@redacto.io/consent-sdk-react 9.5.0-beta.0 → 10.0.0-beta.1

package/src/RedactoPrivacyCenter/locales/ml/translation.json

@@ -330,5 +330,11 @@
   "casesCreatedCount_other": "{{count}} cases created",
   "someRequestsFailed": "Some requests failed",
   "retry": "Retry",
-  "retrying": "Retrying..."
+  "retrying": "Retrying...",
+  "switchProfile": "പ്രൊഫൈൽ മാറ്റുക",
+  "chooseYourProfile": "നിങ്ങളുടെ പ്രൊഫൈൽ തിരഞ്ഞെടുക്കുക",
+  "emailLinkedToMultipleProfiles": "{{email}} ഒന്നിലധികം പ്രൊഫൈലുകളുമായി ബന്ധിപ്പിച്ചിരിക്കുന്നു. നിങ്ങൾ കാണാൻ ആഗ്രഹിക്കുന്നത് തിരഞ്ഞെടുക്കുക.",
+  "contactLinkedToMultipleProfiles": "ഈ കോൺടാക്റ്റ് ഒന്നിലധികം പ്രൊഫൈലുകളുമായി ബന്ധിപ്പിച്ചിരിക്കുന്നു. നിങ്ങൾ കാണാൻ ആഗ്രഹിക്കുന്നത് തിരഞ്ഞെടുക്കുക.",
+  "signingInEllipsis": "സൈൻ ഇൻ ചെയ്യുന്നു…",
+  "couldNotSwitchProfile": "ആ പ്രൊഫൈലിലേക്ക് മാറാൻ കഴിഞ്ഞില്ല. വീണ്ടും ശ്രമിക്കുക."
 }

package/src/RedactoPrivacyCenter/locales/mni-Mtei/translation.json

@@ -330,5 +330,11 @@
   "casesCreatedCount_other": "{{count}} cases created",
   "someRequestsFailed": "Some requests failed",
   "retry": "Retry",
-  "retrying": "Retrying..."
+  "retrying": "Retrying...",
+  "switchProfile": "প্রোফাইল হোংদোক-উ",
+  "chooseYourProfile": "নহাক্কী প্রোফাইল খনবিয়ু",
+  "emailLinkedToMultipleProfiles": "{{email}} অসি প্রোফাইল অমদগী হেন্না লোইননবা লৈ। নহাক্না য়েংনিংবা অদু খনবিয়ু।",
+  "contactLinkedToMultipleProfiles": "মসি কন্টেক্ট অসি প্রোফাইল অমদগী হেন্না লোইননবা লৈ। নহাক্না য়েংনিংবা অদু খনবিয়ু।",
+  "signingInEllipsis": "সাইন ইন তৌরি…",
+  "couldNotSwitchProfile": "প্রোফাইল অদুদা হোংদোকপা ঙমদ্রে। চানবীদুনা অমুক হন্না হোৎনবিয়ু।"
 }

package/src/RedactoPrivacyCenter/locales/mr/translation.json

@@ -330,5 +330,11 @@
   "casesCreatedCount_other": "{{count}} cases created",
   "someRequestsFailed": "Some requests failed",
   "retry": "Retry",
-  "retrying": "Retrying..."
+  "retrying": "Retrying...",
+  "switchProfile": "प्रोफाइल बदला",
+  "chooseYourProfile": "तुमची प्रोफाइल निवडा",
+  "emailLinkedToMultipleProfiles": "{{email}} एकापेक्षा जास्त प्रोफाइलशी जोडलेला आहे. तुम्हाला जी पाहायची आहे ती निवडा.",
+  "contactLinkedToMultipleProfiles": "हा संपर्क एकापेक्षा जास्त प्रोफाइलशी जोडलेला आहे. तुम्हाला जी पाहायची आहे ती निवडा.",
+  "signingInEllipsis": "साइन इन करत आहे…",
+  "couldNotSwitchProfile": "त्या प्रोफाइलवर स्विच करता आले नाही. कृपया पुन्हा प्रयत्न करा."
 }

