Bug 27378 - Enable compliance with EU Cookie Legislation via cookie consent
Summary: Enable compliance with EU Cookie Legislation via cookie consent
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Martin Renvoize
QA Contact: Testopia
URL:
Keywords: rel_22_11_candidate
Depends on: 22844
Blocks:
  Show dependency treegraph
 
Reported: 2021-01-11 11:46 UTC by Andrew Isherwood
Modified: 2022-06-07 14:58 UTC (History)
11 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Large patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 27378: Add new 'modaljs' syspref type (4.83 KB, patch)
2021-01-21 14:18 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add sysprefs (7.80 KB, patch)
2021-01-21 14:18 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add JS to power modaljs (15.89 KB, patch)
2021-01-21 14:19 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to OPAC (19.58 KB, patch)
2021-01-21 14:19 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to staff UI (12.54 KB, patch)
2021-01-21 14:19 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Move "Your cookies" to existing bar (4.00 KB, patch)
2021-01-25 12:19 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add new 'modaljs' syspref type (5.00 KB, patch)
2021-02-05 14:45 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add sysprefs (7.80 KB, patch)
2021-02-05 14:45 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add JS to power modaljs (15.89 KB, patch)
2021-02-05 14:45 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to OPAC (19.58 KB, patch)
2021-02-05 14:45 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to staff UI (12.54 KB, patch)
2021-02-05 14:45 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Move "Your cookies" to existing bar (4.00 KB, patch)
2021-02-05 14:45 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Delete cookies when consent removed (13.06 KB, patch)
2021-02-05 14:45 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add new 'modaljs' syspref type (5.00 KB, patch)
2021-02-05 16:24 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add sysprefs (7.80 KB, patch)
2021-02-05 16:24 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add JS to power modaljs (15.89 KB, patch)
2021-02-05 16:24 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to OPAC (19.58 KB, patch)
2021-02-05 16:24 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to staff UI (12.54 KB, patch)
2021-02-05 16:24 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Move "Your cookies" to existing bar (4.00 KB, patch)
2021-02-05 16:24 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Delete cookies when consent removed (13.06 KB, patch)
2021-02-05 16:24 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie domain and path (10.11 KB, patch)
2021-02-05 16:24 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add new 'modaljs' syspref type (5.00 KB, patch)
2021-02-18 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add sysprefs (7.80 KB, patch)
2021-02-18 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add JS to power modaljs (15.89 KB, patch)
2021-02-18 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to OPAC (19.58 KB, patch)
2021-02-18 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to staff UI (12.54 KB, patch)
2021-02-18 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Move "Your cookies" to existing bar (4.00 KB, patch)
2021-02-18 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Delete cookies when consent removed (13.06 KB, patch)
2021-02-18 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie domain and path (10.11 KB, patch)
2021-02-18 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Fix typo on cookie deletion expiry (1.32 KB, patch)
2021-02-18 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add new 'modaljs' syspref type (5.00 KB, patch)
2021-06-09 11:09 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add sysprefs (7.74 KB, patch)
2021-06-09 11:09 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add JS to power modaljs (15.89 KB, patch)
2021-06-09 11:10 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to OPAC (19.59 KB, patch)
2021-06-09 11:10 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to staff UI (12.54 KB, patch)
2021-06-09 11:10 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Move "Your cookies" to existing bar (4.00 KB, patch)
2021-06-09 11:10 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Delete cookies when consent removed (13.06 KB, patch)
2021-06-09 11:10 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie domain and path (10.10 KB, patch)
2021-06-09 11:10 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add new 'modaljs' syspref type (5.00 KB, patch)
2021-06-15 12:52 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add sysprefs (7.74 KB, patch)
2021-06-15 12:52 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add JS to power modaljs (15.89 KB, patch)
2021-06-15 12:52 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to OPAC (19.59 KB, patch)
2021-06-15 12:52 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to staff UI (12.54 KB, patch)
2021-06-15 12:53 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Move "Your cookies" to existing bar (4.00 KB, patch)
2021-06-15 12:53 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Delete cookies when consent removed (13.06 KB, patch)
2021-06-15 12:53 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie domain and path (10.10 KB, patch)
2021-06-15 12:53 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add new 'modaljs' syspref type (5.05 KB, patch)
2021-07-07 08:37 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add sysprefs (7.78 KB, patch)
2021-07-07 08:37 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add JS to power modaljs (15.94 KB, patch)
2021-07-07 08:37 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to OPAC (19.64 KB, patch)
2021-07-07 08:37 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to staff UI (12.58 KB, patch)
2021-07-07 08:37 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Move "Your cookies" to existing bar (4.05 KB, patch)
2021-07-07 08:37 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Delete cookies when consent removed (13.11 KB, patch)
2021-07-07 08:37 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add cookie domain and path (10.15 KB, patch)
2021-07-07 08:37 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add new 'modaljs' syspref type (5.05 KB, patch)
2021-09-17 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add sysprefs (7.78 KB, patch)
2021-09-17 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add JS to power modaljs (15.95 KB, patch)
2021-09-17 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to OPAC (19.93 KB, patch)
2021-09-17 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to staff UI (12.58 KB, patch)
2021-09-17 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Move "Your cookies" to existing bar (4.05 KB, patch)
2021-09-17 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Delete cookies when consent removed (13.11 KB, patch)
2021-09-17 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add cookie domain and path (10.15 KB, patch)
2021-09-17 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: (follow-up) Fix update delimiter (1.37 KB, patch)
2021-09-17 11:07 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 27378: Add new 'modaljs' syspref type (5.21 KB, patch)
2022-02-02 10:04 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add sysprefs (7.72 KB, patch)
2022-02-02 10:04 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add JS to power modaljs (15.94 KB, patch)
2022-02-02 10:04 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to OPAC (19.94 KB, patch)
2022-02-02 10:04 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to staff UI (12.58 KB, patch)
2022-02-02 10:04 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Move "Your cookies" to existing bar (4.05 KB, patch)
2022-02-02 10:04 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Delete cookies when consent removed (13.11 KB, patch)
2022-02-02 10:04 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add cookie domain and path (10.15 KB, patch)
2022-02-02 10:04 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: (follow-up) Fix update delimiter (1.37 KB, patch)
2022-02-02 10:04 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add new 'modaljs' syspref type (5.21 KB, patch)
2022-05-24 15:08 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add sysprefs (7.72 KB, patch)
2022-05-24 15:08 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add JS to power modaljs (15.92 KB, patch)
2022-05-24 15:08 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to OPAC (20.01 KB, patch)
2022-05-24 15:08 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add cookie consent display to staff UI (12.58 KB, patch)
2022-05-24 15:08 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Move "Your cookies" to existing bar (4.05 KB, patch)
2022-05-24 15:09 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Delete cookies when consent removed (13.11 KB, patch)
2022-05-24 15:09 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: Add cookie domain and path (10.15 KB, patch)
2022-05-24 15:09 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: (follow-up) Fix update delimiter (1.37 KB, patch)
2022-05-24 15:09 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27378: (follow-up) Add missing filters (4.36 KB, patch)
2022-05-24 15:09 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Isherwood 2021-01-11 11:46:03 UTC
This bug proposes to add the ability for a site to comply with EU Cookie Legislation if required, through the use of cookie consent.

Cookie use that requires consent involves the use of "non-essential" cookies. For the implementation of this bug, we are considering all cookies set by Koha itself to be "essential", and therefore not requiring consent. "Non-essential" cookies will potentially be anything else, for example, Google Analytics tracking.

This bug will provide the following:

- Allow an admin to define code that requires consent to run (e.g. code that results in a non-essential cookie being set). Along with a name & description for that code, and the ability to specify whether that code requires consent before running, both in the OPAC and staff interface.

- Allow a user to see exactly which cookies (essential & non-essential) may be set and which non-essential cookies they can consent to if they wish. The detail of the cookies in use is definable by a site admin.

- Allow a user to consent to any non-essential cookies.

- Allow a user to see which non-essential cookies they have consented to and, subsequently, remove consent if they wish.

- Prevent the running of any code that causes a non-essential cookie to be set unless the user has explicitly consented to it.
Comment 1 Andrew Isherwood 2021-01-21 14:18:56 UTC
Created attachment 115544 [details] [review]
Bug 27378: Add new 'modaljs' syspref type

This commit adds a new 'modaljs' syspref type. This is similar to the existing
'modalselect' syspref type but instead of using a file to create a list of
selectable options which are displayed in the modal, it assumes that anything
can happen within the modal driven by JS, and whatever happens is going to
return a string, that will be saved as the syspref value. In our case, the
string will be all the details of the “chunks” concatenated into a string
Comment 2 Andrew Isherwood 2021-01-21 14:18:59 UTC
Created attachment 115545 [details] [review]
Bug 27378: Add sysprefs

This commit adds 4 new sysprefs:

- CookieConsent - the master on/off for this functionality
- ConsentJS - The configuration for JS code that requires consent prior to running.
- CookieConsentBar: Allows the admin to specify the HTML that will be
displayed in the consent bar that appears at the bottom of the page
- CookieConsentPopup: Allows the admin to specify the HTML that will be
displayed in the cookie consent popup
Comment 3 Andrew Isherwood 2021-01-21 14:19:03 UTC
Created attachment 115546 [details] [review]
Bug 27378: Add JS to power modaljs

This commit adds the Javascript that provides the functionality within
the consentJS modaljs modal. It provides the ability to display the
current state of any consentJS values and to amend them, as well as add
new ones.

There is also some refactoring of the existing modalselect functions to
allow re-use of existing code between modalselect & modaljs. This
refactoring has been minimal and consists of abstracting functionality
into functions to allow more wide use.

Styles for the consentJS UI were also added.
Comment 4 Andrew Isherwood 2021-01-21 14:19:06 UTC
Created attachment 115547 [details] [review]
Bug 27378: Add cookie consent display to OPAC

This commit adds the display of the cookie consent bar and modal to the
OPAC.

