cookie-consent-jurisdiction-engine-v1/tests/audit/audit-test.html

<!doctype html>
<html lang="en">
<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>Cookie Consent Audit Lab</title>
    <style>
        body { font-family: system-ui, sans-serif; max-width: 900px; margin: 40px auto; padding: 0 20px; }
        button { padding: 10px 16px; cursor: pointer; }
        #status { margin: 20px 0; font-size: 1.2rem; font-weight: 700; }
        pre { background: #f5f5f5; padding: 16px; overflow: auto; }
    </style>
</head>
<body>
    <h1>Cookie Consent Audit Lab</h1>
    <p>Browser audit for Core + Jurisdiction + Integration invariants.</p>
    <button id="run">Run audit</button>
    <div id="status">Not run</div>
    <pre id="log"></pre>

    <script type="module">
        import { createIntegratedConsentEngine } from "../../integration/index.js";

        const status = document.getElementById("status");
        const log = document.getElementById("log");
        const button = document.getElementById("run");

        function assert(condition, message) {
            if (!condition) throw new Error(message);
        }

        function clearConsentCookie() {
            document.cookie = "ucc_consent=; Max-Age=0; Path=/; SameSite=Lax";
        }

        async function test(name, fn, output) {
            try {
                await fn();
                output.push(`PASS ${name}`);
                return true;
            } catch (error) {
                output.push(`FAIL ${name} — ${error.message}`);
                return false;
            }
        }

        async function runAudit() {
            clearConsentCookie();
            const output = [];
            let passed = 0;

            if (await test("dynamic jurisdiction is reflected in Core state", () => {
                const consent = createIntegratedConsentEngine({
                    jurisdiction: { mode: "fixed", jurisdiction: "global" }
                });
                consent.initialize();
                assert(consent.setJurisdiction("us-ma").jurisdiction === "us-ma", "jurisdiction mismatch");
            }, output)) passed++;

            if (await test("GPC state is represented without granting optional consent", () => {
                const consent = createIntegratedConsentEngine({
                    jurisdiction: { mode: "fixed", jurisdiction: "us-ma" }
                });
                consent.initialize();
                const state = consent.setGpc(true);
                assert(state.gpc === true, "GPC was not recorded");
                assert(state.hasDecision === false, "GPC unexpectedly created a decision");
                assert(state.categories.analytics === "unknown", "analytics was granted unexpectedly");
            }, output)) passed++;

            if (await test("acceptance persists resolved jurisdiction", () => {
                clearConsentCookie();
                const consent = createIntegratedConsentEngine({
                    jurisdiction: { mode: "fixed", jurisdiction: "us-ma" }
                });
                consent.initialize();
                const state = consent.acceptAll();
                assert(state.hasDecision === true, "decision was not saved");
                assert(state.jurisdiction === "us-ma", "wrong persisted jurisdiction");
            }, output)) passed++;

            if (await test("reload recovers the persisted decision", () => {
                const consent = createIntegratedConsentEngine({
                    jurisdiction: { mode: "fixed", jurisdiction: "us-ma" }
                });
                consent.initialize();
                const state = consent.getState();
                assert(state.hasDecision === true, "decision did not survive reinitialization");
                assert(state.jurisdiction === "us-ma", "jurisdiction did not survive reinitialization");
            }, output)) passed++;

            if (await test("reset removes the persisted decision", () => {
                const consent = createIntegratedConsentEngine({
                    jurisdiction: { mode: "fixed", jurisdiction: "us-ma" }
                });
                consent.initialize();
                const state = consent.reset();
                assert(state.hasDecision === false, "reset retained decision");
                assert(state.categories.analytics === "unknown", "analytics was not reset");
            }, output)) passed++;

            if (await test("event sequence reports acceptance once", () => {
                clearConsentCookie();
                const consent = createIntegratedConsentEngine({
                    jurisdiction: { mode: "fixed", jurisdiction: "us-ma" }
                });
                const events = [];
                consent.on("consent:changed", () => events.push("changed"));
                consent.on("consent:accepted", () => events.push("accepted"));
                consent.initialize();
                consent.acceptAll();
                assert(events.join(",") === "changed,accepted", "unexpected event sequence: " + events.join(","));
            }, output)) passed++;

            if (await test("returned state cannot mutate Core internals", () => {
                const consent = createIntegratedConsentEngine({
                    jurisdiction: { mode: "fixed", jurisdiction: "us-ma" }
                });
                consent.initialize();
                const state = consent.getState();
                state.categories.analytics = "granted";
                state.jurisdiction = "changed";
                const current = consent.getState();
                assert(current.categories.analytics === "unknown", "categories leaked");
                assert(current.jurisdiction === "us-ma", "jurisdiction leaked");
            }, output)) passed++;

            log.textContent = output.join("\n");
            status.textContent = `${passed}/7 audit tests passed`;
            clearConsentCookie();
        }

        button.addEventListener("click", runAudit);
    </script>
</body>
</html>