@redacto.io/consent-sdk-react 9.5.0-beta.0 → 10.0.0-beta.0

package/src/RedactoNoticeConsent/api/types.ts

@@ -19,6 +19,38 @@ export type DataElementSelection = {
   required: boolean;
 };
 
+// ─── Ledger notice check-consent ────────────────────────────────────────────
+// Mirrors the Go ledger's `NoticeConsentStatusResponse`. Used to overlay the
+// banner's prior-consent / reconsent state from the ledger, since Python's
+// notice-validation overlay is empty after the consent cutover.
+export type NoticeConsentStatusDataElement = {
+  uuid: string;
+  name: string;
+  selected: boolean;
+};
+
+export type NoticeConsentStatusPurpose = {
+  uuid: string;
+  name: string;
+  selected: boolean;
+  status: string; // ACTIVE | EXPIRED | WITHDRAW | DECLINED | INACTIVE
+  expiry_datetime?: string | null;
+  data_elements: NoticeConsentStatusDataElement[];
+};
+
+export type NoticeConsentStatusResponse = {
+  consented: boolean;
+  all_mandatory_active: boolean;
+  purposes: NoticeConsentStatusPurpose[];
+};
+
+export type FetchNoticeConsentStatusParams = {
+  accessToken: string;
+  ledgerBaseUrl: string;
+  noticeUuid: string;
+  signal?: AbortSignal;
+};
+
 export type ConsentContent = {
   code: number;
   status: string;
@@ -198,7 +230,7 @@ export type Purpose = {
 
 export type SubmitConsentEventParams = {
   accessToken: string;
-  baseUrl?: string;
+  ledgerBaseUrl: string;
   noticeUuid: string;
   purposes: Array<Purpose>;
   declined: boolean;

package/src/RedactoNoticeConsent/types.ts

@@ -5,6 +5,7 @@ export type Props = Readonly<{
   accessToken: string;
   refreshToken: string;
   baseUrl?: string;
+  ledgerBaseUrl: string;
   settings?: Partial<Settings>;
   language?: string;
   blockUI?: boolean;

package/src/RedactoNoticeConsentInline/RedactoNoticeConsentInline.tsx

@@ -12,6 +12,7 @@ const RedactoConsentInlineComponent = ({
   notice_uuid,
   accessToken,
   baseUrl,
+  ledgerBaseUrl,
   language = "en",
   onAccept,
   onError,
@@ -319,7 +320,7 @@ const RedactoConsentInlineComponent = ({
           org_uuid,
           workspace_uuid,
           accessToken: tokenToUse,
-          baseUrl,
+          ledgerBaseUrl,
           noticeUuid: content.notice_uuid,
           purposes: content.purposes.map((purpose) => {
             // Check if any required data element is selected
@@ -382,6 +383,7 @@ const RedactoConsentInlineComponent = ({
       org_uuid,
       workspace_uuid,
       baseUrl,
+      ledgerBaseUrl,
       selectedDataElements,
       selectedPurposes,
       applicationId,

package/src/RedactoNoticeConsentInline/api/index.ts

@@ -47,13 +47,16 @@ export const submitConsentEvent = async ({
   org_uuid,
   workspace_uuid,
   accessToken,
-  baseUrl,
+  ledgerBaseUrl,
   noticeUuid,
   purposes,
   declined,
   meta_data,
 }: SubmitConsentEventParams): Promise<void> => {
-  const apiBaseUrl = baseUrl || BASE_URL;
+  if (!ledgerBaseUrl) {
+    throw new Error("ledgerBaseUrl is required to submit consent");
+  }
+  const apiBaseUrl = ledgerBaseUrl;
 
   const payload: ConsentEventPayload = {
     notice_uuid: noticeUuid,

package/src/RedactoNoticeConsentInline/api/types.ts

@@ -172,7 +172,7 @@ export type SubmitConsentEventParams = {
   org_uuid: string;
   workspace_uuid: string;
   accessToken: string;
-  baseUrl?: string;
+  ledgerBaseUrl: string;
   noticeUuid: string;
   purposes: Array<Purpose>;
   declined: boolean;

