      keyExtractor: (item, idx) => item.id || `${item.case_id || item.timestamp}-${idx}`,
       onEndReached: handleLoadMore,
       onEndReachedThreshold: 0.3,
       contentContainerStyle: [styles30.content, { flexGrow: 1, paddingBottom: listBottom }],
@@ -16560,27 +16579,38 @@ var uploadFileWithS2S = async ({
   authToken,
   baseUrl
 }) => {
+  var _a3;
   try {
-    if (!authToken) {
-      throw new Error("Auth token is required for document upload");
-    }
     if (!baseUrl) {
       throw new Error("Base URL is required for document upload");
     }
-    const decodedToken = decodeJwtToken(authToken);
-    if (!decodedToken) {
-      throw new Error("Invalid access token");
-    }
-    const { organisation_uuid, workspace_uuid } = decodedToken;
-    if (!organisation_uuid || !workspace_uuid) {
-      throw new Error("Invalid token: missing organization or workspace UUID");
+    const sandbox = getSandboxConfig();
+    let organisation_uuid;
+    let workspace_uuid;
+    let authHeaders;
+    if (sandbox) {
+      organisation_uuid = sandbox.organisationUuid;
+      workspace_uuid = sandbox.workspaceUuid;
+      authHeaders = (_a3 = sandboxAuthHeaders()) != null ? _a3 : {};
+    } else {
+      if (!authToken) {
+        throw new Error("Auth token is required for document upload");
+      }
+      const decodedToken = decodeJwtToken(authToken);
+      if (!decodedToken) {
+        throw new Error("Invalid access token");
+      }
+      if (!decodedToken.organisation_uuid || !decodedToken.workspace_uuid) {
+        throw new Error("Invalid token: missing organization or workspace UUID");
+      }
+      organisation_uuid = decodedToken.organisation_uuid;
+      workspace_uuid = decodedToken.workspace_uuid;
+      authHeaders = { Authorization: `Bearer ${authToken}` };
     }
     const url = `${baseUrl}/organisations/${organisation_uuid}/workspaces/${workspace_uuid}/dsar/privacy-center/upload-document`;
     const response = await fetch(url, {
       method: "POST",
-      headers: {
-        "Authorization": `Bearer ${authToken}`
-      },
+      headers: authHeaders,
       body: formData
     });
     if (!response.ok) {
@@ -21413,7 +21443,8 @@ function RedactoPrivacyCenter({
       refreshToken: refreshToken != null ? refreshToken : "",
       token,
       sandboxUcic: ucic,
-      sandboxSubject: email || mobile,
+      sandboxEmail: email,
+      sandboxMobile: mobile,
       organisationUuid,
       workspaceUuid,
       slug,

package/dist/privacy-center.mjs

@@ -9931,13 +9931,20 @@ var sandboxBodyIdentity = () => {
   if (!sandboxConfig) {
     return null;
   }
+  const payload = {};
   if (sandboxConfig.ucic) {
-    return { org_user_id: sandboxConfig.ucic };
+    payload.org_user_id = sandboxConfig.ucic;
   }
-  return sandboxConfig.subject.includes("@") ? { primary_email: sandboxConfig.subject } : { primary_mobile: sandboxConfig.subject };
+  if (sandboxConfig.email) {
+    payload.primary_email = sandboxConfig.email;
+  }
+  if (sandboxConfig.mobile) {
+    payload.primary_mobile = sandboxConfig.mobile;
+  }
+  return payload;
 };
 var sandboxQueryIdentity = () => sandboxBodyIdentity();
-var sandboxContact = () => sandboxConfig ? sandboxConfig.ucic || sandboxConfig.subject : null;
+var sandboxContact = () => sandboxConfig ? sandboxConfig.ucic || sandboxConfig.email || sandboxConfig.mobile || null : null;
 
 // src/RedactoPrivacyCenter/api/fetcher.ts
 var ApiError = class _ApiError extends Error {
@@ -10099,7 +10106,9 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
     const identity = sandboxQueryIdentity();
     if (identity) {
       Object.entries(identity).forEach(([key, value]) => {
-        queryParams.append(key, value);
+        if (value) {
+          queryParams.append(key, value);
+        }
       });
     }
   }
@@ -10254,13 +10263,20 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
     },
     /**
      * Verify OTP (public)
+     *
+     * Defaults to `purpose: "login"` — the branch the backend uses to mint an
+     * `auth`-scoped token (and to resolve shared-contact principals via the
+     * ledger). `purpose: "consent"` is reserved for consent flows. A login that
+     * omits the purpose falls back server-side to `purpose: "consent"`, which
+     * mints a scope-less notice token — every `/dsar/privacy-center/*` endpoint
+     * then rejects it with 403 "Token scope is not permitted".
