@redacto.io/consent-sdk-react 10.0.0-beta.7 → 10.0.0-beta.9

package/dist/privacy-center.js

@@ -8164,6 +8164,36 @@ var useOrganization = () => {
 // src/RedactoPrivacyCenter/context/DataAvailabilityContext.tsx
 var import_react5 = require("react");
 
+// src/shared/sandbox.ts
+var SANDBOX_TOKEN_HEADER = "X-Consent-Token";
+
+// src/RedactoPrivacyCenter/lib/sandbox.ts
+var sandboxConfig = null;
+var setSandboxConfig = (config) => {
+  sandboxConfig = config;
+};
+var getSandboxConfig = () => sandboxConfig;
+var isSandboxMode = () => sandboxConfig !== null;
+var sandboxAuthHeaders = () => {
+  if (!sandboxConfig) {
+    return null;
+  }
+  return {
+    [SANDBOX_TOKEN_HEADER]: sandboxConfig.token
+  };
+};
+var sandboxBodyIdentity = () => {
+  if (!sandboxConfig) {
+    return null;
+  }
+  if (sandboxConfig.ucic) {
+    return { org_user_id: sandboxConfig.ucic };
+  }
+  return sandboxConfig.subject.includes("@") ? { primary_email: sandboxConfig.subject } : { primary_mobile: sandboxConfig.subject };
+};
+var sandboxQueryIdentity = () => sandboxBodyIdentity();
+var sandboxContact = () => sandboxConfig ? sandboxConfig.ucic || sandboxConfig.subject : null;
+
 // src/RedactoPrivacyCenter/api/fetcher.ts
 var ApiError = class _ApiError extends Error {
   constructor(message, options = {}) {
@@ -8210,11 +8240,18 @@ async function apiFetch(url, options = {}) {
     }
   }
   if (getAuthToken) {
-    const token = await getAuthToken();
-    if (token) {
-      const trimmedToken = token.trim();
-      requestHeaders.set("X-Auth-Token", trimmedToken);
-      requestHeaders.set("x-auth-token", trimmedToken);
+    const sandboxHeaders = sandboxAuthHeaders();
+    if (sandboxHeaders) {
+      Object.entries(sandboxHeaders).forEach(([key, value]) => {
+        requestHeaders.set(key, value);
+      });
+    } else {
+      const token = await getAuthToken();
+      if (token) {
+        const trimmedToken = token.trim();
+        requestHeaders.set("X-Auth-Token", trimmedToken);
+        requestHeaders.set("x-auth-token", trimmedToken);
+      }
     }
   }
   const fetchOptionsFinal = {
@@ -8506,7 +8543,8 @@ async function manageConsentServer(params) {
       params.dataElementUuids,
       params.productUuid,
       params.noticeUuid,
-      params.dataElements
+      params.dataElements,
+      params.language
     );
     if (result && typeof result === "object" && "success" in result) {
       return Boolean(result.success);
@@ -8952,6 +8990,7 @@ var MAX_REFRESH_BACKOFF_MS = 3e5;
 var REFRESH_TOKEN_STORAGE_KEY = "redacto_pc_refresh_token";
 var LEGACY_REFRESH_TOKEN_COOKIE = "refresh_token";
 var FORM_PICKER_GROUP_LIMIT = 100;
+var LEGACY_PRODUCT_GROUP_UUID = "__legacy_flat_purposes__";
 var POLL_INTERVAL = 3e4;
 var NOTIFICATION_PAGE_SIZE = 10;
 var NOTIFICATION_DROPDOWN_LIMIT = 5;
@@ -9179,6 +9218,9 @@ var getInitialState = (slug) => {
 };
 var checkAndRefreshAuth = async (expectedSlug, organizationId, workspaceId, consentClient) => {
   if (typeof window === "undefined") return false;
+  if (getSandboxConfig()) {
+    return true;
+  }
   const accessToken = sessionStorage.getItem("access_token");
   const email = sessionStorage.getItem("email");
   const orgSlug = sessionStorage.getItem("pc_org_slug");
@@ -9289,6 +9331,10 @@ var signOutPrivacyCenter = () => {
 };
 var ensureValidToken = async (organizationId, workspaceId, slug, authContext, consentClient) => {
   if (typeof window === "undefined") return null;
+  const sandbox = getSandboxConfig();
+  if (sandbox) {
+    return sandbox.token;
+  }
   const accessToken = (authContext == null ? void 0 : authContext.accessToken) || sessionStorage.getItem("access_token");
   if (accessToken && typeof accessToken === "string" && accessToken.trim() !== "" && !isJwtExpired(accessToken, TOKEN_EXPIRY_BUFFER_SECONDS)) {
     return accessToken;
