From 655f84d88700f9044013b212b827a01ca27e21bf Mon Sep 17 00:00:00 2001
From: Hamza Khalid <hamza.khalid@levellingup.gov.uk>
Date: Mon, 24 Jun 2024 00:23:48 +0100
Subject: [PATCH 1/4] FS-3873:

- Cookie Policy page added
- Route to cookie policy page added
- Cookie banner added with accept and decline options
- Unused JS functions removed
- Show all sections and show are being rendred by the govuk frontend in the version being used
---
 .../templates/assessor_tool_dashboard.html    |  18 +-
 app/blueprints/shared/routes.py               |  10 ++
 app/static/src/js/fsd_cookies.js              |  54 ++++++
 app/static/src/js/helpers.js                  |  58 ------
 app/static/src/styles/govuk-overrides.css     |  15 ++
 app/templates/cookie_policy.html              | 167 ++++++++++++++++++
 app/templates/head.html                       |  89 ++++++++--
 build.py                                      |   6 +
 config/envs/default.py                        |  72 +++++++-
 create_app.py                                 |   2 +-
 requirements-dev.txt                          |   2 +-
 requirements.in                               |   2 +-
 requirements.txt                              |   2 +-
 static_assets.py                              |   1 +
 14 files changed, 408 insertions(+), 90 deletions(-)
 create mode 100644 app/static/src/js/fsd_cookies.js
 create mode 100644 app/templates/cookie_policy.html

diff --git a/app/blueprints/assessments/templates/assessor_tool_dashboard.html b/app/blueprints/assessments/templates/assessor_tool_dashboard.html
index 23512eb3..92309f2d 100644
--- a/app/blueprints/assessments/templates/assessor_tool_dashboard.html
+++ b/app/blueprints/assessments/templates/assessor_tool_dashboard.html
@@ -30,14 +30,9 @@ <h2 class="govuk-heading-l">
         </h2>
 
         <div class="govuk-accordion" data-module="govuk-accordion" id="accordion-default">
-            {% if funds %}
-            <div class="govuk-accordion__controls">
-                <button type="button" class="govuk-accordion__show-all">
-                    <span class="govuk-accordion-nav__chevron govuk-accordion-nav__chevron--down"></span>
-                    <span class="govuk-accordion__show-all-text" data-qa="show_all_sections">Show all sections</span>
-                </button>
-            </div>
-            {% endif %}
+            <!-- {% if funds %} -->
+            <!-- "Show all sections" button being shown by the govuk-frontend automatically -->
+            <!-- {% endif %} -->
             {% for fund_id in funds %}
                 <div class="govuk-accordion__section">
                     <div class="govuk-accordion__section-header">
@@ -50,13 +45,6 @@ <h2 class="govuk-accordion__section-heading">
                                       {{ funds[fund_id].name }} ({{ fund_summaries[fund_id] | length }})
                                     </span>
                                 </span>
-                                <span class="govuk-visually-hidden govuk-accordion__section-heading-divider">, </span>
-                                    <span class="govuk-accordion__section-toggle" data-nosnippet="">
-                                    <span class="govuk-accordion__section-toggle-focus">
-                                        <span class="govuk-accordion-nav__chevron govuk-accordion-nav__chevron--down"></span>
-                                        <span class="govuk-accordion__section-toggle-text">Show</span>
-                                    </span>
-                                </span>
                             </button>
                         </h2>
                         <div id="accordion-default-content-{{ loop.index }}" class="govuk-accordion__section-content display-none"
diff --git a/app/blueprints/shared/routes.py b/app/blueprints/shared/routes.py
index ee10a92b..ff49a99b 100644
--- a/app/blueprints/shared/routes.py
+++ b/app/blueprints/shared/routes.py
@@ -1,4 +1,5 @@
 from flask import Blueprint
+from flask import current_app
 from flask import render_template
 
 from app.blueprints.services.data_services import get_default_round_data
@@ -17,6 +18,15 @@ def index():
     )
 