package/src/RedactoPrivacyCenter/locales/ne/translation.json

@@ -330,5 +330,11 @@
   "casesCreatedCount_other": "{{count}} cases created",
   "someRequestsFailed": "Some requests failed",
   "retry": "Retry",
-  "retrying": "Retrying..."
+  "retrying": "Retrying...",
+  "switchProfile": "प्रोफाइल बदल्नुहोस्",
+  "chooseYourProfile": "आफ्नो प्रोफाइल छान्नुहोस्",
+  "emailLinkedToMultipleProfiles": "{{email}} एकभन्दा बढी प्रोफाइलसँग जोडिएको छ। तपाईंले हेर्न चाहनुभएको छान्नुहोस्।",
+  "contactLinkedToMultipleProfiles": "यो सम्पर्क एकभन्दा बढी प्रोफाइलसँग जोडिएको छ। तपाईंले हेर्न चाहनुभएको छान्नुहोस्।",
+  "signingInEllipsis": "साइन इन हुँदैछ…",
+  "couldNotSwitchProfile": "त्यो प्रोफाइलमा स्विच गर्न सकिएन। कृपया फेरि प्रयास गर्नुहोस्।"
 }

package/src/RedactoPrivacyCenter/locales/or/translation.json

@@ -330,5 +330,11 @@
   "casesCreatedCount_other": "{{count}} cases created",
   "someRequestsFailed": "Some requests failed",
   "retry": "Retry",
-  "retrying": "Retrying..."
+  "retrying": "Retrying...",
+  "switchProfile": "ପ୍ରୋଫାଇଲ୍ ବଦଳାନ୍ତୁ",
+  "chooseYourProfile": "ଆପଣଙ୍କ ପ୍ରୋଫାଇଲ୍ ବାଛନ୍ତୁ",
+  "emailLinkedToMultipleProfiles": "{{email}} ଏକାଧିକ ପ୍ରୋଫାଇଲ୍ ସହିତ ଯୋଡ଼ାଯାଇଛି। ଆପଣ ଦେଖିବାକୁ ଚାହୁଁଥିବାଟି ବାଛନ୍ତୁ।",
+  "contactLinkedToMultipleProfiles": "ଏହି ଯୋଗାଯୋଗ ଏକାଧିକ ପ୍ରୋଫାଇଲ୍ ସହିତ ଯୋଡ଼ାଯାଇଛି। ଆପଣ ଦେଖିବାକୁ ଚାହୁଁଥିବାଟି ବାଛନ୍ତୁ।",
+  "signingInEllipsis": "ସାଇନ୍ ଇନ୍ ହେଉଛି…",
+  "couldNotSwitchProfile": "ସେହି ପ୍ରୋଫାଇଲକୁ ସ୍ୱିଚ୍ କରାଯାଇପାରିଲା ନାହିଁ। ଦୟାକରି ପୁନର୍ବାର ଚେଷ୍ଟା କରନ୍ତୁ।"
 }

package/src/RedactoPrivacyCenter/locales/pa/translation.json

@@ -330,5 +330,11 @@
   "casesCreatedCount_other": "{{count}} cases created",
   "someRequestsFailed": "Some requests failed",
   "retry": "Retry",
-  "retrying": "Retrying..."
+  "retrying": "Retrying...",
+  "switchProfile": "ਪ੍ਰੋਫਾਈਲ ਬਦਲੋ",
+  "chooseYourProfile": "ਆਪਣੀ ਪ੍ਰੋਫਾਈਲ ਚੁਣੋ",
+  "emailLinkedToMultipleProfiles": "{{email}} ਇੱਕ ਤੋਂ ਵੱਧ ਪ੍ਰੋਫਾਈਲਾਂ ਨਾਲ ਜੁੜਿਆ ਹੋਇਆ ਹੈ। ਜੋ ਤੁਸੀਂ ਵੇਖਣਾ ਚਾਹੁੰਦੇ ਹੋ ਉਹ ਚੁਣੋ।",
+  "contactLinkedToMultipleProfiles": "ਇਹ ਸੰਪਰਕ ਇੱਕ ਤੋਂ ਵੱਧ ਪ੍ਰੋਫਾਈਲਾਂ ਨਾਲ ਜੁੜਿਆ ਹੋਇਆ ਹੈ। ਜੋ ਤੁਸੀਂ ਵੇਖਣਾ ਚਾਹੁੰਦੇ ਹੋ ਉਹ ਚੁਣੋ।",
+  "signingInEllipsis": "ਸਾਈਨ ਇਨ ਹੋ ਰਿਹਾ ਹੈ…",
+  "couldNotSwitchProfile": "ਉਸ ਪ੍ਰੋਫਾਈਲ 'ਤੇ ਸਵਿੱਚ ਨਹੀਂ ਕੀਤਾ ਜਾ ਸਕਿਆ। ਕਿਰਪਾ ਕਰਕੇ ਦੁਬਾਰਾ ਕੋਸ਼ਿਸ਼ ਕਰੋ।"
 }

