consently 1.0.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dab77a672e8b422500eceb9e90f0481fc4f7abb180e22ca7c12fadf98c4ef9ef
-  data.tar.gz: 802a3a6d8c5915acce9d6e843bb5fd8b10a28a7eafb4dd68d0af8bc8617ba43b
+  metadata.gz: 5a4c3433bcb18de24b5fc9849e955ef217502f51f01e4a281e23a493ae18a681
+  data.tar.gz: 1347eb53ce32770929522ada6c86a35a068c450cd738466d88913f98019191c8
 SHA512:
-  metadata.gz: 3097f21d9037f63e8d27a697e73c2fae5e54b246e1de83e6722a40b2915005400c45ede835a7d8b77aaf1c3da55b877ba6318e23617aad7b3d00de9d0b001e59
-  data.tar.gz: 4247ab6d468b280bc7b784c52401d1f4ee53d98e627f168206159bea2daebc08ff3c359124afd71849b7cf535de37f9b50b49795e020099c988db74dfd12fc67
+  metadata.gz: 532e7e0eab42de4a040fedb640ef70cb575cd651d3b871c743cd3259abf9562f681248c25b1d9d2662321c7d904850544404072ac3da75316cd7fa31962b8a3c
+  data.tar.gz: 2b4cbaa8b217c5691836b8b425d716e862642f865018a7dc24da428c9eb3861d35bc3a475238a56ae7857df3038e32462e33b3f7bafb9673dc53af727eebad29

data/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 2.0.0 (2026-10-31)
+
+- The banner asks only about categories in use: one with a tag in it (in any
+  scope) or one declared with `c.category`. A site with nothing but Google
+  Analytics no longer shows a "Marketing" checkbox for marketing it does not
+  do. `c.categories = [...]` fixes the list by hand.
+- The banner message follows the categories: analytics alone reads "to
+  understand how it is used and improve it", without the "relevant offers"
+  that only marketing justifies. Every locale has the new `message_analytics`
+  and `message_marketing`.
+- No optional category, no banner: there is nothing to ask.
+- Checkboxes are drawn by the gem's CSS instead of left native, so a reset in
+  the host app (`@tailwindcss/forms` turns every checkbox square) no longer
+  restyles them. `--consently-checkbox-border` and
+  `--consently-checkbox-radius` tune them.
+- **Upgrading:** `consently_embed` raises when its category is not offered,
+  since the visitor could never release it. A site whose embeds wait for
+  `marketing` without any marketing tag adds `c.category :marketing`.
+
 ## 1.0.0 (2026-09-04)
 
 - Events speak the language of the page's tags: `gtag('event', ...)` under

data/README.md

@@ -102,11 +102,25 @@ c.tag :custom, as: :inline_thing, category: :marketing, inline: "console.log('hi
 
 ## Consent
 
-Three categories out of the box - `necessary`, `analytics`, `marketing` - and
-you can add your own:
+Three categories out of the box - `necessary`, `analytics`, `marketing` - but
+the banner only asks about the ones you use: a category is offered when a tag
+sits in it (in any scope) or when you declare it. A site running nothing but
+Google Analytics gets a single checkbox, and a message that does not promise
+"relevant offers" it never makes. With only `necessary` tags there is nothing
+to ask, and no banner.
+
+Declare a category that only your views use - an embed, an event - or one of
+your own:
+
+```ruby
+c.category :marketing        # a YouTube embed waits for it
+c.category :personalization  # name it in your locale file
+```
+
+Or fix the list and its order outright (`necessary` is always added):
 
 ```ruby
-c.category :personalization
+c.categories = %i[analytics marketing]
 ```
 
