@redacto.io/consent-sdk-react 9.3.0 → 9.4.0

package/src/RedactoPrivacyCenter/lib/utils.ts

@@ -1,10 +1,57 @@
 import { refreshOtpTokenServer } from './api';
+import { isTerminalRefreshError } from '../api/fetcher';
+import {
+  MIN_REFRESH_BACKOFF_MS,
+  MAX_REFRESH_BACKOFF_MS,
+  REFRESH_TOKEN_STORAGE_KEY,
+  LEGACY_REFRESH_TOKEN_COOKIE,
+} from './constants';
 import type { BaseUrlContextValue } from '../context/BaseUrlContext';
 
 // Token refresh lock to prevent concurrent refresh attempts
 let isRefreshing = false;
 let refreshPromise: Promise<string | null> | null = null;
 
+// ─── OTP refresh circuit breaker (incident 2026-06-22) ──────────────────────
+// ensureValidToken is called from 3 independent 30s pollers, before every
+// authenticated API call, and from render-driven effects. Without a memory of
+// failure, a single dead refresh token gets re-submitted on every one of those
+// triggers, hammering POST /otp/refresh until the tab closes. These guards make a
+// terminally-failed token cost exactly one request, and apply backoff to transient
+// failures.
+//
+// `deadRefreshToken` holds the *value* of a refresh token that terminally failed.
+// It auto-clears the moment a different token value appears (i.e. the user
+// re-authenticated), so the breaker never permanently bricks a session.
+let deadRefreshToken: string | null = null;
+// Transient-failure backoff window (epoch ms) and the current backoff duration.
+let transientRefreshFailureUntil = 0;
+let transientRefreshBackoffMs = 0;
+
+// ─── Terminal "session expired" signal ──────────────────────────────────────
+// The circuit breaker above stops the *network* (a dead refresh token costs one
+// request). This listener lets the React tree learn that the session is
+// terminally over so it can show a dedicated "session expired" screen and gate
+// every further fetch — instead of silently rendering empty/stale content or
+// hard-navigating away. A single module-level listener, consistent with the
+// single-instance breaker singleton above (one Privacy Center per page).
+let sessionExpiredListener: (() => void) | null = null;
+
+/**
+ * Register (or clear, with `null`) the callback fired when a refresh terminally
+ * fails — i.e. the refresh token is expired/invalid and re-authentication is
+ * required. AuthProvider registers its `markSessionExpired` here. Exported for
+ * that wiring and for tests; not part of the package's public API.
+ */
+export const setSessionExpiredListener = (fn: (() => void) | null): void => {
+  sessionExpiredListener = fn;
+};
+
+/** Notify the React tree that the session has terminally expired. */
+const notifySessionExpired = (): void => {
+  sessionExpiredListener?.();
+};
+
 // Buffer time in seconds before token expiration to proactively refresh
 // Using 30 seconds to ensure tokens are refreshed before they expire
 const TOKEN_EXPIRY_BUFFER_SECONDS = 30;
@@ -20,25 +67,140 @@ export const getCookieValue = (name: string) => {
   return null;
 };
 