- Adds a new JSConsents template plugin that enables a template to be
populated with the contents of the ConsentJS syspref in a prepared,
usable form
- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
- Adds the ability for both authenticated and unauthenticated users to
view and modify their consents either via "your consents" or a new
unobtrusive "Your cookies" button in the bottom right of the screen.
- Adds unit test for JSConsents.pm
Comment 5 Andrew Isherwood 2021-01-21 14:19:09 UTC
Created attachment 115548 [details] [review]
Bug 27378: Add cookie consent display to staff UI

This commit adds the display of the cookie consent bar and modal to the
staff interface:

- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
Comment 6 Andrew Isherwood 2021-01-21 14:19:24 UTC
TEST PLAN
---------

Note: As part of this test plan you will be required to remove a value from your browser's local storage store, we use this for storing a browser's cookie consent choice. To remove this value when instructed to do so, do the following:

Chrome / Edge
------
- Press F12
- Click the "Application" tab
- On the left, expand the "Local Storage" section
- Find the entry that corresponds with the URL of your Koha and click on it
- Find the entry in the list with a "Key" of "cookieConsent"
- Click on it and press "Delete" on your keyboard

Firefox
-------
- Press F12
- Click the "Storage" tab
- On the left, expand the "Local Storage" section
- Find the entry that corresponds with the URL of your Koha and click on it
- Find the entry in the list with a "Key" of "cookieConsent"
- Click on it and press "Delete" on your keyboard


1. Ensure you have a tab open on the intranet view and one open on the OPAC view
2. Search for "consent" in the sysprefs
=> TEST: Observe there are 4 new sysprefs:
  - "ConsentJS"
  - "CookieConsent"
  - "CookieConsentBar"
  - "CookieConsentPopup"
3. Change the value for the "CookieConsent" syspref to "Require"
4. Refresh the intranet page
=> TEST: In the intranet view, observe that a cookie consent bar appears at the bottom of the page with just a single "Accept all cookies" button
5. Refresh the OPAC page
=> TEST: In the OPAC view, observe that a cookie consent bar appears at the bottom of the page with just a single "Accept all cookies" button
6. Add some text to the "CookieConsentBar" syspref, this can be HTML if you wish
7. Refresh the intranet page
=> TEST: In the intranet view, observe that the cookie consent bar appears at the bottom of the page containing the text you specified
8. Refresh the OPAC page
=> TEST: In the OPAC view, observe that the cookie consent bar appears at the bottom of the page containing the text you specified
9. Add some text to the "CookieConsentPop" syspref, this can be HTML if you wish
10. Click the "ConsentJS" syspref input
11. Click the "Add new code" link
12. Enter a name and description, and check both checkboxes
13. Click the "Click to expand" link
14. Enter the following Javascript:
    (function() { console.log('Hello from my test'); })()
15. Repeat the process of entering new code by clicking "Add new code" 3 times, ensure that the message being logged is different every time, this will enable you to verify that each consented bit of code is running
16. Click "Save"
17. Refresh the intranet page
=> TEST: In the intranet view, observe that the cookie consent bar appears at the bottom of the page containing 3 buttons
18. Refresh the OPAC page
=> TEST: In the OPAC view, observe that the cookie consent bar appears at the bottom of the page containing 3 buttons
19. Click the "More information" button
=> TEST: Observe that a cookie consent popup is displayed listing the codes you added in the syspref, displaying the name,description and checkbox for each, allowing a code to be selected
20.- Select a code
=> TEST: Observe that "Accept selected non-essential cookies" is enabled
21. Deselect all codes
=> TEST: Observe that "Accept selected non-essential cookies" is disabled
22. Open the developer tools for your browser (usually F12) and ensure you are viewing the Javascript console
23. Click accept all cookies
=> TEST: In the Javascript console, observe that the messages in all the codes you added to the ConsentJS syspref are displayed
24. Navigate to any other pages in the OPAC
=> TEST: On each page load, in the Javascript console, observe that the messages in all the codes you added to the ConsentJS syspref are displayed
25. Remove the cookieConsent local storage (as detailed at the start)
26. Switch to the intranet view
27. Repeat steps 19-25 in the intranet view
28. Refresh the page
29. Click the "Accept all cookies" button on the cookie bar
=> TEST: In the Javascript console, observe that the messages in all the codes you added to the ConsentJS syspref are displayed
30. Remove the cookieConsent local storage (as detailed at the start)
31. Refresh the page
32. Click the "Accept only essential cookies" button on the cookie bar
=> TEST: In the Javascript console, observe that none of the messages in the codes you added to the ConsentJS syspref are displayed
33. Remove the cookieConsent local storage (as detailed at the start)
34. Refresh the page
35. Click the "More information" button on the cookie bar
36. Select two of the codes you defined in the ConsentJS syspref
37. Click the "Accept selected non-essential cookies" button
=> TEST: In the Javascript console, observe that only the messages from the selected codes you added to the ConsentJS syspref are displayed
38. Repeat steps 28-37 on the OPAC view
Comment 7 Jonathan Druart 2021-01-21 14:30:24 UTC
What about rejecting them? :)
Comment 8 Jonathan Druart 2021-01-21 14:34:25 UTC
(In reply to Jonathan Druart from comment #7)
> What about rejecting them? :)

Ok, it's the "Accept only essential cookies" button.
Comment 9 Andrew Isherwood 2021-01-21 15:24:08 UTC
I've just realised I've left a chunk off the test plan, so I'm setting this back to Assigned until I've added the missing bits
Comment 10 Andrew Isherwood 2021-01-21 15:29:17 UTC
TEST PLAN
---------

Note: As part of this test plan you will be required to remove a value from your browser's local storage store, we use this for storing a browser's cookie consent choice. To remove this value when instructed to do so, do the following:

Chrome / Edge
------
- Press F12
- Click the "Application" tab
- On the left, expand the "Local Storage" section
- Find the entry that corresponds with the URL of your Koha and click on it
- Find the entry in the list with a "Key" of "cookieConsent"
- Click on it and press "Delete" on your keyboard

Firefox
-------
- Press F12
- Click the "Storage" tab
- On the left, expand the "Local Storage" section
- Find the entry that corresponds with the URL of your Koha and click on it
- Find the entry in the list with a "Key" of "cookieConsent"
- Click on it and press "Delete" on your keyboard


1. Ensure you have a tab open on the intranet view and one open on the OPAC view, ensure you are logged in on both
2. Search for "consent" in the sysprefs
=> TEST: Observe there are 4 new sysprefs:
  - "ConsentJS"
  - "CookieConsent"
  - "CookieConsentBar"
  - "CookieConsentPopup"
3. Change the value for the "CookieConsent" syspref to "Require"
4. Refresh the intranet page
=> TEST: In the intranet view, observe that a cookie consent bar appears at the bottom of the page with just a single "Accept all cookies" button
5. Refresh the OPAC page
=> TEST: In the OPAC view, observe that a cookie consent bar appears at the bottom of the page with just a single "Accept all cookies" button
6. Add some text to the "CookieConsentBar" syspref, this can be HTML if you wish
7. Refresh the intranet page
=> TEST: In the intranet view, observe that the cookie consent bar appears at the bottom of the page containing the text you specified
8. Refresh the OPAC page
=> TEST: In the OPAC view, observe that the cookie consent bar appears at the bottom of the page containing the text you specified
9. Add some text to the "CookieConsentPop" syspref, this can be HTML if you wish
10. Click the "ConsentJS" syspref input
11. Click the "Add new code" link
12. Enter a name and description, and check both checkboxes
13. Click the "Click to expand" link
14. Enter the following Javascript:
    (function() { console.log('Hello from my test'); })()
15. Repeat the process of entering new code by clicking "Add new code" 3 times, ensure that the message being logged is different every time, this will enable you to verify that each consented bit of code is running
16. Click "Save"
17. Refresh the intranet page
=> TEST: In the intranet view, observe that the cookie consent bar appears at the bottom of the page containing 3 buttons
18. Refresh the OPAC page
=> TEST: In the OPAC view, observe that the cookie consent bar appears at the bottom of the page containing 3 buttons
19. Click the "More information" button
=> TEST: Observe that a cookie consent popup is displayed listing the codes you added in the syspref, displaying the name,description and checkbox for each, allowing a code to be selected
20.- Select a code
=> TEST: Observe that "Accept selected non-essential cookies" is enabled
21. Deselect all codes
=> TEST: Observe that "Accept selected non-essential cookies" is disabled
22. Open the developer tools for your browser (usually F12) and ensure you are viewing the Javascript console
23. Click accept all cookies
=> TEST: In the Javascript console, observe that the messages in all the codes you added to the ConsentJS syspref are displayed
24. Navigate to any other pages in the OPAC
=> TEST: On each page load, in the Javascript console, observe that the messages in all the codes you added to the ConsentJS syspref are displayed
25. Remove the cookieConsent local storage (as detailed at the start)
26. Switch to the intranet view
27. Repeat steps 19-25 in the intranet view
28. Refresh the page
29. Click the "Accept all cookies" button on the cookie bar
=> TEST: In the Javascript console, observe that the messages in all the codes you added to the ConsentJS syspref are displayed
30. Remove the cookieConsent local storage (as detailed at the start)
31. Refresh the page
32. Click the "Accept only essential cookies" button on the cookie bar
=> TEST: In the Javascript console, observe that none of the messages in the codes you added to the ConsentJS syspref are displayed
33. Remove the cookieConsent local storage (as detailed at the start)
34. Refresh the page
35. Click the "More information" button on the cookie bar
36. Select two of the codes you defined in the ConsentJS syspref
37. Click the "Accept selected non-essential cookies" button
=> TEST: In the Javascript console, observe that only the messages from the selected codes you added to the ConsentJS syspref are displayed
38. Repeat steps 28-37 on the OPAC view
39. In the OPAC view, go to the "Your account" page
=> TEST: Observe that the "your consents" option is available
40. Click on "your consents"
=> TEST: Observe that a "Cookie consents" section is displayed, with a button
41. Click the "View your cookie consents" button
=> TEST: Observe that the "Cookie consent" popup is displayed allowing you to modify your cookie consents
42. Consent to whichever cookies you wish
43. Log out of the OPAC
=> Observe that a small "Your cookies" button is displayed in the bottom right of the screen
44. Click the "Your cookies" button
=> TEST: Observe that the "Cookie consent" popup is displayed allowing you to modify your cookie consents
Comment 11 Andrew Isherwood 2021-01-25 12:19:29 UTC
Created attachment 115756 [details] [review]
Bug 27378: Move "Your cookies" to existing bar

The new "Your cookies" button that appeared at the bottom right when an
unauthenticated user had made their cookie consent selections wasn't
ideal.

It has now been moved to the top bar, next to "Lists", this feels like a
much more sensible place for it.
Comment 12 Andrew Isherwood 2021-01-25 12:20:49 UTC
TEST PLAN
---------

Note: As part of this test plan you will be required to remove a value from your browser's local storage store, we use this for storing a browser's cookie consent choice. To remove this value when instructed to do so, do the following:

Chrome / Edge
------
- Press F12
- Click the "Application" tab
- On the left, expand the "Local Storage" section
- Find the entry that corresponds with the URL of your Koha and click on it
- Find the entry in the list with a "Key" of "cookieConsent"
- Click on it and press "Delete" on your keyboard

Firefox
-------
- Press F12
- Click the "Storage" tab
- On the left, expand the "Local Storage" section
- Find the entry that corresponds with the URL of your Koha and click on it
- Find the entry in the list with a "Key" of "cookieConsent"
- Click on it and press "Delete" on your keyboard


1. Ensure you have a tab open on the intranet view and one open on the OPAC view, ensure you are logged in on both
2. Search for "consent" in the sysprefs
=> TEST: Observe there are 4 new sysprefs:
  - "ConsentJS"
  - "CookieConsent"
  - "CookieConsentBar"
  - "CookieConsentPopup"
3. Change the value for the "CookieConsent" syspref to "Require"
4. Refresh the intranet page
=> TEST: In the intranet view, observe that a cookie consent bar appears at the bottom of the page with just a single "Accept all cookies" button
5. Refresh the OPAC page
=> TEST: In the OPAC view, observe that a cookie consent bar appears at the bottom of the page with just a single "Accept all cookies" button
6. Add some text to the "CookieConsentBar" syspref, this can be HTML if you wish
7. Refresh the intranet page
=> TEST: In the intranet view, observe that the cookie consent bar appears at the bottom of the page containing the text you specified
8. Refresh the OPAC page
=> TEST: In the OPAC view, observe that the cookie consent bar appears at the bottom of the page containing the text you specified
9. Add some text to the "CookieConsentPop" syspref, this can be HTML if you wish
10. Click the "ConsentJS" syspref input
11. Click the "Add new code" link
12. Enter a name and description, and check both checkboxes
13. Click the "Click to expand" link
14. Enter the following Javascript:
    (function() { console.log('Hello from my test'); })()
15. Repeat the process of entering new code by clicking "Add new code" 3 times, ensure that the message being logged is different every time, this will enable you to verify that each consented bit of code is running
16. Click "Save"
17. Refresh the intranet page
=> TEST: In the intranet view, observe that the cookie consent bar appears at the bottom of the page containing 3 buttons
18. Refresh the OPAC page
=> TEST: In the OPAC view, observe that the cookie consent bar appears at the bottom of the page containing 3 buttons
19. Click the "More information" button
=> TEST: Observe that a cookie consent popup is displayed listing the codes you added in the syspref, displaying the name,description and checkbox for each, allowing a code to be selected
20.- Select a code
=> TEST: Observe that "Accept selected non-essential cookies" is enabled
21. Deselect all codes
=> TEST: Observe that "Accept selected non-essential cookies" is disabled
22. Open the developer tools for your browser (usually F12) and ensure you are viewing the Javascript console
23. Click accept all cookies
=> TEST: In the Javascript console, observe that the messages in all the codes you added to the ConsentJS syspref are displayed
24. Navigate to any other pages in the OPAC
=> TEST: On each page load, in the Javascript console, observe that the messages in all the codes you added to the ConsentJS syspref are displayed
25. Remove the cookieConsent local storage (as detailed at the start)
26. Switch to the intranet view
27. Repeat steps 19-25 in the intranet view
28. Refresh the page
29. Click the "Accept all cookies" button on the cookie bar
=> TEST: In the Javascript console, observe that the messages in all the codes you added to the ConsentJS syspref are displayed
30. Remove the cookieConsent local storage (as detailed at the start)
31. Refresh the page
32. Click the "Accept only essential cookies" button on the cookie bar
=> TEST: In the Javascript console, observe that none of the messages in the codes you added to the ConsentJS syspref are displayed
33. Remove the cookieConsent local storage (as detailed at the start)
34. Refresh the page
35. Click the "More information" button on the cookie bar
36. Select two of the codes you defined in the ConsentJS syspref
37. Click the "Accept selected non-essential cookies" button
=> TEST: In the Javascript console, observe that only the messages from the selected codes you added to the ConsentJS syspref are displayed
38. Repeat steps 28-37 on the OPAC view
39. In the OPAC view, go to the "Your account" page
=> TEST: Observe that the "your consents" option is available
40. Click on "your consents"
=> TEST: Observe that a "Cookie consents" section is displayed, with a button
41. Click the "View your cookie consents" button
=> TEST: Observe that the "Cookie consent" popup is displayed allowing you to modify your cookie consents
42. Consent to whichever cookies you wish
43. Log out of the OPAC
=> Observe that a "Your cookies" button is displayed in the top bar next to "Links"
44. Click the "Your cookies" button
=> TEST: Observe that the "Cookie consent" popup is displayed allowing you to modify your cookie consents
Comment 13 Andrew Isherwood 2021-02-05 14:45:09 UTC
Created attachment 116397 [details] [review]
Bug 27378: Add new 'modaljs' syspref type

This commit adds a new 'modaljs' syspref type. This is similar to the existing
'modalselect' syspref type but instead of using a file to create a list of
selectable options which are displayed in the modal, it assumes that anything
can happen within the modal driven by JS, and whatever happens is going to
return a string, that will be saved as the syspref value. In our case, the
string will be all the details of the “chunks” concatenated into a string
Comment 14 Andrew Isherwood 2021-02-05 14:45:12 UTC
Created attachment 116398 [details] [review]
Bug 27378: Add sysprefs

This commit adds 4 new sysprefs:

- CookieConsent - the master on/off for this functionality
- ConsentJS - The configuration for JS code that requires consent prior to running.
- CookieConsentBar: Allows the admin to specify the HTML that will be
displayed in the consent bar that appears at the bottom of the page
- CookieConsentPopup: Allows the admin to specify the HTML that will be
displayed in the cookie consent popup
Comment 15 Andrew Isherwood 2021-02-05 14:45:15 UTC
Created attachment 116399 [details] [review]
Bug 27378: Add JS to power modaljs

This commit adds the Javascript that provides the functionality within
the consentJS modaljs modal. It provides the ability to display the
current state of any consentJS values and to amend them, as well as add
new ones.

There is also some refactoring of the existing modalselect functions to
allow re-use of existing code between modalselect & modaljs. This
refactoring has been minimal and consists of abstracting functionality
into functions to allow more wide use.

Styles for the consentJS UI were also added.
Comment 16 Andrew Isherwood 2021-02-05 14:45:18 UTC
Created attachment 116400 [details] [review]
Bug 27378: Add cookie consent display to OPAC

This commit adds the display of the cookie consent bar and modal to the
OPAC.

- Adds a new JSConsents template plugin that enables a template to be
populated with the contents of the ConsentJS syspref in a prepared,
usable form
- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
- Adds the ability for both authenticated and unauthenticated users to
view and modify their consents either via "your consents" or a new
unobtrusive "Your cookies" button in the bottom right of the screen.
- Adds unit test for JSConsents.pm
Comment 17 Andrew Isherwood 2021-02-05 14:45:22 UTC
Created attachment 116401 [details] [review]
Bug 27378: Add cookie consent display to staff UI

This commit adds the display of the cookie consent bar and modal to the
staff interface:

- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
Comment 18 Andrew Isherwood 2021-02-05 14:45:25 UTC
Created attachment 116402 [details] [review]
Bug 27378: Move "Your cookies" to existing bar

The new "Your cookies" button that appeared at the bottom right when an
unauthenticated user had made their cookie consent selections wasn't
ideal.

It has now been moved to the top bar, next to "Lists", this feels like a
much more sensible place for it.
Comment 19 Andrew Isherwood 2021-02-05 14:45:28 UTC
Created attachment 116403 [details] [review]
Bug 27378: Delete cookies when consent removed

We have provided the ability for a user to remove previously granted
consent, but we were not removing the cookie associated with that
consent. This was a complete oversight on my part.

I've introduced an additional bit of metadata for each "consent" defined
in the ConsentJS syspref, this allows the admin defining a "consent" to
specify a string (which is treated as a regex) that allows us to
identify a cookie name associated with that consent. So, for example, if
Google Analytics was being added, an identifying string might be '_ga'.
This allows us to subsequently remove a cookie that a previously
granted consent has set.

