How to Use Server-side Cookies in JavaScript SDK v3

    type CookieData = {
      name: string;
      value: string;
    };

    type CookiesReqData = {
      options: {
        expires?: string; // ISO 8601 date string
        maxAge?: number; // In milliseconds
        path?: string;
        domain?: string;
        sameSite?: 'Lax' | 'Strict' | 'None';
        secure?: boolean;
      };
      cookies: CookieData[];
    };

    type RequestData = CookiesReqData;

    type RequestType = 'setCookies';

    // The SDK wraps the cookie payload in this envelope
    type RSARequest = {
      reqType: RequestType;
      workspaceId: string;
      data: RequestData;
    };

    const ALLOWED_COOKIES = [
      'rl_user_id',
      'rl_trait',
      'rl_anonymous_id',
      'rl_group_id',
      'rl_group_trait',
      'rl_page_init_referrer',
      'rl_page_init_referring_domain',
      'rl_session',
      'rl_auth_token'
    ];

    const encode = (value: string) => {
      try {
        return encodeURIComponent(value);
      } catch (err) {
        return undefined;
      }
    };

    const generateCookieStrings = (data: RequestData): string[] => {
      try {
        const { cookies, options } = data;
        return cookies.filter((cookie: CookieData) => ALLOWED_COOKIES.includes(cookie.name)).map((cookie: CookieData) => {
          const encodedName = encode(cookie.name);
          const encodedValue = encode(cookie.value);

          // encode returns undefined instead of throwing, so skip the cookie rather
          // than writing a literal "undefined" into the header
          if (encodedName === undefined || encodedValue === undefined) {
            return undefined;
          }

          let cookieStr = `${encodedName}=${encodedValue}`;

          // expires arrives as a string over JSON, so parse it into a Date
          let expires = options.expires ? new Date(options.expires) : undefined;

          // Calculate expires from maxAge if provided (maxAge is in milliseconds)
          if (cookie.value === '') {
            expires = new Date(Date.now() - 600 * 1000); // Set to past time to delete cookie
          } else if (options.maxAge) {
            expires = new Date(Date.now() + options.maxAge);
          }

          if (options.path) cookieStr += `; Path=${options.path}`;
          if (options.domain) cookieStr += `; Domain=${options.domain}`;
          if (expires) cookieStr += `; Expires=${expires.toUTCString()}`;
          if (options.sameSite) cookieStr += `; SameSite=${options.sameSite}`;
          if (options.secure) cookieStr += '; Secure';

          return cookieStr;
        }).filter((cookieStr?: string): cookieStr is string => cookieStr !== undefined);
      } catch (err) {
        return [];
      }
    };

    export default function cookieRequestHandler (ctx: Context) {
      const { reqType, data }: RSARequest = ctx.request.body;
      if (reqType === 'setCookies') {
        const cookieStrings = generateCookieStrings(data);
        cookieStrings.forEach(cookieStr => {
          ctx.response.append('Set-Cookie', cookieStr);
        });
      }
      ctx.status = 200;
    }

    type CookieData = {
      name: string;
      value: string;
    };

    type CookiesReqData = {
      options: {
        expires?: string; // ISO 8601 date string
        maxAge?: number; // In milliseconds
        path?: string;
        domain?: string;
        sameSite?: 'Lax' | 'Strict' | 'None';
        secure?: boolean;
      };
      cookies: CookieData[];
    };

    type RequestData = CookiesReqData;

    type RequestType = 'setCookies';

    // The SDK wraps the cookie payload in this envelope
    type RSARequest = {
      reqType: RequestType;
      workspaceId: string;
      data: RequestData;
    };

    const ALLOWED_COOKIES = [
      'rl_user_id',
      'rl_trait',
      'rl_anonymous_id',
      'rl_group_id',
      'rl_group_trait',
      'rl_page_init_referrer',
      'rl_page_init_referring_domain',
      'rl_session',
      'rl_auth_token'
    ];

    const encode = (value: string) => {
      try {
        return encodeURIComponent(value);
      } catch (err) {
        return undefined;
      }
    };

    const generateCookieStrings = (data: RequestData): string[] => {
      try {
        const { cookies, options } = data;
        return cookies.filter((cookie: CookieData) => ALLOWED_COOKIES.includes(cookie.name)).map((cookie: CookieData) => {
          const encodedName = encode(cookie.name);
          const encodedValue = encode(cookie.value);

