Codex/magento1 privacy parity phase 1

.github/copilot-instructions.md

@@ -1,18 +1,18 @@
-# GitHub Copilot Instructions for BasicRum Analytics (Magento 1)
+# GitHub Copilot Instructions for Basicrum Analytics (Magento 1)
 
 ## Module Purpose
-This module integrates **Boomerang.js** (Real User Monitoring) into Magento 1 stores to capture frontend performance analytics. It sends beacon data to a configurable endpoint for analysis via the BasicRUM platform.
+This module integrates **Boomerang.js** (Real User Monitoring) into Magento 1 stores to capture frontend performance analytics. It sends beacon data to a configurable endpoint for analysis via the Basicrum platform.
 
 ### Key Features
 - **RUM Data Collection**: Captures page load timing, resource timing, and continuity metrics.
-- **GDPR/Privacy Compliance**: Supports opt-in mode for cookie consent requirements.
+- **GDPR/Privacy Compliance**: Uses consent-controlled loading by default for new installations.
 - **Configurable Beacon Endpoint**: Admin can specify where analytics data is sent.
 - **Async Loading**: Boomerang JS loads asynchronously to minimize performance impact.
 
 ## Project Context
 - **Framework**: Magento 1 (OpenMage LTS) / Modernized M1.
 - **Module Name**: `BasicRum_Analytics`
-- **Module Version**: `1.0.0`
+- **Module Version**: `1.1.0`
 - **Code Pool**: `community`
 - **Deployment**: Uses `modman` for file mapping.
 
@@ -33,7 +33,7 @@ This module integrates **Boomerang.js** (Real User Monitoring) into Magento 1 st
 app/code/community/BasicRum/Analytics/
 ├── Block/
 │   └── Boomerang/
-│       └── Loader.php              # Renders JS snippet in footer
+│       └── Loader.php              # Renders JS snippet before the closing body tag
 ├── Helper/
 │   ├── Data.php                    # Config retrieval methods
 │   └── PageTypeDetector.php        # Layout handle-based page type detection
@@ -56,8 +56,8 @@ js/basicrum/
 
 | Class | Purpose |
 |-------|---------|
-| `BasicRum_Analytics_Block_Boomerang_Loader` | Generates the Boomerang JS inline script. Injected into `footer` reference. |
-| `BasicRum_Analytics_Helper_Data` | Retrieves admin config values: `isEnabled()`, `isOptInRequired()`, `getBeaconEndpoint()`, `useUnminifiedLoaders()`. |
+| `BasicRum_Analytics_Block_Boomerang_Loader` | Generates the Boomerang JS inline script. Injected into the `before_body_end` reference. |
+| `BasicRum_Analytics_Helper_Data` | Retrieves and normalizes scoped admin configuration, including privacy and HTTP policy. |
 | `BasicRum_Analytics_Helper_PageTypeDetector` | Detects page type from layout handles (home, product, category, etc.). |
 
 ### Configuration Paths
@@ -66,14 +66,17 @@ Access via `Mage::getStoreConfig()` or `Mage::getStoreConfigFlag()`:
 | Path | Type | Description |
 |------|------|-------------|
 | `basicrum_analytics/general/enabled` | bool | Enable/disable the module |
-| `basicrum_analytics/general/opt_in_required` | bool | Use opt-in loader for GDPR compliance |
+| `basicrum_analytics/privacy/opt_in_required` | bool | Require a current-page opt-in signal before loading |
+| `basicrum_analytics/privacy/strip_query_string` | bool | Redact query strings in monitored URLs before beaconing |
 | `basicrum_analytics/general/beacon_endpoint` | string | URL where beacons are sent |
+| `basicrum_analytics/general/brum_site_id` | string | Required Basicrum backend UUID v4 |
 | `basicrum_analytics/wait_after_onload/enabled` | bool | Enable delayed beacon sending |
 | `basicrum_analytics/wait_after_onload/wait_ms` | int | Milliseconds to wait before sending beacon |
+| `basicrum_analytics/developer/development_mode` | bool | Allow HTTP Beacon Endpoints only for local testing |
 | `basicrum_analytics/developer/use_unminified_loaders` | bool | Load non-minified JS for debugging |
 
