@redacto.io/consent-sdk-react 10.0.0-beta.0 → 10.0.0-beta.11

package/src/RedactoNoticeConsent/api/types.ts

@@ -6,6 +6,52 @@ export type RedactoJwtPayload = {
   iat?: number;
 };
 
+/**
+ * Optional sandbox-mode auth fields shared by every API param type. When
+ * `token` is set the call sends the single `X-Consent-Token` header instead of
+ * `Authorization: Bearer`, injects the subject into each request's own payload
+ * (body for POSTs, query param for GETs), and takes org/workspace from these
+ * props instead of decoding the JWT. All optional so existing JWT callers are
+ * unaffected.
+ */
+export type SandboxAuthParams = {
+  token?: string;
+  /** UCIC — the client's own user id (`org_user_id`); takes precedence over the subject. */
+  sandboxUcic?: string;
+  sandboxSubject?: string;
+  organisationUuid?: string;
+  workspaceUuid?: string;
+};
+
+/**
+ * Sandbox authentication context. Present only when the host opts into sandbox
+ * mode by passing a sandbox token; the token/org/workspace are always required
+ * at that point because there is no JWT to fall back on. The acting identity is
+ * a UCIC (the client's own `org_user_id`) or a `subject` (email/mobile) — at
+ * least one is present (UCIC takes precedence when both are set).
+ */
+export type SandboxAuth = {
+  token: string;
+  /** UCIC — the client's own user id (`org_user_id`). Takes precedence over `subject`. */
+  ucic?: string;
+  subject: string;
+  organisationUuid: string;
+  workspaceUuid: string;
+};
+
+/** The identity payload fragment for the sandbox acting principal. */
+export type SandboxIdentityPayload =
+  | { org_user_id: string }
+  | { primary_email: string }
+  | { primary_mobile: string };
+
+/** Org/workspace UUIDs plus the resolved sandbox context for a request. */
+export type ResolvedRequestAuth = {
+  organisationUuid: string;
+  workspaceUuid: string;
+  sandbox: SandboxAuth | null;
+};
+
 export type PurposeSelection = {
   selected: boolean;
   status: string; // ACTIVE | EXPIRED | WITHDRAW | DECLINED
@@ -19,38 +65,6 @@ export type DataElementSelection = {
   required: boolean;
 };
 
-// ─── Ledger notice check-consent ────────────────────────────────────────────
-// Mirrors the Go ledger's `NoticeConsentStatusResponse`. Used to overlay the
-// banner's prior-consent / reconsent state from the ledger, since Python's
-// notice-validation overlay is empty after the consent cutover.
-export type NoticeConsentStatusDataElement = {
-  uuid: string;
-  name: string;
-  selected: boolean;
-};
-
-export type NoticeConsentStatusPurpose = {
-  uuid: string;
-  name: string;
-  selected: boolean;
-  status: string; // ACTIVE | EXPIRED | WITHDRAW | DECLINED | INACTIVE
-  expiry_datetime?: string | null;
-  data_elements: NoticeConsentStatusDataElement[];
-};
-
-export type NoticeConsentStatusResponse = {
-  consented: boolean;
-  all_mandatory_active: boolean;
-  purposes: NoticeConsentStatusPurpose[];
-};
-
-export type FetchNoticeConsentStatusParams = {
-  accessToken: string;
-  ledgerBaseUrl: string;
-  noticeUuid: string;
-  signal?: AbortSignal;
-};
-
 export type ConsentContent = {
   code: number;
   status: string;
@@ -178,10 +192,10 @@ export type Settings = {
   font?: string;
 };
 
-export type FetchConsentContentParams = {
+export type FetchConsentContentParams = SandboxAuthParams & {
   noticeId: string;
-  accessToken: string;
-  refreshToken: string;
+  accessToken?: string;
+  refreshToken?: string;
   baseUrl?: string;
   language?: string;
   specific_uuid?: string;
@@ -228,9 +242,10 @@ export type Purpose = {
   data_elements: Array<DataElement>;
 };
 
-export type SubmitConsentEventParams = {
-  accessToken: string;
-  ledgerBaseUrl: string;
+export type SubmitConsentEventParams = SandboxAuthParams & {
+  accessToken?: string;
+  baseUrl?: string;
+  ledgerBaseUrl?: string;
   noticeUuid: string;
   purposes: Array<Purpose>;
   declined: boolean;
@@ -351,9 +366,10 @@ export type DpoInfoAudio = {
   grievance_email_audio_url?: string;
 };
 
