@redacto.io/consent-sdk-react 3.4.0 → 3.6.0

package/src/RedactoPrivacyCenter/api/client.ts

@@ -0,0 +1,413 @@
+import { apiFetch } from "./fetcher";
+import type { ApiFetchOptions, ApiResponse } from "./fetcher";
+
+/**
+ * Base request parameters for consent service calls
+ */
+export type BaseRequest = {
+  organisationUuid: string;
+  workspaceUuid: string;
+  authToken: string;
+};
+
+/**
+ * Consent service client factory.
+ * Creates a client instance with a specific base URL.
+ * @param baseUrl - Consent server base URL
+ */
+export function createConsentClient(baseUrl: string) {
+  /**
+   * Privacy Center API fetch wrapper that uses Authorization: Bearer header.
+   * Privacy center endpoints require JWT tokens in Authorization header, not X-Auth-Token.
+   */
+  async function privacyCenterApiFetch<T>(
+    url: string,
+    options: ApiFetchOptions & { authToken?: string }
+  ): Promise<T> {
+    const { authToken, getAuthToken, headers = {}, ...fetchOptions } = options;
+
+    // Build headers using Headers object
+    const requestHeaders = new Headers();
+
+    // Set default headers (skip Content-Type for FormData)
+    const isFormData = fetchOptions.body instanceof FormData;
+    if (!isFormData) {
+      requestHeaders.set("Content-Type", "application/json");
+    }
+    requestHeaders.set("Accept", "application/json");
+
+    // Add custom headers from options
+    if (headers && typeof headers === "object") {
+      if (headers instanceof Headers) {
+        headers.forEach((value, key) => {
+          requestHeaders.set(key, value);
+        });
+      } else {
+        Object.entries(headers as Record<string, string>).forEach(
+          ([key, value]) => {
+            if (value) {
+              requestHeaders.set(key, value);
+            }
+          }
+        );
+      }
+    }
+
+    // Add Authorization Bearer token for privacy center APIs
+    const token = authToken || (getAuthToken ? await getAuthToken() : null);
+    if (token) {
+      const trimmedToken = token.trim();
+      // Format token with Bearer prefix if not already present
+      const bearerToken = trimmedToken.startsWith('Bearer ')
+        ? trimmedToken
+        : `Bearer ${trimmedToken}`;
+      requestHeaders.set("Authorization", bearerToken);
+    }
+
+    // Build fetch options
+    const fetchOptionsFinal: RequestInit = {
+      ...fetchOptions,
+      headers: requestHeaders,
+    };
+
+    try {
+      const response = await fetch(url, fetchOptionsFinal);
+
+      // Handle non-OK responses
+      if (!response.ok) {
+        let errorMessage = `Request failed with status ${response.status}`;
+
+        try {
+          const errorData = (await response.json()) as {
+            detail?: unknown;
+            message?: string;
+          } | null;
+          if (errorData) {
+            if ("detail" in errorData && errorData.detail) {
+              errorMessage =
+                typeof errorData.detail === "string"
+                  ? errorData.detail
+                  : JSON.stringify(errorData.detail, null, 2);
+            } else if ("message" in errorData && errorData.message) {
+              errorMessage = errorData.message;
+            }
+          }
+        } catch {
+          // If response is not JSON, try to get text
+          try {
+            const errorText = await response.text();
+            if (errorText) {
+              errorMessage = errorText;
+            }
+          } catch {
+            // Ignore parsing errors
+          }
+        }
+
+        throw new Error(errorMessage);
+      }
+
+      // Parse JSON response
+      const contentType = response.headers.get("Content-Type") || "";
+      if (!contentType.includes("application/json")) {
+        const textResponse = await response.text();
+        throw new Error(
+          `Expected JSON response, got ${contentType}: ${textResponse}`
+        );
+      }
+
+      const data = (await response.json()) as ApiResponse<T> | T;
+
+      // Handle wrapped API responses (code, status, detail format)
+      if (
+        typeof data === "object" &&
+        data !== null &&
+        "code" in data &&
+        "status" in data &&
+        "detail" in data
+      ) {
+        const apiResponse = data as ApiResponse<T>;
+        return apiResponse.detail as T;
+      }
+
+      return data as T;
+    } catch (error) {
+      if (error instanceof Error) {
+        throw error;
+      }
+      throw new Error(`Unknown error occurred: ${String(error)}`);
+    }
+  }
+
+  return {
+    /**
+     * Get form data (privacy center)
+     */
+    async getFormData(
+      baseRequest: BaseRequest,
+      contact: string,
+      authToken?: string,
+      options?: ApiFetchOptions & { useSessionAuth?: boolean },
+      language?: string
+    ): Promise<unknown> {
+      const queryParams = new URLSearchParams();
+      if (language) queryParams.append("language", language);
+      const queryString = queryParams.toString();
