@redacto.io/consent-sdk-react 10.1.0-beta.1 → 10.1.0-beta.2

package/dist/index.js

@@ -155,7 +155,7 @@ var SANDBOX_TOKEN_HEADER = "X-Consent-Token";
 
 // src/RedactoNoticeConsent/api/sandbox.ts
 var resolveSandboxAuth = (params) => {
-  var _a, _b, _c, _d, _e;
+  var _a, _b, _c, _d, _e, _f;
   const token = (_a = params.token) == null ? void 0 : _a.trim();
   if (!token) {
     return null;
@@ -163,16 +163,17 @@ var resolveSandboxAuth = (params) => {
   const organisationUuid = (_b = params.organisationUuid) == null ? void 0 : _b.trim();
   const workspaceUuid = (_c = params.workspaceUuid) == null ? void 0 : _c.trim();
   const ucic = (_d = params.sandboxUcic) == null ? void 0 : _d.trim();
-  const subject = (_e = params.sandboxSubject) == null ? void 0 : _e.trim();
+  const email = (_e = params.sandboxEmail) == null ? void 0 : _e.trim();
+  const mobile = (_f = params.sandboxMobile) == null ? void 0 : _f.trim();
   if (!organisationUuid || !workspaceUuid) {
     throw new Error(
       "Sandbox mode requires organisationUuid and workspaceUuid props"
     );
   }
-  if (!ucic && !subject) {
+  if (!ucic && !email && !mobile) {
     throw new Error("Sandbox mode requires a UCIC, email, or mobile");
   }
-  return { token, ucic, subject: subject != null ? subject : "", organisationUuid, workspaceUuid };
+  return { token, ucic, email, mobile, organisationUuid, workspaceUuid };
 };
 var resolveRequestAuth = (accessToken, sandboxParams, decodeTokenSafely2) => {
   const sandbox = resolveSandboxAuth(sandboxParams);
@@ -204,10 +205,17 @@ var buildAuthHeaders = (accessToken, sandbox) => {
   return { Authorization: `Bearer ${accessToken}` };
 };
 var sandboxBodyIdentity = (sandbox) => {
+  const payload = {};
   if (sandbox.ucic) {
-    return { org_user_id: sandbox.ucic };
+    payload.org_user_id = sandbox.ucic;
+  }
+  if (sandbox.email) {
+    payload.primary_email = sandbox.email;
+  }
+  if (sandbox.mobile) {
+    payload.primary_mobile = sandbox.mobile;
   }
-  return sandbox.subject.includes("@") ? { primary_email: sandbox.subject } : { primary_mobile: sandbox.subject };
+  return payload;
 };
 var sandboxQueryIdentity = (sandbox) => sandboxBodyIdentity(sandbox);
 
@@ -335,7 +343,7 @@ var fetchConsentContent = async ({
   }
   const { organisationUuid: ORGANISATION_UUID, workspaceUuid: WORKSPACE_UUID, sandbox } = resolveRequestAuth(accessToken, sandboxParams, decodeTokenSafely);
   const apiBaseUrl = baseUrl || BASE_URL;
-  const cacheIdentity = sandbox ? `sandbox:${sandbox.organisationUuid}:${sandbox.workspaceUuid}:${sandbox.ucic || sandbox.subject}` : accessToken;
+  const cacheIdentity = sandbox ? `sandbox:${sandbox.organisationUuid}:${sandbox.workspaceUuid}:${sandbox.ucic || sandbox.email || sandbox.mobile}` : accessToken;
   const cacheKey = `${cacheIdentity}-${noticeId}-${validate_against}-${language}-${specific_uuid || ""}-${include_fully_consented_data}`;
   if (validate_against === "all" && !specific_uuid) {
     const cachedData = getCachedData(cacheKey);
@@ -355,7 +363,9 @@ var fetchConsentContent = async ({
   }
   if (sandbox) {
     for (const [key, value] of Object.entries(sandboxQueryIdentity(sandbox))) {
-      url.searchParams.append(key, value);
+      if (value) {
+        url.searchParams.append(key, value);
+      }
     }
   }
   const response = await fetch(url.toString(), {
@@ -399,7 +409,7 @@ var submitConsentEvent = async ({
     throw new Error("accessToken or token is required");
   }
   const { organisationUuid: ORGANISATION_UUID, workspaceUuid: WORKSPACE_UUID, sandbox } = resolveRequestAuth(accessToken, sandboxParams, decodeTokenSafely);
-  const apiBaseUrl = (sandbox ? null : ledgerBaseUrl) || baseUrl || BASE_URL;
+  const apiBaseUrl = ledgerBaseUrl || baseUrl || BASE_URL;
   const validatedPurposes = purposes.map((purpose) => {
     if (!purpose.uuid) {
       throw new Error(`Invalid purpose data: missing uuid`);
@@ -465,7 +475,9 @@ var fetchTTSAudioUrls = async ({
   );
   if (sandbox) {
     for (const [key, value] of Object.entries(sandboxQueryIdentity(sandbox))) {
-      url.searchParams.append(key, value);
+      if (value) {
+        url.searchParams.append(key, value);
+      }
     }
   }
   const response = await fetch(url.toString(), {
@@ -3082,7 +3094,8 @@ var RedactoNoticeConsent = ({
     () => ({
       token,
       sandboxUcic: ucic,
-      sandboxSubject: email || mobile,
+      sandboxEmail: email,
+      sandboxMobile: mobile,
       organisationUuid,
       workspaceUuid
     }),

