@redacto.io/consent-sdk-react 10.0.0-beta.9 → 10.0.0

package/src/RedactoPrivacyCenter/lib/utils.ts

@@ -1,798 +0,0 @@
-import { refreshOtpTokenServer } from './api';
-import { isTerminalRefreshError } from '../api/fetcher';
-import { getSandboxConfig } from './sandbox';
-import {
-  MIN_REFRESH_BACKOFF_MS,
-  MAX_REFRESH_BACKOFF_MS,
-  REFRESH_TOKEN_STORAGE_KEY,
-  LEGACY_REFRESH_TOKEN_COOKIE,
-} from './constants';
-import type { BaseUrlContextValue } from '../context/BaseUrlContext';
-
-// Token refresh lock to prevent concurrent refresh attempts
-let isRefreshing = false;
-let refreshPromise: Promise<string | null> | null = null;
-
-// ─── OTP refresh circuit breaker (incident 2026-06-22) ──────────────────────
-// ensureValidToken is called from 3 independent 30s pollers, before every
-// authenticated API call, and from render-driven effects. Without a memory of
-// failure, a single dead refresh token gets re-submitted on every one of those
-// triggers, hammering POST /otp/refresh until the tab closes. These guards make a
-// terminally-failed token cost exactly one request, and apply backoff to transient
-// failures.
-//
-// `deadRefreshToken` holds the *value* of a refresh token that terminally failed.
-// It auto-clears the moment a different token value appears (i.e. the user
-// re-authenticated), so the breaker never permanently bricks a session.
-let deadRefreshToken: string | null = null;
-// Transient-failure backoff window (epoch ms) and the current backoff duration.
-let transientRefreshFailureUntil = 0;
-let transientRefreshBackoffMs = 0;
-
-// ─── Terminal "session expired" signal ──────────────────────────────────────
-// The circuit breaker above stops the *network* (a dead refresh token costs one
-// request). This listener lets the React tree learn that the session is
-// terminally over so it can show a dedicated "session expired" screen and gate
-// every further fetch — instead of silently rendering empty/stale content or
-// hard-navigating away. A single module-level listener, consistent with the
-// single-instance breaker singleton above (one Privacy Center per page).
-let sessionExpiredListener: (() => void) | null = null;
-
-/**
- * Register (or clear, with `null`) the callback fired when a refresh terminally
- * fails — i.e. the refresh token is expired/invalid and re-authentication is
- * required. AuthProvider registers its `markSessionExpired` here. Exported for
- * that wiring and for tests; not part of the package's public API.
- */
-export const setSessionExpiredListener = (fn: (() => void) | null): void => {
-  sessionExpiredListener = fn;
-};
-
-/** Notify the React tree that the session has terminally expired. */
-const notifySessionExpired = (): void => {
-  sessionExpiredListener?.();
-};
-
-// Buffer time in seconds before token expiration to proactively refresh
-// Using 30 seconds to ensure tokens are refreshed before they expire
-const TOKEN_EXPIRY_BUFFER_SECONDS = 30;
-
-export const getCookieValue = (name: string) => {
-  const cookies = document.cookie.split('; ');
-  for (let cookie of cookies) {
-    const [key, value] = cookie.split('=');
-    if (key === name) {
-      return value;
-    }
-  }
-  return null;
-};
-
-// ─── Refresh token persistence ──────────────────────────────────────────────
-// The refresh token lives in localStorage (key REFRESH_TOKEN_STORAGE_KEY), not a
-// cookie. A path-scoped cookie is not readable when the host mounts the privacy
-// center under a basePath (e.g. consent-app at /consent → /consent/privacy-center/...),
-// so a rotated token can't be read back and the stale token gets re-presented,
-// causing a 401 "Refresh token not found or already used" storm. localStorage is
-// origin-scoped (no path matching), so it is readable under any basePath.
