@redacto.io/consent-sdk-react 9.2.0-beta.1 → 9.2.0

package/src/RedactoPrivacyCenter/locales/mr/translation.json

@@ -314,8 +314,8 @@
   "selectProductsForRequestGeneric": "Select one or more products to continue",
   "yourData": "Your data",
   "actingOnBehalfOf": "Acting on behalf of {{nominator}}",
-  "activePurposes_one": "{{count}} active purpose",
-  "activePurposes_other": "{{count}} active purposes",
+  "activePurposes_one": "{{count}} उद्देश",
+  "activePurposes_other": "{{count}} उद्देश",
   "autoSelected": "Auto-selected",
   "noProductsAvailable": "No products available",
   "noProductsAvailableDescription": "You have no consents to manage yet.",

package/src/RedactoPrivacyCenter/locales/ne/translation.json

@@ -314,8 +314,8 @@
   "selectProductsForRequestGeneric": "Select one or more products to continue",
   "yourData": "Your data",
   "actingOnBehalfOf": "Acting on behalf of {{nominator}}",
-  "activePurposes_one": "{{count}} active purpose",
-  "activePurposes_other": "{{count}} active purposes",
+  "activePurposes_one": "{{count}} उद्देश्य",
+  "activePurposes_other": "{{count}} उद्देश्य",
   "autoSelected": "Auto-selected",
   "noProductsAvailable": "No products available",
   "noProductsAvailableDescription": "You have no consents to manage yet.",

package/src/RedactoPrivacyCenter/locales/or/translation.json

@@ -314,8 +314,8 @@
   "selectProductsForRequestGeneric": "Select one or more products to continue",
   "yourData": "Your data",
   "actingOnBehalfOf": "Acting on behalf of {{nominator}}",
-  "activePurposes_one": "{{count}} active purpose",
-  "activePurposes_other": "{{count}} active purposes",
+  "activePurposes_one": "{{count}} ଉଦ୍ଦେଶ୍ୟ",
+  "activePurposes_other": "{{count}} ଉଦ୍ଦେଶ୍ୟଗୁଡ଼ିକ",
   "autoSelected": "Auto-selected",
   "noProductsAvailable": "No products available",
   "noProductsAvailableDescription": "You have no consents to manage yet.",

package/src/RedactoPrivacyCenter/locales/pa/translation.json

@@ -314,8 +314,8 @@
   "selectProductsForRequestGeneric": "Select one or more products to continue",
   "yourData": "Your data",
   "actingOnBehalfOf": "Acting on behalf of {{nominator}}",
-  "activePurposes_one": "{{count}} active purpose",
-  "activePurposes_other": "{{count}} active purposes",
+  "activePurposes_one": "{{count}} ਮਕਸਦ",
+  "activePurposes_other": "{{count}} ਮਕਸਦ",
   "autoSelected": "Auto-selected",
   "noProductsAvailable": "No products available",
   "noProductsAvailableDescription": "You have no consents to manage yet.",

package/src/RedactoPrivacyCenter/locales/sa/translation.json

@@ -314,8 +314,8 @@
   "selectProductsForRequestGeneric": "Select one or more products to continue",
   "yourData": "Your data",
   "actingOnBehalfOf": "Acting on behalf of {{nominator}}",
-  "activePurposes_one": "{{count}} active purpose",
-  "activePurposes_other": "{{count}} active purposes",
+  "activePurposes_one": "{{count}} प्रयोजनम्",
+  "activePurposes_other": "{{count}} प्रयोजनानि",
   "autoSelected": "Auto-selected",
   "noProductsAvailable": "No products available",
   "noProductsAvailableDescription": "You have no consents to manage yet.",

package/src/RedactoPrivacyCenter/locales/sat/translation.json

@@ -314,8 +314,8 @@
   "selectProductsForRequestGeneric": "Select one or more products to continue",
   "yourData": "Your data",
   "actingOnBehalfOf": "Acting on behalf of {{nominator}}",
-  "activePurposes_one": "{{count}} active purpose",
-  "activePurposes_other": "{{count}} active purposes",
+  "activePurposes_one": "{{count}} ᱯᱷᱮᱰᱟᱛ",
+  "activePurposes_other": "{{count}} ᱯᱷᱮᱰᱟᱛ",
   "autoSelected": "Auto-selected",
   "noProductsAvailable": "No products available",
   "noProductsAvailableDescription": "You have no consents to manage yet.",