+// ─── Refresh token persistence ──────────────────────────────────────────────
+// The refresh token lives in localStorage (key REFRESH_TOKEN_STORAGE_KEY), not a
+// cookie. A path-scoped cookie is not readable when the host mounts the privacy
+// center under a basePath (e.g. consent-app at /consent → /consent/privacy-center/...),
+// so a rotated token can't be read back and the stale token gets re-presented,
+// causing a 401 "Refresh token not found or already used" storm. localStorage is
+// origin-scoped (no path matching), so it is readable under any basePath.
+//
+// localStorage access throws when storage is disabled or over quota (private
+// modes, embedded webviews). Guard every access so the SDK degrades to "refresh
+// fails -> re-auth" instead of crashing the render tree (setRefreshTokenCookie
+// runs during AuthProvider's render). Mirrors components/AppShell/hooks/useSidebarState.ts.
+const readStorage = (key: string): string | null => {
+  try {
+    return window.localStorage.getItem(key);
+  } catch {
+    return null;
+  }
+};
+
+const writeStorage = (key: string, value: string): void => {
+  try {
+    window.localStorage.setItem(key, value);
+  } catch {
+    // localStorage unavailable / quota exceeded — ignore
+  }
+};
+
+const removeStorage = (key: string): void => {
+  try {
+    window.localStorage.removeItem(key);
+  } catch {
+    // localStorage unavailable — ignore
+  }
+};
+
 /**
- * Set refresh token cookie with proper attributes
+ * Expire the SDK's own legacy refresh_token cookie (older versions wrote it at
+ * path=/privacy-center). Scoped to that path only on purpose: a refresh_token
+ * cookie at path=/ belongs to the host app, and clearing it would sign the host
+ * out.
+ */
+const clearLegacyRefreshTokenCookie = (): void => {
+  if (typeof window === 'undefined') {
+    return;
+  }
+  document.cookie = `${LEGACY_REFRESH_TOKEN_COOKIE}=; path=/privacy-center; expires=Thu, 01 Jan 1970 00:00:00 GMT`;
+};
+
+/**
+ * Persist the refresh token. Named `setRefreshTokenCookie` for backward
+ * compatibility (it is part of the package's exported surface); it now writes
+ * to localStorage rather than a cookie, and clears any cookie an older SDK
+ * version left at path=/privacy-center.
  * @param refreshToken - The refresh token value to set
  */
 export const setRefreshTokenCookie = (refreshToken: string): void => {
   if (typeof window === 'undefined') {
     return;
   }
+  writeStorage(REFRESH_TOKEN_STORAGE_KEY, refreshToken);
+  clearLegacyRefreshTokenCookie();
+};
+
+/**
+ * Read the persisted refresh token from localStorage.
+ *
+ * Intentionally does NOT fall back to reading a `refresh_token` cookie: a cookie
+ * read is name-only (the path isn't visible to JS), so it cannot tell the SDK's
+ * own legacy cookie from a host app's unrelated `refresh_token` cookie — reading
+ * the latter would leak a host credential to the OTP refresh endpoint. Existing
+ * sessions are preserved by AuthProvider re-seeding storage from the token prop.
+ */
+export const getStoredRefreshToken = (): string | null => {
+  if (typeof window === 'undefined') {
+    return null;
+  }
+  return readStorage(REFRESH_TOKEN_STORAGE_KEY);
+};
+
+/**
+ * Resolve the refresh token currently in play: from auth context (props mode) or
+ * persisted storage (legacy mode). Centralised so the circuit breaker and the
+ * refresh routine always agree on exactly which token value is being used.
+ */
+const getActiveRefreshToken = (authContext?: { refreshToken?: string }): string | null => {
+  if (authContext) {
+    return authContext.refreshToken && authContext.refreshToken.trim() !== ''
+      ? authContext.refreshToken
+      : null;
+  }
+  if (typeof window === 'undefined') return null;
+  return getStoredRefreshToken();
+};
+
+/**
+ * Clear all OTP-refresh circuit-breaker state. Called after a successful refresh
+ * and exposed for tests. Deliberately NOT called from signOutPrivacyCenter: in
+ * props mode the refresh token lives in a prop that sign-out cannot clear, so
+ * clearing the breaker there would immediately re-arm the retry storm. Recovery
+ * instead happens automatically when a *different* token value appears.
+ */
+export const resetRefreshCircuit = (): void => {
+  deadRefreshToken = null;
+  transientRefreshFailureUntil = 0;
+  transientRefreshBackoffMs = 0;
+};
+
+/**
+ * True when attempting a refresh right now would be pointless — the active refresh
+ * token has already terminally failed, or we're inside the transient backoff
+ * window. Pollers consult this to avoid scheduling doomed work.
+ */
+export const isRefreshBlocked = (authContext?: { refreshToken?: string }): boolean => {
+  const active = getActiveRefreshToken(authContext);
+  if (active !== null && active === deadRefreshToken) return true;
+  if (Date.now() < transientRefreshFailureUntil) return true;
+  return false;
+};
 
