@redacto.io/consent-sdk-react 10.0.0-beta.1 → 10.0.0-beta.11

package/src/RedactoNoticeConsent/language-codes.ts

@@ -6,7 +6,6 @@ export const LANGUAGE_NATIVE_LABELS: Record<string, string> = {
   English: "English",
   Assamese: "অসমীয়া (Assamese)",
   Bengali: "বাংলা (Bengali)",
-  Bhojpuri: "भोजपुरी (Bhojpuri)",
   Bodo: "बड़ो (Bodo)",
   Dogri: "डोगरी (Dogri)",
   Gujarati: "ગુજરાતી (Gujarati)",
@@ -44,7 +43,6 @@ const LANGUAGE_NAME_TO_BCP47: Record<string, string> = {
   English: "en",
   Assamese: "as",
   Bengali: "bn",
-  Bhojpuri: "bho",
   Bodo: "brx",
   Dogri: "doi",
   Gujarati: "gu",

package/src/RedactoNoticeConsent/types.ts

@@ -2,8 +2,34 @@ import type { Settings, DpoInfoTranslation } from "./api/types";
 
 export type Props = Readonly<{
   noticeId: string;
-  accessToken: string;
-  refreshToken: string;
+  /**
+   * JWT access token. Optional so sandbox integrations (see `token`) can
+   * omit it. Required in the normal JWT flow.
+   */
+  accessToken?: string;
+  /** JWT refresh token. Optional; accepted for source-compat, currently unused. */
+  refreshToken?: string;
+  /**
+   * Sandbox PoC: a pasted static token. When set, the SDK runs against the
+   * sandbox with no JWT — it sends the single `X-Consent-Token` header, carries
+   * the acting identity (`email` || `mobile`) in each request's own payload,
+   * takes org/workspace from `organisationUuid`/`workspaceUuid`, and does no
+   * token refresh.
+   */
+  token?: string;
+  /** Sandbox test subject email (carried in the request payload when set). */
+  email?: string;
+  /** Sandbox test subject mobile (fallback subject when `email` is absent). */
+  mobile?: string;
+  /**
+   * Sandbox UCIC: the client's own user id / org_user_id, e.g. a UUID or
+   * customer code; optional third identifier alongside email/mobile.
+   */
+  ucic?: string;
+  /** Sandbox org UUID (replaces the JWT-decoded org in sandbox mode). */
+  organisationUuid?: string;
+  /** Sandbox workspace UUID (replaces the JWT-decoded workspace in sandbox mode). */
+  workspaceUuid?: string;
   baseUrl?: string;
   ledgerBaseUrl?: string;
   settings?: Partial<Settings>;

package/src/RedactoNoticeConsentInline/RedactoNoticeConsentInline.tsx

@@ -1,5 +1,9 @@
 import { useEffect, useMemo, useState, useRef, useCallback, memo } from "react";
 import { fetchConsentContent, submitConsentEvent } from "./api";
+import {
+  fetchNoticeConsentStatus,
+  isNoticeFullyConsented,
+} from "../shared/notice-consent-status";
 import type { ConsentContent } from "./api/types";
 import type { Props, TranslationObject } from "./types";
 import { styles } from "./styles";
@@ -36,6 +40,14 @@ const RedactoConsentInlineComponent = ({
     Record<string, boolean>
   >({});
   const [hasAlreadyConsented, setHasAlreadyConsented] = useState(false);
+  // When a ledger is configured, block the auto-submit effect until the ledger
+  // check-consent read settles, so an already-consented principal is not
+  // re-submitted. Starts true only when a ledger check will actually run
+  // (skipped for the magic-link specific_uuid flow); stays false otherwise so
+  // the legacy Python-409 path is unaffected.
+  const [isCheckingConsent, setIsCheckingConsent] = useState<boolean>(
+    Boolean(ledgerBaseUrl) && !applicationId
+  );
   const [fetchError, setFetchError] = useState<Error | null>(null);
   const [errorMessage, setErrorMessage] = useState<string | null>(null);
 
