@autobusal/providers 1.44.5 → 1.45.0

package/Setup/analytics.ts

@@ -27,47 +27,84 @@ declare global {
 
 const CONTAINER_ID = 'gtm-container';
 
+declare global {
+  interface Window {
+    gtag?: (...args: any[]) => void
+  }
+}
+
+const CONSENT_TYPES = ['ad_storage', 'ad_user_data', 'ad_personalization', 'analytics_storage'];
+
+/**
+ * Google Consent Mode v2: the signal Tag Manager and GA4 read before any tag
+ * fires. Pushed onto the dataLayer through the gtag() shim, the way Google
+ * documents it, so it is in place before gtm.js is even requested.
+ */
+const consentSignal = (command: 'default' | 'update', granted: boolean): void => {
+  window.dataLayer = window.dataLayer || [];
+
+  window.gtag = window.gtag || function () {
+    // eslint-disable-next-line prefer-rest-params
+    window.dataLayer!.push(arguments);
+  };
+
+  const state = Object.fromEntries(CONSENT_TYPES.map(type => [ type, granted ? 'granted' : 'denied' ]));
+
+  window.gtag('consent', command, command === 'default' ? { ...state, wait_for_update: 500 } : state);
+};
+
+/**
+ * Claude - 2026-09-25 (Ferjolt: consent, not a notice).
+ *
+ * NOTHING NON-ESSENTIAL LOADS UNTIL THE VISITOR ACCEPTS. Tag Manager (and
+ * GA4 and Microsoft Clarity, which it carries) used to load on every page
+ * while the cookie card said "by continuing you accept". Now the loader
+ * reads the recorded choice (@autobusal/common CookieNotification/consent):
+ * accepted loads the container as before; nothing recorded, or rejected,
+ * loads nothing and waits for the CONSENT_EVENT the card fires - so a
+ * visitor who accepts mid-visit gets the container then, together with
+ * every dataLayer event pushed in the meantime (they queue in the array).
+ *
+ * Consent Mode is signalled either way, so if the container is ever loaded
+ * with consent denied (a tag added later, say) Google's tags behave.
+ */
+const CONSENT_COOKIE = 'OBTCookieConsent';
+const CONSENT_EVENT = 'obt:cookie-consent';
+
+const storedConsent = (): 'accepted' | 'rejected' | null => {
+  const match = document.cookie.match(new RegExp('(?:^|; )' + CONSENT_COOKIE + '=(accepted|rejected)'));
+
+  return match ? (match[1] as 'accepted' | 'rejected') : null;
+};
+
+// Setup renders more than once; the consent signal and the listener must
+// exist exactly once per page, whatever the container element says
+let armed = false;
+
 const analytics = (container: string | null | undefined): void => {
-  if (!container) {
+  if (!container || armed) {
     return;
   }
 
-  // Guard against a second insert. Two containers on one page double-count
-  // every tag they fire, and Setup can re-run (a settings refetch, a
-  // remount) without the page ever reloading.
   if (document.getElementById(CONTAINER_ID)) {
     return;
   }
 
+  armed = true;
+
   window.dataLayer = window.dataLayer || [];
-  window.dataLayer.push({ 'gtm.start': Date.now(), event: 'gtm.js' });
-
-  /*
-   * LOADED IN THE FIRST QUIET MOMENT, not while the page races for the
-   * network.
-   *
-   * Edited: Claude - Date: 2026-09-16
-   *
-   * Measured with Lighthouse against production on a throttled phone: the
-   * container and the GA tag it pulls are 287 KB of script - more than this
-   * app's own entry chunk - fetched in the same window as the bundle, the
-   * translations and the images, on a connection modelled at 1.6 Mbps. The
-   * page is no more usable for having them early, and every byte they take
-   * is one the content is waiting for.
-   *
-   * The dataLayer is filled FIRST, above, and GTM reads whatever is already
-   * in it when it boots - so a page view or a commerce event announced in
-   * the meantime still arrives. That is the only thing that could have made
-   * deferring this wrong.
-   *
-   * Safari has no requestIdleCallback, so setTimeout is the fallback rather
-   * than a polyfill: "soon, after the load" is the whole requirement.
-   */
+
+  const accepted = storedConsent() === 'accepted';
+
+  consentSignal('default', accepted);
+
   const load = (): void => {
     if (document.getElementById(CONTAINER_ID)) {
       return;
     }
 
