@redacto.io/consent-sdk-react 10.0.0-beta.7 → 10.0.0-beta.9

package/src/RedactoPrivacyCenter/RedactoPrivacyCenter.tsx

@@ -17,8 +17,31 @@ interface RedactoPrivacyCenterProps {
   baseUrl: string; // Consent server base URL
   ledgerBaseUrl?: string; // Go ledger base URL — serves user-consents; omit to use the legacy Python privacy-center consent endpoints
   slug: string;
-  accessToken: string;
-  refreshToken: string;
+  /** JWT access token. Optional so sandbox mode (see `token`) can omit it. */
+  accessToken?: string;
+  /** JWT refresh token. Optional; used by the OTP-refresh loop in the JWT flow. */
+  refreshToken?: string;
+  /**
+   * Sandbox PoC: a pasted static token. When set, the Privacy Center runs
+   * against the sandbox with no JWT — it sends the single `X-Consent-Token`
+   * header, carries the acting identity (`email` || `mobile`) in each request's
+   * own payload, takes org/workspace from `organisationUuid`/`workspaceUuid`,
+   * and never calls `/otp/refresh`.
+   */
+  token?: string;
+  /** Sandbox test subject email (carried in the request payload when set). */
+  email?: string;
+  /** Sandbox test subject mobile (fallback subject when `email` is absent). */
+  mobile?: string;
+  /**
+   * Sandbox UCIC: the client's own user id / org_user_id, e.g. a UUID or
+   * customer code; optional third identifier alongside email/mobile.
+   */
+  ucic?: string;
+  /** Sandbox org UUID (replaces the JWT-decoded org in sandbox mode). */
+  organisationUuid?: string;
+  /** Sandbox workspace UUID (replaces the JWT-decoded workspace in sandbox mode). */
+  workspaceUuid?: string;
   onError: (error: Error) => boolean;
   initialPage?: InternalPage;
   onBack?: 'back' | 'signout';
@@ -30,6 +53,12 @@ export function RedactoPrivacyCenter({
   slug,
   accessToken,
   refreshToken,
+  token,
+  email,
+  mobile,
+  ucic,
+  organisationUuid,
+  workspaceUuid,
   onError,
   initialPage = 'consent-manager',
   onBack,
@@ -41,6 +70,12 @@ export function RedactoPrivacyCenter({
           <AuthProvider
             accessToken={accessToken}
             refreshToken={refreshToken}
+            token={token}
+            sandboxUcic={ucic}
+            sandboxSubject={email || mobile}
+            organisationUuid={organisationUuid}
+            workspaceUuid={workspaceUuid}
+            slug={slug}
             onError={onError}
           >
             <NavigationProvider initialPage={initialPage}>

package/src/RedactoPrivacyCenter/api/actions.ts

@@ -357,6 +357,7 @@ export async function manageConsentServer(params: {
   productUuid?: string;
   noticeUuid?: string;
   dataElements?: Array<{ uuid: string; selected: boolean }>;
+  language?: string;
 }): Promise<boolean | null> {
   try {
     if (!params.consentClient) {
@@ -381,7 +382,8 @@ export async function manageConsentServer(params: {
       params.dataElementUuids,
       params.productUuid,
       params.noticeUuid,
-      params.dataElements
+      params.dataElements,
+      params.language
     );
     if (result && typeof result === 'object' && 'success' in result) {
       return Boolean((result as LegacyManageConsentResponse).success);

package/src/RedactoPrivacyCenter/api/client.ts

@@ -1,5 +1,11 @@
 import { apiFetch, ApiError } from "./fetcher";
 import type { ApiFetchOptions, ApiResponse } from "./fetcher";
+import {
+  isSandboxMode,
+  sandboxAuthHeaders,
+  sandboxContact,
+  sandboxQueryIdentity,
+} from "../lib/sandbox";
 import type {
   CaseMessage,
   IdentityListResponse,
@@ -33,7 +39,11 @@ export type BaseRequest = {
  *   integrations without a deployed ledger keep working.
  */
 export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
-  const useLedger = Boolean(ledgerBaseUrl);
+  const ledgerConfigured = Boolean(ledgerBaseUrl);
+  // Sandbox mode never routes to the Go ledger (it has no sandbox / test::
+  // support). A sandbox token forces the legacy consent-server path regardless
+  // of ledgerBaseUrl, so isolation can't be bypassed by also configuring a ledger.
+  const useLedger = () => ledgerConfigured && !isSandboxMode();
   const ledgerBase = (ledgerBaseUrl ?? "").replace(/\/$/, "");
   /**
    * Privacy Center API fetch wrapper that uses Authorization: Bearer header.
@@ -72,15 +82,26 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
       }
     }
 
