@redacto.io/consent-sdk-react-native 5.0.1-beta.0 → 5.0.1-beta.1

package/dist/index.js

@@ -48,7 +48,7 @@ var SANDBOX_TOKEN_HEADER = "X-Consent-Token";
 
 // src/RedactoNoticeConsent/api/sandbox.ts
 var resolveSandboxAuth = (params) => {
-  var _a, _b, _c, _d, _e;
+  var _a, _b, _c, _d, _e, _f;
   const token = (_a = params.token) == null ? void 0 : _a.trim();
   if (!token) {
     return null;
@@ -56,16 +56,17 @@ var resolveSandboxAuth = (params) => {
   const organisationUuid = (_b = params.organisationUuid) == null ? void 0 : _b.trim();
   const workspaceUuid = (_c = params.workspaceUuid) == null ? void 0 : _c.trim();
   const ucic = (_d = params.sandboxUcic) == null ? void 0 : _d.trim();
-  const subject = (_e = params.sandboxSubject) == null ? void 0 : _e.trim();
+  const email = (_e = params.sandboxEmail) == null ? void 0 : _e.trim();
+  const mobile = (_f = params.sandboxMobile) == null ? void 0 : _f.trim();
   if (!organisationUuid || !workspaceUuid) {
     throw new Error(
       "Sandbox mode requires organisationUuid and workspaceUuid props"
     );
   }
-  if (!ucic && !subject) {
+  if (!ucic && !email && !mobile) {
     throw new Error("Sandbox mode requires a UCIC, email, or mobile");
   }
-  return { token, ucic, subject: subject != null ? subject : "", organisationUuid, workspaceUuid };
+  return { token, ucic, email, mobile, organisationUuid, workspaceUuid };
 };
 var resolveRequestAuth = (accessToken, sandboxParams, decodeTokenSafely2) => {
   const sandbox = resolveSandboxAuth(sandboxParams);
@@ -97,10 +98,17 @@ var buildAuthHeaders = (accessToken, sandbox) => {
   return { Authorization: `Bearer ${accessToken}` };
 };
 var sandboxBodyIdentity = (sandbox) => {
+  const payload = {};
   if (sandbox.ucic) {
-    return { org_user_id: sandbox.ucic };
+    payload.org_user_id = sandbox.ucic;
+  }
+  if (sandbox.email) {
+    payload.primary_email = sandbox.email;
   }
-  return sandbox.subject.includes("@") ? { primary_email: sandbox.subject } : { primary_mobile: sandbox.subject };
+  if (sandbox.mobile) {
+    payload.primary_mobile = sandbox.mobile;
+  }
+  return payload;
 };
 var sandboxQueryIdentity = (sandbox) => sandboxBodyIdentity(sandbox);
 
@@ -199,7 +207,7 @@ var fetchConsentContent = async ({
   }
   const { organisationUuid: ORGANISATION_UUID, workspaceUuid: WORKSPACE_UUID, sandbox } = resolveRequestAuth(accessToken, sandboxParams, decodeTokenSafely);
   const apiBaseUrl = baseUrl || DEFAULT_CONSENT_API_BASE_URL;
-  const cacheIdentity = sandbox ? `sandbox:${sandbox.organisationUuid}:${sandbox.workspaceUuid}:${sandbox.ucic || sandbox.subject}` : accessToken;
+  const cacheIdentity = sandbox ? `sandbox:${sandbox.organisationUuid}:${sandbox.workspaceUuid}:${sandbox.ucic || sandbox.email || sandbox.mobile}` : accessToken;
   const cacheKey = `${cacheIdentity}-${noticeId}-${validate_against}-${language}-${specific_uuid || ""}-${include_fully_consented_data}`;
   if (validate_against === "all" && !specific_uuid) {
     const cachedData = getCachedData(cacheKey);
@@ -219,7 +227,9 @@ var fetchConsentContent = async ({
   }
   if (sandbox) {
     for (const [key, value] of Object.entries(sandboxQueryIdentity(sandbox))) {
-      url.searchParams.append(key, value);
+      if (value) {
+        url.searchParams.append(key, value);
+      }
     }
   }
   const response = await fetch(url.toString(), {
@@ -353,7 +363,9 @@ var fetchTTSAudioUrls = async ({
   );
   if (sandbox) {
     for (const [key, value] of Object.entries(sandboxQueryIdentity(sandbox))) {
-      url.searchParams.append(key, value);
+      if (value) {
+        url.searchParams.append(key, value);
+      }
     }
   }
   const response = await fetch(url.toString(), {
@@ -1860,7 +1872,8 @@ var RedactoNoticeConsent = ({
     () => ({
       token,
       sandboxUcic: ucic,
-      sandboxSubject: email || mobile,
+      sandboxEmail: email,
+      sandboxMobile: mobile,
       organisationUuid,
       workspaceUuid
     }),