package/src/RedactoNoticeConsentInline/types.ts

@@ -8,6 +8,7 @@ export type Props = Readonly<{
   accessToken?: string;
   refreshToken?: string;
   baseUrl?: string;
+  ledgerBaseUrl: string;
   settings?: Partial<Settings>;
   language?: string;
   onAccept?: () => void;

package/src/RedactoPrivacyCenter/RedactoPrivacyCenter.tsx

@@ -15,6 +15,7 @@ injectPCStyles();
 
 interface RedactoPrivacyCenterProps {
   baseUrl: string; // Consent server base URL
+  ledgerBaseUrl: string; // Go ledger base URL — serves user-consents
   slug: string;
   accessToken: string;
   refreshToken: string;
@@ -25,6 +26,7 @@ interface RedactoPrivacyCenterProps {
 
 export function RedactoPrivacyCenter({
   baseUrl,
+  ledgerBaseUrl,
   slug,
   accessToken,
   refreshToken,
@@ -35,7 +37,7 @@ export function RedactoPrivacyCenter({
   return (
     <I18nextProvider i18n={i18n}>
       <BrandingProvider slug={slug} baseUrl={baseUrl}>
-        <BaseUrlProvider baseUrl={baseUrl}>
+        <BaseUrlProvider baseUrl={baseUrl} ledgerBaseUrl={ledgerBaseUrl}>
           <AuthProvider
             accessToken={accessToken}
             refreshToken={refreshToken}

package/src/RedactoPrivacyCenter/api/actions.ts

@@ -351,6 +351,8 @@ export async function manageConsentServer(params: {
   nominatorContact?: string;
   dataElementUuids?: string[];
   productUuid?: string;
+  noticeUuid?: string;
+  dataElements?: Array<{ uuid: string; selected: boolean }>;
 }): Promise<boolean | null> {
   try {
     if (!params.consentClient) {
@@ -359,7 +361,10 @@ export async function manageConsentServer(params: {
     // Privacy center endpoints use JWT Bearer tokens, not session-based auth
     const baseRequest = buildBaseRequest(params.organizationId, params.workspaceId, params.authToken);
 
-    const result = await params.consentClient.manageConsent(
+    // Routes to the Go ledger's submit-consent (partial); resolves on 2xx and
+    // throws otherwise, so a resolved call is success. The ledger returns a
+    // ConsentEventResponse (no `success` flag), unlike the old Python endpoint.
+    await params.consentClient.manageConsent(
       baseRequest,
       params.purposeId,
       params.contact,
@@ -368,9 +373,11 @@ export async function manageConsentServer(params: {
       undefined,
       params.nominatorContact,
       params.dataElementUuids,
-      params.productUuid
+      params.productUuid,
+      params.noticeUuid,
+      params.dataElements
     );
-    return (result as { success: boolean })?.success ?? null;
+    return true;
   } catch (error: any) {
     // Normalize nominator-specific errors into stable error codes
     const errorMsg = error?.message || '';

package/src/RedactoPrivacyCenter/api/client.ts

@@ -23,9 +23,15 @@ export type BaseRequest = {
 /**
  * Consent service client factory.
  * Creates a client instance with a specific base URL.
- * @param baseUrl - Consent server base URL
+ * @param baseUrl - Consent server base URL (Python service, e.g. http://host/consent)
+ * @param ledgerBaseUrl - Go ledger base URL (e.g. http://host:8090/consent-ledger).
+ *   Used for user-consents reads which are served from the ledger's `/public/...` paths.
  */
-export function createConsentClient(baseUrl: string) {
+export function createConsentClient(baseUrl: string, ledgerBaseUrl: string) {
+  if (!ledgerBaseUrl) {
+    throw new Error("ledgerBaseUrl is required to create the consent client");
+  }
+  const ledgerBase = ledgerBaseUrl.replace(/\/$/, "");
   /**
    * Privacy Center API fetch wrapper that uses Authorization: Bearer header.
    * Privacy center endpoints require JWT tokens in Authorization header, not X-Auth-Token.
@@ -170,6 +176,10 @@ export function createConsentClient(baseUrl: string) {
     return `${baseUrl}/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}/dsar/privacy-center${path}`;
   }
 
+  function ledgerUrl(baseRequest: BaseRequest, path: string): string {
+    return `${ledgerBase}/public/organisations/${baseRequest.organisationUuid}/workspaces/${baseRequest.workspaceUuid}${path}`;
+  }
+
   function caseUrl(baseRequest: BaseRequest, caseUuid: string, path = ''): string {
     return privacyCenterUrl(baseRequest, `/cases/${caseUuid}${path}`);
   }
@@ -373,7 +383,8 @@ export function createConsentClient(baseUrl: string) {
       if (params.product_uuid) queryParams.append("product_uuid", params.product_uuid);
       if (params.language) queryParams.append("language", params.language);
       const queryString = queryParams.toString();
-      const url = privacyCenterUrl(baseRequest, `/user-consents${queryString ? `?${queryString}` : ""}`);
+      const suffix = `/user-consents${queryString ? `?${queryString}` : ""}`;
+      const url = ledgerUrl(baseRequest, suffix);
       return privacyCenterApiFetch(url, {
         ...options,
         method: "GET",
@@ -408,10 +419,8 @@ export function createConsentClient(baseUrl: string) {
       if (params.language) queryParams.append("language", params.language);
       if (params.nominator_uuid) queryParams.append("nominator_uuid", params.nominator_uuid);
       const queryString = queryParams.toString();
-      const url = privacyCenterUrl(
-        baseRequest,
-        `/user-consents/${productUuid}/purposes${queryString ? `?${queryString}` : ""}`
-      );
+      const suffix = `/user-consents/${productUuid}/purposes${queryString ? `?${queryString}` : ""}`;
+      const url = ledgerUrl(baseRequest, suffix);
       return privacyCenterApiFetch(url, {
         ...options,
         method: "GET",
@@ -421,7 +430,16 @@ export function createConsentClient(baseUrl: string) {
     },
 
