Benjamin Admin
fab1e35847
Per user request: BMW (and others) put their own services AND external
vendors in the same cookie-policy widget. The VVT-Tabelle now groups
them by Art. 30(1)(d) DSGVO recipient category so the DSB can act on
the right buckets:
- INTERNAL — owner processing for itself ('BMW AG — XYZ')
- GROUP_COMPANY — same brand family, different legal entity ('BMW Bank')
- PROCESSOR — Auftragsverarbeiter, AVV-pflichtig (Adobe, Akamai)
- CONTROLLER — independent / joint controller (Meta Pixel, Google
Ads, LinkedIn — they run their own profiles)
- AUTHORITY — government bodies (rare in cookies)
- OTHER — fallback
New module vendor_classifier.py:
- owner_from_url(url) — derive site-owner token (bmw.de -> 'BMW',
mercedes-benz.de -> 'Mercedes-Benz')
- classify(name, category, owner) — strict 5-tier heuristic:
* INTERNAL: vendor name first-token is '<Owner>' / '<Owner> AG' /
'<Owner> SE' / '<Owner> GmbH' / '<Owner> AG & Co. KG'
* GROUP_COMPANY: starts with '<Owner> ' but isn't '<Owner> AG'
* CONTROLLER: matches a known joint-controller list (Meta, Google
Ads, YouTube, LinkedIn Insight, TikTok, Pinterest, Taboola,
Outbrain, Criteo, Twitter, Reddit, ...)
* PROCESSOR: legal-form suffix in name (GmbH, AG, Inc., A/S,
B.V., S.A., Ltd., LLC, ...)
* OTHER: anything else
vendor_extractor.extract_vendors_from_payloads now takes owner_name:
- Passes it through to classify() for every extracted vendor record
- The route derives owner_name via _company_name_from_url(doc_entries)
- LLM-extracted vendors are classified the same way (so V3 fallback
also produces tagged records)
agent_doc_check_extras.build_vvt_table_html rewritten:
- Buckets vendors by recipient_type
- Renders one section per non-empty bucket, in canonical order
(RECIPIENT_TYPE_SECTIONS), each with section header + count + bad
count + nested table
- Within each section: sorted by compliance_score ascending
- Response JSON cmp_vendors includes recipient_type so the frontend
can later import per-category into the VVT module
Expected BMW result: ~60 INTERNAL rows (BMW AG own services),
~25 PROCESSOR rows (Adobe, Adform, Akamai, AWS, ...), ~5 CONTROLLER
rows (Meta Pixel, Google, LinkedIn, Pinterest, Outbrain, Taboola).
374 lines
15 KiB
Python
374 lines
15 KiB
Python
"""
|
|
Extras for the agent doc-check email report.
|
|
|
|
Split out from agent_doc_check_report.py to keep both files under the
|
|
500-line hard cap. Contains:
|
|
- build_scanned_urls_html (list of fetched URLs + cross-domain notice)
|
|
- build_provider_list_html (cookie banner + TCF vendor table)
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
|
|
def build_scanned_urls_html(doc_entries: list[dict]) -> str:
|
|
"""Render the list of scanned URLs at the top of the report.
|
|
|
|
Transparent for the GF which sources were actually fetched/analysed.
|
|
Skips empty URLs (text-only uploads). Adds a cross-domain warning when
|
|
legal texts are distributed across multiple domains (e.g. BMW spreads
|
|
across bmw.de, bmwgroup.com, bmwgroup.jobs).
|
|
"""
|
|
from urllib.parse import urlparse
|
|
|
|
rows: list[str] = []
|
|
seen: set[str] = set()
|
|
domains: dict[str, list[str]] = {} # netloc -> list of doc_types
|
|
for entry in doc_entries:
|
|
url = (entry.get("url") or "").strip()
|
|
if not url or url in seen:
|
|
continue
|
|
seen.add(url)
|
|
label = _doc_type_label(entry.get("doc_type", ""))
|
|
words = entry.get("word_count") or 0
|
|
auto = entry.get("auto_discovered")
|
|
try:
|
|
netloc = urlparse(url).netloc.lower().lstrip("www.")
