From 9fbb716b00bca03b44305815cb3b62a35c014f9d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= <emile@getprobo.com>
Date: Fri, 24 Apr 2026 16:35:39 +0400
Subject: [PATCH] Constrain PostHog consent to one normal category per banner
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a partial unique index ensuring only one category per banner can
have posthog_consent enabled. Default it to the analytics category on
banner creation, clear the previous mapping before setting a new one,
and restrict the toggle to NORMAL categories in both the service layer
and the console UI.

Signed-off-by: Émile Ré <emile@getprobo.com>
---
 .../cookies/_components/CategorySection.tsx   |  1 +
 .../cookies/_components/EditCategoryForm.tsx  | 38 +++++++------
 pkg/cookiebanner/defaults.go                  | 51 ++++++++++++++++--
 pkg/cookiebanner/errors.go                    |  1 +
 pkg/cookiebanner/service.go                   | 20 +++++--
 pkg/coredata/cookie.go                        | 53 +++++++++++++++++++
 pkg/coredata/cookie_category.go               | 33 ++++++++++++
 pkg/coredata/migrations/20260424T122219Z.sql  | 17 ++++++
 .../api/console/v1/cookie_banner_resolvers.go |  3 ++
 9 files changed, 190 insertions(+), 27 deletions(-)
 create mode 100644 pkg/coredata/migrations/20260424T122219Z.sql

diff --git a/apps/console/src/pages/organizations/cookie-banners/configuration/cookies/_components/CategorySection.tsx b/apps/console/src/pages/organizations/cookie-banners/configuration/cookies/_components/CategorySection.tsx
index 11f5b2f09..68fd26bcd 100644
--- a/apps/console/src/pages/organizations/cookie-banners/configuration/cookies/_components/CategorySection.tsx
+++ b/apps/console/src/pages/organizations/cookie-banners/configuration/cookies/_components/CategorySection.tsx
@@ -490,6 +490,7 @@ export function CategorySection({ categoryKey, onDelete }: CategorySectionProps)
                 name={category.name}
                 slug={category.slug}
                 description={category.description}
+                kind={category.kind}
                 gcmConsentTypes={[...category.gcmConsentTypes]}
                 posthogConsent={category.posthogConsent}
                 isUpdating={isUpdating}
diff --git a/apps/console/src/pages/organizations/cookie-banners/configuration/cookies/_components/EditCategoryForm.tsx b/apps/console/src/pages/organizations/cookie-banners/configuration/cookies/_components/EditCategoryForm.tsx
index 618c8866b..a62084c36 100644
--- a/apps/console/src/pages/organizations/cookie-banners/configuration/cookies/_components/EditCategoryForm.tsx
+++ b/apps/console/src/pages/organizations/cookie-banners/configuration/cookies/_components/EditCategoryForm.tsx
@@ -30,6 +30,7 @@ interface EditCategoryFormProps {
   name: string;
   slug: string;
   description: string;
+  kind: string;
   gcmConsentTypes: string[];
   posthogConsent: boolean;
   isUpdating: boolean;
@@ -41,6 +42,7 @@ export function EditCategoryForm({
   name,
   slug,
   description,
+  kind,
   gcmConsentTypes,
   posthogConsent,
   isUpdating,
@@ -105,23 +107,25 @@ export function EditCategoryForm({
           ))}
         </div>
       </div>
-      <div>
-        <label className="text-sm font-medium">
-          {__("PostHog")}
-        </label>
-        <p className="text-xs text-muted-foreground mb-2">
-          {__("Control PostHog tracking consent based on this category.")}
-        </p>
-        <label className="flex items-center gap-1.5 text-xs cursor-pointer">
-          <input
-            type="checkbox"
-            checked={editPosthogConsent}
-            onChange={() => setEditPosthogConsent(prev => !prev)}
-            className="rounded"
-          />
-          <span>{__("Opt in/out of PostHog tracking")}</span>
-        </label>
-      </div>
+      {kind === "NORMAL" && (
+        <div>
+          <label className="text-sm font-medium">
+            {__("PostHog")}
+          </label>
+          <p className="text-xs text-muted-foreground mb-2">
+            {__("Control PostHog tracking consent based on this category.")}
+          </p>
+          <label className="flex items-center gap-1.5 text-xs cursor-pointer">
+            <input
+              type="checkbox"
+              checked={editPosthogConsent}
+              onChange={() => setEditPosthogConsent(prev => !prev)}
+              className="rounded"
+            />
+            <span>{__("Opt in/out of PostHog tracking")}</span>
+          </label>
+        </div>
+      )}
       <div className="flex items-center gap-2">
         <Button
           onClick={() => {
diff --git a/pkg/cookiebanner/defaults.go b/pkg/cookiebanner/defaults.go
index 677a743b5..92a2744e4 100644
--- a/pkg/cookiebanner/defaults.go
+++ b/pkg/cookiebanner/defaults.go
@@ -25,12 +25,53 @@ var defaultCategories = []struct {
 	Kind            coredata.CookieCategoryKind
 	Rank            int
 	GCMConsentTypes []string
+	PostHogConsent  bool
 }{
-	{"Necessary", "necessary", "Essential cookies required for the website to function properly.", coredata.CookieCategoryKindNecessary, 0, []string{"security_storage"}},
-	{"Analytics", "analytics", "Cookies that help understand how visitors interact with the website.", coredata.CookieCategoryKindNormal, 1, []string{"analytics_storage"}},
-	{"Advertising", "advertising", "Cookies used to deliver relevant advertisements and track campaigns.", coredata.CookieCategoryKindNormal, 2, []string{"ad_storage", "ad_user_data", "ad_personalization"}},
-	{"Functional", "functional", "Cookies that enable enhanced functionality and personalization.", coredata.CookieCategoryKindNormal, 3, []string{"functionality_storage", "personalization_storage"}},
-	{"Uncategorised", "uncategorised", "Cookies that have not been assigned to a category yet.", coredata.CookieCategoryKindUncategorised, 4, nil},
+	{
+		Name:            "Necessary",
+		Slug:            "necessary",
+		Description:     "Essential cookies required for the website to function properly.",
+		Kind:            coredata.CookieCategoryKindNecessary,
+		Rank:            0,
+		GCMConsentTypes: []string{"security_storage"},
+		PostHogConsent:  false,
+	},
+	{
+		Name:            "Analytics",
+		Slug:            "analytics",
+		Description:     "Cookies that help understand how visitors interact with the website.",
+		Kind:            coredata.CookieCategoryKindNormal,
+		Rank:            1,
+		GCMConsentTypes: []string{"analytics_storage"},
+		PostHogConsent:  true,
+	},
+	{
+		Name:            "Advertising",
+		Slug:            "advertising",
+		Description:     "Cookies used to deliver relevant advertisements and track campaigns.",
+		Kind:            coredata.CookieCategoryKindNormal,
+		Rank:            2,
+		GCMConsentTypes: []string{"ad_storage", "ad_user_data", "ad_personalization"},
+		PostHogConsent:  false,
+	},
+	{
+		Name:            "Functional",
+		Slug:            "functional",
+		Description:     "Cookies that enable enhanced functionality and personalization.",
+		Kind:            coredata.CookieCategoryKindNormal,
+		Rank:            3,
+		GCMConsentTypes: []string{"functionality_storage", "personalization_storage"},
+		PostHogConsent:  false,
+	},
+	{
+		Name:            "Uncategorised",
+		Slug:            "uncategorised",
+		Description:     "Cookies that have not been assigned to a category yet.",
+		Kind:            coredata.CookieCategoryKindUncategorised,
+		Rank:            4,
+		GCMConsentTypes: nil,
+		PostHogConsent:  false,
+	},
 }
 
