@redacto.io/consent-sdk-react 10.0.0-beta.0 → 10.0.0-beta.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redacto.io/consent-sdk-react",
-  "version": "10.0.0-beta.0",
+  "version": "10.0.0-beta.11",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
   "types": "dist/index.d.ts",

package/src/RedactoNoticeAssisted/RedactoNoticeAssisted.test.tsx

@@ -18,6 +18,7 @@ import {
 } from "./api";
 import type { ConsentContent, TTSAudioUrlsResponse } from "./api/types";
 import { ApiError } from "../shared/api-errors";
+import { fetchNoticeConsentStatusForScope } from "../shared/notice-consent-status";
 import { makeStaticT } from "./i18n";
 
 vi.mock("./api", () => ({
@@ -28,12 +29,26 @@ vi.mock("./api", () => ({
   submitAssistedConsent: vi.fn(),
 }));
 
+// Mock only the ledger check-consent network read; keep the real
+// isNoticeFullyConsented predicate so the already-consented decision is exercised.
+vi.mock("../shared/notice-consent-status", async (importActual) => {
+  const actual =
+    await importActual<typeof import("../shared/notice-consent-status")>();
+  return {
+    ...actual,
+    fetchNoticeConsentStatusForScope: vi.fn(),
+  };
+});
+
+const LEDGER_BASE_URL = "https://ledger.example.test/consent-ledger";
+
 const otpLength = ASSISTED_CONFIG.otpLength;
 const mockedFetch = vi.mocked(fetchAssistedNotice);
 const mockedFetchTTS = vi.mocked(fetchAssistedTTSAudioUrls);
 const mockedCreateOtp = vi.mocked(createOtp);
 const mockedVerifyOtp = vi.mocked(verifyOtp);
 const mockedSubmitConsent = vi.mocked(submitAssistedConsent);
+const mockedFetchScope = vi.mocked(fetchNoticeConsentStatusForScope);
 
 const OTP_DETAIL = {
   uuid: "otp-1",
@@ -226,6 +241,9 @@ describe("RedactoNoticeAssisted", () => {
     mockedCreateOtp.mockResolvedValue(OTP_DETAIL);
     mockedVerifyOtp.mockResolvedValue(VERIFY_DETAIL);
     mockedSubmitConsent.mockResolvedValue(null);
+    // Default: ledger reports no prior full consent, so flows proceed to submit.
+    mockedFetchScope.mockReset();
+    mockedFetchScope.mockResolvedValue(null);
   });
 
   it("fetches with the public-notice props (no auth)", async () => {
@@ -604,6 +622,75 @@ describe("RedactoNoticeAssisted", () => {
     ).not.toBeInTheDocument();
   });
 