-  const cookieAttributes = [
-    `refresh_token=${refreshToken}`,
-    'path=/privacy-center',
-    `max-age=${60 * 60 * 24 * 7}`, // 7 days
-    `samesite=lax`,
-  ]
-    .filter(Boolean)
-    .join('; ');
+/** Record a transient refresh failure (network / 5xx) and grow the backoff window. */
+const noteTransientRefreshFailure = (): void => {
+  transientRefreshBackoffMs = Math.min(
+    Math.max(transientRefreshBackoffMs * 2, MIN_REFRESH_BACKOFF_MS),
+    MAX_REFRESH_BACKOFF_MS,
+  );
+  transientRefreshFailureUntil = Date.now() + transientRefreshBackoffMs;
+};
 
-  document.cookie = cookieAttributes;
+/** Trip the circuit breaker for a refresh token value that terminally failed. */
+const markRefreshTokenDead = (token: string | null): void => {
+  if (token) {
+    deadRefreshToken = token;
+  }
 };
 
 /**
@@ -210,14 +372,24 @@ export const checkAndRefreshAuth = async (
       return false;
     }
 
-    try {
-      const refreshToken = getCookieValue('refresh_token');
-      if (!refreshToken) {
-        // No refresh token available - user needs to sign in again
-        signOutPrivacyCenter();
-        return false;
-      }
+    const refreshToken = getStoredRefreshToken();
+    if (!refreshToken) {
+      // No refresh token available - terminal: surface the session-expired screen.
+      signOutPrivacyCenter();
+      notifySessionExpired();
+      return false;
+    }
+
+    // Circuit breaker (incident 2026-06-22): a new token re-arms; a known-dead
+    // token or an open backoff window short-circuits without hitting the network.
+    if (deadRefreshToken !== null && refreshToken !== deadRefreshToken) {
+      resetRefreshCircuit();
+    }
+    if (refreshToken === deadRefreshToken || Date.now() < transientRefreshFailureUntil) {
+      return false;
+    }
 
+    try {
       const result = await refreshOtpTokenServer(orgId, wsId, refreshToken, consentClient);
       if (result && result.success !== false) {
         const newAccessToken = (result as { access_token?: string })?.access_token;
@@ -227,14 +399,20 @@ export const checkAndRefreshAuth = async (
           // Validate the new token is not expired before storing
           if (isJwtExpired(newAccessToken, TOKEN_EXPIRY_BUFFER_SECONDS)) {
             console.error('Refreshed access token is already expired - clearing auth state');
+            markRefreshTokenDead(refreshToken);
             signOutPrivacyCenter();
+            notifySessionExpired();
             return false;
           }
           sessionStorage.setItem('access_token', newAccessToken);
+          // Success — re-arm the circuit breaker.
+          resetRefreshCircuit();
         } else {
           // No access token in response - refresh failed
           console.error('Refresh response missing access token - clearing auth state');
+          markRefreshTokenDead(refreshToken);
           signOutPrivacyCenter();
+          notifySessionExpired();
           return false;
         }
 