package/src/RedactoPrivacyCenter/locales/sd/translation.json

@@ -314,8 +314,8 @@
   "selectProductsForRequestGeneric": "Select one or more products to continue",
   "yourData": "Your data",
   "actingOnBehalfOf": "Acting on behalf of {{nominator}}",
-  "activePurposes_one": "{{count}} active purpose",
-  "activePurposes_other": "{{count}} active purposes",
+  "activePurposes_one": "{{count}} مقصد",
+  "activePurposes_other": "{{count}} مقصد",
   "autoSelected": "Auto-selected",
   "noProductsAvailable": "No products available",
   "noProductsAvailableDescription": "You have no consents to manage yet.",

package/src/RedactoPrivacyCenter/locales/ta/translation.json

@@ -314,8 +314,8 @@
   "selectProductsForRequestGeneric": "Select one or more products to continue",
   "yourData": "Your data",
   "actingOnBehalfOf": "Acting on behalf of {{nominator}}",
-  "activePurposes_one": "{{count}} active purpose",
-  "activePurposes_other": "{{count}} active purposes",
+  "activePurposes_one": "{{count}} நோக்கம்",
+  "activePurposes_other": "{{count}} நோக்கங்கள்",
   "autoSelected": "Auto-selected",
   "noProductsAvailable": "No products available",
   "noProductsAvailableDescription": "You have no consents to manage yet.",

package/src/RedactoPrivacyCenter/locales/te/translation.json

@@ -314,8 +314,8 @@
   "selectProductsForRequestGeneric": "Select one or more products to continue",
   "yourData": "Your data",
   "actingOnBehalfOf": "Acting on behalf of {{nominator}}",
-  "activePurposes_one": "{{count}} active purpose",
-  "activePurposes_other": "{{count}} active purposes",
+  "activePurposes_one": "{{count}} ఉద్దేశ్యం",
+  "activePurposes_other": "{{count}} ఉద్దేశ్యాలు",
   "autoSelected": "Auto-selected",
   "noProductsAvailable": "No products available",
   "noProductsAvailableDescription": "You have no consents to manage yet.",

package/src/RedactoPrivacyCenter/locales/ur/translation.json

@@ -314,8 +314,8 @@
   "selectProductsForRequestGeneric": "Select one or more products to continue",
   "yourData": "Your data",
   "actingOnBehalfOf": "Acting on behalf of {{nominator}}",
-  "activePurposes_one": "{{count}} active purpose",
-  "activePurposes_other": "{{count}} active purposes",
+  "activePurposes_one": "{{count}} مقصد",
+  "activePurposes_other": "{{count}} مقاصد",
   "autoSelected": "Auto-selected",
   "noProductsAvailable": "No products available",
   "noProductsAvailableDescription": "You have no consents to manage yet.",

package/tests/Form.test.tsx

@@ -38,8 +38,8 @@ vi.mock('react-i18next', () => {
     nominationChipSuffix: '· {{nominator}}',
     yourData: 'Your data',
     actingOnBehalfOf: 'Acting on behalf of {{nominator}}',
-    activePurposes_one: '{{count}} active purpose',
-    activePurposes_other: '{{count}} active purposes',
+    activePurposes_one: '{{count}} purpose',
+    activePurposes_other: '{{count}} purposes',
     autoSelected: 'Auto-selected',
     noProductsAvailable: 'No products available',
     noProductsAvailableDescription: 'You have no consents to manage yet.',
@@ -95,16 +95,11 @@ vi.mock('../src/RedactoPrivacyCenter/lib/i18n', () => ({
 }));
 
