@redacto.io/consent-sdk-react 10.0.0-beta.11 → 10.0.0-beta.12

package/src/shared/api-errors.ts

@@ -1,180 +0,0 @@
-/**
- * Shared API error handling for the consent-sdk-react package.
- *
- * The backend (consent-server) owns the user-facing copy. Each error
- * response carries:
- *   - `message`: user-safe text the SDK displays verbatim
- *   - `error_code`: stable identifier for programmatic branching
- *
- * The SDK never re-translates a code into a message. To change wording,
- * update the server titles registry -- no SDK release required.
- */
-
-export type ApiErrorCode =
-  | "INVALID_TOKEN"
-  | "TOKEN_TENANT_MISMATCH"
-  | "UNAUTHORIZED"
-  | "USER_NOT_FOUND"
-  | "USER_EMAIL_MISMATCH"
-  | "USER_MOBILE_MISMATCH"
-  | "USER_CONTACT_MISMATCH"
-  | "NO_IDENTIFIER_PROVIDED"
-  | "INVALID_PAYLOAD"
-  | "VALIDATION_ERROR"
-  | "NOTICE_NOT_FOUND"
-  | "NOTICE_CONFIGURATION_NOT_FOUND"
-  | "NOTICE_STILL_IN_DRAFT"
-  | "CONSENT_ALREADY_PROVIDED"
-  | "PURPOSE_NOT_FOUND"
-  | "INVALID_PURPOSE"
-  | "INVALID_DATA_ELEMENTS"
-  | "MISSING_PURPOSE"
-  | "MISSING_DATA_ELEMENTS"
-  | "REQUIRED_DATA_ELEMENT_NOT_ENABLED"
-  | "AUDIO_NOT_FOUND"
-  | "INVALID_LANGUAGE"
-  | "VERIFICATION_FAILED"
-  | "VERIFICATION_EXPIRED"
-  | "GUARDIAN_INFO_NOT_FOUND"
-  | "GUARDIAN_SESSION_INVALID"
-  | "SESSION_EXPIRED"
-  | "INTERNAL_ERROR";
-
-interface ApiErrorDetail {
-  message?: string;
-  error_code?: string | null;
-  // Ninja's auth-pipeline auto-401 returns `{detail: {detail: "Unauthorized"}}`
-  // -- the inner `detail` is a string. Captured here so the parser can use
-  // it as a last-resort message extraction.
-  detail?: string;
-}
-
-interface ApiErrorBody {
-  message?: string;
-  error_code?: string | null;
-  // Some endpoints (e.g. OTP verify) signal "this code is dead, request a fresh
-  // one" via a top-level boolean instead of an `error_code`. Captured so callers
-  // can branch on it (e.g. to distinguish an expired code from a wrong one).
-  should_request_new?: boolean;
-  // `detail` may arrive as:
-  //   { message: "...", error_code: "..." }    -- our MessageResponse via Ninja
-  //   { detail: "..." }                         -- Ninja auto-401
-  //   "..."                                     -- direct string from some endpoints
-  //   [...]                                     -- Ninja auto-422 Pydantic errors
-  detail?: ApiErrorDetail | string | unknown[];
-}
-
-// `ApiErrorCode | (string & {})` keeps literal autocomplete on `code` while
-// still permitting unknown strings from forward-compatible server versions.
-// A bare `ApiErrorCode | string` would widen to `string` and lose the
-// literal suggestions.
-export type ApiErrorCodeLike = ApiErrorCode | (string & {});
-
-export class ApiError extends Error {
-  readonly status: number;
-  readonly code?: ApiErrorCodeLike;
-  // Mirrors the server's `should_request_new` flag, when present.
-  readonly shouldRequestNew?: boolean;
-
-  constructor(opts: {
-    status: number;
-    code?: ApiErrorCodeLike;
-    message: string;
-    shouldRequestNew?: boolean;
-  }) {
-    super(opts.message);
-    this.name = "ApiError";
-    this.status = opts.status;
-    this.code = opts.code;
-    this.shouldRequestNew = opts.shouldRequestNew;
-  }
-}
-
-// Tier-3 fallbacks for failure modes where the server did not produce
-// a parseable body with `message`. Common case: Ninja's auth pipeline
-// rejects a request before reaching our handler, returning
-// `{detail: {detail: "Unauthorized"}}` with no message field. The
-// fallback is a static, user-safe hint -- never an override of a
-// server-supplied message.
-function statusFallback(status: number): string | undefined {
-  if (status === 401) {
-    return "Your session has expired. Please request a new access link.";
-  }
-  if (status === 403) {
-    return "You do not have access to this resource.";
-  }
-  if (status >= 500) {
-    return "Something went wrong on our end. Please try again later.";
-  }
-  return undefined;
-}
-
-/**
- * Build an ApiError from a non-OK fetch Response.
- *
- * Order of preference for the user-facing message:
- *   1. `message` field from the backend response body (preferred -- the
- *      SDK-consumed endpoints always populate this with user-safe copy).
- *   2. Status-based fallback (only when the server omitted a message,
- *      e.g. Ninja's auto-401 for an expired JWT).
- *   3. The caller-supplied fallback (used when the body is missing or
- *      unparseable -- network error, non-JSON proxy page).
- *
- * The `code` field is exposed as-is for programmatic branching. Consumers
- * that want compile-time safety should narrow against `ApiErrorCode`.
- */
-function extractFromDetail(
-  detail: ApiErrorBody["detail"]
-): { message?: string; code?: string | null } {
-  // String detail (e.g. some endpoints return `{detail: "..."}` directly).
-  if (typeof detail === "string") {
-    return { message: detail };
-  }
-  // Array detail (Ninja's auto-422 Pydantic validation errors): no usable
-  // single message; let the caller fall back to status/generic copy.
-  if (Array.isArray(detail)) {
-    return {};
-  }
-  // Object detail covers both shapes:
-  //   our MessageResponse: { message, error_code }
-  //   Ninja auto-401:      { detail: "Unauthorized" }
-  if (detail && typeof detail === "object") {
-    const obj = detail as ApiErrorDetail;
-    return { message: obj.message ?? obj.detail, code: obj.error_code };
-  }
-  return {};
-}
-
-export async function parseApiError(
-  response: Response,
-  fallbackMessage: string
-): Promise<ApiError> {
-  let body: ApiErrorBody | undefined;
-  let parsedBody = false;
-  try {
-    body = (await response.json()) as ApiErrorBody;
-    parsedBody = true;
-  } catch {
-    body = undefined;
-  }
-
-  const fromDetail = extractFromDetail(body?.detail);
-  const serverMessage = body?.message ?? fromDetail.message;
-  // Status fallback only applies when the body parsed but had no message
-  // (e.g. Ninja auto-401's `{detail: {detail: "Unauthorized"}}`). When the
-  // body is unparseable (proxy HTML 502, empty body, network jank) the
-  // caller's per-endpoint fallback is the more accurate hint -- a 401 from
-  // a misbehaving proxy is not necessarily an expired session.
-  const message =
-    serverMessage ??
-    (parsedBody ? statusFallback(response.status) : undefined) ??
-    fallbackMessage;
-  const code = body?.error_code ?? fromDetail.code ?? undefined;
-
-  return new ApiError({
-    status: response.status,
-    code,
-    message,
-    shouldRequestNew: body?.should_request_new,
-  });
-}

