@redacto.io/consent-sdk-react 9.3.0 → 9.4.0-beta.0

package/src/RedactoNoticeAssisted/types.ts

@@ -0,0 +1,24 @@
+// Internal types for RedactoNoticeAssisted.
+
+/** The three screens of the agent-assisted consent flow. */
+export type ConsoleState = "notice" | "otp" | "confirmed";
+
+/**
+ * Public props. The notice is fetched from the PUBLIC notice endpoint, so the
+ * organisation / workspace / notice UUIDs and base URL are supplied by the host
+ * (typically read from the frontend URL) — there is no auth token.
+ */
+export type RedactoNoticeAssistedProps = {
+  /** Organisation UUID (path segment of the public notice endpoint). */
+  organisationUuid: string;
+  /** Workspace UUID (path segment of the public notice endpoint). */
+  workspaceUuid: string;
+  /** Notice UUID to fetch and render. */
+  noticeUuid: string;
+  /** API base URL (defaults to the production consent API). */
+  baseUrl?: string;
+  /** Called when the agent/customer declines (host should unmount the modal). */
+  onDecline?: () => void;
+  /** Called when the agent clicks "Proceed" on the confirmed screen. */
+  onComplete?: () => void;
+};

package/src/RedactoNoticeAssisted/useMediaQuery.ts

@@ -0,0 +1,36 @@
+import { useState, useEffect } from "react";
+
+export const useMediaQuery = (query: string): boolean => {
+  const getMatches = () =>
+    typeof window !== "undefined" ? window.matchMedia(query).matches : false;
+  const [matches, setMatches] = useState<boolean>(getMatches);
+
+  useEffect(() => {
+    if (typeof window === "undefined") return;
+    const media = window.matchMedia(query);
+
+    // Create event listener
+    const listener = (e: MediaQueryListEvent) => {
+      setMatches(e.matches);
+    };
+
+    // Add listener (fallback for legacy browsers)
+    if (media.addEventListener) {
+      media.addEventListener("change", listener);
+    } else {
+      // @ts-ignore – deprecated fallback
+      media.addListener(listener);
+    }
+
+    // Clean up
+    return () => {
+      if (media.removeEventListener) {
+        media.removeEventListener("change", listener);
+      } else {
+        media.removeListener(listener);
+      }
+    };
+  }, [query]);
+
+  return matches;
+};

package/src/RedactoPrivacyCenter/NotificationsPage.tsx

@@ -3,6 +3,7 @@ import { IoChevronBackOutline } from 'react-icons/io5';
 import { useTranslation } from 'react-i18next';
 import { usePageChrome } from './context/PageChromeContext';
 import { fetchNotifications } from './lib/api';
+import { isRefreshBlocked } from './lib/utils';
 import type { Notification, NotificationSummary, NotificationCTA, FilterTab } from './lib/types';
 import { TAB_TO_CATEGORY, POLL_INTERVAL, NOTIFICATION_PAGE_SIZE, useNotificationStatLabels } from './lib/constants';
 import { useCurrentLanguage } from './lib/useCurrentLanguage';
@@ -39,6 +40,13 @@ export const NotificationsPage = () => {
     if (!organizationId || !workspaceId) {
       return;
     }
+    // Skip polling/loading work while auth is terminally failed / backing off
+    // (incident 2026-06-22); clear spinners so the UI doesn't hang.
+    if (isRefreshBlocked(authContext)) {
+      setIsLoading(false);
+      setIsRefreshing(false);
+      return;
+    }
     if (!silent) {
       setIsLoading(true);
     }

package/src/RedactoPrivacyCenter/api/actions.ts

@@ -1,4 +1,5 @@
 import type { BaseRequest } from './client';
+import { isTerminalRefreshError } from './fetcher';
 
 export type ConsentApiErrorCode = 'NOMINATOR_NOT_FOUND' | 'NOMINEE_MUST_SPECIFY_NOMINATOR';
 
@@ -219,20 +220,14 @@ export async function refreshOtpTokenServer(
     }
     return response;
   } catch (error: any) {
-    // Check if this is an expired refresh token error (expected scenario)
-    const errorMessage = error?.message || '';
-    const isExpiredTokenError =
-      errorMessage.includes('expired') ||
-      errorMessage.includes('Invalid refresh token') ||
-      errorMessage.includes('Refresh token') ||
-      errorMessage.includes('revoked');
-
-    // For expired/revoked tokens, return null gracefully (don't log as error)
-    if (isExpiredTokenError) {
+    // Terminal token errors (expired / not found / already used / 4xx) are an
+    // expected outcome — return null so the caller trips the circuit breaker
+    // instead of treating it as a retryable exception (incident 2026-06-22).
+    if (isTerminalRefreshError(error)) {
       return null;
     }
 
