@duckduckgo/autoconsent 16.63.0 → 17.1.0

package/dist/heuristics.cjs.js

@@ -46,8 +46,8 @@ var DETECT_PATTERNS = [
   // "only necessary" is probably too broad
   /(?:by continuing.{0,100}cookie)|(?:cookie.{0,100}by continuing)/gi,
   /(?:by continuing.{0,100}privacy)|(?:privacy.{0,100}by continuing)/gi,
-  // a single qualifier is common: "optional", "essential", "necessary", "analytics", ...
-  /we (?:use|serve)(?: \w+)? cookies/gi,
+  // up to two qualifiers are common: "optional", "essential", "analytics", "google analytics", "third party", ...
+  /we (?:use|serve)(?: \w+){0,2} cookies/gi,
   /we are using cookies/gi,
   /use of cookies/gi,
   /website uses cookies to enhance your browsing experience/gi,
@@ -204,7 +204,10 @@ var DETECT_PATTERNS = [
   /(?:cookie|クッキー).{0,10}を(?:使用|利用)/gi,
   // Danish (DA)
   // e.g. "vi bruger cookies", "hjemmesiden bruger cookies til at ..."
-  /bruger cookies/gi
+  /bruger cookies/gi,
+  // Norwegian (NO)
+  // e.g. "vi bruker informasjonskapsler", "kan vi bruke valgfrie informasjonskapsler", "nettstedet bruker cookies"
+  /\b(?:vi|nettstedet|nettsiden|siden)\s+bruker?\s.{0,60}?(?:informasjonskapsler|cookies)/gi
 ];
 var REJECT_PATTERNS_ENGLISH = [
   // e.g. "reject", "reject all", "reject all cookies", "deny all", "refuse cookies", "decline",
@@ -346,6 +349,14 @@ var REJECT_PATTERNS_DANISH = [
   // "nej tak" (no thanks)
   /^nej(,?\s+tak)?$/is
 ];
+var REJECT_PATTERNS_NORWEGIAN = [
+  // avvis / avslå (reject verbs)
+  /(^|\s)(avvis|avslå)/is,
+  // (accept/allow/use) only necessary cookies
+  /^(godta\s+|tillat\s+|aksepter\s+|bruk\s+)?(kun|bare)\s+(strengt\s+)?nødvendige( (informasjonskapsler|cookies))?$/is,
+  // "nei" / "nei takk" (no thanks)
+  /^nei(,?\s+takk)?$/is
+];
 var REJECT_PATTERNS_CATALAN = [
   /(^|\s)rebutj/is,
   "no accepto",
@@ -401,6 +412,7 @@ var REJECT_PATTERNS = [
   ...REJECT_PATTERNS_SPANISH,
   ...REJECT_PATTERNS_SWEDISH,
   ...REJECT_PATTERNS_DANISH,
+  ...REJECT_PATTERNS_NORWEGIAN,
   ...REJECT_PATTERNS_CATALAN,
   ...REJECT_PATTERNS_GALICIAN,
   ...REJECT_PATTERNS_BASQUE,

