consentful 0.1.0.pre1

data/app/controllers/consentful/admin/services_controller.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module Consentful
+  module Admin
+    class ServicesController < BaseController
+      ARRAY_FIELDS = %i[cookie_names data_collected data_purposes technologies_used].freeze
+
+      before_action :set_service, only: [ :edit, :update, :destroy ]
+      before_action :set_categories, only: [ :new, :edit, :create, :update ]
+
+      def index
+        @services_by_category = ConsentCategory.includes(:consent_services).order(:position).index_with do |category|
+          category.consent_services.order(:position, :name)
+        end
+
+        respond_to do |format|
+          format.html
+          format.json { render json: export_payload }
+        end
+      end
+
+      def new
+        @service = ConsentService.new(consent_category: @categories.first, active: true)
+      end
+
+      def edit; end
+
+      def create
+        @service = ConsentService.new(service_params)
+        if @service.save
+          redirect_to edit_admin_service_path(@service), notice: "Service created."
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def update
+        if @service.update(service_params)
+          redirect_to edit_admin_service_path(@service), notice: "Service updated."
+        else
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
+      def destroy
+        @service.destroy
+        redirect_to admin_services_path, notice: "Service deleted."
+      end
+
+      private
+
+      def set_service
+        @service = ConsentService.find(params[:id])
+      end
+
+      def set_categories
+        @categories = ConsentCategory.order(:position)
+      end
+
+      def service_params
+        attrs = params.require(:consent_service).permit(
+          :name, :slug, :consent_category_id, :loader_kind, :loader_ref, :domain, :active,
+          :description, :processing_company_name, :processing_company_address, :dpo_email,
+          :privacy_url, :legal_basis, :retention_period, :processing_location, :third_country_transfer,
+          :cookie_names, :data_collected, :data_purposes, :technologies_used
+        )
+        ARRAY_FIELDS.each do |field|
+          attrs[field] = attrs[field].to_s.split(",").map(&:strip).compact_blank if attrs.key?(field)
+        end
+        attrs
+      end
+
+      def export_payload
+        ConsentService.includes(:consent_category).order(:position, :name).map do |service|
+          service.as_json(except: %i[created_at updated_at]).merge(category_key: service.consent_category.key)
+        end
+      end
+    end
+  end
+end

data/app/controllers/consentful/application_controller.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Consentful
+  class ApplicationController < ActionController::Base
+    include Consentful::VisitorCookie
+
+    layout -> { Consentful.config.layout }
+  end
+end