-export type FetchTTSAudioUrlsParams = {
-  accessToken: string;
+export type FetchTTSAudioUrlsParams = SandboxAuthParams & {
+  accessToken?: string;
   baseUrl?: string;
+  ledgerBaseUrl?: string;
   noticeUuid: string;
   language: string;
 };
@@ -366,8 +382,8 @@ export type FetchTTSAudioUrlsParams = {
  * Parameters for initiating guardian verification
  * POST /guardian/initiate-verification
  */
-export type InitiateGuardianVerificationParams = {
-  accessToken: string;
+export type InitiateGuardianVerificationParams = SandboxAuthParams & {
+  accessToken?: string;
   baseUrl?: string;
   guardianName: string;
   guardianContact: string;
@@ -402,8 +418,8 @@ export type InitiateGuardianVerificationResponse = {
  * Parameters for checking verification status
  * POST /guardian/verify-status
  */
-export type VerifyGuardianStatusParams = {
-  accessToken: string;
+export type VerifyGuardianStatusParams = SandboxAuthParams & {
+  accessToken?: string;
   baseUrl?: string;
   sessionToken: string;
   signal?: AbortSignal;

package/src/RedactoNoticeConsent/language-codes.ts

@@ -6,7 +6,6 @@ export const LANGUAGE_NATIVE_LABELS: Record<string, string> = {
   English: "English",
   Assamese: "অসমীয়া (Assamese)",
   Bengali: "বাংলা (Bengali)",
-  Bhojpuri: "भोजपुरी (Bhojpuri)",
   Bodo: "बड़ो (Bodo)",
   Dogri: "डोगरी (Dogri)",
   Gujarati: "ગુજરાતી (Gujarati)",
@@ -44,7 +43,6 @@ const LANGUAGE_NAME_TO_BCP47: Record<string, string> = {
   English: "en",
   Assamese: "as",
   Bengali: "bn",
-  Bhojpuri: "bho",
   Bodo: "brx",
   Dogri: "doi",
   Gujarati: "gu",

package/src/RedactoNoticeConsent/types.ts

@@ -2,10 +2,36 @@ import type { Settings, DpoInfoTranslation } from "./api/types";
 
 export type Props = Readonly<{
   noticeId: string;
-  accessToken: string;
-  refreshToken: string;
+  /**
+   * JWT access token. Optional so sandbox integrations (see `token`) can
+   * omit it. Required in the normal JWT flow.
+   */
+  accessToken?: string;
+  /** JWT refresh token. Optional; accepted for source-compat, currently unused. */
+  refreshToken?: string;
+  /**
+   * Sandbox PoC: a pasted static token. When set, the SDK runs against the
+   * sandbox with no JWT — it sends the single `X-Consent-Token` header, carries
+   * the acting identity (`email` || `mobile`) in each request's own payload,
+   * takes org/workspace from `organisationUuid`/`workspaceUuid`, and does no
+   * token refresh.
+   */
+  token?: string;
+  /** Sandbox test subject email (carried in the request payload when set). */
+  email?: string;
+  /** Sandbox test subject mobile (fallback subject when `email` is absent). */
+  mobile?: string;
+  /**
+   * Sandbox UCIC: the client's own user id / org_user_id, e.g. a UUID or
+   * customer code; optional third identifier alongside email/mobile.
+   */
+  ucic?: string;
+  /** Sandbox org UUID (replaces the JWT-decoded org in sandbox mode). */
+  organisationUuid?: string;
+  /** Sandbox workspace UUID (replaces the JWT-decoded workspace in sandbox mode). */
+  workspaceUuid?: string;
   baseUrl?: string;
-  ledgerBaseUrl: string;
+  ledgerBaseUrl?: string;
   settings?: Partial<Settings>;
   language?: string;
   blockUI?: boolean;