package/src/RedactoPrivacyCenter/locales/sa/translation.json

@@ -330,5 +330,11 @@
   "casesCreatedCount_other": "{{count}} cases created",
   "someRequestsFailed": "Some requests failed",
   "retry": "Retry",
-  "retrying": "Retrying..."
+  "retrying": "Retrying...",
+  "switchProfile": "प्रोफ़ाइलं परिवर्तयतु",
+  "chooseYourProfile": "स्वप्रोफ़ाइलं चिनोतु",
+  "emailLinkedToMultipleProfiles": "{{email}} एकाधिकैः प्रोफ़ाइलैः सह सम्बद्धः अस्ति। यत् द्रष्टुम् इच्छति तत् चिनोतु।",
+  "contactLinkedToMultipleProfiles": "अयं सम्पर्कः एकाधिकैः प्रोफ़ाइलैः सह सम्बद्धः अस्ति। यत् द्रष्टुम् इच्छति तत् चिनोतु।",
+  "signingInEllipsis": "प्रवेशः क्रियते…",
+  "couldNotSwitchProfile": "तां प्रोफ़ाइलं प्रति परिवर्तनं न शक्यते स्म। कृपया पुनः प्रयत्नं करोतु।"
 }

package/src/RedactoPrivacyCenter/locales/sat/translation.json

@@ -330,5 +330,11 @@
   "casesCreatedCount_other": "{{count}} cases created",
   "someRequestsFailed": "Some requests failed",
   "retry": "Retry",
-  "retrying": "Retrying..."
+  "retrying": "Retrying...",
+  "switchProfile": "ᱯᱨᱳᱯᱷᱟᱭᱤᱞ ᱵᱚᱫᱚᱞ ᱢᱮ",
+  "chooseYourProfile": "ᱟᱢᱟᱜ ᱯᱨᱳᱯᱷᱟᱭᱤᱞ ᱵᱟᱪᱷᱟᱣ ᱢᱮ",
+  "emailLinkedToMultipleProfiles": "{{email}} ᱫᱚ ᱢᱤᱫ ᱠᱷᱚᱱ ᱰᱷᱮᱨ ᱯᱨᱳᱯᱷᱟᱭᱤᱞ ᱥᱟᱶ ᱡᱩᱰᱟᱹᱣ ᱟᱠᱟᱱᱟ᱾ ᱟᱢ ᱧᱮᱞ ᱥᱟᱱᱟᱢ ᱚᱱᱟ ᱵᱟᱪᱷᱟᱣ ᱢᱮ᱾",
+  "contactLinkedToMultipleProfiles": "ᱱᱳᱶᱟ ᱠᱚᱱᱴᱮᱠᱴ ᱫᱚ ᱢᱤᱫ ᱠᱷᱚᱱ ᱰᱷᱮᱨ ᱯᱨᱳᱯᱷᱟᱭᱤᱞ ᱥᱟᱶ ᱡᱩᱰᱟᱹᱣ ᱟᱠᱟᱱᱟ᱾ ᱟᱢ ᱧᱮᱞ ᱥᱟᱱᱟᱢ ᱚᱱᱟ ᱵᱟᱪᱷᱟᱣ ᱢᱮ᱾",
+  "signingInEllipsis": "ᱥᱟᱭᱤᱱ ᱤᱱ ᱮᱫᱟᱭ…",
+  "couldNotSwitchProfile": "ᱚᱱᱟ ᱯᱨᱳᱯᱷᱟᱭᱤᱞ ᱛᱮ ᱥᱩᱭᱪ ᱵᱟᱝ ᱦᱩᱭ ᱞᱮᱱᱟ᱾ ᱫᱟᱭᱟ ᱠᱟᱛᱮ ᱫᱩᱠᱟᱹᱛᱮ ᱠᱩᱨᱩᱢᱩᱴᱩ ᱢᱮ᱾"
 }

package/src/RedactoPrivacyCenter/locales/sd/translation.json

@@ -330,5 +330,11 @@
   "casesCreatedCount_other": "{{count}} cases created",
   "someRequestsFailed": "Some requests failed",
   "retry": "Retry",
-  "retrying": "Retrying..."
+  "retrying": "Retrying...",
+  "switchProfile": "پروفائل تبديل ڪريو",
+  "chooseYourProfile": "پنهنجو پروفائل چونڊيو",
+  "emailLinkedToMultipleProfiles": "{{email}} هڪ کان وڌيڪ پروفائلن سان ڳنڍيل آهي. جيڪو توهان ڏسڻ چاهيو ٿا اهو چونڊيو.",
+  "contactLinkedToMultipleProfiles": "هي رابطو هڪ کان وڌيڪ پروفائلن سان ڳنڍيل آهي. جيڪو توهان ڏسڻ چاهيو ٿا اهو چونڊيو.",
+  "signingInEllipsis": "سائن ان ٿي رهيو آهي…",
+  "couldNotSwitchProfile": "ان پروفائل تي سوئچ نه ٿي سگهيو. مهرباني ڪري ٻيهر ڪوشش ڪريو."
 }

package/src/RedactoPrivacyCenter/locales/ta/translation.json

@@ -330,5 +330,11 @@
   "casesCreatedCount_other": "{{count}} cases created",
   "someRequestsFailed": "Some requests failed",
   "retry": "Retry",
-  "retrying": "Retrying..."
+  "retrying": "Retrying...",
+  "switchProfile": "சுயவிவரத்தை மாற்று",
+  "chooseYourProfile": "உங்கள் சுயவிவரத்தைத் தேர்ந்தெடுக்கவும்",
+  "emailLinkedToMultipleProfiles": "{{email}} ஒன்றுக்கு மேற்பட்ட சுயவிவரங்களுடன் இணைக்கப்பட்டுள்ளது. நீங்கள் பார்க்க விரும்புவதைத் தேர்ந்தெடுக்கவும்.",
+  "contactLinkedToMultipleProfiles": "இந்தத் தொடர்பு ஒன்றுக்கு மேற்பட்ட சுயவிவரங்களுடன் இணைக்கப்பட்டுள்ளது. நீங்கள் பார்க்க விரும்புவதைத் தேர்ந்தெடுக்கவும்.",
+  "signingInEllipsis": "உள்நுழைகிறது…",
+  "couldNotSwitchProfile": "அந்தச் சுயவிவரத்திற்கு மாற முடியவில்லை. மீண்டும் முயற்சிக்கவும்."
 }

package/src/RedactoPrivacyCenter/locales/te/translation.json

@@ -330,5 +330,11 @@
   "casesCreatedCount_other": "{{count}} cases created",
   "someRequestsFailed": "Some requests failed",
   "retry": "Retry",
-  "retrying": "Retrying..."
+  "retrying": "Retrying...",
+  "switchProfile": "ప్రొఫైల్‌ను మార్చండి",
+  "chooseYourProfile": "మీ ప్రొఫైల్‌ను ఎంచుకోండి",
+  "emailLinkedToMultipleProfiles": "{{email}} ఒకటి కంటే ఎక్కువ ప్రొఫైల్‌లతో అనుసంధానించబడింది. మీరు చూడాలనుకుంటున్నదాన్ని ఎంచుకోండి.",
+  "contactLinkedToMultipleProfiles": "ఈ సంప్రదింపు ఒకటి కంటే ఎక్కువ ప్రొఫైల్‌లతో అనుసంధానించబడింది. మీరు చూడాలనుకుంటున్నదాన్ని ఎంచుకోండి.",
+  "signingInEllipsis": "సైన్ ఇన్ అవుతోంది…",
+  "couldNotSwitchProfile": "ఆ ప్రొఫైల్‌కు మారడం సాధ్యం కాలేదు. దయచేసి మళ్లీ ప్రయత్నించండి."
 }

