consentful 0.1.0.pre1

data/app/components/consentful/preferences.html.erb

@@ -0,0 +1,167 @@
+<div
+  data-controller="consentful--preferences"
+  data-consentful--preferences-expected-version-id-value="<%= version.id %>"
+  data-consentful--preferences-submit-path-value="<%= submit_path %>"
+  data-consentful--preferences-categories-value="<%= categories_payload.to_json %>"
+  class="c-consent-preferences <%= modal? ? "c-consent-preferences--modal" : "c-consent-preferences--page" %>"
+>
+  <% if modal? %>
+    <div class="c-consent-preferences__header">
+      <h2 class="c-consent-preferences__header-title"><%= version.banner_title %></h2>
+      <button type="button" data-action="consentful--preferences#close" aria-label="Close" class="c-consent-preferences__close">
+        <svg width="20" height="20" viewBox="0 0 20 20" fill="none" stroke="currentColor" stroke-width="2">
+          <path d="M5 5l10 10M15 5L5 15" stroke-linecap="round"/>
+        </svg>
+      </button>
+    </div>
+  <% end %>
+
+  <div class="c-consent-preferences__body">
+    <div class="c-consent-preferences__intro">
+      <% unless modal? %>
+        <h1 class="c-consent-preferences__page-title"><%= version.banner_title %></h1>
+      <% end %>
+      <p class="c-consent-preferences__intro-body"><%= version.modal_intro.presence || version.banner_body %></p>
+    </div>
+
+    <div class="c-consent-preferences__tabs" role="tablist">
+      <button
+        type="button"
+        role="tab"
+        data-action="consentful--preferences#switchTab"
+        data-consentful--preferences-target="tab"
+        data-tab="categories"
+        aria-selected="true"
+        class="c-consent-preferences__tab c-consent-preferences__tab--active"
+      >Categories</button>
+      <button
+        type="button"
+        role="tab"
+        data-action="consentful--preferences#switchTab"
+        data-consentful--preferences-target="tab"
+        data-tab="services"
+        aria-selected="false"
+        class="c-consent-preferences__tab"
+      >Services</button>
+    </div>
+
+    <div data-consentful--preferences-target="tabPanel" data-tab="categories" class="c-consent-preferences__panel">
+      <% categories.each do |category| %>
+        <section class="c-consent-category" data-category-key="<%= category.key %>">
+          <header class="c-consent-category__header">
+            <div class="c-consent-category__heading">
+              <h3 class="c-consent-category__title"><%= category.name %></h3>
+              <% if category_blurb(category).present? %>
+                <p class="c-consent-category__blurb"><%= category_blurb(category) %></p>
+              <% end %>
+            </div>
+            <%= render Consentful::Toggle.new(
+                  id_scope: variant,
+                  name: "categories[#{category.key}]",
+                  value: "true",
+                  checked: category.required?,
+                  disabled: category.required?,
+                  data: {
+                    "consentful--preferences-target": "categoryMaster",
+                    "action": "change->consentful--preferences#cascadeCategory",
+                    "category-key": category.key
+                  }
+                ) %>
+            <button type="button" data-action="consentful--preferences#toggleSection" data-section-target="category-<%= category.key %>" aria-expanded="false" class="c-consent-category__chevron">
+              <svg width="20" height="20" data-section-chevron="category-<%= category.key %>" viewBox="0 0 20 20" fill="none" stroke="currentColor" stroke-width="2">
+                <path d="M6 8l4 4 4-4" stroke-linecap="round" stroke-linejoin="round"/>
+              </svg>
+            </button>
+          </header>
+          <div data-section-body="category-<%= category.key %>" class="c-consent-category__body c-consent__hidden">
+            <% services.select { |service| service.consent_category_id == category.id }.each do |service| %>
+              <div class="c-consent-service__row">
+                <span class="c-consent-service__name"><%= service.name %></span>
+                <button type="button" class="c-consent-service__info" data-action="consentful--preferences#toggleSection" data-section-target="service-<%= service.slug %>" aria-label="Service details">
+                  <svg width="16" height="16" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
+                    <path fill-rule="evenodd" d="M10 18a8 8 0 100-16 8 8 0 000 16zm0-9.5a1 1 0 100-2 1 1 0 000 2zM9 10a1 1 0 011-1h.01a1 1 0 110 2H10v3a1 1 0 11-2 0v-4z" clip-rule="evenodd"/>
+                  </svg>
+                </button>
+                <%= render Consentful::Toggle.new(
+                      id_scope: "#{variant}-cat",
+                      name: "services[#{service.slug}]",
+                      value: "true",
+                      checked: category.required?,
+                      disabled: category.required?,
+                      data: {
+                        "consentful--preferences-target": "serviceToggle",
+                        "action": "change->consentful--preferences#syncServiceToggle",
+                        "category-key": category.key,
+                        "service-slug": service.slug
+                      }
+                    ) %>
+              </div>
+              <div data-section-body="service-<%= service.slug %>" class="c-consent-service__detail c-consent__hidden">
+                <%= render Consentful::ServiceDetail.new(service: service) %>
+              </div>
+            <% end %>
+          </div>
+        </section>
+      <% end %>
+    </div>
+
+    <div data-consentful--preferences-target="tabPanel" data-tab="services" class="c-consent-preferences__panel c-consent__hidden">
+      <% services.each do |service| %>
+        <div class="c-consent-services-card">
+          <header class="c-consent-services-card__header">
+            <div class="c-consent-services-card__heading">
+              <p class="c-consent-services-card__name"><%= service.name %></p>
+              <p class="c-consent-services-card__category"><%= service.consent_category.name %></p>
+            </div>
+            <%= render Consentful::Toggle.new(
+                  id_scope: "#{variant}-flat",
+                  name: "services[#{service.slug}]",
+                  value: "true",
+                  checked: service.consent_category.required?,
+                  disabled: service.consent_category.required?,
+                  data: {
+                    "consentful--preferences-target": "serviceToggle",
+                    "action": "change->consentful--preferences#syncServiceToggle",
+                    "category-key": service.consent_category.key,
+                    "service-slug": service.slug
+                  }
+                ) %>
+            <button type="button" data-action="consentful--preferences#toggleSection" data-section-target="service-flat-<%= service.slug %>" aria-expanded="false" class="c-consent-category__chevron">
+              <svg width="20" height="20" data-section-chevron="service-flat-<%= service.slug %>" viewBox="0 0 20 20" fill="none" stroke="currentColor" stroke-width="2">
+                <path d="M6 8l4 4 4-4" stroke-linecap="round" stroke-linejoin="round"/>
+              </svg>
+            </button>
+          </header>
+          <div data-section-body="service-flat-<%= service.slug %>" class="c-consent-service__detail c-consent__hidden">
+            <%= render Consentful::ServiceDetail.new(service: service) %>
+          </div>
+        </div>
+      <% end %>
+    </div>
+  </div>
+
+  <% if visitor_uuid.present? %>
+    <div class="c-consent-preferences__reference">
+      <% if sar_contact_email.present? %>
+        If you'd like to request your consent history, quote this reference and send it to
+        <a href="mailto:<%= sar_contact_email %>"><%= sar_contact_email %></a>:
+      <% else %>
+        If you'd like to request your consent history, quote this reference:
+      <% end %>
+      <code class="c-consent-preferences__reference-code" data-consentful--preferences-target="reference"><%= visitor_uuid %></code>
+      <button type="button" data-action="consentful--preferences#copyReference" class="c-consent-preferences__copy-button">Copy</button>
+    </div>
+  <% end %>
+
+  <div class="c-consent-preferences__footer">
+    <button type="button" data-action="consentful--preferences#save" class="c-consent-action">
+      <%= version.save_label.presence || "Save Settings" %>
+    </button>
+    <button type="button" data-action="consentful--preferences#reject" class="c-consent-action">
+      <%= version.reject_label.presence || "Deny" %>
+    </button>
+    <button type="button" data-action="consentful--preferences#accept" class="c-consent-action">
+      <%= version.accept_label.presence || "Accept All" %>
+    </button>
+  </div>
+</div>