This commit also adds some missing 'html' filters in
koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc and
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc
Comment 20 Andrew Isherwood 2021-02-05 14:57:27 UTC
REVISED TEST PLAN
-----------------

Note: As part of this test plan you will be required to remove a value from your browser's local storage store, we use this for storing a browser's cookie consent choice. To remove this value when instructed to do so, do the following:

Chrome / Edge
------
- Press F12
- Click the "Application" tab
- On the left, expand the "Local Storage" section
- Find the entry that corresponds with the URL of your Koha and click on it
- Find the entry in the list with a "Key" of "cookieConsent"
- Click on it and press "Delete" on your keyboard

Firefox
-------
- Press F12
- Click the "Storage" tab
- On the left, expand the "Local Storage" section
- Find the entry that corresponds with the URL of your Koha and click on it
- Find the entry in the list with a "Key" of "cookieConsent"
- Click on it and press "Delete" on your keyboard

Note: Also you will be required to inspect cookies set in your browser. When instructed to do so, do the following:

Chrome / Edge
------
- Press F12
- Click the "Application" tab
- On the left, expand the "Cookies" section
- Find the entry that corresponds with the URL of your Koha and click on it
- View the list of cookies

Firefox
-------
- Press F12
- Click the "Storage" tab
- On the left, expand the "Cookies" section
- Find the entry that corresponds with the URL of your Koha and click on it
- View the list of cookies


1. Ensure you have a tab open on the intranet view and one open on the OPAC view, ensure you are logged in on both
2. Search for "consent" in the sysprefs
=> TEST: Observe there are 4 new sysprefs:
  - "ConsentJS"
  - "CookieConsent"
  - "CookieConsentBar"
  - "CookieConsentPopup"
3. Change the value for the "CookieConsent" syspref to "Require"
4. Refresh the intranet page
=> TEST: In the intranet view, observe that a cookie consent bar appears at the bottom of the page with just a single "Accept all cookies" button
5. Refresh the OPAC page
=> TEST: In the OPAC view, observe that a cookie consent bar appears at the bottom of the page with just a single "Accept all cookies" button
6. Add some text to the "CookieConsentBar" syspref, this can be HTML if you wish
7. Refresh the intranet page
=> TEST: In the intranet view, observe that the cookie consent bar appears at the bottom of the page containing the text you specified
8. Refresh the OPAC page
=> TEST: In the OPAC view, observe that the cookie consent bar appears at the bottom of the page containing the text you specified
9. Add some text to the "CookieConsentPop" syspref, this can be HTML if you wish
10. Click the "ConsentJS" syspref input
11. Click the "Add new code" link
12. Enter a name and description, and check both checkboxes. For "String used to identify cookie name", enter "test1", this enables us to delete the cookie when consent is withdrawn.
13. Click the "Click to expand" link
14. Enter the following Javascript:
    (function() { console.log('Hello from test1'); document.cookie = 'test1=testing'; })()
15. Repeat steps 11 to 14 twice more, substituting "test1" for "test2" & "test3"
16. Click "Save"
17. Refresh the intranet page
=> TEST: In the intranet view, observe that the cookie consent bar appears at the bottom of the page containing 3 buttons
18. Refresh the OPAC page
=> TEST: In the OPAC view, observe that the cookie consent bar appears at the bottom of the page containing 3 buttons
19. Click the "More information" button
=> TEST: Observe that a cookie consent popup is displayed listing the codes you added in the syspref, displaying the name,description and checkbox for each, allowing a code to be selected
20.- Select a code
=> TEST: Observe that "Accept selected non-essential cookies" is enabled
21. Deselect all codes
=> TEST: Observe that "Accept selected non-essential cookies" is disabled
22. Open the developer tools for your browser (usually F12) and ensure you are viewing the Javascript console
23. Click accept all cookies
=> TEST: In the Javascript console, observe that the messages in all the codes you added to the ConsentJS syspref are displayed
=> TEST: In the cookie list (as detailed at the top of the test plan) observe that the cookies corresponding with the consents granted have been set.
24. Navigate to any other pages in the OPAC
=> TEST: On each page load, in the Javascript console, observe that the messages in all the codes you added to the ConsentJS syspref are displayed
25. Remove the cookieConsent local storage (as detailed at the start)
26. Switch to the intranet view
27. Repeat steps 19-25 in the intranet view
28. Refresh the page
29. Click the "Accept all cookies" button on the cookie bar
=> TEST: In the Javascript console, observe that the messages in all the codes you added to the ConsentJS syspref are displayed
30. Remove the cookieConsent local storage (as detailed at the start)
31. Refresh the page
32. Click the "Accept only essential cookies" button on the cookie bar
=> TEST: In the Javascript console, observe that none of the messages in the codes you added to the ConsentJS syspref are displayed
33. Remove the cookieConsent local storage (as detailed at the start)
34. Refresh the page
35. Click the "More information" button on the cookie bar
36. Select two of the codes you defined in the ConsentJS syspref
37. Click the "Accept selected non-essential cookies" button
=> TEST: In the Javascript console, observe that only the messages from the selected codes you added to the ConsentJS syspref are displayed
38. Repeat steps 28-37 on the OPAC view
39. In the OPAC view, go to the "Your account" page
=> TEST: Observe that the "your consents" option is available
40. Click on "your consents"
=> TEST: Observe that a "Cookie consents" section is displayed, with a button
41. Click the "View your cookie consents" button
=> TEST: Observe that the "Cookie consent" popup is displayed allowing you to modify your cookie consents
42. Remove consent from at least one cookie, click Save
=> TEST: In the cookie list in your browser (as detailed at the top of the test plan), observe that any cookies you removed consent from have either been removed or have no value.
43. Log out of the OPAC
=> Observe that a "Your cookies" button is displayed in the top bar next to "Links"
44. Click the "Your cookies" button
=> TEST: Observe that the "Cookie consent" popup is displayed allowing you to modify your cookie consents
Comment 21 Andrew Isherwood 2021-02-05 16:24:27 UTC
Created attachment 116416 [details] [review]
Bug 27378: Add new 'modaljs' syspref type

This commit adds a new 'modaljs' syspref type. This is similar to the existing
'modalselect' syspref type but instead of using a file to create a list of
selectable options which are displayed in the modal, it assumes that anything
can happen within the modal driven by JS, and whatever happens is going to
return a string, that will be saved as the syspref value. In our case, the
string will be all the details of the “chunks” concatenated into a string
Comment 22 Andrew Isherwood 2021-02-05 16:24:31 UTC
Created attachment 116417 [details] [review]
Bug 27378: Add sysprefs

This commit adds 4 new sysprefs:

- CookieConsent - the master on/off for this functionality
- ConsentJS - The configuration for JS code that requires consent prior to running.
- CookieConsentBar: Allows the admin to specify the HTML that will be
displayed in the consent bar that appears at the bottom of the page
- CookieConsentPopup: Allows the admin to specify the HTML that will be
displayed in the cookie consent popup
Comment 23 Andrew Isherwood 2021-02-05 16:24:34 UTC
Created attachment 116418 [details] [review]
Bug 27378: Add JS to power modaljs

This commit adds the Javascript that provides the functionality within
the consentJS modaljs modal. It provides the ability to display the
current state of any consentJS values and to amend them, as well as add
new ones.

There is also some refactoring of the existing modalselect functions to
allow re-use of existing code between modalselect & modaljs. This
refactoring has been minimal and consists of abstracting functionality
into functions to allow more wide use.

Styles for the consentJS UI were also added.
Comment 24 Andrew Isherwood 2021-02-05 16:24:38 UTC
Created attachment 116419 [details] [review]
Bug 27378: Add cookie consent display to OPAC

This commit adds the display of the cookie consent bar and modal to the
OPAC.

- Adds a new JSConsents template plugin that enables a template to be
populated with the contents of the ConsentJS syspref in a prepared,
usable form
- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
- Adds the ability for both authenticated and unauthenticated users to
view and modify their consents either via "your consents" or a new
unobtrusive "Your cookies" button in the bottom right of the screen.
- Adds unit test for JSConsents.pm
Comment 25 Andrew Isherwood 2021-02-05 16:24:41 UTC
Created attachment 116420 [details] [review]
Bug 27378: Add cookie consent display to staff UI

This commit adds the display of the cookie consent bar and modal to the
staff interface:

- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
Comment 26 Andrew Isherwood 2021-02-05 16:24:44 UTC
Created attachment 116421 [details] [review]
Bug 27378: Move "Your cookies" to existing bar

The new "Your cookies" button that appeared at the bottom right when an
unauthenticated user had made their cookie consent selections wasn't
ideal.

It has now been moved to the top bar, next to "Lists", this feels like a
much more sensible place for it.
Comment 27 Andrew Isherwood 2021-02-05 16:24:47 UTC
Created attachment 116422 [details] [review]
Bug 27378: Delete cookies when consent removed

We have provided the ability for a user to remove previously granted
consent, but we were not removing the cookie associated with that
consent. This was a complete oversight on my part.

I've introduced an additional bit of metadata for each "consent" defined
in the ConsentJS syspref, this allows the admin defining a "consent" to
specify a string (which is treated as a regex) that allows us to
identify a cookie name associated with that consent. So, for example, if
Google Analytics was being added, an identifying string might be '_ga'.
This allows us to subsequently remove a cookie that a previously
granted consent has set.

This commit also adds some missing 'html' filters in
koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc and
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc
Comment 28 Andrew Isherwood 2021-02-05 16:24:51 UTC
Created attachment 116423 [details] [review]
Bug 27378: Add cookie domain and path

A subtlety I missed was that some tracking services, such as Google
Analytics, specify a cookie domain and path that differ from the
default. E.g. on a site with a domain of demostaff.koha-ptfs.co.uk, the
GA cookie will have a domain of '.koha-ptfs.co.uk' and a path of '/',
even though the cookie may have been set at a different path.

Both of these things makes sense, but of course unless we also specify
both of those things when we try to delete a previously set cookie, we
cannot.

Therefore, I have added two more bits of metadata to each "consent",
Cookie Domain and Cookie Path. It is necessary for an admin creating a
"consent" entry to know and specify these values. They can be
established by looking a cookie set by the service being configured.

