Merge pull request #13547 from quarto-dev/cookie-consent/default-express

cderv · web-flow · commit 42623202862d · 2025-10-15T16:50:18.000+02:00
diff --git a/news/changelog-1.9.md b/news/changelog-1.9.md
@@ -35,6 +35,7 @@ All changes included in 1.9:
 
 - ([#13524](https://github.com/quarto-dev/quarto-cli/issues/13524)): Add support for Plausible Analytics via `plausible-analytics` configuration option. Users can either paste their Plausible script snippet directly in YAML or provide a path to a file containing the snippet using `plausible-analytics: { path: _plausible_snippet.html }`.
 - ([#13525](https://github.com/quarto-dev/quarto-cli/issues/13525)): Algolia Insights now uses privacy-friendly defaults: `useCookie: false` with random session tokens when cookie consent is not configured. When `cookie-consent: true` is enabled, Algolia scripts are deferred and only use cookies after user grants "tracking" consent, ensuring GDPR compliance.
+- ([#13547](https://github.com/quarto-dev/quarto-cli/issues/13547))`cookie-content: { type: express }` is now the default. Previously it was `type: implied`. It now means this will block cookies until the user expressly agrees to allow them (or continue blocking them if the user doesn’t agree).
 
 ## `publish`
 
diff --git a/src/project/types/website/website-analytics.ts b/src/project/types/website/website-analytics.ts
@@ -277,7 +277,7 @@ function cookieConsentConfiguration(
 ): CookieConsentConfiguration {
   return {
     siteName: "",
-    type: type || "implied",
+    type: type || "express",
     style: style || "simple",
     palette: palette || "light",
     policyUrl,
@@ -378,6 +378,8 @@ gtag('js', new Date());`);
   ].join("\n");
 }
 
+// configuration for the script are defined in
+// https://github.com/termsfeed/termsfeed-cookie-consent-4-0/blob/main/README.md
 function cookieConsentScript(
   config: CookieConsentConfiguration,
 ) {
diff --git a/src/resources/editor/tools/vs-code.mjs b/src/resources/editor/tools/vs-code.mjs
@@ -9522,12 +9522,12 @@ var require_yaml_intelligence_resources = __commonJS({
                       properties: {
                         type: {
                           enum: [
-                            "implied",
-                            "express"
+                            "express",
+                            "implied"
                           ],
                           description: {
                             short: "The type of consent that should be requested",
-                            long: "The type of consent that should be requested, using one of these two values:\n\n- `implied` (default): This will notify the user that the site uses cookies and permit them to change preferences, but not block cookies unless the user changes their preferences.\n\n- `express`: This will block cookies until the user expressly agrees to allow them (or continue blocking them if the user doesn\u2019t agree).\n"
+                            long: "The type of consent that should be requested, using one of these two values:\n\n- `express` (default): This will block cookies until the user expressly agrees to allow them (or continue blocking them if the user doesn\u2019t agree).\n\n- `implied`: This will notify the user that the site uses cookies and permit them to change preferences, but not block cookies unless the user changes their preferences.\n"
                           }
                         },
                         style: {
diff --git a/src/resources/editor/tools/yaml/all-schema-definitions.json b/src/resources/editor/tools/yaml/all-schema-definitions.json
diff --git a/src/resources/editor/tools/yaml/web-worker.js b/src/resources/editor/tools/yaml/web-worker.js
diff --git a/src/resources/editor/tools/yaml/yaml-intelligence-resources.json b/src/resources/editor/tools/yaml/yaml-intelligence-resources.json
@@ -2494,12 +2494,12 @@
                   "properties": {
                     "type": {
                       "enum": [
-                        "implied",
-                        "express"
+                        "express",
+                        "implied"
                       ],
                       "description": {
                         "short": "The type of consent that should be requested",
-                        "long": "The type of consent that should be requested, using one of these two values:\n\n- `implied` (default): This will notify the user that the site uses cookies and permit them to change preferences, but not block cookies unless the user changes their preferences.\n\n- `express`: This will block cookies until the user expressly agrees to allow them (or continue blocking them if the user doesn’t agree).\n"
+                        "long": "The type of consent that should be requested, using one of these two values:\n\n- `express` (default): This will block cookies until the user expressly agrees to allow them (or continue blocking them if the user doesn’t agree).\n\n- `implied`: This will notify the user that the site uses cookies and permit them to change preferences, but not block cookies unless the user changes their preferences.\n"
                       }
                     },
                     "style": {
diff --git a/src/resources/schema/definitions.yml b/src/resources/schema/definitions.yml
@@ -845,15 +845,16 @@
           - object:
               properties:
                 type:
-                  enum: [implied, express]
+                  enum: [express, implied]
                   description:
                     short: "The type of consent that should be requested"
                     long: |
                       The type of consent that should be requested, using one of these two values:
 
-                      - `implied` (default): This will notify the user that the site uses cookies and permit them to change preferences, but not block cookies unless the user changes their preferences.
+                      - `express` (default): This will block cookies until the user expressly agrees to allow them (or continue blocking them if the user doesn’t agree).
+
+                      - `implied`: This will notify the user that the site uses cookies and permit them to change preferences, but not block cookies unless the user changes their preferences.
 
