name: Cookie Coverage

on:
  push:
    branches: [develop]
    paths:
      - '.github/workflows/cookie-coverage.yml'
      - '.github/actions/setup-php-composer/**'
      - 'auth_2fa.php'
      - 'auth_changepassword.php'
      - 'auth_login.php'
      - 'composer.json'
      - 'composer.lock'
      - 'include/auth.php'
      - 'include/global.php'
      - 'include/js/jquery.zoom.js'
      - 'include/js/js.storage.js'
      - 'include/layout.js'
      - 'include/themes/midwinter/main.js'
      - 'lib/auth.php'
      - 'lib/functions.php'
      - 'logout.php'
      - 'package.json'
      - 'package-lock.json'
      - 'tests/Helpers/AuthCookieProbe.php'
      - 'tests/integration/AuthSystemRegressionIntegrationTest.php'
      - 'tests/js/cookie_helpers.test.js'
      - 'tests/Unit/Security/Session/CookiePolicyContractTest.php'
      - 'tests/Unit/Security/Session/CookieRuntimeTest.php'
  pull_request:
    branches: [develop]
    paths:
      - '.github/workflows/cookie-coverage.yml'
      - '.github/actions/setup-php-composer/**'
      - 'auth_2fa.php'
      - 'auth_changepassword.php'
      - 'auth_login.php'
      - 'composer.json'
      - 'composer.lock'
      - 'include/auth.php'
      - 'include/global.php'
      - 'include/js/jquery.zoom.js'
      - 'include/js/js.storage.js'
      - 'include/layout.js'
      - 'include/themes/midwinter/main.js'
      - 'lib/auth.php'
      - 'lib/functions.php'
      - 'logout.php'
      - 'package.json'
      - 'package-lock.json'
      - 'tests/Helpers/AuthCookieProbe.php'
      - 'tests/integration/AuthSystemRegressionIntegrationTest.php'
      - 'tests/js/cookie_helpers.test.js'
      - 'tests/Unit/Security/Session/CookiePolicyContractTest.php'
      - 'tests/Unit/Security/Session/CookieRuntimeTest.php'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: cookie-coverage-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  COMPOSER_ALLOW_SUPERUSER: 1

jobs:
  coverage:
    name: Cookie behavior matrix
    runs-on: ubuntu-24.04
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - name: Set up PHP and Cacti test dependencies
        uses: ./.github/actions/setup-php-composer
        with:
          php-version: '8.4'
          coverage: none
          extensions: intl, mysql, gd, ldap, gmp, xml, curl, json, mbstring
          dependency-mode: locked-tests
          install-args: --prefer-dist --no-progress --no-interaction

      - name: Setup Node 22
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # 4.4.0
        with:
          node-version: '22'
          cache: npm

      - name: Install JavaScript dependencies
        run: |
          set -euo pipefail
          npm ci --ignore-scripts
          npm run postinstall --ignore-scripts

      - name: Run PHP cookie matrix
        run: >-
          include/vendor/bin/pest --configuration=tests/phpunit.xml
          tests/Unit/Security/Session/CookiePolicyContractTest.php
          tests/Unit/Security/Session/CookieRuntimeTest.php
          tests/integration/AuthSystemRegressionIntegrationTest.php

      - name: Run browser cookie helpers
        run: node --test tests/js/cookie_helpers.test.js