 ### JavaScript Assets
-Located in `js/basicrum/` and symlinked to Magento's `public/js/basicrum/`:
+Located in `js/basicrum/` and mapped by Modman to Magento's root-level `js/basicrum/` directory:
 
 | File | Purpose |
 |------|---------|
@@ -84,21 +87,22 @@ Located in `js/basicrum/` and symlinked to Magento's `public/js/basicrum/`:
 | `loaders/consent-boomerang-loader-v1-15.js` | GDPR-compliant loader (development) |
 
 ### Layout Integration
-The block is added to the `footer` reference in `basicrum_analytics.xml`:
+The block is added to the `before_body_end` reference in `basicrum_analytics.xml`:
 ```xml
-<reference name="footer">
+<reference name="before_body_end">
     <block type="basicrum_analytics/boomerang_loader" name="boomerang" />
 </reference>
 ```
 
 ## Specific Instructions
 1. **Modman**: When adding new files, always verify if the `modman` file needs updating to map the file from the source to the Magento root.
 2. **Layouts**: Layout updates reside in `app/design/frontend/base/default/layout/`.
-3. **JS/CSS**: Static assets are symlinked from `js/basicrum/` to the Magento root `public/js/` folder.
+3. **JavaScript**: Static assets under `js/basicrum/` are mapped by Modman to the Magento root `js/basicrum/` directory.
 4. **Configuration**:
    - `config.xml`: Module version, models, blocks, helpers, events.
    - `system.xml`: Backend configuration fields (ACL, Scope).
    - `adminhtml.xml`: Admin menu items and ACL resources.
+   - Keep Beacon Endpoint and Brum Site ID visible while the module is disabled. Privacy controls and consent guidance live in General Settings, with `config_path` preserving the established `basicrum_analytics/privacy/*` storage paths. Runtime-only privacy, wait, and developer fields depend on `basicrum_analytics/general/enabled`; preserve those dependencies and Magento's scoped inheritance behavior. The wait toggle uses the unique admin field ID `wait_enabled` with `config_path` mapped to the established public path `basicrum_analytics/wait_after_onload/enabled`, avoiding duplicate dependency node names in Magento's merged XML.
 
 ## Important Patterns
 - **Helpers**: Always access helpers via `Mage::helper('basicrum_analytics')`.
@@ -111,7 +115,8 @@ The block is added to the `footer` reference in `basicrum_analytics.xml`:
 ## Boomerang Configuration
 The module configures Boomerang with these settings:
 - `beacon_url`: From admin config.
-- `instrument_xhr`: Enabled for XHR tracking.
+- `instrument_xhr`: Disabled.
+- `strip_query_string`: Scoped privacy setting; disabled by default for compatibility.
 - `Continuity.enabled`: Tracks user interaction metrics.
 - `ResourceTiming.enabled`: Captures resource load times.
 - `secure_cookie` & `same_site_cookie`: Set to `true` and `"Strict"` for security.