package/dist/index.mjs

@@ -82,7 +82,7 @@ async function parseApiError(response, fallbackMessage) {
 
 // src/RedactoNoticeConsent/api/sandbox.ts
 var resolveSandboxAuth = (params) => {
-  var _a, _b, _c, _d, _e;
+  var _a, _b, _c, _d, _e, _f;
   const token = (_a = params.token) == null ? void 0 : _a.trim();
   if (!token) {
     return null;
@@ -90,16 +90,17 @@ var resolveSandboxAuth = (params) => {
   const organisationUuid = (_b = params.organisationUuid) == null ? void 0 : _b.trim();
   const workspaceUuid = (_c = params.workspaceUuid) == null ? void 0 : _c.trim();
   const ucic = (_d = params.sandboxUcic) == null ? void 0 : _d.trim();
-  const subject = (_e = params.sandboxSubject) == null ? void 0 : _e.trim();
+  const email = (_e = params.sandboxEmail) == null ? void 0 : _e.trim();
+  const mobile = (_f = params.sandboxMobile) == null ? void 0 : _f.trim();
   if (!organisationUuid || !workspaceUuid) {
     throw new Error(
       "Sandbox mode requires organisationUuid and workspaceUuid props"
     );
   }
-  if (!ucic && !subject) {
+  if (!ucic && !email && !mobile) {
     throw new Error("Sandbox mode requires a UCIC, email, or mobile");
   }
-  return { token, ucic, subject: subject != null ? subject : "", organisationUuid, workspaceUuid };
+  return { token, ucic, email, mobile, organisationUuid, workspaceUuid };
 };
 var resolveRequestAuth = (accessToken, sandboxParams, decodeTokenSafely2) => {
   const sandbox = resolveSandboxAuth(sandboxParams);
@@ -131,10 +132,17 @@ var buildAuthHeaders = (accessToken, sandbox) => {
   return { Authorization: `Bearer ${accessToken}` };
 };
 var sandboxBodyIdentity = (sandbox) => {
+  const payload = {};
   if (sandbox.ucic) {
-    return { org_user_id: sandbox.ucic };
+    payload.org_user_id = sandbox.ucic;
+  }
+  if (sandbox.email) {
+    payload.primary_email = sandbox.email;
+  }
+  if (sandbox.mobile) {
+    payload.primary_mobile = sandbox.mobile;
   }
-  return sandbox.subject.includes("@") ? { primary_email: sandbox.subject } : { primary_mobile: sandbox.subject };
+  return payload;
 };
 var sandboxQueryIdentity = (sandbox) => sandboxBodyIdentity(sandbox);
 