package/dist/index.mjs

@@ -32,7 +32,7 @@ import { jwtDecode } from "jwt-decode";
 
 // src/RedactoNoticeConsent/api/sandbox.ts
 var resolveSandboxAuth = (params) => {
-  var _a, _b, _c, _d, _e;
+  var _a, _b, _c, _d, _e, _f;
   const token = (_a = params.token) == null ? void 0 : _a.trim();
   if (!token) {
     return null;
@@ -40,16 +40,17 @@ var resolveSandboxAuth = (params) => {
   const organisationUuid = (_b = params.organisationUuid) == null ? void 0 : _b.trim();
   const workspaceUuid = (_c = params.workspaceUuid) == null ? void 0 : _c.trim();
   const ucic = (_d = params.sandboxUcic) == null ? void 0 : _d.trim();
-  const subject = (_e = params.sandboxSubject) == null ? void 0 : _e.trim();
+  const email = (_e = params.sandboxEmail) == null ? void 0 : _e.trim();
+  const mobile = (_f = params.sandboxMobile) == null ? void 0 : _f.trim();
   if (!organisationUuid || !workspaceUuid) {
     throw new Error(
       "Sandbox mode requires organisationUuid and workspaceUuid props"
     );
   }
-  if (!ucic && !subject) {
+  if (!ucic && !email && !mobile) {
     throw new Error("Sandbox mode requires a UCIC, email, or mobile");
   }
-  return { token, ucic, subject: subject != null ? subject : "", organisationUuid, workspaceUuid };
+  return { token, ucic, email, mobile, organisationUuid, workspaceUuid };
 };
 var resolveRequestAuth = (accessToken, sandboxParams, decodeTokenSafely2) => {
   const sandbox = resolveSandboxAuth(sandboxParams);
@@ -81,10 +82,17 @@ var buildAuthHeaders = (accessToken, sandbox) => {
   return { Authorization: `Bearer ${accessToken}` };
 };
 var sandboxBodyIdentity = (sandbox) => {
+  const payload = {};
   if (sandbox.ucic) {
-    return { org_user_id: sandbox.ucic };
+    payload.org_user_id = sandbox.ucic;
+  }
+  if (sandbox.email) {
+    payload.primary_email = sandbox.email;
   }
-  return sandbox.subject.includes("@") ? { primary_email: sandbox.subject } : { primary_mobile: sandbox.subject };
+  if (sandbox.mobile) {
+    payload.primary_mobile = sandbox.mobile;
+  }
+  return payload;
 };
 var sandboxQueryIdentity = (sandbox) => sandboxBodyIdentity(sandbox);
 