 
+@shared_bp.route("/cookie_policy", methods=["GET"])
+def cookie_policy():
+    current_app.logger.info("Cookie policy page loaded.")
+    return render_template(
+        "cookie_policy.html",
+        migration_banner_enabled=Config.MIGRATION_BANNER_ENABLED,
+    )
+
+
 @shared_bp.route("/help", methods=["GET"])
 def get_help():
     round_data = get_default_round_data() or {}
diff --git a/app/static/src/js/fsd_cookies.js b/app/static/src/js/fsd_cookies.js
new file mode 100644
index 00000000..d48fa51a
--- /dev/null
+++ b/app/static/src/js/fsd_cookies.js
@@ -0,0 +1,54 @@
+
+const DEFAULT_CONSENT = {'ad_storage': 'denied', 'analytics_storage': 'denied', 'personalisation_storage': 'denied',
+'functionality_storage': 'denied', 'security_storage': 'denied',}
+const COOKIE_FSD_CONSENT = "fsd_cookie_consent";
+
+function readConsentCookie() {
+    const cookie = document.cookie.split(";").find(c => c.trim().startsWith(`${COOKIE_FSD_CONSENT}=`));
+    return cookie ? JSON.parse(atob(cookie.split("=")[1])) : null;
+}
+
+function updateCookieConsent(value) {
+    const consentObject = { 'analytics_storage': value };
+    const currentDomain = window.location.hostname;
+    const slice = currentDomain.includes("access-funding") ? -4 : -3;
+    const targetDomain = currentDomain.split('.').slice(slice).join('.');
+    document.cookie = `${COOKIE_FSD_CONSENT}=${btoa(JSON.stringify(consentObject))};path=` + "/" + `;domain=${targetDomain};secure;SameSite=None`;
+
+    const notificationBanner = document.getElementById("cookie-setting-saved-banner")
+    if (notificationBanner) {
+      notificationBanner.removeAttribute("hidden");
+      notificationBanner.scrollIntoView();
+    }
+
+}
+function acceptCookies() {
+    updateCookieConsent('granted');
+    document.getElementById("cookies-choice-msg").setAttribute("hidden", "true");
+    document.getElementById("cookies-accepted-msg").removeAttribute("hidden");
+}
+
+function denyCookies() {
+    updateCookieConsent('denied');
+    document.getElementById("cookies-choice-msg").setAttribute("hidden", "true");
+    document.getElementById("cookies-rejected-msg").removeAttribute("hidden");
+}
+
+function hideCookiesMessage() {
+    document.getElementById("cookie-banner").setAttribute("hidden", "true");
+}
+
+function unhideCookiesMessage() {
+    document.getElementById("cookie-banner").removeAttribute("hidden");
+}
+
+
+function saveAnalyticsPrefs(){
+  if (document.getElementById("cookies-analytics").checked) {
+    updateCookieConsent('granted');
+    hideCookiesMessage();
+  } else {
+    updateCookieConsent('denied');
+    hideCookiesMessage();
+  }
+}
diff --git a/app/static/src/js/helpers.js b/app/static/src/js/helpers.js
index 4d695e53..b4161cb9 100644
--- a/app/static/src/js/helpers.js
+++ b/app/static/src/js/helpers.js
@@ -66,61 +66,3 @@ Array.from(tabAnchors).forEach(tabAnchor => {
         }
     });
 })
-
-
-function toggleAccordionOff(accordion, index) {
-    const content = document.getElementById(`accordion-default-content-${index}`);
-    content.style.display = ''; // Set display to empty to hide the content
-    const textSpan = accordion.querySelector('.govuk-accordion__section-toggle-text');
-    textSpan.textContent = 'Show'; // Change the text to 'Show'
-    const chavron = accordion.querySelector('.govuk-accordion-nav__chevron');
-    chavron.classList.add('govuk-accordion-nav__chevron--down'); // Add the class to change the chevron direction
-}
-
-function toggleAccordionOn(accordion, index) {
-    const content = document.getElementById(`accordion-default-content-${index}`);
-    content.style.display = 'block'; // Set display to 'block' to show the content
-    const textSpan = accordion.querySelector('.govuk-accordion__section-toggle-text');
-    textSpan.textContent = 'Hide'; // Change the text to 'Hide'
-    const chavron = accordion.querySelector('.govuk-accordion-nav__chevron');
-    chavron.classList.remove('govuk-accordion-nav__chevron--down'); // Remove the class to change the chevron direction
-}
-
-function toggleAccordion(accordion, index) {
-    const content = document.getElementById(`accordion-default-content-${index}`);
-    if (content.style.display) {
-        toggleAccordionOff(accordion, index);
-    } else {
-        toggleAccordionOn(accordion, index);
-    }
-}
-
-const closedAccordionButtons = Array.from(document.getElementsByClassName('landing-accordion'))
-closedAccordionButtons.forEach((accordion, index) => {
-    accordion.onclick = (_e) => {
-        toggleAccordion(accordion, index + 1);
-    }
-})
-
-const showAllAccordion = document.querySelector('.govuk-accordion__show-all');
-if (showAllAccordion) {
-    showAllAccordion.toggledOn = false;
-    showAllAccordion.onclick = (_e) => {
-        showAllAccordion.toggledOn = !showAllAccordion.toggledOn;
-        const showAllText = showAllAccordion.querySelector('.govuk-accordion__show-all-text');
-        const showAllChavron = showAllAccordion.querySelector('.govuk-accordion-nav__chevron');
-        if (showAllAccordion.toggledOn) {
-            closedAccordionButtons.forEach((accordion, index) => {
-                toggleAccordionOn(accordion, index + 1);
-            })
-            showAllText.textContent = 'Hide all sections';
-            showAllChavron.classList.remove('govuk-accordion-nav__chevron--down');
-        } else {
-            closedAccordionButtons.forEach((accordion, index) => {
-                toggleAccordionOff(accordion, index + 1);
-            })
-            showAllText.textContent = 'Show all sections';
-            showAllChavron.classList.add('govuk-accordion-nav__chevron--down');
-        }
-    }
-}
diff --git a/app/static/src/styles/govuk-overrides.css b/app/static/src/styles/govuk-overrides.css
index ac41712a..f2e82e8d 100644
--- a/app/static/src/styles/govuk-overrides.css
+++ b/app/static/src/styles/govuk-overrides.css
@@ -363,6 +363,11 @@ list-style-type: upper-roman;
     margin: auto;
 }
 