@@ -149,18 +161,26 @@ const RedactoConsentInlineComponent = ({
     return defaultText;
   };
 
-  const fetchNotice = async () => {
+  const fetchNotice = async (signal?: AbortSignal) => {
     setIsLoading(true);
     setFetchError(null);
+    setHasAlreadyConsented(false);
     try {
       const consentContentData = await fetchConsentContent({
         org_uuid,
         workspace_uuid,
         notice_uuid,
+        accessToken,
         baseUrl,
         language,
         specific_uuid: applicationId,
+        signal,
       });
+
+      if (signal?.aborted) {
+        return;
+      }
+
       const activeConfig = consentContentData.detail.active_config;
       setContent(activeConfig);
       if (activeConfig.default_language) {
@@ -203,6 +223,13 @@ const RedactoConsentInlineComponent = ({
         );
       setSelectedPurposes(initialPurposeState);
     } catch (err: unknown) {
+      if (
+        signal?.aborted ||
+        (err instanceof Error && err.name === "AbortError")
+      ) {
+        return;
+      }
+
       const error = err as Error & { status?: number };
       setFetchError(error);
       if (error.status === 409) {
@@ -211,14 +238,60 @@ const RedactoConsentInlineComponent = ({
         onError?.(error);
       }
     } finally {
-      setIsLoading(false);
+      if (!signal?.aborted) {
+        setIsLoading(false);
+      }
     }
   };
 
   useEffect(() => {
-    fetchNotice();
+    const controller = new AbortController();
+    void fetchNotice(controller.signal);
+
+    return () => {
+      controller.abort();
+    };
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [org_uuid, workspace_uuid, notice_uuid, language, applicationId]);
+  }, [org_uuid, workspace_uuid, notice_uuid, language, applicationId, accessToken]);
+
+  // Post-cutover, consent records live in the Go ledger, so Python's
+  // get-notice no longer returns 409 CONSENT_ALREADY_PROVIDED. When a ledger
+  // is configured, ask it directly whether this principal has already fully
+  // consented — the same check-consent read the banner uses. Skipped for the
+  // magic-link specific_uuid flow (which always re-submits against a specific
+  // application) and when no ledger is set (the legacy 409 path governs).
+  useEffect(() => {
+    if (!ledgerBaseUrl || applicationId) {
+      return;
+    }
+    if (!accessToken || !content) {
+      return;
+    }
+    let active = true;
+    const controller = new AbortController();
+    const checkLedgerConsent = async () => {
+      try {
+        const ledgerStatus = await fetchNoticeConsentStatus({
+          accessToken,
+          ledgerBaseUrl,
+          noticeUuid: notice_uuid,
+          signal: controller.signal,
+        });
+        if (active && ledgerStatus && isNoticeFullyConsented(ledgerStatus)) {
+          setHasAlreadyConsented(true);
+        }
+      } finally {
+        if (active) {
+          setIsCheckingConsent(false);
+        }
+      }
+    };
+    checkLedgerConsent();
+    return () => {
+      active = false;
+      controller.abort();
+    };
+  }, [ledgerBaseUrl, applicationId, accessToken, content, notice_uuid]);
 
   const togglePurposeCollapse = (purposeUuid: string) => {
     setCollapsedPurposes((prev) => ({
@@ -392,13 +465,18 @@ const RedactoConsentInlineComponent = ({
     ]
   );
 
-  // Auto-submit consent when all conditions are met
+  // Auto-submit consent when all conditions are met. Waits for the ledger
+  // check-consent read to settle (isCheckingConsent) and never fires for an
+  // already-consented principal, so the cutover cannot trigger a duplicate
+  // submission.
   useEffect(() => {
     if (
       accessToken &&
       content &&
       areAllRequiredElementsChecked &&
       !isSubmitting &&
+      !isCheckingConsent &&
+      !hasAlreadyConsented &&
       !hasSubmittedRef.current
     ) {
       hasSubmittedRef.current = true;
@@ -417,6 +495,8 @@ const RedactoConsentInlineComponent = ({
     content,
     areAllRequiredElementsChecked,
     isSubmitting,
+    isCheckingConsent,
+    hasAlreadyConsented,
     handleAcceptWithToken,
   ]);
 

package/src/RedactoNoticeConsentInline/api/index.ts

@@ -12,13 +12,19 @@ export const fetchConsentContent = async ({
   org_uuid,
   workspace_uuid,
   notice_uuid,
+  accessToken,
   baseUrl,
+  language,
   specific_uuid,
+  signal,
 }: FetchConsentContentParams): Promise<ConsentContent> => {
   const apiBaseUrl = baseUrl || BASE_URL;
+  const noticesUrl = `${apiBaseUrl}/public/organisations/${org_uuid}/workspaces/${workspace_uuid}/notices`;
 
   const url = new URL(
-    `${apiBaseUrl}/public/organisations/${org_uuid}/workspaces/${workspace_uuid}/notices/get-notice/${notice_uuid}`
+    accessToken
+      ? `${noticesUrl}/${notice_uuid}`
+      : `${noticesUrl}/get-notice/${notice_uuid}`
   );
 
   if (specific_uuid) {
@@ -29,7 +35,10 @@ export const fetchConsentContent = async ({
     method: "GET",
     headers: {
       "Content-Type": "application/json",
+      "Accept-Language": language || "en",
+      ...(accessToken ? { Authorization: `Bearer ${accessToken}` } : {}),
     },
+    signal,
   });
 
   if (!response.ok) {

package/src/RedactoNoticeConsentInline/api/notice-read-routing.test.ts

@@ -0,0 +1,72 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { fetchConsentContent } from "./index";
+
+const LEDGER = "https://ledger.example.test/consent-ledger";
+const PYTHON = "https://api.example.test/consent";
+const TOKEN = "opaque-token";
+
+const scope = (base: string) =>
+  `${base}/public/organisations/org-1/workspaces/ws-1/notices`;
+
+const requestedUrl = (fetchMock: ReturnType<typeof vi.fn>): string =>
+  String(fetchMock.mock.calls[0][0]);
+
+const requestedHeaders = (
+  fetchMock: ReturnType<typeof vi.fn>
+): Record<string, string> =>
+  (fetchMock.mock.calls[0][1] as RequestInit).headers as Record<string, string>;
+
+describe("inline notice read routing", () => {
+  const fetchMock = vi.fn();
+  const base = { org_uuid: "org-1", workspace_uuid: "ws-1", notice_uuid: "ntc-1" };
+
+  beforeEach(() => {
+    fetchMock.mockReset();
+    fetchMock.mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => ({}),
+    } as Response);
+    vi.stubGlobal("fetch", fetchMock);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("reads the authenticated notice endpoint when a token is available", async () => {
+    await fetchConsentContent({ ...base, accessToken: TOKEN, baseUrl: LEDGER });
+    expect(requestedUrl(fetchMock)).toBe(`${scope(LEDGER)}/ntc-1`);
+    expect(requestedHeaders(fetchMock).Authorization).toBe(`Bearer ${TOKEN}`);
+  });
+
+  it("falls back to the tokenless get-notice endpoint without a token", async () => {
+    await fetchConsentContent({ ...base, baseUrl: PYTHON });
+    expect(requestedUrl(fetchMock)).toBe(`${scope(PYTHON)}/get-notice/ntc-1`);
+    expect(requestedHeaders(fetchMock).Authorization).toBeUndefined();
+  });
+
+  it("keeps specific_uuid on the authenticated read", async () => {
+    await fetchConsentContent({
+      ...base,
+      accessToken: TOKEN,
+      baseUrl: LEDGER,
+      specific_uuid: "app-1",
+    });
+    expect(requestedUrl(fetchMock)).toBe(`${scope(LEDGER)}/ntc-1?specific_uuid=app-1`);
+  });
+
+  it("sends the requested language on both paths", async () => {
+    await fetchConsentContent({ ...base, baseUrl: PYTHON, language: "hi" });
+    expect(requestedHeaders(fetchMock)["Accept-Language"]).toBe("hi");
+
+    fetchMock.mockClear();
+    await fetchConsentContent({
+      ...base,
+      accessToken: TOKEN,
+      baseUrl: LEDGER,
+      language: "hi",
+    });
+    expect(requestedHeaders(fetchMock)["Accept-Language"]).toBe("hi");
+  });
+});