-    // Add Authorization Bearer token for privacy center APIs
-    const token = authToken || (getAuthToken ? await getAuthToken() : null);
-    if (token) {
-      const trimmedToken = token.trim();
-      // Format token with Bearer prefix if not already present
-      const bearerToken = trimmedToken.startsWith('Bearer ')
-        ? trimmedToken
-        : `Bearer ${trimmedToken}`;
-      requestHeaders.set("Authorization", bearerToken);
+    // Sandbox PoC: send only the X-Consent-Token credential (no JWT bearer). Set
+    // last so it wins over any caller-supplied Authorization header. The acting
+    // identity travels in the request payload -- query params on reads, the body
+    // on writes -- never a header.
+    const sandboxHeaders = sandboxAuthHeaders();
+    if (sandboxHeaders) {
+      Object.entries(sandboxHeaders).forEach(([key, value]) => {
+        requestHeaders.set(key, value);
+      });
+    } else {
+      // Add Authorization Bearer token for privacy center APIs
+      const token = authToken || (getAuthToken ? await getAuthToken() : null);
+      if (token) {
+        const trimmedToken = token.trim();
+        // Format token with Bearer prefix if not already present
+        const bearerToken = trimmedToken.startsWith('Bearer ')
+          ? trimmedToken
+          : `Bearer ${trimmedToken}`;
+        requestHeaders.set("Authorization", bearerToken);
+      }
     }
 
     // Build fetch options
@@ -180,7 +201,7 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
   }
 
   function ledgerUrl(baseRequest: BaseRequest, path: string): string {
-    if (!useLedger) {
+    if (!useLedger()) {
       throw new Error("ledgerUrl called without a configured ledgerBaseUrl");
     }
     return `${ledgerBase}/public/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}${path}`;
@@ -191,13 +212,47 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
   }
 
   function notificationUrl(baseRequest: BaseRequest, path = ''): string {
-    return privacyCenterUrl(baseRequest, `/notifications${path}`);
+    const identitySuffix = sandboxIdentitySuffix();
+    if (!identitySuffix) {
+      return privacyCenterUrl(baseRequest, `/notifications${path}`);
+    }
+    const separator = path.includes('?') ? `&${identitySuffix.slice(1)}` : identitySuffix;
+    return privacyCenterUrl(baseRequest, `/notifications${path}${separator}`);
   }
 
   function resolveAuthToken(authToken: string | undefined, baseRequest: BaseRequest): string {
     return authToken || baseRequest.authToken;
   }
 
+  /**
+   * Append the sandbox acting identity (`primary_email` / `primary_mobile`) to a
+   * query-param bag when sandbox mode is active; a no-op otherwise. The server
+   * resolves the acting test identity from these query params on reads (there is
+   * no subject header). The credential is the X-Consent-Token header set in
+   * privacyCenterApiFetch.
+   */
+  function appendSandboxIdentity(queryParams: URLSearchParams): void {
+    const identity = sandboxQueryIdentity();
+    if (identity) {
+      Object.entries(identity).forEach(([key, value]) => {
+        queryParams.append(key, value);
+      });
+    }
+  }
+
+  /**
+   * The sandbox acting-identity query suffix (`?primary_email=...` /
+   * `?primary_mobile=...`) for endpoints that build a bare URL with no other
+   * query params (the case-communication reads/POSTs). Empty string outside
+   * sandbox mode, so the JWT path is unchanged.
+   */
+  function sandboxIdentitySuffix(): string {
+    const queryParams = new URLSearchParams();
+    appendSandboxIdentity(queryParams);
+    const queryString = queryParams.toString();
+    return queryString ? `?${queryString}` : "";
+  }
+
   return {
     /**
      * Get form data (privacy center)
@@ -247,13 +302,23 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
       const url = privacyCenterUrl(baseRequest, '/case');
       const { useSessionAuth = false, getAuthToken, ...fetchOptions } = options || {};
 
