@redacto.io/consent-sdk-react 10.0.0-beta.9 → 10.0.0

package/src/RedactoPrivacyCenter/lib/useCurrentLanguage.ts

@@ -1,37 +0,0 @@
-import { useSyncExternalStore, useCallback } from 'react';
-import i18n from './i18n';
-
-const DEFAULT_LANGUAGE = 'en';
-
-/**
- * Returns the language query param to send to the API.
- * Returns `undefined` for the default language (English) so that
- * existing un-localised behaviour is preserved.
- */
-export function getLangParam(language: string): string | undefined {
-  return language !== DEFAULT_LANGUAGE ? language : undefined;
-}
-
-/**
- * React hook that subscribes to i18next language changes.
- * Returns `{ currentLanguage, langParam }` where `langParam`
- * is `undefined` for the default language.
- *
- * Unlike reading `i18n.language` directly, this hook triggers a
- * component re-render whenever the language changes.
- */
-export function useCurrentLanguage() {
-  const subscribe = useCallback((onStoreChange: () => void) => {
-    i18n.on('languageChanged', onStoreChange);
-    return () => {
-      i18n.off('languageChanged', onStoreChange);
-    };
-  }, []);
-
-  const getSnapshot = useCallback(() => i18n.language, []);
-
-  const currentLanguage = useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
-  const langParam = getLangParam(currentLanguage);
-
-  return { currentLanguage, langParam };
-}

