Consent Widget

DPDPAShield.init({
  apiKey: 'dpdpa_live_xxx',
  position: 'bottom-right' // default
})

const API_KEY = process.env.NEXT_PUBLIC_DPDPA_API_KEY;

function getConsentStatus() {
  const raw = localStorage.getItem('dpdpa_consent_' + API_KEY);
  return raw ? JSON.parse(raw) : null;
  // Returns: { id, status, ts, lang } or null
}

// The SDK writes dpdpa_purposes_{apiKey} to localStorage automatically
// after the API confirms the consent record.
// Shape: { [purposeId]: boolean }
function isPurposeConsented(purposeId) {
  try {
    const purposes = JSON.parse(
      localStorage.getItem('dpdpa_purposes_' + API_KEY) || '{}'
    );
    return purposes[purposeId] === true;
  } catch {
    return false;
  }
}

// Gate a feature behind consent
if (isPurposeConsented('YOUR_PURPOSE_ID')) {
  // load analytics, enable tracking, etc.
}

const crypto = require('crypto');

// Hash the user's email (same algorithm as SDK)
const hash = crypto
  .createHash('sha256')
  .update(email.toLowerCase().trim())
  .digest('hex');

const response = await fetch(
  `https://api.dpdpashield.in/api/v1/consent/status/${hash}`,
  {
    headers: {
      'Authorization': `Bearer ${DPDPA_API_KEY}`,
      'Content-Type': 'application/json'
    }
  }
);
const { data } = await response.json();
// data is an array of consent records, most recent first.
// Use data[0] for the current state; empty array = no consent on record.
const latest = data[0] ?? null;
// latest.consentGiven: Record<purposeId, boolean> | null
// latest.isWithdrawn: boolean               - true only on FULL withdrawal
// latest.withdrawnAt: string | null
// latest.withdrawnPurposes: string[]        - non-empty on a PARTIAL withdrawal
// latest.isPartiallyWithdrawn: boolean       - check this too, not just isWithdrawn

// Set these fields in the Notice Builder:
//   Contact Email:   privacy@yourdomain.com
//   Complaint Text:  "To raise a grievance, contact our DPO at privacy@yourdomain.com
//                    or write to: [postal address]. We will respond within 7 days."
//   Withdrawal URL:  https://dpdpashield.in/rights/your-slug?apiKey=dpdpa_live_xxx

// The SDK reads these from the /public-notice endpoint and renders them
// automatically - no code changes needed on your website.