@redacto.io/consent-sdk-react 9.3.0 → 9.4.0-beta.0

package/src/RedactoPrivacyCenter/lib/constants.ts

@@ -167,21 +167,34 @@ export const DOCUMENT_REQUEST_STATUS_LABEL: Record<DocumentRequestStatus, Docume
   replacement_requested: { labelKey: 'docStatusReplacementRequested', color: STATUS_COLORS.warning.color },
 };
 
-// Activity columns constants
-export const ACTIVITY_COLUMN_SIZES = {
-  TITLE: 220,
-  ACTIVITY_TYPE: 160,
-  DESCRIPTION: 320,
-  TIMESTAMP: 200,
-} as const;
-
-export const ACTIVITY_DESCRIPTION_TRUNCATE_LENGTH = 100;
-
 export const ACTIVITY_DATE_FORMATS = {
   DISPLAY: 'MMM D, YYYY [at] h:mm A',
   TOOLTIP: 'MMMM D, YYYY [at] h:mm:ss A',
+  DATE: 'MMM D, YYYY',
+  TIME: 'h:mm A',
 } as const;
 
+export const ACTIVITY_PAGE_SIZE = 10;
+
+
+// ─── Token refresh ─────────────────────────────────────────────────────────
+
+// Backoff window for *transient* OTP-refresh failures (network / 5xx). After a
+// transient failure we wait at least MIN before the next attempt and grow the
+// window exponentially up to MAX, so a flaky connection can't turn the
+// proactive-refresh path into a request storm (incident 2026-06-22). Terminal
+// failures (expired / already-used token) are handled by the circuit breaker in
+// lib/utils.ts and are not retried at all.
+export const MIN_REFRESH_BACKOFF_MS = 30_000; // 30s
+export const MAX_REFRESH_BACKOFF_MS = 300_000; // 5m
+
+// Where the privacy center persists the refresh token: localStorage (origin-
+// scoped, no path matching) under a Redacto-namespaced key, so it is readable
+// regardless of the host app's basePath and never collides with a host's own
+// `refresh_token` cookie. LEGACY_REFRESH_TOKEN_COOKIE is the cookie name older
+// SDK versions wrote (at path=/privacy-center); only that path is ever cleared.
+export const REFRESH_TOKEN_STORAGE_KEY = 'redacto_pc_refresh_token';
+export const LEGACY_REFRESH_TOKEN_COOKIE = 'refresh_token';
 
 // ─── Notification Hub ──────────────────────────────────────────────────────
 

package/src/RedactoPrivacyCenter/lib/queries.ts

@@ -9,6 +9,7 @@ import {
 } from './api';
 import { useBaseUrl } from '../context/BaseUrlContext';
 import { useCurrentLanguage } from './useCurrentLanguage';
+import { isTerminalRefreshError } from '../api/fetcher';
 import type { SendCaseMessageInput, SubmitDocumentForRequestInput } from './types';
 
 export const useCaseHistory = (
@@ -33,7 +34,10 @@ export const useCaseHistory = (
       return response?.data || [];
     },
     enabled: !!organizationId && !!workspaceId && !!contact && !!consentClient,
-    retry: 1,
+    // Don't retry terminal auth failures — retrying a dead token only adds load
+    // (incident 2026-06-22). Transient failures get a single backed-off retry.
+    retry: (failureCount, error) => !isTerminalRefreshError(error) && failureCount < 1,
+    retryDelay: (attempt) => Math.min(1000 * 2 ** attempt, 30_000),
   });
 };
 
@@ -67,7 +71,10 @@ export const useCaseMessages = (
         return ta - tb;
       }),
     enabled: !!organizationId && !!workspaceId && !!caseUuid && !!consentClient,
-    retry: 1,
+    // Don't retry terminal auth failures — retrying a dead token only adds load
+    // (incident 2026-06-22). Transient failures get a single backed-off retry.
+    retry: (failureCount, error) => !isTerminalRefreshError(error) && failureCount < 1,
+    retryDelay: (attempt) => Math.min(1000 * 2 ** attempt, 30_000),
   });
 };
 

package/src/RedactoPrivacyCenter/lib/utils.refresh-circuit.test.ts

@@ -0,0 +1,127 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { ensureValidToken, isRefreshBlocked, resetRefreshCircuit } from './utils';
+import { ApiError } from '../api/fetcher';
+
+/**
+ * Regression tests for the OTP refresh circuit breaker.
+ *
+ * Production incident 2026-06-22: an embedded Privacy Center retry-looped a dead
+ * refresh token, sending ~9× the normal volume of `POST /otp/refresh` (all fast
+ * terminal rejections) and spiking consent-server CPU. ensureValidToken is the
+ * single chokepoint for every refresh — these tests pin the guarantee that a
+ * terminally-failed token is attempted exactly once until the user re-authenticates,
+ * and that transient failures back off instead of hammering.
+ */
+
+// Minimal JWT with a chosen `exp`. The signature is irrelevant — the SDK only
+// base64-decodes the payload to read `exp`.
+const base64url = (obj: unknown) => btoa(JSON.stringify(obj)).replace(/=+$/, '');
+const makeJwt = (expSeconds: number) =>
+  `${base64url({ alg: 'HS256', typ: 'JWT' })}.${base64url({ exp: expSeconds })}.sig`;
+
+// `exp` in 1970 — always treated as expired, so ensureValidToken always takes the
+// refresh path regardless of wall-clock / fake timers.
+const EXPIRED_ACCESS_TOKEN = makeJwt(1_000);
+const ORG = 'org-uuid';
+const WS = 'ws-uuid';
+
+const makeConsentClient = (
+  refreshOtpToken: (orgId: string, wsId: string, refreshToken: string) => Promise<unknown>
+) => ({ refreshOtpToken: vi.fn(refreshOtpToken) }) as any;
+
+const makeAuthContext = (refreshToken: string) => ({
+  accessToken: EXPIRED_ACCESS_TOKEN,
+  refreshToken,
+  // Return false so the SDK suppresses navigation (jsdom can't navigate). The
+  // circuit breaker trips before onError is consulted, which is what we assert.
+  onError: vi.fn(() => false),
+  updateTokens: vi.fn(),
+});
+
+describe('ensureValidToken — OTP refresh circuit breaker (incident 2026-06-22)', () => {
+  beforeEach(() => {
+    resetRefreshCircuit();
+    sessionStorage.clear();
+    vi.clearAllMocks();
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it('attempts a terminally-failed refresh token exactly once across many calls', async () => {
+    const client = makeConsentClient(() =>
+      Promise.reject(new ApiError('Token verification error: Refresh token has expired', { status: 401 }))
+    );
+    const authContext = makeAuthContext('dead-refresh-token');
+
+    // Simulate the 3 pollers + every API call + render-driven effects all hitting
+    // the path while the token is dead.
+    const results: Array<string | null> = [];
+    for (let i = 0; i < 25; i++) {
+      results.push(await ensureValidToken(ORG, WS, undefined, authContext, client));
+    }
+
+    expect(results.every((r) => r === null)).toBe(true);
+    expect(client.refreshOtpToken).toHaveBeenCalledTimes(1);
+    expect(isRefreshBlocked(authContext)).toBe(true);
+  });
+
+  it('treats "not found / already used" (T0) as terminal, not retryable', async () => {
+    const client = makeConsentClient(() =>
+      Promise.reject(new ApiError('Refresh token not found or already used', { status: 401 }))
+    );
+    const authContext = makeAuthContext('already-used-token');
+
+    await ensureValidToken(ORG, WS, undefined, authContext, client);
+    await ensureValidToken(ORG, WS, undefined, authContext, client);
+
+    expect(client.refreshOtpToken).toHaveBeenCalledTimes(1);
+  });
+
+  it('resumes refreshing once a new refresh token value appears', async () => {
+    const validAccess = makeJwt(Math.floor(Date.now() / 1000) + 3600);
+    const client = makeConsentClient((_org, _ws, token) =>
+      token === 'dead-refresh-token'
+        ? Promise.reject(new ApiError('Refresh token has expired', { status: 401 }))
+        : Promise.resolve({ access_token: validAccess, refresh_token: 'rotated' })
+    );
+
+    const deadCtx = makeAuthContext('dead-refresh-token');
+    await ensureValidToken(ORG, WS, undefined, deadCtx, client);
+    await ensureValidToken(ORG, WS, undefined, deadCtx, client);
+    expect(client.refreshOtpToken).toHaveBeenCalledTimes(1); // breaker held the loop
+
+    // User re-authenticated → a *different* refresh token value re-arms the breaker.
+    const freshCtx = makeAuthContext('fresh-refresh-token');
+    const token = await ensureValidToken(ORG, WS, undefined, freshCtx, client);
+
+    expect(client.refreshOtpToken).toHaveBeenCalledTimes(2);
+    expect(token).toBe(validAccess);
+    expect(isRefreshBlocked(freshCtx)).toBe(false);
+  });
+
+  it('backs off after a transient failure instead of retrying immediately', async () => {
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date('2026-06-22T11:00:00Z'));
+
+    const client = makeConsentClient(() =>
+      Promise.reject(new ApiError('Service Unavailable', { status: 503 }))
+    );
+    const authContext = makeAuthContext('flaky-refresh-token');
+
+    await ensureValidToken(ORG, WS, undefined, authContext, client);
+    await ensureValidToken(ORG, WS, undefined, authContext, client);
+    await ensureValidToken(ORG, WS, undefined, authContext, client);
+
+    // One attempt, then the backoff window suppresses the rest (no token-marking —
+    // a 5xx is transient, so the token is NOT permanently dead).
+    expect(client.refreshOtpToken).toHaveBeenCalledTimes(1);
+    expect(isRefreshBlocked(authContext)).toBe(true);
+
+    // Once the backoff window elapses, a later call is allowed to retry.
+    vi.advanceTimersByTime(31_000); // > MIN_REFRESH_BACKOFF_MS (30s)
+    await ensureValidToken(ORG, WS, undefined, authContext, client);
+    expect(client.refreshOtpToken).toHaveBeenCalledTimes(2);
+  });
+});

