@redacto.io/consent-sdk-react 10.0.0-beta.0 → 10.0.0-beta.11

package/tests/Form.test.tsx

@@ -140,13 +140,16 @@ vi.mock('../src/RedactoPrivacyCenter/context/AuthContext', () => {
   return { useAuth: () => auth };
 });
 
-vi.mock('../src/RedactoPrivacyCenter/context/BaseUrlContext', () => {
-  const base = {
-    consentClient: { get: () => Promise.resolve(null), post: () => Promise.resolve(null) },
-    baseUrl: 'https://consent.test',
-  };
-  return { useBaseUrl: () => base };
-});
+// Mutable so individual tests can drop `ledgerBaseUrl` to exercise the legacy
+// (no-ledger) mode; beforeEach restores the ledger default.
+const baseUrlStub = vi.hoisted(() => ({
+  consentClient: { get: () => Promise.resolve(null), post: () => Promise.resolve(null) },
+  baseUrl: 'https://consent.test',
+  ledgerBaseUrl: 'https://ledger.test/consent-ledger' as string | undefined,
+}));
+vi.mock('../src/RedactoPrivacyCenter/context/BaseUrlContext', () => ({
+  useBaseUrl: () => baseUrlStub,
+}));
 
 vi.mock('../src/RedactoPrivacyCenter/context/OrganizationContext', () => {
   const org = {
@@ -481,6 +484,8 @@ describe('Form (P2-SDK-3)', () => {
   beforeEach(() => {
     createCaseRequest.mockReset();
     getFormData.mockReset();
+    fetchUserConsents.mockReset();
+    baseUrlStub.ledgerBaseUrl = 'https://ledger.test/consent-ledger';
     sessionStorage.clear();
   });
 
@@ -519,6 +524,184 @@ describe('Form (P2-SDK-3)', () => {
     expect(submitButton.disabled).toBe(true);
   });
 