 var defaultCategoryTranslationsByLanguage = map[string]map[string]struct {
diff --git a/pkg/cookiebanner/errors.go b/pkg/cookiebanner/errors.go
index d260c51cc..177a58736 100644
--- a/pkg/cookiebanner/errors.go
+++ b/pkg/cookiebanner/errors.go
@@ -33,4 +33,5 @@ var (
 	ErrCookieNameAlreadyExists    = errors.New("a cookie with this name already exists in this banner")
 	ErrCategoriesBannerMismatch   = errors.New("source and target categories belong to different banners")
 	ErrSameCategoryMove           = errors.New("source and target cookie categories must be different")
+	ErrPostHogConsentKindInvalid  = errors.New("PostHog consent can only be enabled on normal categories")
 )
diff --git a/pkg/cookiebanner/service.go b/pkg/cookiebanner/service.go
index 6254bd06c..464c06024 100644
--- a/pkg/cookiebanner/service.go
+++ b/pkg/cookiebanner/service.go
@@ -574,6 +574,7 @@ func (s *Service) CreateCookieBanner(
 					Kind:            dc.Kind,
 					Rank:            dc.Rank,
 					GCMConsentTypes: gcmConsentTypes,
+					PostHogConsent:  dc.PostHogConsent,
 					CreatedAt:       now,
 					UpdatedAt:       now,
 				}
@@ -1350,6 +1351,15 @@ func (s *Service) UpdateCookieCategory(
 				category.GCMConsentTypes = *req.GCMConsentTypes
 			}
 			if req.PostHogConsent != nil {
+				if *req.PostHogConsent && category.Kind != coredata.CookieCategoryKindNormal {
+					return ErrPostHogConsentKindInvalid
+				}
+				if *req.PostHogConsent {
+					var categories coredata.CookieCategories
+				if err := categories.ClearPostHogConsentByBannerID(ctx, tx, scope, category.CookieBannerID); err != nil {
+						return fmt.Errorf("cannot clear posthog consent: %w", err)
+					}
+				}
 				category.PostHogConsent = *req.PostHogConsent
 			}
 