          // encode returns undefined instead of throwing, so skip the cookie rather
          // than writing a literal "undefined" into the header
          if (encodedName === undefined || encodedValue === undefined) {
            return undefined;
          }

          let cookieStr = `${encodedName}=${encodedValue}`;

          // expires arrives as a string over JSON, so parse it into a Date
          let expires = options.expires ? new Date(options.expires) : undefined;

          // Calculate expires from maxAge if provided (maxAge is in milliseconds)
          if (cookie.value === '') {
            expires = new Date(Date.now() - 600 * 1000); // Set to past time to delete cookie
          } else if (options.maxAge) {
            expires = new Date(Date.now() + options.maxAge);
          }

          if (options.path) cookieStr += `; Path=${options.path}`;
          if (options.domain) cookieStr += `; Domain=${options.domain}`;
          if (expires) cookieStr += `; Expires=${expires.toUTCString()}`;
          if (options.sameSite) cookieStr += `; SameSite=${options.sameSite}`;
          if (options.secure) cookieStr += '; Secure';

          return cookieStr;
        }).filter((cookieStr?: string): cookieStr is string => cookieStr !== undefined);
      } catch (err) {
        return [];
      }
    };

    export default function cookieRequestHandler(
      req: NextApiRequest,
      res: NextApiResponse
    ) {
      const { reqType, data }: RSARequest = req.body;
      if (reqType === 'setCookies') {
        const cookieStrings = generateCookieStrings(data);
        cookieStrings.forEach(cookieStr => {
          res.append('Set-Cookie', cookieStr);
        });
      }
      res.status(200);
    }

    $allowedCookies = [
        'rl_user_id', 'rl_trait', 'rl_anonymous_id', 'rl_group_id',
        'rl_group_trait', 'rl_page_init_referrer', 'rl_page_init_referring_domain',
        'rl_session', 'rl_auth_token'
    ];

    function isAllowedCookie($name) {
        return in_array($name, $GLOBALS['allowedCookies']);
    }

    function setCookiesFromRequest($data) {
        $cookies = $data['cookies'];
        $options = $data['options'];

        foreach ($cookies as $cookie) {
            if (!isAllowedCookie($cookie['name'])) {
                continue;
            }

            $cookieOptions = []; // Array to hold cookie-specific options
            $maxAge = isset($options['maxAge']) ? $options['maxAge'] : null; // In milliseconds

            if ($cookie['value'] === '') {
                $maxAge = -600 * 1000; // Set negative to ensure cookie is deleted (in milliseconds)
            }

            $expires = null;
            if (isset($maxAge)) {
                $expires = time() + (int) ($maxAge / 1000); // time() is in seconds, so convert maxAge
            } elseif (isset($options['expires'])) {
                $expires = strtotime($options['expires']);
            }

            // Set each option only if it's explicitly provided
            if (isset($expires)) {
                $cookieOptions['expires'] = $expires;
            }
            if (isset($options['path'])) {
                $cookieOptions['path'] = $options['path'];
            }
            if (isset($options['domain'])) {
                $cookieOptions['domain'] = $options['domain'];
            }
            if (isset($options['secure'])) {
                $cookieOptions['secure'] = $options['secure'];
            }
            if (isset($options['sameSite'])) {
                $cookieOptions['samesite'] = $options['sameSite'];
            }

            setcookie($cookie['name'], $cookie['value'], $cookieOptions);
        }
    }

    function cookieRequestHandler() {
        $request = json_decode(file_get_contents('php://input'), true);

        // The SDK wraps the cookie payload in a reqType/workspaceId/data envelope
        if (($request['reqType'] ?? null) === 'setCookies') {
            setCookiesFromRequest($request['data']);
        }
    }

    ALLOWED_COOKIES = [
      'rl_user_id', 'rl_trait', 'rl_anonymous_id', 'rl_group_id',
      'rl_group_trait', 'rl_page_init_referrer', 'rl_page_init_referring_domain',
      'rl_session', 'rl_auth_token'
    ].freeze

    def cookie_request_handler
      rsa_request = JSON.parse(request.body.read)