package/src/RedactoPrivacyCenter/locales/ur/translation.json

@@ -330,5 +330,11 @@
   "casesCreatedCount_other": "{{count}} cases created",
   "someRequestsFailed": "Some requests failed",
   "retry": "Retry",
-  "retrying": "Retrying..."
+  "retrying": "Retrying...",
+  "switchProfile": "پروفائل تبدیل کریں",
+  "chooseYourProfile": "اپنی پروفائل منتخب کریں",
+  "emailLinkedToMultipleProfiles": "{{email}} ایک سے زیادہ پروفائلز سے منسلک ہے۔ جسے آپ دیکھنا چاہتے ہیں اسے منتخب کریں۔",
+  "contactLinkedToMultipleProfiles": "یہ رابطہ ایک سے زیادہ پروفائلز سے منسلک ہے۔ جسے آپ دیکھنا چاہتے ہیں اسے منتخب کریں۔",
+  "signingInEllipsis": "سائن ان ہو رہا ہے…",
+  "couldNotSwitchProfile": "اس پروفائل پر سوئچ نہیں کیا جا سکا۔ براہ کرم دوبارہ کوشش کریں۔"
 }

package/src/RedactoPrivacyCenter/styles/injectStyles.ts

@@ -664,6 +664,111 @@ export const injectPCStyles = () => {
       color: var(--pc-text-secondary);
       line-height: 1.25;
     }
+    .pc-select-user {
+      display: flex;
+      flex-direction: column;
+      justify-content: center;
+      gap: var(--pc-spacing-xl);
+      width: 100%;
+      max-width: 460px;
+      margin: 0 auto;
+      min-height: min(62vh, 540px);
+      padding-top: var(--pc-spacing-2xl);
+      padding-bottom: var(--pc-spacing-2xl);
+    }
+    .pc-select-user__header {
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      text-align: center;
+      gap: var(--pc-spacing-sm);
+    }
+    .pc-select-user__header > * {
+      margin: 0;
+    }
+    .pc-select-user__list {
+      display: flex;
+      flex-direction: column;
+      gap: 0.625rem;
+    }
+    .pc-select-user__item {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      gap: 0.75rem;
+      width: 100%;
+      box-sizing: border-box;
+      padding: 0.75rem 1rem;
+      border: 1px solid var(--pc-border-color);
+      border-radius: 0.625rem;
+      background-color: var(--pc-bg-primary);
+      color: var(--pc-text-primary);
+      cursor: pointer;
+      text-align: left;
+      appearance: none;
+      -webkit-appearance: none;
+      font-family: inherit;
+      transition: border-color 0.2s ease, background-color 0.2s ease;
+    }
+    .pc-select-user__item:hover:not(:disabled) {
+      border-color: var(--pc-primary);
+      background-color: color-mix(in srgb, var(--pc-primary) 6%, var(--pc-bg-primary));
+    }
+    .pc-select-user__item:disabled {
+      cursor: default;
+      opacity: 0.7;
+    }
+    .pc-select-user__item:focus-visible {
+      outline: 2px solid var(--pc-border-color-focus);
+      outline-offset: 2px;
+    }
+    .pc-select-user__item-text {
+      display: flex;
+      flex-direction: column;
+      align-items: flex-start;
+      gap: 0.125rem;
+      min-width: 0;
+    }
+    .pc-select-user__item-primary {
+      font-size: 0.875rem;
+      font-weight: 600;
+      line-height: 1.25;
+      overflow: hidden;
+      text-overflow: ellipsis;
+      white-space: nowrap;
+      max-width: 100%;
+    }
+    .pc-select-user__item-secondary {
+      font-size: 0.75rem;
+      color: var(--pc-text-secondary);
+      line-height: 1.25;
+      overflow: hidden;
+      text-overflow: ellipsis;
+      white-space: nowrap;
+      max-width: 100%;
+    }
+    .pc-select-user__item-status {
+      font-size: 0.75rem;
+      font-weight: 600;
+      color: var(--pc-primary);
+      flex-shrink: 0;
+    }
+    .pc-select-user__item-chevron {
+      color: var(--pc-primary);
+      flex-shrink: 0;
+    }
+    .pc-select-user__error {
+      margin: 0.75rem 0 0;
+      font-size: 0.8125rem;
+      color: var(--pc-error);
+      text-align: center;
+    }
+    .pc-select-user-loading {
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      min-height: 60vh;
+    }
     .pc-product-purpose-panel {
       display: flex;
       flex-direction: column;

package/tests/Form.test.tsx

@@ -98,9 +98,14 @@ vi.mock('../src/RedactoPrivacyCenter/lib/i18n', () => ({
 // 1-form -> 1-case: only `createCaseRequest` is consumed by Form.tsx now.
 const createCaseRequest = vi.fn();
 const getFormData = vi.fn();
+const fetchUserConsents = vi.fn();
 vi.mock('../src/RedactoPrivacyCenter/lib/api', () => ({
   createCaseRequest: (...args: unknown[]) => createCaseRequest(...args),
   getFormData: (...args: unknown[]) => getFormData(...args),
+  // Approach A sources the product picker from the ledger's user-consents.
+  // Default to no ledger result so the form falls back to the getFormData
+  // product groups these tests set up.
+  fetchUserConsents: (...args: unknown[]) => fetchUserConsents(...args),
 }));
 