     /**
-     * Manage consent (privacy center) - revoke, regrant, or renew
+     * Manage consent (privacy center) - revoke, regrant, or renew.
+     *
+     * The Go ledger has no manage-consent route, so this is expressed as a
+     * `partial` submit-consent on the ledger — mirroring the Python dual-write
+     * relay (`build_consent_management_payload`): the affected purpose is
+     * re-submitted with `selected: false` to revoke or `selected: true` to
+     * regrant/renew, and `partial: true` so the rest of the notice's purposes
+     * are left untouched. The principal is resolved from the JWT, so no
+     * `contact`/identifiers are sent in the body, and `consent_event_uuid` is
+     * omitted so the ledger mints a fresh event.
      */
     async manageConsent(
       baseRequest: BaseRequest,
@@ -432,19 +450,44 @@ export function createConsentClient(baseUrl: string) {
       options?: Omit<ApiFetchOptions, "getAuthToken">,
       nominatorContact?: string,
       dataElementUuids?: string[],
-      productUuid?: string
+      productUuid?: string,
+      noticeUuid?: string,
+      dataElements?: Array<{ uuid: string; selected: boolean }>
     ): Promise<unknown> {
-      const url = privacyCenterUrl(baseRequest, `/manage-consent?status=${status}`);
-      const body: Record<string, unknown> = { purpose_uuid: purposeId, contact };
-      if (nominatorContact) {
-        body.nominator_contact = nominatorContact;
-      }
-      if (Array.isArray(dataElementUuids) && dataElementUuids.length > 0) {
-        body.data_element_uuids = dataElementUuids;
-      }
-      if (productUuid) {
-        body.product_uuid = productUuid;
+      if (!noticeUuid) {
+        throw new Error("notice_uuid is required to manage consent via the ledger");
       }
+      const purposeSelected = status !== 'revoke';
+      const elements = (dataElements ?? []).map((de) => {
+        let selected: boolean;
+        if (status === 'revoke') {
+          selected = false;
+        } else if (status === 'regrant') {
+          // Only the data elements the user chose to re-grant become selected.
+          selected = Array.isArray(dataElementUuids)
+            ? dataElementUuids.includes(de.uuid)
+            : de.selected;
+        } else {
+          // renew — preserve the currently-granted set.
+          selected = de.selected;
+        }
+        return { uuid: de.uuid, selected };
+      });
+      const body = {
+        notice_uuid: noticeUuid,
+        partial: true,
+        declined: false,
+        select_all_mandatory: false,
+        self_declared_adult: false,
+        purposes: [
+          {
+            purpose_uuid: purposeId,
+            selected: purposeSelected,
+            data_elements: elements,
+          },
+        ],
+      };
+      const url = ledgerUrl(baseRequest, "/submit-consent");
       return privacyCenterApiFetch(url, {
         ...options,
         method: "POST",
@@ -504,7 +547,8 @@ export function createConsentClient(baseUrl: string) {
       if (params.created_before) queryParams.append("created_before", params.created_before);
       if (params.language) queryParams.append("language", params.language);
       const queryString = queryParams.toString();
-      const url = privacyCenterUrl(baseRequest, `/receipts${queryString ? `?${queryString}` : ""}`);
+      // Receipts are served by the Go ledger (paginated list under /public/...).
+      const url = ledgerUrl(baseRequest, `/receipts${queryString ? `?${queryString}` : ""}`);
       return privacyCenterApiFetch<unknown>(url, {
         ...options,
         method: "GET",
@@ -524,7 +568,9 @@ export function createConsentClient(baseUrl: string) {
       receiptUuid: string,
       authToken?: string
     ): Promise<Blob> {
-      const url = privacyCenterUrl(baseRequest, `/receipts/${receiptUuid}/pdf`);
+      // The ledger serves the receipt PDF at /receipts/{uuid}/download; the
+      // receipt_uuid comes from the ledger list above, so both must be the ledger.
+      const url = ledgerUrl(baseRequest, `/receipts/${receiptUuid}/download`);
       const token = resolveAuthToken(authToken, baseRequest);
       const requestHeaders = new Headers();
       requestHeaders.set("Accept", "application/pdf");

package/src/RedactoPrivacyCenter/components/ConsentManager.tsx

@@ -754,6 +754,15 @@ export default function ConsentManager({ variant }: ConsentManagerProps) {
       };
 
       try {
+        // The ledger's submit-consent needs the notice the purpose was consented
+        // under, plus the purpose's data elements with their current selected
+        // state — both live on the loaded consent record (selectedRecord).
+        const noticeUuid = selectedRecord?.notice_uuid ?? undefined;
+        const dataElements = (selectedRecord?.data_elements ?? []).map((el) => ({
+          uuid: el.uuid,
+          selected: el.selected,
+        }));
+
         const response = await manageConsent({
           organizationId,
           workspaceId,
@@ -765,6 +774,8 @@ export default function ConsentManager({ variant }: ConsentManagerProps) {
           nominatorContact,
           dataElementUuids,
           productUuid,
+          noticeUuid,
+          dataElements,
         });
 
         if (response) {
@@ -787,7 +798,7 @@ export default function ConsentManager({ variant }: ConsentManagerProps) {
         handleCloseModal();
       }
     },
-    [organizationId, workspaceId, contact, fetchData, handleCloseModal, t, authContext, consentClient]
+    [organizationId, workspaceId, contact, fetchData, handleCloseModal, t, authContext, consentClient, selectedRecord]
   );
 
   const getVar = (varName: string): string => `var(${varName})`;

package/src/RedactoPrivacyCenter/components/Form.tsx

@@ -10,9 +10,10 @@ import { PiUploadBold } from 'react-icons/pi';
 import { toast } from '../utils/toast';
 import { PCButton, PCCheckbox, PCInput, PCLoader, PCSelect, PCText, PCTextarea } from '../ui';
 import { PCModal } from '../ui/PCModal';
-import { buildGroupDataElements, buildGroupPurposes } from './groupHelpers';
+import { buildGroupDataElements, buildGroupPurposes, consentGroupToFormProductGroup } from './groupHelpers';
 import { pcStyles } from '../styles/pcStyles';
-import { createCaseRequest, getFormData } from '../lib/api';
+import { createCaseRequest, fetchUserConsents, getFormData } from '../lib/api';
+import { FORM_PICKER_GROUP_LIMIT } from '../lib/constants';
 import { ensureValidToken } from '../lib/utils';
 import { useAuth } from '../context/AuthContext';
 import { useBaseUrl } from '../context/BaseUrlContext';
@@ -274,6 +275,53 @@ export default function Form({
     [],
   );
 