package/src/RedactoNoticeConsentInline/api/types.ts

@@ -128,9 +128,11 @@ export type FetchConsentContentParams = {
   org_uuid: string;
   workspace_uuid: string;
   notice_uuid: string;
+  accessToken?: string;
   baseUrl?: string;
   language?: string;
   specific_uuid?: string;
+  signal?: AbortSignal;
 };
 
 export type ConsentEventPayload = {

package/src/RedactoPrivacyCenter/RedactoPrivacyCenter.tsx

@@ -17,8 +17,31 @@ interface RedactoPrivacyCenterProps {
   baseUrl: string; // Consent server base URL
   ledgerBaseUrl?: string; // Go ledger base URL — serves user-consents; omit to use the legacy Python privacy-center consent endpoints
   slug: string;
-  accessToken: string;
-  refreshToken: string;
+  /** JWT access token. Optional so sandbox mode (see `token`) can omit it. */
+  accessToken?: string;
+  /** JWT refresh token. Optional; used by the OTP-refresh loop in the JWT flow. */
+  refreshToken?: string;
+  /**
+   * Sandbox PoC: a pasted static token. When set, the Privacy Center runs
+   * against the sandbox with no JWT — it sends the single `X-Consent-Token`
+   * header, carries the acting identity (`email` || `mobile`) in each request's
+   * own payload, takes org/workspace from `organisationUuid`/`workspaceUuid`,
+   * and never calls `/otp/refresh`.
+   */
+  token?: string;
+  /** Sandbox test subject email (carried in the request payload when set). */
+  email?: string;
+  /** Sandbox test subject mobile (fallback subject when `email` is absent). */
+  mobile?: string;
+  /**
+   * Sandbox UCIC: the client's own user id / org_user_id, e.g. a UUID or
+   * customer code; optional third identifier alongside email/mobile.
+   */
+  ucic?: string;
+  /** Sandbox org UUID (replaces the JWT-decoded org in sandbox mode). */
+  organisationUuid?: string;
+  /** Sandbox workspace UUID (replaces the JWT-decoded workspace in sandbox mode). */
+  workspaceUuid?: string;
   onError: (error: Error) => boolean;
   initialPage?: InternalPage;
   onBack?: 'back' | 'signout';
@@ -30,6 +53,12 @@ export function RedactoPrivacyCenter({
   slug,
   accessToken,
   refreshToken,
+  token,
+  email,
+  mobile,
+  ucic,
+  organisationUuid,
+  workspaceUuid,
   onError,
   initialPage = 'consent-manager',
   onBack,
@@ -41,6 +70,12 @@ export function RedactoPrivacyCenter({
           <AuthProvider
             accessToken={accessToken}
             refreshToken={refreshToken}
+            token={token}
+            sandboxUcic={ucic}
+            sandboxSubject={email || mobile}
+            organisationUuid={organisationUuid}
+            workspaceUuid={workspaceUuid}
+            slug={slug}
             onError={onError}
           >
             <NavigationProvider initialPage={initialPage}>

package/src/RedactoPrivacyCenter/api/actions.ts

@@ -354,6 +354,7 @@ export async function manageConsentServer(params: {
   productUuid?: string;
   noticeUuid?: string;
   dataElements?: Array<{ uuid: string; selected: boolean }>;
+  language?: string;
 }): Promise<boolean | null> {
   try {
     if (!params.consentClient) {
@@ -378,7 +379,8 @@ export async function manageConsentServer(params: {
       params.dataElementUuids,
       params.productUuid,
       params.noticeUuid,
-      params.dataElements
+      params.dataElements,
+      params.language
     );
     if (result && typeof result === 'object' && 'success' in result) {
       return Boolean((result as LegacyManageConsentResponse).success);