package/dist/heuristics.mjs

@@ -7,8 +7,8 @@ var DETECT_PATTERNS = [
   // "only necessary" is probably too broad
   /(?:by continuing.{0,100}cookie)|(?:cookie.{0,100}by continuing)/gi,
   /(?:by continuing.{0,100}privacy)|(?:privacy.{0,100}by continuing)/gi,
-  // a single qualifier is common: "optional", "essential", "necessary", "analytics", ...
-  /we (?:use|serve)(?: \w+)? cookies/gi,
+  // up to two qualifiers are common: "optional", "essential", "analytics", "google analytics", "third party", ...
+  /we (?:use|serve)(?: \w+){0,2} cookies/gi,
   /we are using cookies/gi,
   /use of cookies/gi,
   /website uses cookies to enhance your browsing experience/gi,
@@ -165,7 +165,10 @@ var DETECT_PATTERNS = [
   /(?:cookie|クッキー).{0,10}を(?:使用|利用)/gi,
   // Danish (DA)
   // e.g. "vi bruger cookies", "hjemmesiden bruger cookies til at ..."
-  /bruger cookies/gi
+  /bruger cookies/gi,
+  // Norwegian (NO)
+  // e.g. "vi bruker informasjonskapsler", "kan vi bruke valgfrie informasjonskapsler", "nettstedet bruker cookies"
+  /\b(?:vi|nettstedet|nettsiden|siden)\s+bruker?\s.{0,60}?(?:informasjonskapsler|cookies)/gi
 ];
 var REJECT_PATTERNS_ENGLISH = [
   // e.g. "reject", "reject all", "reject all cookies", "deny all", "refuse cookies", "decline",
@@ -307,6 +310,14 @@ var REJECT_PATTERNS_DANISH = [
   // "nej tak" (no thanks)
   /^nej(,?\s+tak)?$/is
 ];
+var REJECT_PATTERNS_NORWEGIAN = [
+  // avvis / avslå (reject verbs)
+  /(^|\s)(avvis|avslå)/is,
+  // (accept/allow/use) only necessary cookies
+  /^(godta\s+|tillat\s+|aksepter\s+|bruk\s+)?(kun|bare)\s+(strengt\s+)?nødvendige( (informasjonskapsler|cookies))?$/is,
+  // "nei" / "nei takk" (no thanks)
+  /^nei(,?\s+takk)?$/is
+];
 var REJECT_PATTERNS_CATALAN = [
   /(^|\s)rebutj/is,
   "no accepto",
@@ -362,6 +373,7 @@ var REJECT_PATTERNS = [
   ...REJECT_PATTERNS_SPANISH,
   ...REJECT_PATTERNS_SWEDISH,
   ...REJECT_PATTERNS_DANISH,
+  ...REJECT_PATTERNS_NORWEGIAN,
   ...REJECT_PATTERNS_CATALAN,
   ...REJECT_PATTERNS_GALICIAN,
   ...REJECT_PATTERNS_BASQUE,

package/dist/types/heuristics.d.ts

@@ -1,9 +1,18 @@
-import { ButtonData, HeuristicLevel, PopupData } from './types';
-export declare function getActionablePopups(mode?: HeuristicLevel, timeout?: number): PopupData[];
+import { ButtonData, HeuristicLevel, HitTestGrid, PopupData } from './types';
 /**
+ * Popups the heuristic rule can act on in this mode, sorted so that a popup with reject comes first.
  * @param timeout time budget for the whole search, in ms
+ * @param hitTest hit-test the viewport before the DOM walk, to find popups the walk misses; when this finds a consent
+ *   popup with reject, the walk is skipped
  */
-export declare function getPotentialPopups(timeout?: number): PopupData[];
+export declare function getActionablePopups(mode?: HeuristicLevel, timeout?: number, hitTest?: boolean): PopupData[];
+/**
+ * Popup candidates, each labelled with a regexClassification from its buttons.
+ * @param timeout time budget for the whole search, in ms
+ * @param hitTest hit-test the viewport before the DOM walk, to find popups the walk misses
+ * @param hitTestGrid points to hit-test, if not the default grid
+ */
+export declare function getPotentialPopups(timeout?: number, hitTest?: boolean, hitTestGrid?: HitTestGrid): PopupData[];
 /**
  * The whole document of a frame, if it is rendered and has text. The body can have zero height when all of its
  * content is positioned, so only check visibility styles, not size.

package/dist/types/types.d.ts

@@ -69,6 +69,7 @@ export type Config = {
     };
     performanceLoggingEnabled: boolean;
     heuristicPopupSearchTimeout: number;
+    enableHeuristicHitTest: boolean;
     heuristicMode: HeuristicLevel;
 };
 export type LifecycleState = 'loading' | 'initialized' | 'waitingForInitResponse' | 'started' | 'nothingDetected' | 'cmpDetected' | 'openPopupDetected' | 'runningOptOut' | 'runningOptIn' | 'optOutSucceeded' | 'optOutFailed' | 'optInSucceeded' | 'optInFailed' | 'done';
@@ -94,7 +95,17 @@ export interface PopupData {
     text: string;
     element: HTMLElement;
     buttons: ButtonData[];
-    regexClassification?: PopupClassification;
+    regexClassification: PopupClassification;
+    source?: 'walk' | 'hitTest' | 'frame';
+    hitPoints?: [number, number][];
+}
+/**
+ * Points to hit-test: columns are fractions of the viewport width, and rows are distances in px from both the top
+ * and the bottom edge. The middle row of the viewport is always tested.
+ */
+export interface HitTestGrid {
+    columns: number[];
+    edgeRows: number[];
 }
 /**
  * The user setting for autoconsent and heuristic detection.

package/lib/cmps/base.ts

@@ -454,7 +454,11 @@ export class AutoConsentHeuristicCMP extends AutoConsentCMPBase {
         // wait for one tick to deprioritize heavy DOM operations
         await new Promise((resolve) => setTimeout(resolve, 0));
         this.autoconsent.config.performanceLoggingEnabled && performance.mark('heuristicDetectorStart');
-        this.popups = getActionablePopups(this.mode, this.autoconsent.config.heuristicPopupSearchTimeout);
+        this.popups = getActionablePopups(
+            this.mode,
+            this.autoconsent.config.heuristicPopupSearchTimeout,
+            this.autoconsent.config.enableHeuristicHitTest,
+        );
         this.autoconsent.config.performanceLoggingEnabled && performance.mark('heuristicDetectorEnd');
         this.autoconsent.config.performanceLoggingEnabled &&
             performance.measure('heuristicDetector', 'heuristicDetectorStart', 'heuristicDetectorEnd');

package/lib/heuristic-patterns.ts

@@ -7,8 +7,8 @@ export const DETECT_PATTERNS = [
     /only necessary cookies/gi, // "only necessary" is probably too broad
     /(?:by continuing.{0,100}cookie)|(?:cookie.{0,100}by continuing)/gi,
     /(?:by continuing.{0,100}privacy)|(?:privacy.{0,100}by continuing)/gi,
-    // a single qualifier is common: "optional", "essential", "necessary", "analytics", ...
-    /we (?:use|serve)(?: \w+)? cookies/gi,
+    // up to two qualifiers are common: "optional", "essential", "analytics", "google analytics", "third party", ...
+    /we (?:use|serve)(?: \w+){0,2} cookies/gi,
     /we are using cookies/gi,
     /use of cookies/gi,
     /website uses cookies to enhance your browsing experience/gi,
@@ -182,6 +182,10 @@ export const DETECT_PATTERNS = [
     // Danish (DA)
     // e.g. "vi bruger cookies", "hjemmesiden bruger cookies til at ..."
     /bruger cookies/gi,
+
+    // Norwegian (NO)
+    // e.g. "vi bruker informasjonskapsler", "kan vi bruke valgfrie informasjonskapsler", "nettstedet bruker cookies"
+    /\b(?:vi|nettstedet|nettsiden|siden)\s+bruker?\s.{0,60}?(?:informasjonskapsler|cookies)/gi,
 ];
 
 const REJECT_PATTERNS_ENGLISH = [
@@ -373,6 +377,17 @@ const REJECT_PATTERNS_DANISH = [
     /^nej(,?\s+tak)?$/is,
 ];
 
+const REJECT_PATTERNS_NORWEGIAN = [
+    // avvis / avslå (reject verbs)
+    /(^|\s)(avvis|avslå)/is,
+
+    // (accept/allow/use) only necessary cookies
+    /^(godta\s+|tillat\s+|aksepter\s+|bruk\s+)?(kun|bare)\s+(strengt\s+)?nødvendige( (informasjonskapsler|cookies))?$/is,
+
+    // "nei" / "nei takk" (no thanks)
+    /^nei(,?\s+takk)?$/is,
+];
+
 const REJECT_PATTERNS_CATALAN = [
     /(^|\s)rebutj/is,
     'no accepto',
@@ -449,6 +464,7 @@ export const REJECT_PATTERNS = [
     ...REJECT_PATTERNS_SPANISH,
     ...REJECT_PATTERNS_SWEDISH,
     ...REJECT_PATTERNS_DANISH,
+    ...REJECT_PATTERNS_NORWEGIAN,
     ...REJECT_PATTERNS_CATALAN,
     ...REJECT_PATTERNS_GALICIAN,
     ...REJECT_PATTERNS_BASQUE,

package/lib/heuristics.ts

@@ -1,41 +1,116 @@
 import { classifyButtons, classifyPopup, hasHeuristicPatterns, isExcludedPopup } from './heuristic-classify';
-import { ButtonData, HeuristicLevel, PopupClassification, PopupData } from './types';
+import { ButtonData, HeuristicLevel, HitTestGrid, PopupClassification, PopupData } from './types';
 import { isElementVisible, isTopFrame } from './utils';
 
 const BUTTON_LIKE_ELEMENT_SELECTOR = 'button, input[type="button"], input[type="submit"], a, [role="button"], [class*="button"]';
 const POPUP_SEARCH_MAX_TIME = 100;
 
