662327e8b4
CI / nodejs-build (push) Successful in 2m47s
CI / branch-name (push) Has been skipped
CI / guardrail-integrity (push) Has been skipped
CI / detect-changes (push) Successful in 10s
CI / secret-scan (push) Has been skipped
CI / dep-audit (push) Has been skipped
CI / sbom-scan (push) Has been skipped
CI / validate-canonical-controls (push) Successful in 16s
CI / loc-budget (push) Failing after 17s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-python-backend (push) Successful in 42s
CI / test-python-document-crawler (push) Has been skipped
CI / test-go (push) Has been skipped
CI / iace-gt-coverage (push) Has been skipped
CI / test-python-dsms-gateway (push) Has been skipped
Massiv-Update auf Basis BMW-Test-Iterationen (v1→v9): Core Compliance-Check - Sonnet check_type Klassifikation: text/process/review fuer alle 1874 MCs in compliance.doc_check_controls (script + Sidecar /data/mc_classification.db). rag_document_checker filtert auf check_type='text' fuer doc_check. Plus fits_doc_type-Audit (v2) + ui_only-Audit fuer DSA/E-Commerce-MCs in falscher doc_type-Schublade. - scope_requires-Filter: biometric/ai_decision/child_targeting MCs werden per business_profile gefiltert (FRT skipped fuer BMW etc.). - Embedding-Match (BGE-M3) als Phase-3 nach Regex-Match: Per-doc_type-Threshold-Override (impressum 0.50, dse/cookie 0.60), Short-Field-Rescue (15-Wort-Chunks) fuer Pflichtfelder im Impressum. Title+check_question als Embedding-Input fuer mehr Kontext. - Cookie-Text-Routing: consent-tester gibt cmp_cookie_text aus dem CMP-Reconstruct zurueck, Backend bevorzugt das gegen DOM-Extraction wenn richer (BMW 1824 vs 600 Worte). Vendor-Redundanz + EU-Alternativen + Cost-Saving - vendor_redundancy.analyze() — funktionale Kategorisierung der CMP-Vendors, Detektion von Mehrfach-Anbietern pro Kategorie, EU-Alternative-Lookup (Matomo, IONOS, HERE, Friendly Captcha, Smart AdServer, ...). - vendor_cost_estimator: Tier-Inferenz aus Cookie-Footprint (Cookie-Anzahl + Premium-Feature-Cookies + Third-Party-Quote → starter/professional/ enterprise/premier). - Self-Service-Werbung (Google/Meta/Pinterest/...) = 0 Lizenz-Kosten (nur Media-Spend, separat). DSP-Plattformen behalten enge Range. - Tier-aware Saving-Range: bei Enterprise/Premier nutzen wir den oberen 40-100%-Band der Listpreise, nicht starter→premier. - Multi-Function-Tools (Matomo Pro, SAP CX, IONOS Cloud, Userlike, Smart AdServer, HERE Maps, Vimeo Pro, LamaPoll) — ein Tool ersetzt mehrere Kategorien gleichzeitig. Cookie-Wissens-DB + Funktionale Klassifikation - cookie_knowledge_db: 50 kuratierte Top-Cookies (Google/Meta/Adobe/MS/...) mit vendor, exact_purpose, data_collected, IAB-TCF-IDs, reid_risk, schrems_ii_status, EuGH-Urteile, EU-Alternative. - cookie_function_classifier: pro Cookie funktionale Rolle (tracking_id, ad_pixel, session_id, ab_test, csrf, ...) + blocking_impact. Country-Inferenz aus Rechtsform - cookie_link_validator: Country-Field wird aus Vendor-Name abgeleitet (A/S=DK, GmbH=DE, Inc=US, B.V.=NL, ...) plus Vendor-Lookup-Table. Reduziert false-positive no_country-Flags bei eindeutig-EU-Vendors (Adform DK, Pinterest IE). Action-Recipes + Doc-Anchor-Locator - finding_action_recipes: pro Finding-Typ (no_cookies_listed, no_country, broken_opt_out, "Auftragsverarbeiter erwaehnen", "Art. 22 Profiling", ...) eine strukturierte Anweisung mit what/why/fix_text/where/example. Zum 1:1-Einfuegen in Kunden-Dokumente. - doc_anchor_locator: Embedding-basiert (BGE-M3 cosine) — sucht den passenden Absatz im existierenden Kundendokument fuer jeden Finding. Per-Run Thread-Local-Cache. Fallback: keyword-Match. - Email-Rendering integriert Recipe + Anchor pro Doc-Pruefungs-Fail + Vendor-Flag-Liste mit aufklappbarer Action-Liste. - Score-Erklaerung pro Vendor-Zeile (3/5-Untertitel + Tooltip). Migration-Pipeline (Compliance-Check -> Customer Banner/Documents) - migration_to_banner.py: Vendor-Liste -> CookieBannerConfig mit 4 Kategorien + Review-Flags. - migration_to_document.py: Vendor-Liste -> Cookie-Policy + VVT-Register + Privacy-Policy-Pre-Fills. - agent_migration_routes: 3 Preview-Endpoints (banner-preview, document-preview, summary). Persistierung der cmp_vendors in /data/compliance_audits.db check_payloads-Tabelle. Borlabs-Parity Cookie-Banner-Features - Consent-Historie im Banner: window.bpShowConsentHistory() + localStorage. - Content-Blocker: cookie-banner-content-blocker.ts — YouTube/Maps/Video Placeholder bis Einwilligung. - Google Consent Mode v2 erweitert: wait_for_update + region=EEA/CH/GB. - Consent-Log Export (CSV/JSON) per einwilligungen_export_routes. Bug-Fixes - canonical_control_routes: _jsonish-Helper fuer string-typed jsonb, similar-controls-Endpoint mit _has_embedding_col()-Cache (kein 500 mehr). - Control-Library Frontend: defensive .map-Coercer in 2 Detail-Views. - Embedding-Service-Batching (32er Batches statt 165 in einem Call). - KeyError 'control_id' in MC-Result-Aggregation (defensive .get). - Master-Controls-Klick-Through von /sdk/master-controls auf /sdk/control-library?control=<id> mit URL-Param-Auto-Open. - Dockerfile: /data pre-chowned auf appuser (Audit-DB-Schreibrecht). - Cookie-Text-Routing-Bug (cmp_reconstructed > DOM-extraction). - doc_type-aware MC-Filter (statt all-text-MCs). - Master-Contract-Dedup (60 BMW-Internal-Eintraege = 1 Adobe-Vertrag). - A3-v2-Audit hat 24 UI-Sprache-MCs als 'process' reklassifiziert. Tests - test_migration_mappers.py (9 Tests) - test_migration_endpoints.py (4 Tests) Skripte (one-shot) - classify_mc_check_type.py (v1) + _v2 (PK=control_id,doc_type) - audit_mc_doctype_fit.py (v1 fits) + _v2 (ui_only + scope_requires) BMW-Run-Bilanz v1 (broken) -> v9 (alle Fixes): DSE 7,5% -> 81-83% Impressum 4% -> 100% (6 echte MCs alle erfuellt) Cookie 0% -> 79-83% (CMP-Text-Routing + Embedding) Plus: 10 Konsolidierungs-Kategorien, geschaetzte Saving 200k-3M / Jahr Plus: Action-Recipes + Doc-Anchors fuer jeden Fail Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
157 lines
6.4 KiB
TypeScript
157 lines
6.4 KiB
TypeScript
/**
|
|
* Content-Blocker Generator (Borlabs-Parity).
|
|
*
|
|
* Returns a small JS snippet that scans the page for blockable third-party
|
|
* embeds (YouTube, Vimeo, Google Maps, Spotify, Twitter, Facebook) and
|
|
* replaces them with a click-to-consent placeholder until the user agrees
|
|
* to the relevant cookie category.
