biscotti_cmp 1.1.3 copy "biscotti_cmp: ^1.1.3" to clipboard
biscotti_cmp: ^1.1.3 copied to clipboard

Published 10 days ago
SDKFlutter
PlatformAndroidiOS
→

Metadata

Biscotti CMP Flutter SDK — native consent management with IAB TCF 2.3 compliance.

More...

1.1.3 #

  • Fixed: consent changes now reach consumers immediately after Accept All or Save Preferences. The public stream and callback listener can be registered before configure(), replay the current local decision to late subscribers, and remain connected when the SDK is configured again. Replacing or disposing the internal consent manager no longer strands existing app subscriptions on a closed or permanently empty stream.
  • Consent sync now posts to the server's actual POST /api/v1/consent endpoint, with the website ID in the request body, instead of the nonexistent /consent/:websiteId path.
  • Local consent, pending sync payloads, visitor identifiers, and cached configuration are now isolated by website (and configuration caches also by locale and API environment). Queue retries preserve the exact original payload, heal only the matching decision and visitor, and follow stale successful uploads by syncing the current decision. Reconfiguration waits for prior writes and in-flight retry attempts before loading replacement state; a stuck shutdown fails closed instead of allowing old writes to overlap a replacement runtime.
  • Consent-gated SDK callbacks are isolated from one another and fenced against reentrant configure/dispose calls, so a throwing or nested initializer/teardown cannot hide a consent event or overwrite the newer lifecycle state.
  • Non-TCF mobile properties now fail cleanly: configuration clears stale process-wide IAB keys, removes persisted TC/purpose/vendor proof while retaining the user's category decision, and writes no IAB metadata for new category-only decisions. This prevents a previous TCF-enabled property from leaking its signal into a mobile integration where TCF is disabled.
  • Fixed: the sheet is rendered in the visitor's language, not the site's configured one. The server resolves the request locale into effectiveLanguage and localizes both the banner copy and the IAB purpose payload to it; the SDK read the site's bannerLanguage instead. A site configured en (or auto) therefore showed German copy from the server next to English SDK labels and encoded EN as the TC String's consent language. Category names are also resolved against the effective locale instead of the first entry in the response map.
  • Fixed: a website without an active banner no longer opens an empty sheet. bannerEnabled is now part of BannerConfig, and showConsentDialog() returns without presenting anything when the operator has switched the consent UI off. Previously the null banner parsed into blank copy with unlabelled buttons — which is what a newly created mobile-app property does before its own banner exists.
  • Fixed: the category detail view listed no services. The configured services arrive as a top-level array with their own category, while the parser only looked for a nested category.services key that the response does not contain. They are now attached to the matching category, so the vendor/service disclosure the operator configured is actually shown.
  • Categories the SDK cannot record a decision for (currently the server's ai category) are no longer displayed. Their toggle was rendered but the value was silently dropped, so the choice was neither persisted nor synced.
  • Fixed: the persisted configuration cache was lossy. After an app restart the legal links disappeared, the granular-view flag reset to true and the corner radius jumped back to 16, because the cache stores the parsed config and the writer and reader disagreed on where those fields live.
  • theme.accentColor now drives the toggle switches and the reject button, and a configured fontConfig.fontFamily is applied to the sheet's own text. Both were parsed and then ignored. Uploaded font FILES are deliberately never downloaded: the sheet renders before any consent exists, so fetching a remote font there would be the very request this component prevents.
  • Upgrade note: consent and visitor data written by 1.1.2 did not carry a reliable website owner. To prevent one configured website from reading or signing another website's state, ambiguous unscoped 1.1.2 data is not claimed during migration. Affected installations will receive a new per-website visitor identifier and must collect consent again once after upgrade.

1.1.2 #

  • Fixed: the iOS consent sheet failed while rendering granular TCF controls. On current Flutter releases, Switch.adaptive still requires a Material ancestor even inside a Cupertino app. The SDK now provides that ancestor itself while preserving the inherited Cupertino text metrics. Purpose, Special Feature and legitimate-interest switches — and the sheet's action buttons — work without requiring integrators to wrap their app in MaterialApp or Scaffold.
  • Consent payloads and the iOS plugin metadata now report the actual SDK version instead of the stale 1.0.0 value.

1.1.1 #

  • Fixed: the TC String Created / LastUpdated timestamps were 30 years in the past. The spec derives both from Date.UTC(year, month, day) / 100, which is DAY-LEVEL deciseconds since 1970-01-01. This SDK measured from 2000-01-01 and included the time of day, so the IAB's own decoder read a string written on 2024-01-15 as created on 1994-01-15. Because LastUpdated drives the 13-month re-consent reminder under TCF Policy, every string looked long expired. Android and iOS carried the same defect and are fixed in the same release; the web engine was never affected (it encodes through @iabtcf/core).
  • Removed a second, unused copy of the same wrong epoch constant, and three unused imports flagged by dart analyze.

1.1.0 #

  • The consent decision is one model shared with the Android, iOS and React Native SDKs, so the same answers now produce the same TC string on every platform.
    • Purpose 1 is explicit: refusing it survives granting another purpose.
    • Consent and legitimate interest stay separate axes.
    • A purpose that was never disclosed is not silently consented to.
  • BannerConfig reads the current server response, including the IAB TCF Layer 1 disclosure text. Previously the dialog had nothing to compose that text from and showed only a headline; the wording now comes from the IAB Global Vendor List via the Biscotti API, in all 44 supported locales.
  • textDirection from the API is honoured. Hebrew and Arabic used to fall back to left-to-right because the field was absent from the payload and the SDK defaulted to ltr.
  • 108 tests.

1.0.0 #

  • Initial release of the Biscotti CMP Flutter SDK.
  • IAB TCF 2.3 TC string encoding (CMP ID 497, policy version 5, service-specific): purposes, vendor consents / legitimate interests, and the disclosed-vendors segment derived from the active per-site vendor list.
  • Native consent dialog, consent-gated SDK initialisation, App Tracking Transparency coordination (iOS), offline consent queue with backend sync.
  • Android + iOS platform sides wired via method channels (Dart owns the consent/TCF logic).

← Metadata

0
likes
150
points
208
downloads

Documentation

API reference

Publisher

unverified uploader

Weekly Downloads

Metadata

Biscotti CMP Flutter SDK — native consent management with IAB TCF 2.3 compliance.

Repository (GitHub)
View/report issues

Topics

#consent #gdpr #privacy #tcf #cmp

License

MIT (license)

Dependencies

flutter

More

Packages that depend on biscotti_cmp

Packages that implement biscotti_cmp

Back