@redacto.io/consent-sdk-react 10.0.0-beta.0 → 10.0.0-beta.11

package/src/RedactoPrivacyCenter/api/client.ts

@@ -1,12 +1,20 @@
 import { apiFetch, ApiError } from "./fetcher";
 import type { ApiFetchOptions, ApiResponse } from "./fetcher";
+import {
+  isSandboxMode,
+  sandboxAuthHeaders,
+  sandboxContact,
+  sandboxQueryIdentity,
+} from "../lib/sandbox";
 import type {
   CaseMessage,
+  IdentityListResponse,
   MessageDocument,
   NotificationActionResponse,
   NotificationListResponse,
   NotificationQueryParams,
   NotificationSummary,
+  SelectPrincipalResponse,
   UnreadCountResponse,
   UploadDocumentResponse,
 } from "../lib/types";
@@ -25,13 +33,18 @@ export type BaseRequest = {
  * Creates a client instance with a specific base URL.
  * @param baseUrl - Consent server base URL (Python service, e.g. http://host/consent)
  * @param ledgerBaseUrl - Go ledger base URL (e.g. http://host:8090/consent-ledger).
- *   Used for user-consents reads which are served from the ledger's `/public/...` paths.
+ *   Used for user-consents reads/writes served from the ledger's `/public/...` paths.
+ *   When omitted, those calls fall back to the legacy Python
+ *   `/dsar/privacy-center` endpoints and payloads (pre-ledger behavior), so
+ *   integrations without a deployed ledger keep working.
  */
-export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
-  if (!ledgerBaseUrl) {
-    throw new Error("ledgerBaseUrl is required to create the consent client");
-  }
-  const ledgerBase = ledgerBaseUrl.replace(/\/$/, "");
+export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
+  const ledgerConfigured = Boolean(ledgerBaseUrl);
+  // Sandbox mode never routes to the Go ledger (it has no sandbox / test::
+  // support). A sandbox token forces the legacy consent-server path regardless
+  // of ledgerBaseUrl, so isolation can't be bypassed by also configuring a ledger.
+  const useLedger = () => ledgerConfigured && !isSandboxMode();
+  const ledgerBase = (ledgerBaseUrl ?? "").replace(/\/$/, "");
   /**
    * Privacy Center API fetch wrapper that uses Authorization: Bearer header.
    * Privacy center endpoints require JWT tokens in Authorization header, not X-Auth-Token.
@@ -69,15 +82,26 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
       }
     }
 
-    // Add Authorization Bearer token for privacy center APIs
-    const token = authToken || (getAuthToken ? await getAuthToken() : null);
-    if (token) {
-      const trimmedToken = token.trim();
-      // Format token with Bearer prefix if not already present
-      const bearerToken = trimmedToken.startsWith('Bearer ')
-        ? trimmedToken
-        : `Bearer ${trimmedToken}`;
-      requestHeaders.set("Authorization", bearerToken);
+    // Sandbox PoC: send only the X-Consent-Token credential (no JWT bearer). Set
+    // last so it wins over any caller-supplied Authorization header. The acting
+    // identity travels in the request payload -- query params on reads, the body
+    // on writes -- never a header.
+    const sandboxHeaders = sandboxAuthHeaders();
+    if (sandboxHeaders) {
+      Object.entries(sandboxHeaders).forEach(([key, value]) => {
+        requestHeaders.set(key, value);
+      });
+    } else {
+      // Add Authorization Bearer token for privacy center APIs
+      const token = authToken || (getAuthToken ? await getAuthToken() : null);
+      if (token) {
+        const trimmedToken = token.trim();
+        // Format token with Bearer prefix if not already present
+        const bearerToken = trimmedToken.startsWith('Bearer ')
+          ? trimmedToken
+          : `Bearer ${trimmedToken}`;
+        requestHeaders.set("Authorization", bearerToken);
+      }
     }
 
     // Build fetch options
@@ -177,6 +201,9 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
   }
 
   function ledgerUrl(baseRequest: BaseRequest, path: string): string {
+    if (!useLedger()) {
+      throw new Error("ledgerUrl called without a configured ledgerBaseUrl");
+    }
     return `${ledgerBase}/public/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}${path}`;
   }
 