      # The SDK wraps the cookie payload in a reqType/workspaceId/data envelope
      return head :ok unless rsa_request['reqType'] == 'setCookies'

      data = rsa_request['data']
      cookies_data = data['cookies']
      options = data['options'].symbolize_keys

      cookies_data.each do |cookie|
        next unless ALLOWED_COOKIES.include?(cookie['name'])

        value = cookie['value']

        cookie_options = {
          value: value
        }

        # Calculate expires from maxAge if provided (maxAge is in milliseconds)
        if value.blank?
          cookie_options[:expires] = 600.seconds.ago # Set to past time to delete cookie
        elsif options[:maxAge]
          cookie_options[:expires] = Time.current + (options[:maxAge] / 1000.0).seconds
        elsif options[:expires]
          # expires arrives as a string over JSON, so parse it into a Time
          cookie_options[:expires] = Time.zone.parse(options[:expires])
        end

        # Only set optional parameters if they are provided
        cookie_options[:path] = options[:path] if options[:path]
        cookie_options[:domain] = options[:domain] if options[:domain]
        cookie_options[:secure] = options[:secure] if options[:secure]
        cookie_options[:same_site] = options[:sameSite] if options[:sameSite]

        cookies[cookie['name']] = cookie_options
      end
      head :ok
    end

    import (
        "encoding/json"
        "net/http"
        "time"
    )

    var allowedCookies = []string{
        "rl_user_id", "rl_trait", "rl_anonymous_id", "rl_group_id",
        "rl_group_trait", "rl_page_init_referrer", "rl_page_init_referring_domain",
        "rl_session", "rl_auth_token",
    }

    func isAllowedCookie(name string) bool {
        for _, allowed := range allowedCookies {
            if allowed == name {
                return true
            }
        }
        return false
    }

    func parseSameSite(s string) http.SameSite {
        switch s {
        case "Strict":
            return http.SameSiteStrictMode
        case "Lax":
            return http.SameSiteLaxMode
        case "None":
            return http.SameSiteNoneMode
        default:
            return http.SameSiteDefaultMode
        }
    }

    func cookieRequestHandler(w http.ResponseWriter, r *http.Request) {
        // The SDK wraps the cookie payload in a reqType/workspaceId/data envelope
        var request struct {
            ReqType     string `json:"reqType"`
            WorkspaceID string `json:"workspaceId"`
            Data        struct {
                Cookies []struct {
                    Name  string `json:"name"`
                    Value string `json:"value"`
                } `json:"cookies"`
                Options struct {
                    Expires  *time.Time `json:"expires"` // Parsed from the ISO 8601 date string
                    MaxAge   *int       `json:"maxAge"`  // In milliseconds
                    Path     string     `json:"path"`
                    Domain   string     `json:"domain"`
                    SameSite string     `json:"sameSite"`
                    Secure   bool       `json:"secure"`
                } `json:"options"`
            } `json:"data"`
        }
        json.NewDecoder(r.Body).Decode(&request)

        if request.ReqType != "setCookies" {
            w.WriteHeader(http.StatusOK)
            return
        }

        data := request.Data
        for _, cookie := range data.Cookies {
            if !isAllowedCookie(cookie.Name) {
                continue
            }

            var expires time.Time

            // Calculate expires from maxAge if provided, or use expires if provided
            if cookie.Value == "" {
                expires = time.Now().Add(-600 * time.Second) // Set to past time to delete cookie
            } else if data.Options.MaxAge != nil {
                expires = time.Now().Add(time.Duration(*data.Options.MaxAge) * time.Millisecond)
            } else if data.Options.Expires != nil {
                expires = *data.Options.Expires
            }

            http.SetCookie(w, &http.Cookie{
                Name:     cookie.Name,
                Value:    cookie.Value,
                Expires:  expires,
                Path:     data.Options.Path,
                Domain:   data.Options.Domain,
                Secure:   data.Options.Secure,
                SameSite: parseSameSite(data.Options.SameSite),
            })
        }
        w.WriteHeader(http.StatusOK)
    }