 // ─── upload stub ─────────────────────────────────────────────────────────────
@@ -135,13 +140,16 @@ vi.mock('../src/RedactoPrivacyCenter/context/AuthContext', () => {
   return { useAuth: () => auth };
 });
 
-vi.mock('../src/RedactoPrivacyCenter/context/BaseUrlContext', () => {
-  const base = {
-    consentClient: { get: () => Promise.resolve(null), post: () => Promise.resolve(null) },
-    baseUrl: 'https://consent.test',
-  };
-  return { useBaseUrl: () => base };
-});
+// Mutable so individual tests can drop `ledgerBaseUrl` to exercise the legacy
+// (no-ledger) mode; beforeEach restores the ledger default.
+const baseUrlStub = vi.hoisted(() => ({
+  consentClient: { get: () => Promise.resolve(null), post: () => Promise.resolve(null) },
+  baseUrl: 'https://consent.test',
+  ledgerBaseUrl: 'https://ledger.test/consent-ledger' as string | undefined,
+}));
+vi.mock('../src/RedactoPrivacyCenter/context/BaseUrlContext', () => ({
+  useBaseUrl: () => baseUrlStub,
+}));
 
 vi.mock('../src/RedactoPrivacyCenter/context/OrganizationContext', () => {
   const org = {
@@ -476,6 +484,8 @@ describe('Form (P2-SDK-3)', () => {
   beforeEach(() => {
     createCaseRequest.mockReset();
     getFormData.mockReset();
+    fetchUserConsents.mockReset();
+    baseUrlStub.ledgerBaseUrl = 'https://ledger.test/consent-ledger';
     sessionStorage.clear();
   });
 
@@ -514,6 +524,47 @@ describe('Form (P2-SDK-3)', () => {
     expect(submitButton.disabled).toBe(true);
   });
 
+  it('skips the ledger picker overlay when no ledgerBaseUrl is configured', async () => {
+    // Without a ledger, consents still live in Python and the form/data
+    // groups are authoritative — the overlay must not fire a user-consents
+    // read (it would hit the legacy endpoint and mis-map its shape).
+    baseUrlStub.ledgerBaseUrl = undefined;
+    setupSession();
+    getFormData.mockResolvedValue(
+      makeFormData({
+        direct_groups: [
+          makeGroup(),
+          makeGroup({
+            product_uuid: 'prod-direct-2',
+            product_name: 'Acme Rewards',
+            purposes: [basePurpose('purp-2', 'Analytics')],
+          }),
+        ],
+      }),
+    );
+
+    render(<Form onCreateRequest={vi.fn()} />);
+    await waitFor(() => expect(getFormData).toHaveBeenCalled());
+
+    pickRequestType(RequestTypeEnum.ERASURE);
+    await waitFor(() => {
+      expect(screen.getByText('Acme Loyalty')).toBeInTheDocument();
+    });
+    expect(fetchUserConsents).not.toHaveBeenCalled();
+  });
+
+  it('runs the ledger picker overlay when ledgerBaseUrl is configured', async () => {
+    setupSession();
+    getFormData.mockResolvedValue(
+      makeFormData({ direct_groups: [makeGroup()] }),
+    );
+
+    render(<Form onCreateRequest={vi.fn()} />);
+    await waitFor(() => expect(getFormData).toHaveBeenCalled());
+
+    await waitFor(() => expect(fetchUserConsents).toHaveBeenCalled());
+  });
+
   it('renders the product step for DSAR types when direct_groups is present', async () => {
     setupSession();
     const direct = makeGroup({

