Initial reliable release of consent engine

tests/audit/audit-test.html

@@ -0,0 +1,136 @@
+<!doctype html>
+<html lang="en">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>Cookie Consent Audit Lab</title>
+    <style>
+        body { font-family: system-ui, sans-serif; max-width: 900px; margin: 40px auto; padding: 0 20px; }
+        button { padding: 10px 16px; cursor: pointer; }
+        #status { margin: 20px 0; font-size: 1.2rem; font-weight: 700; }
+        pre { background: #f5f5f5; padding: 16px; overflow: auto; }
+    </style>
+</head>
+<body>
+    <h1>Cookie Consent Audit Lab</h1>
+    <p>Browser audit for Core + Jurisdiction + Integration invariants.</p>
+    <button id="run">Run audit</button>
+    <div id="status">Not run</div>
+    <pre id="log"></pre>
+
+    <script type="module">
+        import { createIntegratedConsentEngine } from "../../integration/index.js";
+
+        const status = document.getElementById("status");
+        const log = document.getElementById("log");
+        const button = document.getElementById("run");
+
+        function assert(condition, message) {
+            if (!condition) throw new Error(message);
+        }
+
+        function clearConsentCookie() {
+            document.cookie = "ucc_consent=; Max-Age=0; Path=/; SameSite=Lax";
+        }
+
+        async function test(name, fn, output) {
+            try {
+                await fn();
+                output.push(`PASS ${name}`);
+                return true;
+            } catch (error) {
+                output.push(`FAIL ${name} — ${error.message}`);
+                return false;
+            }
+        }
+
+        async function runAudit() {
+            clearConsentCookie();
+            const output = [];
+            let passed = 0;
+
+            if (await test("dynamic jurisdiction is reflected in Core state", () => {
+                const consent = createIntegratedConsentEngine({
+                    jurisdiction: { mode: "fixed", jurisdiction: "global" }
+                });
+                consent.initialize();
+                assert(consent.setJurisdiction("us-ma").jurisdiction === "us-ma", "jurisdiction mismatch");
+            }, output)) passed++;
+
+            if (await test("GPC state is represented without granting optional consent", () => {
+                const consent = createIntegratedConsentEngine({
+                    jurisdiction: { mode: "fixed", jurisdiction: "us-ma" }
+                });
+                consent.initialize();
+                const state = consent.setGpc(true);
+                assert(state.gpc === true, "GPC was not recorded");
+                assert(state.hasDecision === false, "GPC unexpectedly created a decision");
+                assert(state.categories.analytics === "unknown", "analytics was granted unexpectedly");
+            }, output)) passed++;
+
+            if (await test("acceptance persists resolved jurisdiction", () => {
+                clearConsentCookie();
+                const consent = createIntegratedConsentEngine({
+                    jurisdiction: { mode: "fixed", jurisdiction: "us-ma" }
+                });
+                consent.initialize();
+                const state = consent.acceptAll();
+                assert(state.hasDecision === true, "decision was not saved");
+                assert(state.jurisdiction === "us-ma", "wrong persisted jurisdiction");
+            }, output)) passed++;
+
+            if (await test("reload recovers the persisted decision", () => {
+                const consent = createIntegratedConsentEngine({
+                    jurisdiction: { mode: "fixed", jurisdiction: "us-ma" }
+                });
+                consent.initialize();
+                const state = consent.getState();
+                assert(state.hasDecision === true, "decision did not survive reinitialization");
+                assert(state.jurisdiction === "us-ma", "jurisdiction did not survive reinitialization");
+            }, output)) passed++;
+
+            if (await test("reset removes the persisted decision", () => {
+                const consent = createIntegratedConsentEngine({
+                    jurisdiction: { mode: "fixed", jurisdiction: "us-ma" }
+                });
+                consent.initialize();
+                const state = consent.reset();
+                assert(state.hasDecision === false, "reset retained decision");
+                assert(state.categories.analytics === "unknown", "analytics was not reset");
+            }, output)) passed++;
+
+            if (await test("event sequence reports acceptance once", () => {
+                clearConsentCookie();
+                const consent = createIntegratedConsentEngine({
+                    jurisdiction: { mode: "fixed", jurisdiction: "us-ma" }
+                });
+                const events = [];
+                consent.on("consent:changed", () => events.push("changed"));
+                consent.on("consent:accepted", () => events.push("accepted"));
+                consent.initialize();
+                consent.acceptAll();
+                assert(events.join(",") === "changed,accepted", "unexpected event sequence: " + events.join(","));
+            }, output)) passed++;
+
+            if (await test("returned state cannot mutate Core internals", () => {
+                const consent = createIntegratedConsentEngine({
+                    jurisdiction: { mode: "fixed", jurisdiction: "us-ma" }
+                });
+                consent.initialize();
+                const state = consent.getState();
+                state.categories.analytics = "granted";
+                state.jurisdiction = "changed";
+                const current = consent.getState();
+                assert(current.categories.analytics === "unknown", "categories leaked");
+                assert(current.jurisdiction === "us-ma", "jurisdiction leaked");
+            }, output)) passed++;
+
+            log.textContent = output.join("\n");
+            status.textContent = `${passed}/7 audit tests passed`;
+            clearConsentCookie();
+        }
+
+        button.addEventListener("click", runAudit);
+    </script>
+</body>
+</html>