부모가 묻는 단 하나의 쿠키

/// Which of a store's cookies go with one request, the way a browser picks
/// them: the names asked for, unexpired, set for exactly this host (Firelink
/// sets no `Domain`, and a cookie another host on the tailnet scoped wider is
/// not the hub's), on a path the request is under, and a `Secure` cookie only
/// over https. Cookies ignore ports, so the name is what keeps another family
/// app's session on the same tailnet host (Pippa's) out of the header.
public enum RequestCookies {
    public static func header(
        from cookies: [HTTPCookie], for origin: PageOrigin, path: String, named names: Set<String>, now: Date = Date()
    ) -> String? {
        let chosen = cookies.filter { cookie in
            names.contains(cookie.name)
                && cookie.domain.lowercased() == origin.host
                && (cookie.expiresDate.map { $0 > now } ?? true)
                && (!cookie.isSecure || origin.scheme == "https")
                && pathMatches(cookie.path, path)
        }
        // The more specific path first, as browsers order them.
        .sorted { $0.path.count > $1.path.count }
        guard !chosen.isEmpty else { return nil }
        return chosen.map { "\($0.name)=\($0.value)" }.joined(separator: "; ")
    }

    /// RFC 6265 §5.1.4: the cookie's path is the request's, or a prefix that
    /// ends at a `/`.
    static func pathMatches(_ cookiePath: String, _ requestPath: String) -> Bool {
        let cookiePath = cookiePath.isEmpty ? "/" : cookiePath
        guard requestPath.hasPrefix(cookiePath) else { return false }
        return requestPath.count == cookiePath.count || cookiePath.hasSuffix("/")
            || requestPath.dropFirst(cookiePath.count).hasPrefix("/")
    }
}

    public var cookiesDidChange: (@MainActor (IdentityID) -> Void)?
    private var cookieWatchers: [IdentityID: CookieWatcher] = [:]

    /// Reads the identity's cookies here, in the child, and hands the parent
    /// only the header made of the names it asked for.
    public func cookieHeader(for origin: PageOrigin, path: String, named names: Set<String>, identity: IdentityID) async -> String? {
        guard identity != .privateSession, !names.isEmpty else { return nil }
        let cookies = await store(for: identity).httpCookieStore.allCookies()
        return RequestCookies.header(from: cookies, for: origin, path: path, named: names)
    }

    @Test func onlyFirelinksCookieForTheHubsHostIsChosen() {
        let origin = PageOrigin(url: Self.hub)!
        let path = FirelinkHubSession.catalogPath
        let jar = [
            Self.cookie("pippa_session", "pippa"),   // another app on the same host: cookies ignore ports
            Self.cookie("cwkfirelink_session_tls", "theirs", host: "other.tail.test"),
            Self.cookie("cwkfirelink_session_tls", "wide", host: ".tail.test"),
            Self.cookie("cwkfirelink_session_tls", "old", path: "/api", expires: Date(timeIntervalSinceNow: -60)),
            Self.cookie("cwkfirelink_session_tls", "elsewhere", path: "/admin"),
            Self.cookie("cwkfirelink_session_tls", "hub"),
        ]
        #expect(RequestCookies.header(from: jar, for: origin, path: path, named: ["cwkfirelink_session_tls"]) == "cwkfirelink_session_tls=hub")
        #expect(RequestCookies.header(from: jar, for: origin, path: path, named: ["cwkfirelink_session"]) == nil)
        // A Secure cookie never goes over plain http.
        let plain = PageOrigin(scheme: "http", host: "hub.tail.test", port: 9400)
        #expect(RequestCookies.header(from: jar, for: plain, path: path, named: ["cwkfirelink_session_tls"]) == nil)
        #expect(RequestCookies.pathMatches("/api", "/api/v1/launcher/catalog"))
        #expect(!RequestCookies.pathMatches("/ap", "/api/v1/launcher/catalog"))
        #expect(RequestCookies.pathMatches("/", "/api/v1/launcher/catalog"))