package/src/RedactoPrivacyCenter/lib/utils.refresh-circuit.test.ts

@@ -1,127 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { ensureValidToken, isRefreshBlocked, resetRefreshCircuit } from './utils';
-import { ApiError } from '../api/fetcher';
-
-/**
- * Regression tests for the OTP refresh circuit breaker.
- *
- * Production incident 2026-06-22: an embedded Privacy Center retry-looped a dead
- * refresh token, sending ~9× the normal volume of `POST /otp/refresh` (all fast
- * terminal rejections) and spiking consent-server CPU. ensureValidToken is the
- * single chokepoint for every refresh — these tests pin the guarantee that a
- * terminally-failed token is attempted exactly once until the user re-authenticates,
- * and that transient failures back off instead of hammering.
- */
-
-// Minimal JWT with a chosen `exp`. The signature is irrelevant — the SDK only
-// base64-decodes the payload to read `exp`.
-const base64url = (obj: unknown) => btoa(JSON.stringify(obj)).replace(/=+$/, '');
-const makeJwt = (expSeconds: number) =>
-  `${base64url({ alg: 'HS256', typ: 'JWT' })}.${base64url({ exp: expSeconds })}.sig`;
-
-// `exp` in 1970 — always treated as expired, so ensureValidToken always takes the
-// refresh path regardless of wall-clock / fake timers.
-const EXPIRED_ACCESS_TOKEN = makeJwt(1_000);
-const ORG = 'org-uuid';
-const WS = 'ws-uuid';
-
-const makeConsentClient = (
-  refreshOtpToken: (orgId: string, wsId: string, refreshToken: string) => Promise<unknown>
-) => ({ refreshOtpToken: vi.fn(refreshOtpToken) }) as any;
-
-const makeAuthContext = (refreshToken: string) => ({
-  accessToken: EXPIRED_ACCESS_TOKEN,
-  refreshToken,
-  // Return false so the SDK suppresses navigation (jsdom can't navigate). The
-  // circuit breaker trips before onError is consulted, which is what we assert.
-  onError: vi.fn(() => false),
-  updateTokens: vi.fn(),
-});
-
-describe('ensureValidToken — OTP refresh circuit breaker (incident 2026-06-22)', () => {
-  beforeEach(() => {
-    resetRefreshCircuit();
-    sessionStorage.clear();
-    vi.clearAllMocks();
-  });
-
-  afterEach(() => {
-    vi.useRealTimers();
-  });
-
-  it('attempts a terminally-failed refresh token exactly once across many calls', async () => {
-    const client = makeConsentClient(() =>
-      Promise.reject(new ApiError('Token verification error: Refresh token has expired', { status: 401 }))
-    );
-    const authContext = makeAuthContext('dead-refresh-token');
-
-    // Simulate the 3 pollers + every API call + render-driven effects all hitting
-    // the path while the token is dead.
-    const results: Array<string | null> = [];
-    for (let i = 0; i < 25; i++) {
-      results.push(await ensureValidToken(ORG, WS, undefined, authContext, client));
-    }
-
-    expect(results.every((r) => r === null)).toBe(true);
-    expect(client.refreshOtpToken).toHaveBeenCalledTimes(1);
-    expect(isRefreshBlocked(authContext)).toBe(true);
-  });
-
-  it('treats "not found / already used" (T0) as terminal, not retryable', async () => {
-    const client = makeConsentClient(() =>
-      Promise.reject(new ApiError('Refresh token not found or already used', { status: 401 }))
-    );
-    const authContext = makeAuthContext('already-used-token');
-
-    await ensureValidToken(ORG, WS, undefined, authContext, client);
-    await ensureValidToken(ORG, WS, undefined, authContext, client);
-
-    expect(client.refreshOtpToken).toHaveBeenCalledTimes(1);
-  });
-
-  it('resumes refreshing once a new refresh token value appears', async () => {
-    const validAccess = makeJwt(Math.floor(Date.now() / 1000) + 3600);
-    const client = makeConsentClient((_org, _ws, token) =>
-      token === 'dead-refresh-token'
-        ? Promise.reject(new ApiError('Refresh token has expired', { status: 401 }))
-        : Promise.resolve({ access_token: validAccess, refresh_token: 'rotated' })
-    );
-
-    const deadCtx = makeAuthContext('dead-refresh-token');
-    await ensureValidToken(ORG, WS, undefined, deadCtx, client);
-    await ensureValidToken(ORG, WS, undefined, deadCtx, client);
-    expect(client.refreshOtpToken).toHaveBeenCalledTimes(1); // breaker held the loop
-
-    // User re-authenticated → a *different* refresh token value re-arms the breaker.
-    const freshCtx = makeAuthContext('fresh-refresh-token');
-    const token = await ensureValidToken(ORG, WS, undefined, freshCtx, client);
-
-    expect(client.refreshOtpToken).toHaveBeenCalledTimes(2);
-    expect(token).toBe(validAccess);
-    expect(isRefreshBlocked(freshCtx)).toBe(false);
-  });
-
-  it('backs off after a transient failure instead of retrying immediately', async () => {
-    vi.useFakeTimers();
-    vi.setSystemTime(new Date('2026-06-22T11:00:00Z'));
-
-    const client = makeConsentClient(() =>
-      Promise.reject(new ApiError('Service Unavailable', { status: 503 }))
-    );
-    const authContext = makeAuthContext('flaky-refresh-token');
-
-    await ensureValidToken(ORG, WS, undefined, authContext, client);
-    await ensureValidToken(ORG, WS, undefined, authContext, client);
-    await ensureValidToken(ORG, WS, undefined, authContext, client);
-
-    // One attempt, then the backoff window suppresses the rest (no token-marking —
-    // a 5xx is transient, so the token is NOT permanently dead).
-    expect(client.refreshOtpToken).toHaveBeenCalledTimes(1);
-    expect(isRefreshBlocked(authContext)).toBe(true);
-
-    // Once the backoff window elapses, a later call is allowed to retry.
-    vi.advanceTimersByTime(31_000); // > MIN_REFRESH_BACKOFF_MS (30s)
-    await ensureValidToken(ORG, WS, undefined, authContext, client);
-    expect(client.refreshOtpToken).toHaveBeenCalledTimes(2);
-  });
-});