+  // ── Go ledger (ledgerBaseUrl) ─────────────────────────────────────────────
+  // Drives the full notice → OTP → Confirm flow with a notice that carries a
+  // notice_uuid (so the check-consent read runs), and returns the onComplete spy.
+  const runConfirmFlow = async (extraProps: Record<string, unknown>) => {
+    mockedFetch.mockResolvedValue(NOTICE_WITH_AUDIO);
+    const onComplete = vi.fn();
+    render(
+      <RedactoNoticeAssisted {...PROPS} onComplete={onComplete} {...extraProps} />,
+    );
+    await screen.findByRole("heading", { name: "EA Sports" });
+    selectRequired();
+    fireEvent.click(screen.getByRole("button", { name: "Agree" }));
+    fireEvent.change(screen.getByLabelText("Mobile number"), {
+      target: { value: "9876543210" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Send OTP" }));
+    await screen.findByText(/OTP sent to/);
+    typeOtp("1".repeat(otpLength));
+    fireEvent.click(screen.getByRole("button", { name: "Confirm OTP" }));
+    return onComplete;
+  };
+
+  it("routes the write through ledgerBaseUrl and submits when not already consented", async () => {
+    const onComplete = await runConfirmFlow({ ledgerBaseUrl: LEDGER_BASE_URL });
+
+    await waitFor(() => expect(mockedSubmitConsent).toHaveBeenCalledTimes(1));
+    // The check-consent read runs with props org/workspace + the OTP token.
+    expect(mockedFetchScope).toHaveBeenCalledWith(
+      expect.objectContaining({
+        accessToken: "access-token-1",
+        ledgerBaseUrl: LEDGER_BASE_URL,
+        organisationUuid: "org-1",
+        workspaceUuid: "ws-1",
+        noticeUuid: "ntc-1",
+      }),
+    );
+    // The submit carries ledgerBaseUrl so the api layer routes it to the ledger.
+    expect(mockedSubmitConsent).toHaveBeenCalledWith(
+      expect.objectContaining({ ledgerBaseUrl: LEDGER_BASE_URL }),
+    );
+    await waitFor(() => expect(onComplete).toHaveBeenCalledTimes(1));
+  });
+
+  it("short-circuits an already fully-consented principal via the ledger (no submit)", async () => {
+    mockedFetchScope.mockResolvedValue({
+      consented: true,
+      all_mandatory_active: true,
+      purposes: [],
+    });
+    const onComplete = await runConfirmFlow({ ledgerBaseUrl: LEDGER_BASE_URL });
+
+    await waitFor(() => expect(onComplete).toHaveBeenCalledTimes(1));
+    expect(mockedSubmitConsent).not.toHaveBeenCalled();
+  });
+
+  it("skips the ledger check-consent and stays on baseUrl when ledgerBaseUrl is absent", async () => {
+    const onComplete = await runConfirmFlow({});
+
+    await waitFor(() => expect(mockedSubmitConsent).toHaveBeenCalledTimes(1));
+    expect(mockedFetchScope).not.toHaveBeenCalled();
+    expect(mockedSubmitConsent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        ledgerBaseUrl: undefined,
+        baseUrl: "https://api.example.test/consent",
+      }),
+    );
+    await waitFor(() => expect(onComplete).toHaveBeenCalledTimes(1));
+  });
+
   // The verify endpoint returns English copy with no error_code, so the SDK
   // localizes by HTTP status + the `should_request_new` flag instead of echoing
   // the server message.

package/src/RedactoNoticeAssisted/RedactoNoticeAssisted.tsx

@@ -23,6 +23,10 @@ import type {
   TTSAudioUrlsResponse,
 } from "./api/types";
 import { ApiError } from "../shared/api-errors";
+import {
+  fetchNoticeConsentStatusForScope,
+  isNoticeFullyConsented,
+} from "../shared/notice-consent-status";
 import {
   toNativeLabel,
   toBcp47Code,
@@ -251,6 +255,7 @@ export const RedactoNoticeAssisted = ({
   workspaceUuid,
   noticeUuid,
   baseUrl,
+  ledgerBaseUrl,
   onDecline,
   onComplete,
 }: RedactoNoticeAssistedProps) => {
@@ -1207,6 +1212,26 @@ export const RedactoNoticeAssisted = ({
       }
       const token = verifyDetail.access_token;
 
+      // Post-cutover, consent records live in the Go ledger, so Python's 409
+      // CONSENT_ALREADY_PROVIDED can no longer be relied on. When a ledger is
+      // configured, ask it directly (org/workspace from props, OTP token as
+      // bearer) whether this principal has already fully consented and, if so,
+      // hand off without writing a duplicate consent event. Any failure returns
+      // null and falls through to the normal submit (graceful degradation).
+      if (ledgerBaseUrl) {
+        const ledgerStatus = await fetchNoticeConsentStatusForScope({
+          accessToken: token,
+          ledgerBaseUrl,
+          organisationUuid,
+          workspaceUuid,
+          noticeUuid: content.notice_uuid,
+        });
+        if (ledgerStatus && isNoticeFullyConsented(ledgerStatus)) {
+          handleSuccess();
+          return;
+        }
+      }
+
       // Map current selection onto the submit payload shape (required → selected).
       const submitPurposes = content.purposes.map((purpose) => ({
         ...purpose,
@@ -1224,6 +1249,7 @@ export const RedactoNoticeAssisted = ({
         organisationUuid,
         workspaceUuid,
         baseUrl,
+        ledgerBaseUrl,
         noticeUuid: content.notice_uuid,
         purposes: submitPurposes,
         language: toBcp47Code(selectedLanguage),
@@ -1255,6 +1281,7 @@ export const RedactoNoticeAssisted = ({
     otpUuid,
     otpValue,
     baseUrl,
+    ledgerBaseUrl,
     selectedPurposes,
     selectedDataElements,
     selectedLanguage,