@@ -139,7 +147,7 @@ var fetchConsentContent = async ({
   }
   const { organisationUuid: ORGANISATION_UUID, workspaceUuid: WORKSPACE_UUID, sandbox } = resolveRequestAuth(accessToken, sandboxParams, decodeTokenSafely);
   const apiBaseUrl = baseUrl || DEFAULT_CONSENT_API_BASE_URL;
-  const cacheIdentity = sandbox ? `sandbox:${sandbox.organisationUuid}:${sandbox.workspaceUuid}:${sandbox.ucic || sandbox.subject}` : accessToken;
+  const cacheIdentity = sandbox ? `sandbox:${sandbox.organisationUuid}:${sandbox.workspaceUuid}:${sandbox.ucic || sandbox.email || sandbox.mobile}` : accessToken;
   const cacheKey = `${cacheIdentity}-${noticeId}-${validate_against}-${language}-${specific_uuid || ""}-${include_fully_consented_data}`;
   if (validate_against === "all" && !specific_uuid) {
     const cachedData = getCachedData(cacheKey);
@@ -159,7 +167,9 @@ var fetchConsentContent = async ({
   }
   if (sandbox) {
     for (const [key, value] of Object.entries(sandboxQueryIdentity(sandbox))) {
-      url.searchParams.append(key, value);
+      if (value) {
+        url.searchParams.append(key, value);
+      }
     }
   }
   const response = await fetch(url.toString(), {
@@ -293,7 +303,9 @@ var fetchTTSAudioUrls = async ({
   );
   if (sandbox) {
     for (const [key, value] of Object.entries(sandboxQueryIdentity(sandbox))) {
-      url.searchParams.append(key, value);
+      if (value) {
+        url.searchParams.append(key, value);
+      }
     }
   }
   const response = await fetch(url.toString(), {
@@ -1807,7 +1819,8 @@ var RedactoNoticeConsent = ({
     () => ({
       token,
       sandboxUcic: ucic,
-      sandboxSubject: email || mobile,
+      sandboxEmail: email,
+      sandboxMobile: mobile,
       organisationUuid,
       workspaceUuid
     }),

package/dist/privacy-center.d.mts

@@ -395,6 +395,8 @@ type ManageConsentParams = {
     dataElementUuids?: string[];
 };
 type Activity = {
+    /** Stable per-activity id (source event/case uuid) for list keys and de-duplication. */
+    id?: string;
     activity_type: string;
     activity_type_display?: string;
     timestamp: string;
@@ -691,8 +693,15 @@ declare function createConsentClient(baseUrl: string, ledgerBaseUrl?: string): {
     createOtp(organisationId: string, workspaceId: string, email: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<unknown>;
     /**
      * Verify OTP (public)
+     *
+     * Defaults to `purpose: "login"` — the branch the backend uses to mint an
+     * `auth`-scoped token (and to resolve shared-contact principals via the
+     * ledger). `purpose: "consent"` is reserved for consent flows. A login that
+     * omits the purpose falls back server-side to `purpose: "consent"`, which
+     * mints a scope-less notice token — every `/dsar/privacy-center/*` endpoint
+     * then rejects it with 403 "Token scope is not permitted".
      */
-    verifyOtp(organisationId: string, workspaceId: string, otpId: string, otp: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<unknown>;
+    verifyOtp(organisationId: string, workspaceId: string, otpId: string, otp: string, options?: Omit<ApiFetchOptions, "getAuthToken">, purpose?: "login" | "consent"): Promise<unknown>;
     /**
      * Exchange one-time token for JWT tokens (public)
      */
@@ -943,10 +952,12 @@ interface AuthProviderProps {
      * payload, and never calls `/otp/refresh`.
      */
     token?: string;
-    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence over the subject. */
+    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence for the principal. */
     sandboxUcic?: string;
-    /** Sandbox subject (email or mobile) — carried in the request payload. */
-    sandboxSubject?: string;
+    /** Sandbox email — carried on every request, like a live JWT's `user_data.primary_email`. */
+    sandboxEmail?: string;
+    /** Sandbox mobile — carried on every request, like a live JWT's `user_data.primary_mobile`. */
+    sandboxMobile?: string;
     /** Sandbox org UUID (replaces the JWT-decoded org). */
     organisationUuid?: string;
     /** Sandbox workspace UUID (replaces the JWT-decoded workspace). */