-//
-// localStorage access throws when storage is disabled or over quota (private
-// modes, embedded webviews). Guard every access so the SDK degrades to "refresh
-// fails -> re-auth" instead of crashing the render tree (setRefreshTokenCookie
-// runs during AuthProvider's render). Mirrors components/AppShell/hooks/useSidebarState.ts.
-const readStorage = (key: string): string | null => {
-  try {
-    return window.localStorage.getItem(key);
-  } catch {
-    return null;
-  }
-};
-
-const writeStorage = (key: string, value: string): void => {
-  try {
-    window.localStorage.setItem(key, value);
-  } catch {
-    // localStorage unavailable / quota exceeded — ignore
-  }
-};
-
-const removeStorage = (key: string): void => {
-  try {
-    window.localStorage.removeItem(key);
-  } catch {
-    // localStorage unavailable — ignore
-  }
-};
-
-/**
- * Expire the SDK's own legacy refresh_token cookie (older versions wrote it at
- * path=/privacy-center). Scoped to that path only on purpose: a refresh_token
- * cookie at path=/ belongs to the host app, and clearing it would sign the host
- * out.
- */
-const clearLegacyRefreshTokenCookie = (): void => {
-  if (typeof window === 'undefined') {
-    return;
-  }
-  document.cookie = `${LEGACY_REFRESH_TOKEN_COOKIE}=; path=/privacy-center; expires=Thu, 01 Jan 1970 00:00:00 GMT`;
-};
-
-/**
- * Persist the refresh token. Named `setRefreshTokenCookie` for backward
- * compatibility (it is part of the package's exported surface); it now writes
- * to localStorage rather than a cookie, and clears any cookie an older SDK
- * version left at path=/privacy-center.
- * @param refreshToken - The refresh token value to set
- */
-export const setRefreshTokenCookie = (refreshToken: string): void => {
-  if (typeof window === 'undefined') {
-    return;
-  }
-  writeStorage(REFRESH_TOKEN_STORAGE_KEY, refreshToken);
-  clearLegacyRefreshTokenCookie();
-};
-
-/**
- * Read the persisted refresh token from localStorage.
- *
- * Intentionally does NOT fall back to reading a `refresh_token` cookie: a cookie
- * read is name-only (the path isn't visible to JS), so it cannot tell the SDK's
- * own legacy cookie from a host app's unrelated `refresh_token` cookie — reading
- * the latter would leak a host credential to the OTP refresh endpoint. Existing
- * sessions are preserved by AuthProvider re-seeding storage from the token prop.
- */
-export const getStoredRefreshToken = (): string | null => {
-  if (typeof window === 'undefined') {
-    return null;
-  }
-  return readStorage(REFRESH_TOKEN_STORAGE_KEY);
-};
-
-/**
- * Resolve the refresh token currently in play: from auth context (props mode) or
- * persisted storage (legacy mode). Centralised so the circuit breaker and the
- * refresh routine always agree on exactly which token value is being used.
- */
-const getActiveRefreshToken = (authContext?: { refreshToken?: string }): string | null => {
-  if (authContext) {
-    return authContext.refreshToken && authContext.refreshToken.trim() !== ''
-      ? authContext.refreshToken
-      : null;
-  }
-  if (typeof window === 'undefined') return null;
-  return getStoredRefreshToken();
-};
-
-/**
- * Clear all OTP-refresh circuit-breaker state. Called after a successful refresh
- * and exposed for tests. Deliberately NOT called from signOutPrivacyCenter: in
- * props mode the refresh token lives in a prop that sign-out cannot clear, so
- * clearing the breaker there would immediately re-arm the retry storm. Recovery
- * instead happens automatically when a *different* token value appears.
- */
-export const resetRefreshCircuit = (): void => {
-  deadRefreshToken = null;
-  transientRefreshFailureUntil = 0;
-  transientRefreshBackoffMs = 0;
-};
-
-/**
- * True when attempting a refresh right now would be pointless — the active refresh
- * token has already terminally failed, or we're inside the transient backoff
- * window. Pollers consult this to avoid scheduling doomed work.
