Cookie Consent: config-driven core with per-feature toggles

[chihsuan]

Fixes WOOA7S-1639

Proposed changes

Part of the Cookie Consent all-sites hardening. Today Cookie_Consent::init() takes no arguments and wires up everything at once. This makes the core config-driven: a consumer passes a config to init(), an enabled switch turns the whole feature on/off, and each capability is an independent toggle. Called with no arguments, behavior is unchanged.

• Cookie_Consent::init( array $config = [] ) — resolves the config once, bails early if enabled is false, and registers each feature (banner, ccpa_page, footer_links, consent_log, tracks, geo) only when its toggle is on.
• New Config_Schema — one declarative schema (types, defaults, validation) that resolve() applies. Stateless; reads no options.
• The consent-log controller now receives its log settings (ip_mode, retention_days, versions) as an argument instead of reaching into globals.
• Kept the jetpack_cookie_consent_config and jetpack_cookie_consent_log_retention_days filters as override points for code that doesn't own the init() call. init() is the primary path (for the host plugin); the config filter runs over the resolved config and is re-resolved through Config_Schema, so third-party input is still validated. jetpack_cookie_consent_config stays a documented, versioned public API.
• Tests for the schema, the full on/off toggle matrix, the enqueued frontend config, and the override filters.

Related product discussion/links

• Linear: WOOA7S-1639 (design: WOOA7S-1597).

Does this pull request change what data or activity we track or use?

No. Behavior-preserving refactor — default IP handling stays drop, log retention stays 30 days.

Testing instructions

Unit tests (the primary check):

cd projects/packages/cookie-consent
composer test-php   # 124 tests, all green

Try the new API — the package runs inside a consumer (e.g. premium-analytics). To exercise the toggles, drop a mu-plugin on a site that has the package, e.g. wp-content/mu-plugins/cookie-consent-config.php:

<?php
use Automattic\Jetpack\CookieConsent\Cookie_Consent;

// Default — everything on, identical to before this PR.
Cookie_Consent::init();

// Selective — banner only; no CCPA page, Tracks, or consent log.
Cookie_Consent::init( [
    'features' => [
        'ccpa_page'   => false,
        'tracks'      => false,
        'consent_log' => false,
    ],
] );

// Kill switch — register nothing at all for this site.
Cookie_Consent::init( [ 'enabled' => false ] );

Add ?preview_cookie_consent=1 to a front-end URL to force the banner to show outside a GDPR region. With the selective config, confirm no CCPA page is auto-created and stats.wp.com/w.js is not enqueued, while the banner still renders. With enabled = false, confirm nothing is registered.

Third-party override — with the package booted, confirm another plugin can still adjust config without owning the init() call:

add_filter( 'jetpack_cookie_consent_config', function ( $config ) {
    $config['links']['cookie_policy_url'] = 'https://example.com/cookie-policy/';
    return $config;
} );

[github-actions]

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

• ✅ Include a description of your PR changes.
  
• ✅ Add a "[Status]" label (In Progress, Needs Review, ...).
  
• ✅ Add testing instructions.
  
• ✅ Specify whether this PR includes any changes to data or privacy.
  
• ✅ Add changelog entries to affected projects
  

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

---

Follow this PR Review Process:

1. Ensure all required checks appearing at the bottom of this PR are passing.
2. Make sure to test your changes on all platforms that it applies to. You're responsible for the quality of the code you ship.
3. You can use GitHub's Reviewers functionality to request a review.
4. When it's reviewed and merged, you will be pinged in Slack to deploy the changes to WordPress.com simple once the build is done.

If you have questions about anything, reach out in #jetpack-developers for guidance!

[Copilot]

Pull request overview

This PR refactors the cookie-consent package toward third-party consumption by introducing a schema-driven configuration resolver and a config-driven Cookie_Consent::init( array $config = [] ) entry point with per-feature hook gating.

Changes:

• Add Config_Schema as a single source of truth for config shape/defaults and a resolve() routine that stashes resolved config.
• Update Cookie_Consent::init() to accept config, support a master enabled switch, and register hooks conditionally per features.*.
• Update consent-log initialization to accept injected log config, and add/adjust PHPUnit coverage for schema resolution, feature toggles, and asset enqueue behavior.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
projects/packages/cookie-consent/tests/php/Init_Feature_Toggles_Test.php	New tests asserting feature toggles gate hook registration.
projects/packages/cookie-consent/tests/php/Enqueue_Assets_Test.php	New tests asserting enqueue emissions are gated and geo config contract is stable.
projects/packages/cookie-consent/tests/php/Cookie_Consent_Log_Versions_Test.php	Updates tests to inject config via stashed config instead of removed filters.
projects/packages/cookie-consent/tests/php/Consent_Log_Controller_Test.php	Updates controller tests for injected log config and new config injection approach.
projects/packages/cookie-consent/tests/php/Consent_Log_Controller_Log_Versions_Test.php	Updates log-version tests to use config injection helper.
projects/packages/cookie-consent/tests/php/Config_Test.php	Updates config tests to use public get_config() and stashed defaults behavior.
projects/packages/cookie-consent/tests/php/Config_Schema_Test.php	New unit tests for Config_Schema::schema() and resolve() behavior.
projects/packages/cookie-consent/tests/php/Config_Normalization_Test.php	Migrates normalization coverage from Cookie_Consent to Config_Schema.
projects/packages/cookie-consent/tests/php/class-testcase.php	Adds helpers to set/reset the private config stash for tests via reflection.
projects/packages/cookie-consent/src/schema/class-config-schema.php	Introduces schema + resolver for configuration defaults, coercion, and validation.
projects/packages/cookie-consent/src/cookie-banner-content.php	Allows templates to accept pre-resolved $copy/$categories (fallback when absent).
projects/packages/cookie-consent/src/class-cookie-consent.php	Implements config-driven init(), feature gating, stashed config, and updated asset emission.
projects/packages/cookie-consent/src/class-consent-log-controller.php	Accepts injected log config; uses it for IP mode/retention and updates docs accordingly.
projects/packages/cookie-consent/src/ccpa-content.php	Allows template to accept pre-resolved $copy (fallback when absent).
projects/packages/cookie-consent/README.md	Documents new init( $config ) API, master switch, feature toggles, and config structure.
projects/packages/cookie-consent/changelog/wooa7s-1639-config-driven-core	Adds changelog entry for the new config-driven core API.

[jp-launch-control]

Code Coverage Summary

This PR did not change code coverage!

That could be good or bad, depending on the situation. Everything covered before, and still is? Great! Nothing was covered before? Not so great. 🤷

Full summary · PHP report