cookiebanner: detect service workers and Cache Storage buckets

A registered service worker is a URL-shaped artifact (origin+path of
the worker script), so it goes in tracker_resources as a new
SERVICE_WORKER resource type. A Cache Storage bucket is an opaque
named string with no URL, so it goes in detected_trackers as a new
CACHE_STORAGE tracker type.

Frontend:
  - StorageDetector wraps caches.open() and enumerates caches.keys()
    on start to surface pre-existing buckets that pre-date the SDK
    load (service workers commonly populate caches eagerly on
    install).
  - ThirdPartyDetector wraps navigator.serviceWorker.register() and
    enumerates getRegistrations() on start.

Both wrappers degrade silently on insecure contexts where these APIs
are unavailable.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/coredata/migrations/20260511T064746Z.sql

@@ -0,0 +1,21 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+-- A registered service worker is a URL-shaped artifact, so it lives
+-- in tracker_resources alongside scripts/iframes.
+ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'SERVICE_WORKER';
+
+-- A Cache Storage bucket is just a named string identifier with no
+-- URL, so it lives in detected_trackers like the other storage types.
+ALTER TYPE tracker_type ADD VALUE IF NOT EXISTS 'CACHE_STORAGE';

pkg/coredata/tracker_resource_type.go

@@ -22,14 +22,15 @@ import (
 type TrackerResourceType string
 
 const (
-	TrackerResourceTypeScript     TrackerResourceType = "SCRIPT"
-	TrackerResourceTypeIframe     TrackerResourceType = "IFRAME"
-	TrackerResourceTypeImage      TrackerResourceType = "IMAGE"
-	TrackerResourceTypeStylesheet TrackerResourceType = "STYLESHEET"
-	TrackerResourceTypeFont       TrackerResourceType = "FONT"
-	TrackerResourceTypeBeacon     TrackerResourceType = "BEACON"
-	TrackerResourceTypeFetch      TrackerResourceType = "FETCH"
-	TrackerResourceTypeMedia      TrackerResourceType = "MEDIA"
+	TrackerResourceTypeScript        TrackerResourceType = "SCRIPT"
+	TrackerResourceTypeIframe        TrackerResourceType = "IFRAME"
+	TrackerResourceTypeImage         TrackerResourceType = "IMAGE"
+	TrackerResourceTypeStylesheet    TrackerResourceType = "STYLESHEET"
+	TrackerResourceTypeFont          TrackerResourceType = "FONT"
+	TrackerResourceTypeBeacon        TrackerResourceType = "BEACON"
+	TrackerResourceTypeFetch         TrackerResourceType = "FETCH"
+	TrackerResourceTypeMedia         TrackerResourceType = "MEDIA"
+	TrackerResourceTypeServiceWorker TrackerResourceType = "SERVICE_WORKER"
 )
 
 func TrackerResourceTypes() []TrackerResourceType {
@@ -42,6 +43,7 @@ func TrackerResourceTypes() []TrackerResourceType {
 		TrackerResourceTypeBeacon,
 		TrackerResourceTypeFetch,
 		TrackerResourceTypeMedia,
+		TrackerResourceTypeServiceWorker,
 	}
 }
 
@@ -77,6 +79,8 @@ func (s *TrackerResourceType) Scan(value any) error {
 		*s = TrackerResourceTypeFetch
 	case TrackerResourceTypeMedia:
 		*s = TrackerResourceTypeMedia
+	case TrackerResourceTypeServiceWorker:
+		*s = TrackerResourceTypeServiceWorker
 	default:
 		return fmt.Errorf("invalid TrackerResourceType value: %q", v)
 	}
@@ -92,7 +96,8 @@ func (s TrackerResourceType) Value() (driver.Value, error) {
 		TrackerResourceTypeFont,
 		TrackerResourceTypeBeacon,
 		TrackerResourceTypeFetch,
-		TrackerResourceTypeMedia:
+		TrackerResourceTypeMedia,
+		TrackerResourceTypeServiceWorker:
 		return string(s), nil
 	default:
 		return nil, fmt.Errorf("invalid TrackerResourceType: %s", s)

pkg/coredata/tracker_type.go

@@ -26,6 +26,7 @@ const (
 	TrackerTypeLocalStorage   TrackerType = "LOCAL_STORAGE"
 	TrackerTypeSessionStorage TrackerType = "SESSION_STORAGE"
 	TrackerTypeIndexedDB      TrackerType = "INDEXED_DB"
+	TrackerTypeCacheStorage   TrackerType = "CACHE_STORAGE"
 )
 
 func TrackerTypes() []TrackerType {
@@ -34,6 +35,7 @@ func TrackerTypes() []TrackerType {
 		TrackerTypeLocalStorage,
 		TrackerTypeSessionStorage,
 		TrackerTypeIndexedDB,
+		TrackerTypeCacheStorage,
 	}
 }
 
@@ -61,6 +63,8 @@ func (s *TrackerType) Scan(value any) error {
 		*s = TrackerTypeSessionStorage
 	case TrackerTypeIndexedDB:
 		*s = TrackerTypeIndexedDB
+	case TrackerTypeCacheStorage:
+		*s = TrackerTypeCacheStorage
 	default:
 		return fmt.Errorf("invalid TrackerType value: %q", v)
 	}
@@ -72,7 +76,8 @@ func (s TrackerType) Value() (driver.Value, error) {
 	case TrackerTypeCookie,
 		TrackerTypeLocalStorage,
 		TrackerTypeSessionStorage,
-		TrackerTypeIndexedDB:
+		TrackerTypeIndexedDB,
+		TrackerTypeCacheStorage:
 		return string(s), nil
 	default:
 		return nil, fmt.Errorf("invalid TrackerType: %s", s)