data/app/controllers/consentful/consent_controller.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+module Consentful
+  # Public-facing endpoints:
+  #   POST /consent        — record a choice and persist the cookie
+  #   GET  /consent/state  — JSON probe of the current cookie state
+  #   POST /consent/link   — bridge the visitor UUID to a known identifier
+  #   GET  /cookie-preferences — standalone preference centre page
+  class ConsentController < ApplicationController
+    skip_before_action :verify_authenticity_token, only: [ :update, :link ], raise: false
+
+    before_action :ensure_visitor_id, only: [ :preferences ]
+
+    wrap_parameters false
+
+    def update
+      record = build_record
+      payload = cookie_payload(record)
+
+      ActiveRecord::Base.transaction do
+        record.save!
+        write_consent_cookie(payload)
+      end
+
+      head :no_content
+    end
+
+    def state
+      payload = ConsentState.parse(cookies[Consentful.config.cookie_name])
+      render json: {
+        cookie: payload,
+        published_version_id: ConsentCopyVersion.current&.id
+      }
+    end
+
+    def preferences
+      @published_version = ConsentCopyVersion.current
+      @categories = ConsentCategory.includes(:consent_services).order(:position)
+    end
+
+    def link
+      type = link_params[:type].to_s.presence_in(ConsentVisitorLink.identifier_types.keys)
+      if type.nil?
+        head :unprocessable_entity
+        return
+      end
+
+      link_consent_identifier!(type: type.to_sym, value: link_params[:value])
+      head :no_content
+    end
+
+    private
+
+    def link_params
+      @link_params ||= params.permit(:type, :value)
+    end
+
+    def build_record
+      published = ConsentCopyVersion.current
+      raise ActionController::BadRequest, "no published consent copy" if published.nil?
+
+      ConsentRecord.new(
+        visitor_uuid: consent_visitor_id,
+        consent_copy_version: published,
+        category_choices: filtered_categories,
+        service_overrides: filtered_services,
+        source: source_param,
+        user_agent: request.user_agent,
+        referer: request.referer
+      )
+    end
+
+    def cookie_payload(record)
+      {
+        version_id: record.consent_copy_version_id,
+        categories: filtered_categories,
+        services: compact_service_overrides,
+        recorded_at: Time.current.to_i
+      }
+    end
+
+    def write_consent_cookie(payload)
+      cookies[Consentful.config.cookie_name] = consent_cookie_options.merge(
+        value: payload.to_json,
+        expires: Consentful.config.cookie_expiry_months.months.from_now
+      )
+    end
+
+    def filtered_categories
+      valid_keys = ConsentCategory.pluck(:key).to_set
+      raw = consent_params[:categories].to_h
+      raw.each_with_object({}) do |(key, value), acc|
+        next unless valid_keys.include?(key.to_s)
+
+        acc[key.to_s] = ActiveModel::Type::Boolean.new.cast(value)
+      end
+    end
+
+    def filtered_services
+      valid_slugs = ConsentService.pluck(:slug).to_set
+      raw = consent_params[:services].to_h
+      raw.each_with_object({}) do |(slug, value), acc|
+        next unless valid_slugs.include?(slug.to_s)
+
+        acc[slug.to_s] = ActiveModel::Type::Boolean.new.cast(value)
+      end
+    end
+
+    def compact_service_overrides
+      categories = filtered_categories
+      services = filtered_services
+      category_for_slug = ConsentService.where(slug: services.keys).pluck(:slug, :consent_category_id).to_h
+      category_keys = ConsentCategory.where(id: category_for_slug.values.uniq).pluck(:id, :key).to_h
+
+      services.reject do |slug, value|
+        category_id = category_for_slug[slug]
+        category_default = categories[category_keys[category_id]]
+        value == category_default
+      end
+    end
+
+    def source_param
+      return :preference_centre unless ConsentRecord.sources.key?(consent_params[:source].to_s)
+
+      consent_params[:source].to_sym
+    end
+
+    def consent_params
+      @consent_params ||= params.permit(:source, categories: {}, services: {})
+    end
+  end
+end

data/app/helpers/consentful/application_helper.rb

@@ -0,0 +1,4 @@
+module Consentful
+  module ApplicationHelper
+  end
+end

data/app/helpers/consentful/consent_helper.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Consentful
+  # View helpers for gating inline tracking. The host keeps its own
+  # `render_tracking_for` partial loader (its tracking partials are app-specific);
+  # the engine exposes only the consent decision.
+  module ConsentHelper
+    def current_consent
+      @current_consent ||= ConsentState.from_cookie(cookies[Consentful.config.cookie_name])
+    end
+
+    # Gate for inline tracking scripts. Allows everything while enforcement is
+    # off (rollout flag); once on, an unknown slug defaults to denied.
+    def consent_allowed?(slug)
+      return true unless Consentful.config.enforce
+
+      service = ConsentService.find_by(slug:)
+      return false if service.nil?
+
+      current_consent.allowed?(service)
+    end
+  end
+end