|
|
if netloc:
|
|
domains.setdefault(netloc, []).append(label)
|
|
except Exception:
|
|
pass
|
|
badge = ('<span style="display:inline-block;margin-left:6px;'
|
|
'background:#dbeafe;color:#1e40af;font-size:10px;'
|
|
'padding:1px 6px;border-radius:8px;font-family:sans-serif">'
|
|
'auto-entdeckt</span>') if auto else ""
|
|
rows.append(
|
|
f'<tr>'
|
|
f'<td style="padding:3px 12px 3px 0;color:#475569;font-size:12px">'
|
|
f'{label}{badge}</td>'
|
|
f'<td style="padding:3px 12px 3px 0;font-size:12px;'
|
|
f'font-family:ui-monospace,monospace;color:#1e293b;word-break:break-all">'
|
|
f'<a href="{url}" style="color:#2563eb;text-decoration:none">{url}</a></td>'
|
|
f'<td style="padding:3px 0;color:#94a3b8;font-size:11px;text-align:right;'
|
|
f'white-space:nowrap">{words} Woerter</td>'
|
|
f'</tr>'
|
|
)
|
|
if not rows:
|
|
return ""
|
|
|
|
cross_domain_html = _cross_domain_notice(domains) if len(domains) >= 2 else ""
|
|
|
|
return (
|
|
'<div style="font-family:-apple-system,BlinkMacSystemFont,sans-serif;'
|
|
'max-width:700px;margin:0 auto 16px;padding:12px 16px;'
|
|
'background:#fafafa;border:1px solid #e5e7eb;border-radius:8px">'
|
|
'<h3 style="margin:0 0 8px;font-size:14px;color:#334155">'
|
|
f'Gepruefte Quellen ({len(rows)})</h3>'
|
|
'<table style="width:100%;border-collapse:collapse">'
|
|
+ "".join(rows)
|
|
+ '</table>'
|
|
+ cross_domain_html
|
|
+ '</div>'
|
|
)
|
|
|
|
|
|
def _cross_domain_notice(domains: dict[str, list[str]]) -> str:
|
|
"""Warning box when legal texts are spread across multiple domains.
|
|
|
|
Relevant for big corporate groups (BMW Group: bmw.de / bmwgroup.com /
|
|
bmwgroup.jobs). Affects findability for data subjects and may indicate
|
|
incomplete disclosure on the main site.
|
|
"""
|
|
items = []
|
|
for netloc, labels in sorted(domains.items()):
|
|
labels_str = ", ".join(sorted(set(labels)))
|
|
items.append(
|
|
f'<li style="margin-bottom:2px"><strong>{netloc}</strong> '
|
|
f'<span style="color:#92400e;font-size:11px">→ {labels_str}</span></li>'
|
|
)
|
|
return (
|
|
'<div style="margin-top:12px;padding:10px 12px;background:#fffbeb;'
|
|
'border-left:3px solid #f59e0b;border-radius:4px;font-size:12px;'
|
|
'color:#78350f">'
|
|
'<strong>Hinweis: Rechtstexte verteilt auf '
|
|
f'{len(domains)} Domains.</strong> '
|
|
'Erschwert die Auffindbarkeit fuer Betroffene (Art. 12 Abs. 1 DSGVO — '
|
|
'transparente Information). Pruefen Sie, ob alle Texte auch von der '
|
|
'Hauptdomain aus klar verlinkt sind.'
|
|
'<ul style="margin:6px 0 0 16px;padding-left:0">'
|
|
+ "".join(items) +
|
|
'</ul></div>'
|
|
)
|
|
|
|
|
|
def _doc_type_label(doc_type: str) -> str:
|
|
"""Lazy resolver — avoids circular import with agent_compliance_check_routes."""
|
|
labels = {
|
|
"dse": "Datenschutzerklaerung",
|
|
"datenschutz": "Datenschutzerklaerung",
|
|
"privacy": "Datenschutzerklaerung",
|
|
"impressum": "Impressum",
|
|
"agb": "AGB",
|
|
"widerruf": "Widerrufsbelehrung",
|
|
"cookie": "Cookie-Richtlinie",
|
|
"avv": "Auftragsverarbeitung",
|
|
"loeschkonzept": "Loeschkonzept",
|
|
"dsfa": "Datenschutz-Folgenabschaetzung",
|
|
"social_media": "Social Media Datenschutz",
|
|
"nutzungsbedingungen": "Nutzungsbedingungen",
|
|
"dsb": "DSB-Kontakt",
|
|
}
|
|
return labels.get(doc_type, doc_type.upper() if doc_type else "Dokument")
|
|
|
|
|
|
def build_provider_list_html(
|
|
banner_result: dict | None,
|
|
vvt_entries: list[dict] | None,
|
|
) -> str:
|
|
"""Render the cookie banner result + TCF vendor table for the email.
|
|
|
|
Sections:
|
|
1. Banner summary (provider, violations count)
|
|
2. Vendor table: Name | Kategorie | Zweck | Drittland | Rechtsgrundlage
|
|
"""
|
|
if not banner_result and not vvt_entries:
|
|
return ""
|
|
|
|
parts: list[str] = [
|
|
'<div style="font-family:-apple-system,BlinkMacSystemFont,sans-serif;'
|
|
'max-width:700px;margin:0 auto 16px;padding:12px 16px;'
|
|
'background:#fafafa;border:1px solid #e5e7eb;border-radius:8px">'
|
|
'<h3 style="margin:0 0 10px;font-size:14px;color:#334155">'
|
|
'Cookie-Banner & Verarbeiter</h3>'
|
|
]
|
|
|
|
if banner_result:
|
|
detected = banner_result.get("banner_detected", False)
|
|
provider = banner_result.get("banner_provider") or "unbekannt"
|
|
violations = banner_result.get("banner_checks", {}).get("violations", [])
|
|
n_viol = len(violations) if isinstance(violations, list) else int(violations or 0)
|
|
|
|
status_color = "#16a34a" if detected and n_viol == 0 else (
|
|
"#d97706" if detected else "#6b7280"
|
|
)
|
|
parts.append(
|
|
f'<div style="font-size:13px;color:#374151;margin-bottom:10px">'
|
|
f'<span style="display:inline-block;width:8px;height:8px;'
|
|
f'border-radius:50%;background:{status_color};margin-right:8px"></span>'
|
|
f'Banner erkannt: <strong>{"Ja" if detected else "Nein"}</strong>'
|
|
f' · Anbieter: <strong>{provider}</strong>'
|
|
f' · Auffaelligkeiten: <strong>{n_viol}</strong>'
|
|
f'</div>'
|
|
)
|
|
|
|
vendors = vvt_entries or []
|
|
if vendors:
|
|
parts.append(
|
|
f'<div style="font-size:12px;color:#475569;margin:8px 0 6px">'
|
|
f'<strong>{len(vendors)} TCF-Verarbeiter ueber das Banner eingebunden:</strong>'
|
|
f'</div>'
|
|
'<table style="width:100%;border-collapse:collapse;font-size:11px">'
|
|
'<thead><tr style="background:#f1f5f9;color:#475569;text-align:left">'
|
|
'<th style="padding:5px 8px">Name</th>'
|
|
'<th style="padding:5px 8px">Kategorie</th>'
|
|
'<th style="padding:5px 8px">Zweck</th>'
|
|
'<th style="padding:5px 8px">Drittland</th>'
|
|
'<th style="padding:5px 8px">Rechtsgrundlage</th>'
|
|
'</tr></thead><tbody>'
|
|
)
|
|
for v in vendors[:50]:
|
|
parts.append(_render_vendor_row(v))
|
|
parts.append('</tbody></table>')
|
|
if len(vendors) > 50:
|
|
parts.append(
|
|
f'<div style="font-size:11px;color:#94a3b8;margin-top:4px">'
|
|
f'... und {len(vendors) - 50} weitere</div>'
|
|
)
|
|
elif banner_result and banner_result.get("banner_detected"):
|
|
parts.append(
|
|
'<div style="font-size:11px;color:#94a3b8">'
|
|
'Keine TCF-Verarbeiter erkannt (Banner nutzt kein TCF v2 Framework '
|
|
'oder Vendor-Liste konnte nicht ausgelesen werden).</div>'
|
|
)
|
|
|
|
parts.append('</div>')
|
|
return "".join(parts)
|
|
|
|
|
|
def _render_vendor_row(v: dict) -> str:
|
|
name = v.get("name") or "Unbekannt"
|
|
kategorie = _category_label(v.get("kategorie", ""))
|
|
zweck = v.get("zweck_kurz") or ", ".join((v.get("zweck") or [])[:2])
|
|
drittland = v.get("drittland")
|
|
land = v.get("land") or ""
|
|
if drittland is True:
|
|
drittland_str = (f'<span style="color:#dc2626">Ja ({land})</span>'
|
|
if land else '<span style="color:#dc2626">Ja</span>')
|
|
elif drittland is False:
|
|
drittland_str = (f'<span style="color:#16a34a">Nein ({land})</span>'