|
|
*
|
|
* The customer drops a SECOND script tag next to the banner:
|
|
* <script src="/cookie-banner.js"></script>
|
|
* <script src="/cookie-content-blocker.js"></script>
|
|
*
|
|
* Author writes content as either:
|
|
* <bp-consent-block category="EXTERNAL_MEDIA"
|
|
* provider="YouTube"
|
|
* src="https://www.youtube.com/embed/...">
|
|
* <!-- the original iframe / embed code -->
|
|
* </bp-consent-block>
|
|
*
|
|
* OR auto-detect: any <iframe src="https://www.youtube.com/...">
|
|
* gets wrapped on page load.
|
|
*/
|
|
|
|
const KNOWN_EMBEDS: Array<{ host: string; provider: string; category: string }> = [
|
|
{ host: 'youtube.com', provider: 'YouTube', category: 'EXTERNAL_MEDIA' },
|
|
{ host: 'youtu.be', provider: 'YouTube', category: 'EXTERNAL_MEDIA' },
|
|
{ host: 'vimeo.com', provider: 'Vimeo', category: 'EXTERNAL_MEDIA' },
|
|
{ host: 'google.com/maps', provider: 'Google Maps', category: 'EXTERNAL_MEDIA' },
|
|
{ host: 'maps.googleapis.com', provider: 'Google Maps', category: 'EXTERNAL_MEDIA' },
|
|
{ host: 'spotify.com', provider: 'Spotify', category: 'EXTERNAL_MEDIA' },
|
|
{ host: 'soundcloud.com', provider: 'SoundCloud', category: 'EXTERNAL_MEDIA' },
|
|
{ host: 'twitter.com', provider: 'Twitter / X', category: 'PERSONALIZATION' },
|
|
{ host: 'facebook.com', provider: 'Facebook', category: 'PERSONALIZATION' },
|
|
{ host: 'instagram.com', provider: 'Instagram', category: 'PERSONALIZATION' },
|
|
]
|
|
|
|
export function generateContentBlockerJS(cookieName: string = 'cookie_consent'): string {
|
|
return `(function () {
|
|
'use strict';
|
|
var COOKIE_NAME = ${JSON.stringify(cookieName)};
|
|
var KNOWN_EMBEDS = ${JSON.stringify(KNOWN_EMBEDS)};
|
|
|
|
function getConsent() {
|
|
var c = document.cookie.split('; ').find(function (r) {
|
|
return r.indexOf(COOKIE_NAME + '=') === 0;
|
|
});
|
|
if (!c) return null;
|
|
try { return JSON.parse(decodeURIComponent(c.split('=')[1])); } catch (e) { return null; }
|
|
}
|
|
|
|
function categoryGranted(cat) {
|
|
var c = getConsent();
|
|
if (!c) return false;
|
|
var k = String(cat).toLowerCase();
|
|
return c[cat] === true || c[k] === true;
|
|
}
|
|
|
|
function classifyByHost(src) {
|
|
if (!src) return null;
|
|
for (var i = 0; i < KNOWN_EMBEDS.length; i++) {
|
|
if (src.indexOf(KNOWN_EMBEDS[i].host) > -1) return KNOWN_EMBEDS[i];
|
|
}
|
|
return null;
|
|
}
|
|
|
|
function makePlaceholder(provider, category, originalHTML, parent) {
|
|
var ph = document.createElement('div');
|
|
ph.className = 'bp-consent-placeholder';
|
|
ph.style.cssText = 'border:2px dashed #cbd5e1;background:#f8fafc;padding:24px;' +
|
|
'border-radius:8px;text-align:center;font-family:-apple-system,sans-serif;color:#475569';
|
|
ph.innerHTML =
|
|
'<div style="font-size:14px;font-weight:600;color:#1e293b;margin-bottom:8px">' +
|
|
'Inhalt von ' + provider + ' blockiert</div>' +
|
|
'<div style="font-size:12px;margin-bottom:12px">' +
|
|
'Zum Anzeigen dieses Inhalts wird Ihre Einwilligung fuer die Kategorie ' +
|
|
'<strong>' + category + '</strong> benoetigt. ' +
|
|