@@ -9617,7 +9663,8 @@ var manageConsent = async ({
   dataElementUuids,
   productUuid,
   noticeUuid,
-  dataElements
+  dataElements,
+  language
 }) => {
   try {
     const accessToken = await ensureValidToken(organizationId, workspaceId, void 0, authContext, consentClient);
@@ -9636,7 +9683,8 @@ var manageConsent = async ({
       dataElementUuids,
       productUuid,
       noticeUuid,
-      dataElements
+      dataElements,
+      language
     });
     return result;
   } catch (error) {
@@ -9862,6 +9910,45 @@ function useCurrentLanguage() {
 var import_react3 = require("react");
 var import_jsx_runtime3 = require("react/jsx-runtime");
 var AuthContext = (0, import_react3.createContext)(null);
+var seedSessionStorage = (data) => {
+  if (typeof window === "undefined") {
+    return;
+  }
+  if (data.accessToken) sessionStorage.setItem("access_token", data.accessToken);
+  if (data.orgId) sessionStorage.setItem("pc_org_id", data.orgId);
+  if (data.workspaceId) sessionStorage.setItem("pc_workspace_id", data.workspaceId);
+  if (data.slug) sessionStorage.setItem("pc_org_slug", data.slug);
+  if (data.contact) sessionStorage.setItem("email", data.contact);
+};
+var configureSandbox = (props) => {
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+  const token = (_a = props.token) == null ? void 0 : _a.trim();
+  if (!token) {
+    setSandboxConfig(null);
+    return false;
+  }
+  const organisationUuid = (_c = (_b = props.organisationUuid) == null ? void 0 : _b.trim()) != null ? _c : "";
+  const workspaceUuid = (_e = (_d = props.workspaceUuid) == null ? void 0 : _d.trim()) != null ? _e : "";
+  const ucic = (_g = (_f = props.sandboxUcic) == null ? void 0 : _f.trim()) != null ? _g : "";
+  const subject = (_i = (_h = props.sandboxSubject) == null ? void 0 : _h.trim()) != null ? _i : "";
+  const slug = (_k = (_j = props.slug) == null ? void 0 : _j.trim()) != null ? _k : "";
+  setSandboxConfig({
+    token,
+    ucic: ucic || void 0,
+    subject,
+    organisationUuid,
+    workspaceUuid,
+    slug
+  });
+  seedSessionStorage({
+    accessToken: token,
+    orgId: organisationUuid,
+    workspaceId: workspaceUuid,
+    slug,
+    contact: ucic || subject
+  });
+  return true;
+};
 var syncJwtDataToSessionStorage = (accessToken) => {
   if (typeof window === "undefined") return;
   const decoded = decodeJwtToken(accessToken);
@@ -9869,44 +9956,49 @@ var syncJwtDataToSessionStorage = (accessToken) => {
     return;
   }
   const contact = resolveContactFromJwt(decoded) || sessionStorage.getItem("email") || (typeof localStorage !== "undefined" ? localStorage.getItem("userEmail") : null);
-  if (contact && typeof contact === "string") {
-    sessionStorage.setItem("email", contact);
-  }
-  const orgUuid = decoded.organisation_uuid;
-  if (orgUuid && typeof orgUuid === "string") {
-    sessionStorage.setItem("pc_org_id", orgUuid);
-  }
-  const workspaceUuid = decoded.workspace_uuid;
-  if (workspaceUuid && typeof workspaceUuid === "string") {
-    sessionStorage.setItem("pc_workspace_id", workspaceUuid);
-  }
-  const orgSlug = decoded.organisation_slug;
-  if (orgSlug && typeof orgSlug === "string") {
-    sessionStorage.setItem("pc_org_slug", orgSlug);
-  }
+  seedSessionStorage({
+    orgId: typeof decoded.organisation_uuid === "string" ? decoded.organisation_uuid : void 0,
+    workspaceId: typeof decoded.workspace_uuid === "string" ? decoded.workspace_uuid : void 0,
+    slug: typeof decoded.organisation_slug === "string" ? decoded.organisation_slug : void 0,
+    contact: typeof contact === "string" ? contact : void 0
+  });
 };
-var AuthProvider = ({
-  children,
-  accessToken: initialAccessToken,
-  refreshToken: initialRefreshToken,
-  onError
-}) => {
+var AuthProvider = (props) => {
+  const {
+    children,
+    accessToken: initialAccessToken,