|
|
if land else '<span style="color:#16a34a">Nein</span>')
|
|
else:
|
|
drittland_str = '<span style="color:#94a3b8">unbekannt</span>'
|
|
rg = v.get("rechtsgrundlage", "")
|
|
rg_short = "Einwilligung" if "Einwilligung" in rg else (
|
|
"Berechtigtes Interesse" if "Berechtigtes" in rg else rg[:40]
|
|
)
|
|
return (
|
|
f'<tr style="border-top:1px solid #e2e8f0">'
|
|
f'<td style="padding:4px 8px;color:#1e293b">{name}</td>'
|
|
f'<td style="padding:4px 8px;color:#475569">{kategorie}</td>'
|
|
f'<td style="padding:4px 8px;color:#475569">{zweck}</td>'
|
|
f'<td style="padding:4px 8px">{drittland_str}</td>'
|
|
f'<td style="padding:4px 8px;color:#475569">{rg_short}</td>'
|
|
f'</tr>'
|
|
)
|
|
|
|
|
|
def _category_label(kat: str) -> str:
|
|
return {
|
|
"necessary": "Notwendig",
|
|
"functional": "Funktional",
|
|
"statistics": "Statistik",
|
|
"marketing": "Marketing",
|
|
"strictlyNecessary": "Notwendig",
|
|
"advertising": "Marketing",
|
|
}.get(kat, kat or "—")
|
|
|
|
|
|
def build_vvt_table_html(vendors: list[dict]) -> str:
|
|
"""Render the per-vendor VVT-style table for the email report.
|
|
|
|
Splits vendors into 3-4 sections by recipient_type (Art. 30(1)(d)
|
|
DSGVO):
|
|
|
|
1. INTERNAL — own departments / own systems
|
|
2. GROUP_COMPANY — parent/subsidiary (if any)
|
|
3. PROCESSOR — Auftragsverarbeiter (AVV-pflichtig)
|
|
4. CONTROLLER — joint/independent controllers (Meta, Google,
|
|
LinkedIn — they build own profiles)
|
|
5. AUTHORITY / OTHER — rest
|
|
|
|
Within each section: rows sorted by compliance_score ascending so
|
|
the weakest entries surface first.
|
|
"""
|
|
if not vendors:
|
|
return ""
|
|
|
|
# Import here to avoid pulling backend service deps at module load
|
|
from compliance.services.vendor_classifier import RECIPIENT_TYPE_SECTIONS
|
|
|
|
# Bucket vendors by recipient_type
|
|
by_type: dict[str, list[dict]] = {}
|
|
for v in vendors:
|
|
rt = (v.get("recipient_type") or "OTHER").upper()
|
|
by_type.setdefault(rt, []).append(v)
|
|
|
|
# Top summary
|
|
n_total = len(vendors)
|
|
n_critical = sum(1 for v in vendors if v.get("compliance_score", 0) < 50)
|
|
summary = (
|
|
f"{n_total} Anbieter erfasst"
|
|
+ (f", <strong style=\"color:#dc2626\">{n_critical} unter 50%</strong>"
|
|
if n_critical else " — alle ueber 50%")
|
|
)
|
|
|
|
out: list[str] = [
|
|
'<div style="font-family:-apple-system,BlinkMacSystemFont,sans-serif;'
|
|
'max-width:760px;margin:0 auto 16px;padding:12px 16px;'
|
|
'background:#fafafa;border:1px solid #e5e7eb;border-radius:8px">',
|
|
'<h3 style="margin:0 0 4px;font-size:14px;color:#334155">'
|
|
'VVT-Vorschlag: Drittanbieter aus Cookie-Richtlinie</h3>',
|
|
f'<p style="margin:0 0 10px;font-size:11px;color:#6b7280">{summary}. '
|
|
'Gruppiert nach Empfaengerkategorie (Art. 30(1)(d) DSGVO), innerhalb '
|
|
'jeder Gruppe nach Compliance-Score sortiert.</p>',
|
|
]
|
|
|
|
for rtype, section_label in RECIPIENT_TYPE_SECTIONS:
|
|
rows = by_type.get(rtype) or []
|
|
if not rows:
|
|
continue
|
|
rows = sorted(rows, key=lambda v: v.get("compliance_score", 0))
|
|
n = len(rows)
|
|
n_bad = sum(1 for v in rows if v.get("compliance_score", 0) < 50)
|
|
bad_hint = (f' <span style="color:#dc2626">({n_bad} unter 50%)</span>'