- */
-export const isRefreshBlocked = (authContext?: { refreshToken?: string }): boolean => {
-  const active = getActiveRefreshToken(authContext);
-  if (active !== null && active === deadRefreshToken) return true;
-  if (Date.now() < transientRefreshFailureUntil) return true;
-  return false;
-};
-
-/** Record a transient refresh failure (network / 5xx) and grow the backoff window. */
-const noteTransientRefreshFailure = (): void => {
-  transientRefreshBackoffMs = Math.min(
-    Math.max(transientRefreshBackoffMs * 2, MIN_REFRESH_BACKOFF_MS),
-    MAX_REFRESH_BACKOFF_MS,
-  );
-  transientRefreshFailureUntil = Date.now() + transientRefreshBackoffMs;
-};
-
-/** Trip the circuit breaker for a refresh token value that terminally failed. */
-const markRefreshTokenDead = (token: string | null): void => {
-  if (token) {
-    deadRefreshToken = token;
-  }
-};
-
-/**
- * Decode JWT token and extract payload
- * @param token - JWT token string
- * @returns Decoded JWT payload or null if decoding fails
- */
-export const decodeJwtToken = (token: string): { organisation_uuid?: string; organisation_name?: string; workspace_uuid?: string; [key: string]: any } | null => {
-  if (!token || typeof token !== 'string') {
-    return null;
-  }
-
-  try {
-    // JWT format: header.payload.signature
-    const parts = token.split('.');
-    if (parts.length !== 3) {
-      // Malformed JWT
-      return null;
-    }
-
-    // Decode payload (second part)
-    const payload = parts[1];
-
-    // Base64URL decode
-    // Replace URL-safe characters and add padding if needed
-    let base64 = payload.replace(/-/g, '+').replace(/_/g, '/');
-    const padding = base64.length % 4;
-    if (padding) {
-      base64 += '='.repeat(4 - padding);
-    }
-
-    // Decode base64
-    const decodedPayload = atob(base64);
-    const payloadObj = JSON.parse(decodedPayload) as { organisation_uuid?: string; organisation_name?: string; workspace_uuid?: string; [key: string]: any };
-
-    return payloadObj;
-  } catch (error) {
-    // If decoding fails, return null
-    console.error('Error decoding JWT:', error);
-    return null;
-  }
-};
-
-/**
- * Resolve the user's contact identifier from a decoded JWT.
- *
- * Identifiers live under `user_data` (primary_email / primary_mobile /
- * org_user_id); some token shapes also expose `contact`/`primary_email` at the
- * top level. Email is preferred, but a mobile-only login must still resolve to
- * the phone (or org_user_id) so case/grievance and consent-management actions —
- * which key off this contact — work without an email. The backend matches
- * identifiers type-aware (phone-to-phone), so storing the mobile here is safe.
