cookiebanner: detect service workers and Cache Storage buckets

A registered service worker is a URL-shaped artifact (origin+path of
the worker script), so it goes in tracker_resources as a new
SERVICE_WORKER resource type. A Cache Storage bucket is an opaque
named string with no URL, so it goes in detected_trackers as a new
CACHE_STORAGE tracker type.

Frontend:
  - StorageDetector wraps caches.open() and enumerates caches.keys()
    on start to surface pre-existing buckets that pre-date the SDK
    load (service workers commonly populate caches eagerly on
    install).
  - ThirdPartyDetector wraps navigator.serviceWorker.register() and
    enumerates getRegistrations() on start.

Both wrappers degrade silently on insecure contexts where these APIs
are unavailable.

Signed-off-by: Émile Ré <emile@getprobo.com>

packages/cookie-banner/src/detectors/storage-detector.ts

@@ -19,7 +19,11 @@ import { getInitiatorURL } from "./initiator";
 
 interface DetectedStorageEntry {
   key: string;
-  storage_type: "local_storage" | "session_storage" | "indexed_db";
+  storage_type:
+    | "local_storage"
+    | "session_storage"
+    | "indexed_db"
+    | "cache_storage";
   value_size: number | null;
   initiator_url?: string;
 }
@@ -42,6 +46,7 @@ export class StorageDetector implements Detector {
   private timer: ReturnType<typeof setTimeout> | null = null;
   private originalSetItem: typeof Storage.prototype.setItem | null = null;
   private originalIDBOpen: typeof IDBFactory.prototype.open | null = null;
+  private originalCachesOpen: typeof CacheStorage.prototype.open | null = null;
 
   constructor(baseUrl: URL, bannerId: string) {
     this.reportUrl = new URL(`${bannerId}/report`, baseUrl);
@@ -51,7 +56,9 @@ export class StorageDetector implements Detector {
   start(): void {
     this.wrapStorage();
     this.wrapIndexedDB();
+    this.wrapCacheStorage();
     this.scanExisting();
+    this.scanCacheStorage();
   }
 
   stop(): void {
@@ -72,6 +79,10 @@ export class StorageDetector implements Detector {
       IDBFactory.prototype.open = this.originalIDBOpen;
       this.originalIDBOpen = null;
     }
+    if (this.originalCachesOpen && typeof caches !== "undefined") {
+      caches.open = this.originalCachesOpen;
+      this.originalCachesOpen = null;
+    }
   }
 
   private wrapStorage(): void {
@@ -107,6 +118,20 @@ export class StorageDetector implements Detector {
     };
   }
 
+  private wrapCacheStorage(): void {
+    if (typeof caches === "undefined") return;
+
+    const originalOpen = caches.open.bind(caches);
+    this.originalCachesOpen = originalOpen;
+
+    const self = this;
+
+    caches.open = function (name: string): Promise<Cache> {
+      self.onCacheStorageOpen(name);
+      return originalOpen(name);
+    };
+  }
+
   private onStorageWrite(
     key: string,
     value: string,
@@ -143,6 +168,37 @@ export class StorageDetector implements Detector {
     this.scheduleFlush();
   }
 
+  private onCacheStorageOpen(name: string): void {
+    const reportKey = `cache_storage:${name}`;
+    if (this.reported.has(reportKey)) return;
+
+    this.reported.add(reportKey);
+    this.pending.set(reportKey, {
+      key: name,
+      storage_type: "cache_storage",
+      value_size: null,
+    });
+    this.scheduleFlush();
+  }
+
+  // scanCacheStorage enumerates pre-existing cache buckets created
+  // before the SDK loaded. Service workers commonly create their
+  // caches eagerly on `install`, so without this scan we would miss
+  // any cache bucket whose creation predates the banner script.
+  private scanCacheStorage(): void {
+    if (typeof caches === "undefined") return;
+    caches
+      .keys()
+      .then((names) => {
+        for (const name of names) {
+          this.onCacheStorageOpen(name);
+        }
+      })
+      .catch(() => {
+        // Insecure context or storage partition errors -- ignore.
+      });
+  }
+
   private scanExisting(): void {
     this.scanStorage(localStorage, "local_storage");
     this.scanStorage(sessionStorage, "session_storage");

packages/cookie-banner/src/detectors/third-party-detector.ts

@@ -24,7 +24,8 @@ type ResourceType =
   | "font"
   | "beacon"
   | "fetch"
-  | "media";
+  | "media"
+  | "service_worker";
 
 interface DetectedResourceEntry {
   url: string;
@@ -80,6 +81,7 @@ export class ThirdPartyDetector implements Detector {
   private timer: ReturnType<typeof setTimeout> | null = null;
   private observer: MutationObserver | null = null;
   private perfObserver: PerformanceObserver | null = null;
+  private originalSWRegister: typeof ServiceWorkerContainer.prototype.register | null = null;
 
   constructor(baseUrl: URL, bannerId: string) {
     this.reportUrl = new URL(`${bannerId}/report`, baseUrl);
@@ -91,6 +93,8 @@ export class ThirdPartyDetector implements Detector {
     this.scanExisting();
     this.observeMutations();
     this.observePerformance();
+    this.wrapServiceWorker();
+    this.scanServiceWorkers();
   }
 
   stop(): void {
@@ -112,6 +116,15 @@ export class ThirdPartyDetector implements Detector {
       this.perfObserver.disconnect();
       this.perfObserver = null;
     }
+
+    if (
+      this.originalSWRegister
+      && typeof navigator !== "undefined"
+      && navigator.serviceWorker
+    ) {
+      navigator.serviceWorker.register = this.originalSWRegister;
+      this.originalSWRegister = null;
+    }
   }
 
   private scanExisting(): void {
@@ -179,6 +192,50 @@ export class ThirdPartyDetector implements Detector {
     }
   }
 
+  // wrapServiceWorker intercepts navigator.serviceWorker.register so
+  // each registration -- even ones initiated by third-party SDKs --
+  // surfaces as a tracker_resource entry keyed on the worker script
+  // origin+path.
+  private wrapServiceWorker(): void {
+    if (typeof navigator === "undefined" || !navigator.serviceWorker) return;
+
+    const sw = navigator.serviceWorker;
+    const originalRegister = sw.register.bind(sw);
+    this.originalSWRegister = originalRegister;
+
+    const self = this;
+
+    sw.register = function (
+      scriptURL: string | URL,
+      options?: RegistrationOptions,
+    ): Promise<ServiceWorkerRegistration> {
+      const url = typeof scriptURL === "string" ? scriptURL : scriptURL.toString();
+      self.processResource(url, "service_worker");
+      return originalRegister(scriptURL, options);
+    };
+  }
+
+  // scanServiceWorkers enumerates registrations that pre-date the SDK
+  // (e.g. installed on a previous visit, restored from cache).
+  private scanServiceWorkers(): void {
+    if (typeof navigator === "undefined" || !navigator.serviceWorker) return;
+
+    navigator.serviceWorker
+      .getRegistrations()
+      .then((registrations) => {
+        for (const r of registrations) {
+          const url
+            = r.active?.scriptURL
+              ?? r.installing?.scriptURL
+              ?? r.waiting?.scriptURL;
+          if (url) this.processResource(url, "service_worker");
+        }
+      })
+      .catch(() => {
+        // Some browsers throw NotSupportedError in insecure contexts.
+      });
+  }
+
   private processResource(src: string, resourceType: ResourceType): void {
     if (EXTENSION_URL_RE.test(src)) return;