|
|
if n_bad else "")
|
|
out.append(
|
|
f'<h4 style="margin:14px 0 4px;font-size:12px;color:#1e293b;'
|
|
f'border-top:1px solid #e2e8f0;padding-top:8px">'
|
|
f'{section_label} <span style="color:#94a3b8;font-weight:400">'
|
|
f'({n}){bad_hint}</span></h4>'
|
|
)
|
|
out.append(_render_vendor_section(rows))
|
|
|
|
out.append('</div>')
|
|
return "".join(out)
|
|
|
|
|
|
def _render_vendor_section(rows: list[dict]) -> str:
|
|
body: list[str] = [
|
|
'<table style="width:100%;border-collapse:collapse;font-size:11px">'
|
|
'<thead><tr style="background:#f1f5f9;color:#475569;text-align:left">'
|
|
'<th style="padding:5px 8px">Name</th>'
|
|
'<th style="padding:5px 8px">Kategorie</th>'
|
|
'<th style="padding:5px 8px">Sitz</th>'
|
|
'<th style="padding:5px 8px;text-align:center">Cookies</th>'
|
|
'<th style="padding:5px 8px;text-align:center">Opt-Out</th>'
|
|
'<th style="padding:5px 8px;text-align:center">Privacy</th>'
|
|
'<th style="padding:5px 8px;text-align:right">Score</th>'
|
|
'</tr></thead><tbody>',
|
|
]
|
|
for v in rows:
|
|
body.append(_render_vendor_row_full(v))
|
|
body.append('</tbody></table>')
|
|
return "".join(body)
|
|
|
|
|
|
def _render_vendor_row_full(v: dict) -> str:
|
|
name = v.get("name") or "Unbekannt"
|
|
category = _category_label(v.get("category", ""))
|
|
country = v.get("country") or "—"
|
|
cookies = v.get("cookies") or []
|
|
n_cookies = len(cookies)
|
|
score = int(v.get("compliance_score", 0))
|
|
flags = v.get("compliance_flags") or []
|
|
opt_status = _link_status_badge(
|
|
v.get("opt_out_url"), v.get("opt_out_ok"), v.get("opt_out_status"),
|
|
)
|
|
privacy_status = _link_status_badge(
|
|
v.get("privacy_policy_url"), v.get("privacy_ok"),
|
|
v.get("privacy_status"),
|
|
)
|
|
score_color = ("#16a34a" if score >= 80 else
|
|
"#d97706" if score >= 50 else "#dc2626")
|
|
flag_str = ""
|
|
if flags:
|
|
flag_str = (
|
|
f'<div style="font-size:10px;color:#94a3b8;margin-top:2px">'
|
|
f'{", ".join(flags[:4])}</div>'
|
|
)
|
|
return (
|
|
f'<tr style="border-top:1px solid #e2e8f0">'
|
|
f'<td style="padding:6px 8px;color:#1e293b;font-size:11px">'
|
|
f'{name}{flag_str}</td>'
|
|
f'<td style="padding:6px 8px;color:#475569;font-size:11px">{category}</td>'
|
|
f'<td style="padding:6px 8px;color:#475569;font-size:11px">{country}</td>'
|
|
f'<td style="padding:6px 8px;text-align:center;color:#475569;font-size:11px">'
|
|
f'{n_cookies}</td>'
|
|
f'<td style="padding:6px 8px;text-align:center">{opt_status}</td>'
|
|
f'<td style="padding:6px 8px;text-align:center">{privacy_status}</td>'
|
|
f'<td style="padding:6px 8px;text-align:right;font-weight:600;'
|
|
f'color:{score_color};font-size:11px">{score}%</td>'
|
|
f'</tr>'
|
|
)
|
|
|
|
|
|
def _link_status_badge(url: str | None, ok: bool | None, status: int | None) -> str:
|
|
if not url:
|
|
return ('<span style="color:#dc2626;font-size:11px" title="Kein Link">'
|
|
'✗</span>')
|
|
if ok:
|
|
return ('<span style="color:#16a34a;font-size:11px" '
|
|
f'title="HTTP {status}">✓</span>')
|
|
status_str = str(status) if status else "?"
|
|
return ('<span style="color:#dc2626;font-size:11px" '
|
|
f'title="HTTP {status_str}">✗ ({status_str})</span>')
|