This adds more complexity to setting up a consent, but we cannot remove
previously set cookies without it.
Comment 29 Andrew Isherwood 2021-02-05 16:26:27 UTC
REVISED TEST PLAN
-----------------

Note: As part of this test plan you will be required to remove a value from your browser's local storage store, we use this for storing a browser's cookie consent choice. To remove this value when instructed to do so, do the following:

Chrome / Edge
------
- Press F12
- Click the "Application" tab
- On the left, expand the "Local Storage" section
- Find the entry that corresponds with the URL of your Koha and click on it
- Find the entry in the list with a "Key" of "cookieConsent"
- Click on it and press "Delete" on your keyboard

Firefox
-------
- Press F12
- Click the "Storage" tab
- On the left, expand the "Local Storage" section
- Find the entry that corresponds with the URL of your Koha and click on it
- Find the entry in the list with a "Key" of "cookieConsent"
- Click on it and press "Delete" on your keyboard

Note: Also you will be required to inspect cookies set in your browser. When instructed to do so, do the following:

Chrome / Edge
------
- Press F12
- Click the "Application" tab
- On the left, expand the "Cookies" section
- Find the entry that corresponds with the URL of your Koha and click on it
- View the list of cookies

Firefox
-------
- Press F12
- Click the "Storage" tab
- On the left, expand the "Cookies" section
- Find the entry that corresponds with the URL of your Koha and click on it
- View the list of cookies


1. Ensure you have a tab open on the intranet view and one open on the OPAC view, ensure you are logged in on both
2. Search for "consent" in the sysprefs
=> TEST: Observe there are 4 new sysprefs:
  - "ConsentJS"
  - "CookieConsent"
  - "CookieConsentBar"
  - "CookieConsentPopup"
3. Change the value for the "CookieConsent" syspref to "Require"
4. Refresh the intranet page
=> TEST: In the intranet view, observe that a cookie consent bar appears at the bottom of the page with just a single "Accept all cookies" button
5. Refresh the OPAC page
=> TEST: In the OPAC view, observe that a cookie consent bar appears at the bottom of the page with just a single "Accept all cookies" button
6. Add some text to the "CookieConsentBar" syspref, this can be HTML if you wish
7. Refresh the intranet page
=> TEST: In the intranet view, observe that the cookie consent bar appears at the bottom of the page containing the text you specified
8. Refresh the OPAC page
=> TEST: In the OPAC view, observe that the cookie consent bar appears at the bottom of the page containing the text you specified
9. Add some text to the "CookieConsentPop" syspref, this can be HTML if you wish
10. Click the "ConsentJS" syspref input
11. Click the "Add new code" link
12. Enter a name and description, and check both checkboxes.
    - For "String used to identify cookie name", enter "test1", this enables us to delete the cookie when consent is withdrawn.
    - For "Cookie domain" enter the domain of your Koha.
    - For "Cookie path" enter "/"
13. Click the "Click to expand" link
14. Enter the following Javascript:
    (function() { console.log('Hello from test1'); document.cookie = 'test1=testing; domain=<the_domain_of_your_koha>; path=/'; })()
15. Repeat steps 11 to 14 twice more, substituting "test1" for "test2" & "test3"
16. Click "Save"
17. Refresh the intranet page
=> TEST: In the intranet view, observe that the cookie consent bar appears at the bottom of the page containing 3 buttons
18. Refresh the OPAC page
=> TEST: In the OPAC view, observe that the cookie consent bar appears at the bottom of the page containing 3 buttons
19. Click the "More information" button
=> TEST: Observe that a cookie consent popup is displayed listing the codes you added in the syspref, displaying the name,description and checkbox for each, allowing a code to be selected
20.- Select a code
=> TEST: Observe that "Accept selected non-essential cookies" is enabled
21. Deselect all codes
=> TEST: Observe that "Accept selected non-essential cookies" is disabled
22. Open the developer tools for your browser (usually F12) and ensure you are viewing the Javascript console
23. Click accept all cookies
=> TEST: In the Javascript console, observe that the messages in all the codes you added to the ConsentJS syspref are displayed
=> TEST: In the cookie list (as detailed at the top of the test plan) observe that the cookies corresponding with the consents granted have been set.
24. Navigate to any other pages in the OPAC
=> TEST: On each page load, in the Javascript console, observe that the messages in all the codes you added to the ConsentJS syspref are displayed
25. Remove the cookieConsent local storage (as detailed at the start)
26. Switch to the intranet view
27. Repeat steps 19-25 in the intranet view
28. Refresh the page
29. Click the "Accept all cookies" button on the cookie bar
=> TEST: In the Javascript console, observe that the messages in all the codes you added to the ConsentJS syspref are displayed
30. Remove the cookieConsent local storage (as detailed at the start)
31. Refresh the page
32. Click the "Accept only essential cookies" button on the cookie bar
=> TEST: In the Javascript console, observe that none of the messages in the codes you added to the ConsentJS syspref are displayed
33. Remove the cookieConsent local storage (as detailed at the start)
34. Refresh the page
35. Click the "More information" button on the cookie bar
36. Select two of the codes you defined in the ConsentJS syspref
37. Click the "Accept selected non-essential cookies" button
=> TEST: In the Javascript console, observe that only the messages from the selected codes you added to the ConsentJS syspref are displayed
38. Repeat steps 28-37 on the OPAC view
39. In the OPAC view, go to the "Your account" page
=> TEST: Observe that the "your consents" option is available
40. Click on "your consents"
=> TEST: Observe that a "Cookie consents" section is displayed, with a button
41. Click the "View your cookie consents" button
=> TEST: Observe that the "Cookie consent" popup is displayed allowing you to modify your cookie consents
42. Remove consent from at least one cookie, click Save
=> TEST: In the cookie list in your browser (as detailed at the top of the test plan), observe that any cookies you removed consent from have either been removed or have no value.
43. Log out of the OPAC
=> Observe that a "Your cookies" button is displayed in the top bar next to "Links"
44. Click the "Your cookies" button
=> TEST: Observe that the "Cookie consent" popup is displayed allowing you to modify your cookie consents
Comment 30 Andrew Isherwood 2021-02-18 11:07:14 UTC
Created attachment 116978 [details] [review]
Bug 27378: Add new 'modaljs' syspref type

This commit adds a new 'modaljs' syspref type. This is similar to the existing
'modalselect' syspref type but instead of using a file to create a list of
selectable options which are displayed in the modal, it assumes that anything
can happen within the modal driven by JS, and whatever happens is going to
return a string, that will be saved as the syspref value. In our case, the
string will be all the details of the “chunks” concatenated into a string
Comment 31 Andrew Isherwood 2021-02-18 11:07:17 UTC
Created attachment 116979 [details] [review]
Bug 27378: Add sysprefs

This commit adds 4 new sysprefs:

- CookieConsent - the master on/off for this functionality
- ConsentJS - The configuration for JS code that requires consent prior to running.
- CookieConsentBar: Allows the admin to specify the HTML that will be
displayed in the consent bar that appears at the bottom of the page
- CookieConsentPopup: Allows the admin to specify the HTML that will be
displayed in the cookie consent popup
Comment 32 Andrew Isherwood 2021-02-18 11:07:21 UTC
Created attachment 116980 [details] [review]
Bug 27378: Add JS to power modaljs

This commit adds the Javascript that provides the functionality within
the consentJS modaljs modal. It provides the ability to display the
current state of any consentJS values and to amend them, as well as add
new ones.

There is also some refactoring of the existing modalselect functions to
allow re-use of existing code between modalselect & modaljs. This
refactoring has been minimal and consists of abstracting functionality
into functions to allow more wide use.

Styles for the consentJS UI were also added.
Comment 33 Andrew Isherwood 2021-02-18 11:07:24 UTC
Created attachment 116981 [details] [review]
Bug 27378: Add cookie consent display to OPAC

This commit adds the display of the cookie consent bar and modal to the
OPAC.

- Adds a new JSConsents template plugin that enables a template to be
populated with the contents of the ConsentJS syspref in a prepared,
usable form
- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
- Adds the ability for both authenticated and unauthenticated users to
view and modify their consents either via "your consents" or a new
unobtrusive "Your cookies" button in the bottom right of the screen.
- Adds unit test for JSConsents.pm
Comment 34 Andrew Isherwood 2021-02-18 11:07:28 UTC
Created attachment 116982 [details] [review]
Bug 27378: Add cookie consent display to staff UI

This commit adds the display of the cookie consent bar and modal to the
staff interface:

- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
Comment 35 Andrew Isherwood 2021-02-18 11:07:31 UTC
Created attachment 116983 [details] [review]
Bug 27378: Move "Your cookies" to existing bar

The new "Your cookies" button that appeared at the bottom right when an
unauthenticated user had made their cookie consent selections wasn't
ideal.

It has now been moved to the top bar, next to "Lists", this feels like a
much more sensible place for it.
Comment 36 Andrew Isherwood 2021-02-18 11:07:35 UTC
Created attachment 116984 [details] [review]
Bug 27378: Delete cookies when consent removed

We have provided the ability for a user to remove previously granted
consent, but we were not removing the cookie associated with that
consent. This was a complete oversight on my part.

I've introduced an additional bit of metadata for each "consent" defined
in the ConsentJS syspref, this allows the admin defining a "consent" to
specify a string (which is treated as a regex) that allows us to
identify a cookie name associated with that consent. So, for example, if
Google Analytics was being added, an identifying string might be '_ga'.
This allows us to subsequently remove a cookie that a previously
granted consent has set.

This commit also adds some missing 'html' filters in
koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc and
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc
Comment 37 Andrew Isherwood 2021-02-18 11:07:38 UTC
Created attachment 116985 [details] [review]
Bug 27378: Add cookie domain and path

A subtlety I missed was that some tracking services, such as Google
Analytics, specify a cookie domain and path that differ from the
default. E.g. on a site with a domain of demostaff.koha-ptfs.co.uk, the
GA cookie will have a domain of '.koha-ptfs.co.uk' and a path of '/',
even though the cookie may have been set at a different path.

Both of these things makes sense, but of course unless we also specify
both of those things when we try to delete a previously set cookie, we
cannot.

Therefore, I have added two more bits of metadata to each "consent",
Cookie Domain and Cookie Path. It is necessary for an admin creating a
"consent" entry to know and specify these values. They can be
established by looking a cookie set by the service being configured.