 // ─── API stubs ───────────────────────────────────────────────────────────────
-// `createCaseRequest` (legacy single-case path) and `createCaseRequestUnsafe`
-// (batch path) are both shipped at runtime. We route them through one
-// shared mock so existing tests can keep using `createCaseRequest.mock...`
-// regardless of which code path the Form picks. Tests that need to assert
-// throw-vs-null semantics override the relevant mock individually.
+// 1-form -> 1-case: only `createCaseRequest` is consumed by Form.tsx now.
 const createCaseRequest = vi.fn();
 const getFormData = vi.fn();
 vi.mock('../src/RedactoPrivacyCenter/lib/api', () => ({
   createCaseRequest: (...args: unknown[]) => createCaseRequest(...args),
-  createCaseRequestUnsafe: (...args: unknown[]) => createCaseRequest(...args),
   getFormData: (...args: unknown[]) => getFormData(...args),
 }));
 
@@ -355,54 +350,45 @@ vi.mock(
 vi.mock(
   '../src/RedactoPrivacyCenter/components/DataRequest/NominationDataSection',
   () => ({
-    default: () => <div data-testid="nomination-section" />,
+    // Test-only stub: exposes an email input that calls the real
+    // `setNominationData` setter, so tests can drive the form to a
+    // valid NOMINATION state and exercise the actual submit path
+    // (not just the "button disabled" gate).
+    default: ({ nominationData, setNominationData }: any) => (
+      <div data-testid="nomination-section">
+        <input
+          data-testid="nominee-email-input"
+          value={nominationData?.nominee_email ?? ''}
+          onChange={(e) =>
+            setNominationData((prev: any) => ({
+              ...prev,
+              nominee_email: e.target.value,
+            }))
+          }
+        />
+      </div>
+    ),
   }),
 );
 vi.mock('../src/RedactoPrivacyCenter/components/RequestSubmit', () => ({
   default: ({
     result,
-    onRetry,
   }: {
     result: {
-      succeeded: Array<{
-        case_id: string;
-        product_uuid: string;
-        product_name: string;
-        group_key: string;
-      }>;
-      failed: Array<{
-        group_key: string;
-        product_uuid: string;
-        product_name: string;
-        error: string;
-      }>;
+      case_id: string;
+      uuid: string;
+      product_uuid: string;
+      product_name: string;
     };
-    onRetry?: (groupKey: string) => void;
   }) => (
     <div data-testid="request-submitted">
-      <ul data-testid="request-submitted-succeeded">
-        {result.succeeded.map((s) => (
-          <li key={`${s.group_key}:${s.case_id}`} data-group-key={s.group_key}>
-            {s.case_id}
-          </li>
-        ))}
-      </ul>
-      <ul data-testid="request-submitted-failed">
-        {result.failed.map((f) => (
-          <li key={f.group_key} data-group-key={f.group_key}>
-            {f.product_name}
-            {onRetry !== undefined && (
-              <button
-                type="button"
-                onClick={() => onRetry(f.group_key)}
-                aria-label={`retry-${f.group_key}`}
-              >
-                Retry
-              </button>
-            )}
-          </li>
-        ))}
-      </ul>
+      <span data-testid="request-submitted-case-id">{result.case_id}</span>
+      <span data-testid="request-submitted-product-uuid">
+        {result.product_uuid}
+      </span>
+      <span data-testid="request-submitted-product-name">
+        {result.product_name}
+      </span>
     </div>
   ),
 }));
@@ -497,40 +483,35 @@ describe('Form (P2-SDK-3)', () => {
     sessionStorage.clear();
   });
 
-  it('falls back to the legacy flat render when direct_groups is undefined', async () => {
+  it('blocks submit for product-scoped types when the DP has no consent groups', async () => {
+    // 1-form -> 1-case -> 1-product means product-scoped request types
+    // (ACCESS/ERASURE/CORRECTION) MUST have a product anchor. When the
+    // DP has zero consent groups (direct + nominated), the picker shows
+    // its empty state and submit must be hard-blocked at the validity
+    // gate so the case can never be created without an anchor.
     setupSession();
-    // Legacy backend shape: no direct_groups field at all.
-    const legacyData = {
-      uuid: 'form-session-uuid',
-      name: 'Jane',
-      contact: 'jane@example.com',
-      grievance_options: [],
-      purposes: [{ purpose: basePurpose('purp-1', 'Marketing') }],
-    } as unknown as FormData;
-    getFormData.mockResolvedValue(legacyData);
-
-    // The Form emits a one-time console.warn when it falls back to the
-    // legacy render so customer developers notice their backend hasn't
-    // shipped Phase 1. Spy on it so we can both silence and assert.
-    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    getFormData.mockResolvedValue(
+      makeFormData({ direct_groups: [], nominated_groups: [] }),
+    );
 
     render(<Form onCreateRequest={vi.fn()} />);
     await waitFor(() => expect(getFormData).toHaveBeenCalled());
 
     pickRequestType(RequestTypeEnum.ERASURE);
 