.github/workflows/ci.yml

@@ -0,0 +1,139 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - '**'
+    tags-ignore:
+      - 'v*.*.*' # Version tags run this workflow through release.yml.
+  pull_request:
+  workflow_call:
+    inputs:
+      release_tag:
+        type: string
+        default: ''
+    outputs:
+      archive_name:
+        value: ${{ jobs.browser-and-package.outputs.archive_name }}
+
+permissions:
+  contents: read
+
+jobs:
+  php:
+    name: PHP ${{ matrix.php }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ["7.0", "7.4", "8.3"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+      - name: PHP syntax
+        run: find app tests/php tests/platform -type f -name '*.php' -print0 | xargs -0 -n1 php -l
+      - name: PHP configuration and rendering tests
+        run: php tests/php/run.php
+
+  browser-and-package:
+    name: Browser and package checks
+    runs-on: ubuntu-latest
+    outputs:
+      archive_name: ${{ steps.package.outputs.archive_name }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - name: Install JavaScript dependencies
+        run: npm ci
+      - name: Install Chromium
+        run: npx playwright install --with-deps chromium
+      - name: Browser loader tests
+        run: npm test
+      - name: Install XML and archive tools
+        run: sudo apt-get update && sudo apt-get install -y libxml2-utils zip unzip
+      - name: XML and package checks
+        run: bash tests/check-package.sh
+      - name: Release tooling regression tests
+        run: |
+          node --test tests/release/version.test.js
+          bash tests/release/package.sh
+      - name: Build installable release ZIP
+        id: package
+        env:
+          BASICRUM_RELEASE_TAG: ${{ inputs.release_tag }}
+        run: |
+          version="$(node tools/release-version.js)"
+          bash tools/build-release.sh
+          echo "archive_name=basicrum-magento-1-$version.zip" >> "$GITHUB_OUTPUT"
+      - name: Upload candidate ZIP and checksum
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: basicrum-magento-1-release
+          path: |
+            release/*.zip
+            release/*.zip.sha256
+          if-no-files-found: error
+          retention-days: 14
+
+  platform-matrix:
+    name: ${{ matrix.name }}
+    needs: browser-and-package
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Magento CE 1.9.4.5 / PHP 7.4
+            platform: magento-ce
+            repository: OpenMage/magento-mirror
+            ref: 1.9.4.5
+            php: "7.4"
+          - name: OpenMage 20.18.0 / PHP 8.3
+            platform: openmage
+            repository: OpenMage/magento-lts
+            ref: v20.18.0
+            php: "8.3"
+    services:
+      database:
+        image: mariadb:10.11
+        env:
+          MARIADB_DATABASE: basicrum
+          MARIADB_USER: basicrum
+          MARIADB_PASSWORD: basicrum
+          MARIADB_ROOT_PASSWORD: root
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd="healthcheck.sh --connect --innodb_initialized"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ matrix.repository }}
+          ref: ${{ matrix.ref }}
+          path: platform
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+          extensions: ctype, curl, dom, ftp, gd, iconv, intl, mbstring, mysqli, pdo_mysql, simplexml, soap, zip
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: basicrum-magento-1-release
+          path: release
+      - name: Install release verification tools
+        run: sudo apt-get update && sudo apt-get install -y libxml2-utils unzip
+      - name: Install and verify packaged module on ${{ matrix.name }}
+        env:
+          BASICRUM_TEST_RELEASE_ZIP: ${{ github.workspace }}/release/${{ needs.browser-and-package.outputs.archive_name }}
+        run: bash tests/platform/run.sh "${{ matrix.platform }}" "$GITHUB_WORKSPACE/platform"

.github/workflows/release.yml

@@ -0,0 +1,52 @@
+name: Release Extension
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  checks:
+    name: Test the tagged release
+    uses: ./.github/workflows/ci.yml
+    with:
+      release_tag: ${{ github.ref_name }}
+
+  publish:
+    name: Publish the tested ZIP
+    needs: checks
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: basicrum-magento-1-release
+          path: release
+      - name: Install verification tools
+        run: sudo apt-get update && sudo apt-get install -y libxml2-utils unzip
+      - name: Recheck the tested archive without rebuilding
+        env:
+          ARCHIVE_NAME: ${{ needs.checks.outputs.archive_name }}
+        run: bash tools/verify-release.sh "release/$ARCHIVE_NAME"
+      - name: Create GitHub release and attach assets
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+        with:
+          tag_name: ${{ github.ref_name }}
+          generate_release_notes: true
+          prerelease: ${{ contains(github.ref_name, '-') }}
+          make_latest: ${{ contains(github.ref_name, '-') && 'false' || 'legacy' }}
+          fail_on_unmatched_files: true
+          files: |
+            release/${{ needs.checks.outputs.archive_name }}
+            release/${{ needs.checks.outputs.archive_name }}.sha256

.gitignore

@@ -0,0 +1,4 @@
+/node_modules/
+/.test-results/
+/playwright-report/
+/release/