package/dist/privacy-center.d.ts

@@ -395,6 +395,8 @@ type ManageConsentParams = {
     dataElementUuids?: string[];
 };
 type Activity = {
+    /** Stable per-activity id (source event/case uuid) for list keys and de-duplication. */
+    id?: string;
     activity_type: string;
     activity_type_display?: string;
     timestamp: string;
@@ -691,8 +693,15 @@ declare function createConsentClient(baseUrl: string, ledgerBaseUrl?: string): {
     createOtp(organisationId: string, workspaceId: string, email: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<unknown>;
     /**
      * Verify OTP (public)
+     *
+     * Defaults to `purpose: "login"` — the branch the backend uses to mint an
+     * `auth`-scoped token (and to resolve shared-contact principals via the
+     * ledger). `purpose: "consent"` is reserved for consent flows. A login that
+     * omits the purpose falls back server-side to `purpose: "consent"`, which
+     * mints a scope-less notice token — every `/dsar/privacy-center/*` endpoint
+     * then rejects it with 403 "Token scope is not permitted".
      */
-    verifyOtp(organisationId: string, workspaceId: string, otpId: string, otp: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<unknown>;
+    verifyOtp(organisationId: string, workspaceId: string, otpId: string, otp: string, options?: Omit<ApiFetchOptions, "getAuthToken">, purpose?: "login" | "consent"): Promise<unknown>;
     /**
      * Exchange one-time token for JWT tokens (public)
      */
@@ -943,10 +952,12 @@ interface AuthProviderProps {
      * payload, and never calls `/otp/refresh`.
      */
     token?: string;
-    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence over the subject. */
+    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence for the principal. */
     sandboxUcic?: string;
-    /** Sandbox subject (email or mobile) — carried in the request payload. */
-    sandboxSubject?: string;
+    /** Sandbox email — carried on every request, like a live JWT's `user_data.primary_email`. */
+    sandboxEmail?: string;
+    /** Sandbox mobile — carried on every request, like a live JWT's `user_data.primary_mobile`. */
+    sandboxMobile?: string;
     /** Sandbox org UUID (replaces the JWT-decoded org). */
     organisationUuid?: string;
     /** Sandbox workspace UUID (replaces the JWT-decoded workspace). */

package/dist/privacy-center.js

@@ -10046,13 +10046,20 @@ var sandboxBodyIdentity = () => {
   if (!sandboxConfig) {
     return null;
   }
+  const payload = {};
   if (sandboxConfig.ucic) {
-    return { org_user_id: sandboxConfig.ucic };
+    payload.org_user_id = sandboxConfig.ucic;
   }
-  return sandboxConfig.subject.includes("@") ? { primary_email: sandboxConfig.subject } : { primary_mobile: sandboxConfig.subject };
+  if (sandboxConfig.email) {
+    payload.primary_email = sandboxConfig.email;
+  }
+  if (sandboxConfig.mobile) {
+    payload.primary_mobile = sandboxConfig.mobile;
+  }
+  return payload;
 };
 var sandboxQueryIdentity = () => sandboxBodyIdentity();
-var sandboxContact = () => sandboxConfig ? sandboxConfig.ucic || sandboxConfig.subject : null;
+var sandboxContact = () => sandboxConfig ? sandboxConfig.ucic || sandboxConfig.email || sandboxConfig.mobile || null : null;
 