data/app/components/consentful/preferences.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module Consentful
+  class Preferences < ViewComponent::Base
+    VARIANTS = %i[page modal].freeze
+
+    def initialize(version:, categories:, visitor_uuid:, submit_path:, variant: :page)
+      super()
+      @version = version
+      @categories = categories
+      @visitor_uuid = visitor_uuid
+      @submit_path = submit_path
+      @variant = VARIANTS.include?(variant) ? variant : :page
+    end
+
+    def render?
+      @version.present?
+    end
+
+    def services
+      @services ||= ConsentService.active.includes(:consent_category).order(:position, :name)
+    end
+
+    private
+
+    attr_reader :version, :categories, :visitor_uuid, :submit_path, :variant
+
+    def modal?
+      variant == :modal
+    end
+
+    def sar_contact_email
+      Consentful.config.sar_contact_email
+    end
+
+    def category_blurb(category)
+      raw = version.category_blurbs[category.key]
+      blurb = raw.is_a?(Hash) ? raw["description"] || raw[:description] : raw
+      blurb.presence || category.description.presence || ""
+    end
+
+    def categories_payload
+      categories.map do |category|
+        { key: category.key, name: category.name, required: category.required? }
+      end
+    end
+  end
+end

data/app/components/consentful/service_detail.html.erb

@@ -0,0 +1,99 @@
+<div>
+  <% if service.description.present? %>
+    <div class="c-consent-service__detail-section">
+      <p class="c-consent-service__detail-label">Description of Service</p>
+      <p class="c-consent-service__detail-value"><%= service.description %></p>
+    </div>
+  <% end %>
+
+  <% if service.processing_company_name.present? || service.processing_company_address.present? %>
+    <div class="c-consent-service__detail-section">
+      <p class="c-consent-service__detail-label">Processing Company</p>
+      <p class="c-consent-service__detail-value"><%= service.processing_company_name %></p>
+      <% if service.processing_company_address.present? %>
+        <p class="c-consent-service__detail-value" style="color: #494949;"><%= service.processing_company_address %></p>
+      <% end %>
+    </div>
+  <% end %>
+
+  <% if service.dpo_email.present? %>
+    <div class="c-consent-service__detail-section">
+      <p class="c-consent-service__detail-label">Data Protection Officer of Processing Company</p>
+      <p class="c-consent-service__detail-value"><%= mail_to service.dpo_email, class: "c-consent-service__detail-link" %></p>
+    </div>
+  <% end %>
+
+  <% if chips_for(service.data_purposes).any? %>
+    <div class="c-consent-service__detail-section">
+      <p class="c-consent-service__detail-label">Data Purposes</p>
+      <div class="c-consent-service__chips">
+        <% chips_for(service.data_purposes).each do |purpose| %>
+          <span class="c-consent-service__chip"><%= purpose %></span>
+        <% end %>
+      </div>
+    </div>
+  <% end %>
+
+  <% if chips_for(service.technologies_used).any? %>
+    <div class="c-consent-service__detail-section">
+      <p class="c-consent-service__detail-label">Technologies Used</p>
+      <div class="c-consent-service__chips">
+        <% chips_for(service.technologies_used).each do |tech| %>
+          <span class="c-consent-service__chip"><%= tech %></span>
+        <% end %>
+      </div>
+    </div>
+  <% end %>
+
+  <% if chips_for(service.cookie_names).any? %>
+    <div class="c-consent-service__detail-section">
+      <p class="c-consent-service__detail-label">Cookies</p>
+      <div class="c-consent-service__chips">
+        <% chips_for(service.cookie_names).each do |cookie| %>
+          <span class="c-consent-service__chip c-consent-service__chip--mono"><%= cookie %></span>
+        <% end %>
+      </div>
+    </div>
+  <% end %>
+
+  <% if chips_for(service.data_collected).any? %>
+    <div class="c-consent-service__detail-section">
+      <p class="c-consent-service__detail-label">Data Collected</p>
+      <div class="c-consent-service__chips">
+        <% chips_for(service.data_collected).each do |data| %>
+          <span class="c-consent-service__chip"><%= data %></span>
+        <% end %>
+      </div>
+    </div>
+  <% end %>
+
+  <% if service.legal_basis.present? %>
+    <div class="c-consent-service__detail-section">
+      <p class="c-consent-service__detail-label">Legal Basis</p>
+      <p class="c-consent-service__detail-value"><%= service.legal_basis %></p>
+    </div>
+  <% end %>
+
+  <% if service.processing_location.present? %>
+    <div class="c-consent-service__detail-section">
+      <p class="c-consent-service__detail-label">Location of Processing</p>
+      <ul>
+        <li><%= service.processing_location %></li>
+      </ul>
+    </div>
+  <% end %>
+
+  <% if service.retention_period.present? %>
+    <div class="c-consent-service__detail-section">
+      <p class="c-consent-service__detail-label">Retention Period</p>
+      <p class="c-consent-service__detail-value"><%= service.retention_period %></p>
+    </div>
+  <% end %>
+
+  <% if service.third_country_transfer.present? %>
+    <div class="c-consent-service__detail-section">
+      <p class="c-consent-service__detail-label">Transfer to Third Countries</p>
+      <p class="c-consent-service__detail-value"><%= service.third_country_transfer %></p>
+    </div>
+  <% end %>
+</div>

