biscuit-rails 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a99734c304d99da013a29fd797e8d8d9461bdea8811bb87997bddc4a0b1cd100
-  data.tar.gz: b93c476239e0e9ee02f5466596b1de11dc3f24fcb3794c7b99497a66073efaf4
+  metadata.gz: 6af5d93f2b84a14db762315e56fc1e75b1ecd88b0d7763480c81364fcab20046
+  data.tar.gz: 13c0ca1019abd874c65ec3a5acd5552af3a2bc84acba6a3c2b2fc7d3c40abb51
 SHA512:
-  metadata.gz: 695482883b254ce859513919089eaa30f80947d792f9755cba738db35aff1bfde4bf6472cdbde5860b4e300acf05dda113ba595f26a422f2d6d60ef1833975d1
-  data.tar.gz: 197a2f37232f33b7b179fef7418497eaed80a3630016175e75709315e01778b273fdc0fa8347371b07c84884b0d78b0e696b9d6f0093eb930f779d8bc4ed0c6b
+  metadata.gz: 51ac7899d57bb410cfa26695a7c583490afdf7dc27310086cbce2489678475af409b6391b189570baf2f1836fb07215f20308d04fbb1d6794151affbf7bc1774
+  data.tar.gz: 278a5ba3887c2aa9a2d7172b506fdb2c02837ba31827db44a9f58e259a337ebf05334d69f086e99fac6b2d39a22d55ab3a63d1eee29e0e9f095e40c0373ebe2b

data/CHANGELOG.md

@@ -5,6 +5,43 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.0] - 2026-06-21
+
+### Added
+
+- `biscuit:consent-given` DOM event — dispatched on the banner element (bubbles)
+  after every successful consent POST, with `detail.categories` mirroring the
+  saved payload. Lets apps run tracking code (GA4 Consent Mode v2, GTM dataLayer,
+  Meta Pixel, etc.) immediately after consent without any page reload.
+
+### Removed
+
+- `reload_on_consent` option for `biscuit_banner` — removed as the
+  `biscuit:consent-given` event supersedes it. Apps that need a page reload
+  after consent can do `document.addEventListener("biscuit:consent-given",
+  () => window.location.reload())`.
+
+**Migration:** remove `reload_on_consent: true` from any `biscuit_banner`
+calls. Add the one-liner above if a reload is still needed for your use case.
+
+---
+
+## [0.2.1] - 2026-04-02
+
+### Fixed
+
+- `biscuit-install` skill: add Sprockets manifest step — when not using Propshaft,
+  `biscuit/biscuit.css` and `biscuit/biscuit_controller.js` must be linked in
+  `app/assets/config/manifest.js` or they 404 in test and production
+- `biscuit-install` skill: fix integration test POST syntax — `body:` is not a valid
+  Rails integration test keyword; replaced with `params: { ... }.to_json` and explicit
+  `Content-Type`/`Accept` headers
+- `biscuit-install` skill: explain why the Stimulus controller must be registered
+  manually (`eagerLoadControllersFrom` only discovers controllers in
+  `app/javascript/controllers/`, not gem-provided ones)
+
+---
+
 ## [0.2.0] - 2026-03-31
 
 ### Added

data/README.md

@@ -5,6 +5,8 @@ bottom/top banner, manages consent state via a browser cookie, and exposes a
 Stimulus controller for interactivity. Supports i18n and CSS custom property
 theming with no external runtime dependencies.
 
+[Project page](https://bemused.org/projects/biscuit-rails/) · [GitHub](https://github.com/garethfr/biscuit-rails) · [Changelog](https://github.com/garethfr/biscuit-rails/blob/main/CHANGELOG.md) · [Issues](https://github.com/garethfr/biscuit-rails/issues)
+
 ---
 
 ## Requirements
@@ -115,20 +117,45 @@ revisit their preferences at any time.
 
 ## Banner Options
 
-`biscuit_banner` accepts keyword options to control behaviour per-page:
+`biscuit_banner` accepts keyword options to control behaviour per-page.
 
-### `reload_on_consent`
+Currently there are no banner-level options. Configuration is done via the
+initializer — see **Configuration** below.
 
-When `true`, the page reloads via `Turbo.visit` after the user saves their
-consent choice, instead of just hiding the banner. This is useful when your
-layout conditionally loads scripts based on consent — a reload ensures those
-scripts are evaluated with the new cookie in place.
+---
 
-```erb
-<%= biscuit_banner(reload_on_consent: true) %>
+## `biscuit:consent-given` event
+
+After any consent POST succeeds, the controller dispatches a
+`biscuit:consent-given` DOM event on the banner's root element. The event
+bubbles, so you can listen anywhere:
+
+```js
+document.addEventListener("biscuit:consent-given", ({ detail }) => {
+  if (detail.categories.analytics) {
+    // GA4 Consent Mode v2 — no page reload needed
+    gtag("consent", "update", { analytics_storage: "granted" })
+    gtag("event", "page_view")
+  }
+  if (detail.categories.marketing) {
+    fbq("consent", "grant")
+    fbq("track", "PageView")
+  }
+})
 ```
 
-Default: `false` — the banner hides in place without a page reload.
+`detail.categories` mirrors the payload sent to the server —
+`{ analytics: true, marketing: false, ... }`.
+
+If you need a full page reload after consent (for example, to trigger
+server-side `biscuit_allowed?()` guards on the current page), do it in the
+handler:
+
+```js
+document.addEventListener("biscuit:consent-given", () => {
+  window.location.reload()
+})
+```
 
 ---
 
@@ -364,10 +391,8 @@ Biscuit provides the consent UI and storage mechanism. You are responsible for:
 ```
 
 For scripts that must load on the client side after a user accepts consent
-during their current session (without a page reload), listen for the Fetch
-response in your own JavaScript and initialise scripts there, or use a
-lightweight Turbo visit to reload the page after the consent POST succeeds.
-(Turbo Stream support for post-consent injection is planned for v2.)
+during their current session (without a page reload), listen for the
+`biscuit:consent-given` DOM event and initialise scripts there.
 