 // src/RedactoPrivacyCenter/api/fetcher.ts
 var ApiError = class _ApiError extends Error {
@@ -10214,7 +10221,9 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
     const identity = sandboxQueryIdentity();
     if (identity) {
       Object.entries(identity).forEach(([key, value]) => {
-        queryParams.append(key, value);
+        if (value) {
+          queryParams.append(key, value);
+        }
       });
     }
   }
@@ -10369,13 +10378,20 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
     },
     /**
      * Verify OTP (public)
+     *
+     * Defaults to `purpose: "login"` — the branch the backend uses to mint an
+     * `auth`-scoped token (and to resolve shared-contact principals via the
+     * ledger). `purpose: "consent"` is reserved for consent flows. A login that
+     * omits the purpose falls back server-side to `purpose: "consent"`, which
+     * mints a scope-less notice token — every `/dsar/privacy-center/*` endpoint
+     * then rejects it with 403 "Token scope is not permitted".
      */
-    async verifyOtp(organisationId, workspaceId, otpId, otp, options) {
+    async verifyOtp(organisationId, workspaceId, otpId, otp, options, purpose = "login") {
       const url = `${baseUrl}/public/organisations/${organisationId}/workspaces/${workspaceId}/otp/verify`;
       return apiFetch(url, {
         ...options,
         method: "POST",
-        body: JSON.stringify({ uuid: otpId, otp })
+        body: JSON.stringify({ uuid: otpId, otp, purpose })
       });
     },
     /**
@@ -10613,7 +10629,7 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
      * the RN UI writes to a temp file to open/share. 404 => not found.
      */
     async getReceiptPdf(baseRequest, receiptUuid, authToken) {
-      const url = useLedger() ? ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`) : `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/receipts/${receiptUuid}/pdf`;
+      const url = useLedger() ? ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`) : `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/receipts/${receiptUuid}/pdf${sandboxIdentitySuffix()}`;
       const token = authToken || baseRequest.authToken;
       const requestHeaders = new Headers();
       requestHeaders.set("Accept", "application/pdf");
@@ -12178,7 +12194,7 @@ function syncJwtDataToStore(token) {
   return authData;
 }
 function configureSandbox(props) {
-  var _a3, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+  var _a3, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m;
   const token = (_a3 = props.token) == null ? void 0 : _a3.trim();
   if (!token) {
     setSandboxConfig(null);
@@ -12187,23 +12203,25 @@ function configureSandbox(props) {
   const organisationUuid = (_c = (_b = props.organisationUuid) == null ? void 0 : _b.trim()) != null ? _c : "";
   const workspaceUuid = (_e = (_d = props.workspaceUuid) == null ? void 0 : _d.trim()) != null ? _e : "";
   const ucic = (_g = (_f = props.sandboxUcic) == null ? void 0 : _f.trim()) != null ? _g : "";
-  const subject = (_i = (_h = props.sandboxSubject) == null ? void 0 : _h.trim()) != null ? _i : "";
-  const slug = (_k = (_j = props.slug) == null ? void 0 : _j.trim()) != null ? _k : "";
+  const email = (_i = (_h = props.sandboxEmail) == null ? void 0 : _h.trim()) != null ? _i : "";
+  const mobile = (_k = (_j = props.sandboxMobile) == null ? void 0 : _j.trim()) != null ? _k : "";
+  const slug = (_m = (_l = props.slug) == null ? void 0 : _l.trim()) != null ? _m : "";
   if (!organisationUuid || !workspaceUuid) {
     throw new Error("Sandbox mode requires organisationUuid and workspaceUuid props");
   }
-  if (!ucic && !subject) {
+  if (!ucic && !email && !mobile) {
     throw new Error("Sandbox mode requires a UCIC, email, or mobile");
   }
   setSandboxConfig({
     token,
     ucic: ucic || void 0,
-    subject,
+    email: email || void 0,
+    mobile: mobile || void 0,
     organisationUuid,
     workspaceUuid,
     slug
   });
-  const contact = ucic || subject;
+  const contact = ucic || email || mobile;
   setStoredValue("access_token", token);
   if (organisationUuid) setStoredValue("pc_org_id", organisationUuid);
   if (workspaceUuid) setStoredValue("pc_workspace_id", workspaceUuid);
@@ -12222,7 +12240,8 @@ function AuthProvider(props) {
     refreshToken: initialRefreshToken,
     token: sandboxToken,
     sandboxUcic,
-    sandboxSubject,
+    sandboxEmail,
+    sandboxMobile,
     organisationUuid,
     workspaceUuid,
     slug,
@@ -12265,7 +12284,7 @@ function AuthProvider(props) {
       setOrganizationName(seeded.organizationName);
     }
     return () => setSandboxConfig(null);
-  }, [sandboxActive, sandboxToken, sandboxUcic, sandboxSubject, organisationUuid, workspaceUuid, slug]);
+  }, [sandboxActive, sandboxToken, sandboxUcic, sandboxEmail, sandboxMobile, organisationUuid, workspaceUuid, slug]);
   (0, import_react3.useEffect)(() => {
     if (sandboxActive) return;
     if (accessToken) {
@@ -16014,7 +16033,7 @@ function ActivitiesList() {
     {
       data: activities,
       style: { backgroundColor: colors.canvasSubtle },
-      keyExtractor: (item, idx) => `${item.case_id || item.timestamp}-${idx}`,
+      keyExtractor: (item, idx) => item.id || `${item.case_id || item.timestamp}-${idx}`,
       onEndReached: handleLoadMore,
       onEndReachedThreshold: 0.3,
       contentContainerStyle: [styles30.content, { flexGrow: 1, paddingBottom: listBottom }],
@@ -21424,7 +21443,8 @@ function RedactoPrivacyCenter({
       refreshToken: refreshToken != null ? refreshToken : "",
       token,
       sandboxUcic: ucic,
-      sandboxSubject: email || mobile,
+      sandboxEmail: email,
+      sandboxMobile: mobile,
       organisationUuid,
       workspaceUuid,
       slug,