@@ -250,29 +428,23 @@ export const checkAndRefreshAuth = async (
         }
         return isValid;
       } else {
-        // Refresh token expired/revoked or server returned failure
-        // This is an expected scenario - silently handle it
+        // Refresh token expired/revoked or server returned failure - terminal.
+        markRefreshTokenDead(refreshToken);
         signOutPrivacyCenter();
+        notifySessionExpired();
         return false;
       }
     } catch (error: any) {
-      // Check if error indicates refresh token is expired/revoked (expected scenario)
-      const errorMessage = error?.message || '';
-      const isRefreshTokenExpired =
-        errorMessage.includes('revoked') ||
-        errorMessage.includes('expired') ||
-        errorMessage.includes('Refresh token') ||
-        errorMessage.includes('Invalid refresh token') ||
-        errorMessage.includes('401') ||
-        errorMessage.includes('Unauthorized');
-
-      if (isRefreshTokenExpired) {
-        // Refresh token is expired/revoked - silently handle (expected scenario)
+      if (isTerminalRefreshError(error)) {
+        // Refresh token is expired / not found / already used - trip the breaker.
+        markRefreshTokenDead(refreshToken);
         signOutPrivacyCenter();
+        notifySessionExpired();
         return false;
       }
 
-      // For other errors (network, etc.), log and don't clear auth state - might be temporary
+      // Transient (network / 5xx): keep auth state, back off, retry on a later call.
+      noteTransientRefreshFailure();
       console.error('[Token Refresh] Unexpected error refreshing token:', error);
       return false;
     }
@@ -323,12 +495,10 @@ export const signOutPrivacyCenter = (): void => {
     sessionStorage.removeItem(key);
   });
 
-  // Clear refresh token cookie set for privacy center
-  document.cookie =
-    'refresh_token=; path=/privacy-center; expires=Thu, 01 Jan 1970 00:00:00 GMT';
-  // Fallback in case the cookie path differs
-  document.cookie =
-    'refresh_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT';
+  // Clear the persisted refresh token (and the SDK's own legacy cookie from
+  // older versions). The host app's path=/ cookie is intentionally left alone.
+  removeStorage(REFRESH_TOKEN_STORAGE_KEY);
+  clearLegacyRefreshTokenCookie();
 };
 
 /**
@@ -371,6 +541,22 @@ export const ensureValidToken = async (
     return accessToken;
   }
 
+  // Circuit breaker: before any network work, consult the failure memory.
+  // (Incident 2026-06-22 — stops the /otp/refresh retry storm at its source.)
+  const activeRefreshToken = getActiveRefreshToken(authContext);
+  // A new refresh token value means the user re-authenticated — re-arm the breaker.
+  if (deadRefreshToken !== null && activeRefreshToken !== deadRefreshToken) {
+    resetRefreshCircuit();
+  }
+  // Known-dead token: do not touch the network until a different token appears.
+  if (activeRefreshToken !== null && activeRefreshToken === deadRefreshToken) {
+    return null;
+  }
+  // Transient-failure backoff window still open: skip the network.
+  if (Date.now() < transientRefreshFailureUntil) {
+    return null;
+  }
+
   // Token is missing or expired, need to refresh
   // Use lock to prevent concurrent refresh attempts
   if (isRefreshing && refreshPromise) {
@@ -401,7 +587,9 @@ export const ensureValidToken = async (
 const performTokenRefresh = async (
   organizationId?: string,
   workspaceId?: string,
-  slug?: string,
+  // Retained for call-site compatibility; redirect-by-slug was removed in favor
+  // of the terminal "session expired" screen, so the value is intentionally unused.
+  _slug?: string,
   authContext?: {
     accessToken?: string;
     refreshToken?: string;
@@ -413,54 +601,37 @@ const performTokenRefresh = async (
   // Get organizationId and workspaceId from sessionStorage if not provided
   const orgId = organizationId || sessionStorage.getItem('pc_org_id') || '';
   const wsId = workspaceId || sessionStorage.getItem('pc_workspace_id') || '';
-  const orgSlug = slug || sessionStorage.getItem('pc_org_slug') || '';
 
   if (!orgId || !wsId) {
     console.error('[Token Refresh] Missing organizationId or workspaceId');
     const error = new Error('Missing organizationId or workspaceId');
-    // Call onError if provided, check return value before proceeding
-    if (authContext?.onError) {
-      const shouldProceed = authContext.onError(error);
-      if (!shouldProceed) {
-        return null;
-      }
-    }
+    // Inform the host (informational only — we no longer auto-navigate; the
+    // component surfaces a terminal "session expired" screen instead).
+    authContext?.onError?.(error);
     signOutPrivacyCenter();
-    redirectToSignIn(orgSlug, authContext?.onError);
+    notifySessionExpired();
     return null;
   }
 