+.govuk-width-container-original {
+    max-width: 960px;
+    margin-right: 15px;
+    margin-left: 15px;
+}
 
 .govuk-link__white_font {
     color: white !important;
@@ -404,3 +409,13 @@ a.govuk-link.deactivate {
 /* .govuk-summary-list:first-of-type {
     border-top: 1px solid #b1b4b6;
 } */
+
+#accept_cookies_btn, #deny_cookies_btn, #cookies-accepted-msg > div.govuk-button-group > button {
+    background-color: #00703c;
+}
+
+.govuk-main-wrapper-cookies-page {
+    display: block;
+    padding-top: 20px;
+    padding-bottom: 20px
+}
diff --git a/app/templates/cookie_policy.html b/app/templates/cookie_policy.html
new file mode 100644
index 00000000..f0182af9
--- /dev/null
+++ b/app/templates/cookie_policy.html
@@ -0,0 +1,167 @@
+{% extends "base.html" %}
+
+{%- from 'govuk_frontend_jinja/components/inset-text/macro.html' import govukInsetText -%}
+{% from "macros/migration_banner.html" import migration_banner %}
+{%- from "govuk_frontend_jinja/components/radios/macro.html" import govukRadios %}
+{% set pageHeading %}Cookies{% endset %}
+{% block content %}
+
+    <div class="govuk-main-wrapper-cookies-page">
+  <div class="govuk-grid-column-two-thirds">
+    {% if migration_banner_enabled %}
+      {{ migration_banner() }}
+    {% endif %}
+
+    <div id="cookie-setting-saved-banner" class="govuk-notification-banner govuk-notification-banner--success js-cookies-page-success" role="alert" aria-labelledby="govuk-notification-banner-title" data-module="govuk-notification-banner" hidden>
+      <div class="govuk-notification-banner__header">
+        <h2 class="govuk-notification-banner__title" id="govuk-notification-banner-title">
+          Success
+        </h2>
+      </div>
+      <div class="govuk-notification-banner__content">
+        <p class="govuk-notification-banner__heading">Your cookie settings were saved</p>
+      </div>
+    </div>
+
+    <h1 class="govuk-heading-l">{{ pageHeading }}</h1>
+    <p class="govuk-body">
+        Cookies are small files saved on your phone, tablet or computer when you visit a website.
+    </p>
+    <p class="govuk-body">We use cookies to make the {{ service_title }} service work.</p>
+
+    <h2 class="govuk-heading-m" id="essential-cookies">Essential cookies</h2>
+    <p class="govuk-body">Essential cookies keep your information secure while you use the {{ service_title }} service. We do not need to ask permission to use them.</p>
+    <table class="govuk-table">
+        <caption class="govuk-visually-hidden">Essential cookies</caption>
+        <thead class="govuk-table__head">
+            <tr>
+                <th class="govuk-table__header">Name</th>
+                <th class="govuk-table__header">Purpose</th>
+                <th class="govuk-table__header">Expires</th>
+            </tr>
+        </thead>
+        <tbody class="govuk-table__body">
+            <tr class="govuk-table__row">
+                <td class="govuk-table__cell">
+                  session_cookie
+                </td>
+                <td width="50%" class="govuk-table__cell">
+                  Used to keep you connected to your current session
+                </td>
+                <td class="govuk-table__cell">
+                  When you close your browser
+                </td>
+            </tr>
+            <tr class="govuk-table__row">
+                <td class="govuk-table__cell">
+                  fsd_user_token
+                </td>
+                <td width="50%" class="govuk-table__cell">
+                  Used to keep you signed in
+                </td>
+                <td class="govuk-table__cell">
+                  24 hours
+                </td>
+            </tr>
+            <tr class="govuk-table__row">
+                <td class="govuk-table__cell">
+                  session
+                </td>
+                <td width="50%" class="govuk-table__cell">
+                  Set to remember information you’ve entered into a form