+      const url = `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/form/data${queryString ? `?${queryString}` : ""}`;
+      const { useSessionAuth = false, getAuthToken, ...fetchOptions } = options || {};
+
+      // Case management uses session-based auth (X-Auth-Token)
+      // Privacy center uses JWT Bearer tokens (Authorization: Bearer)
+      if (useSessionAuth) {
+        return apiFetch(url, {
+          ...fetchOptions,
+          method: "POST",
+          body: JSON.stringify({ contact }),
+          getAuthToken,
+        });
+      }
+
+      // Privacy center: use JWT Bearer token
+      return privacyCenterApiFetch(url, {
+        ...fetchOptions,
+        method: "POST",
+        body: JSON.stringify({ contact }),
+        authToken: authToken || baseRequest.authToken,
+      });
+    },
+
+    /**
+     * Create case request (privacy center or case management)
+     */
+    async createCaseRequest(
+      baseRequest: BaseRequest,
+      payload: unknown,
+      authToken?: string,
+      options?: ApiFetchOptions & { useSessionAuth?: boolean }
+    ): Promise<unknown> {
+      const url = `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/case`;
+      const { useSessionAuth = false, getAuthToken, ...fetchOptions } = options || {};
+
+      // Case management uses session-based auth (X-Auth-Token)
+      // Privacy center uses JWT Bearer tokens (Authorization: Bearer)
+      if (useSessionAuth) {
+        return apiFetch(url, {
+          ...fetchOptions,
+          method: "POST",
+          body: JSON.stringify(payload),
+          getAuthToken,
+        });
+      }
+
+      // Privacy center: use JWT Bearer token
+      return privacyCenterApiFetch(url, {
+        ...fetchOptions,
+        method: "POST",
+        body: JSON.stringify(payload),
+        authToken: authToken || baseRequest.authToken,
+      });
+    },
+
+    /**
+     * Create OTP (public)
+     */
+    async createOtp(
+      organisationId: string,
+      workspaceId: string,
+      email: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<unknown> {
+      const url = `${baseUrl}/public/organisations/${organisationId}/workspaces/${workspaceId}/otp/create`;
+      return apiFetch(url, {
+        ...options,
+        method: "POST",
+        body: JSON.stringify({ to: email, channel: "email" }),
+      });
+    },
+
+    /**
+     * Verify OTP (public)
+     */
+    async verifyOtp(
+      organisationId: string,
+      workspaceId: string,
+      otpId: string,
+      otp: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<unknown> {
+      const url = `${baseUrl}/public/organisations/${organisationId}/workspaces/${workspaceId}/otp/verify`;
+      return apiFetch(url, {
+        ...options,
+        method: "POST",
+        body: JSON.stringify({ uuid: otpId, otp }),
+      });
+    },
+
+    /**
+     * Exchange one-time token for JWT tokens (public)
+     */
+    async exchangeToken(
+      token: string,
+    ): Promise<unknown> {
+      const url = `${baseUrl}/public/tokens/token-exchange?token=${encodeURIComponent(token)}`;
+      const response = await fetch(url, {
+        method: "GET",
+        headers: { "Accept": "application/json" },
+      });
+
+      if (!response.ok) {
+        const errorData = await response.json().catch(() => null) as { detail?: string; message?: string } | null;
+        throw new Error(
+          errorData?.detail || errorData?.message || `Token exchange failed with status ${response.status}`
+        );
+      }
+
+      const data = await response.json() as { code?: number; status?: string; detail?: unknown };
+      if (data && typeof data === "object" && "code" in data && "status" in data && "detail" in data) {
+        return data.detail;
+      }
+      return data;
+    },
+
+    /**
+     * Refresh OTP token (public)
+     */
+    async refreshOtpToken(
+      organisationId: string,
+      workspaceId: string,
+      refreshToken: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<unknown> {
+      const url = `${baseUrl}/public/organisations/${organisationId}/workspaces/${workspaceId}/otp/refresh`;
+      return apiFetch(url, {
+        ...options,
+        method: "POST",
+        body: JSON.stringify({ refresh_token: refreshToken }),
+      });
+    },
+
+    /**
+     * Get products
+     */
+    async getProducts(
+      baseRequest: BaseRequest,
+      skip: number = 0,
+      limit: number = 10,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<unknown> {
+      const url = `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/notice-management/products/?skip=${skip}&limit=${limit}`;
+      return apiFetch<unknown>(url, {
+        ...options,
+        getAuthToken: async () => baseRequest.authToken,
+      });
+    },
+
+    /**
+     * Get user consents (privacy center)
+     */
+    async getUserConsents(
+      baseRequest: BaseRequest,
+      contact: string,
+      offset?: number,
+      limit?: number,
+      search?: string,
+      status?: string,
+      product_uuid?: string,
+      language?: string,
