Configurable behaviour for cookie defaults and overrides

lib/rails_same_site_cookie/configuration.rb

@@ -1,9 +1,62 @@
 module RailsSameSiteCookie
   class Configuration
+    VALUES = %w{Strict Lax None}
+
     attr_accessor :user_agent_regex
 
     def initialize
       @user_agent_regex = nil
+      @default_value = 'None'
+      @default_override = false
+      @modify_target_all_cookies = true
+      @individual_settings = {}
+    end
+
+    def default_value=(raw_value)
+      value = raw_value.to_s.camelcase
+      raise ArgumentError, "invalid value (valid: #{VALUES})" unless VALUES.include?(value)
+      @default_value = value
+    end
+
+    def default_override=(boolean)
+      raise ArgumentError, 'not boolean' unless [true, false].include?(boolean)
+      @default_override = boolean
+    end
+
+    def modify_target_all_cookies=(boolean)
+      raise ArgumentError, 'not boolean' unless [true, false].include?(boolean)
+      @modify_target_all_cookies = boolean
+    end
+
+    def individual_settings=(settings)
+      settings.each do |name, options|
+        cookie_name = name.to_s
+        @individual_settings[cookie_name] = {}
+        if options.present?
+          if options.key?(:value)
+            value = options[:value].to_s.camelcase
+            raise ArgumentError, "invalid value (valid: #{VALUES})" unless VALUES.include?(value)
+            @individual_settings[cookie_name][:value] = value
+          end
+          if options.key?(:override)
+            raise ArgumentError, 'not boolean' unless [true, false].include?(options[:override])
+            @individual_settings[cookie_name][:override] = options[:override]
+          end
+        end
+      end
+    end
+
+    def modify_target?(cookie_name)
+      @modify_target_all_cookies || @individual_settings.key?(cookie_name)
+    end
+
+    def value(cookie_name)
+      @individual_settings.dig(cookie_name, :value) || @default_value
+    end
+
+    def allow_override?(cookie_name)
+      override = @individual_settings.dig(cookie_name, :override)
+      override.nil? ? @default_override : override
     end
   end
-end
+end

lib/rails_same_site_cookie/middleware.rb

@@ -21,14 +21,17 @@ def call(env)
 
           cookies.each do |cookie|
             next if cookie.blank?
-            if ssl and not cookie =~ /;\s*secure/i
-              cookie << '; Secure'
+            name = cookie.split('=', 2)[0]
+            if RailsSameSiteCookie.configuration.modify_target?(name)
+              if RailsSameSiteCookie.configuration.allow_override?(name) || cookie !~ /;\s*samesite=/i
+                cookie.sub!(/;\s*samesite=[^;\s]+/i, '')
+                value = RailsSameSiteCookie.configuration.value(name)
+                cookie << "; SameSite=#{value}"
+                if value == 'None' && ssl && cookie !~ /;\s*secure/i
+                  cookie << '; Secure'
+                end
+              end
             end
-
-            unless cookie =~ /;\s*samesite=/i
-              cookie << '; SameSite=None'
-            end
-
           end
 
           headers['Set-Cookie'] = cookies.join(COOKIE_SEPARATOR)
@@ -39,4 +42,4 @@ def call(env)
     end
 
