@redacto.io/consent-sdk-react 4.0.0 → 5.0.0

package/src/RedactoPrivacyCenter/api/client.ts

@@ -0,0 +1,524 @@
+import { apiFetch } from "./fetcher";
+import type { ApiFetchOptions, ApiResponse } from "./fetcher";
+import type {
+  CaseMessage,
+  MessageDocument,
+  UploadDocumentResponse,
+} from "../lib/types";
+
+/**
+ * Base request parameters for consent service calls
+ */
+export type BaseRequest = {
+  organisationUuid: string;
+  workspaceUuid: string;
+  authToken: string;
+};
+
+/**
+ * Consent service client factory.
+ * Creates a client instance with a specific base URL.
+ * @param baseUrl - Consent server base URL
+ */
+export function createConsentClient(baseUrl: string) {
+  /**
+   * Privacy Center API fetch wrapper that uses Authorization: Bearer header.
+   * Privacy center endpoints require JWT tokens in Authorization header, not X-Auth-Token.
+   */
+  async function privacyCenterApiFetch<T>(
+    url: string,
+    options: ApiFetchOptions & { authToken?: string }
+  ): Promise<T> {
+    const { authToken, getAuthToken, headers = {}, ...fetchOptions } = options;
+
+    // Build headers using Headers object
+    const requestHeaders = new Headers();
+
+    // Set default headers (skip Content-Type for FormData)
+    const isFormData = fetchOptions.body instanceof FormData;
+    if (!isFormData) {
+      requestHeaders.set("Content-Type", "application/json");
+    }
+    requestHeaders.set("Accept", "application/json");
+
+    // Add custom headers from options
+    if (headers && typeof headers === "object") {
+      if (headers instanceof Headers) {
+        headers.forEach((value, key) => {
+          requestHeaders.set(key, value);
+        });
+      } else {
+        Object.entries(headers as Record<string, string>).forEach(
+          ([key, value]) => {
+            if (value) {
+              requestHeaders.set(key, value);
+            }
+          }
+        );
+      }
+    }
+
+    // Add Authorization Bearer token for privacy center APIs
+    const token = authToken || (getAuthToken ? await getAuthToken() : null);
+    if (token) {
+      const trimmedToken = token.trim();
+      // Format token with Bearer prefix if not already present
+      const bearerToken = trimmedToken.startsWith('Bearer ')
+        ? trimmedToken
+        : `Bearer ${trimmedToken}`;
+      requestHeaders.set("Authorization", bearerToken);
+    }
+
+    // Build fetch options
+    const fetchOptionsFinal: RequestInit = {
+      ...fetchOptions,
+      headers: requestHeaders,
+    };
+
+    try {
+      const response = await fetch(url, fetchOptionsFinal);
+
+      // Handle non-OK responses
+      if (!response.ok) {
+        let errorMessage = `Request failed with status ${response.status}`;
+
+        try {
+          const errorData = (await response.json()) as {
+            detail?: unknown;
+            message?: string;
+            code?: string;
+          } | null;
+          if (errorData) {
+            if ("detail" in errorData && errorData.detail) {
+              errorMessage =
+                typeof errorData.detail === "string"
+                  ? errorData.detail
+                  : JSON.stringify(errorData.detail, null, 2);
+            } else if ("message" in errorData && errorData.message) {
+              errorMessage = errorData.message;
+            } else if ("code" in errorData && errorData.code) {
+              // e.g. { code: "empty_file" } or { code: "document_already_exists" }
+              errorMessage = errorData.code;
+            }
+          }
+        } catch {
+          // If response is not JSON, try to get text
+          try {
+            const errorText = await response.text();
+            if (errorText) {
+              errorMessage = errorText;
+            }
+          } catch {
+            // Ignore parsing errors
+          }
+        }
+
+        // Prepend HTTP status so callers can branch on it without losing context
+        throw new Error(`[${response.status}] ${errorMessage}`);
+      }
+
+      // Parse JSON response
+      const contentType = response.headers.get("Content-Type") || "";
+      if (!contentType.includes("application/json")) {
+        const textResponse = await response.text();
+        throw new Error(
+          `Expected JSON response, got ${contentType}: ${textResponse}`
+        );
+      }
+
+      const data = (await response.json()) as ApiResponse<T> | T;
+
+      // Handle wrapped API responses (code, status, detail format)
+      if (
+        typeof data === "object" &&
+        data !== null &&
+        "code" in data &&
+        "status" in data &&