+  it('runs the picker overlay against the legacy endpoint when no ledgerBaseUrl is configured', async () => {
+    // `getUserConsents` serves the same grouped payload from either backend
+    // (ledger `/public/...` or Python `/dsar/privacy-center/...`), so the
+    // overlay must run in both modes — Python's form/data no longer emits
+    // product groups, and skipping the read leaves the picker empty.
+    baseUrlStub.ledgerBaseUrl = undefined;
+    setupSession();
+    fetchUserConsents.mockResolvedValue(null);
+    getFormData.mockResolvedValue(
+      makeFormData({
+        direct_groups: [
+          makeGroup(),
+          makeGroup({
+            product_uuid: 'prod-direct-2',
+            product_name: 'Acme Rewards',
+            purposes: [basePurpose('purp-2', 'Analytics')],
+          }),
+        ],
+      }),
+    );
+
+    render(<Form onCreateRequest={vi.fn()} />);
+    await waitFor(() => expect(getFormData).toHaveBeenCalled());
+    await waitFor(() => expect(fetchUserConsents).toHaveBeenCalled());
+
+    pickRequestType(RequestTypeEnum.ERASURE);
+    await waitFor(() => {
+      expect(screen.getByText('Acme Loyalty')).toBeInTheDocument();
+    });
+  });
+
+  it('runs the ledger picker overlay when ledgerBaseUrl is configured', async () => {
+    setupSession();
+    getFormData.mockResolvedValue(
+      makeFormData({ direct_groups: [makeGroup()] }),
+    );
+
+    render(<Form onCreateRequest={vi.fn()} />);
+    await waitFor(() => expect(getFormData).toHaveBeenCalled());
+
+    await waitFor(() => expect(fetchUserConsents).toHaveBeenCalled());
+  });
+
+  it('keeps the form/data groups when user-consents comes back with no groups', async () => {
+    // A successful-but-empty read must never overwrite groups form/data did
+    // supply — that turned a populated picker into "No products available".
+    setupSession();
+    fetchUserConsents.mockResolvedValue({ direct: [], nominated: [] });
+    getFormData.mockResolvedValue(
+      makeFormData({
+        direct_groups: [
+          makeGroup(),
+          makeGroup({
+            product_uuid: 'prod-direct-2',
+            product_name: 'Acme Rewards',
+            purposes: [basePurpose('purp-2', 'Analytics')],
+          }),
+        ],
+      }),
+    );
+
+    render(<Form onCreateRequest={vi.fn()} />);
+    await waitFor(() => expect(fetchUserConsents).toHaveBeenCalled());
+
+    pickRequestType(RequestTypeEnum.ERASURE);
+    await waitFor(() => {
+      expect(screen.getByText('Acme Loyalty')).toBeInTheDocument();
+    });
+    expect(screen.getByText('Acme Rewards')).toBeInTheDocument();
+    expect(screen.queryByText('No products available')).not.toBeInTheDocument();
+  });
+
+  it('falls back to the legacy flat purposes list when the backend exposes no product groups', async () => {
+    // Pre-grouping backends return purposes without any product grouping.
+    // Those consents must stay reachable under one synthetic group instead
+    // of the picker claiming the principal has none.
+    setupSession();
+    fetchUserConsents.mockResolvedValue(null);
+    getFormData.mockResolvedValue(
+      makeFormData({
+        direct_groups: [],
+        nominated_groups: [],
+        purposes: [{ purpose: basePurpose('purp-flat', 'Marketing') }],
+      }),
+    );
+
+    render(<Form onCreateRequest={vi.fn()} />);
+    await waitFor(() => expect(getFormData).toHaveBeenCalled());
+
+    pickRequestType(RequestTypeEnum.ACCESS);
+
+    await waitFor(() => {
+      expect(screen.getByText('Your data')).toBeInTheDocument();
+    });
+    expect(screen.getByText('Marketing')).toBeInTheDocument();
+    expect(screen.queryByText('No products available')).not.toBeInTheDocument();
+  });
+
+  it('keeps the empty state when the flat purposes carry no data elements', async () => {
+    // Nothing selectable survives `buildGroupPurposes`, so the synthetic group
+    // would render an unusable panel — the empty state is the honest answer.
+    setupSession();
+    fetchUserConsents.mockResolvedValue(null);
+    getFormData.mockResolvedValue(
+      makeFormData({
+        direct_groups: [],
+        nominated_groups: [],
+        purposes: [{ purpose: basePurpose('purp-flat', 'Marketing', []) }],
+      }),
+    );
+
+    render(<Form onCreateRequest={vi.fn()} />);
+    await waitFor(() => expect(getFormData).toHaveBeenCalled());
+
+    pickRequestType(RequestTypeEnum.ACCESS);
+
+    await waitFor(() => {
+      expect(screen.getByText('No products available')).toBeInTheDocument();
+    });
+    expect(screen.queryByText('Your data')).not.toBeInTheDocument();
+  });
+
+  it('submits the legacy flat fallback as an org-level case without a product anchor', async () => {
+    // The synthetic group has no server-side product, so the case must go up
+    // in the pre-grouping org-level shape rather than carrying a made-up
+    // `product_uuid` the backend cannot resolve.
+    setupSession();
+    fetchUserConsents.mockResolvedValue(null);
+    getFormData.mockResolvedValue(
+      makeFormData({
+        direct_groups: [],
+        nominated_groups: [],
+        purposes: [{ purpose: basePurpose('purp-flat', 'Marketing') }],
+      }),
+    );
+    createCaseRequest.mockResolvedValueOnce({
+      case_id: 'CASE-FLAT',
+      uuid: 'uuid-flat',
+    });
+
+    render(<Form onCreateRequest={vi.fn()} />);
+    await waitFor(() => expect(getFormData).toHaveBeenCalled());
+
+    pickRequestType(RequestTypeEnum.ACCESS);
+
+    await waitFor(() => {
+      expect(screen.getByText('Marketing')).toBeInTheDocument();
+    });
+
+    const marketingCheckbox = screen
+      .getByText('Marketing')
+      .closest('label')
+      ?.querySelector('input[type="checkbox"]') as HTMLInputElement | null;
+    expect(marketingCheckbox).toBeTruthy();
+    fireEvent.click(marketingCheckbox!);
+
+    const confirmCheckbox = (
+      screen.getAllByRole('checkbox') as HTMLInputElement[]
+    ).find((c) => c.closest('label')?.textContent?.includes('I confirm'));
+    expect(confirmCheckbox).toBeTruthy();
+    fireEvent.click(confirmCheckbox!);
+
+    const submitButton = screen.getByRole('button', { name: /^submit$/i });
+    expect(submitButton).not.toBeDisabled();
+    await act(async () => {
+      fireEvent.click(submitButton);
+    });
+
+    await waitFor(() => expect(createCaseRequest).toHaveBeenCalledTimes(1));
+
+    const payload = createCaseRequest.mock.calls[0][2];
+    expect('product_uuid' in payload).toBe(false);
+    expect('data_principal_uuid' in payload).toBe(false);
+    expect(payload.request_details.purposes).toEqual([
+      { purpose_uuid: 'purp-flat', data_element_uuids: ['purp-flat-de1'] },
+    ]);
+  });
+
   it('renders the product step for DSAR types when direct_groups is present', async () => {
     setupSession();
     const direct = makeGroup({