+      // Sandbox mode: the acting test identity is the single `contact` field
+      // (the server has no subject header; it namespaces this identity `test::`).
+      // Merge it into the body only when sandbox mode is active and the payload
+      // is a plain object; the JWT path is left byte-for-byte unchanged.
+      const contact = sandboxContact();
+      const requestPayload =
+        contact && payload && typeof payload === "object"
+          ? { ...(payload as Record<string, unknown>), contact }
+          : payload;
+
       // Case management uses session-based auth (X-Auth-Token)
       // Privacy center uses JWT Bearer tokens (Authorization: Bearer)
       if (useSessionAuth) {
         return apiFetch(url, {
           ...fetchOptions,
           method: "POST",
-          body: JSON.stringify(payload),
+          body: JSON.stringify(requestPayload),
           getAuthToken,
         });
       }
@@ -262,7 +327,7 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
       return privacyCenterApiFetch(url, {
         ...fetchOptions,
         method: "POST",
-        body: JSON.stringify(payload),
+        body: JSON.stringify(requestPayload),
         authToken: resolveAuthToken(authToken, baseRequest),
       });
     },
@@ -388,9 +453,12 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
       if (params.status) queryParams.append("status", params.status);
       if (params.product_uuid) queryParams.append("product_uuid", params.product_uuid);
       if (params.language) queryParams.append("language", params.language);
+      // Sandbox mode: the acting identity travels as query params
+      // (primary_email / primary_mobile); the credential is the X-Consent-Token header.
+      appendSandboxIdentity(queryParams);
       const queryString = queryParams.toString();
       const suffix = `/user-consents${queryString ? `?${queryString}` : ""}`;
-      const url = useLedger
+      const url = useLedger()
         ? ledgerUrl(baseRequest, suffix)
         : privacyCenterUrl(baseRequest, suffix);
       return privacyCenterApiFetch(url, {
@@ -426,9 +494,12 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
       if (params.search) queryParams.append("search", params.search);
       if (params.language) queryParams.append("language", params.language);
       if (params.nominator_uuid) queryParams.append("nominator_uuid", params.nominator_uuid);
+      // Sandbox mode: the acting identity travels as query params
+      // (primary_email / primary_mobile); the credential is the X-Consent-Token header.
+      appendSandboxIdentity(queryParams);
       const queryString = queryParams.toString();
       const suffix = `/user-consents/${productUuid}/purposes${queryString ? `?${queryString}` : ""}`;
-      const url = useLedger
+      const url = useLedger()
         ? ledgerUrl(baseRequest, suffix)
         : privacyCenterUrl(baseRequest, suffix);
       return privacyCenterApiFetch(url, {
@@ -467,9 +538,10 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
       dataElementUuids?: string[],
       productUuid?: string,
       noticeUuid?: string,
-      dataElements?: Array<{ uuid: string; selected: boolean }>
+      dataElements?: Array<{ uuid: string; selected: boolean }>,
+      language?: string
     ): Promise<unknown> {
-      if (!useLedger) {
+      if (!useLedger()) {
         const url = privacyCenterUrl(baseRequest, `/manage-consent?status=${status}`);
         const body: Record<string, unknown> = { purpose_uuid: purposeId, contact };
         if (nominatorContact) {
@@ -481,6 +553,9 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
         if (productUuid) {
           body.product_uuid = productUuid;
         }
+        if (language) {
+          body.language = language;
+        }
         return privacyCenterApiFetch(url, {
           ...options,
           method: "POST",
@@ -507,7 +582,7 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
         }
         return { uuid: de.uuid, selected };
       });
-      const body = {
+      const body: Record<string, unknown> = {
         notice_uuid: noticeUuid,
         partial: true,
         declined: false,
@@ -520,6 +595,7 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
             data_elements: elements,
           },
         ],
+        ...(language ? { language } : {}),
       };
       const url = ledgerUrl(baseRequest, "/submit-consent");
       return privacyCenterApiFetch(url, {
@@ -545,6 +621,9 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
       if (offset !== undefined) queryParams.append("offset", offset.toString());
       if (limit !== undefined) queryParams.append("limit", limit.toString());
       if (language) queryParams.append("language", language);
+      // Sandbox mode: the acting identity travels as query params