@@ -262,7 +270,7 @@ var fetchConsentContent = async ({
   }
   const { organisationUuid: ORGANISATION_UUID, workspaceUuid: WORKSPACE_UUID, sandbox } = resolveRequestAuth(accessToken, sandboxParams, decodeTokenSafely);
   const apiBaseUrl = baseUrl || BASE_URL;
-  const cacheIdentity = sandbox ? `sandbox:${sandbox.organisationUuid}:${sandbox.workspaceUuid}:${sandbox.ucic || sandbox.subject}` : accessToken;
+  const cacheIdentity = sandbox ? `sandbox:${sandbox.organisationUuid}:${sandbox.workspaceUuid}:${sandbox.ucic || sandbox.email || sandbox.mobile}` : accessToken;
   const cacheKey = `${cacheIdentity}-${noticeId}-${validate_against}-${language}-${specific_uuid || ""}-${include_fully_consented_data}`;
   if (validate_against === "all" && !specific_uuid) {
     const cachedData = getCachedData(cacheKey);
@@ -282,7 +290,9 @@ var fetchConsentContent = async ({
   }
   if (sandbox) {
     for (const [key, value] of Object.entries(sandboxQueryIdentity(sandbox))) {
-      url.searchParams.append(key, value);
+      if (value) {
+        url.searchParams.append(key, value);
+      }
     }
   }
   const response = await fetch(url.toString(), {
@@ -326,7 +336,7 @@ var submitConsentEvent = async ({
     throw new Error("accessToken or token is required");
   }
   const { organisationUuid: ORGANISATION_UUID, workspaceUuid: WORKSPACE_UUID, sandbox } = resolveRequestAuth(accessToken, sandboxParams, decodeTokenSafely);
-  const apiBaseUrl = (sandbox ? null : ledgerBaseUrl) || baseUrl || BASE_URL;
+  const apiBaseUrl = ledgerBaseUrl || baseUrl || BASE_URL;
   const validatedPurposes = purposes.map((purpose) => {
     if (!purpose.uuid) {
       throw new Error(`Invalid purpose data: missing uuid`);
@@ -392,7 +402,9 @@ var fetchTTSAudioUrls = async ({
   );
   if (sandbox) {
     for (const [key, value] of Object.entries(sandboxQueryIdentity(sandbox))) {
-      url.searchParams.append(key, value);
+      if (value) {
+        url.searchParams.append(key, value);
+      }
     }
   }
   const response = await fetch(url.toString(), {
@@ -2808,7 +2820,8 @@ var RedactoNoticeConsent = ({
     () => ({
       token,
       sandboxUcic: ucic,
-      sandboxSubject: email || mobile,
+      sandboxEmail: email,
+      sandboxMobile: mobile,
       organisationUuid,
       workspaceUuid
     }),

package/dist/privacy-center.d.mts

@@ -57,8 +57,15 @@ declare function createConsentClient(baseUrl: string, ledgerBaseUrl?: string): {
     createOtp(organisationId: string, workspaceId: string, email: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<unknown>;
     /**
      * Verify OTP (public)
+     *
+     * Defaults to `purpose: "login"` — the branch the backend uses to mint an
+     * `auth`-scoped token (and to resolve shared-contact principals via the
+     * ledger). `purpose: "consent"` is reserved for consent flows. A login that
+     * omits the purpose falls back server-side to `purpose: "consent"`, which
+     * mints a scope-less notice token — every `/dsar/privacy-center/*` endpoint
+     * then rejects it with 403 "Token scope is not permitted".
      */
-    verifyOtp(organisationId: string, workspaceId: string, otpId: string, otp: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<unknown>;
+    verifyOtp(organisationId: string, workspaceId: string, otpId: string, otp: string, options?: Omit<ApiFetchOptions, "getAuthToken">, purpose?: "login" | "consent"): Promise<unknown>;
     /**
      * Exchange one-time token for JWT tokens (public)
      */
@@ -472,6 +479,8 @@ type ManageConsentParams = {
     dataElementUuids?: string[];
 };
 type Activity = {
+    /** Stable per-activity id (source consent-event / case uuid) for keying and de-duplication. */
+    id?: string;
     activity_type: string;
     activity_type_display?: string;
     timestamp: string;
@@ -722,10 +731,12 @@ type AuthProviderProps = Readonly<{
      * payload, and never calls `/otp/refresh`.
      */
     token?: string;
-    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence over the subject. */
+    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence for the principal. */
     sandboxUcic?: string;
-    /** Sandbox subject (email or mobile) — carried in the request payload. */
-    sandboxSubject?: string;
+    /** Sandbox email — carried on every request, like a live JWT's `user_data.primary_email`. */
+    sandboxEmail?: string;
+    /** Sandbox mobile — carried on every request, like a live JWT's `user_data.primary_mobile`. */
+    sandboxMobile?: string;
     /** Sandbox org UUID (replaces the JWT-decoded org). */
     organisationUuid?: string;
     /** Sandbox workspace UUID (replaces the JWT-decoded workspace). */