-                      - `express`: This will block cookies until the user expressly agrees to allow them (or continue blocking them if the user doesn’t agree).
                 style:
                   enum: [simple, headline, interstitial, standalone]
                   description:
diff --git a/src/resources/schema/json-schemas.json b/src/resources/schema/json-schemas.json
@@ -891,8 +891,8 @@
                   "properties": {
                     "type": {
                       "enum": [
-                        "implied",
-                        "express"
+                        "express",
+                        "implied"
                       ]
                     },
                     "style": {
diff --git a/src/resources/types/schema-types.ts b/src/resources/types/schema-types.ts
@@ -431,12 +431,12 @@ For more information, see <https://plausible.io/docs/plausible-script> */;
 
 - `standalone`: An opaque overlay of the entire website. */;
     type?:
-      | "implied"
-      | "express"; /* The type of consent that should be requested, using one of these two values:
+      | "express"
+      | "implied"; /* The type of consent that should be requested, using one of these two values:
 
-- `implied` (default): This will notify the user that the site uses cookies and permit them to change preferences, but not block cookies unless the user changes their preferences.
+- `express` (default): This will block cookies until the user expressly agrees to allow them (or continue blocking them if the user doesn’t agree).
 
-- `express`: This will block cookies until the user expressly agrees to allow them (or continue blocking them if the user doesn’t agree). */
+- `implied`: This will notify the user that the site uses cookies and permit them to change preferences, but not block cookies unless the user changes their preferences. */
   } /* Quarto includes the ability to request cookie consent before enabling scripts that set cookies, using [Cookie Consent](https://www.cookieconsent.com/).
 
 The user’s cookie preferences will automatically control Google Analytics (if enabled) and can be used to control custom scripts you add as well. For more information see [Custom Scripts and Cookie Consent](https://quarto.org/docs/websites/website-tools.html#custom-scripts-and-cookie-consent). */;
diff --git a/src/resources/types/zod/schema-types.ts b/src/resources/types/zod/schema-types.ts
@@ -328,7 +328,7 @@ export const ZodBaseWebsite = z.object({
     z.enum(["express", "implied"] as const),
     z.boolean(),
     z.object({
-      type: z.enum(["implied", "express"] as const),
+      type: z.enum(["express", "implied"] as const),
       style: z.enum(
         ["simple", "headline", "interstitial", "standalone"] as const,
       ),
@@ -506,7 +506,7 @@ export const ZodBookSchema = z.object({
     z.enum(["express", "implied"] as const),
     z.boolean(),
     z.object({
-      type: z.enum(["implied", "express"] as const),
+      type: z.enum(["express", "implied"] as const),
       style: z.enum(
         ["simple", "headline", "interstitial", "standalone"] as const,
       ),
diff --git a/tests/docs/smoke-all/website-search/algolia-with-consent-implied/.gitignore b/tests/docs/smoke-all/website-search/algolia-with-consent-implied/.gitignore
@@ -0,0 +1,2 @@
+/.quarto/
+**/*.quarto_ipynb
diff --git a/tests/docs/smoke-all/website-search/algolia-with-consent-implied/_quarto.yml b/tests/docs/smoke-all/website-search/algolia-with-consent-implied/_quarto.yml
@@ -0,0 +1,17 @@
+project:
+  type: website
+
+website:
+  title: "Algolia With Cookie Consent Test"
+  search:
+    algolia:
+      application-id: "TEST_APP_ID"
+      search-only-api-key: "TEST_API_KEY"
+      index-name: "test-index"
+      analytics-events: true
+  cookie-consent:
+    type: implied
+
+format:
+  html:
+    theme: cosmo
diff --git a/tests/docs/smoke-all/website-search/algolia-with-consent-implied/index.qmd b/tests/docs/smoke-all/website-search/algolia-with-consent-implied/index.qmd
@@ -0,0 +1,27 @@
+---
+title: "Algolia Search With Cookie Consent"
+_quarto:
+  tests:
+    html:
+      ensureHtmlElements:
+        - 
+          # Ensure search options script exists
+          - 'script#quarto-search-options'
+          # Cookie consent element are loaded 
+          - script[src$='cookie-consent.js']
+      ensureFileRegexMatches:
+        - 
+          # Cookie consent should be enabled
+          - '"cookie-consent-enabled":\s*true'
+          # Scripts should be deferred with cookie-consent attribute
+          - 'type="text/plain"[^>]*cookie-consent="tracking"[^>]*>[\s\S]*search-insights'
+          # type should be implied per config
+          - 'cookieconsent.run\(\{[^}]*"consent_type":"implied"'
+---
+
+This test verifies that when `cookie-consent` is configured in the website settings:
+
+1. The Algolia search options JSON contains `"cookie-consent-enabled": true`
+2. Algolia Insights scripts are deferred with `type="text/plain" cookie-consent="tracking"`
+3. Scripts only execute after user grants "tracking" consent
+4. Cookie consent UI elements are present on the page
diff --git a/tests/docs/smoke-all/website-search/algolia-with-consent/index.qmd b/tests/docs/smoke-all/website-search/algolia-with-consent/index.qmd
@@ -15,6 +15,8 @@ _quarto:
           - '"cookie-consent-enabled":\s*true'
           # Scripts should be deferred with cookie-consent attribute
           - 'type="text/plain"[^>]*cookie-consent="tracking"[^>]*>[\s\S]*search-insights'
+          # Default type should be express
+          - 'cookieconsent.run\(\{[^}]*"consent_type":"express"'
 ---
 
 This test verifies that when `cookie-consent` is configured in the website settings:
