Build privacy base recipe

Created on 25 October 2024, 5 months ago

Problem/Motivation

The base privacy should be applied by default and provide the following functionality:

  • Consent management (cookies) in the front end
  • Block remote content until the user accepted it explicitly
  • Provide default content for privacy statement and others

Proposed resolution

The module proposed for this recipe is the Klaro module β†’ . It is not yet the most popular one, but it is the state-of-the art solution for this requirement. There will be a stable release in November, the maintainers will cover the module by the security advisory policy and maintainers of similar modules with higher user statistics will join forces and help maintaining Klaro.

πŸ“Œ Task
Status

Active

Component

Track: Privacy

Created by

πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @jurgenhaas
  • Pipeline finished with Success
    5 months ago
    Total: 870s
    #320512
  • Pipeline finished with Failed
    5 months ago
    Total: 757s
    #320604
  • Pipeline finished with Failed
    5 months ago
    Total: 911s
    #320606
  • Pipeline finished with Canceled
    5 months ago
    Total: 67s
    #320875
  • Pipeline finished with Failed
    5 months ago
    Total: 597s
    #320873
  • Pipeline finished with Canceled
    5 months ago
    Total: 545s
    #320878
  • Pipeline finished with Failed
    5 months ago
    Total: 697s
    #320879
  • Pipeline finished with Canceled
    5 months ago
    Total: 79s
    #320890
  • Pipeline finished with Failed
    5 months ago
    Total: 886s
    #320891
  • Pipeline finished with Failed
    5 months ago
    Total: 62s
    #322999
  • Pipeline finished with Failed
    5 months ago
    Total: 62s
    #323000
  • Pipeline finished with Failed
    5 months ago
    Total: 65s
    #323012
  • Pipeline finished with Failed
    5 months ago
    Total: 139s
    #323013
  • Pipeline finished with Canceled
    5 months ago
    Total: 65s
    #323034
  • Pipeline finished with Success
    5 months ago
    Total: 2317s
    #323035
  • First commit to issue fork.
  • Pipeline finished with Canceled
    5 months ago
    Total: 184s
    #323103
  • Pipeline finished with Failed
    5 months ago
    Total: 745s
    #323106
  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts

    The more I look at this, the more I think we should, at least for now, fold it into the base recipe.

    This would eliminate the dependency weirdness about the Page content type, and it would decrease overall maintenance burden by reducing the number of components we'll need to split out. I think that it makes sense to lower our initial maintenance needs at release time, and then split this into its own recipe if the popular demand for it exists. I am not convinced this recipe currently provides enough "stuff", on its own, to justify it being its own component. As has been pointed out, its additions are useful but also quite generic, which really puts this more into the "initial site starter kit" category which is covered by the base recipe.

  • Pipeline finished with Failed
    5 months ago
    Total: 194s
    #323177
  • Pipeline finished with Success
    5 months ago
    Total: 828s
    #323201
  • πŸ‡ΈπŸ‡°Slovakia poker10

    @jurgenhaas I see the Klaro! consent manager JS-Library is open-source for client-side usage, but paid for another server-side features. Are we certain that the licensing will not change if we make it more popular? These 3rd party services tend to tighten the usage policies like cookiebot and some others have done in the past.

  • Pipeline finished with Failed
    5 months ago
    Total: 388s
    #323237
  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

    @poker10 yes, we've checked into that. Not only this statement on their website

    but also a lot other indicators have been checked, down to the level that we know the guy and his motivation, who built that service. And even if he were bought out by somebody, that would not prevent us from continued usage of the free library which we have forked and provide as a drupal-library from klaro_js β†’ on drupal.org

  • Pipeline finished with Failed
    5 months ago
    Total: 494s
    #323241
  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts

    Hey, look! I found a reasonable compromise that can allow this to move forward.