package/dist/privacy-center.mjs

@@ -9931,13 +9931,20 @@ var sandboxBodyIdentity = () => {
   if (!sandboxConfig) {
     return null;
   }
+  const payload = {};
   if (sandboxConfig.ucic) {
-    return { org_user_id: sandboxConfig.ucic };
+    payload.org_user_id = sandboxConfig.ucic;
   }
-  return sandboxConfig.subject.includes("@") ? { primary_email: sandboxConfig.subject } : { primary_mobile: sandboxConfig.subject };
+  if (sandboxConfig.email) {
+    payload.primary_email = sandboxConfig.email;
+  }
+  if (sandboxConfig.mobile) {
+    payload.primary_mobile = sandboxConfig.mobile;
+  }
+  return payload;
 };
 var sandboxQueryIdentity = () => sandboxBodyIdentity();
-var sandboxContact = () => sandboxConfig ? sandboxConfig.ucic || sandboxConfig.subject : null;
+var sandboxContact = () => sandboxConfig ? sandboxConfig.ucic || sandboxConfig.email || sandboxConfig.mobile || null : null;
 
 // src/RedactoPrivacyCenter/api/fetcher.ts
 var ApiError = class _ApiError extends Error {
@@ -10099,7 +10106,9 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
     const identity = sandboxQueryIdentity();
     if (identity) {
       Object.entries(identity).forEach(([key, value]) => {
-        queryParams.append(key, value);
+        if (value) {
+          queryParams.append(key, value);
+        }
       });
     }
   }
@@ -10254,13 +10263,20 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
     },
     /**
      * Verify OTP (public)
+     *
+     * Defaults to `purpose: "login"` — the branch the backend uses to mint an
+     * `auth`-scoped token (and to resolve shared-contact principals via the
+     * ledger). `purpose: "consent"` is reserved for consent flows. A login that
+     * omits the purpose falls back server-side to `purpose: "consent"`, which
+     * mints a scope-less notice token — every `/dsar/privacy-center/*` endpoint
+     * then rejects it with 403 "Token scope is not permitted".
      */
-    async verifyOtp(organisationId, workspaceId, otpId, otp, options) {
+    async verifyOtp(organisationId, workspaceId, otpId, otp, options, purpose = "login") {
       const url = `${baseUrl}/public/organisations/${organisationId}/workspaces/${workspaceId}/otp/verify`;
       return apiFetch(url, {
         ...options,
         method: "POST",
-        body: JSON.stringify({ uuid: otpId, otp })
+        body: JSON.stringify({ uuid: otpId, otp, purpose })
       });
     },
     /**
@@ -10498,7 +10514,7 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
      * the RN UI writes to a temp file to open/share. 404 => not found.
      */
     async getReceiptPdf(baseRequest, receiptUuid, authToken) {
-      const url = useLedger() ? ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`) : `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/receipts/${receiptUuid}/pdf`;
+      const url = useLedger() ? ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`) : `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/receipts/${receiptUuid}/pdf${sandboxIdentitySuffix()}`;
       const token = authToken || baseRequest.authToken;
       const requestHeaders = new Headers();
       requestHeaders.set("Accept", "application/pdf");
@@ -12063,7 +12079,7 @@ function syncJwtDataToStore(token) {
   return authData;
 }
 function configureSandbox(props) {
-  var _a3, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+  var _a3, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m;
   const token = (_a3 = props.token) == null ? void 0 : _a3.trim();