package/src/RedactoNoticeAssisted/api/index.ts

@@ -160,6 +160,7 @@ export const submitAssistedConsent = async ({
   organisationUuid,
   workspaceUuid,
   baseUrl,
+  ledgerBaseUrl,
   noticeUuid,
   purposes,
   language,
@@ -196,7 +197,12 @@ export const submitAssistedConsent = async ({
     language: language || undefined,
   };
 
-  const url = `${publicScope(baseUrl, organisationUuid, workspaceUuid)}/submit-consent`;
+  // Route the write to the Go ledger when configured, else the legacy consent
+  // server. publicScope already applies `|| BASE_URL`, so this yields the
+  // standard `ledgerBaseUrl || baseUrl || BASE_URL` fallback used by the other
+  // notice components. Only submit-consent routes to the ledger; notice/OTP/TTS
+  // stay on baseUrl.
+  const url = `${publicScope(ledgerBaseUrl || baseUrl, organisationUuid, workspaceUuid)}/submit-consent`;
 
   const response = await fetch(url, {
     method: "POST",

package/src/RedactoNoticeAssisted/api/types.ts

@@ -94,6 +94,8 @@ export type SubmitAssistedConsentParams = {
   organisationUuid: string;
   workspaceUuid: string;
   baseUrl?: string;
+  /** Go ledger base URL — routes the write to the ledger; omit to use the legacy consent server. */
+  ledgerBaseUrl?: string;
   /** `notice_uuid` from the fetched active_config. */
   noticeUuid: string;
   /** Purposes carrying their current `selected` state + data elements. */

package/src/RedactoNoticeAssisted/i18n.ts

@@ -1248,60 +1248,6 @@ const as: StaticStrings = {
   close: "বন্ধ কৰক",
 };
 