This adds more complexity to setting up a consent, but we cannot remove
previously set cookies without it.
Comment 38 Andrew Isherwood 2021-02-18 11:07:41 UTC
Created attachment 116986 [details] [review]
Bug 27378: Fix typo on cookie deletion expiry

This commit fixes a typo in the expiry date of the "delete cookie"
setting. It was causing the cookie to be set to an empty value, rather
than being removed from the cookie store.
Comment 39 Andrew Isherwood 2021-06-09 11:09:55 UTC
Created attachment 121728 [details] [review]
Bug 27378: Add new 'modaljs' syspref type

This commit adds a new 'modaljs' syspref type. This is similar to the existing
'modalselect' syspref type but instead of using a file to create a list of
selectable options which are displayed in the modal, it assumes that anything
can happen within the modal driven by JS, and whatever happens is going to
return a string, that will be saved as the syspref value. In our case, the
string will be all the details of the “chunks” concatenated into a string
Comment 40 Andrew Isherwood 2021-06-09 11:09:59 UTC
Created attachment 121729 [details] [review]
Bug 27378: Add sysprefs

This commit adds 4 new sysprefs:

- CookieConsent - the master on/off for this functionality
- ConsentJS - The configuration for JS code that requires consent prior to running.
- CookieConsentBar: Allows the admin to specify the HTML that will be
displayed in the consent bar that appears at the bottom of the page
- CookieConsentPopup: Allows the admin to specify the HTML that will be
displayed in the cookie consent popup
Comment 41 Andrew Isherwood 2021-06-09 11:10:04 UTC
Created attachment 121730 [details] [review]
Bug 27378: Add JS to power modaljs

This commit adds the Javascript that provides the functionality within
the consentJS modaljs modal. It provides the ability to display the
current state of any consentJS values and to amend them, as well as add
new ones.

There is also some refactoring of the existing modalselect functions to
allow re-use of existing code between modalselect & modaljs. This
refactoring has been minimal and consists of abstracting functionality
into functions to allow more wide use.

Styles for the consentJS UI were also added.
Comment 42 Andrew Isherwood 2021-06-09 11:10:08 UTC
Created attachment 121731 [details] [review]
Bug 27378: Add cookie consent display to OPAC

This commit adds the display of the cookie consent bar and modal to the
OPAC.

- Adds a new JSConsents template plugin that enables a template to be
populated with the contents of the ConsentJS syspref in a prepared,
usable form
- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
- Adds the ability for both authenticated and unauthenticated users to
view and modify their consents either via "your consents" or a new
unobtrusive "Your cookies" button in the bottom right of the screen.
- Adds unit test for JSConsents.pm
Comment 43 Andrew Isherwood 2021-06-09 11:10:13 UTC
Created attachment 121732 [details] [review]
Bug 27378: Add cookie consent display to staff UI

This commit adds the display of the cookie consent bar and modal to the
staff interface:

- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
Comment 44 Andrew Isherwood 2021-06-09 11:10:17 UTC
Created attachment 121733 [details] [review]
Bug 27378: Move "Your cookies" to existing bar

The new "Your cookies" button that appeared at the bottom right when an
unauthenticated user had made their cookie consent selections wasn't
ideal.

It has now been moved to the top bar, next to "Lists", this feels like a
much more sensible place for it.
Comment 45 Andrew Isherwood 2021-06-09 11:10:22 UTC
Created attachment 121734 [details] [review]
Bug 27378: Delete cookies when consent removed

We have provided the ability for a user to remove previously granted
consent, but we were not removing the cookie associated with that
consent. This was a complete oversight on my part.

I've introduced an additional bit of metadata for each "consent" defined
in the ConsentJS syspref, this allows the admin defining a "consent" to
specify a string (which is treated as a regex) that allows us to
identify a cookie name associated with that consent. So, for example, if
Google Analytics was being added, an identifying string might be '_ga'.
This allows us to subsequently remove a cookie that a previously
granted consent has set.

This commit also adds some missing 'html' filters in
koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc and
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc
Comment 46 Andrew Isherwood 2021-06-09 11:10:26 UTC
Created attachment 121735 [details] [review]
Bug 27378: Add cookie domain and path

A subtlety I missed was that some tracking services, such as Google
Analytics, specify a cookie domain and path that differ from the
default. E.g. on a site with a domain of demostaff.koha-ptfs.co.uk, the
GA cookie will have a domain of '.koha-ptfs.co.uk' and a path of '/',
even though the cookie may have been set at a different path.

Both of these things makes sense, but of course unless we also specify
both of those things when we try to delete a previously set cookie, we
cannot.

Therefore, I have added two more bits of metadata to each "consent",
Cookie Domain and Cookie Path. It is necessary for an admin creating a
"consent" entry to know and specify these values. They can be
established by looking a cookie set by the service being configured.

This adds more complexity to setting up a consent, but we cannot remove
previously set cookies without it.
Comment 47 Andrew Isherwood 2021-06-15 12:52:44 UTC
Created attachment 121995 [details] [review]
Bug 27378: Add new 'modaljs' syspref type

This commit adds a new 'modaljs' syspref type. This is similar to the existing
'modalselect' syspref type but instead of using a file to create a list of
selectable options which are displayed in the modal, it assumes that anything
can happen within the modal driven by JS, and whatever happens is going to
return a string, that will be saved as the syspref value. In our case, the
string will be all the details of the “chunks” concatenated into a string
Comment 48 Andrew Isherwood 2021-06-15 12:52:48 UTC
Created attachment 121996 [details] [review]
Bug 27378: Add sysprefs

This commit adds 4 new sysprefs:

- CookieConsent - the master on/off for this functionality
- ConsentJS - The configuration for JS code that requires consent prior to running.
- CookieConsentBar: Allows the admin to specify the HTML that will be
displayed in the consent bar that appears at the bottom of the page
- CookieConsentPopup: Allows the admin to specify the HTML that will be
displayed in the cookie consent popup
Comment 49 Andrew Isherwood 2021-06-15 12:52:52 UTC
Created attachment 121997 [details] [review]
Bug 27378: Add JS to power modaljs

This commit adds the Javascript that provides the functionality within
the consentJS modaljs modal. It provides the ability to display the
current state of any consentJS values and to amend them, as well as add
new ones.

There is also some refactoring of the existing modalselect functions to
allow re-use of existing code between modalselect & modaljs. This
refactoring has been minimal and consists of abstracting functionality
into functions to allow more wide use.

Styles for the consentJS UI were also added.
Comment 50 Andrew Isherwood 2021-06-15 12:52:57 UTC
Created attachment 121998 [details] [review]
Bug 27378: Add cookie consent display to OPAC

This commit adds the display of the cookie consent bar and modal to the
OPAC.

- Adds a new JSConsents template plugin that enables a template to be
populated with the contents of the ConsentJS syspref in a prepared,
usable form
- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
- Adds the ability for both authenticated and unauthenticated users to
view and modify their consents either via "your consents" or a new
unobtrusive "Your cookies" button in the bottom right of the screen.
- Adds unit test for JSConsents.pm
Comment 51 Andrew Isherwood 2021-06-15 12:53:01 UTC
Created attachment 121999 [details] [review]
Bug 27378: Add cookie consent display to staff UI

This commit adds the display of the cookie consent bar and modal to the
staff interface:

- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
Comment 52 Andrew Isherwood 2021-06-15 12:53:05 UTC
Created attachment 122000 [details] [review]
Bug 27378: Move "Your cookies" to existing bar

The new "Your cookies" button that appeared at the bottom right when an
unauthenticated user had made their cookie consent selections wasn't
ideal.

It has now been moved to the top bar, next to "Lists", this feels like a
much more sensible place for it.
Comment 53 Andrew Isherwood 2021-06-15 12:53:10 UTC
Created attachment 122001 [details] [review]
Bug 27378: Delete cookies when consent removed

We have provided the ability for a user to remove previously granted
consent, but we were not removing the cookie associated with that
consent. This was a complete oversight on my part.

I've introduced an additional bit of metadata for each "consent" defined
in the ConsentJS syspref, this allows the admin defining a "consent" to
specify a string (which is treated as a regex) that allows us to
identify a cookie name associated with that consent. So, for example, if
Google Analytics was being added, an identifying string might be '_ga'.
This allows us to subsequently remove a cookie that a previously
granted consent has set.

This commit also adds some missing 'html' filters in
koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc and
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc
Comment 54 Andrew Isherwood 2021-06-15 12:53:14 UTC
Created attachment 122002 [details] [review]
Bug 27378: Add cookie domain and path

A subtlety I missed was that some tracking services, such as Google
Analytics, specify a cookie domain and path that differ from the
default. E.g. on a site with a domain of demostaff.koha-ptfs.co.uk, the
GA cookie will have a domain of '.koha-ptfs.co.uk' and a path of '/',
even though the cookie may have been set at a different path.

Both of these things makes sense, but of course unless we also specify
both of those things when we try to delete a previously set cookie, we
cannot.

Therefore, I have added two more bits of metadata to each "consent",
Cookie Domain and Cookie Path. It is necessary for an admin creating a
"consent" entry to know and specify these values. They can be
established by looking a cookie set by the service being configured.

This adds more complexity to setting up a consent, but we cannot remove
previously set cookies without it.
Comment 55 Martin Renvoize 2021-07-07 08:37:07 UTC
Created attachment 122635 [details] [review]
Bug 27378: Add new 'modaljs' syspref type

This commit adds a new 'modaljs' syspref type. This is similar to the existing
'modalselect' syspref type but instead of using a file to create a list of
selectable options which are displayed in the modal, it assumes that anything
can happen within the modal driven by JS, and whatever happens is going to
return a string, that will be saved as the syspref value. In our case, the
string will be all the details of the “chunks” concatenated into a string

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 56 Martin Renvoize 2021-07-07 08:37:12 UTC
Created attachment 122636 [details] [review]
Bug 27378: Add sysprefs

This commit adds 4 new sysprefs:

- CookieConsent - the master on/off for this functionality
- ConsentJS - The configuration for JS code that requires consent prior to running.
- CookieConsentBar: Allows the admin to specify the HTML that will be
displayed in the consent bar that appears at the bottom of the page
- CookieConsentPopup: Allows the admin to specify the HTML that will be
displayed in the cookie consent popup

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 57 Martin Renvoize 2021-07-07 08:37:17 UTC
Created attachment 122637 [details] [review]
Bug 27378: Add JS to power modaljs

This commit adds the Javascript that provides the functionality within
the consentJS modaljs modal. It provides the ability to display the
current state of any consentJS values and to amend them, as well as add
new ones.