-export function getActionablePopups(mode: HeuristicLevel = 'reject', timeout = POPUP_SEARCH_MAX_TIME): PopupData[] {
-    const acceptedLevels: PopupClassification[] =
-        mode === 'tier2' ? ['reject', 'tier1', 'tier2'] : mode === 'tier1' ? ['reject', 'tier1'] : ['reject'];
-    const popups = getPotentialPopups(timeout).filter((popup) => {
-        const popupText = popup.text?.trim();
-        if (!popupText || isExcludedPopup(popupText) || !hasHeuristicPatterns(popupText)) {
-            return false;
-        }
-        popup.regexClassification = classifyPopup(popup.buttons);
-        return popup.regexClassification !== undefined && acceptedLevels.includes(popup.regexClassification);
-    });
-    // a popup with reject will always win
-    return popups.sort((a, b) => ((a.regexClassification ?? '') > (b.regexClassification ?? '') ? 1 : -1));
+// popup classifications the heuristic rule can act on, by heuristic mode
+const ACCEPTED_LEVELS: Record<HeuristicLevel, PopupClassification[]> = {
+    off: [],
+    reject: ['reject'],
+    tier1: ['reject', 'tier1'],
+    tier2: ['reject', 'tier1', 'tier2'],
+};
+
+/**
+ * Popups the heuristic rule can act on in this mode, sorted so that a popup with reject comes first.
+ * @param timeout time budget for the whole search, in ms
+ * @param hitTest hit-test the viewport before the DOM walk, to find popups the walk misses; when this finds a consent
+ *   popup with reject, the walk is skipped
+ */
+export function getActionablePopups(mode: HeuristicLevel = 'reject', timeout = POPUP_SEARCH_MAX_TIME, hitTest = false): PopupData[] {
+    const acceptedLevels = ACCEPTED_LEVELS[mode];
+    const isActionable = (popup: PopupData) => acceptedLevels.includes(popup.regexClassification) && isConsentPopup(popup);
+    const popups = searchPopups(timeout, hitTest, DEFAULT_HIT_TEST_GRID, true).filter(isActionable);
+    // stable, so popups with the same classification keep their search order
+    return popups.sort((a, b) => classificationRank(a) - classificationRank(b));
 }
 