-  // Use context refreshToken if provided, otherwise fall back to cookie
-  // If authContext is provided, prioritize its refreshToken (props mode)
-  // Otherwise, fall back to cookie (legacy mode)
-  let refreshTokenValue: string | null = null;
-
-  if (authContext) {
-    // Props mode: use refreshToken from context
-    refreshTokenValue = authContext.refreshToken || null;
-  } else {
-    // Legacy mode: use refreshToken from cookie
-    refreshTokenValue = getCookieValue('refresh_token');
-  }
+  // Resolve the refresh token (props mode → context, legacy mode → storage) via
+  // the shared helper so the value matches what the circuit breaker keyed on.
+  const refreshTokenValue: string | null = getActiveRefreshToken(authContext);
 
   // Validate refreshToken is a non-empty string
   if (!refreshTokenValue || typeof refreshTokenValue !== 'string' || refreshTokenValue.trim() === '') {
     // No refresh token available - user needs to sign in again
+    // Log presence only — never the raw token, which would leak a credential to
+    // browser log collectors.
     console.warn('[Token Refresh] No valid refresh token available', {
       hasAuthContext: !!authContext,
-      refreshTokenFromContext: authContext?.refreshToken,
-      refreshTokenFromCookie: getCookieValue('refresh_token'),
+      hasRefreshTokenInContext: !!authContext?.refreshToken?.trim(),
+      hasRefreshTokenInStorage: !!getStoredRefreshToken(),
     });
     const error = new Error('No refresh token available');
-    // Call onError if provided, check return value before proceeding
-    if (authContext?.onError) {
-      const shouldProceed = authContext.onError(error);
-      if (!shouldProceed) {
-        return null;
-      }
-    }
+    // Inform the host (informational only — we no longer auto-navigate).
+    authContext?.onError?.(error);
     signOutPrivacyCenter();
-    redirectToSignIn(orgSlug, authContext?.onError);
+    notifySessionExpired();
     return null;
   }
 
@@ -478,16 +649,12 @@ const performTokenRefresh = async (
         // Validate the new token is not expired before storing
         if (isJwtExpired(newAccessToken, TOKEN_EXPIRY_BUFFER_SECONDS)) {
           console.error('[Token Refresh] New access token is already expired');
+          markRefreshTokenDead(refreshToken);
           const error = new Error('New access token is already expired');
-          // Call onError if provided, check return value before proceeding
-          if (authContext?.onError) {
-            const shouldProceed = authContext.onError(error);
-            if (!shouldProceed) {
-              return null;
-            }
-          }
+          // Inform the host (informational only — we no longer auto-navigate).
+          authContext?.onError?.(error);
           signOutPrivacyCenter();
-          redirectToSignIn(orgSlug, authContext?.onError);
+          notifySessionExpired();
           return null;
         }
 
@@ -501,63 +668,46 @@ const performTokenRefresh = async (
           }
         }
 
+        // Success — re-arm the circuit breaker so future failures are tracked afresh.
+        resetRefreshCircuit();
         // Return the new access token directly (already stored in sessionStorage/context)
         return newAccessToken;
       } else {
         // No access token in response - refresh failed
         console.error('[Token Refresh] Response missing access token');
+        markRefreshTokenDead(refreshToken);
         const error = new Error('Response missing access token');
-        // Call onError if provided, check return value before proceeding
-        if (authContext?.onError) {
-          const shouldProceed = authContext.onError(error);
-          if (!shouldProceed) {
-            return null;
-          }
-        }
+        // Inform the host (informational only — we no longer auto-navigate).
+        authContext?.onError?.(error);
         signOutPrivacyCenter();
-        redirectToSignIn(orgSlug, authContext?.onError);
+        notifySessionExpired();
         return null;
       }
     } else {
-      // Refresh token expired/revoked or server returned failure
+      // Refresh token expired/revoked or server returned failure - terminal.
+      markRefreshTokenDead(refreshToken);
       const error = new Error('Refresh token expired or revoked');
-      // Call onError if provided, check return value before proceeding
-      if (authContext?.onError) {
-        const shouldProceed = authContext.onError(error);
-        if (!shouldProceed) {
-          return null;
-        }
-      }
+      // Inform the host (informational only — we no longer auto-navigate).
+      authContext?.onError?.(error);
       signOutPrivacyCenter();
-      redirectToSignIn(orgSlug, authContext?.onError);
+      notifySessionExpired();
       return null;
     }
   } catch (error: any) {
-    const errorMessage = error?.message || '';
-    const isRefreshTokenExpired =
-      errorMessage.includes('revoked') ||
-      errorMessage.includes('expired') ||
-      errorMessage.includes('Refresh token') ||
-      errorMessage.includes('Invalid refresh token') ||
-      errorMessage.includes('401') ||
-      errorMessage.includes('Unauthorized');
-
-    if (isRefreshTokenExpired) {
-      // Refresh token is expired/revoked - expected scenario
+    if (isTerminalRefreshError(error)) {
+      // Terminal: refresh token expired / not found / already used / 4xx. Trip the
+      // breaker so this dead token is never re-submitted, then surface the
+      // session-expired screen (onError is informational; we no longer navigate).
+      markRefreshTokenDead(refreshToken);
       const err = new Error('Refresh token expired or revoked');
-      // Call onError if provided, check return value before proceeding
-      if (authContext?.onError) {
-        const shouldProceed = authContext.onError(err);
-        if (!shouldProceed) {
-          return null;
-        }
-      }
+      authContext?.onError?.(err);
       signOutPrivacyCenter();
-      redirectToSignIn(orgSlug, authContext?.onError);
+      notifySessionExpired();
       return null;
     }
 
-    // For other errors (network, etc.), log but don't clear auth state
+    // Transient (network / 5xx): keep auth state, back off, and let a later call retry.
+    noteTransientRefreshFailure();
     console.error('[Token Refresh] Unexpected error:', error);
     // Still call onError for unexpected errors
     if (authContext?.onError) {
@@ -568,30 +718,6 @@ const performTokenRefresh = async (
   }
 };
 
-/**
- * Helper to redirect to sign-in page
- */
-const redirectToSignIn = (slug?: string, onError?: (error: Error) => boolean): void => {
-  if (typeof window === 'undefined') return;
-
-  // If onError is provided, call it and check return value
-  if (onError) {
-    const error = new Error('Authentication failed - redirecting to sign-in');
-    const shouldProceed = onError(error);
-    if (!shouldProceed) {
-      // User wants to handle navigation themselves
-      return;
-    }
-  }
-
-  const orgSlug = slug || sessionStorage.getItem('pc_org_slug') || '';
-  if (orgSlug) {
-    window.location.href = `/privacy-center/${orgSlug}/sign-in`;
-  } else {
-    window.location.href = '/privacy-center';
-  }
-};
-
 // Activity helper functions
 