- */
-export const resolveContactFromJwt = (
-  decoded: { [key: string]: any } | null,
-): string | null => {
-  if (!decoded) {
-    return null;
-  }
-  const userData = (decoded.user_data as Record<string, unknown>) || {};
-  const candidate =
-    decoded.contact ||
-    decoded.primary_email ||
-    userData.primary_email ||
-    userData.primary_mobile ||
-    userData.org_user_id;
-  return typeof candidate === 'string' && candidate.trim() !== ''
-    ? candidate
-    : null;
-};
-
-/**
- * Decode JWT payload and check if token is expired or will expire soon
- * @param token - JWT token string
- * @param bufferSeconds - Buffer time in seconds before expiration to consider token expired (default: 5 minutes)
- * @returns true if token is expired, invalid, or will expire within buffer time; false if valid
- */
-export const isJwtExpired = (token: string, bufferSeconds: number = 5 * 60): boolean => {
-  if (!token || typeof token !== 'string') {
-    return true;
-  }
-
-  try {
-    // JWT format: header.payload.signature
-    const parts = token.split('.');
-    if (parts.length !== 3) {
-      // Malformed JWT
-      return true;
-    }
-
-    // Decode payload (second part)
-    const payload = parts[1];
-
-    // Base64URL decode
-    // Replace URL-safe characters and add padding if needed
-    let base64 = payload.replace(/-/g, '+').replace(/_/g, '/');
-    const padding = base64.length % 4;
-    if (padding) {
-      base64 += '='.repeat(4 - padding);
-    }
-
-    // Decode base64
-    const decodedPayload = atob(base64);
-    const payloadObj: { exp?: number } = JSON.parse(decodedPayload) as { exp?: number };
-
-    // Check if exp claim exists
-    if (typeof payloadObj.exp !== 'number') {
-      // Missing exp claim - treat as invalid
-      return true;
-    }
-
-    // Get current time in seconds
-    const now = Math.floor(Date.now() / 1000);
-
-    // Check if token is expired or will expire within buffer time
-    const isExpired = payloadObj.exp <= (now + bufferSeconds);
-
-    // exp is in seconds since epoch
-    return isExpired;
-  } catch (error) {
-    // If decoding fails, treat as expired/invalid
-    console.error('Error decoding JWT:', error);
-    return true;
-  }
-};
-
-/**
- * Check if user is authenticated in privacy center
- * User is considered authenticated if both access_token and email exist in sessionStorage
- */
-export const isUserAuthenticated = (expectedSlug: string): boolean => {
-  if (typeof window === 'undefined') return false;
-  const accessToken = sessionStorage.getItem('access_token');
-  const email = sessionStorage.getItem('email');
-  const orgSlug = sessionStorage.getItem('pc_org_slug');
-
-  // Require that tokens exist and the stored organization slug matches
-  if (!accessToken || !email || !orgSlug) {
-    return false;
-  }
-
-  return orgSlug === expectedSlug;
-};
-
-/**
- * Get initial state for sign-in form visibility
- * Returns true if window is undefined (SSR) or user is not authenticated
- * @param slug - The organization slug to check authentication against
- * @returns true if sign-in form should be shown, false otherwise
- */
-export const getInitialState = (slug: string): boolean => {
-  if (typeof window === 'undefined') return true;
-  return !isUserAuthenticated(slug);
-};
-
-/**
- * Check authentication status and attempt token refresh if needed
- * This function checks if the user is authenticated, validates JWT expiration,
- * and attempts to refresh using the refresh token cookie if the token is expired or missing.
- * @param expectedSlug - The organization slug to verify against
- * @param organizationId - Optional organization ID (will be read from sessionStorage if not provided)
- * @param workspaceId - Optional workspace ID (will be read from sessionStorage if not provided)
- * @returns Promise<boolean> - true if authenticated with valid non-expired token, false otherwise
- */
-export const checkAndRefreshAuth = async (
-  expectedSlug: string,
-  organizationId?: string,
-  workspaceId?: string,
-  consentClient?: BaseUrlContextValue['consentClient']
-): Promise<boolean> => {
-  if (typeof window === 'undefined') return false;
-
-  // Sandbox PoC: the static token is always "valid" and there is nothing to
-  // refresh, so authentication is satisfied unconditionally.