data/app/components/consentful/service_detail.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Consentful
+  class ServiceDetail < ViewComponent::Base
+    def initialize(service:)
+      super()
+      @service = service
+    end
+
+    private
+
+    attr_reader :service
+
+    def chips_for(values)
+      Array(values).compact_blank
+    end
+  end
+end

data/app/components/consentful/toggle.html.erb

@@ -0,0 +1,30 @@
+<label for="<%= id %>" class="c-consent-toggle <%= 'c-consent-toggle--disabled' if disabled %>">
+  <% if label && label_before? %>
+    <span class="c-consent-toggle__label"><%= label %></span>
+  <% end %>
+
+  <span class="c-consent-toggle__pill-wrap">
+    <input
+      type="checkbox"
+      id="<%= id %>"
+      name="<%= name %>"
+      value="<%= value %>"
+      <%= "checked" if checked %>
+      <%= "disabled" if disabled %>
+      class="c-consent-toggle__input"
+      <% data.each do |key, val| %>data-<%= key.to_s.dasherize %>="<%= val %>" <% end %>
+    />
+    <span class="c-consent-toggle__pill"></span>
+    <span class="c-consent-toggle__knob"></span>
+    <svg class="c-consent-toggle__icon c-consent-toggle__icon--off" viewBox="0 0 20 20" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true">
+      <path d="M5 5l10 10M15 5L5 15" stroke-linecap="round"/>
+    </svg>
+    <svg class="c-consent-toggle__icon c-consent-toggle__icon--on" viewBox="0 0 20 20" fill="none" stroke="currentColor" stroke-width="2.5" aria-hidden="true">
+      <path d="M4 10l4 4 8-8" stroke-linecap="round" stroke-linejoin="round"/>
+    </svg>
+  </span>
+
+  <% if label && !label_before? %>
+    <span class="c-consent-toggle__label"><%= label %></span>
+  <% end %>
+</label>