package/tests/consentClient.test.ts

@@ -0,0 +1,171 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { createConsentClient } from '../src/RedactoPrivacyCenter/api/client';
+import type { BaseRequest } from '../src/RedactoPrivacyCenter/api/client';
+
+// URL routing contract for the five consent read/write methods that moved to
+// the Go ledger in PR #438. With a ledgerBaseUrl they must hit the ledger's
+// /public/... paths; without one they must fall back to the legacy Python
+// /dsar/privacy-center paths (prod has no ledger — see PR #438/#460 regression
+// where the silent baseUrl fallback 404'd the Privacy Center).
+
+const BASE_URL = 'https://consent.test';
+const LEDGER_URL = 'https://ledger.test/consent-ledger';
+const LEGACY_PREFIX =
+  'https://consent.test/organisations/org-1/workspaces/ws-1/dsar/privacy-center';
+const LEDGER_PREFIX =
+  'https://ledger.test/consent-ledger/public/organisations/org-1/workspaces/ws-1';
+
+const baseRequest: BaseRequest = {
+  organisationUuid: 'org-1',
+  workspaceUuid: 'ws-1',
+  authToken: 'jwt-token',
+};
+
+const jsonResponse = () =>
+  new Response(JSON.stringify({}), {
+    status: 200,
+    headers: { 'Content-Type': 'application/json' },
+  });
+
+const pdfResponse = () =>
+  new Response(new Blob(['%PDF'], { type: 'application/pdf' }), {
+    status: 200,
+    headers: { 'Content-Type': 'application/pdf' },
+  });
+
+const mockFetch = vi.fn();
+
+const fetchedUrl = (): string => String(mockFetch.mock.calls[0]?.[0]);
+
+const fetchedBody = (): Record<string, unknown> =>
+  JSON.parse(String(mockFetch.mock.calls[0]?.[1]?.body)) as Record<
+    string,
+    unknown
+  >;
+
+beforeEach(() => {
+  mockFetch.mockReset();
+  mockFetch.mockImplementation(() => Promise.resolve(jsonResponse()));
+  vi.stubGlobal('fetch', mockFetch);
+});
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe('createConsentClient — legacy mode (no ledgerBaseUrl)', () => {
+  const client = createConsentClient(BASE_URL);
+
+  it('routes getUserConsents to the legacy dsar/privacy-center path', async () => {
+    await client.getUserConsents(baseRequest, { offset: 0, limit: 10 });
+    expect(fetchedUrl()).toBe(
+      `${LEGACY_PREFIX}/user-consents?offset=0&limit=10`,
+    );
+  });
+
+  it('routes getGroupPurposes to the legacy dsar/privacy-center path', async () => {
+    await client.getGroupPurposes(baseRequest, 'prod-1', { limit: 5 });
+    expect(fetchedUrl()).toBe(
+      `${LEGACY_PREFIX}/user-consents/prod-1/purposes?limit=5`,
+    );
+  });
+
+  it('routes manageConsent to the legacy manage-consent endpoint with the legacy body and no noticeUuid requirement', async () => {
+    await client.manageConsent(
+      baseRequest,
+      'purp-1',
+      'jane@example.com',
+      'revoke',
+      undefined,
+      undefined,
+      'nominator@example.com',
+      ['de-1'],
+      'prod-1',
+    );
+    expect(fetchedUrl()).toBe(`${LEGACY_PREFIX}/manage-consent?status=revoke`);
+    expect(fetchedBody()).toEqual({
+      purpose_uuid: 'purp-1',
+      contact: 'jane@example.com',
+      nominator_contact: 'nominator@example.com',
+      data_element_uuids: ['de-1'],
+      product_uuid: 'prod-1',
+    });
+  });
+
+  it('routes getReceipts to the legacy dsar/privacy-center path', async () => {
+    await client.getReceipts(baseRequest, { skip: 0, limit: 10 });
+    expect(fetchedUrl()).toBe(`${LEGACY_PREFIX}/receipts?skip=0&limit=10`);
+  });
+
+  it('routes getReceiptPdf to the legacy /pdf path', async () => {
+    mockFetch.mockImplementation(() => Promise.resolve(pdfResponse()));
+    await client.getReceiptPdf(baseRequest, 'r-1');
+    expect(fetchedUrl()).toBe(`${LEGACY_PREFIX}/receipts/r-1/pdf`);
+  });
+});
+
+describe('createConsentClient — ledger mode (ledgerBaseUrl set)', () => {
+  // Trailing slash must be trimmed from the configured ledger base.
+  const client = createConsentClient(BASE_URL, `${LEDGER_URL}/`);
+
+  it('routes getUserConsents to the ledger public path', async () => {
+    await client.getUserConsents(baseRequest, { offset: 0, limit: 10 });
+    expect(fetchedUrl()).toBe(
+      `${LEDGER_PREFIX}/user-consents?offset=0&limit=10`,
+    );
+  });
+
+  it('routes getGroupPurposes to the ledger public path', async () => {
+    await client.getGroupPurposes(baseRequest, 'prod-1', { limit: 5 });
+    expect(fetchedUrl()).toBe(
+      `${LEDGER_PREFIX}/user-consents/prod-1/purposes?limit=5`,
+    );
+  });
+
+  it('routes manageConsent to the ledger submit-consent with a partial payload', async () => {
+    await client.manageConsent(
+      baseRequest,
+      'purp-1',
+      'jane@example.com',
+      'revoke',
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      'notice-1',
+      [{ uuid: 'de-1', selected: true }],
+    );
+    expect(fetchedUrl()).toBe(`${LEDGER_PREFIX}/submit-consent`);
+    expect(fetchedBody()).toMatchObject({
+      notice_uuid: 'notice-1',
+      partial: true,
+      purposes: [
+        {
+          purpose_uuid: 'purp-1',
+          selected: false,
+          data_elements: [{ uuid: 'de-1', selected: false }],
+        },
+      ],
+    });
+  });
+
+  it('throws from manageConsent when noticeUuid is missing', async () => {
+    await expect(
+      client.manageConsent(baseRequest, 'purp-1', 'jane@example.com', 'revoke'),
+    ).rejects.toThrow('notice_uuid is required');
+    expect(mockFetch).not.toHaveBeenCalled();
+  });
+
+  it('routes getReceipts to the ledger public path', async () => {
+    await client.getReceipts(baseRequest, { skip: 0, limit: 10 });
+    expect(fetchedUrl()).toBe(`${LEDGER_PREFIX}/receipts?skip=0&limit=10`);
+  });
+
+  it('routes getReceiptPdf to the ledger /download path', async () => {
+    mockFetch.mockImplementation(() => Promise.resolve(pdfResponse()));
+    await client.getReceiptPdf(baseRequest, 'r-1');
+    expect(fetchedUrl()).toBe(`${LEDGER_PREFIX}/receipts/r-1/download`);
+  });
+});

package/tests/manageConsentServer.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import { manageConsentServer } from '../src/RedactoPrivacyCenter/api/actions';
+import type { createConsentClient } from '../src/RedactoPrivacyCenter/api/client';
+
+// manageConsentServer must honor the legacy Python response's `success` flag
+// (a 200 with { success: false } is a failure) while still treating the Go
+// ledger's ConsentEventResponse (no `success` key) as resolved-on-2xx.
+
+type ConsentClient = ReturnType<typeof createConsentClient>;
+
+const makeParams = (result: unknown) => ({
+  organizationId: 'org-1',
+  workspaceId: 'ws-1',
+  purposeId: 'purp-1',
+  contact: 'jane@example.com',
+  action: 'revoke' as const,
+  authToken: 'jwt-token',
+  consentClient: {
+    manageConsent: vi.fn().mockResolvedValue(result),
+  } as unknown as ConsentClient,
+});
+
+describe('manageConsentServer success detection', () => {
+  it('returns false for a legacy { success: false } response', async () => {
+    await expect(manageConsentServer(makeParams({ success: false }))).resolves.toBe(false);
+  });
+
+  it('returns true for a legacy { success: true } response', async () => {
+    await expect(manageConsentServer(makeParams({ success: true }))).resolves.toBe(true);
+  });
+
+  it('returns true for a ledger ConsentEventResponse (no success flag)', async () => {
+    await expect(
+      manageConsentServer(makeParams({ consent_event_uuid: 'evt-1' })),
+    ).resolves.toBe(true);
+  });
+});

package/tests/mocks.ts

@@ -235,6 +235,7 @@ export const defaultProps = {
   org_uuid: "org-123",
   workspace_uuid: "workspace-123",
   notice_uuid: "notice-123",
+  ledgerBaseUrl: "https://ledger.test/consent-ledger",
   accessToken: "mock-token",
   refreshToken: "mock-refresh-token",
   language: "en",