There is also some refactoring of the existing modalselect functions to
allow re-use of existing code between modalselect & modaljs. This
refactoring has been minimal and consists of abstracting functionality
into functions to allow more wide use.

Styles for the consentJS UI were also added.

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 58 Martin Renvoize 2021-07-07 08:37:22 UTC
Created attachment 122638 [details] [review]
Bug 27378: Add cookie consent display to OPAC

This commit adds the display of the cookie consent bar and modal to the
OPAC.

- Adds a new JSConsents template plugin that enables a template to be
populated with the contents of the ConsentJS syspref in a prepared,
usable form
- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
- Adds the ability for both authenticated and unauthenticated users to
view and modify their consents either via "your consents" or a new
unobtrusive "Your cookies" button in the bottom right of the screen.
- Adds unit test for JSConsents.pm

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 59 Martin Renvoize 2021-07-07 08:37:27 UTC
Created attachment 122639 [details] [review]
Bug 27378: Add cookie consent display to staff UI

This commit adds the display of the cookie consent bar and modal to the
staff interface:

- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 60 Martin Renvoize 2021-07-07 08:37:31 UTC
Created attachment 122640 [details] [review]
Bug 27378: Move "Your cookies" to existing bar

The new "Your cookies" button that appeared at the bottom right when an
unauthenticated user had made their cookie consent selections wasn't
ideal.

It has now been moved to the top bar, next to "Lists", this feels like a
much more sensible place for it.

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 61 Martin Renvoize 2021-07-07 08:37:36 UTC
Created attachment 122641 [details] [review]
Bug 27378: Delete cookies when consent removed

We have provided the ability for a user to remove previously granted
consent, but we were not removing the cookie associated with that
consent. This was a complete oversight on my part.

I've introduced an additional bit of metadata for each "consent" defined
in the ConsentJS syspref, this allows the admin defining a "consent" to
specify a string (which is treated as a regex) that allows us to
identify a cookie name associated with that consent. So, for example, if
Google Analytics was being added, an identifying string might be '_ga'.
This allows us to subsequently remove a cookie that a previously
granted consent has set.

This commit also adds some missing 'html' filters in
koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc and
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 62 Martin Renvoize 2021-07-07 08:37:40 UTC
Created attachment 122642 [details] [review]
Bug 27378: Add cookie domain and path

A subtlety I missed was that some tracking services, such as Google
Analytics, specify a cookie domain and path that differ from the
default. E.g. on a site with a domain of demostaff.koha-ptfs.co.uk, the
GA cookie will have a domain of '.koha-ptfs.co.uk' and a path of '/',
even though the cookie may have been set at a different path.

Both of these things makes sense, but of course unless we also specify
both of those things when we try to delete a previously set cookie, we
cannot.

Therefore, I have added two more bits of metadata to each "consent",
Cookie Domain and Cookie Path. It is necessary for an admin creating a
"consent" entry to know and specify these values. They can be
established by looking a cookie set by the service being configured.

This adds more complexity to setting up a consent, but we cannot remove
previously set cookies without it.

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 63 Martin Renvoize 2021-07-07 08:38:40 UTC
Thoroughly tested by Barry Cannon (and their customers the Institutes of Technology consortium, Ireland).

Add SO lines at their request.
Comment 64 Nick Clemens 2021-08-03 13:11:00 UTC
Error in :
installer/data/mysql/atomicupdate/bug_27378_add_CookieConsentPopup_syspref.perl
(shoudl quote with q{} so the | doesn't break it)

In testing I was never able to get the cookies to set - can you provide some values in the test plan that work on koha testing docker - I got complaints of bad domain for cookies

Question: Should you be able to keep using the site before clicking 'Accept' on the necessary cookies?
Comment 65 Andrew Isherwood 2021-09-17 11:07:02 UTC
Created attachment 124957 [details] [review]
Bug 27378: Add new 'modaljs' syspref type

This commit adds a new 'modaljs' syspref type. This is similar to the existing
'modalselect' syspref type but instead of using a file to create a list of
selectable options which are displayed in the modal, it assumes that anything
can happen within the modal driven by JS, and whatever happens is going to
return a string, that will be saved as the syspref value. In our case, the
string will be all the details of the “chunks” concatenated into a string

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 66 Andrew Isherwood 2021-09-17 11:07:07 UTC
Created attachment 124958 [details] [review]
Bug 27378: Add sysprefs

This commit adds 4 new sysprefs:

- CookieConsent - the master on/off for this functionality
- ConsentJS - The configuration for JS code that requires consent prior to running.
- CookieConsentBar: Allows the admin to specify the HTML that will be
displayed in the consent bar that appears at the bottom of the page
- CookieConsentPopup: Allows the admin to specify the HTML that will be
displayed in the cookie consent popup

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 67 Andrew Isherwood 2021-09-17 11:07:12 UTC
Created attachment 124959 [details] [review]
Bug 27378: Add JS to power modaljs

This commit adds the Javascript that provides the functionality within
the consentJS modaljs modal. It provides the ability to display the
current state of any consentJS values and to amend them, as well as add
new ones.

There is also some refactoring of the existing modalselect functions to
allow re-use of existing code between modalselect & modaljs. This
refactoring has been minimal and consists of abstracting functionality
into functions to allow more wide use.

Styles for the consentJS UI were also added.

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 68 Andrew Isherwood 2021-09-17 11:07:17 UTC
Created attachment 124960 [details] [review]
Bug 27378: Add cookie consent display to OPAC

This commit adds the display of the cookie consent bar and modal to the
OPAC.

- Adds a new JSConsents template plugin that enables a template to be
populated with the contents of the ConsentJS syspref in a prepared,
usable form
- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
- Adds the ability for both authenticated and unauthenticated users to
view and modify their consents either via "your consents" or a new
unobtrusive "Your cookies" button in the bottom right of the screen.
- Adds unit test for JSConsents.pm

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 69 Andrew Isherwood 2021-09-17 11:07:22 UTC
Created attachment 124961 [details] [review]
Bug 27378: Add cookie consent display to staff UI

This commit adds the display of the cookie consent bar and modal to the
staff interface:

- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 70 Andrew Isherwood 2021-09-17 11:07:30 UTC
Created attachment 124962 [details] [review]
Bug 27378: Move "Your cookies" to existing bar

The new "Your cookies" button that appeared at the bottom right when an
unauthenticated user had made their cookie consent selections wasn't
ideal.

It has now been moved to the top bar, next to "Lists", this feels like a
much more sensible place for it.

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 71 Andrew Isherwood 2021-09-17 11:07:34 UTC
Created attachment 124963 [details] [review]
Bug 27378: Delete cookies when consent removed

We have provided the ability for a user to remove previously granted
consent, but we were not removing the cookie associated with that
consent. This was a complete oversight on my part.

I've introduced an additional bit of metadata for each "consent" defined
in the ConsentJS syspref, this allows the admin defining a "consent" to
specify a string (which is treated as a regex) that allows us to
identify a cookie name associated with that consent. So, for example, if
Google Analytics was being added, an identifying string might be '_ga'.
This allows us to subsequently remove a cookie that a previously
granted consent has set.

This commit also adds some missing 'html' filters in
koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc and
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 72 Andrew Isherwood 2021-09-17 11:07:40 UTC
Created attachment 124964 [details] [review]
Bug 27378: Add cookie domain and path

A subtlety I missed was that some tracking services, such as Google
Analytics, specify a cookie domain and path that differ from the
default. E.g. on a site with a domain of demostaff.koha-ptfs.co.uk, the
GA cookie will have a domain of '.koha-ptfs.co.uk' and a path of '/',
even though the cookie may have been set at a different path.

Both of these things makes sense, but of course unless we also specify
both of those things when we try to delete a previously set cookie, we
cannot.

Therefore, I have added two more bits of metadata to each "consent",
Cookie Domain and Cookie Path. It is necessary for an admin creating a
"consent" entry to know and specify these values. They can be
established by looking a cookie set by the service being configured.

This adds more complexity to setting up a consent, but we cannot remove
previously set cookies without it.

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 73 Andrew Isherwood 2021-09-17 11:07:44 UTC
Created attachment 124965 [details] [review]
Bug 27378: (follow-up) Fix update delimiter

As suggested by Nick in Comment #64
Comment 74 Andrew Isherwood 2021-09-17 11:08:22 UTC
- Rebased and fixed merge conflicts
- Modified update delimiter
Comment 75 Andrew Isherwood 2021-09-17 11:11:50 UTC
(In reply to Nick Clemens from comment #64)
> Error in :
> installer/data/mysql/atomicupdate/bug_27378_add_CookieConsentPopup_syspref.
> perl
> (shoudl quote with q{} so the | doesn't break it)

Thanks, fixed.

> In testing I was never able to get the cookies to set - can you provide some
> values in the test plan that work on koha testing docker - I got complaints
> of bad domain for cookies

It was developed on KTD and I just ran through the test plan on the same and it worked perfectly. For step 12 of the test plan are you using the domain you use to access the KTD in your browser?

> Question: Should you be able to keep using the site before clicking 'Accept'
> on the necessary cookies?

I think so, I've yet to encounter a site that wouldn't let me use it before I agreed to cookies.
Comment 76 Katrin Fischer 2021-10-21 19:58:07 UTC
Hi Andrew, could you please rebase?
Comment 77 Katrin Fischer 2021-10-21 19:58:40 UTC
I fixed the conflict in sysprefs.sql, but got stuck on the scss.
Comment 78 Martin Renvoize 2022-02-02 10:04:14 UTC
Created attachment 130072 [details] [review]
Bug 27378: Add new 'modaljs' syspref type

This commit adds a new 'modaljs' syspref type. This is similar to the existing
'modalselect' syspref type but instead of using a file to create a list of
selectable options which are displayed in the modal, it assumes that anything
can happen within the modal driven by JS, and whatever happens is going to
return a string, that will be saved as the syspref value. In our case, the
string will be all the details of the “chunks” concatenated into a string

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 79 Martin Renvoize 2022-02-02 10:04:19 UTC
Created attachment 130073 [details] [review]
Bug 27378: Add sysprefs

This commit adds 4 new sysprefs:

- CookieConsent - the master on/off for this functionality
- ConsentJS - The configuration for JS code that requires consent prior to running.
- CookieConsentBar: Allows the admin to specify the HTML that will be
displayed in the consent bar that appears at the bottom of the page
- CookieConsentPopup: Allows the admin to specify the HTML that will be
displayed in the cookie consent popup

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 80 Martin Renvoize 2022-02-02 10:04:24 UTC
Created attachment 130074 [details] [review]
Bug 27378: Add JS to power modaljs

This commit adds the Javascript that provides the functionality within
the consentJS modaljs modal. It provides the ability to display the
current state of any consentJS values and to amend them, as well as add
new ones.