   if (!token) {
     setSandboxConfig(null);
@@ -12072,23 +12088,25 @@ function configureSandbox(props) {
   const organisationUuid = (_c = (_b = props.organisationUuid) == null ? void 0 : _b.trim()) != null ? _c : "";
   const workspaceUuid = (_e = (_d = props.workspaceUuid) == null ? void 0 : _d.trim()) != null ? _e : "";
   const ucic = (_g = (_f = props.sandboxUcic) == null ? void 0 : _f.trim()) != null ? _g : "";
-  const subject = (_i = (_h = props.sandboxSubject) == null ? void 0 : _h.trim()) != null ? _i : "";
-  const slug = (_k = (_j = props.slug) == null ? void 0 : _j.trim()) != null ? _k : "";
+  const email = (_i = (_h = props.sandboxEmail) == null ? void 0 : _h.trim()) != null ? _i : "";
+  const mobile = (_k = (_j = props.sandboxMobile) == null ? void 0 : _j.trim()) != null ? _k : "";
+  const slug = (_m = (_l = props.slug) == null ? void 0 : _l.trim()) != null ? _m : "";
   if (!organisationUuid || !workspaceUuid) {
     throw new Error("Sandbox mode requires organisationUuid and workspaceUuid props");
   }
-  if (!ucic && !subject) {
+  if (!ucic && !email && !mobile) {
     throw new Error("Sandbox mode requires a UCIC, email, or mobile");
   }
   setSandboxConfig({
     token,
     ucic: ucic || void 0,
-    subject,
+    email: email || void 0,
+    mobile: mobile || void 0,
     organisationUuid,
     workspaceUuid,
     slug
   });
-  const contact = ucic || subject;
+  const contact = ucic || email || mobile;
   setStoredValue("access_token", token);
   if (organisationUuid) setStoredValue("pc_org_id", organisationUuid);
   if (workspaceUuid) setStoredValue("pc_workspace_id", workspaceUuid);
@@ -12107,7 +12125,8 @@ function AuthProvider(props) {
     refreshToken: initialRefreshToken,
     token: sandboxToken,
     sandboxUcic,
-    sandboxSubject,
+    sandboxEmail,
+    sandboxMobile,
     organisationUuid,
     workspaceUuid,
     slug,
@@ -12150,7 +12169,7 @@ function AuthProvider(props) {
       setOrganizationName(seeded.organizationName);
     }
     return () => setSandboxConfig(null);
-  }, [sandboxActive, sandboxToken, sandboxUcic, sandboxSubject, organisationUuid, workspaceUuid, slug]);
+  }, [sandboxActive, sandboxToken, sandboxUcic, sandboxEmail, sandboxMobile, organisationUuid, workspaceUuid, slug]);
   useEffect(() => {
     if (sandboxActive) return;
     if (accessToken) {
@@ -15992,7 +16011,7 @@ function ActivitiesList() {
     {
       data: activities,
       style: { backgroundColor: colors.canvasSubtle },
-      keyExtractor: (item, idx) => `${item.case_id || item.timestamp}-${idx}`,
+      keyExtractor: (item, idx) => item.id || `${item.case_id || item.timestamp}-${idx}`,
       onEndReached: handleLoadMore,
       onEndReachedThreshold: 0.3,
       contentContainerStyle: [styles30.content, { flexGrow: 1, paddingBottom: listBottom }],
@@ -21428,7 +21447,8 @@ function RedactoPrivacyCenter({
       refreshToken: refreshToken != null ? refreshToken : "",
       token,
       sandboxUcic: ucic,
-      sandboxSubject: email || mobile,
+      sandboxEmail: email,
+      sandboxMobile: mobile,
       organisationUuid,
       workspaceUuid,
       slug,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redacto.io/consent-sdk-react-native",
-  "version": "5.0.1-beta.0",
+  "version": "5.0.1-beta.1",
   "description": "React Native SDK for integrating Redacto consent notices and privacy center in mobile apps.",
   "keywords": [
     "consent",