package/tests/RevokeWarningMessage.test.tsx

@@ -0,0 +1,151 @@
+import { render, screen } from '@testing-library/react';
+import { describe, it, expect, vi } from 'vitest';
+
+// react-i18next is an optional peer dep that is not installed in this
+// package's node_modules. Stub it with a minimal `useTranslation` that
+// resolves the keys used by the components under test, honouring the inline
+// English fallback passed as the 2nd argument (mirrors the real i18next
+// behaviour when a key is missing).
+vi.mock('react-i18next', () => {
+  const en: Record<string, string> = {
+    modifyConsent: 'Modify Consent',
+    closeModal: 'Close',
+    cancel: 'Cancel',
+    revokeConsent: 'Revoke Consent',
+    revokeConsentWarning: 'If you revoke this consent, you may lose access.',
+    regrantConsent: 'Regrant Consent',
+    regrantConsentWarning: 'Regranting will restore this consent.',
+    aboutToModifyConsent: 'You are about to modify this consent.',
+    aboutToRegrantConsent: 'You are about to regrant this consent.',
+    noDataElementsAvailable: 'No data elements available',
+    noActionsAvailable: 'No actions available for this record.',
+  };
+  const interpolate = (template: string, vars?: Record<string, unknown>) =>
+    template.replace(/\{\{(\w+)\}\}/g, (_match, key: string) => {
+      const value = vars?.[key];
+      return value === undefined || value === null ? '' : String(value);
+    });
+  // Supports the `t(key, fallbackString)` and `t(key, opts)` call shapes used
+  // across the components. When the key is unknown, fall back to the inline
+  // English string if one was supplied, otherwise echo the key.
+  const t = (key: string, second?: unknown, opts?: Record<string, unknown>) => {
+    const fallback = typeof second === 'string' ? second : undefined;
+    const interpolationOpts =
+      typeof second === 'object' && second !== null
+        ? (second as Record<string, unknown>)
+        : opts;
+    const template = en[key] ?? fallback ?? key;
+    return interpolate(template, interpolationOpts);
+  };
+  return {
+    useTranslation: () => ({ t, i18n: { language: 'en' } }),
+  };
+});
+
+// Icon peer deps — stub the icons used by the modal.
+vi.mock('lucide-react', () => ({
+  ChevronDownIcon: () => null,
+  X: () => null,
+  Smartphone: () => null,
+  LaptopMinimal: () => null,
+}));
+
+vi.mock('react-icons/pi', () => ({
+  PiWarningCircleBold: () => null,
+}));
+
+import { ModifyConsentModal } from '../src/RedactoPrivacyCenter/components/ModifyConsentModal';
+import { NavigationProvider } from '../src/RedactoPrivacyCenter/context/NavigationContext';
+import { ConsentStatusEnum } from '../src/RedactoPrivacyCenter/lib/types';
+import type { ConsentModalRecord } from '../src/RedactoPrivacyCenter/lib/types';
+
+const DEFAULT_WARNING = 'If you revoke this consent, you may lose access.';
+const CUSTOM_WARNING =
+  'Revoking marketing consent will stop all promotional emails immediately.';
+
+const makeRecord = (
+  overrides: Partial<ConsentModalRecord> = {},
+): ConsentModalRecord => ({
+  purpose_uuid: 'purpose-1',
+  name: 'Marketing analytics',
+  description: 'Improve product recommendations',
+  status: ConsentStatusEnum.ACTIVE,
+  given_date: '2026-01-01T00:00:00Z',
+  valid_till: null,
+  method: 'WEB',
+  data_elements: [],
+  link_reason: null,
+  product_uuid: 'prod-1',
+  product_name: 'Acme Loyalty',
+  product_description: null,
+  nominator: null,
+  ...overrides,
+});
+
+const renderModal = (record: ConsentModalRecord) =>
+  render(
+    <NavigationProvider>
+      <ModifyConsentModal
+        isOpen
+        onClose={vi.fn()}
+        selectedRecord={record}
+        isLoading={false}
+        onManageConsent={vi.fn()}
+      />
+    </NavigationProvider>,
+  );
+
+describe('per-purpose revoke warning message', () => {
+  it('shows the custom warning when revoke_warning_message is set on a revoke record', () => {
+    renderModal(makeRecord({ revoke_warning_message: CUSTOM_WARNING }));
+
+    expect(screen.getByText(CUSTOM_WARNING)).toBeInTheDocument();
+    // The localized default must be suppressed when a custom message exists.
+    expect(screen.queryByText(DEFAULT_WARNING)).not.toBeInTheDocument();
+    // Button label is untouched — still the default revoke copy.
+    expect(
+      screen.getByRole('button', { name: 'Revoke Consent' }),
+    ).toBeInTheDocument();
+  });
+
+  it('shows the localized default warning when revoke_warning_message is null', () => {
+    renderModal(makeRecord({ revoke_warning_message: null }));
+
+    expect(screen.getByText(DEFAULT_WARNING)).toBeInTheDocument();
+    expect(
+      screen.getByRole('button', { name: 'Revoke Consent' }),
+    ).toBeInTheDocument();
+  });
+
+  it('shows the localized default warning when revoke_warning_message is an empty string', () => {
+    renderModal(makeRecord({ revoke_warning_message: '' }));
+
+    expect(screen.getByText(DEFAULT_WARNING)).toBeInTheDocument();
+  });
+
+  it('shows the localized default warning when revoke_warning_message is absent (older backends)', () => {
+    renderModal(makeRecord()); // no `revoke_warning_message` field
+
+    expect(screen.getByText(DEFAULT_WARNING)).toBeInTheDocument();
+    expect(
+      screen.getByRole('button', { name: 'Revoke Consent' }),
+    ).toBeInTheDocument();
+  });
+
+  it('does not apply the custom revoke warning to the regrant branch', () => {
+    // A withdrawn record uses the regrant action; the per-purpose revoke
+    // message must never leak into the regrant warning.
+    renderModal(
+      makeRecord({
+        status: ConsentStatusEnum.WITHDRAWN,
+        revoke_warning_message: CUSTOM_WARNING,
+      }),
+    );
+
+    expect(screen.getByText('Regranting will restore this consent.')).toBeInTheDocument();
+    expect(screen.queryByText(CUSTOM_WARNING)).not.toBeInTheDocument();
+    expect(
+      screen.getByRole('button', { name: 'Regrant Consent' }),
+    ).toBeInTheDocument();
+  });
+});

