mirror of
https://github.com/supabase/supabase.git
synced 2026-10-11 12:25:05 +03:00
Sean Oliver
1cccc742d1
## Problem After PR #43221 gated `TelemetryTagManager` behind consent, the EU cookie consent banner started reappearing on every page load and when navigating between apps (www, studio, docs). Back in late February we changed `TelemetryTagManager` to only load when the user has accepted consent. This was the right call for GDPR — don't load tracking scripts before consent. But it created a chicken-and-egg problem with how the Usercentrics SDK stores consent. ## What happened When a user clicks Accept, the SDK writes `uc_settings` + `uc_user_interaction: true` to localStorage. Then the GTM script loads (now that consent is granted), and its Usercentrics integration immediately replaces those keys with a compressed `ucString` + `ucData` format — deleting the originals. On the next page load, `UC.init()` only knows how to read `uc_settings`. It can't find it (GTM deleted it), so it treats the user as brand new and shows the banner again. Before #43221, GTM loaded on every page unconditionally, so its integration was already present during `UC.init()` and could interpret the compressed format. Confirmed via production console monitoring — the exact sequence after clicking Accept: ``` setItem("uc_settings", ...) // SDK writes consent setItem("uc_user_interaction", "true") // SDK marks interaction removeItem("uc_settings") // GTM deletes SDK format removeItem("uc_user_interaction") // GTM deletes SDK format setItem("ucString", ...) // GTM writes compressed format setItem("ucData", ...) // GTM writes compressed format ``` ## Changes - Read `ucData` from localStorage **before** `UC.init()` to detect prior consent in the compressed format - If the SDK wants to show the banner but `ucData` shows all services were previously accepted, silently re-accept instead of re-prompting - Added try/catch around the SDK initialization (was fire-and-forget with no error handling, any failure was completely silent) - Error fallback also honors prior `ucData` consent if the SDK fails to initialize ## Testing Can't fully reproduce on staging previews because CSP blocks the GTM script there (so the storage migration never fires). Verified the root cause via production console monitoring with localStorage monkey-patching, and confirmed the `ucData` format persists across page loads on production. Closes FE-2648