+    refreshToken: initialRefreshToken,
+    token: sandboxToken,
+    sandboxUcic,
+    sandboxSubject,
+    organisationUuid,
+    workspaceUuid,
+    slug,
+    onError
+  } = props;
+  const [sandboxActive] = (0, import_react3.useState)(() => configureSandbox(props));
   const [accessToken, setAccessToken] = (0, import_react3.useState)(() => {
+    if (sandboxActive) {
+      return sandboxToken != null ? sandboxToken : "";
+    }
     if (initialAccessToken && typeof initialAccessToken === "string" && initialAccessToken.trim() !== "") {
       if (typeof window !== "undefined") {
         sessionStorage.setItem("access_token", initialAccessToken);
         syncJwtDataToSessionStorage(initialAccessToken);
       }
     }
-    return initialAccessToken;
+    return initialAccessToken != null ? initialAccessToken : "";
   });
   const [refreshToken, setRefreshToken] = (0, import_react3.useState)(() => {
+    if (sandboxActive) {
+      return "";
+    }
     if (initialRefreshToken && typeof initialRefreshToken === "string" && initialRefreshToken.trim() !== "") {
       if (typeof window !== "undefined") {
         setRefreshTokenCookie(initialRefreshToken);
       }
     }
-    return initialRefreshToken;
+    return initialRefreshToken != null ? initialRefreshToken : "";
   });
   const [sessionExpired, setSessionExpired] = (0, import_react3.useState)(false);
   const markSessionExpired = (0, import_react3.useCallback)(() => setSessionExpired(true), []);
@@ -9915,6 +10007,9 @@ var AuthProvider = ({
     return () => setSessionExpiredListener(null);
   }, [markSessionExpired]);
   (0, import_react3.useEffect)(() => {
+    if (sandboxActive) {
+      return;
+    }
     if (initialAccessToken && typeof initialAccessToken === "string" && initialAccessToken.trim() !== "") {
       setAccessToken(initialAccessToken);
       if (typeof window !== "undefined") {
@@ -9922,8 +10017,11 @@ var AuthProvider = ({
         syncJwtDataToSessionStorage(initialAccessToken);
       }
     }
-  }, [initialAccessToken]);
+  }, [initialAccessToken, sandboxActive]);
   (0, import_react3.useEffect)(() => {
+    if (sandboxActive) {
+      return;
+    }
     if (initialRefreshToken && typeof initialRefreshToken === "string" && initialRefreshToken.trim() !== "") {
       setRefreshToken(initialRefreshToken);
       setSessionExpired(false);
@@ -9931,7 +10029,14 @@ var AuthProvider = ({
         setRefreshTokenCookie(initialRefreshToken);
       }
     }
-  }, [initialRefreshToken]);
+  }, [initialRefreshToken, sandboxActive]);
+  (0, import_react3.useEffect)(() => {
+    if (!sandboxActive) {
+      return;
+    }
+    configureSandbox(props);
+    return () => setSandboxConfig(null);
+  }, [sandboxActive, sandboxToken, sandboxUcic, sandboxSubject, organisationUuid, workspaceUuid, slug]);
   const updateTokens = (0, import_react3.useCallback)((newAccessToken, newRefreshToken) => {
     setAccessToken(newAccessToken);
     if (newRefreshToken) {
@@ -9968,7 +10073,8 @@ var import_react4 = require("react");
 
 // src/RedactoPrivacyCenter/api/client.ts
 function createConsentClient(baseUrl, ledgerBaseUrl) {
-  const useLedger = Boolean(ledgerBaseUrl);
+  const ledgerConfigured = Boolean(ledgerBaseUrl);
+  const useLedger = () => ledgerConfigured && !isSandboxMode();
   const ledgerBase = (ledgerBaseUrl != null ? ledgerBaseUrl : "").replace(/\/$/, "");
   async function privacyCenterApiFetch(url, options) {
     const { authToken, getAuthToken, headers = {}, ...fetchOptions } = options;
@@ -9993,11 +10099,18 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
         );
       }
     }
-    const token = authToken || (getAuthToken ? await getAuthToken() : null);
-    if (token) {
-      const trimmedToken = token.trim();
-      const bearerToken = trimmedToken.startsWith("Bearer ") ? trimmedToken : `Bearer ${trimmedToken}`;
-      requestHeaders.set("Authorization", bearerToken);
+    const sandboxHeaders = sandboxAuthHeaders();
+    if (sandboxHeaders) {
+      Object.entries(sandboxHeaders).forEach(([key, value]) => {
+        requestHeaders.set(key, value);
+      });
+    } else {
+      const token = authToken || (getAuthToken ? await getAuthToken() : null);
+      if (token) {
+        const trimmedToken = token.trim();
+        const bearerToken = trimmedToken.startsWith("Bearer ") ? trimmedToken : `Bearer ${trimmedToken}`;
+        requestHeaders.set("Authorization", bearerToken);
+      }
     }
     const fetchOptionsFinal = {
       ...fetchOptions,
@@ -10063,7 +10176,7 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
     return `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center${path}`;
   }
   function ledgerUrl(baseRequest, path) {
-    if (!useLedger) {
+    if (!useLedger()) {
       throw new Error("ledgerUrl called without a configured ledgerBaseUrl");
     }
     return `${ledgerBase}/public/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}${path}`;
@@ -10072,11 +10185,30 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
     return privacyCenterUrl(baseRequest, `/cases/${caseUuid}${path}`);
   }
   function notificationUrl(baseRequest, path = "") {
-    return privacyCenterUrl(baseRequest, `/notifications${path}`);
+    const identitySuffix = sandboxIdentitySuffix();
+    if (!identitySuffix) {
+      return privacyCenterUrl(baseRequest, `/notifications${path}`);
+    }
+    const separator = path.includes("?") ? `&${identitySuffix.slice(1)}` : identitySuffix;
+    return privacyCenterUrl(baseRequest, `/notifications${path}${separator}`);
   }
   function resolveAuthToken(authToken, baseRequest) {
     return authToken || baseRequest.authToken;
   }
+  function appendSandboxIdentity(queryParams) {
+    const identity = sandboxQueryIdentity();
+    if (identity) {
+      Object.entries(identity).forEach(([key, value]) => {
+        queryParams.append(key, value);
+      });
+    }
+  }
+  function sandboxIdentitySuffix() {
+    const queryParams = new URLSearchParams();
+    appendSandboxIdentity(queryParams);
+    const queryString = queryParams.toString();
+    return queryString ? `?${queryString}` : "";
+  }
   return {
     /**
      * Get form data (privacy center)
@@ -10108,18 +10240,20 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
     async createCaseRequest(baseRequest, payload, authToken, options) {
       const url = privacyCenterUrl(baseRequest, "/case");
       const { useSessionAuth = false, getAuthToken, ...fetchOptions } = options || {};
+      const contact = sandboxContact();
+      const requestPayload = contact && payload && typeof payload === "object" ? { ...payload, contact } : payload;
       if (useSessionAuth) {
         return apiFetch(url, {
           ...fetchOptions,
           method: "POST",
-          body: JSON.stringify(payload),
+          body: JSON.stringify(requestPayload),
           getAuthToken
         });
       }
       return privacyCenterApiFetch(url, {
         ...fetchOptions,
         method: "POST",
-        body: JSON.stringify(payload),
+        body: JSON.stringify(requestPayload),
         authToken: resolveAuthToken(authToken, baseRequest)
       });
     },
@@ -10200,9 +10334,10 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
       if (params.status) queryParams.append("status", params.status);
       if (params.product_uuid) queryParams.append("product_uuid", params.product_uuid);
       if (params.language) queryParams.append("language", params.language);
+      appendSandboxIdentity(queryParams);
       const queryString = queryParams.toString();
       const suffix = `/user-consents${queryString ? `?${queryString}` : ""}`;