-const bho: StaticStrings = {
-  useEmailInstead: "ईमेल इस्तेमाल करीं",
-  useMobileInstead: "मोबाइल इस्तेमाल करीं",
-  emailAddress: "ईमेल पता",
-  otpHelperEmail: "हमनी एह ईमेल पर एक बेर इस्तेमाल होखे वाला पासवर्ड भेजब।",
-  changeEmail: "ईमेल बदलीं",
-  expandDetails: "{name} के विवरण फैलाईं",
-  collapseDetails: "{name} के विवरण समेटीं",
-  selectAllFor: "{name} खातिर सभ डेटा तत्व चुनीं",
-  selectElement: "{name} चुनीं",
-  selectElementRequired: "{name} चुनीं (जरूरी)",
-  required: "जरूरी",
-  logoAlt: "लोगो",
-  selectLanguage: "भाषा चुनीं",
-  selectLanguageCurrent: "भाषा चुनीं. मौजूदा भाषा: {lang}",
-  opensInNewTab: "नया टैब में खुलेला",
-  audioStart: "ऑडियो प्लेबैक शुरू करीं",
-  audioPause: "ऑडियो प्लेबैक रोकीं",
-  talkbackStart: "टॉकबैक शुरू करीं",
-  talkbackPause: "टॉकबैक रोकीं",
-  mobileNumber: "मोबाइल नंबर",
-  otpHelper: "हमनी एह नंबर पर एक बेर इस्तेमाल होखे वाला पासवर्ड भेजब।",
-  otpSentTo: "ओटीपी (OTP) भेजल गइल",
-  changeMobile: "मोबाइल नंबर बदलीं",
-  enterNDigitOtp: "{count}-अंक के ओटीपी (OTP) डालीं",
-  otpDigit: "ओटीपी (OTP) अंक {index}",
-  resendIn: "{seconds} सेकंड में ओटीपी (OTP) फेर से भेजीं",
-  sending: "भेजल जा रहल बा…",
-  resendOtp: "ओटीपी (OTP) फेर से भेजीं",
-  getOtp: "ओटीपी (OTP) पाईं",
-  verifying: "सत्यापित कइल जा रहल बा…",
-  verifyOtp: "ओटीपी (OTP) सत्यापित करीं",
-  sendOtp: "ओटीपी (OTP) भेजीं",
-  confirmOtp: "ओटीपी (OTP) के पुष्टि करीं",
-  verifyWithOtp: "ओटीपी (OTP) से सत्यापित करीं",
-  editSelections: "चुनाव में बदलाव करीं",
-  otpIncorrect:
-    "रउरा डालल सत्यापन कोड गलत बा। कृपया जाँच करीं आ फेर से कोशिश करीं।",
-  otpExpired: "रउरा सत्यापन कोड के मियाद खतम हो गइल बा। कृपया नया कोड मांगीं।",
-  otpNotFound: "सत्यापन कोड ना मिलल। कृपया नया कोड मांगीं।",
-  otpVerifyFailed: "ओटीपी (OTP) के सत्यापन ना हो सकल। कृपया फेर से कोशिश करीं।",
-  otpSendFailed: "ओटीपी (OTP) ना भेजल जा सकल। कृपया फेर से कोशिश करीं।",
-  consentConfirmed: "सहमति के पुष्टि भइल",
-  recordedUnder: "ओटीपी (OTP) सत्यापित · {regulation} के तहत दर्ज भइल",
-  recordedUnderAt:
-    "ओटीपी (OTP) सत्यापित · {regulation} के तहत {time} बजे दर्ज भइल",
-  consentReferenceId: "सहमति संदर्भ आईडी",
-  proceed: "आगे बढ़ीं",
-  loadingNotice: "नोटिस लोड हो रहल बा",
-  loadFailedTitle: "सहमति नोटिस लोड ना हो सकल",
-  tryAgain: "कृपया फेर से कोसिस करीं।",
-  close: "बंद करीं",
-};
-
 const brx: StaticStrings = {
   useEmailInstead: "इमेल बाहाय",
   useMobileInstead: "मबाइल बाहाय",
@@ -1435,7 +1381,6 @@ export const STATIC_STRINGS: Record<string, StaticStrings> = {
   te,
   ur,
   as,
-  bho,
   brx,
   doi,
 };

package/src/RedactoNoticeAssisted/types.ts

@@ -17,6 +17,8 @@ export type RedactoNoticeAssistedProps = {
   noticeUuid: string;
   /** API base URL (defaults to the production consent API). */
   baseUrl?: string;
+  /** Go ledger base URL — routes the consent write to the ledger; omit to use the legacy consent server. */
+  ledgerBaseUrl?: string;
   /** Called when the agent/customer declines (host should unmount the modal). */
   onDecline?: () => void;
   /** Called when the agent clicks "Proceed" on the confirmed screen. */

package/src/RedactoNoticeConsent/RedactoNoticeConsent.test.tsx

@@ -26,11 +26,6 @@ vi.mock("./api", () => ({
   fetchTTSAudioUrls: vi.fn(),
   initiateGuardianVerification: vi.fn(),
   verifyGuardianStatus: vi.fn(),
-  // Defaults to resolving undefined, so the ledger consent-state overlay is
-  // skipped and the banner falls back to the Python-provided values the
-  // existing tests assert on.
-  fetchNoticeConsentStatus: vi.fn(),
-  buildLedgerConsentOverlay: vi.fn(),
 }));
 
 // Mock jwt-decode
@@ -529,7 +524,7 @@ describe("RedactoNoticeConsent", () => {
             noticeId: "notice-123",
             accessToken: "mock-token",
             refreshToken: "mock-refresh-token",
-            baseUrl: undefined,
+            baseUrl: defaultProps.ledgerBaseUrl,
             language: "en",
             specific_uuid: undefined,
             validate_against: "required",
@@ -551,7 +546,7 @@ describe("RedactoNoticeConsent", () => {
             noticeId: "notice-123",
             accessToken: "mock-token",
             refreshToken: "mock-refresh-token",
-            baseUrl: undefined,
+            baseUrl: defaultProps.ledgerBaseUrl,
             language: "en",
             specific_uuid: undefined,
             validate_against: "all",
@@ -564,6 +559,45 @@ describe("RedactoNoticeConsent", () => {
     });
   });
 
+  describe("ledger routing", () => {
+    it("routes the standard notice fetch to the ledger base url", async () => {
+      await act(async () => {
+        render(<RedactoNoticeConsent {...defaultProps} />);
+      });
+      await waitFor(
+        () => {
+          expect(api.fetchConsentContent).toHaveBeenCalledWith(
+            expect.objectContaining({ baseUrl: defaultProps.ledgerBaseUrl })
+          );
+        },
+        { timeout: 3000 }
+      );
+    });
+
+    it("keeps the magic-link flow (applicationId) on the consent server", async () => {
+      await act(async () => {
+        render(
+          <RedactoNoticeConsent {...defaultProps} applicationId="app-xyz" />
+        );
+      });
+      await waitFor(
+        () => {
+          expect(api.fetchConsentContent).toHaveBeenCalledWith(
+            expect.objectContaining({
+              // defaultProps has no baseUrl, so the magic-link flow routes the
+              // fetch to baseUrl=undefined (the consent server / SDK default),
+              // i.e. NOT ledgerBaseUrl — same as the submitConsentEvent
+              // assertion above. The point is the ledger routing is bypassed.
+              baseUrl: undefined,
+              specific_uuid: "app-xyz",
+            })
+          );
+        },
+        { timeout: 3000 }
+      );
+    });
+  });
+
   describe("includeFullyConsentedData (magic link flow)", () => {
     beforeEach(() => {
       mockedApi.fetchTTSAudioUrls.mockResolvedValue({
@@ -604,7 +638,7 @@ describe("RedactoNoticeConsent", () => {
             noticeId: "notice-123",
             accessToken: "mock-token",
             refreshToken: "mock-refresh-token",
-            baseUrl: undefined,
+            baseUrl: defaultProps.ledgerBaseUrl,
             language: "en",
             specific_uuid: undefined,
             validate_against: "all",

package/src/RedactoNoticeConsent/RedactoNoticeConsent.tsx

@@ -11,10 +11,8 @@ import React, { useCallback, useEffect, useMemo, useRef, useState } from "react"
 