+  // Approach A: source the DSAR request-form product picker from the Go
+  // ledger's user-consents. After the consent cutover, consents live in the
+  // ledger, so Python's form/data returns no product groups; we overlay the
+  // ledger's product-grouped consents onto the form data instead. Only the
+  // end-user privacy-center path is eligible — popup / case-management resolve
+  // an arbitrary contact, which the JWT-scoped ledger endpoint cannot serve,
+  // so those keep the Python form/data groups. Returns the form data unchanged
+  // when ineligible or when the ledger read fails (graceful fallback to
+  // whatever groups form/data supplied).
+  const withLedgerPickerGroups = useCallback(
+    async (form: FormData, language?: string): Promise<FormData> => {
+      if (isPopup || isCaseManagementContext || !organizationId || !workspaceId) {
+        return form;
+      }
+      const consents = await fetchUserConsents({
+        organizationId,
+        workspaceId,
+        authContext,
+        consentClient,
+        // No status filter: include every status (active / expired / withdrawn
+        // / declined), matching Python form/data, so a DSAR can target products
+        // the user no longer actively consents to.
+        limit: FORM_PICKER_GROUP_LIMIT,
+        nominatedLimit: FORM_PICKER_GROUP_LIMIT,
+        language,
+      });
+      if (!consents) {
+        return form;
+      }
+      return {
+        ...form,
+        direct_groups: (consents.direct ?? []).map(consentGroupToFormProductGroup),
+        nominated_groups: (consents.nominated ?? []).map(
+          consentGroupToFormProductGroup,
+        ),
+      };
+    },
+    [
+      isPopup,
+      isCaseManagementContext,
+      organizationId,
+      workspaceId,
+      authContext,
+      consentClient,
+    ],
+  );
+
   const fetchAndApplyTranslations = useCallback(async (langValue: string) => {
     if (!organizationId || !workspaceId || !data) {
       return;
@@ -314,7 +362,7 @@ export default function Form({
         return;
       }
 
-      setData(translatedFormData);
+      setData(await withLedgerPickerGroups(translatedFormData, langValue));
 
       if (translatedFormData.grievance_options) {
         const currentGrievanceSelections = { ...selectedGrievances };
@@ -333,7 +381,7 @@ export default function Form({
     } finally {
       setIsTranslating(false);
     }
-  }, [organizationId, workspaceId, data, formData.contact, isPopup, isCaseManagementContext, authContext, consentClient, selectedGrievances, t]);
+  }, [organizationId, workspaceId, data, formData.contact, isPopup, isCaseManagementContext, authContext, consentClient, selectedGrievances, t, withLedgerPickerGroups]);
 
   // Clear product / org-level selections when request type changes.
   // Per-product state (selectedPurposes, selectedCorrectionElements,
@@ -486,7 +534,11 @@ export default function Form({
           }
         }
 
-        setData(displayData);
+        const pickerData = await withLedgerPickerGroups(
+          displayData,
+          langParam || undefined,
+        );
+        setData(pickerData);
         setGrievanceOptions(displayData.grievance_options || []);
         const initialGrievances = (
           displayData.grievance_options || []
@@ -509,7 +561,7 @@ export default function Form({
     };
 
     void initializePrivacyCenterForm();
-  }, [organizationId, workspaceId, isPopup, authContext, consentClient]);
+  }, [organizationId, workspaceId, isPopup, authContext, consentClient, withLedgerPickerGroups]);
 
   /**
    * Maps translated correction element names back to English names using UUID lookup.