+                </td>
+                <td class="govuk-table__cell">
+                  When you close your browser
+                </td>
+            </tr>
+        </tbody>
+    </table>
+
+    <h2 class="govuk-heading-m" id="essential-cookies">Analytics cookies (optional)</h2>
+    <p class="govuk-body">With your permission, we use Google Analytics to collect data about how you use this service. This information helps us to improve our service.</p>
+    <p class="govuk-body">Google is not allowed to use or share our analytics data with anyone.</p>
+    <p class="govuk-body">Google Analytics stores anonymised information about:</p>
+    <ul class="govuk-list govuk-list--bullet">
+      <li>how you got to {{ service_title }}</li>
+      <li>the pages you visit on {{ service_title }} and how long you spend on them</li>
+      <li>any errors you see while using {{ service_title }}</li>
+    </ul>
+    <table class="govuk-table">
+      <caption class="govuk-visually-hidden">Analytics cookies (optional)</caption>
+      <thead class="govuk-table__head">
+        <tr>
+          <th class="govuk-table__header">Name</th>
+          <th class="govuk-table__header">Purpose</th>
+          <th class="govuk-table__header">Expires</th>
+        </tr>
+      </thead>
+      <tbody class="govuk-table__body">
+        <tr class="govuk-table__row">
+          <td class="govuk-table__cell">
+            _ga
+          </td>
+          <td class="govuk-table__cell">
+            Checks if you have visited {{ service_title }} before. This helps us count how many people visit our site.
+          </td>
+          <td class="govuk-table__cell">
+            2 years
+          </td>
+        </tr>
+        <tr class="govuk-table__row">
+          <td class="govuk-table__cell">
+            _ga_GTM-M5J9Q8HV
+          </td>
+          <td class="govuk-table__cell">
+            Checks if you have visited {{ service_title }} before. This helps us to count how many people visit our site and persist a session state.
+          </td>
+          <td class="govuk-table__cell">
+            2 years
+          </td>
+        </tr>
+      </tbody>
+    </table>
+    <div class="govuk-body" id="cookie-settings">
+      {{ govukRadios({
+        "id": "cookies-analytics",
+        "name": "cookies-analytics",
+        "fieldset": {
+        "legend": {
+            "text": "Do you want to accept analytics cookies?",
+            "isPageHeading": false,
+            "classes": "govuk-fieldset__legend--s"
+          }
+        },
+        "items": [
+          {"value":"granted", "text":"Yes"},{"value": "denied", "text":"No"}
+        ]})
+      }}
+      <button class="govuk-button" data-module="govuk-button" id="cookie-settings-save">
+        Save cookie settings
+      </button>
+    </div>
+
+  </div>
+</div>
+<script nonce="{{ csp_nonce() }}" type="text/javascript" src="{{ url_for('static', filename='js/fsd_cookies.js') }}"></script>
+<script nonce="{{ csp_nonce() }}">
+
+   window.dataLayer = window.dataLayer || [];
+  function gtag() { dataLayer.push(arguments) }
+
+  function initCookieRadios(){
+    localConsentMode = readConsentCookie();
+    if (localConsentMode != null){
+      if (localConsentMode.analytics_storage == 'granted'){
+        document.getElementById("cookies-analytics").checked = true;
+      } else {
+        document.getElementById("cookies-analytics-2").checked = true;
+      }
+    }
+    document.getElementById("cookie-settings-save").addEventListener("click", saveAnalyticsPrefs);
+
+
+  }
+
+  initCookieRadios();
+</script>
+{% endblock content %}
diff --git a/app/templates/head.html b/app/templates/head.html
index ffe7119c..dd609113 100644
--- a/app/templates/head.html
+++ b/app/templates/head.html
@@ -13,24 +13,89 @@
     <script nonce="{{ csp_nonce() }}" type="text/javascript" src="{{ ASSET_URL }}" defer></script>
 {% endassets %}
 
