@autobusal/providers 1.45.2 → 1.45.3

package/Setup/analytics.ts

@@ -132,20 +132,73 @@ const analytics = (container: string | null | undefined): void => {
 
   if (accepted) {
     start();
-
-    return;
   }
 
-  // no choice yet, or rejected: wait for the card
+  /*
+   * Claude - 2026-09-25 (audit): consent can be WITHDRAWN. The listener used
+   * to be registered only when nothing was accepted at load, so a visitor
+   * who had accepted and later rejected from the card kept being measured
+   * for the rest of the visit (and their _ga/_clck cookies stayed). Now it
+   * is always registered (still once per page - `armed` above), and pushes a
+   * Consent Mode update only when the state actually changes, so repeated
+   * events never duplicate the dataLayer entries.
+   */
+  let granted = accepted;
+
   window.addEventListener(CONSENT_EVENT, (event: Event) => {
-    if ((event as CustomEvent<string>).detail === 'accepted') {
-      consentSignal('update', true);
+    const choice = (event as CustomEvent<string>).detail;
+
+    if (choice === 'accepted') {
+      if (!granted) {
+        granted = true;
+
+        consentSignal('update', true);
+      }
 
       start();
+    } else if (choice === 'rejected' && granted) {
+      granted = false;
+
+      // a loaded container cannot be unloaded; denied Consent Mode makes
+      // Google's tags stop storing and sending identifiers from here on
+      consentSignal('update', false);
+
+      expireAnalyticsCookies();
     }
   });
 };
 
+/**
+ * Claude - 2026-09-25 (audit): drop the GA4 and Clarity cookies on rejection.
+ * They are set on the current host or on its registrable parent (GA's
+ * cookie_domain 'auto' picks the highest one it can write), so both are
+ * expired, with and without a leading dot, which is what a browser needs to
+ * match the cookie that was written.
+ */
+const ANALYTICS_COOKIE = /^(_ga|_ga_.+|_gid|_clck|_clsk)$/;
+
+const expireAnalyticsCookies = (): void => {
+  const names = document.cookie
+    .split(';')
+    .map(pair => pair.split('=')[0].trim())
+    .filter(name => ANALYTICS_COOKIE.test(name));
+
+  if (names.length === 0) {
+    return;
+  }
+
+  const host = window.location.hostname;
+  const parts = host.split('.');
+  const parent = parts.length > 2 ? parts.slice(-2).join('.') : host;
+  const domains = Array.from(new Set([ '', host, `.${ host }`, parent, `.${ parent }` ]));
+
+  names.forEach(name => {
+    domains.forEach(domain => {
+      document.cookie = `${ name }=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/${ domain ? `; domain=${ domain }` : '' }`;
+    });
+  });
+};
+
 export const pageview = (path: string, title: string): void => {
   window.dataLayer = window.dataLayer || [];
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobusal/providers",
-  "version": "1.45.2",
+  "version": "1.45.3",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts",