From d7eec08cd251762a37aeb85f3c6ed1e451a60561 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= Date: Fri, 24 Apr 2026 18:36:45 +0400 Subject: [PATCH] Add banner ID to probo_consent cookie MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Include a `bid` field in the consent cookie so it explicitly identifies which cookie banner it belongs to, making validation direct instead of relying on the visitor ID as an implicit discriminator. Existing cookies without `bid` self-heal on the next load by falling through to the API fetch. Signed-off-by: Émile Ré --- packages/cookie-banner/build.mjs | 6 ++++++ packages/cookie-banner/src/client.ts | 5 ++++- packages/cookie-banner/src/cookie.ts | 1 + packages/cookie-banner/src/globals.d.ts | 15 +++++++++++++++ pkg/cookiebanner/service.go | 4 ++++ pkg/coredata/cookie_consent_record.go | 6 ++++++ pkg/coredata/migrations/20260424T150000Z.sql | 16 ++++++++++++++++ pkg/server/api/cookiebanner/v1/handler.go | 2 ++ 8 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 packages/cookie-banner/src/globals.d.ts create mode 100644 pkg/coredata/migrations/20260424T150000Z.sql diff --git a/packages/cookie-banner/build.mjs b/packages/cookie-banner/build.mjs index 33de0acef..126e785e5 100644 --- a/packages/cookie-banner/build.mjs +++ b/packages/cookie-banner/build.mjs @@ -12,11 +12,17 @@ // OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR // PERFORMANCE OF THIS SOFTWARE. +import { readFileSync } from "node:fs"; import * as esbuild from "esbuild"; +const { version } = JSON.parse(readFileSync("./package.json", "utf-8")); + const shared = { bundle: true, target: "es2020", + define: { + __SDK_VERSION__: JSON.stringify(version), + }, }; await Promise.all([ diff --git a/packages/cookie-banner/src/client.ts b/packages/cookie-banner/src/client.ts index df1a9dfd4..1587f67b9 100644 --- a/packages/cookie-banner/src/client.ts +++ b/packages/cookie-banner/src/client.ts @@ -132,7 +132,7 @@ export class CookieBannerClient { this.startDetector(config); const cookie = getConsentCookie(); - if (cookie && cookie.v === config.version && cookie.vid === this.visitorId) { + if (cookie && cookie.bid === this.bannerId && cookie.v === config.version && cookie.vid === this.visitorId) { this.consent = { visitor_id: cookie.vid, version: cookie.v, @@ -164,6 +164,7 @@ export class CookieBannerClient { this._gpcApplied = apiConsent.action === "GPC"; setConsentCookie( { + bid: this.bannerId, v: apiConsent.version, vid: apiConsent.visitor_id, action: apiConsent.action, @@ -270,6 +271,7 @@ export class CookieBannerClient { setConsentCookie( { + bid: this.bannerId, v: cfg.version, vid: this.visitorId, action, @@ -286,6 +288,7 @@ export class CookieBannerClient { version: cfg.version, action, consent_data: consentData, + sdk_version: __SDK_VERSION__, }; void fetchJSON(url, { method: "POST", body }) .then(() => void flush(this.bannerId)) diff --git a/packages/cookie-banner/src/cookie.ts b/packages/cookie-banner/src/cookie.ts index 41c98f664..ac73fcdcc 100644 --- a/packages/cookie-banner/src/cookie.ts +++ b/packages/cookie-banner/src/cookie.ts @@ -18,6 +18,7 @@ export const COOKIE_NAME = "probo_consent"; const SECONDS_PER_DAY = 86400; export interface ConsentCookie { + bid: string; v: number; vid: string; action: ConsentAction; diff --git a/packages/cookie-banner/src/globals.d.ts b/packages/cookie-banner/src/globals.d.ts new file mode 100644 index 000000000..27e22eea3 --- /dev/null +++ b/packages/cookie-banner/src/globals.d.ts @@ -0,0 +1,15 @@ +// Copyright (c) 2026 Probo Inc . +// +// Permission to use, copy, modify, and/or distribute this software for any +// purpose with or without fee is hereby granted, provided that the above +// copyright notice and this permission notice appear in all copies. +// +// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH +// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, +// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR +// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +// PERFORMANCE OF THIS SOFTWARE. + +declare const __SDK_VERSION__: string; diff --git a/pkg/cookiebanner/service.go b/pkg/cookiebanner/service.go index 224d8382c..6641852c5 100644 --- a/pkg/cookiebanner/service.go +++ b/pkg/cookiebanner/service.go @@ -110,6 +110,7 @@ type ( UserAgent *string ConsentData json.RawMessage Action coredata.CookieConsentAction + SdkVersion string } RecordConsentRequest struct { @@ -119,6 +120,7 @@ type ( UserAgent *string ConsentData json.RawMessage Action coredata.CookieConsentAction + SdkVersion string } DetectedCookie struct { @@ -1675,6 +1677,7 @@ func (s *Service) CreateCookieConsentRecord( UserAgent: req.UserAgent, ConsentData: req.ConsentData, Action: req.Action, + SdkVersion: req.SdkVersion, CreatedAt: time.Now(), } @@ -2060,6 +2063,7 @@ func (s *Service) RecordConsent( UserAgent: req.UserAgent, ConsentData: req.ConsentData, Action: req.Action, + SdkVersion: req.SdkVersion, CreatedAt: time.Now(), } diff --git a/pkg/coredata/cookie_consent_record.go b/pkg/coredata/cookie_consent_record.go index 3a59bd485..998cd6233 100644 --- a/pkg/coredata/cookie_consent_record.go +++ b/pkg/coredata/cookie_consent_record.go @@ -39,6 +39,7 @@ type ( UserAgent *string `db:"user_agent"` ConsentData json.RawMessage `db:"consent_data"` Action CookieConsentAction `db:"action"` + SdkVersion string `db:"sdk_version"` CreatedAt time.Time `db:"created_at"` } @@ -77,6 +78,7 @@ SELECT user_agent, consent_data, action, + sdk_version, created_at FROM cookie_consent_records @@ -160,6 +162,7 @@ INSERT INTO cookie_consent_records ( user_agent, consent_data, action, + sdk_version, created_at ) VALUES ( @id, @@ -172,6 +175,7 @@ INSERT INTO cookie_consent_records ( @user_agent, @consent_data, @action, + @sdk_version, @created_at ) ` @@ -187,6 +191,7 @@ INSERT INTO cookie_consent_records ( "user_agent": r.UserAgent, "consent_data": r.ConsentData, "action": r.Action, + "sdk_version": r.SdkVersion, "created_at": r.CreatedAt, } @@ -216,6 +221,7 @@ SELECT user_agent, consent_data, action, + sdk_version, created_at FROM cookie_consent_records diff --git a/pkg/coredata/migrations/20260424T150000Z.sql b/pkg/coredata/migrations/20260424T150000Z.sql new file mode 100644 index 000000000..10db4c62f --- /dev/null +++ b/pkg/coredata/migrations/20260424T150000Z.sql @@ -0,0 +1,16 @@ +-- Copyright (c) 2026 Probo Inc . +-- +-- Permission to use, copy, modify, and/or distribute this software for any +-- purpose with or without fee is hereby granted, provided that the above +-- copyright notice and this permission notice appear in all copies. +-- +-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH +-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, +-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR +-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +-- PERFORMANCE OF THIS SOFTWARE. + +ALTER TABLE cookie_consent_records + ADD COLUMN sdk_version TEXT NOT NULL DEFAULT ''; diff --git a/pkg/server/api/cookiebanner/v1/handler.go b/pkg/server/api/cookiebanner/v1/handler.go index 312815a60..afc68f6f9 100644 --- a/pkg/server/api/cookiebanner/v1/handler.go +++ b/pkg/server/api/cookiebanner/v1/handler.go @@ -122,6 +122,7 @@ type ( Version int `json:"version"` Action coredata.CookieConsentAction `json:"action"` ConsentData json.RawMessage `json:"consent_data"` + SdkVersion string `json:"sdk_version"` } postConsentResponse struct { @@ -155,6 +156,7 @@ func (h *Handler) handlePostConsent(w http.ResponseWriter, r *http.Request) { UserAgent: &ua, ConsentData: body.ConsentData, Action: body.Action, + SdkVersion: body.SdkVersion, } record, err := h.cookieBannerSvc.RecordConsent(r.Context(), bannerID, req)