'Beim Akzeptieren werden Cookies von ' + provider + ' gesetzt.</div>' +
|
|
'<button class="bp-consent-load-btn" ' +
|
|
'style="background:#7c3aed;color:white;border:none;padding:8px 16px;' +
|
|
'border-radius:6px;font-size:13px;cursor:pointer;margin-right:6px">' +
|
|
'Inhalt einmalig laden</button>' +
|
|
'<button class="bp-consent-accept-btn" ' +
|
|
'style="background:#16a34a;color:white;border:none;padding:8px 16px;' +
|
|
'border-radius:6px;font-size:13px;cursor:pointer">' +
|
|
category + ' akzeptieren</button>';
|
|
ph.querySelector('.bp-consent-load-btn').addEventListener('click', function () {
|
|
var div = document.createElement('div');
|
|
div.innerHTML = originalHTML;
|
|
while (div.firstChild) parent.insertBefore(div.firstChild, ph);
|
|
ph.remove();
|
|
});
|
|
ph.querySelector('.bp-consent-accept-btn').addEventListener('click', function () {
|
|
var c = getConsent() || {};
|
|
c[category] = true;
|
|
var date = new Date();
|
|
date.setTime(date.getTime() + 180 * 86400000);
|
|
document.cookie = COOKIE_NAME + '=' + encodeURIComponent(JSON.stringify(c)) +
|
|
';expires=' + date.toUTCString() + ';path=/;SameSite=Lax';
|
|
window.dispatchEvent(new CustomEvent('cookieConsentUpdated', { detail: c }));
|
|
// Re-scan: placeholders for THIS category get replaced now
|
|
processAll();
|
|
});
|
|
return ph;
|
|
}
|
|
|
|
function processWrapped() {
|
|
var wrapped = document.querySelectorAll('bp-consent-block, [data-bp-consent-block]');
|
|
wrapped.forEach(function (el) {
|
|
var cat = el.getAttribute('category') || el.getAttribute('data-category') || 'EXTERNAL_MEDIA';
|
|
var prov = el.getAttribute('provider') || el.getAttribute('data-provider') || 'Drittanbieter';
|
|
if (categoryGranted(cat)) {
|
|
// Already consented: unwrap the inner content
|
|
var html = el.innerHTML;
|
|
var tmp = document.createElement('div');
|
|
tmp.innerHTML = html;
|
|
var parent = el.parentNode;
|
|
while (tmp.firstChild) parent.insertBefore(tmp.firstChild, el);
|
|
el.remove();
|
|
} else {
|
|
var parent = el.parentNode;
|
|
var inner = el.innerHTML;
|
|
var ph = makePlaceholder(prov, cat, inner, parent);
|
|
parent.insertBefore(ph, el);
|
|
el.remove();
|
|
}
|
|
});
|
|
}
|
|
|
|
function processBareIframes() {
|
|
var iframes = document.querySelectorAll('iframe[src]:not([data-bp-processed])');
|
|
iframes.forEach(function (f) {
|
|
var match = classifyByHost(f.getAttribute('src') || '');
|
|
if (!match) return;
|
|
f.setAttribute('data-bp-processed', '1');
|
|
if (categoryGranted(match.category)) return;
|
|
var html = f.outerHTML;
|
|
var parent = f.parentNode;
|
|
var ph = makePlaceholder(match.provider, match.category, html, parent);
|
|
parent.replaceChild(ph, f);
|
|
});
|
|
}
|
|
|
|
function processAll() {
|
|
processWrapped();
|
|
processBareIframes();
|
|
}
|
|
|
|
if (document.readyState === 'loading') {
|
|
document.addEventListener('DOMContentLoaded', processAll);
|
|
} else {
|
|
processAll();
|
|
}
|
|
// Re-process when consent updates
|
|
window.addEventListener('cookieConsentUpdated', processAll);
|
|
})();`
|
|
}
|