-    // Legacy purpose row should appear; the grouped header must not.
-    await waitFor(() => {
-      expect(screen.getByText('Marketing')).toBeInTheDocument();
-    });
-    expect(
-      screen.queryByText(/Select a product/i),
-    ).not.toBeInTheDocument();
+    // Confirm checkbox alone is not enough — the validity gate has to
+    // see at least one product selected.
+    const confirmCheckbox = (
+      screen.getAllByRole('checkbox') as HTMLInputElement[]
+    ).find((c) => c.closest('label')?.textContent?.includes('I confirm'));
+    expect(confirmCheckbox).toBeTruthy();
+    fireEvent.click(confirmCheckbox!);
 
-    expect(warnSpy).toHaveBeenCalledWith(
-      expect.stringContaining('Backend response lacks direct_groups'),
-    );
-    warnSpy.mockRestore();
+    const submitButton = screen.getByRole(
+      'button',
+      { name: /^submit$/i },
+    ) as HTMLButtonElement;
+    expect(submitButton.disabled).toBe(true);
   });
 
   it('renders the product step for DSAR types when direct_groups is present', async () => {
@@ -722,7 +703,11 @@ describe('Form (P2-SDK-3)', () => {
     expect('data_principal_uuid' in payload).toBe(false);
     expect(payload.uuid).toBe('form-session-uuid');
     expect(payload.request_type).toBe('erasure');
-    expect(payload.revoke_consent_on_fulfilment).toBe(false);
+    // ERASURE submits must set this flag so the backend's
+    // auto-revoke task fires when the case is fulfilled (DPDPA Sec 12:
+    // erasing data implies revoking the consent that authorized
+    // processing it).
+    expect(payload.revoke_consent_on_fulfilment).toBe(true);
 
     await waitFor(() => {
       expect(screen.getByTestId('request-submitted')).toBeInTheDocument();
@@ -936,97 +921,78 @@ describe('Form (P2-SDK-3)', () => {
     });
   });
 
-  it('falls back to the legacy flat CorrectionDataSection when direct_groups is undefined', async () => {
-    // TECH-3712 (correction grouped path) regression guard: when the
-    // backend hasn't shipped Phase 1 yet (`direct_groups` absent), the
-    // CORRECTION render path must drop back to the legacy flat-data-element
-    // CorrectionDataSection and the submit must produce a single POST
-    // without `product_uuid`.
+  it('submits NOMINATION as an org-level case without product_uuid or data_principal_uuid', async () => {
+    // NOMINATION is org-level — the picker is not rendered and the
+    // payload must omit `product_uuid` (backend rejects it on these
+    // types) AND `data_principal_uuid` (this is a direct grant, not a
+    // nominee acting on someone's behalf). Even when the contact has
+    // consent groups available, NOMINATION must not leak them onto
+    // the case anchor.
     setupSession();
-    const legacyData = {
-      uuid: 'form-session-uuid',
-      name: 'Jane',
-      contact: 'jane@example.com',
-      grievance_options: [],
-      purposes: [
-        {
-          purpose: basePurpose('purp-1', 'Marketing', [
-            baseDataElement('de-1', 'email'),
-          ]),
-        },
-      ],
-    } as unknown as FormData;
-    getFormData.mockResolvedValue(legacyData);
+    const direct = makeGroup();
+    getFormData.mockResolvedValue(
+      makeFormData({ direct_groups: [direct], nominated_groups: [] }),
+    );
     createCaseRequest.mockResolvedValueOnce({
-      case_id: 'CASE-LEGACY',
-      uuid: 'uuid-legacy',
+      case_id: 'CASE-NOM',
+      uuid: 'uuid-nom',
     });
 