There is also some refactoring of the existing modalselect functions to
allow re-use of existing code between modalselect & modaljs. This
refactoring has been minimal and consists of abstracting functionality
into functions to allow more wide use.

Styles for the consentJS UI were also added.

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 81 Martin Renvoize 2022-02-02 10:04:29 UTC
Created attachment 130075 [details] [review]
Bug 27378: Add cookie consent display to OPAC

This commit adds the display of the cookie consent bar and modal to the
OPAC.

- Adds a new JSConsents template plugin that enables a template to be
populated with the contents of the ConsentJS syspref in a prepared,
usable form
- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
- Adds the ability for both authenticated and unauthenticated users to
view and modify their consents either via "your consents" or a new
unobtrusive "Your cookies" button in the bottom right of the screen.
- Adds unit test for JSConsents.pm

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 82 Martin Renvoize 2022-02-02 10:04:34 UTC
Created attachment 130076 [details] [review]
Bug 27378: Add cookie consent display to staff UI

This commit adds the display of the cookie consent bar and modal to the
staff interface:

- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 83 Martin Renvoize 2022-02-02 10:04:40 UTC
Created attachment 130077 [details] [review]
Bug 27378: Move "Your cookies" to existing bar

The new "Your cookies" button that appeared at the bottom right when an
unauthenticated user had made their cookie consent selections wasn't
ideal.

It has now been moved to the top bar, next to "Lists", this feels like a
much more sensible place for it.

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 84 Martin Renvoize 2022-02-02 10:04:45 UTC
Created attachment 130078 [details] [review]
Bug 27378: Delete cookies when consent removed

We have provided the ability for a user to remove previously granted
consent, but we were not removing the cookie associated with that
consent. This was a complete oversight on my part.

I've introduced an additional bit of metadata for each "consent" defined
in the ConsentJS syspref, this allows the admin defining a "consent" to
specify a string (which is treated as a regex) that allows us to
identify a cookie name associated with that consent. So, for example, if
Google Analytics was being added, an identifying string might be '_ga'.
This allows us to subsequently remove a cookie that a previously
granted consent has set.

This commit also adds some missing 'html' filters in
koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc and
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 85 Martin Renvoize 2022-02-02 10:04:51 UTC
Created attachment 130079 [details] [review]
Bug 27378: Add cookie domain and path

A subtlety I missed was that some tracking services, such as Google
Analytics, specify a cookie domain and path that differ from the
default. E.g. on a site with a domain of demostaff.koha-ptfs.co.uk, the
GA cookie will have a domain of '.koha-ptfs.co.uk' and a path of '/',
even though the cookie may have been set at a different path.

Both of these things makes sense, but of course unless we also specify
both of those things when we try to delete a previously set cookie, we
cannot.

Therefore, I have added two more bits of metadata to each "consent",
Cookie Domain and Cookie Path. It is necessary for an admin creating a
"consent" entry to know and specify these values. They can be
established by looking a cookie set by the service being configured.

This adds more complexity to setting up a consent, but we cannot remove
previously set cookies without it.

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 86 Martin Renvoize 2022-02-02 10:04:56 UTC
Created attachment 130080 [details] [review]
Bug 27378: (follow-up) Fix update delimiter

As suggested by Nick in Comment #64
Comment 87 Martin Renvoize 2022-02-02 10:05:27 UTC
Rebased and ready for QA
Comment 88 Marcel de Rooy 2022-03-25 09:35:14 UTC
 FAIL   koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
   FAIL   filters
                missing_filter at line 465 (                                        <input class="consentCheckbox" type="checkbox" name="consentCheckbox" value="[% consent.id %]">)
Comment 89 Marcel de Rooy 2022-03-25 09:35:49 UTC
More:

 FAIL   koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc
   FAIL   filters
                missing_filter at line 112 (                                        <input class="consentCheckbox" type="checkbox" name="consentCheckbox" value="[% consent.id %]">)

 FAIL   koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt
   FAIL   filters
                missing_filter at line 135 (                        <input type="text" name="pref_[% CHUNK.name | html %]" data-initiator="[% CHUNK.initiator | html %]" data-processor="[% CHUNK.processor %]" id="pref_[% CHUNK.name | html %]" class="modaljs preference preference-[% CHUNK.type | html %]" readonly="readonly" value="[% CHUNK.value | html %]"/>)
Comment 90 Martin Renvoize 2022-05-24 15:08:36 UTC
Created attachment 135309 [details] [review]
Bug 27378: Add new 'modaljs' syspref type

This commit adds a new 'modaljs' syspref type. This is similar to the existing
'modalselect' syspref type but instead of using a file to create a list of
selectable options which are displayed in the modal, it assumes that anything
can happen within the modal driven by JS, and whatever happens is going to
return a string, that will be saved as the syspref value. In our case, the
string will be all the details of the “chunks” concatenated into a string

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 91 Martin Renvoize 2022-05-24 15:08:41 UTC
Created attachment 135310 [details] [review]
Bug 27378: Add sysprefs

This commit adds 4 new sysprefs:

- CookieConsent - the master on/off for this functionality
- ConsentJS - The configuration for JS code that requires consent prior to running.
- CookieConsentBar: Allows the admin to specify the HTML that will be
displayed in the consent bar that appears at the bottom of the page
- CookieConsentPopup: Allows the admin to specify the HTML that will be
displayed in the cookie consent popup

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 92 Martin Renvoize 2022-05-24 15:08:46 UTC
Created attachment 135311 [details] [review]
Bug 27378: Add JS to power modaljs

This commit adds the Javascript that provides the functionality within
the consentJS modaljs modal. It provides the ability to display the
current state of any consentJS values and to amend them, as well as add
new ones.

There is also some refactoring of the existing modalselect functions to
allow re-use of existing code between modalselect & modaljs. This
refactoring has been minimal and consists of abstracting functionality
into functions to allow more wide use.

Styles for the consentJS UI were also added.

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 93 Martin Renvoize 2022-05-24 15:08:52 UTC
Created attachment 135312 [details] [review]
Bug 27378: Add cookie consent display to OPAC

This commit adds the display of the cookie consent bar and modal to the
OPAC.

- Adds a new JSConsents template plugin that enables a template to be
populated with the contents of the ConsentJS syspref in a prepared,
usable form
- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate
- Adds the ability for both authenticated and unauthenticated users to
view and modify their consents either via "your consents" or a new
unobtrusive "Your cookies" button in the bottom right of the screen.
- Adds unit test for JSConsents.pm

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 94 Martin Renvoize 2022-05-24 15:08:57 UTC
Created attachment 135313 [details] [review]
Bug 27378: Add cookie consent display to staff UI

This commit adds the display of the cookie consent bar and modal to the
staff interface:

- Adds a new cookieconsent.js script that drives the display and
functionality of the cookie consent bar and modal
- Adds styles for the cookie consent bar and modal
- Adds the creation and population of the cookie consent bar and modal,
if appropriate

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 95 Martin Renvoize 2022-05-24 15:09:03 UTC
Created attachment 135314 [details] [review]
Bug 27378: Move "Your cookies" to existing bar

The new "Your cookies" button that appeared at the bottom right when an
unauthenticated user had made their cookie consent selections wasn't
ideal.

It has now been moved to the top bar, next to "Lists", this feels like a
much more sensible place for it.

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 96 Martin Renvoize 2022-05-24 15:09:08 UTC
Created attachment 135315 [details] [review]
Bug 27378: Delete cookies when consent removed

We have provided the ability for a user to remove previously granted
consent, but we were not removing the cookie associated with that
consent. This was a complete oversight on my part.

I've introduced an additional bit of metadata for each "consent" defined
in the ConsentJS syspref, this allows the admin defining a "consent" to
specify a string (which is treated as a regex) that allows us to
identify a cookie name associated with that consent. So, for example, if
Google Analytics was being added, an identifying string might be '_ga'.
This allows us to subsequently remove a cookie that a previously
granted consent has set.

This commit also adds some missing 'html' filters in
koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc and
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 97 Martin Renvoize 2022-05-24 15:09:14 UTC
Created attachment 135316 [details] [review]
Bug 27378: Add cookie domain and path

A subtlety I missed was that some tracking services, such as Google
Analytics, specify a cookie domain and path that differ from the
default. E.g. on a site with a domain of demostaff.koha-ptfs.co.uk, the
GA cookie will have a domain of '.koha-ptfs.co.uk' and a path of '/',
even though the cookie may have been set at a different path.

Both of these things makes sense, but of course unless we also specify
both of those things when we try to delete a previously set cookie, we
cannot.

Therefore, I have added two more bits of metadata to each "consent",
Cookie Domain and Cookie Path. It is necessary for an admin creating a
"consent" entry to know and specify these values. They can be
established by looking a cookie set by the service being configured.

This adds more complexity to setting up a consent, but we cannot remove
previously set cookies without it.

Signed-ff-by: Barry Cannon <bc@interleaf.ie>
Comment 98 Martin Renvoize 2022-05-24 15:09:19 UTC
Created attachment 135317 [details] [review]
Bug 27378: (follow-up) Fix update delimiter

As suggested by Nick in Comment #64
Comment 99 Martin Renvoize 2022-05-24 15:09:27 UTC
Created attachment 135318 [details] [review]
Bug 27378: (follow-up) Add missing filters
Comment 100 Martin Renvoize 2022-05-24 15:10:19 UTC
Rebased and missing filters added in a follow-up.. QA scripts are happy now.