 ### GDPR compliance checklist
 

data/app/assets/javascripts/biscuit/biscuit_controller.js

@@ -6,8 +6,7 @@ export default class extends Controller {
     endpoint:         String,
     csrfToken:        String,
     position:         { type: String, default: "bottom" },
-    alreadyConsented: { type: Boolean, default: false },
-    reloadOnConsent:  { type: Boolean, default: false }
+    alreadyConsented: { type: Boolean, default: false }
   }
 
   connect() {
@@ -70,12 +69,12 @@ export default class extends Controller {
         body: JSON.stringify({ categories })
       })
       if (response.ok) {
-        if (this.reloadOnConsentValue) {
-          Turbo.visit(window.location.href)
-        } else {
-          this.#hideBanner()
-          this.#showManageLink()
-        }
+        this.element.dispatchEvent(new CustomEvent("biscuit:consent-given", {
+          bubbles: true,
+          detail: { categories }
+        }))
+        this.#hideBanner()
+        this.#showManageLink()
       }
     } catch (error) {
       console.error("[Biscuit] Failed to save consent:", error)

data/app/views/biscuit/banner/_banner.html.erb

@@ -2,8 +2,7 @@
      data-biscuit-position-value="<%= Biscuit.configuration.position %>"
      data-biscuit-csrf-token-value="<%= form_authenticity_token %>"
      data-biscuit-endpoint-value="<%= biscuit.consent_path %>"
-     data-biscuit-already-consented-value="<%= consent.given? %>"
-     data-biscuit-reload-on-consent-value="<%= options[:reload_on_consent] ? 'true' : 'false' %>">
+     data-biscuit-already-consented-value="<%= consent.given? %>">
 
 <div class="biscuit-banner"
      data-biscuit-target="banner"

data/lib/biscuit/version.rb

@@ -1,3 +1,3 @@
 module Biscuit
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/lib/generators/biscuit/install/templates/SKILL.md

@@ -100,6 +100,8 @@ application.register("biscuit", BiscuitController)
 
 Ensure `application` is already imported at the top of that file (it will be in the standard Rails 8 scaffold).
 
+The explicit import is required because Rails' `eagerLoadControllersFrom` only auto-discovers controllers under `app/javascript/controllers/` — it cannot find controllers provided by gems, so they must always be registered manually.
+
 ### If using esbuild / jsbundling
 
 The same import and register lines apply, but inform the user that `@hotwired/stimulus` must be marked as external in their esbuild config so it is not bundled twice:
@@ -126,6 +128,15 @@ If the app uses `reload_on_consent: true` (from Step 4), use:
 <%= biscuit_banner(reload_on_consent: true) %>
 ```
 
+### Sprockets manifest (if not using Propshaft)
+
+If the app uses Sprockets (no `propshaft` in Gemfile), check whether `app/assets/config/manifest.js` exists. If it does, append these two lines if they are not already present — otherwise the stylesheet and JS file will 404 in test and production:
+
+```js
+//= link biscuit/biscuit.css
+//= link biscuit/biscuit_controller.js
+```
+
 ---
 
 ## Step 7 — Cookie and tracking script audit
@@ -209,20 +220,18 @@ class BiscuitConsentTest < ActionDispatch::IntegrationTest
   end
 
   test "accept all sets consent cookie" do
-    post "/biscuit/consent", params: {},
-      headers: { "Content-Type" => "application/json" },
-      as: :json,
-      body: { categories: { analytics: true, marketing: true } }.to_json
+    post "/biscuit/consent",
+      params: { categories: { analytics: true, marketing: true } }.to_json,
+      headers: { "Content-Type" => "application/json", "Accept" => "application/json" }
     assert_response :success
     assert Biscuit::Consent.new(cookies).given?
     assert Biscuit::Consent.new(cookies).allowed?(:analytics)
   end
 
   test "reject all sets non-required categories to false" do
-    post "/biscuit/consent", params: {},
-      headers: { "Content-Type" => "application/json" },
-      as: :json,
-      body: { categories: { analytics: false, marketing: false } }.to_json
+    post "/biscuit/consent",
+      params: { categories: { analytics: false, marketing: false } }.to_json,
+      headers: { "Content-Type" => "application/json", "Accept" => "application/json" }
     assert_response :success
     assert Biscuit::Consent.new(cookies).given?
     assert_equal false, Biscuit::Consent.new(cookies).allowed?(:analytics)

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: biscuit-rails
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Gareth James
 bindir: bin
 cert_chain: []
-date: 2026-03-31 00:00:00.000000000 Z
+date: 2026-06-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails