@redacto.io/consent-sdk-react 9.5.0-beta.0 → 10.0.0-beta.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redacto.io/consent-sdk-react",
-  "version": "9.5.0-beta.0",
+  "version": "10.0.0-beta.1",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
   "types": "dist/index.d.ts",

package/src/RedactoNoticeConsent/RedactoNoticeConsent.test.tsx

@@ -26,6 +26,11 @@ vi.mock("./api", () => ({
   fetchTTSAudioUrls: vi.fn(),
   initiateGuardianVerification: vi.fn(),
   verifyGuardianStatus: vi.fn(),
+  // Defaults to resolving undefined, so the ledger consent-state overlay is
+  // skipped and the banner falls back to the Python-provided values the
+  // existing tests assert on.
+  fetchNoticeConsentStatus: vi.fn(),
+  buildLedgerConsentOverlay: vi.fn(),
 }));
 
 // Mock jwt-decode

package/src/RedactoNoticeConsent/RedactoNoticeConsent.tsx

@@ -11,8 +11,10 @@ import React, { useCallback, useEffect, useMemo, useRef, useState } from "react"
 
 // API imports
 import {
+  buildLedgerConsentOverlay,
   clearApiCache,
   fetchConsentContent,
+  fetchNoticeConsentStatus,
   fetchTTSAudioUrls,
   initiateGuardianVerification,
   submitConsentEvent,
@@ -1296,6 +1298,7 @@ export const RedactoNoticeConsent = ({
   accessToken,
   refreshToken,
   baseUrl,
+  ledgerBaseUrl,
   language = "en",
   blockUI = true,
   onAccept,
@@ -1838,9 +1841,31 @@ export const RedactoNoticeConsent = ({
       );
       setCollapsedPurposes(initialCollapsedState);
 
-      // Initialize selected states - handle reconsent pre-population
-      const isReconsentRequired = consentContentData.detail.reconsent_required;
-      const purposeSelections = consentContentData.detail.purpose_selections;
+      // Initialize selected states - handle reconsent pre-population.
+      // Approach A: overlay the prior-consent / reconsent state from the Go
+      // ledger's check-consent. Consents live in the ledger post-cutover, so
+      // Python's notice-validation overlay is empty; the notice text/config
+      // still comes from Python (above). Falls back to the Python-provided
+      // values when the ledger is unavailable, and is skipped for the
+      // magic-link flow (specific_uuid), which pre-fills from a specific event.
+      let isReconsentRequired = consentContentData.detail.reconsent_required;
+      let purposeSelections = consentContentData.detail.purpose_selections;
+      if (ledgerBaseUrl && !applicationId) {
+        const ledgerStatus = await fetchNoticeConsentStatus({
+          accessToken,
+          ledgerBaseUrl,
+          noticeUuid: noticeId,
+          signal: abortControllerRef.current?.signal,
+        });
+        if (ledgerStatus) {
+          const overlay = buildLedgerConsentOverlay(
+            ledgerStatus,
+            activeConfig.purposes
+          );
+          isReconsentRequired = overlay?.reconsent_required ?? false;
+          purposeSelections = overlay?.purpose_selections;
+        }
+      }
 
       // Categorize purposes for reconsent UI
       const newCategorizedPurposes = isReconsentRequired
@@ -2121,6 +2146,7 @@ export const RedactoNoticeConsent = ({
         await submitConsentEvent({
           accessToken,
           baseUrl,
+          ledgerBaseUrl,
           noticeUuid: content.notice_uuid,
           purposes: content.purposes.map((purpose) => {
             // Check if this is an already-consented purpose that was modified

package/src/RedactoNoticeConsent/api/index.ts

@@ -3,10 +3,14 @@ import { parseApiError } from "../../shared/api-errors";
 import type {
   ConsentContent,
   ConsentEventPayload,
+  DataElementSelection,
   FetchConsentContentParams,
+  FetchNoticeConsentStatusParams,
   FetchTTSAudioUrlsParams,
   InitiateGuardianVerificationParams,
   InitiateGuardianVerificationResponse,
+  NoticeConsentStatusResponse,
+  PurposeSelection,
   RedactoJwtPayload,
   SubmitConsentEventParams,
   TTSAudioUrlsResponse,
@@ -128,6 +132,7 @@ export const fetchConsentContent = async ({
 export const submitConsentEvent = async ({
   accessToken,
   baseUrl,
+  ledgerBaseUrl,
   noticeUuid,
   purposes,
   declined,
@@ -151,7 +156,9 @@ export const submitConsentEvent = async ({
     throw new Error("Invalid token: missing organization or workspace UUID");
   }
 