-<script>
+{% block bodyStart %}
+<div class="govuk-cookie-banner" data-nosnippet role="region" aria-label="Cookies on Access Funding"
+    id="cookie-banner" hidden>
+    <div class="govuk-cookie-banner__message govuk-width-container" id="cookies-choice-msg">
+        <div class="govuk-grid-row govuk-width-container-original">
+            <div class="govuk-grid-column-two-thirds">
+                <h2 class="govuk-cookie-banner__heading govuk-heading-m">Cookies on Access Funding</h2>
+                <div class="govuk-cookie-banner__content">
+                    <p class="govuk-body">We use some essential cookies to make this service work.</p>
+                    <p class="govuk-body">We'd also like to use analytics cookies so we can understand how you use the service and make improvements.</p>
+                </div>
+            </div>
+        </div>
+        <div class="govuk-button-group">
+            <button type="button" class="govuk-button" data-module="govuk-button" id="accept_cookies_btn">
+                Accept analytics cookies
+            </button>
+            <button type="button" class="govuk-button" data-module="govuk-button" id="deny_cookies_btn">
+                Reject analytics cookies
+            </button>
+            <a class="govuk-link" href="{{ url_for('shared_bp.cookie_policy') }}">View cookies</a>
+        </div>
+    </div>
+    <div class="govuk-cookie-banner__message govuk-width-container" role="alert" id="cookies-accepted-msg" hidden>
+        <div class="govuk-grid-row">
+            <div class="govuk-grid-column-two-thirds">
+                <div class="govuk-cookie-banner__content">
+                    <p class="govuk-body">You've accepted analytics cookies. You can <a class="govuk-link"
+                            href="{{ url_for('shared_bp.cookie_policy') }}">change your cookie settings</a> at any time.</p>
+                </div>
+            </div>
+        </div>
+        <div class="govuk-button-group">
+            <button type="button" class="govuk-button" data-module="govuk-button" name="cookies-hide-btn">
+                Hide cookie message
+            </button>
+        </div>
+    </div>
+    <div class="govuk-cookie-banner__message govuk-width-container" role="alert" id="cookies-rejected-msg" hidden>
+        <div class="govuk-grid-row">
+            <div class="govuk-grid-column-two-thirds">
+                <div class="govuk-cookie-banner__content">
+                    <p class="govuk-body">You've rejected analytics cookies. You can <a class="govuk-link"
+                            href="{{ url_for('shared_bp.cookie_policy') }}">change your cookie settings</a> at any time.</p>
+                </div>
+            </div>
+        </div>
+        <div class="govuk-button-group">
+            <button type="button" class="govuk-button" data-module="govuk-button" name="cookies-hide-btn">
+                Hide cookie message
+            </button>
+        </div>
+    </div>
+</div>
+{% endblock bodyStart %}
+
+<script nonce="{{ csp_nonce() }}" type="text/javascript" src="{{ url_for('static', filename='js/fsd_cookies.js') }}"></script>
+<script nonce="{{ csp_nonce() }}">
     window.dataLayer = window.dataLayer || [];
-    function gtag(){dataLayer.push(arguments)}
+    function gtag() { dataLayer.push(arguments) }
+
+    function initCookieState() {
+        const localConsentMode = readConsentCookie();
+
+        if (!localConsentMode) {
+            gtag('consent', 'default', DEFAULT_CONSENT);
+            unhideCookiesMessage();
+        } else {
+            gtag('consent', 'default', readConsentCookie());
+        }
 