package/src/RedactoPrivacyCenter/lib/utils.refresh-storage.test.ts

@@ -0,0 +1,85 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+
+import {
+  setRefreshTokenCookie,
+  getStoredRefreshToken,
+  signOutPrivacyCenter,
+} from './utils';
+
+const STORAGE_KEY = 'redacto_pc_refresh_token';
+
+const expireLegacyCookie = (): void => {
+  document.cookie =
+    'refresh_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT';
+  document.cookie =
+    'refresh_token=; path=/privacy-center; expires=Thu, 01 Jan 1970 00:00:00 GMT';
+};
+
+describe('privacy center refresh token persistence', () => {
+  beforeEach(() => {
+    window.localStorage.clear();
+    expireLegacyCookie();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('persists the refresh token in localStorage (path-independent) and writes no cookie', () => {
+    // A path-scoped cookie is unreadable when the host mounts under a basePath
+    // (e.g. consent-app at /consent), which strands rotated tokens and triggers
+    // the 401 refresh storm. localStorage is origin-scoped, so it is readable
+    // regardless of basePath.
+    setRefreshTokenCookie('tok123');
+
+    expect(window.localStorage.getItem(STORAGE_KEY)).toBe('tok123');
+    expect(getStoredRefreshToken()).toBe('tok123');
+    expect(document.cookie).not.toContain('refresh_token=tok123');
+  });
+
+  it('returns null when no refresh token is stored', () => {
+    expect(getStoredRefreshToken()).toBeNull();
+  });
+
+  it('does not ingest a host app refresh_token cookie', () => {
+    // A cookie read is name-only (JS cannot see the path), so the SDK cannot tell
+    // a host app's own refresh_token cookie from its own legacy one. It must not
+    // read the cookie at all: it neither migrates the value nor deletes the
+    // cookie. (Existing SDK sessions are preserved via the AuthProvider token
+    // prop, not the cookie.)
+    document.cookie = 'refresh_token=hosttoken; path=/';
+
+    const token = getStoredRefreshToken();
+
+    expect(token).toBeNull();
+    expect(window.localStorage.getItem(STORAGE_KEY)).toBeNull();
+    expect(document.cookie).toContain('refresh_token=hosttoken');
+  });
+
+  it('clears the stored refresh token on sign out', () => {
+    setRefreshTokenCookie('tok123');
+    expect(window.localStorage.getItem(STORAGE_KEY)).toBe('tok123');
+
+    signOutPrivacyCenter();
+
+    expect(window.localStorage.getItem(STORAGE_KEY)).toBeNull();
+    expect(getStoredRefreshToken()).toBeNull();
+  });
+
+  it('does not throw when localStorage.setItem is unavailable (private mode / quota)', () => {
+    vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
+      throw new Error('QuotaExceededError');
+    });
+
+    expect(() => setRefreshTokenCookie('tok123')).not.toThrow();
+  });
+
+  it('returns null (no throw) when localStorage.getItem is unavailable', () => {
+    vi.spyOn(Storage.prototype, 'getItem').mockImplementation(() => {
+      throw new Error('SecurityError');
+    });
+
+    expect(() => getStoredRefreshToken()).not.toThrow();
+    expect(getStoredRefreshToken()).toBeNull();
+  });
+});