Add support to cookie partition

[leandrohlsilva]

Why is this PR necessary?

To support Chrome's CHIPS initiative
https://developers.google.com/privacy-sandbox/3pcd/chips

Tests

statehood feature/cookie-partition % npm run test

> @hapi/[email protected] test
> lab -a @hapi/code -t 100 -L



  ..................................................
  ..................................................
  ..........

110 tests complete
Test duration: 48 ms
Assertions count: 162 (verbosity: 1.47)
Leaks: No issues
Coverage: 100.00%
Lint: No issues

[kanongil]

Thanks for this very nice PR.

The only minor implementation issue, is that I would prefer the options validation to fail, if isPartitioned: true without isSecure: true.

However, I'm not sure this is a suitable feature to implement, given the current state (expired) of the spec. Currently it is a Google-only feature, where support could potentially be dropped.

The main problem with not adding it, is that there is no way for users to add this property manually. As such, a better solution might be to add support for custom names and name/value pairs.

[kanongil]

Additional properties could be specified using an object:

{
    …,
    set: {
        Partitioned: true,
        OtherName: 'TheValue'
    }
}

[leandrohlsilva]

Thanks for this very nice PR.

The only minor implementation issue, is that I would prefer the options validation to fail, if isPartitioned: true without isSecure: true.

However, I'm not sure this is a suitable feature to implement, given the current state (expired) of the spec. Currently it is a Google-only feature, where support could potentially be dropped.

The main problem with not adding it, is that there is no way for users to add this property manually. As such, a better solution might be to add support for custom names and name/value pairs.

Hi @kanongil,
thank you for replying.
As suggested, I've made Partition conditional to isSecure and SameSite=None.

As for the spec being expired, I don't know if this expiration date is being taken seriously as Google is rolling out this new policy already: https://developers.google.com/privacy-sandbox/3pcd
Currently, 1% of our Chrome users are having trouble using our systems, and soon to be 100% of them in Q3 2024.

I like the additional properties suggestion, but I wonder if it's necessary now as I'm not aware of other properties being proposed.

[leandrohlsilva]

@kanongil , so what are the next steps to move this PR forward?
Thanks

[leandrohlsilva]

Hi @kanongil
How can we make this PR ready to move forward?
I believe CHIPS support is essential to the well-functioning of Hapi in the future, so I'm following up with you.

Thank you

[legrego]

I'm also interested in having support for the Partitioned attribute. What are our next steps for this, @kanongil?

[wzrdtales]

What is left to merge this? Hapijs is not capable delivering api's towards chrome users anymore

[wzrdtales]

/cc @Marsup @kanongil

[kanongil]

Looks good, other than my inline comment.

[kanongil]

Silently ignoring an option is not how hapi usually works. I would much rather see it throw Boom.badImplementation() if it is not a valid combination.

[leandrohlsilva]

Hi @kanongil , thank you for reviewing.
I've applied your suggestion and updated tests.
I wasn't able to run tests though (I'm unable to run tests on master either).

I'll need your help to run tests before merging.

statehood feature/cookie-partition % npm run test

> @hapi/[email protected] test
> lab -a @hapi/code -t 100 -L

/Users/leandro/Projects/statehood/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2156
                const formattedValue = JSON.stringify(error.data);
                                            ^

TypeError: Converting circular structure to JSON
    --> starting at object with constructor 'Object'

[leandrohlsilva]

I see that the CI pipeline failed.
Not being able to run my tests locally is blocking me.

What I'm doing:

node -v
# v20.11.0
npm -v
# 10.2.4
git checkout master
rm -rf node_modules && rm package-lock.json
npm i
npm run test

Any thoughts on what I'm doing wrong?

[damusix]

@leandrohlsilva tests failed

[leandrohlsilva]

@leandrohlsilva tests failed

Thank you for letting me know.
I'm having a hard time running the tests locally, but I'll figure it out

[damusix]

@leandrohlsilva If you're on the slack, ping one of the channels and I'll help you out

[leandrohlsilva]

@kanongil @damusix two tests failed and I don't know why. Wondering if you'd be able to rerun the CI pipeline.
Also, I'm not able to merge the PR it seems. When would you merge it? Thank you.

[kanongil]

Don't worry about the tests. It seems to be an issue with the v23 node release line, which is tested for, but have no official support.

Merging is best handled by someone from @hapijs/tsc, who can also publish a new release.

[Marsup]

Thanks! It's released as 8.2, I've prepared a matching hapi PR to enforce that update for everyone.