      */
-    async verifyOtp(organisationId, workspaceId, otpId, otp, options) {
+    async verifyOtp(organisationId, workspaceId, otpId, otp, options, purpose = "login") {
       const url = `${baseUrl}/public/organisations/${organisationId}/workspaces/${workspaceId}/otp/verify`;
       return apiFetch(url, {
         ...options,
         method: "POST",
-        body: JSON.stringify({ uuid: otpId, otp })
+        body: JSON.stringify({ uuid: otpId, otp, purpose })
       });
     },
     /**
@@ -10498,7 +10514,7 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
      * the RN UI writes to a temp file to open/share. 404 => not found.
      */
     async getReceiptPdf(baseRequest, receiptUuid, authToken) {
-      const url = useLedger() ? ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`) : `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/receipts/${receiptUuid}/pdf`;
+      const url = useLedger() ? ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`) : `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/receipts/${receiptUuid}/pdf${sandboxIdentitySuffix()}`;
       const token = authToken || baseRequest.authToken;
       const requestHeaders = new Headers();
       requestHeaders.set("Accept", "application/pdf");
@@ -10579,7 +10595,7 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
      * Submit a document for a document request (privacy center)
      */
     async submitDocumentForRequest(baseRequest, caseUuid, requestEventUuid, documentUuid, body, authToken, options) {
-      const url = `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/cases/${caseUuid}/document-requests/${requestEventUuid}/submit`;
+      const url = `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/cases/${caseUuid}/document-requests/${requestEventUuid}/submit${sandboxIdentitySuffix()}`;
       return privacyCenterApiFetch(url, {
         ...options,
         method: "POST",
@@ -12063,7 +12079,7 @@ function syncJwtDataToStore(token) {
   return authData;
 }
 function configureSandbox(props) {
-  var _a3, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+  var _a3, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m;
   const token = (_a3 = props.token) == null ? void 0 : _a3.trim();
   if (!token) {
     setSandboxConfig(null);
@@ -12072,23 +12088,25 @@ function configureSandbox(props) {
   const organisationUuid = (_c = (_b = props.organisationUuid) == null ? void 0 : _b.trim()) != null ? _c : "";
   const workspaceUuid = (_e = (_d = props.workspaceUuid) == null ? void 0 : _d.trim()) != null ? _e : "";
   const ucic = (_g = (_f = props.sandboxUcic) == null ? void 0 : _f.trim()) != null ? _g : "";
-  const subject = (_i = (_h = props.sandboxSubject) == null ? void 0 : _h.trim()) != null ? _i : "";
-  const slug = (_k = (_j = props.slug) == null ? void 0 : _j.trim()) != null ? _k : "";
+  const email = (_i = (_h = props.sandboxEmail) == null ? void 0 : _h.trim()) != null ? _i : "";
+  const mobile = (_k = (_j = props.sandboxMobile) == null ? void 0 : _j.trim()) != null ? _k : "";
+  const slug = (_m = (_l = props.slug) == null ? void 0 : _l.trim()) != null ? _m : "";
   if (!organisationUuid || !workspaceUuid) {
     throw new Error("Sandbox mode requires organisationUuid and workspaceUuid props");
   }
-  if (!ucic && !subject) {
+  if (!ucic && !email && !mobile) {
     throw new Error("Sandbox mode requires a UCIC, email, or mobile");
   }
   setSandboxConfig({
     token,
     ucic: ucic || void 0,
-    subject,
+    email: email || void 0,
+    mobile: mobile || void 0,
     organisationUuid,
     workspaceUuid,
     slug
   });
-  const contact = ucic || subject;
+  const contact = ucic || email || mobile;
   setStoredValue("access_token", token);
   if (organisationUuid) setStoredValue("pc_org_id", organisationUuid);