-    if(localStorage.getItem('consentMode') === null) {
-        gtag('consent', 'default', {
-            'ad_storage': 'denied',
-            'analytics_storage': 'denied',
-            'personalisation_storage': 'denied',
-            'functionality_storage': 'denied',
-            'security_storage': 'denied',
+        document.getElementById("accept_cookies_btn").addEventListener("click", acceptCookies);
+        document.getElementById("deny_cookies_btn").addEventListener("click", denyCookies);
+        document.getElementsByName("cookies-hide-btn").forEach(element => {
+            element.addEventListener("click", hideCookiesMessage);
         });
-    } else {
-        gtag('consent', 'default', JSON.parse(localStorage.getItem('consentMode')));
     }
+
+    initCookieState();
 </script>
+
 <!-- Google Tag Manager -->
-<script>(function (w, d, s, l, i) {
+<script nonce="{{ csp_nonce() }}">(function (w, d, s, l, i) {
     w[l] = w[l] || [];
     w[l].push({
         'gtm.start':
diff --git a/build.py b/build.py
index c61331c8..49565fd5 100644
--- a/build.py
+++ b/build.py
@@ -86,6 +86,12 @@ def build_govuk_assets(static_dist_root="app/static/dist"):
         "./app/static/dist/styles/comments.css",
     )
 
+    # Copy over JS source
+    os.makedirs("./app/static/dist/js")
+    shutil.copyfile(
+        "app/static/src/js/fsd_cookies.js", "./app/static/dist/js/fsd_cookies.js"
+    )
+
     # Delete temp files
     print("Deleting " + ASSETS_PATH)
     shutil.rmtree(ASSETS_PATH)
diff --git a/config/envs/default.py b/config/envs/default.py
index c14f8368..b91811f0 100644
--- a/config/envs/default.py
+++ b/config/envs/default.py
@@ -224,7 +224,77 @@ class DefaultConfig:
     ASSETS_DEBUG = False
     ASSETS_AUTO_BUILD = True
 
