Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/Controllers/Rest/GDPRBannerRestController.php`:
- Around line 52-54: The route in GDPRBannerRestController currently makes the
'nonce' parameter optional and calls GDPRService::setConsent without verifying
it; update the route registration and handler to require a nonce for any
state-changing consent writes (including the blocks around lines 69-81),
validate it with wp_verify_nonce() even for anonymous visitors (do not skip
verification for logged-out users), and perform any additional
capability/context checks before calling GDPRService::setConsent; ensure the
'nonce' param is required in the args schema and that the handler returns a 403
on failed or missing nonce so consent changes cannot be made by cross-site
POSTs.

In `@src/Services/Privacy/ConsentHandler.php`:
- Around line 103-115: The current nonce bypass for anonymous users (in
ConsentHandler::... using get_current_user_id() and wp_verify_nonce) allows
forged POSTs to set banner consent; update the logic to verify the nonce for all
requests that call handleBannerConsent (including anonymous flows forwarded by
TrackingRestController->handleBannerConsent(false, $consent_data)) or otherwise
validate an explicit consent token tied to the client before setting
consent—i.e., remove the early anonymous bypass and ensure
wp_verify_nonce($nonce, 'wp_rest') is performed (or an equivalent cryptographic
check) for banner_consent submissions so anonymous requests cannot upgrade to
PII-tracking without a verified user action.

In `@tests/e2e/gdpr-banner-consent-persistence.spec.ts`:
- Around line 475-490: The test currently only checks that
submitBannerDecision() set the slimstat_gdpr_consent cookie, which doesn’t
verify the stale-nonce POST actually succeeded; update the test after clicking
the accept button (the block using testPage.evaluate and waitForTimeout) to also
assert a successful server-side consent request by using the test helper
isConsentChangeRequest() (or equivalent request recorder) to confirm the consent
POST returned 200 (or that the server recorded the consent change) for the
stale-nonce flow; ensure you reference the existing test helpers (testCtx,
isConsentChangeRequest) and assert the server-side effect in addition to the
cookie check so the test fails when the stale-nonce endpoint returns 403.

In `@tests/gdpr-consent-cookie-test.php`:
- Around line 283-285: Tests 6-9 do not exercise the real endpoint handlers or
production nonce logic; instead of inlining the get_current_user_id() guard,
update the tests to invoke the actual handlers (ConsentHandler,
GDPRBannerRestController, ConsentChangeRestController) by constructing
WP_REST_Request objects and/or populating $_POST with the expected fields, stub
WP functions as needed (e.g., get_current_user_id, wp_verify_nonce,
current_user_can) to simulate both authorized and unauthorized contexts, and
assert that the handlers perform nonce verification and capability checks and
sanitize/escape inputs; ensure you replace the inline guard blocks with calls to
the controller methods so the tests fail if production nonce logic changes.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tests/gdpr-consent-cookie-test.php`:
- Around line 373-385: The anonymous-nonce tests are still asserting the old
failure behavior; update the tests that use $_stub_user_id == 0 (anonymous) and
$_stub_nonce_valid = false (e.g., the GDPRBannerRestController->handle_consent
calls in Test 6 and the related blocks around lines 400-432) to expect success
instead of WP_Error/false (because nonce checks should be skipped for anonymous
cached-page consent), and add new cases where you set $_stub_user_id to a
non-zero value (logged-in user) with invalid/empty nonces to assert the original
failure behavior (WP_Error/rest_forbidden/403 or false as appropriate); ensure
you reference the same controller method handle_consent and keep the anonymous
vs logged-in distinction explicit in the new assertions.

---

Nitpick comments:
In `@tests/gdpr-consent-cookie-test.php`:
- Around line 265-294: Update the test shims to match WordPress core: change
WP_REST_Request::__construct to the core signature (e.g., __construct($method =
'GET', $route = '', $attributes = [])) and store incoming params in the
attributes bag so WP_REST_Request::get_param($key) reads from that attributes
array; update WP_REST_Response to include a public get_status() method returning
$this->status (and keep $status property for compatibility) so tests use
$result->get_status() instead of directly accessing $status. Ensure the shim
class names and method names (WP_REST_Request::__construct,
WP_REST_Request::get_param, WP_REST_Response::get_status) are implemented to
mirror the real API.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@tests/gdpr-consent-cookie-test.php`:
- Around line 1-12: Add the standard GPLv2+ license header immediately after the
opening "<?php" tag in tests/gdpr-consent-cookie-test.php so the file includes
the required licensing boilerplate before the file-level docblock and the
existing declare(strict_types=1); statement; ensure the header matches the
project's standard GPLv2+ text and preserves the existing file comment block
that documents the GDPR tests.
- Around line 415-428: Add a new test case after Test 8 that verifies anonymous
users succeed with a valid nonce: set $_stub_user_id = 0 and $_stub_nonce_valid
= true, clear $_setcookie_calls and set \wp_slimstat::$settings =
['use_slimstat_banner' => 'on']; instantiate
\SlimStat\Controllers\Rest\GDPRBannerRestController, create a POST
\WP_REST_Request to '/slimstat/v1/gdpr/consent' with
['consent'=>'accepted','nonce'=>'valid_nonce'], call
$controller->handle_consent($request) and assert the result is a
\WP_REST_Response with get_status() === 200 (and optionally that
$result->data['success'] is truthy) to cover the anonymous-success path enforced
by nonce verification.