-    // For other errors (network, etc.), log and re-throw
+    // Transient errors (network / 5xx): re-throw so the caller can back off + retry.
     console.error('Error refreshing token:', error);
     throw error;
   }

package/src/RedactoPrivacyCenter/api/client.ts

@@ -1,4 +1,4 @@
-import { apiFetch } from "./fetcher";
+import { apiFetch, ApiError } from "./fetcher";
 import type { ApiFetchOptions, ApiResponse } from "./fetcher";
 import type {
   CaseMessage,
@@ -86,6 +86,8 @@ export function createConsentClient(baseUrl: string) {
       // Handle non-OK responses
       if (!response.ok) {
         let errorMessage = `Request failed with status ${response.status}`;
+        let errorCode: string | undefined;
+        let errorDetail: unknown;
 
         try {
           const errorData = (await response.json()) as {
@@ -94,6 +96,10 @@ export function createConsentClient(baseUrl: string) {
             code?: string;
           } | null;
           if (errorData) {
+            errorDetail = errorData.detail;
+            if (typeof errorData.code === "string") {
+              errorCode = errorData.code;
+            }
             if ("detail" in errorData && errorData.detail) {
               errorMessage =
                 typeof errorData.detail === "string"
@@ -118,8 +124,14 @@ export function createConsentClient(baseUrl: string) {
           }
         }
 
-        // Prepend HTTP status so callers can branch on it without losing context
-        throw new Error(`[${response.status}] ${errorMessage}`);
+        // Throw a typed error carrying the status/code. The `[status]` prefix is
+        // kept in the message for back-compat with callers that branch on it
+        // (e.g. getFormData checks for "404").
+        throw new ApiError(`[${response.status}] ${errorMessage}`, {
+          status: response.status,
+          code: errorCode,
+          detail: errorDetail,
+        });
       }
 
       // Parse JSON response

package/src/RedactoPrivacyCenter/api/fetcher.ts

@@ -17,6 +17,72 @@ export type ApiResponse<T> = {
   detail: T;
 };
 
+/**
+ * Error thrown by the fetch wrappers that preserves the HTTP status code and any
+ * server-provided error code alongside the human-readable message.
+ *
+ * This exists so token-refresh classification (and react-query retry guards) can
+ * reliably distinguish a *terminal* 4xx (the refresh token is dead — retrying just
+ * hammers the server) from a *transient* 5xx/network failure, without resorting to
+ * brittle substring matching on localized message strings. See the production
+ * `/otp/refresh` retry storm on 2026-06-22.
+ */
+export class ApiError extends Error {
+  readonly status?: number;
+  readonly code?: string;
+  readonly detail?: unknown;
+
+  constructor(
+    message: string,
+    options: { status?: number; code?: string; detail?: unknown } = {}
+  ) {
+    super(message);
+    this.name = "ApiError";
+    this.status = options.status;
+    this.code = options.code;
+    this.detail = options.detail;
+    // Restore the prototype chain so `instanceof ApiError` works after the
+    // class is transpiled down (tsup → ES targets).
+    Object.setPrototypeOf(this, ApiError.prototype);
+  }
+}
+
+// HTTP statuses that mean "this refresh token will never succeed" — retrying is
+// pointless and only adds server load. 5xx / 408 / 429 / network errors are NOT
+// in this set: those are transient and handled with backoff instead.
+const TERMINAL_REFRESH_STATUSES = new Set<number>([400, 401, 403, 422]);
+
+/**
+ * True when an error from the OTP refresh endpoint is terminal — i.e. the refresh
+ * token is expired, not found, already used, or otherwise invalid, so no amount of
+ * immediate retrying will help. Prefers the HTTP status carried by {@link ApiError};
+ * falls back to a deliberately narrow message match for non-typed throws.
+ */
+export function isTerminalRefreshError(error: unknown): boolean {
+  const e = error as { status?: unknown; message?: unknown } | null | undefined;
+  if (!e) return false;
+
+  // Primary, reliable signal: the HTTP status from the refresh response.
+  if (typeof e.status === "number") {
+    return TERMINAL_REFRESH_STATUSES.has(e.status);
+  }
+
+  // Fallback for errors without a status (older shapes / plain Error). Match only
+  // the known terminal token phrases so transient failures aren't misclassified.
+  const message = (typeof e.message === "string" ? e.message : "").toLowerCase();
+  if (!message) return false;
+  return (
+    message.includes("expired") ||
+    message.includes("revoked") ||
+    message.includes("not found") ||
+    message.includes("already used") ||
+    message.includes("invalid refresh token") ||
+    message.includes("unauthorized") ||
+    message.includes("[401]") ||
+    message.includes("[403]")
+  );
+}
+
 /**
  * Unified fetch wrapper for client-side API calls.
  * Provides typed responses and automatic error handling.
@@ -84,13 +150,20 @@ export async function apiFetch<T>(
     // Handle non-OK responses
     if (!response.ok) {
       let errorMessage = `Request failed with status ${response.status}`;
+      let errorCode: string | undefined;
+      let errorDetail: unknown;
 
       try {
         const errorData = (await response.json()) as {
           detail?: unknown;
           message?: string;
+          code?: string;
         } | null;
         if (errorData) {
+          errorDetail = errorData.detail;
+          if (typeof errorData.code === "string") {
+            errorCode = errorData.code;
+          }
           if ("detail" in errorData && errorData.detail) {
             errorMessage =
               typeof errorData.detail === "string"
@@ -112,7 +185,13 @@ export async function apiFetch<T>(
         }
       }
 
-      throw new Error(errorMessage);
+      // Preserve status + server error code so callers can classify terminal vs.
+      // transient failures without brittle string matching (incident 2026-06-22).
+      throw new ApiError(errorMessage, {
+        status: response.status,
+        code: errorCode,
+        detail: errorDetail,
+      });
     }
 
     // Handle empty responses (common for DELETE requests with 204 No Content)