package/src/RedactoPrivacyCenter/lib/utils.refresh-storage.test.ts

@@ -1,85 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
-
-import {
-  setRefreshTokenCookie,
-  getStoredRefreshToken,
-  signOutPrivacyCenter,
-} from './utils';
-
-const STORAGE_KEY = 'redacto_pc_refresh_token';
-
-const expireLegacyCookie = (): void => {
-  document.cookie =
-    'refresh_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT';
-  document.cookie =
-    'refresh_token=; path=/privacy-center; expires=Thu, 01 Jan 1970 00:00:00 GMT';
-};
-
-describe('privacy center refresh token persistence', () => {
-  beforeEach(() => {
-    window.localStorage.clear();
-    expireLegacyCookie();
-  });
-
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  it('persists the refresh token in localStorage (path-independent) and writes no cookie', () => {
-    // A path-scoped cookie is unreadable when the host mounts under a basePath
-    // (e.g. consent-app at /consent), which strands rotated tokens and triggers
-    // the 401 refresh storm. localStorage is origin-scoped, so it is readable
-    // regardless of basePath.
-    setRefreshTokenCookie('tok123');
-
-    expect(window.localStorage.getItem(STORAGE_KEY)).toBe('tok123');
-    expect(getStoredRefreshToken()).toBe('tok123');
-    expect(document.cookie).not.toContain('refresh_token=tok123');
-  });
-
-  it('returns null when no refresh token is stored', () => {
-    expect(getStoredRefreshToken()).toBeNull();
-  });
-
-  it('does not ingest a host app refresh_token cookie', () => {
-    // A cookie read is name-only (JS cannot see the path), so the SDK cannot tell
-    // a host app's own refresh_token cookie from its own legacy one. It must not
-    // read the cookie at all: it neither migrates the value nor deletes the
-    // cookie. (Existing SDK sessions are preserved via the AuthProvider token
-    // prop, not the cookie.)
-    document.cookie = 'refresh_token=hosttoken; path=/';
-
-    const token = getStoredRefreshToken();
-
-    expect(token).toBeNull();
-    expect(window.localStorage.getItem(STORAGE_KEY)).toBeNull();
-    expect(document.cookie).toContain('refresh_token=hosttoken');
-  });
-
-  it('clears the stored refresh token on sign out', () => {
-    setRefreshTokenCookie('tok123');
-    expect(window.localStorage.getItem(STORAGE_KEY)).toBe('tok123');
-
-    signOutPrivacyCenter();
-
-    expect(window.localStorage.getItem(STORAGE_KEY)).toBeNull();
-    expect(getStoredRefreshToken()).toBeNull();
-  });
-
-  it('does not throw when localStorage.setItem is unavailable (private mode / quota)', () => {
-    vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
-      throw new Error('QuotaExceededError');
-    });
-
-    expect(() => setRefreshTokenCookie('tok123')).not.toThrow();
-  });
-
-  it('returns null (no throw) when localStorage.getItem is unavailable', () => {
-    vi.spyOn(Storage.prototype, 'getItem').mockImplementation(() => {
-      throw new Error('SecurityError');
-    });
-
-    expect(() => getStoredRefreshToken()).not.toThrow();
-    expect(getStoredRefreshToken()).toBeNull();
-  });
-});