    Although I am still not entirely convinced that this should be its own recipe, that decision can wait until the beta period, when we need to finalize our list of components (which will mean consolidating some of the existing ones into the base recipe). In the meantime, the Page content type, which was a workaround for overzealous strictness checks from core, is removed; we can rely on core's Page content type recipe only, which solves the dependency problem that was making me most hesitant.

    I also went and added basic test coverage here. I think this can go back to you, @jurgenhaas, for any further changes that are needed.

  • Pipeline finished with Failed
    5 months ago
    Total: 555s
    #323252
  • Pipeline finished with Failed
    5 months ago
    Total: 578s
    #323266
  • Pipeline finished with Failed
    5 months ago
    Total: 63s
    #324865
  • Pipeline finished with Failed
    5 months ago
    Total: 65s
    #324866
  • Pipeline finished with Failed
    5 months ago
    Total: 595s
    #324871
  • Pipeline finished with Failed
    5 months ago
    Total: 602s
    #324870
  • Pipeline finished with Canceled
    5 months ago
    Total: 342s
    #324882
  • Pipeline finished with Failed
    5 months ago
    Total: 863s
    #324883
  • Pipeline finished with Failed
    5 months ago
    Total: 564s
    #324900
  • Pipeline finished with Failed
    5 months ago
    Total: 690s
    #324899
  • Pipeline finished with Failed
    5 months ago
    Total: 569s
    #324915
  • Pipeline finished with Failed
    5 months ago
    Total: 618s
    #324914
  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

    This is now ready for review. Note, it's not perfect yet, but we decided to push this out for review and hopefully get it merged soon. We would then like to follow-up in separate issues and MRs with further details as we also learn from other tracks.

    Some explanation:

    • Default configuration provides basic privacy compliance and a consent management
    • Styling of the consent widgets will be addressed in a separate issue
    • Default content is under discussion in πŸ“Œ Default content for privacy requirements Active
    • If other recipes will bring additional requirements for consent management, they will have to enable the relevant settings for it. We'll consult with track leads on that separately.

    So, this review focusses on the basic principle of the setup. Further details to follow in child issues.

  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts

    Only one small nit, and obviously we need to reenable the tests, but no particular objections from me.

    Assigning to @pameeela for manual testing and review.

  • Pipeline finished with Failed
    5 months ago
    Total: 646s
    #325305
  • Pipeline finished with Failed
    5 months ago
    Total: 692s
    #325304
  • Pipeline finished with Failed
    5 months ago
    Total: 540s
    #325335
  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts

    Tests appear to be failing to due a legitimate bug in the Klaro module: https://git.drupalcode.org/project/drupal_cms/-/jobs/3209937#L52

    The problem is that, in their config schema, there's an extra period here: https://git.drupalcode.org/project/klaro/-/blob/3.x/config/schema/klaro....

    They'll need to fix that upstream, or we'll need to patch the module. Kicking back for that.

  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

    They are already on it.

  • Pipeline finished with Failed
    5 months ago
    Total: 557s
    #325366
  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

    This is fixed. There is now only 1 test failure left. It has to do with the footer menu. I can look into that tomorrow

  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts

    Tests seem to be passing now. Over to Pam for review.

  • Pipeline finished with Failed
    5 months ago
    Total: 630s
    #325438
  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts

    Fixed the tests. :)

  • πŸ‡¦πŸ‡ΊAustralia pameeela

    Happy to merge this and see how it goes. I am not 100% on enabling the consent manager by default but it will be easier to test and get feedback once it's merged, and we can easily change it to make it optional.

  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts
  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts
  • Pipeline finished with Skipped
    5 months ago
    #325482
  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts

    And on that note, shipped! Let's see how this goes and adjust as needed down the line. Onward!

  • πŸ‡©πŸ‡ͺGermany rkoller NΓΌrnberg, Germany
  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

    Thanks @phenaproxima, I've just added two more for credits as they helped with testing in getting this across the finish line.

  • Automatically closed - issue fixed for 2 weeks with no activity.

Production build 0.71.5 2024