 export type ActivityBadgeStatus =

package/src/RedactoPrivacyCenter/locales/as/translation.json

@@ -184,6 +184,8 @@
   "noData": "ডেটা নাই",
   "noDataTitle": "এতিয়ালৈকে দেখুৱাবলৈ একো নাই",
   "noDataDescription": "আপোনাৰ একাউণ্টৰ সৈতে সংযুক্ত কোনো সন্মতি, অনুৰোধ বা কাৰ্য্যাৱলী আমি এতিয়ালৈকে বিচাৰি পোৱা নাই। উপলব্ধ হোৱাৰ লগে লগে আপোনাৰ গোপনীয়তা ৰেকৰ্ডসমূহ ইয়াত দেখা যাব।",
+  "sessionExpiredTitle": "আপোনাৰ ছেচন শেষ হৈছে",
+  "sessionExpiredDescription": "অব্যাহত ৰাখিবলৈ অনুগ্ৰহ কৰি পুনৰ ছাইন ইন কৰক।",
   "rowsPerPage": "পৃষ্ঠাত শাৰী:",
   "pageOf": "পৃষ্ঠা {{current}} / {{total}}",
   "rowsSelected": "{{total}}-ৰ {{count}} শাৰী নিৰ্বাচিত",

package/src/RedactoPrivacyCenter/locales/bho/translation.json

@@ -184,6 +184,8 @@
   "noData": "कोनो डेटा नै",
   "noDataTitle": "अबहीं देखावे खातिर कुछ नइखे",
   "noDataDescription": "रउरा खाता से जुड़ल कवनो सहमति, अनुरोध, या गतिविधि अबहीं तक ना मिलल। रउरा गोपनीयता रिकॉर्ड उपलब्ध होते ई इहाँ देखाई दिही।",
+  "sessionExpiredTitle": "रउआ के सत्र खतम हो गइल बा",
+  "sessionExpiredDescription": "जारी रखे खातिर कृपया फेर से साइन इन करीं।",
   "rowsPerPage": "पृष्ठ प्रति पंक्ति:",
   "pageOf": "पृष्ठ {{current}} / {{total}}",
   "rowsSelected": "{{total}} में से {{count}} पंक्ति चुनल गइल",

package/src/RedactoPrivacyCenter/locales/bn/translation.json

@@ -184,6 +184,8 @@
   "noData": "কোনো ডেটা নেই",
   "noDataTitle": "এখনো দেখানোর মতো কিছু নেই",
   "noDataDescription": "আপনার অ্যাকাউন্টের সাথে সম্পর্কিত কোনো সম্মতি, অনুরোধ বা ক্রিয়াকলাপ আমরা এখনো খুঁজে পাইনি। উপলব্ধ হওয়ার সাথে সাথেই আপনার গোপনীয়তা রেকর্ডগুলি এখানে প্রদর্শিত হবে।",
+  "sessionExpiredTitle": "আপনার সেশন মেয়াদ শেষ হয়ে গেছে",
+  "sessionExpiredDescription": "চালিয়ে যেতে অনুগ্রহ করে আবার সাইন ইন করুন।",
   "rowsPerPage": "প্রতি পৃষ্ঠায় সারি:",
   "pageOf": "পৃষ্ঠা {{current}} / {{total}}",
   "rowsSelected": "{{total}}-এর মধ্যে {{count}} সারি নির্বাচিত",

package/src/RedactoPrivacyCenter/locales/brx/translation.json

@@ -184,6 +184,8 @@
   "noData": "डेटा नंगौ",
   "noDataTitle": "दानो दिनथिनो थाखाय जेबो गैया",
   "noDataDescription": "दानो सम नोंथांनि एकाउन्टजों सोमोन्दो थानाय जेबो सहमति, हाबाय एबा खामानि जों मोननो हायाखै। नोंथांनि गोपनीयथा रिकर्डफोर मोननो हानाय बादि बेयावनो दिनथिजागोन।",
+  "sessionExpiredTitle": "नोंथांनि सेसन जोबबाय",
+  "sessionExpiredDescription": "सालायनो थाखाय अननानै फिन साइन इन खालाम।",
   "rowsPerPage": "पृष्ठनि पंक्ति:",
   "pageOf": "पृष्ठ {{current}} / {{total}}",
   "rowsSelected": "{{total}} निफ्राय {{count}} पंक्ति सायख 'खै",

