Problem/Motivation
Our site is running Drupal 10.1 with cookies 1.2.8 with cookies_filter and cookies_gtag. In our case, this is not a significant bug, but we can see how for other sites it may impact GDPR compliance.
I have not confirmed whether this problem affects vanilla installations of Drupal so I am sorry if this bug is only on our side.
In our case, the way cookies_gtag suppresses scripts while aggregate JS is enabled causes it to accidentally suppress all cookies submodule scripts that are aggregated together with it. As a result, things like cookies_filter do not work because the revival scripts are not loaded on pages.
Steps to reproduce
1. Install drupal/cookies 1.2.8 and its submodules cookies_filter and cookies_gtag.
2. Set up a filter and page such that cookies_filter and cookies_gtag should both be served.
3. Enable JS and CSS aggregation.
When confirming the bug, be sure to confirm that the page is running the knockout script for gtag mentioned in the resolution. In our case, subsequent refreshes of the page that were cached or served from varnish correctly served the aggregation. It was only when hook_js_alter was invoked that aggregation failed to resolve correctly.
Proposed resolution
I've identified the problem file and taken action to fix it on my local build. By adding the following line to the cookies.gtag.module hook_js_alter(), I have prevented all the scripts that it alters from being preprocessed, preventing them from being considered for aggregation.
# docroot/modules/custom/cookies/modules/cookies_gtag/cookies_gtag.module
function cookies_gtag_js_alter(&$javascript, AttachedAssetsInterface $assets) {
$doKo = CookiesKnockOutService::getInstance()->doKnockOut();
if ($doKo) {
$module_path = \Drupal::service('extension.list.module')->getPath('google_tag');
$scripts = [
'gtag' => $module_path . '/js/gtag.js',
'gtag_ajax' => $module_path . '/js/gtag.ajax.js',
'gtm' => $module_path . '/js/gtm.js',
];
foreach ($scripts as $key => $script) {
if (isset($javascript[$script])) {
$javascript[$script]['attributes']['type'] = CookiesConstants::COOKIES_SCRIPT_KO_TYPE;
$javascript[$script]['attributes']['id'] = 'cookies_gtag_' . $key;
$javascript[$script]['attributes']['data-cookieconsent'] = 'gtag';
+ $javascript[$script]['preprocess'] = FALSE;
}
}
}
}
By adding this to the module, aggregation of the remaining cookies_filter scripts and other behaviors related to cookies submodules are distributed to users appropriately, with gtag scripts being correctly reduced to plain/text until the cookies module confirms consent from first parties, thus maintaining compliance with GDPR.
Remaining tasks
It is unclear to me at this time whether this is a problem inherent to cookies_gtag or our site individually and I have not tested your module on any vanilla installations. The hack I found does not seem like the best solution because it simply prevents aggregation. I would greatly appreciate any advice on how to better solve this problem if you have any.