Update OneTrust installation script

- Put it behind a feature flag
- Add a config value for the OneTrust id
- Add tests

app/helpers/auth_helper.rb

@@ -169,6 +169,13 @@ module AuthHelper
       !current_user
   end
 
+  def one_trust_enabled?
+    Feature.enabled?(:ecomm_instrumentation_google_analytics_cookies, nil, type: :ops) &&
+      extra_config.has_key?('one_trust_id') &&
+      extra_config.one_trust_id.present? &&
+      !current_user
+  end
+
   def auth_app_owner_text(owner)
     return unless owner
 

app/views/layouts/_one_trust.html.haml

-<!-- OneTrust -->
-= javascript_include_tag "https://cdn.cookielaw.org/consent/-/OtAutoBlock.js"
-%script{ :src => "https://cdn.cookielaw.org/scripttemplates/otSDKStub.js", :charset => "UTF-8", :"data-domain-script" => "-", :defer => true, :nonce => true }
-= javascript_tag do
-  :plain
-    function OptanonWrapper() { }
+- if one_trust_enabled?
+  <!-- OneTrust -->
+  = javascript_include_tag "https://cdn.cookielaw.org/consent/#{extra_config.one_trust_id}/OtAutoBlock.js"
+  %script{ :src => "https://cdn.cookielaw.org/scripttemplates/otSDKStub.js", :charset => "UTF-8", :"data-domain-script" => extra_config.one_trust_id, :defer => true, :nonce => true }
+  = javascript_tag nonce: true do
+    :plain
+      function OptanonWrapper() { }

config/feature_flags/ops/ecomm_instrumentation_google_analytics_cookies.yml

+---
+name: ecomm_instrumentation_google_analytics_cookies
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/71242
+rollout_issue_url:
+milestone: '14.4'
+type: ops
+group: group::product intelligence
+default_enabled: false

config/gitlab.yml.example

@@ -1295,6 +1295,9 @@ production: &base
     ## Google tag manager
     # google_tag_manager_id: '_your_tracking_id'
 
+    ## OneTrust
+    # one_trust_id: '_your_one_trust_id'
+
     ## Matomo analytics.
     # matomo_url: '_your_matomo_url'
     # matomo_site_id: '_your_matomo_site_id'

spec/helpers/auth_helper_spec.rb

@@ -314,6 +314,45 @@ RSpec.describe AuthHelper do
     end
   end
 
+  describe '#one_trust_enabled?' do
+    let(:user) { nil }
+
+    before do
+      stub_config(extra: { one_trust_id: 'key' })
+      allow(helper).to receive(:current_user).and_return(user)
+    end
+
+    subject(:one_trust_enabled?) { helper.one_trust_enabled? }
+
+    context 'with ecomm_instrumentation_google_analytics_cookies feature flag enabled' do
+      before do
+        stub_feature_flags(ecomm_instrumentation_google_analytics_cookies: true)
+      end
+
+      context 'when current user is set' do
+        let(:user) { instance_double('User') }
+
+        it { is_expected.to be_falsey }
+      end
+
+      context 'when no id is set' do
+        before do
+          stub_config(extra: {})
+        end
+
+        it { is_expected.to be_falsey }
+      end
+
+      context 'when id is set and no user is set' do
+        before do
+          stub_config(extra: { one_trust_id: 'key' })
+        end
+
+        it { is_expected.to be_truthy }
+      end
+    end
+  end
+
   describe '#auth_app_owner_text' do
     shared_examples 'generates text with the correct info' do
       it 'includes the name of the application owner' do