-  if (getSandboxConfig()) {
-    return true;
-  }
-
-  const accessToken = sessionStorage.getItem('access_token');
-  const email = sessionStorage.getItem('email');
-  const orgSlug = sessionStorage.getItem('pc_org_slug');
-
-  // If slug doesn't match, user is not authenticated for this organization
-  if (orgSlug && orgSlug !== expectedSlug) {
-    return false;
-  }
-
-  // Check if we need to refresh (token missing or expired)
-  const needsRefresh = !accessToken || (accessToken && isJwtExpired(accessToken, TOKEN_EXPIRY_BUFFER_SECONDS));
-
-  // If we have a valid token and all required data, user is authenticated
-  if (!needsRefresh && accessToken && email && orgSlug && orgSlug === expectedSlug) {
-    return true;
-  }
-
-  // If token is missing or expired, and we have email and orgSlug, try to refresh
-  if (needsRefresh && email && orgSlug === expectedSlug) {
-    // Get organizationId and workspaceId from sessionStorage if not provided
-    const orgId = organizationId || sessionStorage.getItem('pc_org_id') || '';
-    const wsId = workspaceId || sessionStorage.getItem('pc_workspace_id') || '';
-
-    if (!orgId || !wsId) {
-      return false;
-    }
-
-    const refreshToken = getStoredRefreshToken();
-    if (!refreshToken) {
-      // No refresh token available - terminal: surface the session-expired screen.
-      signOutPrivacyCenter();
-      notifySessionExpired();
-      return false;
-    }
-
-    // Circuit breaker (incident 2026-06-22): a new token re-arms; a known-dead
-    // token or an open backoff window short-circuits without hitting the network.
-    if (deadRefreshToken !== null && refreshToken !== deadRefreshToken) {
-      resetRefreshCircuit();
-    }
-    if (refreshToken === deadRefreshToken || Date.now() < transientRefreshFailureUntil) {
-      return false;
-    }
-
-    try {
-      const result = await refreshOtpTokenServer(orgId, wsId, refreshToken, consentClient);
-      if (result && result.success !== false) {
-        const newAccessToken = (result as { access_token?: string })?.access_token;
-        const newRefreshToken = (result as { refresh_token?: string })?.refresh_token;
-
-        if (newAccessToken) {
-          // Validate the new token is not expired before storing
-          if (isJwtExpired(newAccessToken, TOKEN_EXPIRY_BUFFER_SECONDS)) {
-            console.error('Refreshed access token is already expired - clearing auth state');
-            markRefreshTokenDead(refreshToken);
-            signOutPrivacyCenter();
-            notifySessionExpired();
-            return false;
-          }
-          sessionStorage.setItem('access_token', newAccessToken);
-          // Success — re-arm the circuit breaker.
-          resetRefreshCircuit();
-        } else {
-          // No access token in response - refresh failed
-          console.error('Refresh response missing access token - clearing auth state');
-          markRefreshTokenDead(refreshToken);
-          signOutPrivacyCenter();
-          notifySessionExpired();
-          return false;
-        }
-
-        if (newRefreshToken) {
-          setRefreshTokenCookie(newRefreshToken);
-        }
-
-        // Verify we now have a valid, non-expired access token
-        const isValid = !!newAccessToken && !isJwtExpired(newAccessToken, TOKEN_EXPIRY_BUFFER_SECONDS);
-        if (!isValid) {
-          console.error('Refreshed token validation failed - clearing auth state');
-          signOutPrivacyCenter();
-        }
-        return isValid;
-      } else {
-        // Refresh token expired/revoked or server returned failure - terminal.
-        markRefreshTokenDead(refreshToken);
-        signOutPrivacyCenter();
-        notifySessionExpired();
-        return false;
-      }
-    } catch (error: any) {
-      if (isTerminalRefreshError(error)) {
-        // Refresh token is expired / not found / already used - trip the breaker.
-        markRefreshTokenDead(refreshToken);
-        signOutPrivacyCenter();
-        notifySessionExpired();
-        return false;
-      }
-
-      // Transient (network / 5xx): keep auth state, back off, retry on a later call.
-      noteTransientRefreshFailure();
-      console.error('[Token Refresh] Unexpected error refreshing token:', error);
-      return false;
-    }
-  }
-
-  return false;
-};
-
-/**
- * Compare two email addresses (case-insensitive, handles URL encoding)
- * @param email1 - First email (can be URL-encoded)
- * @param email2 - Second email
- * @returns true if emails match (case-insensitive), false otherwise
- */
-export const compareEmails = (email1: string | null, email2: string | null): boolean => {
-  if (!email1 || !email2) {
-    return false;
-  }
-
-  // Decode URL-encoded email (handles %40 for @, %2B for +, etc.)
-  const decodedEmail1 = decodeURIComponent(email1.trim());
-  const normalizedEmail1 = decodedEmail1.toLowerCase();
-  const normalizedEmail2 = email2.trim().toLowerCase();
-
-  return normalizedEmail1 === normalizedEmail2;
-};
-
-/**
- * Sign out from privacy center only
- * Clears privacy-center specific storage and cookies without touching Supabase auth
- */
-export const signOutPrivacyCenter = (): void => {
-  if (typeof window === 'undefined') return;
-
-  const privacyCenterKeys = [
-    'access_token',
-    'email',
-    'i18nextLng',
-    'lang',
-    'pc_org_slug',
-    'pc_org_id',
-    'pc_workspace_id',
-    'pc_current_page',
-    'pc_grievance_view',
-    'pc_selected_case_uuid',
-  ];
-  privacyCenterKeys.forEach((key) => {
-    sessionStorage.removeItem(key);
-  });
-
-  // Clear the persisted refresh token (and the SDK's own legacy cookie from
-  // older versions). The host app's path=/ cookie is intentionally left alone.
-  removeStorage(REFRESH_TOKEN_STORAGE_KEY);
-  clearLegacyRefreshTokenCookie();
-};
-
-/**
- * Ensure a valid access token is available before making API calls.
- * This function checks if the current token is valid (not expired).
- * If expired or missing, it attempts to refresh using the refresh token.
- * If refresh fails (refresh token expired), it signs out and redirects to sign-in.
- * 
- * @param organizationId - The organization UUID
- * @param workspaceId - The workspace UUID
- * @param slug - The organization slug for redirect
- * @param authContext - Optional auth context values (accessToken, refreshToken, onError, updateTokens)
- * @returns Promise<string | null> - Valid access token or null if auth failed
- */
-export const ensureValidToken = async (
-  organizationId?: string,
-  workspaceId?: string,
-  slug?: string,
-  authContext?: {
-    accessToken?: string;
-    refreshToken?: string;
-    onError?: (error: Error) => boolean;
-    updateTokens?: (accessToken: string, refreshToken?: string) => void;
-  },
-  consentClient?: BaseUrlContextValue['consentClient']
-): Promise<string | null> => {
-  if (typeof window === 'undefined') return null;
-
-  // Sandbox PoC: no JWT, no expiry, no refresh — hand back the static token so
-  // callers proceed straight to the request (which carries the X-Consent-Token
-  // header instead of Authorization, and the acting identity in its payload).
-  const sandbox = getSandboxConfig();
-  if (sandbox) {
-    return sandbox.token;
-  }
-
-  // Use context accessToken if provided, otherwise fall back to sessionStorage
-  const accessToken = authContext?.accessToken || sessionStorage.getItem('access_token');
-
-  // Check if current token is valid (exists, is a string, and not expired)
-  // Use a buffer to proactively refresh before actual expiry
-  if (
-    accessToken &&
-    typeof accessToken === 'string' &&
-    accessToken.trim() !== '' &&
-    !isJwtExpired(accessToken, TOKEN_EXPIRY_BUFFER_SECONDS)
-  ) {
-    return accessToken;
-  }
-
-  // Circuit breaker: before any network work, consult the failure memory.
-  // (Incident 2026-06-22 — stops the /otp/refresh retry storm at its source.)
-  const activeRefreshToken = getActiveRefreshToken(authContext);
-  // A new refresh token value means the user re-authenticated — re-arm the breaker.