 `necessary` never waits for a click. Everything else is blocked until the
@@ -427,7 +441,8 @@ Configuration:
 | --- | --- |
 | `c.tag key, **options` | `id:`, `domain:`, `category:`, `as:` (name it, for two of a kind) |
 | `c.scope(name) { \|s\| ... }` | tags for one tenant; `c.scope_resolver` decides which one a request is |
-| `c.category :name` | a category of your own beside `necessary`, `analytics`, `marketing` |
+| `c.category :name` | offer a category no tag uses: your own, or a built-in one for embeds and events |
+| `c.categories = [...]` | fix the offered categories instead of deriving them from the tags |
 | `c.consent_version` | bump it and every older consent stops counting |
 | `c.enabled` | `true`, `false`, or a callable taking the request |
 | `c.reload_after_choice` | reload once a choice is made; off by default |

data/app/assets/stylesheets/consently.css

@@ -23,6 +23,8 @@
   --consently-radius: 0.75rem;
   --consently-shadow: 0 10px 15px -3px rgba(0, 0, 0, 0.1), 0 4px 6px -4px rgba(0, 0, 0, 0.1);
   --consently-max-width: 36rem;
+  --consently-checkbox-border: #d1d5db;
+  --consently-checkbox-radius: 0.25rem;
 }
 
 .consently {
@@ -90,11 +92,46 @@
   line-height: 1.5rem;
 }
 
-.consently__option input {
-  margin: 0.3rem 0 0;
+/* Drawn by hand rather than left native: CSS resets in the host app
+   (@tailwindcss/forms and friends) restyle every [type=checkbox] on the page
+   and the banner ends up with square boxes in the wrong colour. These
+   selectors outrank such resets, so the box looks the same everywhere. */
+.consently__option input[type="checkbox"] {
+  -webkit-appearance: none;
+  appearance: none;
+  flex: none;
+  box-sizing: border-box;
+  display: inline-block;
+  margin: 0.25rem 0 0;
+  padding: 0;
   width: 1rem;
   height: 1rem;
-  accent-color: var(--consently-accent);
+  border: 1px solid var(--consently-checkbox-border);
+  border-radius: var(--consently-checkbox-radius);
+  background: var(--consently-background) none center / 100% 100% no-repeat;
+  box-shadow: none;
+  cursor: pointer;
+}
+
+.consently__option input[type="checkbox"]:checked {
+  border-color: transparent;
+  background-color: var(--consently-accent);
+  background-image: url("data:image/svg+xml,%3csvg viewBox='0 0 16 16' fill='white' xmlns='http://www.w3.org/2000/svg'%3e%3cpath d='M12.207 4.793a1 1 0 010 1.414l-5 5a1 1 0 01-1.414 0l-2-2a1 1 0 011.414-1.414L6.5 9.086l4.293-4.293a1 1 0 011.414 0z'/%3e%3c/svg%3e");
+}
+
+.consently__option input[type="checkbox"]:disabled {
+  cursor: default;
+  opacity: 0.6;
+}
+
+.consently__option input[type="checkbox"]:focus {
+  box-shadow: none;
+  outline: none;
+}
+
+.consently__option input[type="checkbox"]:focus-visible {
+  outline: 2px solid var(--consently-accent);
+  outline-offset: 2px;
 }
 
 .consently__option-name {

data/app/helpers/consently/tags_helper.rb

@@ -42,6 +42,8 @@ module Consently
     # `consently_preferences_link` has something to reopen.
     def consently_banner(policy_url: nil)
       return "".html_safe unless consently_enabled? && Consently.consent_required?(request)
+      # Only necessary cookies: nothing to ask, so no banner.
+      return "".html_safe if Consently.config.optional_categories.empty?
 
       render "consently/banner",
         consent: consently_consent,
@@ -149,6 +151,13 @@ module Consently
     # button that opens the preferences panel; the iframe appears the moment
     # they agree, without a reload.
     def consently_embed(kind, identifier, category: :marketing, title: nil, ratio: "16 / 9", **iframe_options)
+      # The placeholder sends the visitor to a checkbox; without one the
+      # embed could never be released.
+      unless Consently.config.category?(category)
+        raise ArgumentError, "consently_embed waits for the #{category} category, which the banner does not offer - " \
+          "add `c.category :#{category}` to config/initializers/consently.rb"
+      end
+
       src = consently_embed_src(kind, identifier)
       return "".html_safe if src.blank?
 

data/app/views/consently/_banner.html.erb

@@ -32,7 +32,9 @@
        aria-labelledby="consently-message"
        tabindex="-1">
     <p class="consently__text" id="consently-message">
-      <%= t("consently.banner.message") %>
+      <%# The message names only what is asked for: a site without marketing
+          tags does not promise "relevant offers". %>
+      <%= t("consently.banner.message_#{categories.map(&:to_s).sort.join("_")}", default: t("consently.banner.message")) %>
       <% if policy_url.present? %>
         <%= link_to t("consently.banner.policy_link"), policy_url, class: "consently__link" %>
       <% end %>

data/config/locales/cs.yml

@@ -2,6 +2,8 @@ cs:
   consently:
     banner:
       message: "Používáme soubory cookie, aby tento web fungoval, a s vaším souhlasem také k tomu, abychom rozuměli, jak jej používáte, a mohli vám ukazovat relevantní nabídky."
+      message_analytics: "Používáme soubory cookie, aby tento web fungoval, a s vaším souhlasem také k tomu, abychom rozuměli, jak jej používáte, a mohli jej zlepšovat."
+      message_marketing: "Používáme soubory cookie, aby tento web fungoval, a s vaším souhlasem také k tomu, abychom vám mohli ukazovat relevantní nabídky."
       policy_link: "Přečtěte si naše zásady cookies."
       accept_all: "Přijmout vše"
       reject_all: "Odmítnout vše"

data/config/locales/de.yml

@@ -2,6 +2,8 @@ de:
   consently:
     banner:
       message: "Wir verwenden Cookies, damit diese Website funktioniert - und mit Ihrer Einwilligung, um zu verstehen, wie sie genutzt wird, und Ihnen passende Angebote zu zeigen."
+      message_analytics: "Wir verwenden Cookies, damit diese Website funktioniert - und mit Ihrer Einwilligung, um zu verstehen, wie sie genutzt wird, und sie zu verbessern."
+      message_marketing: "Wir verwenden Cookies, damit diese Website funktioniert - und mit Ihrer Einwilligung, um Ihnen passende Angebote zu zeigen."
       policy_link: "Zur Cookie-Richtlinie."
       accept_all: "Alle akzeptieren"
       reject_all: "Alle ablehnen"

data/config/locales/en.yml

@@ -2,6 +2,8 @@ en:
   consently:
     banner:
       message: "We use cookies to run this site, and - with your consent - to understand how it is used and to show you relevant offers."
+      message_analytics: "We use cookies to run this site, and - with your consent - to understand how it is used and improve it."
+      message_marketing: "We use cookies to run this site, and - with your consent - to show you relevant offers."
       policy_link: "Read our cookie policy."
       accept_all: "Accept all"
       reject_all: "Reject all"

data/config/locales/es.yml

@@ -2,6 +2,8 @@ es:
   consently:
     banner:
       message: "Usamos cookies para que este sitio funcione y, con tu consentimiento, para entender cómo se usa y mostrarte ofertas relevantes."
+      message_analytics: "Usamos cookies para que este sitio funcione y, con tu consentimiento, para entender cómo se usa y mejorarlo."
+      message_marketing: "Usamos cookies para que este sitio funcione y, con tu consentimiento, para mostrarte ofertas relevantes."
       policy_link: "Lee nuestra política de cookies."
       accept_all: "Aceptar todo"
       reject_all: "Rechazar todo"

data/config/locales/fr.yml

@@ -2,6 +2,8 @@ fr:
   consently:
     banner:
       message: "Nous utilisons des cookies pour faire fonctionner ce site et, avec votre accord, pour comprendre comment il est utilisé et vous proposer des offres pertinentes."
+      message_analytics: "Nous utilisons des cookies pour faire fonctionner ce site et, avec votre accord, pour comprendre comment il est utilisé et l'améliorer."
+      message_marketing: "Nous utilisons des cookies pour faire fonctionner ce site et, avec votre accord, pour vous proposer des offres pertinentes."
       policy_link: "Consulter notre politique de cookies."
       accept_all: "Tout accepter"
       reject_all: "Tout refuser"

data/config/locales/hu.yml

@@ -2,6 +2,8 @@ hu:
   consently:
     banner:
       message: "Sütiket használunk, hogy az oldal működjön, és - a hozzájárulásoddal - hogy megértsük, hogyan használod, illetve releváns ajánlatokat mutassunk."
+      message_analytics: "Sütiket használunk, hogy az oldal működjön, és - a hozzájárulásoddal - hogy megértsük, hogyan használod, és fejleszthessük."
+      message_marketing: "Sütiket használunk, hogy az oldal működjön, és - a hozzájárulásoddal - hogy releváns ajánlatokat mutassunk."
       policy_link: "Olvasd el a süti szabályzatunkat."
       accept_all: "Összes elfogadása"
       reject_all: "Összes elutasítása"

data/config/locales/it.yml

@@ -2,6 +2,8 @@ it:
   consently:
     banner:
       message: "Usiamo i cookie per far funzionare questo sito e, con il tuo consenso, per capire come viene usato e mostrarti offerte pertinenti."
+      message_analytics: "Usiamo i cookie per far funzionare questo sito e, con il tuo consenso, per capire come viene usato e migliorarlo."
+      message_marketing: "Usiamo i cookie per far funzionare questo sito e, con il tuo consenso, per mostrarti offerte pertinenti."
       policy_link: "Leggi la nostra cookie policy."
       accept_all: "Accetta tutto"
       reject_all: "Rifiuta tutto"

data/config/locales/nl.yml

@@ -2,6 +2,8 @@ nl:
   consently:
     banner:
       message: "We gebruiken cookies om deze site te laten werken en, met jouw toestemming, om te begrijpen hoe de site gebruikt wordt en je relevante aanbiedingen te tonen."
+      message_analytics: "We gebruiken cookies om deze site te laten werken en, met jouw toestemming, om te begrijpen hoe de site gebruikt wordt en hem te verbeteren."
+      message_marketing: "We gebruiken cookies om deze site te laten werken en, met jouw toestemming, om je relevante aanbiedingen te tonen."
       policy_link: "Lees ons cookiebeleid."
       accept_all: "Alles accepteren"
       reject_all: "Alles weigeren"

data/config/locales/pl.yml

@@ -2,6 +2,8 @@ pl:
   consently:
     banner:
       message: "Używamy plików cookie, żeby ta strona działała, a za Twoją zgodą także po to, by rozumieć, jak z niej korzystasz, i pokazywać Ci trafne oferty."
+      message_analytics: "Używamy plików cookie, żeby ta strona działała, a za Twoją zgodą także po to, by rozumieć, jak z niej korzystasz, i ją ulepszać."
+      message_marketing: "Używamy plików cookie, żeby ta strona działała, a za Twoją zgodą także po to, by pokazywać Ci trafne oferty."
       policy_link: "Przeczytaj naszą politykę cookies."
       accept_all: "Akceptuję wszystkie"
       reject_all: "Odrzuć wszystkie"

data/config/locales/sk.yml

@@ -2,6 +2,8 @@ sk:
   consently:
     banner:
       message: "Používame súbory cookie, aby táto stránka fungovala, a s vaším súhlasom aj na to, aby sme rozumeli, ako ju používate, a mohli vám ukazovať relevantné ponuky."
+      message_analytics: "Používame súbory cookie, aby táto stránka fungovala, a s vaším súhlasom aj na to, aby sme rozumeli, ako ju používate, a mohli ju zlepšovať."
+      message_marketing: "Používame súbory cookie, aby táto stránka fungovala, a s vaším súhlasom aj na to, aby sme vám mohli ukazovať relevantné ponuky."
       policy_link: "Prečítajte si naše zásady cookies."
       accept_all: "Prijať všetko"
       reject_all: "Odmietnuť všetko"

data/lib/consently/configuration.rb

@@ -1,7 +1,9 @@
 module Consently
   # Everything the host application sets in config/initializers/consently.rb.
   class Configuration
-    DEFAULT_CATEGORIES = %i[necessary analytics marketing].freeze
+    # The categories Consently knows by name, in the order the banner lists
+    # them. Only the ones in use are offered - see #categories.
+    BUILT_IN_CATEGORIES = %i[necessary analytics marketing].freeze
 