data/app/components/consentful/toggle.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Consentful
+  class Toggle < ViewComponent::Base
+    def initialize(name:, id: nil, id_scope: nil, value: "1", checked: false, disabled: false, label: nil, label_position: :right, data: {}) # rubocop:disable Metrics/ParameterLists
+      super()
+      @name = name
+      @id = id || dom_id_for(name, value, id_scope)
+      @value = value
+      @checked = checked
+      @disabled = disabled
+      @label = label
+      @label_position = label_position
+      @data = data
+    end
+
+    private
+
+    attr_reader :name, :id, :value, :checked, :disabled, :label, :label_position, :data
+
+    def dom_id_for(name, value, scope)
+      parts = [ scope, name, value ].compact.map { |part| part.to_s.parameterize(separator: "_") }
+      "toggle-#{parts.join('-')}"
+    end
+
+    def label_before?
+      label_position.to_sym == :left
+    end
+  end
+end

data/app/controllers/concerns/consentful/visitor_cookie.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module Consentful
+  # Mix into the host's ApplicationController to give every request an anonymous
+  # visitor UUID cookie and the consent-linking helper:
+  #
+  #   class ApplicationController < ActionController::Base
+  #     include Consentful::VisitorCookie
+  #     before_action :ensure_visitor_id
+  #   end
+  #
+  # The engine's own controllers include it too.
+  module VisitorCookie
+    extend ActiveSupport::Concern
+
+    included do
+      helper_method :current_consent, :consent_visitor_id
+    end
+
+    private
+
+    def ensure_visitor_id
+      return if consent_visitor_id.present?
+
+      cookies[Consentful.config.visitor_cookie_name] = consent_cookie_options.merge(
+        value: SecureRandom.uuid,
+        expires: Consentful.config.cookie_expiry_months.months.from_now
+      )
+    end
+
+    def consent_visitor_id
+      cookies[Consentful.config.visitor_cookie_name]
+    end
+
+    def current_consent
+      @current_consent ||= Consentful::ConsentState.from_cookie(cookies[Consentful.config.cookie_name])
+    end
+
+    def consent_cookie_options
+      Consentful.config.cookie_options(request)
+    end
+
+    # Bridge the anonymous visitor cookie to a known identifier (e.g. an email a
+    # user submitted) so a later SAR can resolve every consent record for them.
+    # Safe to call repeatedly — the unique index de-dupes. No-ops on blanks.
+    def link_consent_identifier!(type:, value:)
+      Consentful.link!(consent_visitor_id, type:, value:)
+    rescue StandardError => e
+      Consentful.config.error_handler(e)
+    end
+  end
+end

data/app/controllers/consentful/admin/base_controller.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Consentful
+  module Admin
+    # Base for the self-contained admin panel. Auth is delegated to the host via
+    # Consentful.config.authorize (defaults to allow-all — hosts MUST set it).
+    class BaseController < ActionController::Base
+      protect_from_forgery with: :exception
+      layout "consentful/admin"
+
+      before_action :authorize_consentful!
+
+      helper_method :consentful_identity
+
+      private
+
+      def authorize_consentful!
+        head :forbidden unless Consentful.config.authorize(self)
+      end
+
+      # Who is acting, per the host. Stamped onto published copy versions.
+      def consentful_identity
+        Consentful.config.identify(self)
+      end
+    end
+  end
+end

data/app/controllers/consentful/admin/categories_controller.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module Consentful
+  module Admin
+    class CategoriesController < BaseController
+      before_action :set_category, only: [ :edit, :update ]
+
+      def index
+        @categories = ConsentCategory.all
+      end
+
+      def edit; end
+
+      def update
+        if @category.update(category_params)
+          redirect_to admin_categories_path, notice: "Category updated."
+        else
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
+      def reorder
+        reorder_entries.each { |entry| ConsentCategory.update(entry[:id], position: entry[:position]) }
+        head :no_content
+      end
+
+      private
+
+      def set_category
+        @category = ConsentCategory.find(params[:id])
+      end
+
+      def category_params
+        attrs = params.require(:consent_category).permit(:name, :description, :gtag_keys)
+        attrs[:gtag_keys] = attrs[:gtag_keys].to_s.split(",").map(&:strip).compact_blank if attrs.key?(:gtag_keys)
+        attrs
+      end
+
+      def reorder_entries
+        raw = params.require(:consent_categories)
+        list = raw.respond_to?(:values) ? raw.values : raw
+        list.map { |entry| entry.permit(:id, :position) }
+      end
+    end
+  end
+end