data/app/javascript/consentful/controllers/banner_controller.js

@@ -0,0 +1,92 @@
+import { Controller } from '@hotwired/stimulus';
+import { readConsent, shouldShowBanner, writeOptimistic, applyConsent } from '../state';
+
+export default class extends Controller {
+  static targets = ['categoryToggle'];
+
+  static values = {
+    expectedVersionId: Number,
+    submitPath: String,
+    categories: Array,
+  };
+
+  connect() {
+    const state = readConsent();
+    if (shouldShowBanner(state, this.expectedVersionIdValue)) {
+      this.show();
+    }
+    this.handleConsentUpdated = () => this.hide();
+    window.addEventListener('consent:updated', this.handleConsentUpdated);
+  }
+
+  disconnect() {
+    window.removeEventListener('consent:updated', this.handleConsentUpdated);
+  }
+
+  show() {
+    this.element.classList.remove('c-consent__hidden');
+  }
+
+  hide() {
+    this.element.classList.add('c-consent__hidden');
+  }
+
+  accept() {
+    const categories = {};
+    this.categoriesValue.forEach((category) => {
+      categories[category.key] = true;
+    });
+    this.submit({ categories, source: 'banner_accept_all' });
+  }
+
+  reject() {
+    const categories = {};
+    this.categoriesValue.forEach((category) => {
+      categories[category.key] = category.required === true;
+    });
+    this.submit({ categories, source: 'banner_reject_all' });
+  }
+
+  save() {
+    const categories = this.readToggleSelections();
+    this.submit({ categories, source: 'banner_save' });
+  }
+
+  readToggleSelections() {
+    const categories = {};
+    this.categoryToggleTargets.forEach((input) => {
+      const key = input.dataset.categoryKey;
+      if (key) categories[key] = input.checked;
+    });
+    this.categoriesValue.forEach((category) => {
+      if (category.required) categories[category.key] = true;
+    });
+    return categories;
+  }
+
+  async submit({ categories, source }) {
+    const csrfToken = document.querySelector('meta[name="csrf-token"]')?.content;
+    const response = await fetch(this.submitPathValue, {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+        'X-CSRF-Token': csrfToken || '',
+      },
+      body: JSON.stringify({ categories, source }),
+    });
+
+    if (!response.ok) return;
+
+    const optimisticState = {
+      version_id: this.expectedVersionIdValue,
+      categories,
+      services: {},
+      recorded_at: Math.floor(Date.now() / 1000),
+    };
+    writeOptimistic(optimisticState);
+    applyConsent(optimisticState);
+    this.hide();
+  }
+}

data/app/javascript/consentful/controllers/clipboard_copy_controller.js

@@ -0,0 +1,30 @@
+import { Controller } from '@hotwired/stimulus';
+
+export default class extends Controller {
+  static values = {
+    text: String,
+    successLabel: { type: String, default: 'Copied' },
+    resetMs: { type: Number, default: 2000 },
+  };
+
+  async copy(event) {
+    const button = event.currentTarget;
+    const originalLabel = button.textContent;
+    if (!navigator.clipboard?.writeText) return;
+
+    try {
+      await navigator.clipboard.writeText(this.textValue);
+    } catch (_err) {
+      return;
+    }
+
+    button.textContent = this.successLabelValue;
+    button.disabled = true;
+
+    clearTimeout(this.resetTimer);
+    this.resetTimer = setTimeout(() => {
+      button.textContent = originalLabel;
+      button.disabled = false;
+    }, this.resetMsValue);
+  }
+}

data/app/javascript/consentful/controllers/modal_controller.js

@@ -0,0 +1,50 @@
+import { Controller } from '@hotwired/stimulus';
+
+export default class extends Controller {
+  static targets = ['dialog'];
+
+  connect() {
+    this.previouslyFocused = null;
+    this.handleKey = this.handleKey.bind(this);
+    this.handleConsentClose = this.handleConsentClose.bind(this);
+
+    window.addEventListener('consent:open-modal', this.open);
+    window.addEventListener('consent:close', this.handleConsentClose);
+  }
+
+  disconnect() {
+    window.removeEventListener('consent:open-modal', this.open);
+    window.removeEventListener('consent:close', this.handleConsentClose);
+    document.removeEventListener('keydown', this.handleKey);
+  }
+
+  open = () => {
+    this.previouslyFocused = document.activeElement;
+    this.element.classList.remove('c-consent__hidden');
+    document.documentElement.style.overflow = 'hidden';
+    document.addEventListener('keydown', this.handleKey);
+    const focusable = this.element.querySelector(
+      'button, [href], input, select, textarea, [tabindex]:not([tabindex="-1"])',
+    );
+    focusable?.focus();
+  };
+
+  close = () => {
+    this.element.classList.add('c-consent__hidden');
+    document.documentElement.style.overflow = '';
+    document.removeEventListener('keydown', this.handleKey);
+    this.previouslyFocused?.focus?.();
+  };
+
+  closeFromBackdrop(event) {
+    if (event.target === this.element) this.close();
+  }
+
+  handleKey(event) {
+    if (event.key === 'Escape') this.close();
+  }
+
+  handleConsentClose() {
+    this.close();
+  }
+}