-      const url = useLedger ? ledgerUrl(baseRequest, suffix) : privacyCenterUrl(baseRequest, suffix);
+      const url = useLedger() ? ledgerUrl(baseRequest, suffix) : privacyCenterUrl(baseRequest, suffix);
       return privacyCenterApiFetch(url, {
         ...options,
         method: "GET",
@@ -10222,9 +10357,10 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
       if (params.search) queryParams.append("search", params.search);
       if (params.language) queryParams.append("language", params.language);
       if (params.nominator_uuid) queryParams.append("nominator_uuid", params.nominator_uuid);
+      appendSandboxIdentity(queryParams);
       const queryString = queryParams.toString();
       const suffix = `/user-consents/${productUuid}/purposes${queryString ? `?${queryString}` : ""}`;
-      const url = useLedger ? ledgerUrl(baseRequest, suffix) : privacyCenterUrl(baseRequest, suffix);
+      const url = useLedger() ? ledgerUrl(baseRequest, suffix) : privacyCenterUrl(baseRequest, suffix);
       return privacyCenterApiFetch(url, {
         ...options,
         method: "GET",
@@ -10247,8 +10383,8 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
      * Without a ledger, the legacy Python `/manage-consent?status=` endpoint is
      * used with its `{ purpose_uuid, contact, ... }` payload.
      */
-    async manageConsent(baseRequest, purposeId, contact, status, authToken, options, nominatorContact, dataElementUuids, productUuid, noticeUuid, dataElements) {
-      if (!useLedger) {
+    async manageConsent(baseRequest, purposeId, contact, status, authToken, options, nominatorContact, dataElementUuids, productUuid, noticeUuid, dataElements, language) {
+      if (!useLedger()) {
         const url2 = privacyCenterUrl(baseRequest, `/manage-consent?status=${status}`);
         const body2 = { purpose_uuid: purposeId, contact };
         if (nominatorContact) {
@@ -10260,6 +10396,9 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
         if (productUuid) {
           body2.product_uuid = productUuid;
         }
+        if (language) {
+          body2.language = language;
+        }
         return privacyCenterApiFetch(url2, {
           ...options,
           method: "POST",
@@ -10294,7 +10433,8 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
             selected: purposeSelected,
             data_elements: elements
           }
-        ]
+        ],
+        ...language ? { language } : {}
       };
       const url = ledgerUrl(baseRequest, "/submit-consent");
       return privacyCenterApiFetch(url, {
@@ -10312,6 +10452,7 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
       if (offset !== void 0) queryParams.append("offset", offset.toString());
       if (limit !== void 0) queryParams.append("limit", limit.toString());
       if (language) queryParams.append("language", language);
+      appendSandboxIdentity(queryParams);
       const queryString = queryParams.toString();
       const url = privacyCenterUrl(baseRequest, `/activities${queryString ? `?${queryString}` : ""}`);
       return privacyCenterApiFetch(url, {
@@ -10361,7 +10502,7 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
       if (params.language) queryParams.append("language", params.language);
       const queryString = queryParams.toString();
       const receiptsSuffix = `/receipts${queryString ? `?${queryString}` : ""}`;
-      const url = useLedger ? ledgerUrl(baseRequest, receiptsSuffix) : privacyCenterUrl(baseRequest, receiptsSuffix);
+      const url = useLedger() ? ledgerUrl(baseRequest, receiptsSuffix) : privacyCenterUrl(baseRequest, receiptsSuffix);
       return privacyCenterApiFetch(url, {
         ...options,
         method: "GET",
@@ -10376,11 +10517,16 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
      * and the Authorization header must be sent (anchor navigation wouldn't carry it).
