coveo.analytics 2.33.0 → 2.33.1

package/dist/react-native.es.js

@@ -342,20 +342,12 @@ const addDefaultValues = (eventType, payload) => {
 
 class Cookie {
     static set(name, value, expire) {
-        var domain, expirationDate, domainParts, host;
+        let expirationDate;
         if (expire) {
             expirationDate = new Date();
             expirationDate.setTime(expirationDate.getTime() + expire);
         }
-        host = window.location.hostname;
-        if (host.indexOf('.') === -1) {
-            writeCookie(name, value, expirationDate);
-        }
-        else {
-            domainParts = host.split('.');
-            domain = domainParts[domainParts.length - 2] + '.' + domainParts[domainParts.length - 1];
-            writeCookie(name, value, expirationDate, domain);
-        }
+        writeCookie(name, value, expirationDate, getCookieDomain(window.location.hostname));
     }
     static get(name) {
         var cookiePrefix = name + '=';
@@ -373,6 +365,35 @@ class Cookie {
         Cookie.set(name, '', -1);
     }
 }
+function getCookieDomain(host) {
+    if (host.indexOf('.') === -1) {
+        return undefined;
+    }
+    const domainParts = host.split('.');
+    for (let domainLength = 2; domainLength <= domainParts.length; domainLength++) {
+        const domain = domainParts.slice(-domainLength).join('.');
+        if (supportsCookieDomain(domain)) {
+            return domain;
+        }
+    }
+    return undefined;
+}
+function supportsCookieDomain(domain) {
+    const name = `__coveo_cookie_domain_test_${Math.random().toString(36).substring(2)}`;
+    try {
+        writeCookie(name, '1', undefined, domain);
+        return Cookie.get(name) === '1';
+    }
+    catch (_a) {
+        return false;
+    }
+    finally {
+        try {
+            writeCookie(name, '', new Date(0), domain);
+        }
+        catch (_b) { }
+    }
+}
 function writeCookie(name, value, expirationDate, domain) {
     document.cookie =
         `${name}=${value}` +
@@ -596,7 +617,7 @@ const addPageViewToHistory = (pageViewValue) => __awaiter(void 0, void 0, void 0
     yield store.addElementAsync(historyElement);
 });
 
-const libVersion = "2.33.0";
+const libVersion = "2.33.1";
 
 const getFormattedLocation = (location) => `${location.protocol}//${location.hostname}${location.pathname.indexOf('/') === 0 ? location.pathname : `/${location.pathname}`}${location.search}`;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coveo.analytics",
-  "version": "2.33.0",
+  "version": "2.33.1",
   "description": "📈 Coveo analytics client (node and browser compatible) ",
   "license": "MIT",
   "author": "Coveo",
@@ -28,8 +28,8 @@
   "browser": "dist/coveoua.browser.js",
   "types": "dist/definitions/coveoua/library.d.ts",
   "dependencies": {
-    "cross-fetch": "3.2.0",
-    "uuid": "14.0.1"
+    "cross-fetch": "4.1.0",
+    "uuid": "14.0.2"
   },
   "devDependencies": {
     "@rollup/plugin-alias": "5.1.1",
@@ -39,18 +39,18 @@
     "@rollup/plugin-replace": "6.0.3",
     "@rollup/plugin-terser": "1.0.0",
     "@rollup/plugin-typescript": "12.3.0",
-    "@types/node": "24.13.3",
+    "@types/node": "24.13.6",
     "fetch-mock": "9.11.0",
-    "jsdom": "28.1.0",
+    "jsdom": "30.1.1",
     "node-fetch": "2.7.0",
-    "publint": "0.3.22",
+    "publint": "0.3.24",
     "react-native-get-random-values": "1.11.0",
-    "rollup": "4.62.4",
+    "rollup": "4.63.4",
     "rollup-plugin-copy": "3.5.0",
     "rollup-plugin-serve": "1.1.1",
     "tslib": "2.8.1",
     "typescript": "6.0.3",
-    "vitest": "4.1.10"
+    "vitest": "4.1.11"
   },
   "engines": {
     "node": "^22.11.0 || ^24.11.0"

package/src/cookieutils.spec.ts

@@ -4,18 +4,48 @@ import {Cookie} from './cookieutils';
 describe('Cookie', () => {
   const originalLocation = window.location;
 