+        "detail" in data
+      ) {
+        const apiResponse = data as ApiResponse<T>;
+        return apiResponse.detail as T;
+      }
+
+      return data as T;
+    } catch (error) {
+      if (error instanceof Error) {
+        throw error;
+      }
+      throw new Error(`Unknown error occurred: ${String(error)}`);
+    }
+  }
+
+  function privacyCenterUrl(baseRequest: BaseRequest, path: string): string {
+    return `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center${path}`;
+  }
+
+  function caseUrl(baseRequest: BaseRequest, caseUuid: string, path = ''): string {
+    return privacyCenterUrl(baseRequest, `/cases/${caseUuid}${path}`);
+  }
+
+  function resolveAuthToken(authToken: string | undefined, baseRequest: BaseRequest): string {
+    return authToken || baseRequest.authToken;
+  }
+
+  return {
+    /**
+     * Get form data (privacy center)
+     */
+    async getFormData(
+      baseRequest: BaseRequest,
+      contact: string,
+      authToken?: string,
+      options?: ApiFetchOptions & { useSessionAuth?: boolean },
+      language?: string
+    ): Promise<unknown> {
+      const queryParams = new URLSearchParams();
+      if (language) queryParams.append("language", language);
+      const queryString = queryParams.toString();
+      const url = privacyCenterUrl(baseRequest, `/form/data${queryString ? `?${queryString}` : ""}`);
+      const { useSessionAuth = false, getAuthToken, ...fetchOptions } = options || {};
+
+      // Case management uses session-based auth (X-Auth-Token)
+      // Privacy center uses JWT Bearer tokens (Authorization: Bearer)
+      if (useSessionAuth) {
+        return apiFetch(url, {
+          ...fetchOptions,
+          method: "POST",
+          body: JSON.stringify({ contact }),
+          getAuthToken,
+        });
+      }
+
+      // Privacy center: use JWT Bearer token
+      return privacyCenterApiFetch(url, {
+        ...fetchOptions,
+        method: "POST",
+        body: JSON.stringify({ contact }),
+        authToken: resolveAuthToken(authToken, baseRequest),
+      });
+    },
+
+    /**
+     * Create case request (privacy center or case management)
+     */
+    async createCaseRequest(
+      baseRequest: BaseRequest,
+      payload: unknown,
+      authToken?: string,
+      options?: ApiFetchOptions & { useSessionAuth?: boolean }
+    ): Promise<unknown> {
+      const url = privacyCenterUrl(baseRequest, '/case');
+      const { useSessionAuth = false, getAuthToken, ...fetchOptions } = options || {};
+
+      // Case management uses session-based auth (X-Auth-Token)
+      // Privacy center uses JWT Bearer tokens (Authorization: Bearer)
+      if (useSessionAuth) {
+        return apiFetch(url, {
+          ...fetchOptions,
+          method: "POST",
+          body: JSON.stringify(payload),
+          getAuthToken,
+        });
+      }
+
+      // Privacy center: use JWT Bearer token
+      return privacyCenterApiFetch(url, {
+        ...fetchOptions,
+        method: "POST",
+        body: JSON.stringify(payload),
+        authToken: resolveAuthToken(authToken, baseRequest),
+      });
+    },
+
+    /**
+     * Create OTP (public)
+     */
+    async createOtp(
+      organisationId: string,
+      workspaceId: string,
+      email: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<unknown> {
+      const url = `${baseUrl}/public/organisations/${organisationId}/workspaces/${workspaceId}/otp/create`;
+      return apiFetch(url, {
+        ...options,
+        method: "POST",
+        body: JSON.stringify({ to: email, channel: "email" }),
+      });
+    },
+
+    /**
+     * Verify OTP (public)
+     */
+    async verifyOtp(
+      organisationId: string,
+      workspaceId: string,
+      otpId: string,
+      otp: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<unknown> {
+      const url = `${baseUrl}/public/organisations/${organisationId}/workspaces/${workspaceId}/otp/verify`;
+      return apiFetch(url, {
+        ...options,
+        method: "POST",
+        body: JSON.stringify({ uuid: otpId, otp }),
+      });
+    },
+
+    /**
+     * Exchange one-time token for JWT tokens (public)
+     */
+    async exchangeToken(
+      token: string,
+    ): Promise<unknown> {
+      const url = `${baseUrl}/public/tokens/token-exchange?token=${encodeURIComponent(token)}`;
+      const response = await fetch(url, {
+        method: "GET",
+        headers: { "Accept": "application/json" },
+      });
+
+      if (!response.ok) {
+        const errorData = await response.json().catch(() => null) as { detail?: string; message?: string } | null;
+        throw new Error(