+      authToken?: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<unknown> {
+      const queryParams = new URLSearchParams();
+      if (offset !== undefined) queryParams.append("offset", offset.toString());
+      if (limit !== undefined) queryParams.append("limit", limit.toString());
+      if (search) queryParams.append("search", search);
+      if (status) queryParams.append("status", status);
+      if (product_uuid) queryParams.append("product_uuid", product_uuid);
+      if (language) queryParams.append("language", language);
+      const queryString = queryParams.toString();
+      const url = `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/user-consents${queryString ? `?${queryString}` : ""}`;
+      return privacyCenterApiFetch(url, {
+        ...options,
+        method: "POST",
+        body: JSON.stringify({ contact }),
+        authToken: authToken || baseRequest.authToken,
+      });
+    },
+
+    /**
+     * Manage consent (privacy center) - revoke, regrant, or renew
+     */
+    async manageConsent(
+      baseRequest: BaseRequest,
+      purposeId: string,
+      contact: string,
+      status: 'revoke' | 'regrant' | 'renew',
+      authToken?: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">,
+      nominatorContact?: string,
+      dataElementUuids?: string[]
+    ): Promise<unknown> {
+      const url = `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/manage-consent?status=${status}`;
+      const body: Record<string, unknown> = { purpose_uuid: purposeId, contact };
+      if (nominatorContact) {
+        body.nominator_contact = nominatorContact;
+      }
+      if (Array.isArray(dataElementUuids) && dataElementUuids.length > 0) {
+        body.data_element_uuids = dataElementUuids;
+      }
+      return privacyCenterApiFetch(url, {
+        ...options,
+        method: "POST",
+        body: JSON.stringify(body),
+        authToken: authToken || baseRequest.authToken,
+      });
+    },
+
+    /**
+     * Get activities (privacy center)
+     */
+    async getActivities(
+      baseRequest: BaseRequest,
+      offset?: number,
+      limit?: number,
+      language?: string,
+      authToken?: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<unknown> {
+      const queryParams = new URLSearchParams();
+      if (offset !== undefined) queryParams.append("offset", offset.toString());
+      if (limit !== undefined) queryParams.append("limit", limit.toString());
+      if (language) queryParams.append("language", language);
+      const queryString = queryParams.toString();
+      const url = `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/activities${queryString ? `?${queryString}` : ""}`;
+      return privacyCenterApiFetch<unknown>(url, {
+        ...options,
+        authToken: authToken || baseRequest.authToken,
+      });
+    },
+
+    /**
+     * Get case history (privacy center)
+     */
+    async getCaseHistory(
+      baseRequest: BaseRequest,
+      contact: string,
+      offset?: number,
+      limit?: number,
+      language?: string,
+      authToken?: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<unknown> {
+      const queryParams = new URLSearchParams();
+      if (offset !== undefined) queryParams.append("offset", offset.toString());
+      if (limit !== undefined) queryParams.append("limit", limit.toString());
+      if (language) queryParams.append("language", language);
+      const queryString = queryParams.toString();
+      const url = `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center/cases?${queryString}`;
+      return privacyCenterApiFetch<unknown>(url, {
+        ...options,
+        authToken: authToken || baseRequest.authToken,
+      });
+    },
+  };
+}

package/src/RedactoPrivacyCenter/api/config.ts

@@ -0,0 +1,33 @@
+/**
+ * Client-side configuration for backend service URLs.
+ * consent.baseUrl is set via BaseUrlProvider context.
+ */
+let baseUrl: string | undefined = undefined;
+
+export const config = {
+  consent: {
+    get baseUrl() {
+      return baseUrl;
+    },
+  },
+} as const;
+
+/**
+ * Sets the base URL from the context provider.
+ * This should be called by BaseUrlProvider when it mounts.
+ */
+export function setUserBaseUrl(url: string): void {
+  baseUrl = url;
+}
+
+/**
+ * Validates that required base URL is set.
+ * Throws an error if base URL is missing.
+ */
+export function validateConfig(): void {
+  if (!config.consent.baseUrl) {
+    throw new Error(
+      "Base URL is not defined. Ensure BaseUrlProvider is set up correctly."
+    );
+  }
+}

package/src/RedactoPrivacyCenter/api/fetcher.ts

@@ -0,0 +1,181 @@
+/**
+ * Options for apiFetch function
+ */
+export type ApiFetchOptions = RequestInit & {
+  /**
+   * Auth token getter function
+   */
+  getAuthToken?: () => Promise<string | null>;
+};
+
+/**
+ * Standard API response wrapper
+ */
+export type ApiResponse<T> = {
+  code: number;
+  status: string;
+  detail: T;
+};
+
+/**
+ * Unified fetch wrapper for client-side API calls.
+ * Provides typed responses and automatic error handling.
+ *
+ * @param url - The URL to fetch
+ * @param options - Fetch options including auth token getter
+ * @returns Typed response data
+ * @throws Error if the request fails
+ */
+export async function apiFetch<T>(
+  url: string,
+  options: ApiFetchOptions = {}
+): Promise<T> {
+  const { getAuthToken, headers = {}, ...fetchOptions } = options;
+
+  // Build headers using Headers object for better compatibility
+  const requestHeaders = new Headers();
+
+  // Set default headers (skip Content-Type for FormData - browser will set it with boundary)
+  const isFormData = fetchOptions.body instanceof FormData;
+  if (!isFormData) {
+    requestHeaders.set("Content-Type", "application/json");
+  }
+  requestHeaders.set("Accept", "application/json");
+
+  // Add custom headers from options
+  if (headers && typeof headers === "object") {
+    if (headers instanceof Headers) {
+      headers.forEach((value, key) => {
+        requestHeaders.set(key, value);
+      });
+    } else {
+      Object.entries(headers as Record<string, string>).forEach(
+        ([key, value]) => {
+          if (value) {
+            requestHeaders.set(key, value);
+          }
+        }
+      );
+    }
+  }
+
+  // Add auth token AFTER custom headers to ensure it's never overridden
+  if (getAuthToken) {
+    const token = await getAuthToken();
+    if (token) {
+      // Use the exact header format that works in other parts of the codebase
+      // Other working API calls use 'X-Auth-Token' (capital A and T, rest lowercase)
+      const trimmedToken = token.trim();
+      requestHeaders.set("X-Auth-Token", trimmedToken);
+      // Also set lowercase for compatibility (some servers are case-sensitive)
+      requestHeaders.set("x-auth-token", trimmedToken);
+    }
+  }
+
+  // Build fetch options
+  const fetchOptionsFinal: RequestInit = {
+    ...fetchOptions,
+    headers: requestHeaders,
+  };
+
+  try {
+    const response = await fetch(url, fetchOptionsFinal);
+
+    // Handle non-OK responses
+    if (!response.ok) {
+      let errorMessage = `Request failed with status ${response.status}`;
+
+      try {
+        const errorData = (await response.json()) as {
+          detail?: unknown;
+          message?: string;
+        } | null;
+        if (errorData) {
+          if ("detail" in errorData && errorData.detail) {
+            errorMessage =
+              typeof errorData.detail === "string"
+                ? errorData.detail
+                : JSON.stringify(errorData.detail, null, 2);
+          } else if ("message" in errorData && errorData.message) {
+            errorMessage = errorData.message;
+          }
+        }
+      } catch {
+        // If response is not JSON, try to get text
+        try {
+          const errorText = await response.text();
+          if (errorText) {
+            errorMessage = errorText;
+          }
+        } catch {
+          // Ignore parsing errors
+        }
+      }
+
+      throw new Error(errorMessage);
+    }
+
+    // Handle empty responses (common for DELETE requests with 204 No Content)
+    const contentLength = response.headers.get("Content-Length");
+    const contentType = response.headers.get("Content-Type") || "";
+    
+    // If content length is 0, return undefined for void types
+    if (contentLength === "0") {
+      return undefined as T;
+    }
+
+    // Read response text once (we can't read it twice)
+    let text: string;
+    try {
+      text = await response.text();
+    } catch (error) {
+      // If reading fails, assume empty response is acceptable for void return types
+      return undefined as T;
+    }
+    
+    // If response is empty, return undefined for void types
+    if (!text || text.trim() === "") {
+      return undefined as T;
+    }
+
+    // Parse JSON response
+    if (contentType && !contentType.includes("application/json")) {
+      throw new Error(
+        `Expected JSON response, got ${contentType}: ${text.substring(0, 100)}`
+      );
+    }
+
+    let data: ApiResponse<T> | T;
+    try {
+      data = JSON.parse(text) as ApiResponse<T> | T;
+    } catch (parseError) {
+      // If JSON parsing fails, check if it's just whitespace or "null"
+      if (text.trim() === "" || text.trim() === "null") {
+        return undefined as T;
+      }
+      // Otherwise, throw the parsing error
+      throw new Error(
+        `Failed to parse JSON response: ${parseError instanceof Error ? parseError.message : String(parseError)}. Response: ${text.substring(0, 200)}`
+      );
+    }
+
+    // Handle wrapped API responses (code, status, detail format)
+    if (
+      typeof data === "object" &&
+      data !== null &&
+      "code" in data &&
+      "status" in data &&
+      "detail" in data
+    ) {
+      const apiResponse = data as ApiResponse<T>;
+      return apiResponse.detail as T;
+    }
+
+    return data as T;
+  } catch (error) {
+    if (error instanceof Error) {
+      throw error;
+    }
+    throw new Error(`Unknown error occurred: ${String(error)}`);
+  }
+}