-  const apiBaseUrl = baseUrl || BASE_URL;
+  // Fall back to the consent server when no ledger is configured, so existing
+  // integrations that only pass baseUrl remain backwards compatible.
+  const apiBaseUrl = ledgerBaseUrl || baseUrl || BASE_URL;
 
   const validatedPurposes = purposes.map((purpose) => {
     if (!purpose.uuid) {
@@ -209,6 +216,128 @@ export const submitConsentEvent = async ({
   apiCache.clear();
 };
 
+/**
+ * Fetch the principal's current consent status for a notice from the Go
+ * ledger (`check-consent`). The principal resolves from the JWT, so the body
+ * is empty. Returns null on any failure so the caller can fall back to the
+ * Python-provided overlay (graceful degradation). This is how the banner
+ * learns prior-consent / reconsent state post-cutover, since Python's notice
+ * validation reads its own (now-empty) consent DB.
+ */
+export const fetchNoticeConsentStatus = async ({
+  accessToken,
+  ledgerBaseUrl,
+  noticeUuid,
+  signal,
+}: FetchNoticeConsentStatusParams): Promise<NoticeConsentStatusResponse | null> => {
+  if (!accessToken || !ledgerBaseUrl || !noticeUuid) {
+    return null;
+  }
+
+  const decodedToken = decodeTokenSafely(accessToken);
+  if (!decodedToken) {
+    return null;
+  }
+
+  const { organisation_uuid: ORGANISATION_UUID, workspace_uuid: WORKSPACE_UUID } = decodedToken;
+  if (!ORGANISATION_UUID || !WORKSPACE_UUID) {
+    return null;
+  }
+
+  try {
+    const response = await fetch(
+      `${ledgerBaseUrl}/public/organisations/${ORGANISATION_UUID}/workspaces/${WORKSPACE_UUID}/notices/${noticeUuid}/check-consent`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          "Content-Type": "application/json",
+        },
+        body: "{}",
+        signal,
+      }
+    );
+
+    if (!response.ok) {
+      return null;
+    }
+
+    const data = (await response.json()) as
+      | NoticeConsentStatusResponse
+      | { detail?: NoticeConsentStatusResponse };
+    // The ledger returns the response directly; tolerate a {detail} envelope too.
+    const body =
+      data && typeof data === "object" && "detail" in data && data.detail
+        ? data.detail
+        : (data as NoticeConsentStatusResponse);
+
+    if (!body || !Array.isArray(body.purposes)) {
+      return null;
+    }
+    return body;
+  } catch {
+    // Network / abort / parse failure — degrade to the Python overlay.
+    return null;
+  }
+};
+
+/**
+ * Translate the ledger's notice consent status into the
+ * `{ purpose_selections, reconsent_required }` shape the banner already
+ * consumes, so prior-consent pre-fill and reconsent categorization work off
+ * the ledger. Returns null for a first-time principal (no consent record —
+ * every purpose INACTIVE), preserving the normal first-time consent flow.
+ *
+ * `needs_reconsent` is derived from `status` (anything not ACTIVE needs
+ * reconsent: expired / withdrawn / declined / inactive). NOTE: notice-version
+ * reconsent is NOT covered — the ledger's check-consent has no version
+ * awareness yet, so a republished-notice version bump won't re-prompt until
+ * that lands on the ledger (tracked fast-follow).
+ */
+export const buildLedgerConsentOverlay = (
+  status: NoticeConsentStatusResponse,
+  configPurposes: ConsentContent["detail"]["active_config"]["purposes"]
+): {
+  reconsent_required: boolean;
+  purpose_selections: Record<string, PurposeSelection>;
+} | null => {
+  const byUuid = new Map(status.purposes.map((p) => [p.uuid, p]));
+  const hasHistory = status.purposes.some(
+    (p) => (p.status || "INACTIVE") !== "INACTIVE"
+  );
+  if (!hasHistory) {
+    return null;
+  }
+
+  const purpose_selections: Record<string, PurposeSelection> = {};
+  for (const cp of configPurposes) {
+    const lp = byUuid.get(cp.uuid);
+    const purposeStatus = lp?.status || "INACTIVE";
+    const selectedByUuid = new Map(
+      (lp?.data_elements || []).map((de) => [de.uuid, de.selected])
+    );
+    const data_elements: Record<string, DataElementSelection> = {};
+    for (const de of cp.data_elements) {
+      data_elements[de.uuid] = {
+        selected: selectedByUuid.get(de.uuid) ?? false,
+        enabled: de.enabled,
+        required: de.required,
+      };
+    }
+    purpose_selections[cp.uuid] = {
+      selected: lp?.selected ?? false,
+      status: purposeStatus,
+      needs_reconsent: purposeStatus !== "ACTIVE",
+      data_elements,
+    };
+  }
+
+  const reconsent_required = configPurposes.some(
+    (cp) => (purpose_selections[cp.uuid]?.status || "INACTIVE") !== "ACTIVE"
+  );
+  return { reconsent_required, purpose_selections };
+};
+
 export const fetchTTSAudioUrls = async ({
   accessToken,
   baseUrl,

package/src/RedactoNoticeConsent/api/types.ts

@@ -19,6 +19,38 @@ export type DataElementSelection = {
   required: boolean;
 };
 
+// ─── Ledger notice check-consent ────────────────────────────────────────────
+// Mirrors the Go ledger's `NoticeConsentStatusResponse`. Used to overlay the
+// banner's prior-consent / reconsent state from the ledger, since Python's
+// notice-validation overlay is empty after the consent cutover.
+export type NoticeConsentStatusDataElement = {
+  uuid: string;
+  name: string;
+  selected: boolean;
+};
+
+export type NoticeConsentStatusPurpose = {
+  uuid: string;
+  name: string;
+  selected: boolean;
+  status: string; // ACTIVE | EXPIRED | WITHDRAW | DECLINED | INACTIVE
+  expiry_datetime?: string | null;
+  data_elements: NoticeConsentStatusDataElement[];
+};
+
+export type NoticeConsentStatusResponse = {
+  consented: boolean;
+  all_mandatory_active: boolean;
+  purposes: NoticeConsentStatusPurpose[];
+};
+
+export type FetchNoticeConsentStatusParams = {
+  accessToken: string;
+  ledgerBaseUrl?: string;
+  noticeUuid: string;
+  signal?: AbortSignal;
+};
+
 export type ConsentContent = {
   code: number;
   status: string;
@@ -199,6 +231,7 @@ export type Purpose = {
 export type SubmitConsentEventParams = {
   accessToken: string;
   baseUrl?: string;
+  ledgerBaseUrl?: string;
   noticeUuid: string;
   purposes: Array<Purpose>;
   declined: boolean;

package/src/RedactoNoticeConsent/types.ts

@@ -5,6 +5,7 @@ export type Props = Readonly<{
   accessToken: string;
   refreshToken: string;
   baseUrl?: string;
+  ledgerBaseUrl?: string;
   settings?: Partial<Settings>;
   language?: string;
   blockUI?: boolean;

package/src/RedactoNoticeConsentInline/RedactoNoticeConsentInline.tsx

@@ -12,6 +12,7 @@ const RedactoConsentInlineComponent = ({
   notice_uuid,
   accessToken,
   baseUrl,
+  ledgerBaseUrl,
   language = "en",
   onAccept,
   onError,
@@ -320,6 +321,7 @@ const RedactoConsentInlineComponent = ({
           workspace_uuid,
           accessToken: tokenToUse,
           baseUrl,
+          ledgerBaseUrl,
           noticeUuid: content.notice_uuid,
           purposes: content.purposes.map((purpose) => {
             // Check if any required data element is selected
@@ -382,6 +384,7 @@ const RedactoConsentInlineComponent = ({
       org_uuid,
       workspace_uuid,
       baseUrl,
+      ledgerBaseUrl,
       selectedDataElements,
       selectedPurposes,
       applicationId,

package/src/RedactoNoticeConsentInline/api/index.ts

@@ -48,12 +48,15 @@ export const submitConsentEvent = async ({
   workspace_uuid,
   accessToken,
   baseUrl,
+  ledgerBaseUrl,
   noticeUuid,
   purposes,
   declined,
   meta_data,
 }: SubmitConsentEventParams): Promise<void> => {
-  const apiBaseUrl = baseUrl || BASE_URL;
+  // Fall back to the consent server when no ledger is configured, so existing
+  // integrations that only pass baseUrl remain backwards compatible.
+  const apiBaseUrl = ledgerBaseUrl || baseUrl || BASE_URL;
 
   const payload: ConsentEventPayload = {
     notice_uuid: noticeUuid,

package/src/RedactoNoticeConsentInline/api/types.ts

@@ -173,6 +173,7 @@ export type SubmitConsentEventParams = {
   workspace_uuid: string;
   accessToken: string;
   baseUrl?: string;
+  ledgerBaseUrl?: string;
   noticeUuid: string;
   purposes: Array<Purpose>;
   declined: boolean;

package/src/RedactoNoticeConsentInline/types.ts

@@ -8,6 +8,7 @@ export type Props = Readonly<{
   accessToken?: string;
   refreshToken?: string;
   baseUrl?: string;
+  ledgerBaseUrl?: string;
   settings?: Partial<Settings>;
   language?: string;
   onAccept?: () => void;

package/src/RedactoPrivacyCenter/PrivacyCenterLayout.tsx

@@ -12,6 +12,7 @@ import { useAuth } from './context/AuthContext';
 import { PCLoader } from './ui';
 import { pcStyles } from './styles/pcStyles';
 import AppShell from './components/AppShell/AppShell';
+import { SelectUserGate } from './components/SelectUserGate';
 
 interface PrivacyCenterLayoutProps {
   children: ReactNode;
@@ -164,11 +165,13 @@ export function PrivacyCenterLayout({ children, slug, onBack }: PrivacyCenterLay
 
   return (
     <OrganizationProvider organization={organization}>
-      <DataAvailabilityProvider>
-        <AppShell onBack={onBack}>
-          {children}
-        </AppShell>
-      </DataAvailabilityProvider>
+      <SelectUserGate>
+        <DataAvailabilityProvider>
+          <AppShell onBack={onBack}>
+            {children}
+          </AppShell>
+        </DataAvailabilityProvider>
+      </SelectUserGate>
     </OrganizationProvider>
   );
 }

package/src/RedactoPrivacyCenter/RedactoPrivacyCenter.tsx

@@ -15,6 +15,7 @@ injectPCStyles();
 
 interface RedactoPrivacyCenterProps {
   baseUrl: string; // Consent server base URL
+  ledgerBaseUrl?: string; // Go ledger base URL — serves user-consents; omit to use the legacy Python privacy-center consent endpoints
   slug: string;
   accessToken: string;
   refreshToken: string;
@@ -25,6 +26,7 @@ interface RedactoPrivacyCenterProps {
 
 export function RedactoPrivacyCenter({
   baseUrl,
+  ledgerBaseUrl,
   slug,
   accessToken,
   refreshToken,
@@ -35,7 +37,7 @@ export function RedactoPrivacyCenter({
   return (
     <I18nextProvider i18n={i18n}>
       <BrandingProvider slug={slug} baseUrl={baseUrl}>
-        <BaseUrlProvider baseUrl={baseUrl}>
+        <BaseUrlProvider baseUrl={baseUrl} ledgerBaseUrl={ledgerBaseUrl}>
           <AuthProvider
             accessToken={accessToken}
             refreshToken={refreshToken}

package/src/RedactoPrivacyCenter/api/actions.ts

@@ -24,6 +24,7 @@ import type {
   GetCaseMessagesParams,
   MessageDocument,
   GetNotificationsServerParams,
+  LegacyManageConsentResponse,
   NotificationActionBaseParams,
   NotificationActionResponse,
   NotificationByUuidServerParams,
@@ -351,6 +352,8 @@ export async function manageConsentServer(params: {
   nominatorContact?: string;
   dataElementUuids?: string[];
   productUuid?: string;
+  noticeUuid?: string;
+  dataElements?: Array<{ uuid: string; selected: boolean }>;
 }): Promise<boolean | null> {
   try {
     if (!params.consentClient) {
@@ -359,6 +362,11 @@ export async function manageConsentServer(params: {
     // Privacy center endpoints use JWT Bearer tokens, not session-based auth
     const baseRequest = buildBaseRequest(params.organizationId, params.workspaceId, params.authToken);
 
+    // Ledger mode routes to the Go ledger's submit-consent (partial), which
+    // resolves on 2xx and throws otherwise — a resolved call is success (the
+    // ledger returns a ConsentEventResponse, no `success` flag). Legacy mode
+    // hits the Python manage-consent endpoint, whose unwrapped response
+    // carries a `success` flag that must be honored even on 2xx.
     const result = await params.consentClient.manageConsent(
       baseRequest,
       params.purposeId,
@@ -368,9 +376,14 @@ export async function manageConsentServer(params: {
       undefined,
       params.nominatorContact,
       params.dataElementUuids,
-      params.productUuid
+      params.productUuid,
+      params.noticeUuid,
+      params.dataElements
     );
-    return (result as { success: boolean })?.success ?? null;
+    if (result && typeof result === 'object' && 'success' in result) {
+      return Boolean((result as LegacyManageConsentResponse).success);
+    }
+    return true;
   } catch (error: any) {
     // Normalize nominator-specific errors into stable error codes
     const errorMsg = error?.message || '';