Block Playwright traffic to Google Analytics

[ziodave]

Summary

• block Playwright requests to direct Google Analytics measurement hosts: *.google-analytics.com and *.analytics.google.com
• keep Google Tag Manager, Google Tag Services, DoubleClick, and AdSense available
• install the mandatory guard on every SDK browser context and block service workers
• keep the regex matcher as the single production matcher, avoiding a callable route that intercepts every request in Python
• document that first-party and server-side analytics gateways are outside this guarantee
• rebuild the branch as one commit on current main

Verification

• focused browser and policy tests: 23 passed
• render slice: 32 passed
• changed-file Ruff and format checks: passed
• affected-area coverage: 96%; network policy: 100%
• SDK/security reviewer: happy

Service-worker tradeoff

Blocking service workers prevents analytics requests from escaping page interception, but intentionally reduces fidelity for PWA caching, offline behavior, and service-worker background activity.

Baseline note

The repository-wide suite still has 13 unrelated pre-existing collection errors because the installed generated wordlift-client package lacks fetch_api and fetch_js_render_mode. Repository-wide Ruff reports 28 existing violations outside this diff, and the format check identifies 39 existing files that would be reformatted.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.