-  if (deadRefreshToken !== null && activeRefreshToken !== deadRefreshToken) {
-    resetRefreshCircuit();
-  }
-  // Known-dead token: do not touch the network until a different token appears.
-  if (activeRefreshToken !== null && activeRefreshToken === deadRefreshToken) {
-    return null;
-  }
-  // Transient-failure backoff window still open: skip the network.
-  if (Date.now() < transientRefreshFailureUntil) {
-    return null;
-  }
-
-  // Token is missing or expired, need to refresh
-  // Use lock to prevent concurrent refresh attempts
-  if (isRefreshing && refreshPromise) {
-    // Wait for ongoing refresh to complete
-    const newToken = await refreshPromise;
-    // Return the new token directly (it's already stored in sessionStorage/context)
-    return newToken;
-  }
-
-  // Start refresh process
-  isRefreshing = true;
-  refreshPromise = performTokenRefresh(organizationId, workspaceId, slug, authContext, consentClient);
-
-  try {
-    const newToken = await refreshPromise;
-    // Return the new token directly (it's already stored in sessionStorage/context)
-    return newToken;
-  } finally {
-    isRefreshing = false;
-    refreshPromise = null;
-  }
-};
-
-/**
- * Internal function to perform token refresh
- * @returns Promise<string | null> - The new access token on success, null on failure
- */
-const performTokenRefresh = async (
-  organizationId?: string,
-  workspaceId?: string,
-  // Retained for call-site compatibility; redirect-by-slug was removed in favor
-  // of the terminal "session expired" screen, so the value is intentionally unused.
-  _slug?: string,
-  authContext?: {
-    accessToken?: string;
-    refreshToken?: string;
-    onError?: (error: Error) => boolean;
-    updateTokens?: (accessToken: string, refreshToken?: string) => void;
-  },
-  consentClient?: BaseUrlContextValue['consentClient']
-): Promise<string | null> => {
-  // Get organizationId and workspaceId from sessionStorage if not provided
-  const orgId = organizationId || sessionStorage.getItem('pc_org_id') || '';
-  const wsId = workspaceId || sessionStorage.getItem('pc_workspace_id') || '';
-
-  if (!orgId || !wsId) {
-    console.error('[Token Refresh] Missing organizationId or workspaceId');
-    const error = new Error('Missing organizationId or workspaceId');
-    // Inform the host (informational only — we no longer auto-navigate; the
-    // component surfaces a terminal "session expired" screen instead).
-    authContext?.onError?.(error);
-    signOutPrivacyCenter();
-    notifySessionExpired();
-    return null;
-  }
-
-  // Resolve the refresh token (props mode → context, legacy mode → storage) via
-  // the shared helper so the value matches what the circuit breaker keyed on.
-  const refreshTokenValue: string | null = getActiveRefreshToken(authContext);
-
-  // Validate refreshToken is a non-empty string
-  if (!refreshTokenValue || typeof refreshTokenValue !== 'string' || refreshTokenValue.trim() === '') {
-    // No refresh token available - user needs to sign in again
-    // Log presence only — never the raw token, which would leak a credential to
-    // browser log collectors.
-    console.warn('[Token Refresh] No valid refresh token available', {
-      hasAuthContext: !!authContext,
-      hasRefreshTokenInContext: !!authContext?.refreshToken?.trim(),
-      hasRefreshTokenInStorage: !!getStoredRefreshToken(),
-    });
-    const error = new Error('No refresh token available');
-    // Inform the host (informational only — we no longer auto-navigate).