+    window.dataLayer!.push({ 'gtm.start': Date.now(), event: 'gtm.js' });
+
     const script = document.createElement('script');
 
     script.id = CONTAINER_ID;
@@ -77,32 +114,6 @@ const analytics = (container: string | null | undefined): void => {
     document.head.appendChild(script);
   };
 
-  /*
-   * AFTER THE PAGE HAS LOADED, then in the first quiet moment.
-   *
-   * Edited: Claude - Date: 2026-09-16
-   *
-   * The idle wait above was not enough on its own, because "idle" arrives
-   * early on a page that is still downloading: requestIdleCallback fires
-   * whenever the main thread has a gap, and a phone waiting on the network
-   * has plenty of gaps. Lighthouse on a throttled phone still found Tag
-   * Manager and the Google Analytics tag it pulls in - 287 KB between them,
-   * 131 KB of it never executed - arriving inside the page's own loading
-   * window, competing for the same connection as the bundle and the images.
-   *
-   * Waiting for `load` first puts them after everything the page itself
-   * asked for. The idle wait then keeps them off the main thread while the
-   * page settles, with a ceiling so they are never deferred indefinitely.
-   *
-   * What this costs is measurement, not function, and it is worth naming: a
-   * visitor who leaves within a couple of seconds of the page finishing
-   * loading may not be counted. Everything else is kept. The dataLayer is
-   * created and filled BEFORE any of this, so page views and commerce
-   * events announced while the container is on its way are queued and
-   * processed when it boots, not dropped.
-   *
-   * Safari has no requestIdleCallback, so a short timeout stands in for it.
-   */
   const whenIdle = (): void => {
     if (typeof window.requestIdleCallback === 'function') {
       window.requestIdleCallback(load, { timeout: 3000 });
@@ -111,23 +122,30 @@ const analytics = (container: string | null | undefined): void => {
     }
   };
 
-  if (document.readyState === 'complete') {
-    whenIdle();
-  } else {
-    window.addEventListener('load', whenIdle, { once: true });
+  const start = (): void => {
+    if (document.readyState === 'complete') {
+      whenIdle();
+    } else {
+      window.addEventListener('load', whenIdle, { once: true });
+    }
+  };
+
+  if (accepted) {
+    start();
+
+    return;
   }
+
+  // no choice yet, or rejected: wait for the card
+  window.addEventListener(CONSENT_EVENT, (event: Event) => {
+    if ((event as CustomEvent<string>).detail === 'accepted') {
+      consentSignal('update', true);
+
+      start();
+    }
+  });
 };
 
-/**
- * Announce a page view.
- *
- * A single-page app never reloads, so GTM's own page-load trigger fires
- * exactly once per session - every client-side route change after that is
- * invisible unless it is announced. The container is expected to listen for
- * this `page_view` event and fire GA4 (or anything else) from it.
- *
- * Safe to call before GTM has finished loading: the push simply queues.
- */
 export const pageview = (path: string, title: string): void => {
   window.dataLayer = window.dataLayer || [];
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobusal/providers",
-  "version": "1.44.5",
+  "version": "1.45.0",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts",

package/types/agents.ts

@@ -20,6 +20,9 @@ export interface AgentData {
   // Claude - 2026-08-22: the floor of the funds balance for website sales
   // (0 = prepaid, positive = postpaid down to -that-much)
   credit_limit?: number
+  // Claude - 2026-09-24: the agency has partner API access (the one gate
+  // Http\Middleware\ApiConsumer accepts); set by "Enable partner API"
+  is_api_consumer?: boolean
   mobile: string
   mobile2: string
   phone: string

package/types/users.ts

@@ -60,6 +60,9 @@ export interface ComissionData {
 
 export interface ApiData {
   api: number
+  // Claude - 2026-09-24: whether a partner API key exists - the key itself is
+  // never sent (Agents\AdminController::get, ApiConsumers\AdminController::get)
+  has_token?: boolean
   bkt: number
   devpos: number
   stripe: number