package/src/RedactoPrivacyCenter/lib/utils.session-expired.test.ts

@@ -1,109 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import {
-  ensureValidToken,
-  resetRefreshCircuit,
-  setSessionExpiredListener,
-} from './utils';
-import { ApiError } from '../api/fetcher';
-
-/**
- * Regression tests for the terminal "session expired" signal.
- *
- * When the refresh token is expired/invalid, the refresh endpoint must be hit at
- * most once (the circuit breaker) AND the React tree must be told the session is
- * over exactly once (so it can show the terminal screen and stop all work). A
- * transient (5xx/network) failure must NOT raise the terminal signal — those are
- * retryable and the user is still signed in.
- */
-
-// Minimal JWT with a chosen `exp` (only the base64 payload is read).
-const base64url = (obj: unknown) => btoa(JSON.stringify(obj)).replace(/=+$/, '');
-const makeJwt = (expSeconds: number) =>
-  `${base64url({ alg: 'HS256', typ: 'JWT' })}.${base64url({ exp: expSeconds })}.sig`;
-
-// `exp` in 1970 → always expired, so ensureValidToken always takes the refresh path.
-const EXPIRED_ACCESS_TOKEN = makeJwt(1_000);
-const ORG = 'org-uuid';
-const WS = 'ws-uuid';
-
-const makeConsentClient = (
-  refreshOtpToken: (orgId: string, wsId: string, refreshToken: string) => Promise<unknown>,
-) => ({ refreshOtpToken: vi.fn(refreshOtpToken) }) as any;
-
-const makeAuthContext = (refreshToken: string) => ({
-  accessToken: EXPIRED_ACCESS_TOKEN,
-  refreshToken,
-  // Return false (host handles its own navigation). The terminal signal must fire
-  // regardless of this return value — that is the behaviour under test.
-  onError: vi.fn(() => false),
-  updateTokens: vi.fn(),
-});
-
-describe('ensureValidToken — terminal session-expired signal', () => {
-  beforeEach(() => {
-    resetRefreshCircuit();
-    setSessionExpiredListener(null);
-    sessionStorage.clear();
-    vi.clearAllMocks();
-  });
-
-  afterEach(() => {
-    setSessionExpiredListener(null);
-    vi.useRealTimers();
-  });
-
-  it('fires the session-expired listener exactly once on a terminal failure', async () => {
-    const onExpired = vi.fn();
-    setSessionExpiredListener(onExpired);
-
-    const client = makeConsentClient(() =>
-      Promise.reject(new ApiError('Refresh token has expired', { status: 401 })),
-    );
-    const authContext = makeAuthContext('dead-refresh-token');
-
-    // Many triggers (pollers + API calls + effects) against the same dead token.
-    const results: Array<string | null> = [];
-    for (let i = 0; i < 10; i++) {
-      results.push(await ensureValidToken(ORG, WS, undefined, authContext, client));
-    }
-
-    expect(results.every((r) => r === null)).toBe(true);
-    // Breaker: the dead refresh token is submitted at most once.
-    expect(client.refreshOtpToken).toHaveBeenCalledTimes(1);
-    // Terminal signal raised once, even though onError returned false.
-    expect(onExpired).toHaveBeenCalledTimes(1);
-  });
-
-  it('does NOT fire the listener for a transient (5xx) failure', async () => {
-    vi.useFakeTimers();
-    vi.setSystemTime(new Date('2026-06-22T11:00:00Z'));
-
-    const onExpired = vi.fn();
-    setSessionExpiredListener(onExpired);
-
-    const client = makeConsentClient(() =>
-      Promise.reject(new ApiError('Service Unavailable', { status: 503 })),
-    );
-    const authContext = makeAuthContext('flaky-refresh-token');
-
-    await ensureValidToken(ORG, WS, undefined, authContext, client);
-    await ensureValidToken(ORG, WS, undefined, authContext, client);
-
-    // One attempt then backoff suppresses the rest — and the session is NOT
-    // declared terminally expired (the token may still be valid).
-    expect(client.refreshOtpToken).toHaveBeenCalledTimes(1);
-    expect(onExpired).not.toHaveBeenCalled();
-  });
-
-  it('tolerates a terminal failure with no listener registered (no throw)', async () => {
-    const client = makeConsentClient(() =>
-      Promise.reject(new ApiError('Refresh token has expired', { status: 401 })),
-    );
-    const authContext = makeAuthContext('dead-refresh-token');
-
-    await expect(
-      ensureValidToken(ORG, WS, undefined, authContext, client),
-    ).resolves.toBeNull();
-    expect(client.refreshOtpToken).toHaveBeenCalledTimes(1);
-  });
-});