-    // Silence the legacy-mode warning emitted by Form.tsx so test output
-    // stays focused on the assertions.
-    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-
     render(<Form onCreateRequest={vi.fn()} />);
     await waitFor(() => expect(getFormData).toHaveBeenCalled());
 
-    pickRequestType(RequestTypeEnum.CORRECTION);
+    pickRequestType(RequestTypeEnum.NOMINATION);
 
-    // The product-step header must NOT appear — legacy fallback skips it.
+    await waitFor(() => {
+      expect(screen.getByTestId('nomination-section')).toBeInTheDocument();
+    });
+    // Product picker must not render for NOMINATION even with groups.
     expect(
       screen.queryByText(/Select a product/i),
     ).not.toBeInTheDocument();
 
-    // The legacy flat CorrectionDataSection should render with the
-    // backend's flat `purposes` data elements.
-    const correctionSection = await screen.findByTestId('correction-section');
-    expect(
-      within(correctionSection).getByLabelText('correction-de-email'),
-    ).toBeInTheDocument();
+    const submitButton = screen.getByRole(
+      'button',
+      { name: /^submit$/i },
+    ) as HTMLButtonElement;
+    // Sanity: gate is closed before a valid nominee email is provided.
+    expect(submitButton.disabled).toBe(true);
 
-    fireEvent.click(
-      within(correctionSection).getByLabelText('correction-de-email'),
-    );
-    fireEvent.change(
-      within(correctionSection).getByLabelText('correction-current-email'),
-      { target: { value: 'old' } },
-    );
-    fireEvent.change(
-      within(correctionSection).getByLabelText('correction-updated-email'),
-      { target: { value: 'new' } },
-    );
+    // Drive the form to a valid NOMINATION state via the stubbed
+    // nomination input (see vi.mock above).
+    const emailInput = screen.getByTestId('nominee-email-input');
+    fireEvent.change(emailInput, { target: { value: 'nominee@example.com' } });
 
-    const allCheckboxes = screen.getAllByRole(
-      'checkbox',
-    ) as HTMLInputElement[];
-    const confirmCheckbox = allCheckboxes.find((c) =>
-      c.closest('label')?.textContent?.includes('I confirm'),
-    );
+    const confirmCheckbox = (
+      screen.getAllByRole('checkbox') as HTMLInputElement[]
+    ).find((c) => c.closest('label')?.textContent?.includes('I confirm'));
     expect(confirmCheckbox).toBeTruthy();
     fireEvent.click(confirmCheckbox!);
 
-    const submitButton = screen.getByRole('button', { name: /^submit$/i });
-    expect(submitButton).not.toBeDisabled();
-    await act(async () => {
-      fireEvent.click(submitButton);
-    });
-
     await waitFor(() => {
-      expect(createCaseRequest).toHaveBeenCalledTimes(1);
+      const btn = screen.getByRole(
+        'button',
+        { name: /^submit$/i },
+      ) as HTMLButtonElement;
+      expect(btn.disabled).toBe(false);
     });
 
-    // Single POST with no product anchor — the legacy single-case path.
-    const payload = createCaseRequest.mock.calls[0][2];
-    expect(payload.request_type).toBe('correction');
-    expect(payload.product_uuid).toBeUndefined();
-    expect('data_principal_uuid' in payload).toBe(false);
-    expect(payload.request_details.correction_data).toEqual([
-      { name: 'email', curr_value: 'old', new_value: 'new' },
-    ]);
+    fireEvent.click(
+      screen.getByRole('button', { name: /^submit$/i }),
+    );
+
+    await waitFor(() => expect(createCaseRequest).toHaveBeenCalled());
 
-    warnSpy.mockRestore();
+    const payload = createCaseRequest.mock.calls[0][2];
+    expect(payload.request_type).toBe('nomination');
+    expect(payload).not.toHaveProperty('product_uuid');
+    expect(payload).not.toHaveProperty('data_principal_uuid');
+    expect(payload.request_details.nomination_data).toMatchObject({
+      nominee_email: 'nominee@example.com',
+    });
   });
 