-    TALISMAN_SETTINGS = CommonConfig.TALISMAN_SETTINGS
+    # Content Security Policy
+    SECURE_CSP = {
+        "default-src": "'self'",
+        "script-src": [
+            "'self'",
+            "'sha256-+6WnXIl4mbFTCARd8N3COQmT3bJJmo32N8q8ZSQAIcU='",
+            "'sha256-l1eTVSK8DTnK8+yloud7wZUqFrI0atVo6VlC6PJvYaQ='",
+            "'sha256-z+p4q2n8BOpGMK2/OMOXrTYmjbeEhWQQHC3SF/uMOyg='",
+            "'sha256-RgdCrr7A9yqYVstE6QiM/9RNRj4bYipcUa2C2ywQT1A='",
+            "'sha256-W6+G9WX7ZWCn2Tdi1uHvgAuT45Y2OUJa9kqVxgAM+vM='",
+            "'sha256-RgdCrr7A9yqYVstE6QiM/9RNRj4bYipcUa2C2ywQT1A='",
+            "'sha256-z+p4q2n8BOpGMK2/OMOXrTYmjbeEhWQQHC3SF/uMOyg='",
+            "'sha256-l1eTVSK8DTnK8+yloud7wZUqFrI0atVo6VlC6PJvYaQ='",
+            "'sha256-+6WnXIl4mbFTCARd8N3COQmT3bJJmo32N8q8ZSQAIcU='",
+            "https://tagmanager.google.com",
+            "https://www.googletagmanager.com",
+            "https://*.google-analytics.com",
+        ],
+        "connect-src": [
+            "'self'",
+            "https://*.google-analytics.com",
+        ],  # APPLICATION_STORE_API_HOST_PUBLIC,
+        "img-src": ["data:", "'self'", "https://ssl.gstatic.com"],
+    }
+
+    # Talisman Config
+    FSD_REFERRER_POLICY = "strict-origin-when-cross-origin"
+    FSD_SESSION_COOKIE_SAMESITE = "Strict"
+    FSD_PERMISSIONS_POLICY = {"interest-cohort": "()"}
+    FSD_DOCUMENT_POLICY = {}
+    FSD_FEATURE_POLICY = {
+        "microphone": "'none'",
+        "camera": "'none'",
+        "geolocation": "'none'",
+    }
+
+    DENY = "DENY"
+    SAMEORIGIN = "SAMEORIGIN"
+    ALLOW_FROM = "ALLOW-FROM"
+    ONE_YEAR_IN_SECS = 31556926
+
+    if environ.get("VCAP_SERVICES"):
+        FORCE_HTTPS = True
+    else:
+        FORCE_HTTPS = False
+
+    TALISMAN_SETTINGS = {
+        "feature_policy": FSD_FEATURE_POLICY,
+        "permissions_policy": FSD_PERMISSIONS_POLICY,
+        "document_policy": FSD_DOCUMENT_POLICY,
+        "force_https": FORCE_HTTPS,
+        "force_https_permanent": False,
+        "force_file_save": False,
+        "frame_options": "SAMEORIGIN",
+        "frame_options_allow_from": None,
+        "strict_transport_security": True,
+        "strict_transport_security_preload": True,
+        "strict_transport_security_max_age": ONE_YEAR_IN_SECS,
+        "strict_transport_security_include_subdomains": True,
+        "content_security_policy": SECURE_CSP,
+        "content_security_policy_report_uri": None,
+        "content_security_policy_report_only": False,
+        # "content_security_policy_nonce_in": None,
+        "referrer_policy": FSD_REFERRER_POLICY,
+        "session_cookie_secure": True,
+        "session_cookie_http_only": True,
+        "session_cookie_samesite": FSD_SESSION_COOKIE_SAMESITE,
+        "x_content_type_options": True,
+        "x_xss_protection": True,
+        "content_security_policy_nonce_in": ["script-src"],
+    }
 
     COF_FUND_ID = "47aef2f5-3fcb-4d45-acb5-f0152b5f03c4"
     COF_ROUND_2_ID = "c603d114-5364-4474-a0c4-c41cbf4d3bbd"
diff --git a/create_app.py b/create_app.py
index 1035d936..aee97a5d 100644
--- a/create_app.py
+++ b/create_app.py
@@ -50,7 +50,7 @@
 
 
 def create_app() -> Flask:
-    flask_app = Flask("Assessment Frontend")
+    flask_app = Flask("Assessment Frontend", static_url_path="/assets")
     with flask_app.app_context():
 
         init_sentry()
diff --git a/requirements-dev.txt b/requirements-dev.txt
index 4e704b20..62399de8 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -167,7 +167,7 @@ flask-sqlalchemy==3.0.3
     #   -r requirements.txt
     #   flask-migrate
     #   funding-service-design-utils
-flask-talisman==1.0.0
+flask-talisman==1.1.0
     # via -r requirements.txt
 flask-wtf==1.1.1
     # via -r requirements.txt
diff --git a/requirements.in b/requirements.in
index 553ff8c9..6671b9f0 100644
--- a/requirements.in
+++ b/requirements.in
@@ -16,7 +16,7 @@ flask-babel
 #-----------------------------------
 #   Security
 #-----------------------------------
-flask-talisman
+flask-talisman==1.1.0
 