 /**
+ * Popup candidates, each labelled with a regexClassification from its buttons.
  * @param timeout time budget for the whole search, in ms
+ * @param hitTest hit-test the viewport before the DOM walk, to find popups the walk misses
+ * @param hitTestGrid points to hit-test, if not the default grid
+ */
+export function getPotentialPopups(timeout = POPUP_SEARCH_MAX_TIME, hitTest = false, hitTestGrid = DEFAULT_HIT_TEST_GRID): PopupData[] {
+    return searchPopups(timeout, hitTest, hitTestGrid);
+}
+
+/**
+ * @param stopOnReject skip the DOM walk when hit-testing finds a consent popup with reject
  */
-export function getPotentialPopups(timeout = POPUP_SEARCH_MAX_TIME): PopupData[] {
+function searchPopups(timeout: number, hitTest: boolean, hitTestGrid: HitTestGrid, stopOnReject = false): PopupData[] {
     if (!isTopFrame()) {
-        // do not inspect frames that are more than one level deep
-        if (window.parent && window.parent !== window.top) {
-            return [];
-        }
-        // for iframes, just take the whole document
-        const frameElement = getFramePopupElement(document);
-        const popup = frameElement && toPopupData(frameElement);
-        return popup ? [popup] : [];
+        return getFramePopups();
     }
     const deadline = performance.now() + timeout;
-    // fixed, sticky and dialog-like elements, with fragments expanded to their popup root
+    // hit-test first: it takes a few ms, while on large pages the walk can use the whole budget
+    const hitTestPopups = hitTest ? findPopupsByHitTest(deadline, hitTestGrid) : [];
+    // the walk cannot find a better popup than one with reject
+    if (stopOnReject && hitTestPopups.some((p) => p.regexClassification === 'reject' && isConsentPopup(p))) {
+        return hitTestPopups;
+    }
+    const walkPopups = collectPositionedPopups(deadline);
+    return [...walkPopups, ...mergeWalkOverlaps(hitTestPopups, walkPopups)];
+}
+
+// isConsentPopup scans the popup text with many patterns, and the search asks for the same popup more than once
+const consentPopups = new WeakMap<PopupData, boolean>();
+
+// reject, then tier1, then tier2; -1 for a popup no heuristic mode acts on
+function classificationRank(popup: PopupData): number {
+    return ACCEPTED_LEVELS.tier2.indexOf(popup.regexClassification);
+}
+
+// a consent popup the heuristic rule could act on in some mode
+function isConsentPopup(popup: PopupData): boolean {
+    if (!ACCEPTED_LEVELS.tier2.includes(popup.regexClassification)) {
+        return false;
+    }
+    let result = consentPopups.get(popup);
+    if (result === undefined) {
+        const popupText = popup.text.trim();
+        result = !!popupText && !isExcludedPopup(popupText) && hasHeuristicPatterns(popupText);
+        consentPopups.set(popup, result);
+    }
+    return result;
+}
+
+/**
+ * Where both searches found the same popup, keep the walk's candidate, with the hit points of the hit-test one.
+ * Keep both when the hit-test one is a better consent popup: the walk candidate is not one (such as a wrapper that also
+ * holds an age gate), or ranks lower (such as an accept-only fragment of a banner whose reject button the hit test found).
+ */
+function mergeWalkOverlaps(hitTestPopups: PopupData[], walkPopups: PopupData[]): PopupData[] {
+    return hitTestPopups.filter((h) => {
+        const hitIsConsent = isConsentPopup(h);
+        const absorbs = (p: PopupData) => !hitIsConsent || (isConsentPopup(p) && classificationRank(p) <= classificationRank(h));
+        const walkPopup = walkPopups.find((p) => composedOverlaps(p.element, h.element) && absorbs(p));
+        if (walkPopup) {
+            (walkPopup.hitPoints ??= []).push(...(h.hitPoints ?? []));
+        }
+        return !walkPopup;
+    });
+}
+
+function getFramePopups(): PopupData[] {
+    // do not inspect frames that are more than one level deep
+    if (window.parent && window.parent !== window.top) {
+        return [];
+    }
+    // for iframes, just take the whole document
+    const frameElement = getFramePopupElement(document);
+    const popup = frameElement && toPopupData(frameElement);
+    if (!popup) {
+        return [];
+    }
+    popup.source = 'frame';
+    return [popup];
+}
+
+// fixed, sticky and dialog-like popups found by walking the DOM, with fragments expanded to their popup root
+function collectPositionedPopups(deadline: number): PopupData[] {
     const { elements, shadowHosts } = getPopupLikeElements(deadline);
     const potentialPopups: PopupData[] = [];
     const expanded: HTMLElement[] = [];
@@ -52,19 +127,107 @@ export function getPotentialPopups(timeout = POPUP_SEARCH_MAX_TIME): PopupData[]
         if (root !== popup) {
             expanded.push(root.element);
         }
+        root.source = 'walk';
         potentialPopups.push(root);
     }
     // a fragment expanded to its popup root replaces any other candidates inside that root
     return potentialPopups.filter((p) => !expanded.some((root) => root !== p.element && composedContains(root, p.element)));
 }
 