+      // (primary_email / primary_mobile); the credential is the X-Consent-Token header.
+      appendSandboxIdentity(queryParams);
       const queryString = queryParams.toString();
       const url = privacyCenterUrl(baseRequest, `/activities${queryString ? `?${queryString}` : ""}`);
       return privacyCenterApiFetch<unknown>(url, {
@@ -623,7 +702,7 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
       // (paginated list under /public/...); otherwise the legacy Python
       // privacy-center list is used. normalizeReceipts tolerates both envelopes.
       const receiptsSuffix = `/receipts${queryString ? `?${queryString}` : ""}`;
-      const url = useLedger
+      const url = useLedger()
         ? ledgerUrl(baseRequest, receiptsSuffix)
         : privacyCenterUrl(baseRequest, receiptsSuffix);
       return privacyCenterApiFetch<unknown>(url, {
@@ -648,13 +727,22 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
       // The ledger serves the receipt PDF at /receipts/{uuid}/download, the
       // legacy Python service at /receipts/{uuid}/pdf. The receiptUuid always
       // comes from the same-mode list above, so list and download stay consistent.
-      const url = useLedger
+      const url = useLedger()
         ? ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`)
         : privacyCenterUrl(baseRequest, `/receipts/${receiptUuid}/pdf`);
       const token = resolveAuthToken(authToken, baseRequest);
       const requestHeaders = new Headers();
       requestHeaders.set("Accept", "application/pdf");
-      if (token) {
+      // Sandbox PoC: send the single X-Consent-Token header instead of the JWT
+      // bearer. The receipt PDF download identifies the principal by receiptUuid
+      // (already scoped to the sandbox subject via the same-mode list), so no
+      // extra identity payload is needed here.
+      const sandboxHeaders = sandboxAuthHeaders();
+      if (sandboxHeaders) {
+        Object.entries(sandboxHeaders).forEach(([key, value]) => {
+          requestHeaders.set(key, value);
+        });
+      } else if (token) {
         const trimmedToken = token.trim();
         requestHeaders.set(
           "Authorization",
@@ -697,6 +785,9 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
       if (offset !== undefined) queryParams.append("offset", offset.toString());
       if (limit !== undefined) queryParams.append("limit", limit.toString());
       if (language) queryParams.append("language", language);
+      // Sandbox mode: the acting identity travels as query params
+      // (primary_email / primary_mobile); the credential is the X-Consent-Token header.
+      appendSandboxIdentity(queryParams);
       const queryString = queryParams.toString();
       const url = privacyCenterUrl(baseRequest, `/cases?${queryString}`);
       return privacyCenterApiFetch<unknown>(url, {
@@ -715,7 +806,9 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
       caseUuid: string,
       authToken?: string
     ): Promise<CaseMessage[]> {
-      const url = caseUrl(baseRequest, caseUuid, '/messages');
+      // Sandbox mode: the acting identity travels as query params
+      // (primary_email / primary_mobile); the credential is the X-Consent-Token header.
+      const url = caseUrl(baseRequest, caseUuid, `/messages${sandboxIdentitySuffix()}`);
       return privacyCenterApiFetch<CaseMessage[]>(url, {
         authToken: resolveAuthToken(authToken, baseRequest),
       });
@@ -731,7 +824,9 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
       documentUuids: string[],
       authToken?: string
     ): Promise<CaseMessage> {
-      const url = caseUrl(baseRequest, caseUuid, '/messages');
+      // Sandbox mode: the acting identity travels as query params
+      // (primary_email / primary_mobile); the credential is the X-Consent-Token header.
+      const url = caseUrl(baseRequest, caseUuid, `/messages${sandboxIdentitySuffix()}`);
       return privacyCenterApiFetch<CaseMessage>(url, {
         method: 'POST',
         body: JSON.stringify({ body, document_uuids: documentUuids }),
@@ -748,7 +843,9 @@ export function createConsentClient(baseUrl: string, ledgerBaseUrl?: string) {
       file: File,
       authToken?: string
     ): Promise<UploadDocumentResponse> {
-      const url = caseUrl(baseRequest, caseUuid, '/upload-document');
+      // Sandbox mode: the acting identity travels as query params
+      // (primary_email / primary_mobile); the credential is the X-Consent-Token header.
+      const url = caseUrl(baseRequest, caseUuid, `/upload-document${sandboxIdentitySuffix()}`);
       const formData = new FormData();
       formData.append('file', file, file.name); // field name must be exactly "file"
       // "payload" is required by the privacy-center endpoint (omitting it causes 422)

package/src/RedactoPrivacyCenter/api/fetcher.ts

@@ -1,3 +1,5 @@
+import { sandboxAuthHeaders } from "../lib/sandbox";
+
 /**
  * Options for apiFetch function
  */
@@ -125,16 +127,29 @@ export async function apiFetch<T>(
     }
   }
 
-  // Add auth token AFTER custom headers to ensure it's never overridden
+  // Add auth AFTER custom headers so it's never overridden. Only for calls that
+  // opt into auth (a `getAuthToken` is supplied) — public calls like org
+  // branding (which hit the user server, not consent-server) stay unauthenticated
+  // and must NOT receive the sandbox headers.
   if (getAuthToken) {
-    const token = await getAuthToken();
-    if (token) {
-      // Use the exact header format that works in other parts of the codebase
-      // Other working API calls use 'X-Auth-Token' (capital A and T, rest lowercase)
-      const trimmedToken = token.trim();
-      requestHeaders.set("X-Auth-Token", trimmedToken);
-      // Also set lowercase for compatibility (some servers are case-sensitive)
-      requestHeaders.set("x-auth-token", trimmedToken);
+    // Sandbox PoC: send the single X-Consent-Token header instead of the session
+    // token. The acting identity travels in the request payload (injected by the
+    // client call sites), not a header.
+    const sandboxHeaders = sandboxAuthHeaders();
+    if (sandboxHeaders) {
+      Object.entries(sandboxHeaders).forEach(([key, value]) => {
+        requestHeaders.set(key, value);
+      });
+    } else {
+      const token = await getAuthToken();
+      if (token) {
+        // Use the exact header format that works in other parts of the codebase
+        // Other working API calls use 'X-Auth-Token' (capital A and T, rest lowercase)
+        const trimmedToken = token.trim();
+        requestHeaders.set("X-Auth-Token", trimmedToken);
+        // Also set lowercase for compatibility (some servers are case-sensitive)
+        requestHeaders.set("x-auth-token", trimmedToken);
+      }
     }
   }
 

package/src/RedactoPrivacyCenter/components/ConsentManager.tsx

@@ -776,6 +776,7 @@ export default function ConsentManager({ variant }: ConsentManagerProps) {
           productUuid,
           noticeUuid,
           dataElements,
+          language: langParam,
         });
 
         if (response) {
@@ -805,7 +806,7 @@ export default function ConsentManager({ variant }: ConsentManagerProps) {
         handleCloseModal();
       }
     },
-    [organizationId, workspaceId, contact, fetchData, handleCloseModal, t, authContext, consentClient, selectedRecord]
+    [organizationId, workspaceId, contact, fetchData, handleCloseModal, t, authContext, consentClient, selectedRecord, langParam]
   );
 
   const getVar = (varName: string): string => `var(${varName})`;

package/src/RedactoPrivacyCenter/components/Form.tsx

@@ -10,10 +10,10 @@ import { PiUploadBold } from 'react-icons/pi';
 import { toast } from '../utils/toast';
 import { PCButton, PCCheckbox, PCInput, PCLoader, PCSelect, PCText, PCTextarea } from '../ui';
 import { PCModal } from '../ui/PCModal';
-import { buildGroupDataElements, buildGroupPurposes, consentGroupToFormProductGroup } from './groupHelpers';
+import { buildGroupDataElements, buildGroupPurposes, consentGroupToFormProductGroup, legacyFlatGroup } from './groupHelpers';
 import { pcStyles } from '../styles/pcStyles';
 import { createCaseRequest, fetchUserConsents, getFormData } from '../lib/api';
-import { FORM_PICKER_GROUP_LIMIT } from '../lib/constants';
+import { FORM_PICKER_GROUP_LIMIT, LEGACY_PRODUCT_GROUP_UUID } from '../lib/constants';
 import { ensureValidToken } from '../lib/utils';
 import { useAuth } from '../context/AuthContext';
 import { useBaseUrl } from '../context/BaseUrlContext';
@@ -143,7 +143,7 @@ export default function Form({
   const [isSubmitted, setIsSubmitted] = useState(false);
   const { t } = useTranslation();
   const { accessToken, refreshToken, onError, updateTokens } = useAuth();
-  const { consentClient, baseUrl, ledgerBaseUrl } = useBaseUrl();
+  const { consentClient, baseUrl } = useBaseUrl();
   const organizationId = organization?.uuid;
   const workspaceId = organization?.workspaces[0]?.uuid;
 