      */
     async getReceiptPdf(baseRequest, receiptUuid, authToken) {
-      const url = useLedger ? ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`) : privacyCenterUrl(baseRequest, `/receipts/${receiptUuid}/pdf`);
+      const url = useLedger() ? ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`) : privacyCenterUrl(baseRequest, `/receipts/${receiptUuid}/pdf`);
       const token = resolveAuthToken(authToken, baseRequest);
       const requestHeaders = new Headers();
       requestHeaders.set("Accept", "application/pdf");
-      if (token) {
+      const sandboxHeaders = sandboxAuthHeaders();
+      if (sandboxHeaders) {
+        Object.entries(sandboxHeaders).forEach(([key, value]) => {
+          requestHeaders.set(key, value);
+        });
+      } else if (token) {
         const trimmedToken = token.trim();
         requestHeaders.set(
           "Authorization",
@@ -10411,6 +10557,7 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
       if (offset !== void 0) queryParams.append("offset", offset.toString());
       if (limit !== void 0) queryParams.append("limit", limit.toString());
       if (language) queryParams.append("language", language);
+      appendSandboxIdentity(queryParams);
       const queryString = queryParams.toString();
       const url = privacyCenterUrl(baseRequest, `/cases?${queryString}`);
       return privacyCenterApiFetch(url, {
@@ -10423,7 +10570,7 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
      * Get messages for a case (privacy center)
      */
     async getCaseMessages(baseRequest, caseUuid, authToken) {
-      const url = caseUrl(baseRequest, caseUuid, "/messages");
+      const url = caseUrl(baseRequest, caseUuid, `/messages${sandboxIdentitySuffix()}`);
       return privacyCenterApiFetch(url, {
         authToken: resolveAuthToken(authToken, baseRequest)
       });
@@ -10432,7 +10579,7 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
      * Send a message on a case (privacy center)
      */
     async sendCaseMessage(baseRequest, caseUuid, body, documentUuids, authToken) {
-      const url = caseUrl(baseRequest, caseUuid, "/messages");
+      const url = caseUrl(baseRequest, caseUuid, `/messages${sandboxIdentitySuffix()}`);
       return privacyCenterApiFetch(url, {
         method: "POST",
         body: JSON.stringify({ body, document_uuids: documentUuids }),
@@ -10443,7 +10590,7 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
      * Upload a document on a case (multipart/form-data, privacy center)
      */
     async uploadCaseDocument(baseRequest, caseUuid, file, authToken) {
-      const url = caseUrl(baseRequest, caseUuid, "/upload-document");
+      const url = caseUrl(baseRequest, caseUuid, `/upload-document${sandboxIdentitySuffix()}`);
       const formData = new FormData();
       formData.append("file", file, file.name);
       formData.append("payload", JSON.stringify({ metadata: null }));
@@ -15232,6 +15379,10 @@ var SelectUserGate = ({ children }) => {
   const tokenOrgUserId = ((_d = (_c = decodeJwtToken(accessToken)) == null ? void 0 : _c.user_data) == null ? void 0 : _d.org_user_id) || "";
   (0, import_react32.useEffect)(() => {
     let cancelled = false;
+    if (isSandboxMode()) {
+      setPhase("resolved");
+      return;
+    }
     if (!organizationId || !workspaceId || !accessToken) {
       setPhase("resolved");
       return;
@@ -18409,7 +18560,8 @@ function ConsentManager({ variant }) {
           dataElementUuids,
           productUuid,
           noticeUuid,
-          dataElements
+          dataElements,
+          language: langParam
         });
         if (response) {
           toast.success(successMessages[action]);
@@ -18438,7 +18590,7 @@ function ConsentManager({ variant }) {
         handleCloseModal();
       }
     },
-    [organizationId, workspaceId, contact, fetchData, handleCloseModal, t, authContext, consentClient, selectedRecord]
+    [organizationId, workspaceId, contact, fetchData, handleCloseModal, t, authContext, consentClient, selectedRecord, langParam]
   );
   const getVar26 = (varName) => `var(${varName})`;
   const directBadge = (_c = (_b = consentDetail == null ? void 0 : consentDetail.status_summary) == null ? void 0 : _b.direct_purposes) != null ? _c : "";
@@ -18974,23 +19126,36 @@ var consentGroupToFormProductGroup = (group) => {
   };
 };
 var purposeItemToFormPurpose = (purpose) => {
-  var _a, _b;
+  var _a, _b, _c, _d, _e, _f;
   return {
-    uuid: purpose.purpose_uuid,
-    purpose_uuid: purpose.purpose_uuid,
+    // The ledger keys purposes as `purpose_uuid`; the legacy Python
+    // user-consents payload keys some of them as `uuid`. Accept either so the
+    // picker and the submitted `purpose_uuid` resolve on both backends.