package/dist/privacy-center.d.ts

@@ -57,8 +57,15 @@ declare function createConsentClient(baseUrl: string, ledgerBaseUrl?: string): {
     createOtp(organisationId: string, workspaceId: string, email: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<unknown>;
     /**
      * Verify OTP (public)
+     *
+     * Defaults to `purpose: "login"` — the branch the backend uses to mint an
+     * `auth`-scoped token (and to resolve shared-contact principals via the
+     * ledger). `purpose: "consent"` is reserved for consent flows. A login that
+     * omits the purpose falls back server-side to `purpose: "consent"`, which
+     * mints a scope-less notice token — every `/dsar/privacy-center/*` endpoint
+     * then rejects it with 403 "Token scope is not permitted".
      */
-    verifyOtp(organisationId: string, workspaceId: string, otpId: string, otp: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<unknown>;
+    verifyOtp(organisationId: string, workspaceId: string, otpId: string, otp: string, options?: Omit<ApiFetchOptions, "getAuthToken">, purpose?: "login" | "consent"): Promise<unknown>;
     /**
      * Exchange one-time token for JWT tokens (public)
      */
@@ -472,6 +479,8 @@ type ManageConsentParams = {
     dataElementUuids?: string[];
 };
 type Activity = {
+    /** Stable per-activity id (source consent-event / case uuid) for keying and de-duplication. */
+    id?: string;
     activity_type: string;
     activity_type_display?: string;
     timestamp: string;
@@ -722,10 +731,12 @@ type AuthProviderProps = Readonly<{
      * payload, and never calls `/otp/refresh`.
      */
     token?: string;
-    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence over the subject. */
+    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence for the principal. */
     sandboxUcic?: string;
-    /** Sandbox subject (email or mobile) — carried in the request payload. */
-    sandboxSubject?: string;
+    /** Sandbox email — carried on every request, like a live JWT's `user_data.primary_email`. */
+    sandboxEmail?: string;
+    /** Sandbox mobile — carried on every request, like a live JWT's `user_data.primary_mobile`. */
+    sandboxMobile?: string;
     /** Sandbox org UUID (replaces the JWT-decoded org). */
     organisationUuid?: string;
     /** Sandbox workspace UUID (replaces the JWT-decoded workspace). */

package/dist/privacy-center.js

@@ -8140,13 +8140,20 @@ var sandboxBodyIdentity = () => {
   if (!sandboxConfig) {
     return null;
   }
+  const payload = {};
   if (sandboxConfig.ucic) {
-    return { org_user_id: sandboxConfig.ucic };
+    payload.org_user_id = sandboxConfig.ucic;
   }
-  return sandboxConfig.subject.includes("@") ? { primary_email: sandboxConfig.subject } : { primary_mobile: sandboxConfig.subject };
+  if (sandboxConfig.email) {
+    payload.primary_email = sandboxConfig.email;
+  }
+  if (sandboxConfig.mobile) {
+    payload.primary_mobile = sandboxConfig.mobile;
+  }
+  return payload;
 };
 var sandboxQueryIdentity = () => sandboxBodyIdentity();
-var sandboxContact = () => sandboxConfig ? sandboxConfig.ucic || sandboxConfig.subject : null;
+var sandboxContact = () => sandboxConfig ? sandboxConfig.ucic || sandboxConfig.email || sandboxConfig.mobile || null : null;
 
 // src/RedactoPrivacyCenter/api/fetcher.ts
 var ApiError = class _ApiError extends Error {
@@ -9871,7 +9878,7 @@ var seedSessionStorage = (data) => {
   if (data.contact) sessionStorage.setItem("email", data.contact);
 };
 var configureSandbox = (props) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m;
   const token = (_a = props.token) == null ? void 0 : _a.trim();
   if (!token) {
     setSandboxConfig(null);
@@ -9880,12 +9887,14 @@ var configureSandbox = (props) => {
   const organisationUuid = (_c = (_b = props.organisationUuid) == null ? void 0 : _b.trim()) != null ? _c : "";
   const workspaceUuid = (_e = (_d = props.workspaceUuid) == null ? void 0 : _d.trim()) != null ? _e : "";
   const ucic = (_g = (_f = props.sandboxUcic) == null ? void 0 : _f.trim()) != null ? _g : "";
-  const subject = (_i = (_h = props.sandboxSubject) == null ? void 0 : _h.trim()) != null ? _i : "";
-  const slug = (_k = (_j = props.slug) == null ? void 0 : _j.trim()) != null ? _k : "";
+  const email = (_i = (_h = props.sandboxEmail) == null ? void 0 : _h.trim()) != null ? _i : "";
+  const mobile = (_k = (_j = props.sandboxMobile) == null ? void 0 : _j.trim()) != null ? _k : "";
+  const slug = (_m = (_l = props.slug) == null ? void 0 : _l.trim()) != null ? _m : "";
   setSandboxConfig({
     token,
     ucic: ucic || void 0,
-    subject,
+    email: email || void 0,
+    mobile: mobile || void 0,
     organisationUuid,
     workspaceUuid,
     slug
@@ -9895,7 +9904,8 @@ var configureSandbox = (props) => {
     orgId: organisationUuid,
     workspaceId: workspaceUuid,
     slug,
-    contact: ucic || subject
+    // The principal precedence (UCIC > email > mobile) the server also applies.
+    contact: ucic || email || mobile
   });
   return true;
 };
@@ -9920,7 +9930,8 @@ var AuthProvider = (props) => {
     refreshToken: initialRefreshToken,
     token: sandboxToken,
     sandboxUcic,
-    sandboxSubject,
+    sandboxEmail,
+    sandboxMobile,
     organisationUuid,
     workspaceUuid,
     slug,
@@ -9986,7 +9997,7 @@ var AuthProvider = (props) => {
     }
     configureSandbox(props);
     return () => setSandboxConfig(null);
-  }, [sandboxActive, sandboxToken, sandboxUcic, sandboxSubject, organisationUuid, workspaceUuid, slug]);
+  }, [sandboxActive, sandboxToken, sandboxUcic, sandboxEmail, sandboxMobile, organisationUuid, workspaceUuid, slug]);
   const updateTokens = (0, import_react3.useCallback)((newAccessToken, newRefreshToken) => {
     setAccessToken(newAccessToken);
     if (newRefreshToken) {
@@ -10024,7 +10035,7 @@ var import_react4 = require("react");
 // src/RedactoPrivacyCenter/api/client.ts
 function createConsentClient(baseUrl, ledgerBaseUrl) {
   const ledgerConfigured = Boolean(ledgerBaseUrl);
-  const useLedger = () => ledgerConfigured && !isSandboxMode();
+  const useLedger = () => ledgerConfigured;
   const ledgerBase = (ledgerBaseUrl != null ? ledgerBaseUrl : "").replace(/\/$/, "");
   async function privacyCenterApiFetch(url, options) {
     const { authToken, getAuthToken, headers = {}, ...fetchOptions } = options;
@@ -10149,7 +10160,9 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
     const identity = sandboxQueryIdentity();
     if (identity) {
       Object.entries(identity).forEach(([key, value]) => {
-        queryParams.append(key, value);
+        if (value) {
+          queryParams.append(key, value);
+        }
       });
     }
   }
@@ -10220,13 +10233,20 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
     },
     /**
      * Verify OTP (public)
+     *
+     * Defaults to `purpose: "login"` — the branch the backend uses to mint an