data/app/javascript/consentful/controllers/modal_trigger_controller.js

@@ -0,0 +1,9 @@
+import { Controller } from '@hotwired/stimulus';
+
+export default class extends Controller {
+  open(event) {
+    if (!document.getElementById('consent-modal-root')) return;
+    event.preventDefault();
+    window.dispatchEvent(new CustomEvent('consent:open-modal'));
+  }
+}

data/app/javascript/consentful/controllers/preferences_controller.js

@@ -0,0 +1,182 @@
+import { Controller } from '@hotwired/stimulus';
+import { readConsent, writeOptimistic, applyConsent } from '../state';
+
+export default class extends Controller {
+  static targets = ['tab', 'tabPanel', 'categoryMaster', 'serviceToggle', 'reference'];
+
+  static values = {
+    expectedVersionId: Number,
+    submitPath: String,
+    categories: Array,
+  };
+
+  connect() {
+    this.hydrateFromCookie();
+    this.handleOpenModal = this.handleOpenModal.bind(this);
+    window.addEventListener('consent:open-modal', this.handleOpenModal);
+  }
+
+  disconnect() {
+    window.removeEventListener('consent:open-modal', this.handleOpenModal);
+  }
+
+  handleOpenModal() {
+    this.hydrateFromCookie();
+  }
+
+  hydrateFromCookie() {
+    const state = readConsent();
+    this.categoryMasterTargets.forEach((input) => {
+      const key = input.dataset.categoryKey;
+      if (key && Object.prototype.hasOwnProperty.call(state.categories, key)) {
+        input.checked = Boolean(state.categories[key]);
+      }
+    });
+    this.serviceToggleTargets.forEach((input) => {
+      const slug = input.dataset.serviceSlug;
+      const categoryKey = input.dataset.categoryKey;
+      if (slug && Object.prototype.hasOwnProperty.call(state.services, slug)) {
+        input.checked = Boolean(state.services[slug]);
+      } else if (categoryKey && Object.prototype.hasOwnProperty.call(state.categories, categoryKey)) {
+        input.checked = Boolean(state.categories[categoryKey]);
+      }
+    });
+  }
+
+  switchTab(event) {
+    const target = event.currentTarget.dataset.tab;
+    this.tabTargets.forEach((tab) => {
+      const isActive = tab.dataset.tab === target;
+      tab.setAttribute('aria-selected', String(isActive));
+      tab.classList.toggle('c-consent-preferences__tab--active', isActive);
+    });
+    this.tabPanelTargets.forEach((panel) => {
+      panel.classList.toggle('c-consent__hidden', panel.dataset.tab !== target);
+    });
+  }
+
+  toggleSection(event) {
+    event.preventDefault();
+    const sectionId = event.currentTarget.dataset.sectionTarget;
+    const body = this.element.querySelector(`[data-section-body="${sectionId}"]`);
+    const chevron = this.element.querySelector(`[data-section-chevron="${sectionId}"]`);
+    if (!body) return;
+    const isOpen = !body.classList.toggle('c-consent__hidden');
+    event.currentTarget.setAttribute('aria-expanded', String(isOpen));
+    if (chevron) chevron.style.transform = isOpen ? 'rotate(180deg)' : '';
+  }
+
+  cascadeCategory(event) {
+    const masterInput = event.currentTarget;
+    const categoryKey = masterInput.dataset.categoryKey;
+    const checked = masterInput.checked;
+    this.serviceToggleTargets.forEach((toggle) => {
+      if (toggle.dataset.categoryKey === categoryKey && !toggle.disabled) {
+        toggle.checked = checked;
+      }
+    });
+  }
+
+  syncServiceToggle(event) {
+    const source = event.currentTarget;
+    const slug = source.dataset.serviceSlug;
+    if (!slug) return;
+    this.serviceToggleTargets.forEach((toggle) => {
+      if (toggle !== source && toggle.dataset.serviceSlug === slug) {
+        toggle.checked = source.checked;
+      }
+    });
+  }
+
+  accept() {
+    const categories = {};
+    this.categoriesValue.forEach((category) => {
+      categories[category.key] = true;
+    });
+    this.submit({ categories, services: {}, source: 'preference_centre' });
+  }
+
+  reject() {
+    const categories = {};
+    this.categoriesValue.forEach((category) => {
+      categories[category.key] = category.required === true;
+    });
+    this.submit({ categories, services: {}, source: 'preference_centre' });
+  }
+
+  save() {
+    const categories = {};
+    this.categoryMasterTargets.forEach((input) => {
+      categories[input.dataset.categoryKey] = input.checked || input.disabled;
+    });
+    this.categoriesValue.forEach((category) => {
+      if (category.required) categories[category.key] = true;
+    });
+
+    const services = {};
+    this.serviceToggleTargets.forEach((toggle) => {
+      const slug = toggle.dataset.serviceSlug;
+      const categoryKey = toggle.dataset.categoryKey;
+      if (!slug || toggle.disabled) return;
+      if (toggle.checked !== Boolean(categories[categoryKey])) {
+        services[slug] = toggle.checked;
+      }
+    });
+
+    this.submit({ categories, services, source: 'preference_centre' });
+  }
+
+  close() {
+    this.element.dispatchEvent(new CustomEvent('consent:close', { bubbles: true }));
+  }
+
+  async copyReference(event) {
+    if (!this.hasReferenceTarget) return;
+    const button = event.currentTarget;
+    const originalText = button.textContent;
+    const value = this.referenceTarget.textContent.trim();
+    if (!navigator.clipboard?.writeText) return;
+
+    try {
+      await navigator.clipboard.writeText(value);
+    } catch (_err) {
+      return;
+    }
+
+    button.textContent = 'Copied';
+    button.disabled = true;
+
+    clearTimeout(this.copyResetTimer);
+    this.copyResetTimer = setTimeout(() => {
+      button.textContent = originalText;
+      button.disabled = false;
+    }, 2000);
+  }
+
+  async submit({ categories, services, source }) {
+    const csrfToken = document.querySelector('meta[name="csrf-token"]')?.content;
+    const response = await fetch(this.submitPathValue, {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+        'X-CSRF-Token': csrfToken || '',
+      },
+      body: JSON.stringify({ categories, services, source }),
+    });
+
+    if (!response.ok) return;
+
+    const optimisticState = {
+      version_id: this.expectedVersionIdValue,
+      categories,
+      services,
+      recorded_at: Math.floor(Date.now() / 1000),
+    };
+    writeOptimistic(optimisticState);
+    applyConsent(optimisticState);
+    this.element.dispatchEvent(new CustomEvent('consent:updated', { bubbles: true }));
+    window.dispatchEvent(new CustomEvent('consent:close'));
+  }
+}