-  it('records group_key on successful single-product batch submission', async () => {
+  it('sends data_principal_uuid and product anchors on a nominated-card submit', async () => {
     setupSession();
     const otherDirect = makeGroup({
       product_uuid: 'prod-other',
@@ -1087,16 +1053,24 @@ describe('Form (P2-SDK-3)', () => {
     });
 
     await waitFor(() => {
-      expect(screen.getByTestId('request-submitted')).toBeInTheDocument();
+      expect(createCaseRequest).toHaveBeenCalledTimes(1);
     });
 
-    const succeededItems = within(
-      screen.getByTestId('request-submitted-succeeded'),
-    ).getAllByRole('listitem');
-    expect(succeededItems).toHaveLength(1);
-    expect(succeededItems[0].getAttribute('data-group-key')).toBe(
-      'prod-cc:alice-uuid',
-    );
+    const payload = createCaseRequest.mock.calls[0][2];
+    expect(payload.product_uuid).toBe('prod-cc');
+    // Nominated cards send data_principal_uuid sourced from the
+    // nominator's ConsentUser uuid — NOT from formData.uuid.
+    expect(payload.data_principal_uuid).toBe('alice-uuid');
+
+    await waitFor(() => {
+      expect(screen.getByTestId('request-submitted')).toBeInTheDocument();
+    });
+    expect(
+      screen.getByTestId('request-submitted-product-uuid').textContent,
+    ).toBe('prod-cc');
+    expect(
+      screen.getByTestId('request-submitted-case-id').textContent,
+    ).toBe('CASE-NOMINATED');
   });
 
   it('disables submit when the selected CORRECTION product has incomplete entries', async () => {

package/tests/ProductSelectionSection.test.tsx

@@ -3,8 +3,8 @@ import { describe, it, expect, vi } from 'vitest';
 
 vi.mock('react-i18next', () => {
   const en: Record<string, string> = {
-    activePurposes_one: '{{count}} active purpose',
-    activePurposes_other: '{{count}} active purposes',
+    activePurposes_one: '{{count}} purpose',
+    activePurposes_other: '{{count}} purposes',
     noProductsAvailable: 'No products available',
     noProductsAvailableDescription: 'You have no consents to manage yet.',
     nominationChipSuffix: '· {{nominator}}',
@@ -96,7 +96,42 @@ describe('ProductSelectionSection', () => {
     expect(screen.getByTestId('product-selection-chips')).toHaveClass(
       'pc-product-select-chips',
     );
-    expect(screen.getByText('2 active purposes')).toBeInTheDocument();
+    expect(screen.getByText('2 purposes')).toBeInTheDocument();
+  });
+
+  it('chip count reflects total raisable purposes regardless of status', () => {
+    // Per TECH-4089, withdrawn purposes still appear in the picker (revoking
+    // consent is not deletion — DP must still be able to raise requests for
+    // them). The chip label is a plain count of raisable purposes — no
+    // active/withdrawn distinction is surfaced in the label.
+    const direct = makeGroup({
+      product_uuid: 'prod-mixed',
+      product_name: 'Acme Loyalty',
+      purposes: [
+        {
+          uuid: 'p-active',
+          data_elements: [{ uuid: 'de-a', selected: true }],
+          status: 'ACTIVE',
+        } as never,
+        {
+          uuid: 'p-withdrawn',
+          data_elements: [{ uuid: 'de-w', selected: false }],
+          status: 'WITHDRAW',
+        } as never,
+      ],
+    });
+
+    render(
+      <ProductSelectionSection
+        directGroups={[direct]}
+        nominatedGroups={[]}
+        selectedProductKey={null}
+        onSelect={vi.fn()}
+      />,
+    );
+
+    expect(screen.getByText('2 purposes')).toBeInTheDocument();
+    expect(screen.queryByText(/active/)).not.toBeInTheDocument();
   });
 
   it('marks the selected chip with aria-selected and selected style class', () => {
@@ -148,7 +183,7 @@ describe('ProductSelectionSection', () => {
 
     expect(screen.getByText('Partner Bank')).toBeInTheDocument();
     expect(screen.getByText('· Alice Johnson')).toBeInTheDocument();
-    expect(screen.getByText('1 active purpose')).toBeInTheDocument();
+    expect(screen.getByText('1 purpose')).toBeInTheDocument();
   });
 
   it('falls back to nominator email in the chip suffix when name is null', () => {