package/src/RedactoPrivacyCenter/components/groupHelpers.ts

@@ -1,4 +1,67 @@
-import type { DataElement, FormProductGroup, Purpose } from '../lib/types';
+import type {
+  ConsentDataElement,
+  ConsentGroup,
+  DataElement,
+  FormProductGroup,
+  Purpose,
+  PurposeItem,
+} from '../lib/types';
+
+/**
+ * Map a Go-ledger `ConsentGroup` (from the user-consents endpoint) onto the
+ * DSAR request form's `FormProductGroup`. Approach A: the request-form product
+ * picker is now sourced from the ledger instead of Python's `form/data`, since
+ * consents live in the ledger after the cutover.
+ *
+ * The shapes are near-identical; the only adaptations are:
+ * - purpose id rename: ledger `purpose_uuid` -> form `uuid` (which the picker
+ *   keys on and the submit payload sends back as `purpose_uuid`),
+ * - the ledger data-element's `selected` stands in for the form's
+ *   `given_consent`,
+ * - fields the picker never reads (industries, validity, descriptions) are
+ *   defaulted.
+ *
+ * NOTE: the ledger caps inline purposes at 50 per group (`has_more_purposes`).
+ * A product with more than 50 purposes would need the per-group purposes
+ * endpoint to assemble a complete CORRECTION data-element list (follow-up).
+ */
+export const consentGroupToFormProductGroup = (
+  group: ConsentGroup,
+): FormProductGroup => ({
+  product_uuid: group.product_uuid,
+  product_name: group.product_name,
+  product_description: group.product_description,
+  nominator: group.nominator,
+  purposes: (group.purposes ?? []).map(purposeItemToFormPurpose),
+});
+
+const purposeItemToFormPurpose = (purpose: PurposeItem): Purpose => ({
+  uuid: purpose.purpose_uuid,
+  purpose_uuid: purpose.purpose_uuid,
+  name: purpose.name,
+  description: purpose.description ?? '',
+  industries: '',
+  selected: false,
+  given_consent: false,
+  status: purpose.status,
+  validity: null,
+  enabled: true,
+  data_elements: (purpose.data_elements ?? []).map(
+    consentDataElementToFormDataElement,
+  ),
+});
+
+const consentDataElementToFormDataElement = (
+  element: ConsentDataElement,
+): DataElement => ({
+  uuid: element.uuid,
+  name: element.name,
+  description: '',
+  enabled: element.enabled,
+  required: element.required,
+  given_consent: element.selected,
+  selected: element.selected,
+});
 
 /**
  * Build the per-purpose state used by `PurposeSelectionSection` for a single

package/src/RedactoPrivacyCenter/context/BaseUrlContext.tsx

@@ -9,18 +9,24 @@ export const BaseUrlContext = createContext<BaseUrlContextValue | null>(null);
 export const BaseUrlProvider = ({
   children,
   baseUrl,
+  ledgerBaseUrl,
 }: {
   children: ReactNode;
   baseUrl: string; // Consent server base URL
+  ledgerBaseUrl: string; // Go ledger base URL — serves user-consents
 }) => {
-  const consentClient = useMemo(() => createConsentClient(baseUrl), [baseUrl]);
+  const consentClient = useMemo(
+    () => createConsentClient(baseUrl, ledgerBaseUrl),
+    [baseUrl, ledgerBaseUrl]
+  );
 
   const value: BaseUrlContextValue = useMemo(
     () => ({
       baseUrl,
+      ledgerBaseUrl,
       consentClient,
     }),
-    [baseUrl, consentClient]
+    [baseUrl, ledgerBaseUrl, consentClient]
   );
 
   return (

package/src/RedactoPrivacyCenter/context/types.ts

@@ -14,5 +14,6 @@ export type AuthContextValue = Readonly<{
 
 export type BaseUrlContextValue = Readonly<{
   baseUrl: string;
+  ledgerBaseUrl: string;
   consentClient: ReturnType<typeof createConsentClient>;
 }>;

