fix(consent): drop oc_ storage-key branding and resolve aliased ConsentGate imports (#161) - #175
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 8 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe PR changes default consent storage from ChangesConsent storage-key migration
ConsentGate scanner detection
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Caller
participant CookieAdapter
participant BrowserOrCallback
Caller->>CookieAdapter: getSetCookieHeaders(null)
CookieAdapter->>CookieAdapter: create canonical and legacy expiration headers
CookieAdapter->>BrowserOrCallback: emit all Set-Cookie headers
sequenceDiagram
participant visit.report
participant isGated
participant ParsedImports
visit.report->>isGated: pass JSX parents and parsed imports
isGated->>ParsedImports: resolve ConsentGate bindings
ParsedImports-->>isGated: return import metadata
isGated-->>visit.report: classify the hit
Possibly related issues
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/core/src/consent/storage/local-storage.ts`:
- Around line 45-63: Update readKey so an empty result from ls.getItem(name)
falls through to memory.get(name), while preserving the existing fallback when
getStorage() is unavailable or localStorage access throws. Ensure stored values
written to memory after writeRaw failure remain readable through read().
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: e9a7271a-27da-4d5b-ae10-70986779fe12
📒 Files selected for processing (11)
.changeset/ps-consent-storage-key.mdapps/web/content/docs/consent/core.mdapps/web/content/docs/consent/scanner.mdpackages/core/src/consent/storage/cookie.test.tspackages/core/src/consent/storage/cookie.tspackages/core/src/consent/storage/local-storage.test.tspackages/core/src/consent/storage/local-storage.tspackages/react/src/consent.ssr.test.tsxpackages/vite/src/consent/ungated.test.tspackages/vite/src/consent/ungated.tspackages/vite/src/consent/visit.ts
1 participant
Summary
Closes the two 1.1.0 audit leftovers in #161. The consent storage adapters still defaulted to the pre-rebrand OpenCookies key
oc_consent, and the Vite scanner only recognised a gate whose JSX element was literally namedConsentGate, soimport { ConsentGate as Gate }silently defeated gating detection and reported correctly-gated code as ungated (a build failure undermode: "error"). Both adapters now default tops_consentwhile still reading the old key, so no existing visitor is re-prompted, and the scanner resolves aliased and namespaced gate imports.Changes
localStorageAdapterandcookieAdapterdefault tops_consent(probe key__ps_probe__), with a read-only fallback tooc_consentthat is skipped when you pass your ownkey/name.clear()is the deliberate exception and removes both keys, otherwise the fallback would resurrect a decision the visitor just withdrew;subscribe()watches both keys but ignores a stale legacy event once the canonical key holds a value.cookieAdapter().getSetCookieHeaders(record)because the existing singulargetSetCookieHeaderreturns onestringand cannot expire two cookies, leavingoc_consentbehind on an SSR clear. The singular form is unchanged for compatibility. NotecookieAdapter().namenow returnsps_consent, so server code should read that property rather than hardcode the string.parser.tsalready builds intoisGated, so<Gate>and<PS.ConsentGate>resolving to a@policystack/*export now count as gates. Matching is purely additive: a bare<ConsentGate>with no import still gates, so local wrappers, barrel re-exports and auto-imports keep working and no previously-clean project starts failing.core.mdstorage-key section,scanner.mdgate contract) plus a minor changeset for@policystack/coreand@policystack/vite. 16 new tests cover the migration reads, bothclear()paths, cross-tab events on either key, and the alias/namespace/non-PolicyStack scanner cases.Verification
vp testis at 1024 passing, up from a 1008 baseline. The 28 failures insolid/svelteare pre-existing and reproduce identically on a cleanmain.vp lintandcheck-typesare clean across all 11 packages, and the scanner regression corpora (example-green,projects,real-world,plugin-fold) stay green.Not done: the manual browser re-prompt check on
apps/web. The migration paths are covered by unit tests instead, so a quick dogfood before merge would be worth it.Vue/Svelte gates live in SFC template markup the scanner never parses, and Angular's
ocConsentdirective sits outside the include glob, so aliasing is only fixable for the JSX frameworks. Left as-is.Summary by CodeRabbit
New Features
ps_consentby default.oc_consentdata remains readable and is cleared during migration.ConsentGateimports.Documentation
Bug Fixes