-    authContext?.onError?.(error);
-    signOutPrivacyCenter();
-    notifySessionExpired();
-    return null;
-  }
-
-  // At this point, refreshTokenValue is guaranteed to be a non-empty string
-  const refreshToken: string = refreshTokenValue;
-
-  try {
-    const result = await refreshOtpTokenServer(orgId, wsId, refreshToken, consentClient);
-
-    if (result && result.success !== false) {
-      const newAccessToken = (result as { access_token?: string })?.access_token;
-      const newRefreshToken = (result as { refresh_token?: string })?.refresh_token;
-
-      if (newAccessToken) {
-        // Validate the new token is not expired before storing
-        if (isJwtExpired(newAccessToken, TOKEN_EXPIRY_BUFFER_SECONDS)) {
-          console.error('[Token Refresh] New access token is already expired');
-          markRefreshTokenDead(refreshToken);
-          const error = new Error('New access token is already expired');
-          // Inform the host (informational only — we no longer auto-navigate).
-          authContext?.onError?.(error);
-          signOutPrivacyCenter();
-          notifySessionExpired();
-          return null;
-        }
-
-        // Update tokens via context if available, otherwise use storage
-        if (authContext?.updateTokens) {
-          authContext.updateTokens(newAccessToken, newRefreshToken);
-        } else {
-          sessionStorage.setItem('access_token', newAccessToken);
-          if (newRefreshToken) {
-            setRefreshTokenCookie(newRefreshToken);
-          }
-        }
-
-        // Success — re-arm the circuit breaker so future failures are tracked afresh.
-        resetRefreshCircuit();
-        // Return the new access token directly (already stored in sessionStorage/context)
-        return newAccessToken;
-      } else {
-        // No access token in response - refresh failed
-        console.error('[Token Refresh] Response missing access token');
-        markRefreshTokenDead(refreshToken);
-        const error = new Error('Response missing access token');
-        // Inform the host (informational only — we no longer auto-navigate).
-        authContext?.onError?.(error);
-        signOutPrivacyCenter();
-        notifySessionExpired();
-        return null;
-      }
-    } else {
-      // Refresh token expired/revoked or server returned failure - terminal.
-      markRefreshTokenDead(refreshToken);
-      const error = new Error('Refresh token expired or revoked');
-      // Inform the host (informational only — we no longer auto-navigate).
-      authContext?.onError?.(error);
-      signOutPrivacyCenter();
-      notifySessionExpired();
-      return null;
-    }
-  } catch (error: any) {
-    if (isTerminalRefreshError(error)) {
-      // Terminal: refresh token expired / not found / already used / 4xx. Trip the
-      // breaker so this dead token is never re-submitted, then surface the
-      // session-expired screen (onError is informational; we no longer navigate).
-      markRefreshTokenDead(refreshToken);
-      const err = new Error('Refresh token expired or revoked');
-      authContext?.onError?.(err);
-      signOutPrivacyCenter();
-      notifySessionExpired();
-      return null;
-    }
-
-    // Transient (network / 5xx): keep auth state, back off, and let a later call retry.
-    noteTransientRefreshFailure();
-    console.error('[Token Refresh] Unexpected error:', error);
-    // Still call onError for unexpected errors
-    if (authContext?.onError) {
-      const err = error instanceof Error ? error : new Error(String(error));
-      authContext.onError(err);
-    }
-    return null;
-  }
-};
-
-// Activity helper functions
-
-export type ActivityBadgeStatus =
-  | 'success'
-  | 'warning'
-  | 'error'
-  | 'info'
-  | 'pending';
-
-/**
- * Get badge status based on activity type
- */
-export const getActivityTypeStatus = (
-  activityType: string
-): ActivityBadgeStatus => {
-  const type = activityType.toLowerCase();
-  if (type.includes('consent') || type.includes('grant')) return 'success';
-  if (type.includes('revoke') || type.includes('withdraw')) return 'error';
-  if (type.includes('update') || type.includes('modify')) return 'warning';
-  if (type.includes('view') || type.includes('access')) return 'info';
-  return 'pending';
-};
-
-/**
- * Format activity type for display
- */
-export const formatActivityType = (activityType: string): string => {
-  return activityType
-    .split('_')
-    .map((word) => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase())
-    .join(' ');
-};
-
-
-export const getVar = (varName: string): string => `var(${varName})`;