ConusAI vendor v0.1.0-beta.114

test/consent.test.ts

@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
+
+import { createTestObserve } from "@conusai-sdk/observe-testing"
+import { describe, expect, it } from "vitest"
+import { browserObserveOptions, observeMeta, startBrowserObserve } from "../apps/web/src/observe/browser.js"
+import {
+  CONSENT_COOKIE,
+  CONSENT_NOTICE_VERSION,
+  CONSENT_SECONDS,
+  consentCookie,
+  privacyRestricted,
+  readConsentChoice,
+  recordConsentChoice,
+} from "../apps/web/src/observe/consent.js"
+
+const NOW = Date.parse("2026-10-01T12:00:00.000Z")
+const choice = (analytics: boolean, replay: boolean) => ({
+  analytics,
+  replay,
+  at: new Date(NOW).toISOString(),
+  notice: CONSENT_NOTICE_VERSION,
+})
+
+describe("the app's consent record", () => {
+  it("stores both independent choices for six months and rejects malformed or stale records", () => {
+    const saved = choice(true, false)
+    const cookie = consentCookie(saved)
+    expect(cookie).toContain(`${CONSENT_COOKIE}=`)
+    expect(cookie).toContain(`Max-Age=${CONSENT_SECONDS}`)
+    expect(cookie).toContain("SameSite=Lax; Secure")
+    expect(readConsentChoice(cookie, NOW)).toEqual(saved)
+    expect(readConsentChoice(cookie, NOW + CONSENT_SECONDS * 1000)).toBeUndefined()
+    expect(readConsentChoice(`${CONSENT_COOKIE}=not-json`, NOW)).toBeUndefined()
+    expect(readConsentChoice(consentCookie({ ...saved, notice: "old" }), NOW)).toBeUndefined()
+  })
+
+  it("does not infer replay from analytics consent", () => {
+    const settings = { release: "r", environment: "production" }
+    expect(browserObserveOptions(settings, choice(true, false)).modules).toEqual({ traces: true, analytics: true })
+    expect(browserObserveOptions(settings, choice(true, true)).modules).toEqual({
+      traces: true,
+      analytics: true,
+      replay: true,
+    })
+    expect(browserObserveOptions(settings, choice(true, true), true).modules).not.toHaveProperty("replay")
+  })
+})
+
+describe("restoring and changing a choice", () => {
+  const documentWith = (cookie: string) => ({
+    cookie,
+    querySelector: (selector: string) =>
+      selector === 'meta[name="app-observe"]'
+        ? { getAttribute: (name: string) => observeMeta({ release: "r", environment: "e" })[name] ?? null }
+        : null,
+  })
+
+  it("restores analytics without granting replay, and revokes everything on withdrawal", () => {
+    const instance = createTestObserve({ consent: "opt-in", modules: { errors: false } })
+    startBrowserObserve(documentWith(consentCookie(choice(true, false))) as never, () => instance)
+    expect(instance.consent.state()).toBe("granted")
+
+    recordConsentChoice({ analytics: false, replay: false })
+    expect(instance.consent.state()).toBe("denied")
+  })
+
+  it("treats GPC as a refusal even when an older cookie granted both purposes", () => {
+    const instance = createTestObserve({ consent: "opt-in", modules: { errors: false } })
+    startBrowserObserve(documentWith(consentCookie(choice(true, true))) as never, () => instance, {
+      globalPrivacyControl: true,
+    })
+    expect(instance.consent.state()).toBe("denied")
+    expect(privacyRestricted({ doNotTrack: "1" })).toBe(true)
+    expect(privacyRestricted({ globalPrivacyControl: false })).toBe(false)
+  })
+})