package/src/RedactoNoticeConsentInline/RedactoNoticeConsentInline.tsx

@@ -1,5 +1,9 @@
 import { useEffect, useMemo, useState, useRef, useCallback, memo } from "react";
 import { fetchConsentContent, submitConsentEvent } from "./api";
+import {
+  fetchNoticeConsentStatus,
+  isNoticeFullyConsented,
+} from "../shared/notice-consent-status";
 import type { ConsentContent } from "./api/types";
 import type { Props, TranslationObject } from "./types";
 import { styles } from "./styles";
@@ -36,6 +40,14 @@ const RedactoConsentInlineComponent = ({
     Record<string, boolean>
   >({});
   const [hasAlreadyConsented, setHasAlreadyConsented] = useState(false);
+  // When a ledger is configured, block the auto-submit effect until the ledger
+  // check-consent read settles, so an already-consented principal is not
+  // re-submitted. Starts true only when a ledger check will actually run
+  // (skipped for the magic-link specific_uuid flow); stays false otherwise so
+  // the legacy Python-409 path is unaffected.
+  const [isCheckingConsent, setIsCheckingConsent] = useState<boolean>(
+    Boolean(ledgerBaseUrl) && !applicationId
+  );
   const [fetchError, setFetchError] = useState<Error | null>(null);
   const [errorMessage, setErrorMessage] = useState<string | null>(null);
 
@@ -149,18 +161,26 @@ const RedactoConsentInlineComponent = ({
     return defaultText;
   };
 
-  const fetchNotice = async () => {
+  const fetchNotice = async (signal?: AbortSignal) => {
     setIsLoading(true);
     setFetchError(null);
+    setHasAlreadyConsented(false);
     try {
       const consentContentData = await fetchConsentContent({
         org_uuid,
         workspace_uuid,
         notice_uuid,
+        accessToken,
         baseUrl,
         language,
         specific_uuid: applicationId,
+        signal,
       });
+
+      if (signal?.aborted) {
+        return;
+      }
+
       const activeConfig = consentContentData.detail.active_config;
       setContent(activeConfig);
       if (activeConfig.default_language) {
@@ -203,6 +223,13 @@ const RedactoConsentInlineComponent = ({
         );
       setSelectedPurposes(initialPurposeState);
     } catch (err: unknown) {
+      if (
+        signal?.aborted ||
+        (err instanceof Error && err.name === "AbortError")
+      ) {
+        return;
+      }
+
       const error = err as Error & { status?: number };
       setFetchError(error);
       if (error.status === 409) {
@@ -211,14 +238,60 @@ const RedactoConsentInlineComponent = ({
         onError?.(error);
       }
     } finally {
-      setIsLoading(false);
+      if (!signal?.aborted) {
+        setIsLoading(false);
+      }
     }
   };
 
   useEffect(() => {
-    fetchNotice();
+    const controller = new AbortController();
+    void fetchNotice(controller.signal);
+
+    return () => {
+      controller.abort();
+    };
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [org_uuid, workspace_uuid, notice_uuid, language, applicationId]);
+  }, [org_uuid, workspace_uuid, notice_uuid, language, applicationId, accessToken]);
+
+  // Post-cutover, consent records live in the Go ledger, so Python's
+  // get-notice no longer returns 409 CONSENT_ALREADY_PROVIDED. When a ledger
+  // is configured, ask it directly whether this principal has already fully
+  // consented — the same check-consent read the banner uses. Skipped for the
+  // magic-link specific_uuid flow (which always re-submits against a specific
+  // application) and when no ledger is set (the legacy 409 path governs).
+  useEffect(() => {
+    if (!ledgerBaseUrl || applicationId) {
+      return;
+    }
+    if (!accessToken || !content) {
+      return;
+    }
+    let active = true;
+    const controller = new AbortController();
+    const checkLedgerConsent = async () => {
+      try {
+        const ledgerStatus = await fetchNoticeConsentStatus({
+          accessToken,
+          ledgerBaseUrl,
+          noticeUuid: notice_uuid,
+          signal: controller.signal,
+        });
+        if (active && ledgerStatus && isNoticeFullyConsented(ledgerStatus)) {
+          setHasAlreadyConsented(true);
+        }
+      } finally {
+        if (active) {
+          setIsCheckingConsent(false);
+        }
+      }
+    };
+    checkLedgerConsent();
+    return () => {
+      active = false;
+      controller.abort();
+    };
+  }, [ledgerBaseUrl, applicationId, accessToken, content, notice_uuid]);
 
   const togglePurposeCollapse = (purposeUuid: string) => {
     setCollapsedPurposes((prev) => ({
@@ -320,6 +393,7 @@ const RedactoConsentInlineComponent = ({
           org_uuid,
           workspace_uuid,
           accessToken: tokenToUse,
+          baseUrl,
           ledgerBaseUrl,
           noticeUuid: content.notice_uuid,
           purposes: content.purposes.map((purpose) => {
@@ -391,13 +465,18 @@ const RedactoConsentInlineComponent = ({
     ]
   );
 