package/src/RedactoPrivacyCenter/locales/doi/translation.json

@@ -184,6 +184,8 @@
   "noData": "कोनो डेटा नै",
   "noDataTitle": "अजें दिक्खाने आस्तै किछ नेईं",
   "noDataDescription": "तुंदे खाते कन्नै जुड़ी दी कोई बी सहमति, बेनती जां गतिविधि अजें तक नेईं मिली। तुंदे गोपनीयता रिकॉर्ड उपलब्ध होंदे गै इत्थें दिक्खने गी मिलङन।",
+  "sessionExpiredTitle": "तुंदा सत्र खतम होई गेआ ऐ",
+  "sessionExpiredDescription": "जारी रक्खने आस्तै कृपा करियै फिरी साइन इन करो।",
   "rowsPerPage": "पृष्ठ प्रति पंक्ति:",
   "pageOf": "पृष्ठ {{current}} / {{total}}",
   "rowsSelected": "{{total}} मध्ये {{count}} पंक्ति चुनल गेल",

package/src/RedactoPrivacyCenter/locales/en/translation.json

@@ -138,6 +138,9 @@
   "activities": "Activities",
   "activitiesSubtitle": "View your privacy center activity history",
   "activity": "Activity",
+  "allCaughtUp": "You're all caught up",
+  "noActivitiesYet": "No activity yet",
+  "noActivitiesDescription": "Your privacy center activity will appear here as it happens.",
   "myReceipt": "My Receipt",
   "myReceiptSubtitle": "View your consent receipts",
   "event": "Event",
@@ -197,6 +200,8 @@
   "noData": "No Data",
   "noDataTitle": "Nothing to show yet",
   "noDataDescription": "We couldn't find any consents, requests, or activity linked to your account yet. Your privacy records will appear here once they're available.",
+  "sessionExpiredTitle": "Your session has expired",
+  "sessionExpiredDescription": "Please sign in again to continue.",
   "rowsPerPage": "Rows per page:",
   "pageOf": "Page {{current}} of {{total}}",
   "rowsSelected": "{{count}} of {{total}} row(s) selected",

package/src/RedactoPrivacyCenter/locales/gom/translation.json

@@ -184,6 +184,8 @@
   "noData": "डेटा ना",
   "noDataTitle": "अजून दाखोवपाक कांय ना",
   "noDataDescription": "तुमच्या खात्याकडेन जोडिल्ली कसलीच संमती, मागण्यो वा कृती आमकां अजून मेळूंक नात. उपलब्ध जातकच तुमच्यो गोपनीयता नोंदी हांगा दिसतल्यो.",
+  "sessionExpiredTitle": "तुमचें सत्र सोंपलां",
+  "sessionExpiredDescription": "फुडें वचपाक उपकार करून परतून साइन इन करात.",
   "rowsPerPage": "पानाक पंक्ती:",
   "pageOf": "पान {{current}} / {{total}}",
   "rowsSelected": "{{total}} मध्ये {{count}} पंक्ती निवडली",

package/src/RedactoPrivacyCenter/locales/gu/translation.json

@@ -184,6 +184,8 @@
   "noData": "ડેટા નથી",
   "noDataTitle": "હજુ સુધી બતાવવા માટે કંઈ નથી",
   "noDataDescription": "તમારા ખાતા સાથે જોડાયેલી કોઈ સંમતિઓ, વિનંતીઓ અથવા પ્રવૃત્તિ અમને હજુ સુધી મળી નથી. તમારા ગોપનીયતા રેકોર્ડ ઉપલબ્ધ થતાં જ અહીં દેખાશે.",
+  "sessionExpiredTitle": "તમારું સત્ર સમાપ્ત થઈ ગયું છે",
+  "sessionExpiredDescription": "ચાલુ રાખવા માટે કૃપા કરીને ફરીથી સાઇન ઇન કરો.",
   "rowsPerPage": "દર પૃષ્ઠ પંક્તિઓ:",
   "pageOf": "પૃષ્ઠ {{current}} / {{total}}",
   "rowsSelected": "{{total}} માંથી {{count}} પંક્તિ પસંદ",