 #-----------------------------------
 #   Static Assets
diff --git a/requirements.txt b/requirements.txt
index 8579bd88..b7987e29 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -105,7 +105,7 @@ flask-sqlalchemy==3.0.3
     # via
     #   flask-migrate
     #   funding-service-design-utils
-flask-talisman==1.0.0
+flask-talisman==1.1.0
     # via -r requirements.in
 flask-wtf==1.1.1
     # via -r requirements.in
diff --git a/static_assets.py b/static_assets.py
index cb6dd1a1..6465de3d 100644
--- a/static_assets.py
+++ b/static_assets.py
@@ -24,6 +24,7 @@ def init_assets(app=None, auto_build=False, static_folder="app/static/dist"):
             "./js/namespaces.js",
             "./js/helpers.js",
             "./js/all.js",
+            "./js/fsd_cookies.js",
             "./js/components/*/*.js",
             filters="jsmin",
             output="js/main.min.js",

From 6d11b2e598dae68303c969cfaf1e9c3521ca83ff Mon Sep 17 00:00:00 2001
From: Hamza Khalid <hamza.khalid@levellingup.gov.uk>
Date: Mon, 24 Jun 2024 04:19:39 +0100
Subject: [PATCH 2/4] - static_url_path removed

---
 create_app.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/create_app.py b/create_app.py
index aee97a5d..1035d936 100644
--- a/create_app.py
+++ b/create_app.py
@@ -50,7 +50,7 @@
 
 
 def create_app() -> Flask:
-    flask_app = Flask("Assessment Frontend", static_url_path="/assets")
+    flask_app = Flask("Assessment Frontend")
     with flask_app.app_context():
 
         init_sentry()

From 94d60dcc7a72660f41a10db9bd1185b896df3219 Mon Sep 17 00:00:00 2001
From: Hamza Khalid <hamza.khalid@levellingup.gov.uk>
Date: Mon, 24 Jun 2024 04:39:34 +0100
Subject: [PATCH 3/4] - style adjusted because of login page

---
 app/templates/head.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/templates/head.html b/app/templates/head.html
index dd609113..958d4b0c 100644
--- a/app/templates/head.html
+++ b/app/templates/head.html
@@ -17,7 +17,7 @@
 <div class="govuk-cookie-banner" data-nosnippet role="region" aria-label="Cookies on Access Funding"
     id="cookie-banner" hidden>
     <div class="govuk-cookie-banner__message govuk-width-container" id="cookies-choice-msg">
-        <div class="govuk-grid-row govuk-width-container-original">
+        <div class="govuk-grid-row">
             <div class="govuk-grid-column-two-thirds">
                 <h2 class="govuk-cookie-banner__heading govuk-heading-m">Cookies on Access Funding</h2>
                 <div class="govuk-cookie-banner__content">

From dc6e77fb43de34196dac7633d69976632abd5c09 Mon Sep 17 00:00:00 2001
From: Hamza Khalid <hamza.khalid@levellingup.gov.uk>
Date: Mon, 24 Jun 2024 06:08:44 +0100
Subject: [PATCH 4/4] - govuk-width-container-original remvoed as not used

---
 app/static/src/styles/govuk-overrides.css | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/app/static/src/styles/govuk-overrides.css b/app/static/src/styles/govuk-overrides.css
index f2e82e8d..c87e4db3 100644
--- a/app/static/src/styles/govuk-overrides.css
+++ b/app/static/src/styles/govuk-overrides.css
@@ -363,12 +363,6 @@ list-style-type: upper-roman;
     margin: auto;
 }
 
-.govuk-width-container-original {
-    max-width: 960px;
-    margin-right: 15px;
-    margin-left: 15px;
-}
-
 .govuk-link__white_font {
     color: white !important;
 }