     # Where the visitor's choice is kept. It is read by JavaScript, so it is a
     # plain cookie rather than a signed one.
@@ -113,8 +115,6 @@ module Consently
     # Nil means every request sees the default configuration.
     attr_accessor :scope_resolver
 
-    attr_reader :categories
-
     def initialize
       @cookie_name = "consently"
       @cookie_max_age = 60 * 60 * 24 * 180 # six months, the usual guidance
@@ -134,18 +134,45 @@ module Consently
       @consent_subject = nil
       @policy_url = nil
       @scope_resolver = nil
-      @categories = DEFAULT_CATEGORIES.dup
+      @categories = nil
+      @declared_categories = []
       @scopes = {}
     end
 
-    # A category of your own, shown in the preferences panel alongside the
-    # built-in ones. Give it a name in your locale file.
+    # The categories a visitor is asked about, `necessary` always first.
+    #
+    # Worked out from the tags (in every scope) plus whatever was declared with
+    # `category`: a site running only Google Analytics asks about analytics and
+    # nothing else. Asking for consent to marketing nobody does is not just
+    # noise - it tells the visitor something about the site that is not true.
+    #
+    # `categories=` replaces the guess with a fixed list, for categories that
+    # only views use (an embed, an event) or to keep the order your own.
+    def categories
+      return @categories if @categories
+
+      in_use = (all_tags.map(&:category) + @declared_categories).uniq
+      [ Consent::NECESSARY, *(BUILT_IN_CATEGORIES & in_use), *(in_use - BUILT_IN_CATEGORIES) ].uniq
+    end
+
+    def categories=(names)
+      @categories = [ Consent::NECESSARY, *Array(names).map(&:to_sym) ].uniq
+    end
+
+    # A category to offer even with no tag in it - one of your own, or a
+    # built-in one that only an embed or an event uses. Give your own a name
+    # and a description in your locale file.
     def category(name)
       name = name.to_sym
-      @categories << name unless @categories.include?(name)
+      @declared_categories << name unless @declared_categories.include?(name)
+      @categories << name if @categories && !@categories.include?(name)
       name
     end
 
+    def category?(name)
+      categories.include?(name.to_sym)
+    end
+
     def optional_categories
       categories - [ Consent::NECESSARY ]
     end
@@ -178,6 +205,12 @@ module Consently
       @default_scope ||= Scope.new
     end
 
+    # Every tag in every scope, overridden ones included: a category one
+    # tenant needs is offered to all, since the banner is the same for each.
+    def all_tags
+      [ default_scope, *@scopes.values ].flat_map { |scope| scope.tags.values }
+    end
+
     # A named bundle of tags. Same API as the top-level `tag`, which is what
     # makes the block form read the way it does.
     class Scope

data/lib/consently/version.rb

@@ -1,3 +1,3 @@
 module Consently
-  VERSION = "1.0.0"
+  VERSION = "2.0.0"
 end

data/lib/generators/consently/install/templates/consently.rb

@@ -44,7 +44,9 @@ c.google_consent_mode = :basic
   # The log is anonymous unless you say who made the decision:
   # c.consent_subject = ->(request) { request.env["warden"]&.user&.id }
 
-  # A category of your own, on top of :necessary, :analytics and :marketing.
+  # The banner offers only the categories your tags use. Declare one that only
+  # an embed or an event needs, or one of your own:
+  # c.category :marketing
   # c.category :personalization
 
   # Your tags. Each one waits for its category unless that category is

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: consently
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 2.0.0
 platform: ruby
 authors:
 - Michał Krzysteczko
@@ -123,7 +123,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.18
+rubygems_version: 4.0.20
 specification_version: 4
 summary: GDPR cookie consent for Rails that actually blocks your analytics tags until
   the visitor agrees