-  // Auto-submit consent when all conditions are met
+  // Auto-submit consent when all conditions are met. Waits for the ledger
+  // check-consent read to settle (isCheckingConsent) and never fires for an
+  // already-consented principal, so the cutover cannot trigger a duplicate
+  // submission.
   useEffect(() => {
     if (
       accessToken &&
       content &&
       areAllRequiredElementsChecked &&
       !isSubmitting &&
+      !isCheckingConsent &&
+      !hasAlreadyConsented &&
       !hasSubmittedRef.current
     ) {
       hasSubmittedRef.current = true;
@@ -416,6 +495,8 @@ const RedactoConsentInlineComponent = ({
     content,
     areAllRequiredElementsChecked,
     isSubmitting,
+    isCheckingConsent,
+    hasAlreadyConsented,
     handleAcceptWithToken,
   ]);
 

package/src/RedactoNoticeConsentInline/api/index.ts

@@ -12,13 +12,19 @@ export const fetchConsentContent = async ({
   org_uuid,
   workspace_uuid,
   notice_uuid,
+  accessToken,
   baseUrl,
+  language,
   specific_uuid,
+  signal,
 }: FetchConsentContentParams): Promise<ConsentContent> => {
   const apiBaseUrl = baseUrl || BASE_URL;
+  const noticesUrl = `${apiBaseUrl}/public/organisations/${org_uuid}/workspaces/${workspace_uuid}/notices`;
 
   const url = new URL(
-    `${apiBaseUrl}/public/organisations/${org_uuid}/workspaces/${workspace_uuid}/notices/get-notice/${notice_uuid}`
+    accessToken
+      ? `${noticesUrl}/${notice_uuid}`
+      : `${noticesUrl}/get-notice/${notice_uuid}`
   );
 
   if (specific_uuid) {
@@ -29,7 +35,10 @@ export const fetchConsentContent = async ({
     method: "GET",
     headers: {
       "Content-Type": "application/json",
+      "Accept-Language": language || "en",
+      ...(accessToken ? { Authorization: `Bearer ${accessToken}` } : {}),
     },
+    signal,
   });
 
   if (!response.ok) {
@@ -47,16 +56,16 @@ export const submitConsentEvent = async ({
   org_uuid,
   workspace_uuid,
   accessToken,
+  baseUrl,
   ledgerBaseUrl,
   noticeUuid,
   purposes,
   declined,
   meta_data,
 }: SubmitConsentEventParams): Promise<void> => {
-  if (!ledgerBaseUrl) {
-    throw new Error("ledgerBaseUrl is required to submit consent");
-  }
-  const apiBaseUrl = ledgerBaseUrl;
+  // Fall back to the consent server when no ledger is configured, so existing
+  // integrations that only pass baseUrl remain backwards compatible.
+  const apiBaseUrl = ledgerBaseUrl || baseUrl || BASE_URL;
 
   const payload: ConsentEventPayload = {
     notice_uuid: noticeUuid,

package/src/RedactoNoticeConsentInline/api/notice-read-routing.test.ts

@@ -0,0 +1,72 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { fetchConsentContent } from "./index";
+
+const LEDGER = "https://ledger.example.test/consent-ledger";
+const PYTHON = "https://api.example.test/consent";
+const TOKEN = "opaque-token";
+
+const scope = (base: string) =>
+  `${base}/public/organisations/org-1/workspaces/ws-1/notices`;
+
+const requestedUrl = (fetchMock: ReturnType<typeof vi.fn>): string =>
+  String(fetchMock.mock.calls[0][0]);
+
+const requestedHeaders = (
+  fetchMock: ReturnType<typeof vi.fn>
+): Record<string, string> =>
+  (fetchMock.mock.calls[0][1] as RequestInit).headers as Record<string, string>;
+
+describe("inline notice read routing", () => {
+  const fetchMock = vi.fn();
+  const base = { org_uuid: "org-1", workspace_uuid: "ws-1", notice_uuid: "ntc-1" };
+
+  beforeEach(() => {
+    fetchMock.mockReset();
+    fetchMock.mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => ({}),
+    } as Response);
+    vi.stubGlobal("fetch", fetchMock);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("reads the authenticated notice endpoint when a token is available", async () => {
+    await fetchConsentContent({ ...base, accessToken: TOKEN, baseUrl: LEDGER });
+    expect(requestedUrl(fetchMock)).toBe(`${scope(LEDGER)}/ntc-1`);
+    expect(requestedHeaders(fetchMock).Authorization).toBe(`Bearer ${TOKEN}`);
+  });
+
+  it("falls back to the tokenless get-notice endpoint without a token", async () => {
+    await fetchConsentContent({ ...base, baseUrl: PYTHON });
+    expect(requestedUrl(fetchMock)).toBe(`${scope(PYTHON)}/get-notice/ntc-1`);
+    expect(requestedHeaders(fetchMock).Authorization).toBeUndefined();
+  });
+
+  it("keeps specific_uuid on the authenticated read", async () => {
+    await fetchConsentContent({
+      ...base,
+      accessToken: TOKEN,
+      baseUrl: LEDGER,
+      specific_uuid: "app-1",
+    });
+    expect(requestedUrl(fetchMock)).toBe(`${scope(LEDGER)}/ntc-1?specific_uuid=app-1`);
+  });
+
+  it("sends the requested language on both paths", async () => {
+    await fetchConsentContent({ ...base, baseUrl: PYTHON, language: "hi" });
+    expect(requestedHeaders(fetchMock)["Accept-Language"]).toBe("hi");
+
+    fetchMock.mockClear();
+    await fetchConsentContent({
+      ...base,
+      accessToken: TOKEN,
+      baseUrl: LEDGER,
+      language: "hi",
+    });
+    expect(requestedHeaders(fetchMock)["Accept-Language"]).toBe("hi");
+  });
+});

package/src/RedactoNoticeConsentInline/api/types.ts

@@ -128,9 +128,11 @@ export type FetchConsentContentParams = {
   org_uuid: string;
   workspace_uuid: string;
   notice_uuid: string;
+  accessToken?: string;
   baseUrl?: string;
   language?: string;
   specific_uuid?: string;
+  signal?: AbortSignal;
 };
 
 export type ConsentEventPayload = {
@@ -172,7 +174,8 @@ export type SubmitConsentEventParams = {
   org_uuid: string;
   workspace_uuid: string;
   accessToken: string;
-  ledgerBaseUrl: string;
+  baseUrl?: string;
+  ledgerBaseUrl?: string;
   noticeUuid: string;
   purposes: Array<Purpose>;
   declined: boolean;

package/src/RedactoNoticeConsentInline/types.ts

@@ -8,7 +8,7 @@ export type Props = Readonly<{
   accessToken?: string;
   refreshToken?: string;
   baseUrl?: string;
-  ledgerBaseUrl: string;
+  ledgerBaseUrl?: string;
   settings?: Partial<Settings>;
   language?: string;
   onAccept?: () => void;

package/src/RedactoPrivacyCenter/PrivacyCenterLayout.tsx

@@ -12,6 +12,7 @@ import { useAuth } from './context/AuthContext';
 import { PCLoader } from './ui';
 import { pcStyles } from './styles/pcStyles';
 import AppShell from './components/AppShell/AppShell';
+import { SelectUserGate } from './components/SelectUserGate';
 
 interface PrivacyCenterLayoutProps {
   children: ReactNode;
@@ -164,11 +165,13 @@ export function PrivacyCenterLayout({ children, slug, onBack }: PrivacyCenterLay
 
   return (
     <OrganizationProvider organization={organization}>
-      <DataAvailabilityProvider>
-        <AppShell onBack={onBack}>
-          {children}
-        </AppShell>
-      </DataAvailabilityProvider>
+      <SelectUserGate>
+        <DataAvailabilityProvider>
+          <AppShell onBack={onBack}>
+            {children}
+          </AppShell>
+        </DataAvailabilityProvider>
+      </SelectUserGate>
     </OrganizationProvider>
   );
 }

package/src/RedactoPrivacyCenter/RedactoPrivacyCenter.tsx

@@ -15,10 +15,33 @@ injectPCStyles();
 
 interface RedactoPrivacyCenterProps {
   baseUrl: string; // Consent server base URL
-  ledgerBaseUrl: string; // Go ledger base URL — serves user-consents
+  ledgerBaseUrl?: string; // Go ledger base URL — serves user-consents; omit to use the legacy Python privacy-center consent endpoints
   slug: string;
-  accessToken: string;
-  refreshToken: string;
+  /** JWT access token. Optional so sandbox mode (see `token`) can omit it. */
+  accessToken?: string;
+  /** JWT refresh token. Optional; used by the OTP-refresh loop in the JWT flow. */
+  refreshToken?: string;
+  /**
+   * Sandbox PoC: a pasted static token. When set, the Privacy Center runs
+   * against the sandbox with no JWT — it sends the single `X-Consent-Token`
+   * header, carries the acting identity (`email` || `mobile`) in each request's
+   * own payload, takes org/workspace from `organisationUuid`/`workspaceUuid`,
+   * and never calls `/otp/refresh`.
+   */
+  token?: string;
+  /** Sandbox test subject email (carried in the request payload when set). */
+  email?: string;
+  /** Sandbox test subject mobile (fallback subject when `email` is absent). */
+  mobile?: string;
+  /**
+   * Sandbox UCIC: the client's own user id / org_user_id, e.g. a UUID or
+   * customer code; optional third identifier alongside email/mobile.
+   */
+  ucic?: string;
+  /** Sandbox org UUID (replaces the JWT-decoded org in sandbox mode). */
+  organisationUuid?: string;
+  /** Sandbox workspace UUID (replaces the JWT-decoded workspace in sandbox mode). */
+  workspaceUuid?: string;
   onError: (error: Error) => boolean;
   initialPage?: InternalPage;
   onBack?: 'back' | 'signout';
@@ -30,6 +53,12 @@ export function RedactoPrivacyCenter({
   slug,
   accessToken,
   refreshToken,
+  token,
+  email,
+  mobile,
+  ucic,
+  organisationUuid,
+  workspaceUuid,
   onError,
   initialPage = 'consent-manager',
   onBack,
@@ -41,6 +70,12 @@ export function RedactoPrivacyCenter({
           <AuthProvider
             accessToken={accessToken}
             refreshToken={refreshToken}
+            token={token}
+            sandboxUcic={ucic}
+            sandboxSubject={email || mobile}
+            organisationUuid={organisationUuid}
+            workspaceUuid={workspaceUuid}
+            slug={slug}
             onError={onError}
           >
             <NavigationProvider initialPage={initialPage}>

package/src/RedactoPrivacyCenter/api/actions.ts

@@ -24,6 +24,7 @@ import type {
   GetCaseMessagesParams,
   MessageDocument,
   GetNotificationsServerParams,
+  LegacyManageConsentResponse,
   NotificationActionBaseParams,
   NotificationActionResponse,
   NotificationByUuidServerParams,
@@ -353,6 +354,7 @@ export async function manageConsentServer(params: {
   productUuid?: string;
   noticeUuid?: string;
   dataElements?: Array<{ uuid: string; selected: boolean }>;
+  language?: string;
 }): Promise<boolean | null> {
   try {
     if (!params.consentClient) {
@@ -361,10 +363,12 @@ export async function manageConsentServer(params: {
     // Privacy center endpoints use JWT Bearer tokens, not session-based auth
     const baseRequest = buildBaseRequest(params.organizationId, params.workspaceId, params.authToken);
 
-    // Routes to the Go ledger's submit-consent (partial); resolves on 2xx and
-    // throws otherwise, so a resolved call is success. The ledger returns a
-    // ConsentEventResponse (no `success` flag), unlike the old Python endpoint.
-    await params.consentClient.manageConsent(
+    // Ledger mode routes to the Go ledger's submit-consent (partial), which
+    // resolves on 2xx and throws otherwise — a resolved call is success (the
+    // ledger returns a ConsentEventResponse, no `success` flag). Legacy mode
+    // hits the Python manage-consent endpoint, whose unwrapped response
+    // carries a `success` flag that must be honored even on 2xx.
+    const result = await params.consentClient.manageConsent(
       baseRequest,
       params.purposeId,
       params.contact,
@@ -375,8 +379,12 @@ export async function manageConsentServer(params: {
       params.dataElementUuids,
       params.productUuid,
       params.noticeUuid,
-      params.dataElements
+      params.dataElements,
+      params.language
     );
+    if (result && typeof result === 'object' && 'success' in result) {
+      return Boolean((result as LegacyManageConsentResponse).success);
+    }
     return true;
   } catch (error: any) {
     // Normalize nominator-specific errors into stable error codes