   end
-end
+end

spec/configuration_spec.rb

@@ -1,7 +1,160 @@
 RSpec.describe RailsSameSiteCookie::Configuration do
-  it "sets user_agent_regex" do
-    config = described_class.new
-    config.user_agent_regex = /dsasdd/
-    expect(config.user_agent_regex).to eq(/dsasdd/)
+  let(:config) { described_class.new }
+
+  describe "user_agent_regex" do
+    subject { config.user_agent_regex }
+
+    context "if set /dsasdd/ (regexp)" do
+      before { config.user_agent_regex = /dsasdd/ }
+      example { is_expected.to eq(/dsasdd/) }
+    end
   end
+
+  describe "default_value" do
+    subject { config.instance_variable_get(:@default_value) }
+
+    context "if not set" do
+      it { is_expected.to eq('None') }
+    end
+
+    context "if set 'Lax' (accurate value)" do
+      before { config.default_value = 'Lax' }
+      example { is_expected.to eq('Lax') }
+    end
+
+    context "if set 'strict' (downcase)" do
+      before { config.default_value = 'strict' }
+      it { is_expected.to eq('Strict') }
+    end
+
+    context "if set 'xxxx' (invalid)" do
+      it { expect { config.default_value = 'xxxx' }.to raise_error(ArgumentError) }
+    end
+  end
+
+  describe "default_override" do
+    subject { config.instance_variable_get(:@default_override) }
+
+    context "if not set" do
+      it { is_expected.to be(false) }
+    end
+
+    context "if set true" do
+      before { config.default_override = true }
+      it { is_expected.to be(true) }
+    end
+
+    context "if set 'xxxx' (not boolean)" do
+      it { expect { config.default_override = 'xxxx' }.to raise_error(ArgumentError) }
+    end
+
+    context "if set nil" do
+      it { expect { config.default_override = nil }.to raise_error(ArgumentError) }
+    end
+  end
+
+  describe "modify_target_all_cookies" do
+    subject { config.instance_variable_get(:@modify_target_all_cookies) }
+
+    context "if not set" do
+      it { is_expected.to be(true) }
+    end
+
+    context "if set false" do
+      before { config.modify_target_all_cookies = false }
+      it { is_expected.to be(false) }
+    end
+
+    context "if set 'false' (not boolean)" do
+      it { expect { config.modify_target_all_cookies = 'false' }.to raise_error(ArgumentError) }
+    end
+
+    context "if set nil" do
+      it { expect { config.modify_target_all_cookies = nil }.to raise_error(ArgumentError) }
+    end
+  end
+
+  describe "individual_settings" do
+    subject { config.instance_variable_get(:@individual_settings) }
+
+    context "if not set" do
+      it { is_expected.to eq({}) }
+    end
+
+    context "if set array of strings" do
+      before { config.individual_settings = cookie_names }
+      let(:cookie_names) { %w{name1 name2 name3} }
+
+      it("is expected to have all keys same as set array.") do
+        expect(subject.keys).to eq(cookie_names)
+      end
+
+      it("is expected to have all values be {}.") do
+        expect(subject.values).to all( be {} )
+      end
+    end
+
+    context "if set array of symbols" do
+      before { config.individual_settings = cookie_names }
+      let(:cookie_names) { %i{name1 name2 name3} }
+
+      it("is expected to have all keys converted to string.") do
+        expect(subject.keys).to eq(cookie_names.map(&:to_s))
+      end
+    end
+
+    context "if set valid hash" do
+      before { config.individual_settings = individual_settings }
+      let(:individual_settings) do
+        {
+          name1: {value: 'None', override: true},
+          name2: {value: 'none', override: false},
+          name3: {value: :none, override: true},
+        }
+      end
+
+      it("is expected to have all keys converted to string.") do
+        expect(subject.keys).to match_array(individual_settings.keys.map(&:to_s))
+      end
+
+      it("is expected to have all value attributes converted to constant value.") do
+        expect(subject.values.map {|attrs| attrs[:value] }).to all(eq('None'))
+      end
+
+      it("is expected to have all override attributes be boolean.") do
+        expect(subject.values.map {|attrs| attrs[:override] }).to all(be(true).or be(false))
+      end
+    end
+
+    context "if set hash with blank values" do
+      before { config.individual_settings = individual_settings }
+      let(:individual_settings) do
+        {
+          name1: {},
+          name2: {},
+        }
+      end
+
+      it("is expected to have all values be {}.") do
+        expect(subject.values).to all( be {} )
+      end
+    end
+
+    context "if set hash with invalid value attribute" do
+      let(:individual_settings) do
+        {name1: {value: 'xxxx', override: true}}
+      end
+
+      it { expect { config.individual_settings = individual_settings }.to raise_error(ArgumentError) }
+    end
+
+    context "if set hash with invalid override attribute" do
+      let(:individual_settings) do
+        {name1: {value: 'None', override: 'xxxx'}}
+      end
+
+      it { expect { config.individual_settings = individual_settings }.to raise_error(ArgumentError) }
+    end
+  end
+
 end