data/app/javascript/consentful/index.js

@@ -0,0 +1,42 @@
+// Engine JS entry point. Hosts import this and register the controllers with
+// their own Stimulus application:
+//
+//   import { registerConsentful } from 'consentful';
+//   registerConsentful(application, { cookieName: 'scl_consent' });
+//
+// Or cherry-pick the individual controllers / state helpers.
+
+import { configureConsent } from './state';
+import BannerController from './controllers/banner_controller';
+import ModalController from './controllers/modal_controller';
+import ModalTriggerController from './controllers/modal_trigger_controller';
+import PreferencesController from './controllers/preferences_controller';
+import ClipboardCopyController from './controllers/clipboard_copy_controller';
+
+export {
+  configureConsent,
+  readConsent,
+  isExpired,
+  matchesVersion,
+  shouldShowBanner,
+  isServiceAllowed,
+  applyConsent,
+  writeOptimistic,
+} from './state';
+
+export {
+  BannerController,
+  ModalController,
+  ModalTriggerController,
+  PreferencesController,
+  ClipboardCopyController,
+};
+
+export function registerConsentful(application, { cookieName } = {}) {
+  if (cookieName) configureConsent({ cookieName });
+  application.register('consentful--banner', BannerController);
+  application.register('consentful--modal', ModalController);
+  application.register('consentful--modal-trigger', ModalTriggerController);
+  application.register('consentful--preferences', PreferencesController);
+  application.register('consentful--clipboard', ClipboardCopyController);
+}