@@ -185,13 +212,47 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
   }
 
   function notificationUrl(baseRequest: BaseRequest, path = ''): string {
-    return privacyCenterUrl(baseRequest, `/notifications${path}`);
+    const identitySuffix = sandboxIdentitySuffix();
+    if (!identitySuffix) {
+      return privacyCenterUrl(baseRequest, `/notifications${path}`);
+    }
+    const separator = path.includes('?') ? `&${identitySuffix.slice(1)}` : identitySuffix;
+    return privacyCenterUrl(baseRequest, `/notifications${path}${separator}`);
   }
 
   function resolveAuthToken(authToken: string | undefined, baseRequest: BaseRequest): string {
     return authToken || baseRequest.authToken;
   }
 
+  /**
+   * Append the sandbox acting identity (`primary_email` / `primary_mobile`) to a
+   * query-param bag when sandbox mode is active; a no-op otherwise. The server
+   * resolves the acting test identity from these query params on reads (there is
+   * no subject header). The credential is the X-Consent-Token header set in
+   * privacyCenterApiFetch.
+   */
+  function appendSandboxIdentity(queryParams: URLSearchParams): void {
+    const identity = sandboxQueryIdentity();
+    if (identity) {
+      Object.entries(identity).forEach(([key, value]) => {
+        queryParams.append(key, value);
+      });
+    }
+  }
+
+  /**
+   * The sandbox acting-identity query suffix (`?primary_email=...` /
+   * `?primary_mobile=...`) for endpoints that build a bare URL with no other
+   * query params (the case-communication reads/POSTs). Empty string outside
+   * sandbox mode, so the JWT path is unchanged.
+   */
+  function sandboxIdentitySuffix(): string {
+    const queryParams = new URLSearchParams();
+    appendSandboxIdentity(queryParams);
+    const queryString = queryParams.toString();
+    return queryString ? `?${queryString}` : "";
+  }
+
   return {
     /**
      * Get form data (privacy center)
@@ -241,13 +302,23 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
       const url = privacyCenterUrl(baseRequest, '/case');
       const { useSessionAuth = false, getAuthToken, ...fetchOptions } = options || {};
 
+      // Sandbox mode: the acting test identity is the single `contact` field
+      // (the server has no subject header; it namespaces this identity `test::`).
+      // Merge it into the body only when sandbox mode is active and the payload
+      // is a plain object; the JWT path is left byte-for-byte unchanged.
+      const contact = sandboxContact();
+      const requestPayload =
+        contact && payload && typeof payload === "object"
+          ? { ...(payload as Record<string, unknown>), contact }
+          : payload;
+
       // Case management uses session-based auth (X-Auth-Token)
       // Privacy center uses JWT Bearer tokens (Authorization: Bearer)
       if (useSessionAuth) {
         return apiFetch(url, {
           ...fetchOptions,
           method: "POST",
-          body: JSON.stringify(payload),
+          body: JSON.stringify(requestPayload),
           getAuthToken,
         });
       }
@@ -256,7 +327,7 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
       return privacyCenterApiFetch(url, {
         ...fetchOptions,
         method: "POST",
-        body: JSON.stringify(payload),
+        body: JSON.stringify(requestPayload),
         authToken: resolveAuthToken(authToken, baseRequest),
       });
     },
@@ -382,9 +453,14 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
       if (params.status) queryParams.append("status", params.status);
       if (params.product_uuid) queryParams.append("product_uuid", params.product_uuid);
       if (params.language) queryParams.append("language", params.language);
+      // Sandbox mode: the acting identity travels as query params
+      // (primary_email / primary_mobile); the credential is the X-Consent-Token header.
+      appendSandboxIdentity(queryParams);
       const queryString = queryParams.toString();
       const suffix = `/user-consents${queryString ? `?${queryString}` : ""}`;
-      const url = ledgerUrl(baseRequest, suffix);
+      const url = useLedger()
+        ? ledgerUrl(baseRequest, suffix)
+        : privacyCenterUrl(baseRequest, suffix);
       return privacyCenterApiFetch(url, {
         ...options,
         method: "GET",
@@ -418,9 +494,14 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
       if (params.search) queryParams.append("search", params.search);
       if (params.language) queryParams.append("language", params.language);
       if (params.nominator_uuid) queryParams.append("nominator_uuid", params.nominator_uuid);
+      // Sandbox mode: the acting identity travels as query params
+      // (primary_email / primary_mobile); the credential is the X-Consent-Token header.
+      appendSandboxIdentity(queryParams);
       const queryString = queryParams.toString();
       const suffix = `/user-consents/${productUuid}/purposes${queryString ? `?${queryString}` : ""}`;
-      const url = ledgerUrl(baseRequest, suffix);
+      const url = useLedger()
+        ? ledgerUrl(baseRequest, suffix)
+        : privacyCenterUrl(baseRequest, suffix);
       return privacyCenterApiFetch(url, {
         ...options,
         method: "GET",
@@ -432,18 +513,23 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
     /**
      * Manage consent (privacy center) - revoke, regrant, or renew.
      *
-     * The Go ledger has no manage-consent route, so this is expressed as a
-     * `partial` submit-consent on the ledger — mirroring the Python dual-write
-     * relay (`build_consent_management_payload`): the affected purpose is
-     * re-submitted with `selected: false` to revoke or `selected: true` to
-     * regrant/renew, and `partial: true` so the rest of the notice's purposes
-     * are left untouched. The principal is resolved from the JWT, so no
-     * `contact`/identifiers are sent in the body, and `consent_event_uuid` is
-     * omitted so the ledger mints a fresh event.
+     * The Go ledger has no manage-consent route, so with a ledger configured
+     * this is expressed as a `partial` submit-consent on the ledger — mirroring
+     * the Python dual-write relay (`build_consent_management_payload`): the
+     * affected purpose is re-submitted with `selected: false` to revoke or
+     * `selected: true` to regrant/renew, and `partial: true` so the rest of the
+     * notice's purposes are left untouched. The principal is resolved from the
+     * JWT, so no `contact`/identifiers are sent in the body, and
+     * `consent_event_uuid` is omitted so the ledger mints a fresh event.
+     *
+     * Without a ledger, the legacy Python `/manage-consent?status=` endpoint is
+     * used with its `{ purpose_uuid, contact, ... }` payload.
      */
     async manageConsent(
       baseRequest: BaseRequest,
       purposeId: string,
+      // Sent to the legacy Python endpoint only; the ledger resolves the
+      // principal from the JWT, so no identifiers are sent in ledger mode.
       contact: string,
       status: 'revoke' | 'regrant' | 'renew',
       authToken?: string,
@@ -452,8 +538,31 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
       dataElementUuids?: string[],
       productUuid?: string,
       noticeUuid?: string,
-      dataElements?: Array<{ uuid: string; selected: boolean }>
+      dataElements?: Array<{ uuid: string; selected: boolean }>,
+      language?: string
     ): Promise<unknown> {
+      if (!useLedger()) {
+        const url = privacyCenterUrl(baseRequest, `/manage-consent?status=${status}`);
+        const body: Record<string, unknown> = { purpose_uuid: purposeId, contact };
+        if (nominatorContact) {
+          body.nominator_contact = nominatorContact;
+        }
+        if (Array.isArray(dataElementUuids) && dataElementUuids.length > 0) {
+          body.data_element_uuids = dataElementUuids;
+        }
+        if (productUuid) {
+          body.product_uuid = productUuid;
+        }
+        if (language) {
+          body.language = language;
+        }
+        return privacyCenterApiFetch(url, {
+          ...options,
+          method: "POST",
+          body: JSON.stringify(body),
+          authToken: resolveAuthToken(authToken, baseRequest),
+        });
+      }
       if (!noticeUuid) {
         throw new Error("notice_uuid is required to manage consent via the ledger");
       }
@@ -473,7 +582,7 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
         }
         return { uuid: de.uuid, selected };
       });
-      const body = {
+      const body: Record<string, unknown> = {
         notice_uuid: noticeUuid,
         partial: true,
         declined: false,
@@ -486,6 +595,7 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
             data_elements: elements,
           },
         ],
+        ...(language ? { language } : {}),
       };
       const url = ledgerUrl(baseRequest, "/submit-consent");
       return privacyCenterApiFetch(url, {
@@ -511,6 +621,9 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
       if (offset !== undefined) queryParams.append("offset", offset.toString());
       if (limit !== undefined) queryParams.append("limit", limit.toString());
       if (language) queryParams.append("language", language);
+      // Sandbox mode: the acting identity travels as query params
+      // (primary_email / primary_mobile); the credential is the X-Consent-Token header.
+      appendSandboxIdentity(queryParams);
       const queryString = queryParams.toString();
       const url = privacyCenterUrl(baseRequest, `/activities${queryString ? `?${queryString}` : ""}`);
       return privacyCenterApiFetch<unknown>(url, {
@@ -519,6 +632,44 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
       });
     },
 
+    /**
+     * List all data principals that share this session's contact
+     * (shared-contact profile picker). Identity is derived server-side from the
+     * JWT — the caller sends nothing but its bearer token.
+     */
+    async listIdentities(
+      baseRequest: BaseRequest,
+      authToken?: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<IdentityListResponse> {
+      const url = privacyCenterUrl(baseRequest, '/identities');
+      return privacyCenterApiFetch<IdentityListResponse>(url, {
+        ...options,
+        cache: 'no-store',
+        authToken: resolveAuthToken(authToken, baseRequest),
+      });
+    },
+
+    /**
+     * Re-scope the session to a chosen principal uuid (must be one of the
+     * principals sharing this session's contact). Returns fresh access/refresh
+     * tokens scoped to that principal.
+     */
+    async selectPrincipal(
+      baseRequest: BaseRequest,
+      principalUuid: string,
+      authToken?: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<SelectPrincipalResponse> {
+      const url = privacyCenterUrl(baseRequest, '/identities/select');
+      return privacyCenterApiFetch<SelectPrincipalResponse>(url, {
+        ...options,
+        method: 'POST',
+        body: JSON.stringify({ uuid: principalUuid }),
+        authToken: resolveAuthToken(authToken, baseRequest),
+      });
+    },
+
     /**
      * Get receipts (privacy center) — consent receipts for the authenticated user
      */
@@ -547,8 +698,13 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
       if (params.created_before) queryParams.append("created_before", params.created_before);
       if (params.language) queryParams.append("language", params.language);
       const queryString = queryParams.toString();
-      // Receipts are served by the Go ledger (paginated list under /public/...).
-      const url = ledgerUrl(baseRequest, `/receipts${queryString ? `?${queryString}` : ""}`);
+      // With a ledger configured, receipts are served by the Go ledger
+      // (paginated list under /public/...); otherwise the legacy Python
+      // privacy-center list is used. normalizeReceipts tolerates both envelopes.
+      const receiptsSuffix = `/receipts${queryString ? `?${queryString}` : ""}`;
+      const url = useLedger()
+        ? ledgerUrl(baseRequest, receiptsSuffix)
+        : privacyCenterUrl(baseRequest, receiptsSuffix);
       return privacyCenterApiFetch<unknown>(url, {
         ...options,
         method: "GET",
@@ -568,13 +724,25 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
       receiptUuid: string,
       authToken?: string
     ): Promise<Blob> {
-      // The ledger serves the receipt PDF at /receipts/{uuid}/download; the
-      // receipt_uuid comes from the ledger list above, so both must be the ledger.
-      const url = ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`);
+      // The ledger serves the receipt PDF at /receipts/{uuid}/download, the
+      // legacy Python service at /receipts/{uuid}/pdf. The receiptUuid always
+      // comes from the same-mode list above, so list and download stay consistent.
+      const url = useLedger()
+        ? ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`)
+        : privacyCenterUrl(baseRequest, `/receipts/${receiptUuid}/pdf`);
       const token = resolveAuthToken(authToken, baseRequest);
       const requestHeaders = new Headers();
       requestHeaders.set("Accept", "application/pdf");
-      if (token) {
+      // Sandbox PoC: send the single X-Consent-Token header instead of the JWT
+      // bearer. The receipt PDF download identifies the principal by receiptUuid
+      // (already scoped to the sandbox subject via the same-mode list), so no
+      // extra identity payload is needed here.
+      const sandboxHeaders = sandboxAuthHeaders();
+      if (sandboxHeaders) {
+        Object.entries(sandboxHeaders).forEach(([key, value]) => {
+          requestHeaders.set(key, value);
+        });
+      } else if (token) {
         const trimmedToken = token.trim();
         requestHeaders.set(
           "Authorization",
@@ -617,6 +785,9 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
       if (offset !== undefined) queryParams.append("offset", offset.toString());
       if (limit !== undefined) queryParams.append("limit", limit.toString());
       if (language) queryParams.append("language", language);
+      // Sandbox mode: the acting identity travels as query params
+      // (primary_email / primary_mobile); the credential is the X-Consent-Token header.
+      appendSandboxIdentity(queryParams);
       const queryString = queryParams.toString();
       const url = privacyCenterUrl(baseRequest, `/cases?${queryString}`);
       return privacyCenterApiFetch<unknown>(url, {
@@ -635,7 +806,9 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
       caseUuid: string,
       authToken?: string
     ): Promise<CaseMessage[]> {
-      const url = caseUrl(baseRequest, caseUuid, '/messages');
+      // Sandbox mode: the acting identity travels as query params
+      // (primary_email / primary_mobile); the credential is the X-Consent-Token header.
+      const url = caseUrl(baseRequest, caseUuid, `/messages${sandboxIdentitySuffix()}`);
       return privacyCenterApiFetch<CaseMessage[]>(url, {
         authToken: resolveAuthToken(authToken, baseRequest),
       });
@@ -651,7 +824,9 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
       documentUuids: string[],
       authToken?: string
     ): Promise<CaseMessage> {
-      const url = caseUrl(baseRequest, caseUuid, '/messages');
+      // Sandbox mode: the acting identity travels as query params
+      // (primary_email / primary_mobile); the credential is the X-Consent-Token header.
+      const url = caseUrl(baseRequest, caseUuid, `/messages${sandboxIdentitySuffix()}`);
       return privacyCenterApiFetch<CaseMessage>(url, {
         method: 'POST',
         body: JSON.stringify({ body, document_uuids: documentUuids }),
@@ -668,7 +843,9 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
       file: File,
       authToken?: string
     ): Promise<UploadDocumentResponse> {
-      const url = caseUrl(baseRequest, caseUuid, '/upload-document');
+      // Sandbox mode: the acting identity travels as query params
+      // (primary_email / primary_mobile); the credential is the X-Consent-Token header.
+      const url = caseUrl(baseRequest, caseUuid, `/upload-document${sandboxIdentitySuffix()}`);
       const formData = new FormData();
       formData.append('file', file, file.name); // field name must be exactly "file"
       // "payload" is required by the privacy-center endpoint (omitting it causes 422)