+const DEFAULT_HIT_TEST_GRID: HitTestGrid = {
+    columns: [0.1, 0.5, 0.9],
+    // banners sit along the top and bottom edges and modals in the middle; rows 150px in added almost nothing in crawls
+    edgeRows: [30, 90],
+};
+
+/**
+ * Popups that are not fixed, sticky or dialog-like (for example banners in the normal page flow) are not found by
+ * the DOM walk. Hit-test points across the viewport and climb from the topmost element at each point instead.
+ * Prehide sets pointer-events: none, so a prehidden popup is only hit once prehide is lifted.
+ */
+function findPopupsByHitTest(deadline: number, grid: HitTestGrid): PopupData[] {
+    // the popup that each climbed element leads to, or null if its climb found none
+    const climbed = new Map<Element, PopupData | null>();
+    const found: PopupData[] = [];
+    // any page element can be hit, so leave out forms
+    const toPopup = (el: HTMLElement) => (el.querySelector(TEXT_ENTRY_SELECTOR) ? null : toPopupRoot(el));
+    for (const [x, y] of getHitTestPoints(grid)) {
+        if (performance.now() > deadline) {
+            return found;
+        }
+        const path: HTMLElement[] = [];
+        // the cast stops TypeScript narrowing to null, as only the shouldStop closure assigns it before use
+        let reached = null as PopupData | null;
+        // stop where an earlier climb already went, and at popups already found
+        const shouldStop = (el: HTMLElement) => {
+            if (climbed.has(el)) {
+                reached = climbed.get(el) ?? null;
+                return true;
+            }
+            // the climb went inside a popup already found, or reached one of its ancestors
+            const overlapped = found.find((p) => composedOverlaps(p.element, el));
+            if (overlapped) {
+                reached = composedContains(overlapped.element, el) ? overlapped : null;
+                return true;
+            }
+            path.push(el);
+            return false;
+        };
+        const hit = closestHTMLElement(deepElementFromPoint(x, y));
+        const popup = climbToPopup(hit, MAX_HIT_TEST_CLIMB_DEPTH, toPopup, shouldStop);
+        if (popup) {
+            popup.source = 'hitTest';
+            found.push(popup);
+            reached = popup;
+        }
+        for (const el of path) {
+            climbed.set(el, reached);
+        }
+        if (reached) {
+            (reached.hitPoints ??= []).push([x, y]);
+        }
+    }
+    return found;
+}
+
+// the grid as [x, y] viewport points in CSS px: the top edge rows, the middle, then the bottom edge rows, each column by column
+function getHitTestPoints(grid: HitTestGrid): [number, number][] {
+    const { innerWidth: width, innerHeight: height } = window;
+    const rows = [...grid.edgeRows, height / 2, ...grid.edgeRows.map((y) => height - y)].map((y) => Math.round(y));
+    const ys = [...new Set(rows)].filter((y) => y >= 0 && y < height);
+    return ys.flatMap((y) => grid.columns.map((column): [number, number] => [Math.round(column * width), y]));
+}
+
+// precaution, not yet seen in crawls: login, search and sign-up forms can carry consent wording and a "Continue" button
+const TEXT_ENTRY_SELECTOR =
+    'textarea, input:not([type]), input[type="text"], input[type="email"], input[type="password"], input[type="search"], input[type="tel"], input[type="number"], input[type="url"]';
+
+function deepElementFromPoint(x: number, y: number): Element | null {
+    let el = document.elementFromPoint(x, y);
+    while (el?.shadowRoot) {
+        const inner = el.shadowRoot.elementFromPoint(x, y);
+        if (!inner || inner === el) {
+            break;
+        }
+        el = inner;
+    }
+    return el;
+}
+
+function closestHTMLElement(el: Element | null): HTMLElement | null {
+    while (el && !(el instanceof HTMLElement)) {
+        el = el.parentElement;
+    }
+    return el;
+}
+
 function toPopupData(el: HTMLElement, shadowHosts?: HTMLElement[], text = getElementText(el)): PopupData | null {
     if (!text) {
         return null;
     }
     const buttons = getButtonData(el, shadowHosts);
     classifyButtons(buttons);
-    return { text, element: el, buttons };
+    return { text, element: el, buttons, regexClassification: classifyPopup(buttons) };
 }
 
 // buttons beyond their labels, and at least one button the heuristics recognise (not just policy links)
@@ -81,35 +244,62 @@ function isOnlyButtonText(text: string, buttons: ButtonData[]): boolean {
     return rest.replace(/\s+/g, '').length < 10;
 }
 