+     * `auth`-scoped token (and to resolve shared-contact principals via the
+     * ledger). `purpose: "consent"` is reserved for consent flows. A login that
+     * omits the purpose falls back server-side to `purpose: "consent"`, which
+     * mints a scope-less notice token — every `/dsar/privacy-center/*` endpoint
+     * then rejects it with 403 "Token scope is not permitted".
      */
-    async verifyOtp(organisationId, workspaceId, otpId, otp, options) {
+    async verifyOtp(organisationId, workspaceId, otpId, otp, options, purpose = "login") {
       const url = `${baseUrl}/public/organisations/${organisationId}/workspaces/${workspaceId}/otp/verify`;
       return apiFetch(url, {
         ...options,
         method: "POST",
-        body: JSON.stringify({ uuid: otpId, otp })
+        body: JSON.stringify({ uuid: otpId, otp, purpose })
       });
     },
     /**
@@ -10334,6 +10354,7 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
      * used with its `{ purpose_uuid, contact, ... }` payload.
      */
     async manageConsent(baseRequest, purposeId, contact, status, authToken, options, nominatorContact, dataElementUuids, productUuid, noticeUuid, dataElements, language) {
+      var _a;
       if (!useLedger()) {
         const url2 = privacyCenterUrl(baseRequest, `/manage-consent?status=${status}`);
         const body2 = { purpose_uuid: purposeId, contact };
@@ -10373,6 +10394,9 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
       });
       const body = {
         notice_uuid: noticeUuid,
+        // Sandbox has no JWT, so the ledger resolves the acting test principal
+        // from this identity in the body; null (spread no-op) on the live JWT path.
+        ...(_a = sandboxBodyIdentity()) != null ? _a : {},
         partial: true,
         declined: false,
         select_all_mandatory: false,
@@ -10468,7 +10492,13 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
      * and the Authorization header must be sent (anchor navigation wouldn't carry it).
      */
     async getReceiptPdf(baseRequest, receiptUuid, authToken) {
-      const url = useLedger() ? ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`) : privacyCenterUrl(baseRequest, `/receipts/${receiptUuid}/pdf`);
+      const url = useLedger() ? ledgerUrl(
+        baseRequest,
+        `/receipts/${receiptUuid}/download${sandboxIdentitySuffix()}`
+      ) : privacyCenterUrl(
+        baseRequest,
+        `/receipts/${receiptUuid}/pdf${sandboxIdentitySuffix()}`
+      );
       const token = resolveAuthToken(authToken, baseRequest);
       const requestHeaders = new Headers();
       requestHeaders.set("Accept", "application/pdf");
@@ -22842,13 +22872,16 @@ function ActivityTimeline({
               }
             }
           ),
-          group.items.map((activity, index) => /* @__PURE__ */ (0, import_jsx_runtime71.jsx)(
-            TimelineRow,
-            {
-              activity
-            },
-            `${group.key}-${index}`
-          ))
+          group.items.map((activity, index) => {
+            var _a;
+            return /* @__PURE__ */ (0, import_jsx_runtime71.jsx)(
+              TimelineRow,
+              {
+                activity
+              },
+              (_a = activity.id) != null ? _a : `${group.key}-${index}`
+            );
+          })
         ] })
       ]
     },
@@ -28104,7 +28137,8 @@ function RedactoPrivacyCenter({
       refreshToken,
       token,
       sandboxUcic: ucic,
-      sandboxSubject: email || mobile,
+      sandboxEmail: email,
+      sandboxMobile: mobile,
       organisationUuid,
       workspaceUuid,
       slug,

package/dist/privacy-center.mjs

@@ -8072,13 +8072,20 @@ var sandboxBodyIdentity = () => {
   if (!sandboxConfig) {
     return null;
   }
+  const payload = {};
   if (sandboxConfig.ucic) {
-    return { org_user_id: sandboxConfig.ucic };
+    payload.org_user_id = sandboxConfig.ucic;
   }
-  return sandboxConfig.subject.includes("@") ? { primary_email: sandboxConfig.subject } : { primary_mobile: sandboxConfig.subject };
+  if (sandboxConfig.email) {
+    payload.primary_email = sandboxConfig.email;
+  }
+  if (sandboxConfig.mobile) {
+    payload.primary_mobile = sandboxConfig.mobile;
+  }
+  return payload;
 };
 var sandboxQueryIdentity = () => sandboxBodyIdentity();
-var sandboxContact = () => sandboxConfig ? sandboxConfig.ucic || sandboxConfig.subject : null;
+var sandboxContact = () => sandboxConfig ? sandboxConfig.ucic || sandboxConfig.email || sandboxConfig.mobile || null : null;
 
 // src/RedactoPrivacyCenter/api/fetcher.ts
 var ApiError = class _ApiError extends Error {
@@ -9803,7 +9810,7 @@ var seedSessionStorage = (data) => {
   if (data.contact) sessionStorage.setItem("email", data.contact);
 };
 var configureSandbox = (props) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m;
   const token = (_a = props.token) == null ? void 0 : _a.trim();
   if (!token) {
     setSandboxConfig(null);
@@ -9812,12 +9819,14 @@ var configureSandbox = (props) => {
   const organisationUuid = (_c = (_b = props.organisationUuid) == null ? void 0 : _b.trim()) != null ? _c : "";
   const workspaceUuid = (_e = (_d = props.workspaceUuid) == null ? void 0 : _d.trim()) != null ? _e : "";
   const ucic = (_g = (_f = props.sandboxUcic) == null ? void 0 : _f.trim()) != null ? _g : "";
-  const subject = (_i = (_h = props.sandboxSubject) == null ? void 0 : _h.trim()) != null ? _i : "";
-  const slug = (_k = (_j = props.slug) == null ? void 0 : _j.trim()) != null ? _k : "";
+  const email = (_i = (_h = props.sandboxEmail) == null ? void 0 : _h.trim()) != null ? _i : "";
+  const mobile = (_k = (_j = props.sandboxMobile) == null ? void 0 : _j.trim()) != null ? _k : "";
+  const slug = (_m = (_l = props.slug) == null ? void 0 : _l.trim()) != null ? _m : "";
   setSandboxConfig({
     token,
     ucic: ucic || void 0,
-    subject,
+    email: email || void 0,
+    mobile: mobile || void 0,
     organisationUuid,
     workspaceUuid,
     slug
@@ -9827,7 +9836,8 @@ var configureSandbox = (props) => {
     orgId: organisationUuid,
     workspaceId: workspaceUuid,
     slug,
-    contact: ucic || subject
+    // The principal precedence (UCIC > email > mobile) the server also applies.
+    contact: ucic || email || mobile
   });
   return true;
 };
@@ -9852,7 +9862,8 @@ var AuthProvider = (props) => {
     refreshToken: initialRefreshToken,
     token: sandboxToken,
     sandboxUcic,
-    sandboxSubject,
+    sandboxEmail,
+    sandboxMobile,
     organisationUuid,
     workspaceUuid,
     slug,
@@ -9918,7 +9929,7 @@ var AuthProvider = (props) => {
     }
     configureSandbox(props);
     return () => setSandboxConfig(null);
-  }, [sandboxActive, sandboxToken, sandboxUcic, sandboxSubject, organisationUuid, workspaceUuid, slug]);
+  }, [sandboxActive, sandboxToken, sandboxUcic, sandboxEmail, sandboxMobile, organisationUuid, workspaceUuid, slug]);
   const updateTokens = useCallback2((newAccessToken, newRefreshToken) => {
     setAccessToken(newAccessToken);
     if (newRefreshToken) {
@@ -9956,7 +9967,7 @@ import { createContext as createContext3, useContext as useContext3, useMemo as
 // src/RedactoPrivacyCenter/api/client.ts
 function createConsentClient(baseUrl, ledgerBaseUrl) {
   const ledgerConfigured = Boolean(ledgerBaseUrl);
-  const useLedger = () => ledgerConfigured && !isSandboxMode();
+  const useLedger = () => ledgerConfigured;
   const ledgerBase = (ledgerBaseUrl != null ? ledgerBaseUrl : "").replace(/\/$/, "");
   async function privacyCenterApiFetch(url, options) {
     const { authToken, getAuthToken, headers = {}, ...fetchOptions } = options;
@@ -10081,7 +10092,9 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
     const identity = sandboxQueryIdentity();
     if (identity) {
       Object.entries(identity).forEach(([key, value]) => {