package/tests/consentClient.test.ts

@@ -0,0 +1,217 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { createConsentClient } from '../src/RedactoPrivacyCenter/api/client';
+import type { BaseRequest } from '../src/RedactoPrivacyCenter/api/client';
+
+// URL routing contract for the five consent read/write methods that moved to
+// the Go ledger in PR #438. With a ledgerBaseUrl they must hit the ledger's
+// /public/... paths; without one they must fall back to the legacy Python
+// /dsar/privacy-center paths (prod has no ledger — see PR #438/#460 regression
+// where the silent baseUrl fallback 404'd the Privacy Center).
+
+const BASE_URL = 'https://consent.test';
+const LEDGER_URL = 'https://ledger.test/consent-ledger';
+const LEGACY_PREFIX =
+  'https://consent.test/organisations/org-1/workspaces/ws-1/dsar/privacy-center';
+const LEDGER_PREFIX =
+  'https://ledger.test/consent-ledger/public/organisations/org-1/workspaces/ws-1';
+
+const baseRequest: BaseRequest = {
+  organisationUuid: 'org-1',
+  workspaceUuid: 'ws-1',
+  authToken: 'jwt-token',
+};
+
+const jsonResponse = () =>
+  new Response(JSON.stringify({}), {
+    status: 200,
+    headers: { 'Content-Type': 'application/json' },
+  });
+
+const pdfResponse = () =>
+  new Response(new Blob(['%PDF'], { type: 'application/pdf' }), {
+    status: 200,
+    headers: { 'Content-Type': 'application/pdf' },
+  });
+
+const mockFetch = vi.fn();
+
+const fetchedUrl = (): string => String(mockFetch.mock.calls[0]?.[0]);
+
+const fetchedBody = (): Record<string, unknown> =>
+  JSON.parse(String(mockFetch.mock.calls[0]?.[1]?.body)) as Record<
+    string,
+    unknown
+  >;
+
+beforeEach(() => {
+  mockFetch.mockReset();
+  mockFetch.mockImplementation(() => Promise.resolve(jsonResponse()));
+  vi.stubGlobal('fetch', mockFetch);
+});
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe('createConsentClient — legacy mode (no ledgerBaseUrl)', () => {
+  const client = createConsentClient(BASE_URL);
+
+  it('routes getUserConsents to the legacy dsar/privacy-center path', async () => {
+    await client.getUserConsents(baseRequest, { offset: 0, limit: 10 });
+    expect(fetchedUrl()).toBe(
+      `${LEGACY_PREFIX}/user-consents?offset=0&limit=10`,
+    );
+  });
+
+  it('routes getGroupPurposes to the legacy dsar/privacy-center path', async () => {
+    await client.getGroupPurposes(baseRequest, 'prod-1', { limit: 5 });
+    expect(fetchedUrl()).toBe(
+      `${LEGACY_PREFIX}/user-consents/prod-1/purposes?limit=5`,
+    );
+  });
+
+  it('routes manageConsent to the legacy manage-consent endpoint with the legacy body and no noticeUuid requirement', async () => {
+    await client.manageConsent(
+      baseRequest,
+      'purp-1',
+      'jane@example.com',
+      'revoke',
+      undefined,
+      undefined,
+      'nominator@example.com',
+      ['de-1'],
+      'prod-1',
+    );
+    expect(fetchedUrl()).toBe(`${LEGACY_PREFIX}/manage-consent?status=revoke`);
+    expect(fetchedBody()).toEqual({
+      purpose_uuid: 'purp-1',
+      contact: 'jane@example.com',
+      nominator_contact: 'nominator@example.com',
+      data_element_uuids: ['de-1'],
+      product_uuid: 'prod-1',
+    });
+  });
+
+  it('records the selected language in the legacy manage-consent body', async () => {
+    await client.manageConsent(
+      baseRequest,
+      'purp-1',
+      'jane@example.com',
+      'revoke',
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      'doi',
+    );
+    expect(fetchedBody()).toMatchObject({ language: 'doi' });
+  });
+