 // API imports
 import {
-  buildLedgerConsentOverlay,
   clearApiCache,
   fetchConsentContent,
-  fetchNoticeConsentStatus,
   fetchTTSAudioUrls,
   initiateGuardianVerification,
   submitConsentEvent,
@@ -1297,6 +1295,12 @@ export const RedactoNoticeConsent = ({
   noticeId,
   accessToken,
   refreshToken,
+  token,
+  email,
+  mobile,
+  ucic,
+  organisationUuid,
+  workspaceUuid,
   baseUrl,
   ledgerBaseUrl,
   language = "en",
@@ -1312,6 +1316,25 @@ export const RedactoNoticeConsent = ({
   includeFullyConsentedData = false,
   reviewModeButtonText = "Continue",
 }: Props) => {
+  // =============================================================================
+  // SANDBOX MODE
+  // =============================================================================
+
+  // Sandbox PoC: when `token` is set, every API call bypasses the JWT and sends
+  // the single X-Consent-Token header, carrying the acting identity (subject) in
+  // each request's own payload. Org/workspace/subject are taken straight from
+  // props. Passed through to the API layer alongside `accessToken`.
+  const sandboxParams = useMemo(
+    () => ({
+      token,
+      sandboxUcic: ucic,
+      sandboxSubject: email || mobile,
+      organisationUuid,
+      workspaceUuid,
+    }),
+    [token, ucic, email, mobile, organisationUuid, workspaceUuid]
+  );
+
   // =============================================================================
   // PROP VALIDATION
   // =============================================================================
@@ -1321,11 +1344,31 @@ export const RedactoNoticeConsent = ({
     if (!noticeId?.trim()) {
       return "RedactoNoticeConsent: 'noticeId' prop is required and cannot be empty";
     }
+    // Sandbox mode: require a static token, org/workspace, and a subject instead
+    // of a JWT access token.
+    if (token?.trim()) {
+      if (!organisationUuid?.trim() || !workspaceUuid?.trim()) {
+        return "RedactoNoticeConsent: sandbox mode requires 'organisationUuid' and 'workspaceUuid'";
+      }
+      if (!email?.trim() && !mobile?.trim() && !ucic?.trim()) {
+        return "RedactoNoticeConsent: sandbox mode requires 'email', 'mobile', or 'ucic'";
+      }
+      return null;
+    }
     if (!accessToken?.trim()) {
       return "RedactoNoticeConsent: 'accessToken' prop is required and cannot be empty";
     }
     return null;
-  }, [noticeId, accessToken]);
+  }, [
+    noticeId,
+    accessToken,
+    token,
+    organisationUuid,
+    workspaceUuid,
+    email,
+    mobile,
+    ucic,
+  ]);
 
   // Show error UI if props are invalid
   if (propValidationError) {
@@ -1812,16 +1855,23 @@ export const RedactoNoticeConsent = ({
     setShowAgeVerification(false);
     setShowGuardianForm(false);
     try {
+      // Standard flow reads the notice from the Go ledger. The magic-link flow
+      // (applicationId/specific_uuid) and sandbox sessions stay on the consent
+      // server: the ledger notice read supports neither (no specific_uuid, no
+      // X-Consent-Token auth).
+      const noticeBaseUrl =
+        ledgerBaseUrl && !applicationId && !token ? ledgerBaseUrl : baseUrl;
       const consentContentData = await fetchConsentContent({
         noticeId,
         accessToken,
         refreshToken,
-        baseUrl,
+        baseUrl: noticeBaseUrl,
         language,
         specific_uuid: applicationId,
         validate_against: validateAgainst,
         include_fully_consented_data: includeFullyConsentedData,
         signal: abortControllerRef.current?.signal,
+        ...sandboxParams,
       });
       const activeConfig = consentContentData.detail.active_config;
       setContent(activeConfig);
@@ -1842,30 +1892,15 @@ export const RedactoNoticeConsent = ({
       setCollapsedPurposes(initialCollapsedState);
 
       // Initialize selected states - handle reconsent pre-population.
-      // Approach A: overlay the prior-consent / reconsent state from the Go
-      // ledger's check-consent. Consents live in the ledger post-cutover, so
-      // Python's notice-validation overlay is empty; the notice text/config
-      // still comes from Python (above). Falls back to the Python-provided
-      // values when the ledger is unavailable, and is skipped for the
-      // magic-link flow (specific_uuid), which pre-fills from a specific event.
-      let isReconsentRequired = consentContentData.detail.reconsent_required;
-      let purposeSelections = consentContentData.detail.purpose_selections;
-      if (ledgerBaseUrl && !applicationId) {
-        const ledgerStatus = await fetchNoticeConsentStatus({
-          accessToken,
-          ledgerBaseUrl,
-          noticeUuid: noticeId,
-          signal: abortControllerRef.current?.signal,
-        });
-        if (ledgerStatus) {
-          const overlay = buildLedgerConsentOverlay(
-            ledgerStatus,
-            activeConfig.purposes
-          );
-          isReconsentRequired = overlay?.reconsent_required ?? false;
-          purposeSelections = overlay?.purpose_selections;
-        }
-      }
+      // Both notice reads return the per-principal reconsent overlay inline, so
+      // we just consume it — same as the Python flow always did. The ledger
+      // computes it from the very same consent-status read the standalone
+      // check-consent route uses, so a second round-trip only duplicated that
+      // work and produced a *weaker* overlay: it had no notice-version
+      // awareness (a republished notice never re-prompted) and ignored
+      // validate_against, both of which the inline overlay handles server-side.
+      const isReconsentRequired = consentContentData.detail.reconsent_required;
+      const purposeSelections = consentContentData.detail.purpose_selections;
 
