React Native / Expo

npx expo install @react-native-async-storage/async-storage expo-crypto
# Bare React Native without Expo modules? Any RN-compatible SHA-256 lib
# (e.g. crypto-js) substitutes for expo-crypto - see the comment at the
# top of the file below.

import { fetchNotice, recordConsent, getLastDecision, flushQueue } from './shieldConsent'

useEffect(() => {
  (async () => {
    flushQueue() // retry anything queued from a previous session, offline-first
    const existing = await getLastDecision()
    if (existing) return // already answered on this device - skip the screen

    const notice = await fetchNotice()
    setNotice(notice) // render your own UI from notice.purposes[]
  })()
}, [])

async function onAccept(purposes: Record<string, boolean>) {
  await recordConsent(userIdentifier, purposes, notice.id)
}

// shieldConsent.ts
// Copy this file into your project (e.g. src/lib/shieldConsent.ts) and fill
// in API_KEY below. No native module, no config plugin, no eject - this is
// plain TypeScript over fetch(), so it works identically in Expo Go, an EAS
// dev client, and a bare React Native app.
//
// Two dependencies, both near-universal in RN/Expo projects already:
//   npx expo install @react-native-async-storage/async-storage expo-crypto
// (Not using Expo? Swap Crypto.digestStringAsync() below for any SHA-256
// function - e.g. crypto-js's SHA256(str).toString() - the rest is unchanged.)

import AsyncStorage from '@react-native-async-storage/async-storage'
import * as Crypto from 'expo-crypto'

const API_BASE = 'https://api.dpdpashield.in/api/v1'
const API_KEY = 'dpdpa_live_YOUR_KEY_HERE' // Settings -> API Keys in the dashboard

const QUEUE_KEY = 'shield_consent_queue_v1'
const LAST_DECISION_KEY = 'shield_last_decision_v1'

type QueuedDecision = {
  identifierHash: string
  purposes: Record<string, boolean>
  noticeId: string
  language: string
  queuedAt: number
  // Your own internal ID for this user (e.g. your users table primary key) -
  // sent as-is, never hashed, unlike identifierHash. Optional - omit it and
  // nothing changes. See "Choosing an identifier" below.
  externalId?: string
}

/**
 * Same normalisation the backend applies before hashing
 * (apps/api/src/lib/hash.ts): trim, lowercase, SHA-256, lowercase hex.
 * JS's String.prototype.toLowerCase() is NOT locale-sensitive per the
 * ECMAScript spec (unlike Java/Kotlin's default toLowerCase()), so there is
 * no Turkish-'I'-style caveat to worry about here.
 */
export async function hashIdentifier(raw: string): Promise<string> {
  const normalised = raw.trim().toLowerCase()
  return Crypto.digestStringAsync(Crypto.CryptoDigestAlgorithm.SHA256, normalised, {
    encoding: Crypto.CryptoEncoding.HEX,
  })
}

/** Fetches the tenant's published notice - purposes, 22-language translations,
 *  Rule 3 disclosures (contactEmail, complaintText, withdrawalUrl), etc. */
export async function fetchNotice(noticeId?: string) {
  const url = new URL(`${API_BASE}/consent/public-notice`)
  url.searchParams.set('apiKey', API_KEY)
  if (noticeId) url.searchParams.set('noticeId', noticeId)

  const res = await fetch(url.toString())
  if (!res.ok) throw new Error(`fetchNotice failed: ${res.status}`)
  return (await res.json()).data
}

async function sendConsentRecord(decision: QueuedDecision): Promise<boolean> {
  try {
    const res = await fetch(`${API_BASE}/consent/sdk-record`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        apiKey: API_KEY,
        identifierHash: decision.identifierHash,
        purposes: decision.purposes,
        noticeId: decision.noticeId,
        language: decision.language,
        ...(decision.externalId ? { externalId: decision.externalId } : {}),
      }),
    })
    return res.ok
  } catch {
    return false // no network right now - caller falls back to the offline queue
  }
}

async function enqueue(decision: QueuedDecision) {
  const raw = await AsyncStorage.getItem(QUEUE_KEY)
  const queue: QueuedDecision[] = raw ? JSON.parse(raw) : []
  queue.push(decision)
  await AsyncStorage.setItem(QUEUE_KEY, JSON.stringify(queue))
}

/**
 * Records the user's decision. The identifier is hashed on-device and the
 * raw value never leaves this function - only identifierHash is sent or
 * stored anywhere. Local-first: the decision is written to AsyncStorage
 * before the network call, so a purpose-gate check reading
 * getLastDecision() sees it immediately regardless of connectivity.
 *
 * externalId is YOUR own internal ID for this user (e.g. your users table
 * primary key) - never derived here, sent as-is since it isn't PII we need
 * to protect, unlike identifier. Optional and independent of identifier -
 * pass it to correlate this record back to your own database later via
 * GET /consent/by-external-id/:externalId, without re-hashing lookups.
 */
export async function recordConsent(
  identifier: string,
  purposes: Record<string, boolean>,
  noticeId: string,
  language: string = 'EN',
  externalId?: string,
): Promise<{ sent: boolean; queued: boolean }> {
  const decision: QueuedDecision = {
    identifierHash: await hashIdentifier(identifier),
    purposes,
    noticeId,
    language,
    queuedAt: Date.now(),
    ...(externalId ? { externalId } : {}),
  }

  await AsyncStorage.setItem(LAST_DECISION_KEY, JSON.stringify(decision))

  const sent = await sendConsentRecord(decision)
  if (!sent) await enqueue(decision)
  return { sent, queued: !sent }
}

/** Call this on app foreground and/or on a connectivity-regained event
 *  (e.g. NetInfo.addEventListener from @react-native-community/netinfo). */
export async function flushQueue(): Promise<{ sent: number; remaining: number }> {
  const raw = await AsyncStorage.getItem(QUEUE_KEY)
  const queue: QueuedDecision[] = raw ? JSON.parse(raw) : []
  const remaining: QueuedDecision[] = []
  let sent = 0

  for (const decision of queue) {
    if (await sendConsentRecord(decision)) sent++
    else remaining.push(decision)
  }

  await AsyncStorage.setItem(QUEUE_KEY, JSON.stringify(remaining))
  return { sent, remaining: remaining.length }
}

/** Reads the last decision recorded on this device - use this to decide
 *  whether to show the consent screen at all on a cold start. */
export async function getLastDecision(): Promise<QueuedDecision | null> {
  const raw = await AsyncStorage.getItem(LAST_DECISION_KEY)
  return raw ? JSON.parse(raw) : null
}

/** email MUST be a real email address - the backend validates it as one
 *  and rejects anything else. See "Withdrawal" below if your users aren't
 *  identified by email. */
export async function withdrawConsent(email: string, purposeIds: string[] = [], reason?: string) {
  const res = await fetch(`${API_BASE}/consent/withdraw-public`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ apiKey: API_KEY, email, purposeIds, withdrawalReason: reason }),
  })
  if (!res.ok) {
    const body = await res.json().catch(() => null)
    throw new Error(body?.error?.message ?? `withdrawConsent failed: ${res.status}`)
  }
  return (await res.json()).data
}