+  it('routes getReceipts to the legacy dsar/privacy-center path', async () => {
+    await client.getReceipts(baseRequest, { skip: 0, limit: 10 });
+    expect(fetchedUrl()).toBe(`${LEGACY_PREFIX}/receipts?skip=0&limit=10`);
+  });
+
+  it('routes getReceiptPdf to the legacy /pdf path', async () => {
+    mockFetch.mockImplementation(() => Promise.resolve(pdfResponse()));
+    await client.getReceiptPdf(baseRequest, 'r-1');
+    expect(fetchedUrl()).toBe(`${LEGACY_PREFIX}/receipts/r-1/pdf`);
+  });
+
+  it('appends the language query param to getActivities when provided', async () => {
+    await client.getActivities(baseRequest, 0, 15, 'doi');
+    expect(fetchedUrl()).toContain('language=doi');
+  });
+
+  it('omits the language query param from getActivities for the default language', async () => {
+    await client.getActivities(baseRequest, 0, 15);
+    expect(fetchedUrl()).not.toContain('language=');
+  });
+});
+
+describe('createConsentClient — ledger mode (ledgerBaseUrl set)', () => {
+  // Trailing slash must be trimmed from the configured ledger base.
+  const client = createConsentClient(BASE_URL, `${LEDGER_URL}/`);
+
+  it('routes getUserConsents to the ledger public path', async () => {
+    await client.getUserConsents(baseRequest, { offset: 0, limit: 10 });
+    expect(fetchedUrl()).toBe(
+      `${LEDGER_PREFIX}/user-consents?offset=0&limit=10`,
+    );
+  });
+
+  it('routes getGroupPurposes to the ledger public path', async () => {
+    await client.getGroupPurposes(baseRequest, 'prod-1', { limit: 5 });
+    expect(fetchedUrl()).toBe(
+      `${LEDGER_PREFIX}/user-consents/prod-1/purposes?limit=5`,
+    );
+  });
+
+  it('routes manageConsent to the ledger submit-consent with a partial payload', async () => {
+    await client.manageConsent(
+      baseRequest,
+      'purp-1',
+      'jane@example.com',
+      'revoke',
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      'notice-1',
+      [{ uuid: 'de-1', selected: true }],
+    );
+    expect(fetchedUrl()).toBe(`${LEDGER_PREFIX}/submit-consent`);
+    expect(fetchedBody()).toMatchObject({
+      notice_uuid: 'notice-1',
+      partial: true,
+      purposes: [
+        {
+          purpose_uuid: 'purp-1',
+          selected: false,
+          data_elements: [{ uuid: 'de-1', selected: false }],
+        },
+      ],
+    });
+  });
+
+  it('records the selected language in the ledger partial submit body', async () => {
+    await client.manageConsent(
+      baseRequest,
+      'purp-1',
+      'jane@example.com',
+      'revoke',
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      'notice-1',
+      [{ uuid: 'de-1', selected: true }],
+      'doi',
+    );
+    expect(fetchedBody()).toMatchObject({ language: 'doi' });
+  });
+
+  it('throws from manageConsent when noticeUuid is missing', async () => {
+    await expect(
+      client.manageConsent(baseRequest, 'purp-1', 'jane@example.com', 'revoke'),
+    ).rejects.toThrow('notice_uuid is required');
+    expect(mockFetch).not.toHaveBeenCalled();
+  });
+
+  it('routes getReceipts to the ledger public path', async () => {
+    await client.getReceipts(baseRequest, { skip: 0, limit: 10 });
+    expect(fetchedUrl()).toBe(`${LEDGER_PREFIX}/receipts?skip=0&limit=10`);
+  });
+
+  it('routes getReceiptPdf to the ledger /download path', async () => {
+    mockFetch.mockImplementation(() => Promise.resolve(pdfResponse()));
+    await client.getReceiptPdf(baseRequest, 'r-1');
+    expect(fetchedUrl()).toBe(`${LEDGER_PREFIX}/receipts/r-1/download`);
+  });
+});

package/tests/manageConsentServer.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import { manageConsentServer } from '../src/RedactoPrivacyCenter/api/actions';
+import type { createConsentClient } from '../src/RedactoPrivacyCenter/api/client';
+
+// manageConsentServer must honor the legacy Python response's `success` flag
+// (a 200 with { success: false } is a failure) while still treating the Go
+// ledger's ConsentEventResponse (no `success` key) as resolved-on-2xx.
+
+type ConsentClient = ReturnType<typeof createConsentClient>;
+
+const makeParams = (result: unknown) => ({
+  organizationId: 'org-1',
+  workspaceId: 'ws-1',
+  purposeId: 'purp-1',
+  contact: 'jane@example.com',
+  action: 'revoke' as const,
+  authToken: 'jwt-token',
+  consentClient: {
+    manageConsent: vi.fn().mockResolvedValue(result),
+  } as unknown as ConsentClient,
+});
+
+describe('manageConsentServer success detection', () => {
+  it('returns false for a legacy { success: false } response', async () => {
+    await expect(manageConsentServer(makeParams({ success: false }))).resolves.toBe(false);
+  });
+
+  it('returns true for a legacy { success: true } response', async () => {
+    await expect(manageConsentServer(makeParams({ success: true }))).resolves.toBe(true);
+  });
+
+  it('returns true for a ledger ConsentEventResponse (no success flag)', async () => {
+    await expect(
+      manageConsentServer(makeParams({ consent_event_uuid: 'evt-1' })),
+    ).resolves.toBe(true);
+  });
+});