       // Categorize purposes for reconsent UI
       const newCategorizedPurposes = isReconsentRequired
@@ -2033,8 +2068,10 @@ export const RedactoNoticeConsent = ({
     noticeId,
     accessToken,
     refreshToken,
+    sandboxParams,
     language,
     applicationId,
+    ledgerBaseUrl,
     validateAgainst,
     includeFullyConsentedData,
     // Removed onError and isRefreshingToken from dependencies to prevent duplicate API calls
@@ -2145,6 +2182,7 @@ export const RedactoNoticeConsent = ({
       if (content) {
         await submitConsentEvent({
           accessToken,
+          baseUrl,
           ledgerBaseUrl,
           noticeUuid: content.notice_uuid,
           purposes: content.purposes.map((purpose) => {
@@ -2193,6 +2231,7 @@ export const RedactoNoticeConsent = ({
           guardianVerificationReference: verificationReference || undefined,
           selfDeclaredAdult: selfDeclaredAdult || undefined,
           signal: submitController.signal,
+          ...sandboxParams,
         });
       }
       onAccept?.();
@@ -2436,7 +2475,7 @@ export const RedactoNoticeConsent = ({
     } finally {
       setIsSubmittingGuardian(false);
     }
-  }, [accessToken, baseUrl, guardianFormData, digilockerMode, digilockerCallbackUrl, selectedPurposes, selectedDataElements, noticeId, onError]);
+  }, [accessToken, sandboxParams, baseUrl, guardianFormData, digilockerMode, digilockerCallbackUrl, selectedPurposes, selectedDataElements, noticeId, onError]);
 
   // Age verification handlers
   const handleAgeVerificationYes = useCallback(() => {
@@ -2515,7 +2554,7 @@ export const RedactoNoticeConsent = ({
     setIsPollingStatus(false);
     isPollingStatusRef.current = false;
     setIsInitiatingVerification(false);
-  }, [accessToken, baseUrl]);
+  }, [accessToken, sandboxParams, baseUrl]);
 
   const startPopupMonitoring = useCallback((popup: Window) => {
     // Check every 500ms if popup is closed
@@ -2696,7 +2735,7 @@ export const RedactoNoticeConsent = ({
       // First poll after 3s
       statusPollIntervalRef.current = window.setTimeout(poll, POLL_INTERVAL);
     },
-    [accessToken, baseUrl, getVerificationErrorMessage]
+    [accessToken, sandboxParams, baseUrl, getVerificationErrorMessage]
   );
 
 
@@ -3224,13 +3263,16 @@ export const RedactoNoticeConsent = ({
     // Create abort controller for this request
     const ttsAbortController = new AbortController();
 
-    // Fetch TTS audio URLs
+    // Prefer the Go ledger for audio; fetchTTSAudioUrls keeps sandbox sessions
+    // on the consent server (the ledger has no X-Consent-Token support).
     fetchTTSAudioUrls({
       accessToken,
       baseUrl,
+      ledgerBaseUrl,
       noticeUuid: content.notice_uuid,
       language: languageCode,
       signal: ttsAbortController.signal,
+      ...sandboxParams,
     })
       .then((response) => {
         // Store the response and mark TTS as available
@@ -3249,7 +3291,7 @@ export const RedactoNoticeConsent = ({
     return () => {
       ttsAbortController.abort();
     };
-  }, [content, selectedLanguage, accessToken, baseUrl, getLanguageCode]);
+  }, [content, selectedLanguage, accessToken, sandboxParams, baseUrl, ledgerBaseUrl, getLanguageCode]);
 
   const modalStyle = {
     borderRadius: settings?.borderRadius || "8px",