-// Bounds how far expansion climbs. The stop at page-level containers is the main guard against false positives;
-// this limit only keeps the search cheap on deep trees.
+/**
+ * The element as a popup, if it has consent text and popup buttons.
+ */
+function toPopupRoot(el: HTMLElement, shadowHosts?: HTMLElement[]): PopupData | null {
+    // check the text first: it is cheaper than collecting buttons
+    const text = getElementText(el);
+    if (!text || !hasHeuristicPatterns(text)) {
+        return null;
+    }
+    const popup = toPopupData(el, shadowHosts, text);
+    return popup && hasPopupButtons(text, popup.buttons) ? popup : null;
+}
+
+// Bound how far climbs reach. The page-level stop in climbToPopup is the main guard against false positives;
+// these limits only keep the search cheap on deep trees.
 const MAX_FRAGMENT_EXPANSION_DEPTH = 6;
+const MAX_HIT_TEST_CLIMB_DEPTH = 8;
+
+/**
+ * Climb from el through up to maxDepth composed ancestors, and return the first popup that toPopup accepts.
+ */
+function climbToPopup(
+    el: HTMLElement | null,
+    maxDepth: number,
+    toPopup: (el: HTMLElement) => PopupData | null,
+    shouldStop?: (el: HTMLElement) => boolean,
+): PopupData | null {
+    for (let depth = 0; el && depth < maxDepth; depth++, el = getComposedParent(el)) {
+        // stop before reaching page-level containers, whose text includes unrelated page copy
+        if (
+            shouldStop?.(el) ||
+            el === document.body ||
+            el === document.documentElement ||
+            el.getBoundingClientRect().height > window.innerHeight
+        ) {
+            return null;
+        }
+        const popup = toPopup(el);
+        if (popup) {
+            return popup;
+        }
+    }
+    return null;
+}
 
 /**
  * A positioned candidate is often only part of a popup, such as a sticky button bar or heading.
  * If it does not look like a consent popup on its own, use the nearest ancestor that does.
  */
 function expandPopupFragment(popup: PopupData, shadowHosts?: HTMLElement[]): PopupData {
+    // the same acceptance check as toPopupRoot, on the buttons already collected
     if (hasHeuristicPatterns(popup.text) && hasPopupButtons(popup.text, popup.buttons)) {
         return popup;
     }
-    let el = getComposedParent(popup.element);
-    for (let depth = 0; el && depth < MAX_FRAGMENT_EXPANSION_DEPTH; depth++, el = getComposedParent(el)) {
-        // stop before reaching page-level containers, whose text includes unrelated page copy
-        if (el === document.body || el === document.documentElement || el.getBoundingClientRect().height > window.innerHeight) {
-            break;
-        }
-        // check the text first: it is cheaper than collecting buttons
-        const text = getElementText(el);
-        if (!text || !hasHeuristicPatterns(text)) {
-            continue;
-        }
-        const root = toPopupData(el, shadowHosts, text);
-        if (root && hasPopupButtons(text, root.buttons)) {
-            return root;
-        }
-    }
-    return popup;
+    const parent = getComposedParent(popup.element);
+    return climbToPopup(parent, MAX_FRAGMENT_EXPANSION_DEPTH, (el) => toPopupRoot(el, shadowHosts)) ?? popup;
 }
 
 function getComposedParent(el: HTMLElement): HTMLElement | null {
@@ -161,6 +351,11 @@ function isRenderedTextElement(el: Element): el is HTMLElement {
     );
 }
 
+// either element contains the other, across shadow roots
+function composedOverlaps(a: Node, b: Node): boolean {
+    return composedContains(a, b) || composedContains(b, a);
+}
+
 /**
  * Like Node.contains, but also looks through shadow root boundaries.
  */
@@ -207,7 +402,7 @@ export function isDialogLikeElement(node: HTMLElement): boolean {
 