+          errorData?.detail || errorData?.message || `Token exchange failed with status ${response.status}`
+        );
+      }
+
+      const data = await response.json() as { code?: number; status?: string; detail?: unknown };
+      if (data && typeof data === "object" && "code" in data && "status" in data && "detail" in data) {
+        return data.detail;
+      }
+      return data;
+    },
+
+    /**
+     * Refresh OTP token (public)
+     */
+    async refreshOtpToken(
+      organisationId: string,
+      workspaceId: string,
+      refreshToken: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<unknown> {
+      const url = `${baseUrl}/public/organisations/${organisationId}/workspaces/${workspaceId}/otp/refresh`;
+      return apiFetch(url, {
+        ...options,
+        method: "POST",
+        body: JSON.stringify({ refresh_token: refreshToken }),
+      });
+    },
+
+    /**
+     * Get products
+     */
+    async getProducts(
+      baseRequest: BaseRequest,
+      skip: number = 0,
+      limit: number = 10,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<unknown> {
+      const url = `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/notice-management/products/?skip=${skip}&limit=${limit}`;
+      return apiFetch<unknown>(url, {
+        ...options,
+        getAuthToken: async () => baseRequest.authToken,
+      });
+    },
+
+    /**
+     * Get user consents (privacy center)
+     */
+    async getUserConsents(
+      baseRequest: BaseRequest,
+      contact: string,
+      offset?: number,
+      limit?: number,
+      search?: string,
+      status?: string,
+      product_uuid?: string,
+      language?: string,
+      authToken?: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<unknown> {
+      const queryParams = new URLSearchParams();
+      if (offset !== undefined) queryParams.append("offset", offset.toString());
+      if (limit !== undefined) queryParams.append("limit", limit.toString());
+      if (search) queryParams.append("search", search);
+      if (status) queryParams.append("status", status);
+      if (product_uuid) queryParams.append("product_uuid", product_uuid);
+      if (language) queryParams.append("language", language);
+      const queryString = queryParams.toString();
+      const url = privacyCenterUrl(baseRequest, `/user-consents${queryString ? `?${queryString}` : ""}`);
+      return privacyCenterApiFetch(url, {
+        ...options,
+        method: "POST",
+        body: JSON.stringify({ contact }),
+        authToken: resolveAuthToken(authToken, baseRequest),
+      });
+    },
+
+    /**
+     * Manage consent (privacy center) - revoke, regrant, or renew
+     */
+    async manageConsent(
+      baseRequest: BaseRequest,
+      purposeId: string,
+      contact: string,
+      status: 'revoke' | 'regrant' | 'renew',
+      authToken?: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">,
+      nominatorContact?: string,
+      dataElementUuids?: string[]
+    ): Promise<unknown> {
+      const url = privacyCenterUrl(baseRequest, `/manage-consent?status=${status}`);
+      const body: Record<string, unknown> = { purpose_uuid: purposeId, contact };
+      if (nominatorContact) {
+        body.nominator_contact = nominatorContact;
+      }
+      if (Array.isArray(dataElementUuids) && dataElementUuids.length > 0) {
+        body.data_element_uuids = dataElementUuids;
+      }
+      return privacyCenterApiFetch(url, {
+        ...options,
+        method: "POST",
+        body: JSON.stringify(body),
+        authToken: resolveAuthToken(authToken, baseRequest),
+      });
+    },
+
+    /**
+     * Get activities (privacy center)
+     */
+    async getActivities(
+      baseRequest: BaseRequest,
+      offset?: number,
+      limit?: number,
+      language?: string,
+      authToken?: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<unknown> {
+      const queryParams = new URLSearchParams();
+      if (offset !== undefined) queryParams.append("offset", offset.toString());
+      if (limit !== undefined) queryParams.append("limit", limit.toString());
+      if (language) queryParams.append("language", language);
+      const queryString = queryParams.toString();
+      const url = privacyCenterUrl(baseRequest, `/activities${queryString ? `?${queryString}` : ""}`);
+      return privacyCenterApiFetch<unknown>(url, {
+        ...options,
+        authToken: resolveAuthToken(authToken, baseRequest),
+      });
+    },
+
+    /**
+     * Get case history (privacy center)
+     */
+    async getCaseHistory(
+      baseRequest: BaseRequest,
+      _contact: string,