package/src/RedactoPrivacyCenter/lib/api.ts

@@ -392,6 +392,8 @@ export const manageConsent = async ({
   nominatorContact,
   dataElementUuids,
   productUuid,
+  noticeUuid,
+  dataElements,
 }: {
   organizationId: string;
   workspaceId: string;
@@ -403,6 +405,8 @@ export const manageConsent = async ({
   nominatorContact?: string;
   dataElementUuids?: string[];
   productUuid?: string;
+  noticeUuid?: string;
+  dataElements?: Array<{ uuid: string; selected: boolean }>;
 }): Promise<boolean | null> => {
   try {
     // Ensure we have a valid token before making the API call
@@ -423,6 +427,8 @@ export const manageConsent = async ({
       nominatorContact,
       dataElementUuids,
       productUuid,
+      noticeUuid,
+      dataElements,
     });
     return result;
   } catch (error: any) {
@@ -445,6 +451,8 @@ export const manageConsent = async ({
         nominatorContact,
         dataElementUuids,
         productUuid,
+        noticeUuid,
+        dataElements,
       });
     }
     console.error(`Error ${action} consent:`, error);

package/src/RedactoPrivacyCenter/lib/constants.ts

@@ -196,6 +196,15 @@ export const MAX_REFRESH_BACKOFF_MS = 300_000; // 5m
 export const REFRESH_TOKEN_STORAGE_KEY = 'redacto_pc_refresh_token';
 export const LEGACY_REFRESH_TOKEN_COOKIE = 'refresh_token';
 
+// ─── DSAR request form ─────────────────────────────────────────────────────
+
+// Max product groups requested from the Go ledger's user-consents when
+// sourcing the DSAR request-form product picker (Approach A). The ledger caps
+// user-consents page size at 100; the picker needs all of a principal's
+// groups, so we request the max. A principal with >100 product groups would
+// need group-level pagination (follow-up).
+export const FORM_PICKER_GROUP_LIMIT = 100;
+
 // ─── Notification Hub ──────────────────────────────────────────────────────
 
 export const POLL_INTERVAL = 30_000;

package/src/RedactoPrivacyCenter/lib/types.ts

@@ -256,6 +256,10 @@ export type PurposeItem = {
   method: string;
   data_elements: ConsentDataElement[];
   link_reason: string | null;
+  // UUID of the notice version this purpose was consented under. Served by the
+  // Go ledger's user-consents response; required to revoke/regrant via the
+  // ledger's submit-consent endpoint (which has no manage-consent route).
+  notice_uuid: string | null;
 };
 
 export type ConsentGroup = {
@@ -405,9 +409,15 @@ export type Receipt = {
   created_at: string;
 };
 
+// Mirrors the Go ledger's `ConsentReceiptListResponse` (offset-paginated page
+// of the principal's receipts): flat `total`/`skip`/`limit`, not a nested
+// `pagination` object. `normalizeReceipts` in ReceiptsList tolerates either
+// envelope, but this type documents the ledger contract the SDK now calls.
 export type ReceiptListResponse = {
   data: Receipt[];
-  pagination: Pagination;
+  total: number;
+  skip: number;
+  limit: number;
 };
 
 export type ActivityResponse = {

package/tests/Form.test.tsx

@@ -98,9 +98,14 @@ vi.mock('../src/RedactoPrivacyCenter/lib/i18n', () => ({
 // 1-form -> 1-case: only `createCaseRequest` is consumed by Form.tsx now.
 const createCaseRequest = vi.fn();
 const getFormData = vi.fn();
+const fetchUserConsents = vi.fn();
 vi.mock('../src/RedactoPrivacyCenter/lib/api', () => ({
   createCaseRequest: (...args: unknown[]) => createCaseRequest(...args),
   getFormData: (...args: unknown[]) => getFormData(...args),
+  // Approach A sources the product picker from the ledger's user-consents.
+  // Default to no ledger result so the form falls back to the getFormData
+  // product groups these tests set up.
+  fetchUserConsents: (...args: unknown[]) => fetchUserConsents(...args),
 }));
 
 // ─── upload stub ─────────────────────────────────────────────────────────────