refactor(cookie): widen CookieJar to L13 shape — queue path-aware + make sameSite/raw (task 2.12) - #54
Open
agissept wants to merge 2 commits into
Conversation
… 2.12, part 1) Converge the CookieJar queue surface to L13 (additive / callability widen): - Path-aware queued storage: queue() now nests as [name][path]; queued(), hasQueued(), unqueue() take an optional $path (null = last-for-name, L13 semantics). getQueuedCookies() flattens to a Cookie[] list (Arr::flatten) -- the Queue decorator + QueueingFactory consumers foreach over values, so they are unaffected. - Add expire($name, $path, $domain) and flushQueuedCookies() (L13 methods). Tests: switch the queued/unqueue asserts from array-key to hasQueued() (getQueuedCookies is now a flat list) + add path-aware and expire/flush coverage. tests/Cookie green (6), Auth/Session cookie tests green. Deferred (flip/swap-coupled, task 2.12 remainder): make()/forever() raw + sameSite params (security-relevant Symfony default), jar-default secure/ sameSite on setDefaultPathAndDomain, CookieValuePrefix (v2 HMAC), and the EncryptCookies/AddQueuedCookiesToResponse/StartSession/AuthenticateSession middleware (Guard/Queue decorator rewrite, kernel-flip-coupled). Session Contracts decouple already landed (task 3.4, #40). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…12, part 2) Add the L13 raw + sameSite params to make()/forever() and route secure/ sameSite through getPathAndDomain via new jar defaults. Additive and behavior-preserving: the jar SameSite default is 'lax' (the effective Symfony/L4.2 default today) rather than L13's null, so existing 7-arg callers are unchanged; apps can now set per-cookie sameSite/raw. setDefaultPathAndDomain kept at ($path, $domain) here -- widening its secure/sameSite would null-out SameSite for current 2-arg callers, so it ships with the config-driven EncryptCookies middleware (deferred). Tests: +testSameSiteAndRawWidening (default 'lax' + overrides). tests/Cookie green (7), Auth/Session cookie tests green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
agissept
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Task 2.12 (cookie jar widen)
[fork]Konvergensi surface CookieJar ke L13 — additive & behavior-preserving. Dua bagian:
Part 1 — queue path-aware
queue()nested[name][path];queued()/hasQueued()/unqueue()+$pathopsional (null= last-for-name, semantik L13).getQueuedCookies()flatten →Cookie[](Arr::flatten).expire()+flushQueuedCookies().Cookie\Queuedecorator,QueueingFactory) foreach nilai → aman.Part 2 — make()/forever() raw + sameSite
raw+sameSite; routesecure/sameSiteviagetPathAndDomain+ jar-default baru.'lax'(default efektif Symfony/L4.2 sekarang), bukannullala L13 → caller 7-arg lama tak berubah; app bisa set per-cookie sameSite/raw.Verifikasi
phpunit tests/Cookie→ 7 hijau (42 assertions) (path-aware, expire/flush, sameSite/raw).AuthGuardTest+SessionStoreTesthijau. Lint bersih.⏭️ Ditunda (flip/swap-coupled)
setDefaultPathAndDomainsecure/sameSite (null-out risk untuk caller 2-arg),CookieValuePrefix(v2 HMAC), middlewareEncryptCookies/AddQueuedCookiesToResponse/StartSession/AuthenticateSession(rewrite decorator Guard/Queue, kernel-flip-coupled). Session Contracts decouple sudah di task 3.4 (#40).Urutan
Stacked di atas #53 (stack: #45←#46←#48←#52←#53←**#54**). Blocker (1.1, 2.9) ✅.
🤖 Generated with Claude Code