@@ -2091,13 +2101,13 @@ func (s *Service) ReportDetectedCookies(
 					UpdatedAt:        now,
 				}
 
-				if err := cookie.Insert(ctx, tx, scope); err != nil {
-					if errors.Is(err, coredata.ErrResourceAlreadyExists) {
-						continue
-					}
+				ok, err := cookie.InsertIfNotExists(ctx, tx, scope)
+				if err != nil {
 					return fmt.Errorf("cannot insert detected cookie: %w", err)
 				}
-				inserted++
+				if ok {
+					inserted++
+				}
 			}
 
 			if inserted > 0 {
diff --git a/pkg/coredata/cookie.go b/pkg/coredata/cookie.go
index 4132c560e..020ec27b0 100644
--- a/pkg/coredata/cookie.go
+++ b/pkg/coredata/cookie.go
@@ -297,6 +297,59 @@ INSERT INTO cookies (
 	return nil
 }
 
+func (c *Cookie) InsertIfNotExists(
+	ctx context.Context,
+	tx pg.Tx,
+	scope Scoper,
+) (bool, error) {
+	q := `
+INSERT INTO cookies (
+	id,
+	tenant_id,
+	organization_id,
+	cookie_banner_id,
+	cookie_category_id,
+	name,
+	duration,
+	description,
+	created_at,
+	updated_at
+) VALUES (
+	@id,
+	@tenant_id,
+	@organization_id,
+	@cookie_banner_id,
+	@cookie_category_id,
+	@name,
+	@duration,
+	@description,
+	@created_at,
+	@updated_at
+)
+ON CONFLICT (cookie_banner_id, name) DO NOTHING
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":                 c.ID,
+		"tenant_id":          scope.GetTenantID(),
+		"organization_id":    c.OrganizationID,
+		"cookie_banner_id":   c.CookieBannerID,
+		"cookie_category_id": c.CookieCategoryID,
+		"name":               c.Name,
+		"duration":           c.Duration,
+		"description":        c.Description,
+		"created_at":         c.CreatedAt,
+		"updated_at":         c.UpdatedAt,
+	}
+
+	result, err := tx.Exec(ctx, q, args)
+	if err != nil {
+		return false, fmt.Errorf("cannot insert cookie: %w", err)
+	}
+
+	return result.RowsAffected() > 0, nil
+}
+
 func (c *Cookie) Update(
 	ctx context.Context,
 	tx pg.Tx,
diff --git a/pkg/coredata/cookie_category.go b/pkg/coredata/cookie_category.go
index 6d55b1c92..b495e1896 100644
--- a/pkg/coredata/cookie_category.go
+++ b/pkg/coredata/cookie_category.go
@@ -469,6 +469,39 @@ WHERE
 	return nil
 }
 
+func (c *CookieCategories) ClearPostHogConsentByBannerID(
+	ctx context.Context,
+	tx pg.Tx,
+	scope Scoper,
+	cookieBannerID gid.GID,
+) error {
+	q := `
+UPDATE cookie_categories
+SET
+	posthog_consent = false,
+	updated_at = @updated_at
+WHERE
+	%s
+	AND cookie_banner_id = @cookie_banner_id
+	AND posthog_consent = true
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"cookie_banner_id": cookieBannerID,
+		"updated_at":       time.Now(),
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := tx.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot clear posthog consent: %w", err)
+	}
+
+	return nil
+}
+
 func (c *CookieCategory) LoadUncategorisedByCookieBannerID(
 	ctx context.Context,
 	conn pg.Querier,
diff --git a/pkg/coredata/migrations/20260424T122219Z.sql b/pkg/coredata/migrations/20260424T122219Z.sql
new file mode 100644
index 000000000..a3a8659c1
--- /dev/null
+++ b/pkg/coredata/migrations/20260424T122219Z.sql
@@ -0,0 +1,17 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+CREATE UNIQUE INDEX idx_cookie_categories_unique_posthog_per_banner
+  ON cookie_categories (cookie_banner_id)
+  WHERE posthog_consent = true;
diff --git a/pkg/server/api/console/v1/cookie_banner_resolvers.go b/pkg/server/api/console/v1/cookie_banner_resolvers.go
index 7f9cf5d27..5f638d510 100644
--- a/pkg/server/api/console/v1/cookie_banner_resolvers.go
+++ b/pkg/server/api/console/v1/cookie_banner_resolvers.go
@@ -482,6 +482,9 @@ func (r *mutationResolver) UpdateCookieCategory(ctx context.Context, input types
 		if errors.Is(err, cookiebanner.ErrCategorySlugAlreadyExists) {
 			return nil, gqlutils.Conflict(ctx, err)
 		}
+		if errors.Is(err, cookiebanner.ErrPostHogConsentKindInvalid) {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
 		if validationErrors, ok := errors.AsType[validator.ValidationErrors](err); ok {
 			return nil, gqlutils.InvalidValidationErrors(ctx, validationErrors)
 		}