data/app/controllers/consentful/admin/copy_versions_controller.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+module Consentful
+  module Admin
+    class CopyVersionsController < BaseController
+      before_action :set_version, only: [ :show, :edit, :update, :destroy, :publish, :archive, :restore ]
+      before_action :require_draft, only: [ :edit, :update, :destroy ]
+
+      def index
+        @versions = ConsentCopyVersion.order(created_at: :desc)
+      end
+
+      def show; end
+
+      def new
+        @version = ConsentCopyVersion.new(category_blurbs: blank_category_blurbs)
+      end
+
+      def edit; end
+
+      def create
+        @version = ConsentCopyVersion.new(version_params)
+        if @version.save
+          redirect_to edit_admin_copy_version_path(@version), notice: "Draft created."
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def update
+        if @version.update(version_params)
+          redirect_to edit_admin_copy_version_path(@version), notice: "Draft updated."
+        else
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
+      def destroy
+        @version.destroy
+        redirect_to admin_copy_versions_path, notice: "Draft deleted."
+      end
+
+      def publish
+        unless @version.draft?
+          redirect_to admin_copy_versions_path, alert: "Only draft versions can be published."
+          return
+        end
+
+        @version.publish!(consentful_identity)
+        redirect_to admin_copy_versions_path, notice: "Published. Any previously published version has been archived."
+      end
+
+      def archive
+        unless @version.published?
+          redirect_to admin_copy_versions_path, alert: "Only published versions can be archived."
+          return
+        end
+
+        @version.archive!
+        redirect_to admin_copy_versions_path, notice: "Archived."
+      end
+
+      def restore
+        if @version.draft?
+          redirect_to admin_copy_versions_path, alert: "Draft versions are already editable."
+          return
+        end
+
+        draft = ConsentCopyVersion.create!(
+          banner_title: @version.banner_title,
+          banner_body: @version.banner_body,
+          modal_intro: @version.modal_intro,
+          accept_label: @version.accept_label,
+          reject_label: @version.reject_label,
+          manage_label: @version.manage_label,
+          save_label: @version.save_label,
+          category_blurbs: @version.category_blurbs.deep_dup,
+          status: :draft
+        )
+
+        redirect_to edit_admin_copy_version_path(draft),
+                    notice: "Cloned to a new draft. Edit and publish when you're ready."
+      end
+
+      private
+
+      def set_version
+        @version = ConsentCopyVersion.find(params[:id])
+      end
+
+      def require_draft
+        return if @version.draft?
+
+        redirect_to admin_copy_versions_path,
+                    alert: "Published and archived versions are read-only. Create a new draft to make changes."
+      end
+
+      def version_params
+        params.require(:consent_copy_version).permit(
+          :banner_title, :banner_body, :modal_intro,
+          :accept_label, :reject_label, :manage_label, :save_label,
+          category_blurbs: {}
+        )
+      end
+
+      def blank_category_blurbs
+        ConsentCategory.order(:position).each_with_object({}) do |category, blurbs|
+          blurbs[category.key] = ""
+        end
+      end
+    end
+  end
+end

data/app/controllers/consentful/admin/dashboard_controller.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Consentful
+  module Admin
+    class DashboardController < BaseController
+      def show
+        @report = DashboardReport.new(days: params[:days])
+      end
+    end
+  end
+end

data/app/controllers/consentful/admin/records_controller.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Consentful
+  module Admin
+    class RecordsController < BaseController
+      def index
+        @lookup = SarLookup.new(email: params[:email], visitor_uuid: params[:visitor_uuid])
+      end
+    end
+  end
+end