package/src/shared/notice-consent-status.ts

@@ -1,190 +0,0 @@
-import { jwtDecode } from "jwt-decode";
-
-/**
- * Shared Go-ledger notice `check-consent` read for the consent-sdk-react
- * package.
- *
- * Post-cutover, consent records live in the Go ledger, so the Python
- * `get-notice` endpoint no longer knows whether a principal has already
- * consented (it used to answer that with a 409 `CONSENT_ALREADY_PROVIDED`).
- * Both the banner (`RedactoNoticeConsent`) and the embedded widget
- * (`RedactoNoticeConsentInline`) ask the ledger directly instead — this module
- * is the single implementation they share.
- *
- * Every failure mode (no ledger configured, undecodable token, non-OK
- * response, network/abort/parse error) degrades to `null` so callers can fall
- * back to the legacy Python-driven flow.
- */
-
-type NoticeConsentJwtPayload = {
-  organisation_uuid: string;
-  workspace_uuid: string;
-};
-
-// Mirrors the Go ledger's `NoticeConsentStatusResponse`. Used to overlay the
-// prior-consent / reconsent state from the ledger, since Python's
-// notice-validation overlay is empty after the consent cutover.
-export type NoticeConsentStatusDataElement = {
-  uuid: string;
-  name: string;
-  selected: boolean;
-};
-
-export type NoticeConsentStatusPurpose = {
-  uuid: string;
-  name: string;
-  selected: boolean;
-  status: string; // ACTIVE | EXPIRED | WITHDRAW | DECLINED | INACTIVE
-  expiry_datetime?: string | null;
-  data_elements: NoticeConsentStatusDataElement[];
-};
-
-export type NoticeConsentStatusResponse = {
-  consented: boolean;
-  all_mandatory_active: boolean;
-  purposes: NoticeConsentStatusPurpose[];
-};
-
-export type FetchNoticeConsentStatusParams = {
-  accessToken: string;
-  ledgerBaseUrl?: string;
-  noticeUuid: string;
-  signal?: AbortSignal;
-};
-
-// Same read, but with org/workspace supplied explicitly instead of decoded from
-// the JWT. Used by flows that already hold authoritative org/workspace (props)
-// and whose token may be opaque — e.g. RedactoNoticeAssisted, whose OTP access
-// token carries no org/workspace claims.
-export type FetchNoticeConsentStatusForScopeParams = {
-  accessToken: string;
-  ledgerBaseUrl?: string;
-  organisationUuid: string;
-  workspaceUuid: string;
-  noticeUuid: string;
-  signal?: AbortSignal;
-};
-
-// Decode the JWT to resolve the org/workspace the ledger path is scoped to.
-// Returns null on any decode failure so the caller degrades gracefully.
-const decodeNoticeConsentToken = (
-  token: string
-): NoticeConsentJwtPayload | null => {
-  try {
-    return jwtDecode(token) as NoticeConsentJwtPayload;
-  } catch {
-    return null;
-  }
-};
-
-/**
- * Fetch the principal's current consent status for a notice from the Go
- * ledger (`check-consent`), with org/workspace supplied explicitly. The
- * principal resolves from the bearer token server-side, so the body is empty.
- * Returns null on any failure so the caller can fall back to the Python-driven
- * flow (graceful degradation). This holds the single network implementation;
- * {@link fetchNoticeConsentStatus} decodes the JWT and delegates here.
- */
-export const fetchNoticeConsentStatusForScope = async ({
-  accessToken,
-  ledgerBaseUrl,
-  organisationUuid,
-  workspaceUuid,
-  noticeUuid,
-  signal,
-}: FetchNoticeConsentStatusForScopeParams): Promise<NoticeConsentStatusResponse | null> => {
-  if (
-    !accessToken ||
-    !ledgerBaseUrl ||
-    !organisationUuid ||
-    !workspaceUuid ||
-    !noticeUuid
-  ) {
-    return null;
-  }
-
-  try {
-    const response = await fetch(
-      `${ledgerBaseUrl}/public/organisations/${organisationUuid}/workspaces/${workspaceUuid}/notices/${noticeUuid}/check-consent`,
-      {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${accessToken}`,
-          "Content-Type": "application/json",
-        },
-        body: "{}",
-        signal,
-      }
-    );
-
-    if (!response.ok) {
-      return null;
-    }
-
-    const data = (await response.json()) as
-      | NoticeConsentStatusResponse
-      | { detail?: NoticeConsentStatusResponse };
-    // The ledger returns the response directly; tolerate a {detail} envelope too.
-    const body =
-      data && typeof data === "object" && "detail" in data && data.detail
-        ? data.detail
-        : (data as NoticeConsentStatusResponse);
-
-    if (!body || !Array.isArray(body.purposes)) {
-      return null;
-    }
-    return body;
-  } catch {
-    // Network / abort / parse failure — degrade to the Python-driven flow.
-    return null;
-  }
-};
-
-/**
- * Fetch the principal's current consent status for a notice from the Go
- * ledger (`check-consent`). The org/workspace are resolved by decoding the
- * JWT. Returns null on any failure so the caller can fall back to the
- * Python-provided overlay (graceful degradation).
- */
-export const fetchNoticeConsentStatus = async ({
-  accessToken,
-  ledgerBaseUrl,
-  noticeUuid,
-  signal,
-}: FetchNoticeConsentStatusParams): Promise<NoticeConsentStatusResponse | null> => {
-  if (!accessToken || !ledgerBaseUrl || !noticeUuid) {
-    return null;
-  }
-
-  const decodedToken = decodeNoticeConsentToken(accessToken);
-  if (!decodedToken) {
-    return null;
-  }
-
-  const {
-    organisation_uuid: ORGANISATION_UUID,
-    workspace_uuid: WORKSPACE_UUID,
-  } = decodedToken;
-  if (!ORGANISATION_UUID || !WORKSPACE_UUID) {
-    return null;
-  }
-
-  return fetchNoticeConsentStatusForScope({
-    accessToken,
-    ledgerBaseUrl,
-    organisationUuid: ORGANISATION_UUID,
-    workspaceUuid: WORKSPACE_UUID,
-    noticeUuid,
-    signal,
-  });
-};
-
-/**
- * Whether the principal has already fully consented to this notice with no
- * reconsent needed — the ledger equivalent of Python's 409
- * `CONSENT_ALREADY_PROVIDED`. Requires an active consent record with every
- * mandatory purpose still ACTIVE.
- */
-export const isNoticeFullyConsented = (
-  status: NoticeConsentStatusResponse
-): boolean => status.consented && status.all_mandatory_active;

package/src/shared/sandbox.ts

@@ -1,6 +0,0 @@
-/**
- * HTTP header carrying the static sandbox token (the credential). Its presence
- * marks a request as `environment=test`. Shared by the Notice-consent and
- * Privacy-Center sandbox paths so the header name is defined once.
- */
-export const SANDBOX_TOKEN_HEADER = "X-Consent-Token";

package/src/types/css.d.ts

@@ -1,4 +0,0 @@
-declare module "*.module.css" {
-  const classes: { [key: string]: string };
-  export default classes;
-}

package/src/types/images.d.ts

@@ -1,19 +0,0 @@
-declare module "*.png" {
-  const content: string;
-  export default content;
-}
-
-declare module "*.jpg" {
-  const content: string;
-  export default content;
-}
-
-declare module "*.jpeg" {
-  const content: string;
-  export default content;
-}
-
-declare module "*.svg" {
-  const content: string;
-  export default content;
-}

package/src/types/react-jsx.d.ts

@@ -1,26 +0,0 @@
-/**
- * React 19 JSX compatibility: ensures intrinsic elements (div, button, etc.)
- * and Element type align with React's types to fix "Element is not assignable to ReactNode".
- * @see https://github.com/DefinitelyTyped/DefinitelyTyped/discussions/71395
- */
-import type React from "react";
-
-declare global {
-  namespace JSX {
-    type Element = React.ReactElement;
-  }
-}
-
-declare module "react/jsx-runtime" {
-  namespace JSX {
-    type Element = React.ReactElement;
-    interface IntrinsicElements extends React.JSX.IntrinsicElements {}
-  }
-}
-
-declare module "react/jsx-dev-runtime" {
-  namespace JSX {
-    type Element = React.ReactElement;
-    interface IntrinsicElements extends React.JSX.IntrinsicElements {}
-  }
-}

package/tests/DataAvailabilityContext.test.tsx

@@ -1,123 +0,0 @@
-import { render, screen, waitFor } from '@testing-library/react';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-// ─── API stubs ───────────────────────────────────────────────────────────────
-// The gate calls the direct fetchers (NOT react-query hooks). Each returns
-// `null` on error in production; we exercise both null and rejection paths.
-const fetchUserConsents = vi.fn();
-const fetchCaseHistory = vi.fn();
-const fetchActivities = vi.fn();
-vi.mock('../src/RedactoPrivacyCenter/lib/api', () => ({
-  fetchUserConsents: (...args: unknown[]) => fetchUserConsents(...args),
-  fetchCaseHistory: (...args: unknown[]) => fetchCaseHistory(...args),
-  fetchActivities: (...args: unknown[]) => fetchActivities(...args),
-}));
-
-// ─── Language stub (avoids subscribing to the real i18n event emitter) ───────
-vi.mock('../src/RedactoPrivacyCenter/lib/useCurrentLanguage', () => ({
-  useCurrentLanguage: () => ({ currentLanguage: 'en', langParam: undefined }),
-}));
-
-// ─── Auth / BaseUrl / Organization context stubs ─────────────────────────────
-vi.mock('../src/RedactoPrivacyCenter/context/AuthContext', () => {
-  const auth = {
-    accessToken: 'tok',
-    refreshToken: 'rtok',
-    onError: () => false,
-    updateTokens: () => {},
-  };
-  return { useAuth: () => auth };
-});
-vi.mock('../src/RedactoPrivacyCenter/context/BaseUrlContext', () => {
-  const base = { consentClient: {}, baseUrl: 'https://consent.test' };
-  return { useBaseUrl: () => base };
-});
-vi.mock('../src/RedactoPrivacyCenter/context/OrganizationContext', () => {
-  const org = {
-    organization: { uuid: 'org-uuid', slug: 'acme', name: 'Acme', workspaces: [{ uuid: 'ws-uuid' }] },
-  };
-  return { useOrganization: () => org };
-});
-
-import {
-  DataAvailabilityProvider,
-  useDataAvailability,
-} from '../src/RedactoPrivacyCenter/context/DataAvailabilityContext';
-
-const emptyConsents = { status_summary: { total_purposes: 0 }, direct: [], nominated: [], nominators: [] };
-const emptyCases = { data: [] };
-const emptyActivities = { pagination: { total_count: 0 } };
-
-function StatusProbe() {
-  const { status } = useDataAvailability();
-  return <div data-testid="status">{status}</div>;
-}
-
-function renderGate() {
-  return render(
-    <DataAvailabilityProvider>
-      <StatusProbe />
-    </DataAvailabilityProvider>,
-  );
-}
-
-const waitForStatus = (value: string) =>
-  waitFor(() => expect(screen.getByTestId('status').textContent).toBe(value));
-
-describe('DataAvailabilityContext', () => {
-  beforeEach(() => {
-    sessionStorage.setItem('email', 'user@example.com');
-    // Default: everything empty.
-    fetchUserConsents.mockResolvedValue(emptyConsents);
-    fetchCaseHistory.mockResolvedValue(emptyCases);
-    fetchActivities.mockResolvedValue(emptyActivities);
-  });
-
-  afterEach(() => {
-    vi.clearAllMocks();
-    sessionStorage.clear();
-  });
-
-  it("resolves to 'empty' only when consents, cases, and activity are all empty", async () => {
-    renderGate();
-    await waitForStatus('empty');
-  });
-
-  it("resolves to 'has-data' when there are consents", async () => {
-    fetchUserConsents.mockResolvedValue({ status_summary: { total_purposes: 2 }, direct: [{}], nominated: [], nominators: [] });
-    renderGate();
-    await waitForStatus('has-data');
-  });
-
-  it("resolves to 'has-data' when there are cases", async () => {
-    fetchCaseHistory.mockResolvedValue({ data: [{ uuid: 'c1' }] });
-    renderGate();
-    await waitForStatus('has-data');
-  });
-
-  it("resolves to 'has-data' when there is activity", async () => {
-    fetchActivities.mockResolvedValue({ pagination: { total_count: 4 } });
-    renderGate();
-    await waitForStatus('has-data');
-  });
-
-  it("fails open to 'has-data' when a signal returns null", async () => {
-    // Consents + cases empty, but activity could not be read (null).
-    fetchActivities.mockResolvedValue(null);
-    renderGate();
-    await waitForStatus('has-data');
-  });
-
-  it("fails open to 'has-data' when a signal rejects", async () => {
-    fetchUserConsents.mockRejectedValue(new Error('boom'));
-    renderGate();
-    await waitForStatus('has-data');
-  });
-
-  it("skips the cases fetch when no email is present, treating cases as empty", async () => {
-    sessionStorage.removeItem('email');
-    renderGate();
-    await waitForStatus('empty');
-    expect(fetchCaseHistory).not.toHaveBeenCalled();
-  });
-});