@@ -235,12 +235,31 @@ export default function Form({
 
   // Union of direct + nominated product groups exposed by the backend.
   // Drives both the product-cards step and the per-product picker beneath.
+  // When the backend exposes no groups at all but did return the legacy flat
+  // `purposes` list (pre-grouping Python deployments, and the popup /
+  // case-management contexts that cannot read user-consents), fall back to a
+  // single synthetic group so the purposes stay reachable instead of the
+  // picker claiming the principal has no consents.
   const allGroups = useMemo<FormProductGroup[]>(() => {
     if (!data) {
       return [];
     }
-    return [...(data.direct_groups ?? []), ...(data.nominated_groups ?? [])];
-  }, [data]);
+    const groups = [
+      ...(data.direct_groups ?? []),
+      ...(data.nominated_groups ?? []),
+    ];
+    if (groups.length > 0) {
+      return groups;
+    }
+    const flatGroup = legacyFlatGroup(data, t('yourData'));
+    // `buildGroupPurposes` is what the panel renders from — it drops purposes
+    // with no data elements, so a flat list that survives nothing must keep
+    // showing the empty state rather than an unusable panel.
+    if (buildGroupPurposes(flatGroup).length === 0) {
+      return [];
+    }
+    return [flatGroup];
+  }, [data, t]);
 
   // TECH-3712 UX: when the DP has exactly one consent group total
   // (direct + nominated combined), the product-selection step is friction —
@@ -275,21 +294,22 @@ export default function Form({
     [],
   );
 
-  // Approach A: source the DSAR request-form product picker from the Go
-  // ledger's user-consents. After the consent cutover, consents live in the
-  // ledger, so Python's form/data returns no product groups; we overlay the
-  // ledger's product-grouped consents onto the form data instead. Only the
-  // end-user privacy-center path is eligible — popup / case-management resolve
-  // an arbitrary contact, which the JWT-scoped ledger endpoint cannot serve,
-  // so those keep the Python form/data groups. Returns the form data unchanged
-  // when ineligible or when the ledger read fails (graceful fallback to
-  // whatever groups form/data supplied). Without a configured ledgerBaseUrl,
-  // consents still live in Python and form/data groups are authoritative, so
-  // the overlay must not run (fetchUserConsents would return the legacy Python
-  // shape, which consentGroupToFormProductGroup does not map).
-  const withLedgerPickerGroups = useCallback(
+  // Approach A: source the DSAR request-form product picker from user-consents
+  // rather than from Python's form/data, which stopped emitting product groups
+  // after the consent cutover. `consentClient.getUserConsents` serves the same
+  // grouped payload from either backend — the Go ledger's
+  // `/public/.../user-consents` when a ledgerBaseUrl is configured, Python's
+  // `/dsar/privacy-center/user-consents` otherwise (the same source the
+  // Manage Consent view reads in both modes) — so the overlay runs regardless
+  // of which backend the SDK points at. Only the end-user privacy-center path
+  // is eligible: popup / case-management resolve an arbitrary contact, which
+  // the JWT-scoped user-consents endpoint cannot serve, so those keep the
+  // form/data groups. Returns the form data unchanged when ineligible, when
+  // the read fails, or when it comes back with no groups at all — an empty
+  // result must never overwrite groups form/data did supply.
+  const withUserConsentPickerGroups = useCallback(
     async (form: FormData, language?: string): Promise<FormData> => {
-      if (!ledgerBaseUrl || isPopup || isCaseManagementContext || !organizationId || !workspaceId) {
+      if (isPopup || isCaseManagementContext || !organizationId || !workspaceId) {
         return form;
       }
       const consents = await fetchUserConsents({
@@ -304,19 +324,18 @@ export default function Form({
         nominatedLimit: FORM_PICKER_GROUP_LIMIT,
         language,
       });
-      if (!consents) {
+      const direct = consents?.direct ?? [];
+      const nominated = consents?.nominated ?? [];
+      if (direct.length === 0 && nominated.length === 0) {
         return form;
       }
       return {
         ...form,
-        direct_groups: (consents.direct ?? []).map(consentGroupToFormProductGroup),
-        nominated_groups: (consents.nominated ?? []).map(
-          consentGroupToFormProductGroup,
-        ),
+        direct_groups: direct.map(consentGroupToFormProductGroup),
+        nominated_groups: nominated.map(consentGroupToFormProductGroup),
       };
     },
     [
-      ledgerBaseUrl,
       isPopup,
       isCaseManagementContext,
       organizationId,
@@ -366,7 +385,7 @@ export default function Form({
         return;
       }
 
-      setData(await withLedgerPickerGroups(translatedFormData, langValue));
+      setData(await withUserConsentPickerGroups(translatedFormData, langValue));
 
       if (translatedFormData.grievance_options) {
         const currentGrievanceSelections = { ...selectedGrievances };
@@ -385,7 +404,7 @@ export default function Form({
     } finally {
       setIsTranslating(false);
     }
-  }, [organizationId, workspaceId, data, formData.contact, isPopup, isCaseManagementContext, authContext, consentClient, selectedGrievances, t, withLedgerPickerGroups]);
+  }, [organizationId, workspaceId, data, formData.contact, isPopup, isCaseManagementContext, authContext, consentClient, selectedGrievances, t, withUserConsentPickerGroups]);
 
   // Clear product / org-level selections when request type changes.
   // Per-product state (selectedPurposes, selectedCorrectionElements,
@@ -538,7 +557,7 @@ export default function Form({
           }
         }
 
-        const pickerData = await withLedgerPickerGroups(
+        const pickerData = await withUserConsentPickerGroups(
           displayData,
           langParam || undefined,
         );
@@ -565,7 +584,7 @@ export default function Form({
     };
 
     void initializePrivacyCenterForm();
-  }, [organizationId, workspaceId, isPopup, authContext, consentClient, withLedgerPickerGroups]);
+  }, [organizationId, workspaceId, isPopup, authContext, consentClient, withUserConsentPickerGroups]);
 
   /**
    * Maps translated correction element names back to English names using UUID lookup.
@@ -671,7 +690,13 @@ export default function Form({
     }
 
     const isProductScoped = isProductScopedRequestType(requestType);
-    const anchorGroup = isProductScoped ? selectedGroup : null;
+    // The synthetic legacy-flat group has no server-side product, so it must
+    // not anchor the case — those submissions keep the pre-grouping
+    // org-level shape (`product_uuid` is optional on the backend).
+    const isLegacyFlatSelection =
+      selectedGroup?.product_uuid === LEGACY_PRODUCT_GROUP_UUID;
+    const anchorGroup =
+      isProductScoped && !isLegacyFlatSelection ? selectedGroup : null;
 
     const requestDetails: {
       purposes: UpdatePurpose[];

package/src/RedactoPrivacyCenter/components/SelectUserGate.tsx

@@ -12,6 +12,7 @@ import { useAuth } from '../context/AuthContext';
 import { ProfileSwitchProvider } from '../context/ProfileSwitchContext';
 import { PCLoader } from '../ui';
 import { decodeJwtToken } from '../lib/utils';
+import { isSandboxMode } from '../lib/sandbox';
 import type {
   GatePhase,
   IdentityCandidate,
@@ -54,6 +55,13 @@ export const SelectUserGate = ({ children }: SelectUserGateProps) => {
   useEffect(() => {
     let cancelled = false;
 
+    // Sandbox PoC: there is no JWT and no shared-contact concept — the subject is
+    // fixed by props. Skip the identity lookup and render children directly.
+    if (isSandboxMode()) {
+      setPhase('resolved');
+      return;
+    }
+
     if (!organizationId || !workspaceId || !accessToken) {
       setPhase('resolved');
       return;