+    uuid: (_b = (_a = purpose.purpose_uuid) != null ? _a : purpose.uuid) != null ? _b : "",
+    purpose_uuid: (_d = (_c = purpose.purpose_uuid) != null ? _c : purpose.uuid) != null ? _d : "",
     name: purpose.name,
-    description: (_a = purpose.description) != null ? _a : "",
+    description: (_e = purpose.description) != null ? _e : "",
     industries: "",
     selected: false,
     given_consent: false,
     status: purpose.status,
     validity: null,
     enabled: true,
-    data_elements: ((_b = purpose.data_elements) != null ? _b : []).map(
+    data_elements: ((_f = purpose.data_elements) != null ? _f : []).map(
       consentDataElementToFormDataElement
     )
   };
 };
+var legacyFlatGroup = (form, label) => {
+  var _a;
+  return {
+    product_uuid: LEGACY_PRODUCT_GROUP_UUID,
+    product_name: label,
+    product_description: null,
+    nominator: null,
+    purposes: ((_a = form.purposes) != null ? _a : []).map((wrapper) => wrapper == null ? void 0 : wrapper.purpose).filter((purpose) => Boolean(purpose))
+  };
+};
 var consentDataElementToFormDataElement = (element) => ({
   uuid: element.uuid,
   name: element.name,
@@ -20147,7 +20312,7 @@ function Form({
   const [isSubmitted, setIsSubmitted] = (0, import_react44.useState)(false);
   const { t } = (0, import_react_i18next35.useTranslation)();
   const { accessToken, refreshToken, onError, updateTokens } = useAuth();
-  const { consentClient, baseUrl, ledgerBaseUrl } = useBaseUrl();
+  const { consentClient, baseUrl } = useBaseUrl();
   const organizationId = organization == null ? void 0 : organization.uuid;
   const workspaceId = (_a = organization == null ? void 0 : organization.workspaces[0]) == null ? void 0 : _a.uuid;
   const authContext = (0, import_react44.useMemo)(() => ({
@@ -20209,8 +20374,19 @@ function Form({
     if (!data) {
       return [];
     }
-    return [...(_a2 = data.direct_groups) != null ? _a2 : [], ...(_b2 = data.nominated_groups) != null ? _b2 : []];
-  }, [data]);
+    const groups = [
+      ...(_a2 = data.direct_groups) != null ? _a2 : [],
+      ...(_b2 = data.nominated_groups) != null ? _b2 : []
+    ];
+    if (groups.length > 0) {
+      return groups;
+    }
+    const flatGroup = legacyFlatGroup(data, t("yourData"));
+    if (buildGroupPurposes(flatGroup).length === 0) {
+      return [];
+    }
+    return [flatGroup];
+  }, [data, t]);
   const skipProductStep = allGroups.length === 1;
   const selectedGroup = (0, import_react44.useMemo)(() => {
     var _a2, _b2;
@@ -20228,10 +20404,10 @@ function Form({
     },
     []
   );
-  const withLedgerPickerGroups = (0, import_react44.useCallback)(
+  const withUserConsentPickerGroups = (0, import_react44.useCallback)(
     async (form, language) => {
       var _a2, _b2;
-      if (!ledgerBaseUrl || isPopup || isCaseManagementContext || !organizationId || !workspaceId) {
+      if (isPopup || isCaseManagementContext || !organizationId || !workspaceId) {
         return form;
       }
       const consents = await fetchUserConsents({
@@ -20246,19 +20422,18 @@ function Form({
         nominatedLimit: FORM_PICKER_GROUP_LIMIT,
         language
       });
-      if (!consents) {
+      const direct = (_a2 = consents == null ? void 0 : consents.direct) != null ? _a2 : [];
+      const nominated = (_b2 = consents == null ? void 0 : consents.nominated) != null ? _b2 : [];
+      if (direct.length === 0 && nominated.length === 0) {
         return form;
       }
       return {
         ...form,
-        direct_groups: ((_a2 = consents.direct) != null ? _a2 : []).map(consentGroupToFormProductGroup),
