Add Matomo analytics integration with GDPR consent support (#341)

* Add Matomo Tag Manager as third analytics tracking mode

Adds Matomo Tag Manager support alongside existing Google Analytics and
Piwik Pro integrations. Includes settings.json configuration (url + tag),
build-time script injection via hook-analytics.py, Klaro GDPR consent
banner integration, and runtime consent granting via MTM data layer API.

https://claude.ai/code/session_0165AXHkmRZ6bx23n7Tbyz8h

* Fix Matomo Tag Manager snippet to match official docs

- Accept full container JS URL instead of separate url + tag fields,
  supporting both self-hosted and Matomo Cloud URL patterns
- Match the official snippet: var _mtm alias, _mtm.push shorthand
- Remove redundant type="text/javascript" attribute
- Remove unused "tag" field from settings.json

https://claude.ai/code/session_0165AXHkmRZ6bx23n7Tbyz8h

* Split Matomo config into base url + tag fields

Separate the Matomo setting into `url` (base URL, e.g.
https://cdn.matomo.cloud/openms.matomo.cloud) and `tag` (container ID,
e.g. yDGK8bfY), consistent with how other providers use a tag field.
The script constructs the full path: {url}/container_{tag}.js

https://claude.ai/code/session_0165AXHkmRZ6bx23n7Tbyz8h

* install matomo tag

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: t0mdavid-m

gdpr_consent/dist/bundle.js

@@ -114,6 +114,16 @@ function onRender(event: Event): void {
             }
         )
     }
+    if (data.args['matomo']) {
+        klaroConfig.services.push(
+            {
+                name: 'matomo',
+                purposes: ['analytics'],
+                onAccept: callback,
+                onDecline: callback,
+            }
+        )
+    }
 
     // Create a new script element
     var script = document.createElement('script')

gdpr_consent/src/main.ts

@@ -56,6 +56,21 @@ def piwik_pro_body(piwik_tag):
     """
 
 
+def matomo_head(matomo_url, matomo_tag):
+    return f"""
+    <!-- Matomo Tag Manager -->
+    <script>
+    var _mtm = window._mtm = window._mtm || [];
+    _mtm.push({{'mtm.startTime': (new Date().getTime()), 'event': 'mtm.Start'}});
+    (function() {{
+        var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0];
+        g.async=true; g.src='{matomo_url}/container_{matomo_tag}.js'; s.parentNode.insertBefore(g,s);
+    }})();
+    </script>
+    <!-- End Matomo Tag Manager -->
+    """
+
+
 if __name__ == '__main__':
 
     # Load configuration
@@ -79,6 +94,12 @@ def piwik_pro_body(piwik_tag):
         piwik_tag = settings['analytics']['piwik-pro']['tag']
         index = patch_body(index, piwik_pro_body(piwik_tag))
 
+    # Configure matomo tag manager
+    if settings['analytics']['matomo']['enabled']:
+        matomo_url = settings['analytics']['matomo']['url']
+        matomo_tag = settings['analytics']['matomo']['tag']
+        index = patch_head(index, matomo_head(matomo_url, matomo_tag))
+
     # Save index.html
     with open(index_path, 'w') as f:
         f.write(index)

hooks/hook-analytics.py

@@ -9,8 +9,13 @@
             "tag": ""
         },
         "piwik-pro": {
+            "enabled": false,
+            "tag": ""
+        },
+        "matomo": {
             "enabled": true,
-            "tag": "57690c44-d635-43b0-ab43-f8bd3064ca06"
+            "url": "https://cdn.matomo.cloud/openms.matomo.cloud",
+            "tag": "yDGK8bfY"
         }
     },
     "online_deployment": false,

settings.json

@@ -208,12 +208,13 @@ def captcha_control():
         # Check if consent for tracking was given
         ga = st.session_state.settings['analytics']['google-analytics']['enabled']
         pp = st.session_state.settings['analytics']['piwik-pro']['enabled']
-        if (ga or pp) and (st.session_state.tracking_consent is None):
+        mt = st.session_state.settings['analytics']['matomo']['enabled']
+        if (ga or pp or mt) and (st.session_state.tracking_consent is None):
             consent_component = st_components.declare_component("gdpr_consent", path=Path("gdpr_consent"))
             with st.spinner():
                 # Ask for consent
                 st.session_state.tracking_consent = consent_component(
-                    google_analytics=ga, piwik_pro=pp
+                    google_analytics=ga, piwik_pro=pp, matomo=mt
                 )
                 if st.session_state.tracking_consent is None:
                     # No response by user yet

src/common/captcha_.py

@@ -405,6 +405,23 @@ def page_setup(page: str = "") -> dict[str, Any]:
                 width=1,
                 height=1,
             )
+        if (st.session_state.settings["analytics"]["matomo"]["enabled"]) and (
+            st.session_state.tracking_consent["matomo"] == True
+        ):
+            html(
+                """
+                <!DOCTYPE html>
+                <html lang="en">
+                    <head></head>
+                    <body><script>
+                    window.parent._mtm = window.parent._mtm || [];
+                    window.parent._mtm.push(['MTMSetConsentGiven']);
+                    </script></body>
+                </html>
+                """,
+                width=1,
+                height=1,
+            )
 
     # Determine the workspace for the current session
     if ("workspace" not in st.session_state) or (