 /**
  * Heuristic to get all elements that look like "popups"
- * TODO: popups in the normal page flow are only found when part of them is fixed, sticky or dialog-like
+ * Popups that are not positioned are found by hit-testing instead, when enabled (findPopupsByHitTest).
  */
 function getPopupLikeElements(deadline: number): { elements: HTMLElement[]; shadowHosts: HTMLElement[] } {
     const found: HTMLElement[] = [];

package/lib/types.ts

@@ -81,6 +81,7 @@ export type Config = {
     };
     performanceLoggingEnabled: boolean;
     heuristicPopupSearchTimeout: number;
+    enableHeuristicHitTest: boolean; // hit-test the viewport before the DOM walk, to find popups the walk misses (e.g. not fixed, sticky or dialog-like)
     heuristicMode: HeuristicLevel; // controls the behavior of the heuristic popup detection.
 };
 
@@ -125,7 +126,21 @@ export interface PopupData {
     text: string;
     element: HTMLElement;
     buttons: ButtonData[];
-    regexClassification?: PopupClassification;
+    // from the buttons alone; whether the popup text is consent text is checked separately
+    regexClassification: PopupClassification;
+    // which search found the popup: the DOM walk, the viewport hit test, or the whole document of a frame
+    source?: 'walk' | 'hitTest' | 'frame';
+    // viewport points ([x, y] in CSS px) whose hit test reached this popup
+    hitPoints?: [number, number][];
+}
+
+/**
+ * Points to hit-test: columns are fractions of the viewport width, and rows are distances in px from both the top
+ * and the bottom edge. The middle row of the viewport is always tested.
+ */
+export interface HitTestGrid {
+    columns: number[];
+    edgeRows: number[];
 }
 
 /**

package/lib/utils.ts

@@ -109,6 +109,7 @@ export function normalizeConfig(providedConfig: any): Config {
         },
         performanceLoggingEnabled: false,
         heuristicPopupSearchTimeout: 100,
+        enableHeuristicHitTest: false,
         heuristicMode: 'off', // heuristic disabled by default
     };
     const updatedConfig: Config = copyObject(defaultConfig);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@duckduckgo/autoconsent",
-  "version": "16.63.0",
+  "version": "17.1.0",
   "description": "",
   "types": "./dist/types/web.d.ts",
   "exports": {

package/readme.md

@@ -42,7 +42,7 @@ import { checkHeuristicPatterns, classifyButtonTextRegex, classifyButtons, class
 classifyButtonTextRegex('Reject all'); // 'reject'
 ```
 
-`dist/autoconsent.playwright.js` also exposes `window.autoconsentHeuristics.getPotentialPopups(timeout)` and `getButtonData(element)`, so other scripts injected into the same world can reuse autoconsent's popup and button discovery.
+`dist/autoconsent.playwright.js` also exposes `window.autoconsentHeuristics.getPotentialPopups(timeout, hitTest)` and `getButtonData(element)`, so other scripts injected into the same world can reuse autoconsent's popup and button discovery. Each potential popup is labelled with the `regexClassification` of its buttons; `getActionablePopups` keeps the consent popups among them that the heuristic mode can act on.
 
 ## Browser extension
 

package/rules/autoconsent/1pmobile.json

@@ -0,0 +1,44 @@
+{
+    "name": "1pmobile.com",
+    "runContext": {
+        "urlPattern": "^https?://(\\w+\\.)?1pmobile\\.com/"
+    },
+    "prehideSelectors": [".cookie-disclaimer"],
+    "detectCmp": [
+        {
+            "exists": ".cookie-disclaimer a[href*='cprefs=change'], #myModal #cookieprefs"
+        }
+    ],
+    "detectPopup": [
+        {
+            "visible": ".cookie-disclaimer, #myModal #cookieprefs"
+        }
+    ],
+    "optIn": [
+        {
+            "waitForThenClick": ".cookie-disclaimer a[href*='cprefs=agree'], #myModal #cookieprefs a[href*='cprefs=agree']"
+        }
+    ],
+    "optOut": [
+        {
+            "if": {
+                "exists": "#myModal #cookieprefs"
+            },
+            "then": [
+                {
+                    "click": "#cookieprefs input[type=checkbox]:checked",
+                    "all": true,
+                    "optional": true
+                },
+                {
+                    "waitForThenClick": "#cookieprefs input[type=submit]"
+                }
+            ],
+            "else": [
+                {
+                    "waitForThenClick": ".cookie-disclaimer a[href*='cprefs=change']"
+                }
+            ]
+        }
+    ]
+}