-        nominated_groups: ((_b2 = consents.nominated) != null ? _b2 : []).map(
-          consentGroupToFormProductGroup
-        )
+        direct_groups: direct.map(consentGroupToFormProductGroup),
+        nominated_groups: nominated.map(consentGroupToFormProductGroup)
       };
     },
     [
-      ledgerBaseUrl,
       isPopup,
       isCaseManagementContext,
       organizationId,
@@ -20295,7 +20470,7 @@ function Form({
         toast.info(t("translationNotAvailable"));
         return;
       }
-      setData(await withLedgerPickerGroups(translatedFormData, langValue));
+      setData(await withUserConsentPickerGroups(translatedFormData, langValue));
       if (translatedFormData.grievance_options) {
         const currentGrievanceSelections = { ...selectedGrievances };
         setGrievanceOptions(translatedFormData.grievance_options);
@@ -20311,7 +20486,7 @@ function Form({
     } finally {
       setIsTranslating(false);
     }
-  }, [organizationId, workspaceId, data, formData.contact, isPopup, isCaseManagementContext, authContext, consentClient, selectedGrievances, t, withLedgerPickerGroups]);
+  }, [organizationId, workspaceId, data, formData.contact, isPopup, isCaseManagementContext, authContext, consentClient, selectedGrievances, t, withUserConsentPickerGroups]);
   (0, import_react44.useEffect)(() => {
     if (!skipProductStep) {
       setSelectedProductKey(null);
@@ -20417,7 +20592,7 @@ function Form({
             console.warn("No purposes with data elements found in API response");
           }
         }
-        const pickerData = await withLedgerPickerGroups(
+        const pickerData = await withUserConsentPickerGroups(
           displayData,
           langParam || void 0
         );
@@ -20441,7 +20616,7 @@ function Form({
       }
     };
     void initializePrivacyCenterForm();
-  }, [organizationId, workspaceId, isPopup, authContext, consentClient, withLedgerPickerGroups]);
+  }, [organizationId, workspaceId, isPopup, authContext, consentClient, withUserConsentPickerGroups]);
   const getEnglishDataElementName = (0, import_react44.useCallback)((translatedName) => {
     var _a2, _b2, _c2;
     if (!((_a2 = englishDataRef.current) == null ? void 0 : _a2.purposes)) {
@@ -20503,7 +20678,8 @@ function Form({
       return;
     }
     const isProductScoped = isProductScopedRequestType(requestType);
-    const anchorGroup = isProductScoped ? selectedGroup : null;
+    const isLegacyFlatSelection = (selectedGroup == null ? void 0 : selectedGroup.product_uuid) === LEGACY_PRODUCT_GROUP_UUID;
+    const anchorGroup = isProductScoped && !isLegacyFlatSelection ? selectedGroup : null;
     const requestDetails = {
       purposes: [],
       correction_data: [],
@@ -27959,6 +28135,12 @@ function RedactoPrivacyCenter({
   slug,
   accessToken,
   refreshToken,
+  token,
+  email,
+  mobile,
+  ucic,
+  organisationUuid,
+  workspaceUuid,
   onError,
   initialPage = "consent-manager",
   onBack
@@ -27968,6 +28150,12 @@ function RedactoPrivacyCenter({
     {
       accessToken,
       refreshToken,
+      token,
+      sandboxUcic: ucic,
+      sandboxSubject: email || mobile,
+      organisationUuid,
+      workspaceUuid,
+      slug,
       onError,
       children: /* @__PURE__ */ (0, import_jsx_runtime92.jsx)(NavigationProvider, { initialPage, children: /* @__PURE__ */ (0, import_jsx_runtime92.jsx)(PageChromeProvider, { children: /* @__PURE__ */ (0, import_jsx_runtime92.jsx)(PrivacyCenterLayout, { slug, onBack, children: /* @__PURE__ */ (0, import_jsx_runtime92.jsx)(PrivacyCenterHomePage, {}) }) }) })
     }