+      offset?: number,
+      limit?: number,
+      language?: string,
+      authToken?: string,
+      options?: Omit<ApiFetchOptions, "getAuthToken">
+    ): Promise<unknown> {
+      const queryParams = new URLSearchParams();
+      if (offset !== undefined) queryParams.append("offset", offset.toString());
+      if (limit !== undefined) queryParams.append("limit", limit.toString());
+      if (language) queryParams.append("language", language);
+      const queryString = queryParams.toString();
+      const url = privacyCenterUrl(baseRequest, `/cases?${queryString}`);
+      return privacyCenterApiFetch<unknown>(url, {
+        ...options,
+        authToken: resolveAuthToken(authToken, baseRequest),
+      });
+    },
+
+    // ─── Case Communication ─────────────────────────────────────────────────
+
+    /**
+     * Get messages for a case (privacy center)
+     */
+    async getCaseMessages(
+      baseRequest: BaseRequest,
+      caseUuid: string,
+      authToken?: string
+    ): Promise<CaseMessage[]> {
+      const url = caseUrl(baseRequest, caseUuid, '/messages');
+      return privacyCenterApiFetch<CaseMessage[]>(url, {
+        authToken: resolveAuthToken(authToken, baseRequest),
+      });
+    },
+
+    /**
+     * Send a message on a case (privacy center)
+     */
+    async sendCaseMessage(
+      baseRequest: BaseRequest,
+      caseUuid: string,
+      body: string,
+      documentUuids: string[],
+      authToken?: string
+    ): Promise<CaseMessage> {
+      const url = caseUrl(baseRequest, caseUuid, '/messages');
+      return privacyCenterApiFetch<CaseMessage>(url, {
+        method: 'POST',
+        body: JSON.stringify({ body, document_uuids: documentUuids }),
+        authToken: resolveAuthToken(authToken, baseRequest),
+      });
+    },
+
+    /**
+     * Upload a document on a case (multipart/form-data, privacy center)
+     */
+    async uploadCaseDocument(
+      baseRequest: BaseRequest,
+      caseUuid: string,
+      file: File,
+      authToken?: string
+    ): Promise<UploadDocumentResponse> {
+      const url = caseUrl(baseRequest, caseUuid, '/upload-document');
+      const formData = new FormData();
+      formData.append('file', file, file.name); // field name must be exactly "file"
+      // "payload" is required by the privacy-center endpoint (omitting it causes 422)
+      formData.append('payload', JSON.stringify({ metadata: null }));
+      return privacyCenterApiFetch<UploadDocumentResponse>(url, {
+        method: 'POST',
+        body: formData,
+        authToken: resolveAuthToken(authToken, baseRequest),
+      });
+    },
+
+    /**
+     * Submit a document against a handler document request (privacy center)
+     */
+    async submitDocumentForRequest(
+      baseRequest: BaseRequest,
+      caseUuid: string,
+      requestEventUuid: string,
+      documentUuid: string,
+      body: string,
+      authToken?: string
+    ): Promise<CaseMessage> {
+      const url = caseUrl(baseRequest, caseUuid, `/document-requests/${requestEventUuid}/submit`);
+      return privacyCenterApiFetch<CaseMessage>(url, {
+        method: 'POST',
+        body: JSON.stringify({ document_uuid: documentUuid, body }),
+        authToken: resolveAuthToken(authToken, baseRequest),
+      });
+    },
+
+    /**
+     * Get document info/download URL for a case document (privacy center)
+     */
+    async getCaseDocument(
+      baseRequest: BaseRequest,
+      caseUuid: string,
+      documentUuid: string,
+      authToken?: string
+    ): Promise<MessageDocument> {
+      const url = caseUrl(baseRequest, caseUuid, `/documents/${documentUuid}`);
+      return privacyCenterApiFetch<MessageDocument>(url, {
+        authToken: resolveAuthToken(authToken, baseRequest),
+      });
+    },
+  };
+}

package/src/RedactoPrivacyCenter/api/config.ts

@@ -0,0 +1,33 @@
+/**
+ * Client-side configuration for backend service URLs.
+ * consent.baseUrl is set via BaseUrlProvider context.
+ */
+let baseUrl: string | undefined = undefined;
+
+export const config = {
+  consent: {
+    get baseUrl() {
+      return baseUrl;
+    },
+  },
+} as const;
+
+/**
+ * Sets the base URL from the context provider.
+ * This should be called by BaseUrlProvider when it mounts.
+ */
+export function setUserBaseUrl(url: string): void {
+  baseUrl = url;
+}
+
+/**
+ * Validates that required base URL is set.
+ * Throws an error if base URL is missing.
+ */
+export function validateConfig(): void {
+  if (!config.consent.baseUrl) {
+    throw new Error(
+      "Base URL is not defined. Ensure BaseUrlProvider is set up correctly."
+    );
+  }
+}