   if (workspaceUuid) setStoredValue("pc_workspace_id", workspaceUuid);
@@ -12107,7 +12125,8 @@ function AuthProvider(props) {
     refreshToken: initialRefreshToken,
     token: sandboxToken,
     sandboxUcic,
-    sandboxSubject,
+    sandboxEmail,
+    sandboxMobile,
     organisationUuid,
     workspaceUuid,
     slug,
@@ -12150,7 +12169,7 @@ function AuthProvider(props) {
       setOrganizationName(seeded.organizationName);
     }
     return () => setSandboxConfig(null);
-  }, [sandboxActive, sandboxToken, sandboxUcic, sandboxSubject, organisationUuid, workspaceUuid, slug]);
+  }, [sandboxActive, sandboxToken, sandboxUcic, sandboxEmail, sandboxMobile, organisationUuid, workspaceUuid, slug]);
   useEffect(() => {
     if (sandboxActive) return;
     if (accessToken) {
@@ -15992,7 +16011,7 @@ function ActivitiesList() {
     {
       data: activities,
       style: { backgroundColor: colors.canvasSubtle },
-      keyExtractor: (item, idx) => `${item.case_id || item.timestamp}-${idx}`,
+      keyExtractor: (item, idx) => item.id || `${item.case_id || item.timestamp}-${idx}`,
       onEndReached: handleLoadMore,
       onEndReachedThreshold: 0.3,
       contentContainerStyle: [styles30.content, { flexGrow: 1, paddingBottom: listBottom }],
@@ -16555,27 +16574,38 @@ var uploadFileWithS2S = async ({
   authToken,
   baseUrl
 }) => {
+  var _a3;
   try {
-    if (!authToken) {
-      throw new Error("Auth token is required for document upload");
-    }
     if (!baseUrl) {
       throw new Error("Base URL is required for document upload");
     }
-    const decodedToken = decodeJwtToken(authToken);
-    if (!decodedToken) {
-      throw new Error("Invalid access token");
-    }
-    const { organisation_uuid, workspace_uuid } = decodedToken;
-    if (!organisation_uuid || !workspace_uuid) {
-      throw new Error("Invalid token: missing organization or workspace UUID");
+    const sandbox = getSandboxConfig();
+    let organisation_uuid;
+    let workspace_uuid;
+    let authHeaders;
+    if (sandbox) {
+      organisation_uuid = sandbox.organisationUuid;
+      workspace_uuid = sandbox.workspaceUuid;
+      authHeaders = (_a3 = sandboxAuthHeaders()) != null ? _a3 : {};
+    } else {
+      if (!authToken) {
+        throw new Error("Auth token is required for document upload");
+      }
+      const decodedToken = decodeJwtToken(authToken);
+      if (!decodedToken) {
+        throw new Error("Invalid access token");
+      }
+      if (!decodedToken.organisation_uuid || !decodedToken.workspace_uuid) {
+        throw new Error("Invalid token: missing organization or workspace UUID");
+      }
+      organisation_uuid = decodedToken.organisation_uuid;
+      workspace_uuid = decodedToken.workspace_uuid;
+      authHeaders = { Authorization: `Bearer ${authToken}` };
     }
     const url = `${baseUrl}/organisations/${organisation_uuid}/workspaces/${workspace_uuid}/dsar/privacy-center/upload-document`;
     const response = await fetch(url, {
       method: "POST",
-      headers: {
-        "Authorization": `Bearer ${authToken}`
-      },
+      headers: authHeaders,
       body: formData
     });
     if (!response.ok) {
@@ -21417,7 +21447,8 @@ function RedactoPrivacyCenter({
       refreshToken: refreshToken != null ? refreshToken : "",
       token,
       sandboxUcic: ucic,
-      sandboxSubject: email || mobile,
+      sandboxEmail: email,
+      sandboxMobile: mobile,
       organisationUuid,
       workspaceUuid,
       slug,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redacto.io/consent-sdk-react-native",
-  "version": "5.0.0",
+  "version": "5.0.1-beta.1",
   "description": "React Native SDK for integrating Redacto consent notices and privacy center in mobile apps.",
   "keywords": [
     "consent",