-        queryParams.append(key, value);
+        if (value) {
+          queryParams.append(key, value);
+        }
       });
     }
   }
@@ -10152,13 +10165,20 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
     },
     /**
      * Verify OTP (public)
+     *
+     * Defaults to `purpose: "login"` — the branch the backend uses to mint an
+     * `auth`-scoped token (and to resolve shared-contact principals via the
+     * ledger). `purpose: "consent"` is reserved for consent flows. A login that
+     * omits the purpose falls back server-side to `purpose: "consent"`, which
+     * mints a scope-less notice token — every `/dsar/privacy-center/*` endpoint
+     * then rejects it with 403 "Token scope is not permitted".
      */
-    async verifyOtp(organisationId, workspaceId, otpId, otp, options) {
+    async verifyOtp(organisationId, workspaceId, otpId, otp, options, purpose = "login") {
       const url = `${baseUrl}/public/organisations/${organisationId}/workspaces/${workspaceId}/otp/verify`;
       return apiFetch(url, {
         ...options,
         method: "POST",
-        body: JSON.stringify({ uuid: otpId, otp })
+        body: JSON.stringify({ uuid: otpId, otp, purpose })
       });
     },
     /**
@@ -10266,6 +10286,7 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
      * used with its `{ purpose_uuid, contact, ... }` payload.
      */
     async manageConsent(baseRequest, purposeId, contact, status, authToken, options, nominatorContact, dataElementUuids, productUuid, noticeUuid, dataElements, language) {
+      var _a;
       if (!useLedger()) {
         const url2 = privacyCenterUrl(baseRequest, `/manage-consent?status=${status}`);
         const body2 = { purpose_uuid: purposeId, contact };
@@ -10305,6 +10326,9 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
       });
       const body = {
         notice_uuid: noticeUuid,
+        // Sandbox has no JWT, so the ledger resolves the acting test principal
+        // from this identity in the body; null (spread no-op) on the live JWT path.
+        ...(_a = sandboxBodyIdentity()) != null ? _a : {},
         partial: true,
         declined: false,
         select_all_mandatory: false,
@@ -10400,7 +10424,13 @@ function createConsentClient(baseUrl, ledgerBaseUrl) {
      * and the Authorization header must be sent (anchor navigation wouldn't carry it).
      */
     async getReceiptPdf(baseRequest, receiptUuid, authToken) {
-      const url = useLedger() ? ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`) : privacyCenterUrl(baseRequest, `/receipts/${receiptUuid}/pdf`);
+      const url = useLedger() ? ledgerUrl(
+        baseRequest,
+        `/receipts/${receiptUuid}/download${sandboxIdentitySuffix()}`
+      ) : privacyCenterUrl(
+        baseRequest,
+        `/receipts/${receiptUuid}/pdf${sandboxIdentitySuffix()}`
+      );
       const token = resolveAuthToken(authToken, baseRequest);
       const requestHeaders = new Headers();
       requestHeaders.set("Accept", "application/pdf");
@@ -22805,13 +22835,16 @@ function ActivityTimeline({
               }
             }
           ),
-          group.items.map((activity, index) => /* @__PURE__ */ jsx71(
-            TimelineRow,
-            {
-              activity
-            },
-            `${group.key}-${index}`
-          ))
+          group.items.map((activity, index) => {
+            var _a;
+            return /* @__PURE__ */ jsx71(
+              TimelineRow,
+              {
+                activity
+              },
+              (_a = activity.id) != null ? _a : `${group.key}-${index}`
+            );
+          })
         ] })
       ]
     },
@@ -28071,7 +28104,8 @@ function RedactoPrivacyCenter({
       refreshToken,
       token,
       sandboxUcic: ucic,
-      sandboxSubject: email || mobile,
+      sandboxEmail: email,
+      sandboxMobile: mobile,
       organisationUuid,
       workspaceUuid,
       slug,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redacto.io/consent-sdk-react",
-  "version": "10.1.0-beta.1",
+  "version": "10.1.0-beta.2",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
   "types": "dist/index.d.ts",