package/src/RedactoPrivacyCenter/api/fetcher.ts

@@ -1,3 +1,5 @@
+import { sandboxAuthHeaders } from "../lib/sandbox";
+
 /**
  * Options for apiFetch function
  */
@@ -125,16 +127,29 @@ export async function apiFetch<T>(
     }
   }
 
-  // Add auth token AFTER custom headers to ensure it's never overridden
+  // Add auth AFTER custom headers so it's never overridden. Only for calls that
+  // opt into auth (a `getAuthToken` is supplied) — public calls like org
+  // branding (which hit the user server, not consent-server) stay unauthenticated
+  // and must NOT receive the sandbox headers.
   if (getAuthToken) {
-    const token = await getAuthToken();
-    if (token) {
-      // Use the exact header format that works in other parts of the codebase
-      // Other working API calls use 'X-Auth-Token' (capital A and T, rest lowercase)
-      const trimmedToken = token.trim();
-      requestHeaders.set("X-Auth-Token", trimmedToken);
-      // Also set lowercase for compatibility (some servers are case-sensitive)
-      requestHeaders.set("x-auth-token", trimmedToken);
+    // Sandbox PoC: send the single X-Consent-Token header instead of the session
+    // token. The acting identity travels in the request payload (injected by the
+    // client call sites), not a header.
+    const sandboxHeaders = sandboxAuthHeaders();
+    if (sandboxHeaders) {
+      Object.entries(sandboxHeaders).forEach(([key, value]) => {
+        requestHeaders.set(key, value);
+      });
+    } else {
+      const token = await getAuthToken();
+      if (token) {
+        // Use the exact header format that works in other parts of the codebase
+        // Other working API calls use 'X-Auth-Token' (capital A and T, rest lowercase)
+        const trimmedToken = token.trim();
+        requestHeaders.set("X-Auth-Token", trimmedToken);
+        // Also set lowercase for compatibility (some servers are case-sensitive)
+        requestHeaders.set("x-auth-token", trimmedToken);
+      }
     }
   }
 

package/src/RedactoPrivacyCenter/components/AppShell/AppShell.tsx

@@ -214,6 +214,34 @@ export default function AppShell({
               var(--pc-bg-shell) 100%
             );
           }
+          .pc-shell-user-menu-identity {
+            display: flex;
+            flex-direction: column;
+            gap: 2px;
+            min-width: 0;
+            flex: 1;
+          }
+          .pc-shell-user-menu-identity-email {
+            font-size: 13px;
+            font-weight: 600;
+            color: var(--pc-text-primary);
+            line-height: 1.3;
+            overflow: hidden;
+            text-overflow: ellipsis;
+            white-space: nowrap;
+            min-width: 0;
+          }
+          .pc-shell-user-menu-identity-id {
+            font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+            font-size: 11px;
+            font-weight: 500;
+            color: var(--pc-text-secondary);
+            line-height: 1.3;
+            overflow: hidden;
+            text-overflow: ellipsis;
+            white-space: nowrap;
+            min-width: 0;
+          }
           .pc-popover.pc-shell-user-menu-popover {
             border-radius: 12px !important;
             overflow: hidden !important;