-  const captureCookieWrite = (protocol: string, hostname: string) => {
+  const captureCookieWrite = (
+    protocol: string,
+    hostname: string,
+    validDomains = ['example.com'],
+    throwingDomains: string[] = []
+  ) => {
     Object.defineProperty(window, 'location', {
       configurable: true,
       value: {...originalLocation, protocol, hostname},
     });
+    const cookies = new Map<string, string>();
     const writes: string[] = [];
-    vi.spyOn(document, 'cookie', 'set').mockImplementation((value: string) => {
-      writes.push(value);
+    vi.spyOn(document, 'cookie', 'get').mockImplementation(() =>
+      [...cookies.entries()].map(([name, value]) => `${name}=${value}`).join('; ')
+    );
+    vi.spyOn(document, 'cookie', 'set').mockImplementation((cookie: string) => {
+      writes.push(cookie);
+      const [nameValue, ...attributes] = cookie.split(';');
+      const [name, value] = nameValue.split('=');
+      const domain = attributes
+        .map((attribute) => attribute.trim())
+        .find((attribute) => attribute.startsWith('domain='))
+        ?.substring('domain='.length);
+
+      if (domain && throwingDomains.includes(domain)) {
+        throw new DOMException('Cookie domain is forbidden', 'SecurityError');
+      }
+
+      if (!domain || validDomains.includes(domain)) {
+        if (value) {
+          cookies.set(name, value);
+        } else {
+          cookies.delete(name);
+        }
+      }
     });
     return writes;
   };
 
+  const getCookieWrite = (writes: string[], name: string) =>
+    writes.find((write) => write.startsWith(`${name}=`));
+
   afterEach(() => {
     vi.restoreAllMocks();
     Object.defineProperty(window, 'location', {
@@ -29,7 +59,9 @@ describe('Cookie', () => {
 
     Cookie.set('testCookie', 'testValue');
 
-    expect(writes[0]).toBe('testCookie=testValue;path=/;SameSite=Lax;Secure');
+    expect(getCookieWrite(writes, 'testCookie')).toBe(
+      'testCookie=testValue;path=/;SameSite=Lax;Secure'
+    );
   });
 
   it('omits the Secure attribute when the page is served over http', () => {
@@ -37,7 +69,7 @@ describe('Cookie', () => {
 
     Cookie.set('testCookie', 'testValue');
 
-    expect(writes[0]).toBe('testCookie=testValue;path=/;SameSite=Lax');
+    expect(getCookieWrite(writes, 'testCookie')).toBe('testCookie=testValue;path=/;SameSite=Lax');
   });
 
   it('keeps the domain attribute alongside Secure over https', () => {
@@ -45,7 +77,29 @@ describe('Cookie', () => {
 
     Cookie.set('testCookie', 'testValue');
 
-    expect(writes[0]).toBe('testCookie=testValue;domain=example.com;path=/;SameSite=Lax;Secure');
+    expect(getCookieWrite(writes, 'testCookie')).toBe(
+      'testCookie=testValue;domain=example.com;path=/;SameSite=Lax;Secure'
+    );
+  });
+
+  it('uses the first browser-accepted domain after a multi-label public suffix', () => {
+    const writes = captureCookieWrite('https:', 'www.example.co.uk', ['example.co.uk']);
+
+    Cookie.set('testCookie', 'testValue');
+
+    expect(writes).toEqual(expect.arrayContaining([expect.stringContaining('domain=co.uk')]));
+    expect(getCookieWrite(writes, 'testCookie')).toBe(
+      'testCookie=testValue;domain=example.co.uk;path=/;SameSite=Lax;Secure'
+    );
+  });
+
+  it('continues after a public-suffix cookie write throws', () => {
+    const writes = captureCookieWrite('https:', 'www.example.co.uk', ['example.co.uk'], ['co.uk']);
+
+    expect(() => Cookie.set('testCookie', 'testValue')).not.toThrow();
+    expect(getCookieWrite(writes, 'testCookie')).toBe(
+      'testCookie=testValue;domain=example.co.uk;path=/;SameSite=Lax;Secure'
+    );
   });
 
   it('keeps the expiration attribute alongside Secure over https', () => {
@@ -53,7 +107,8 @@ describe('Cookie', () => {
 
     Cookie.set('testCookie', 'testValue', 3600000);
 
-    expect(writes[0]).toContain('expires=');
-    expect(writes[0]).toContain(';path=/;SameSite=Lax;Secure');
+    const write = getCookieWrite(writes, 'testCookie');
+    expect(write).toContain('expires=');
+    expect(write).toContain(';path=/;SameSite=Lax;Secure');
   });
 });

package/src/cookieutils.ts

@@ -8,21 +8,12 @@ interface CookieDetails {
 // Code originally modified from : https://developers.livechatinc.com/blog/setting-cookies-to-subdomains-in-javascript/
 export class Cookie {
   static set(name: string, value: string, expire?: number) {
-    var domain: string, expirationDate: Date | undefined, domainParts: string[], host: string;
+    let expirationDate: Date | undefined;
     if (expire) {
       expirationDate = new Date();
       expirationDate.setTime(expirationDate.getTime() + expire);
     }
-    host = window.location.hostname;
-    if (host.indexOf('.') === -1) {
-      // no "." in a domain - single domain name, it's localhost or something similar
-      writeCookie(name, value, expirationDate);
-    } else {
-      domainParts = host.split('.');
-      // we always have at least 2 domain parts
-      domain = domainParts[domainParts.length - 2] + '.' + domainParts[domainParts.length - 1];
-      writeCookie(name, value, expirationDate, domain);
-    }
+    writeCookie(name, value, expirationDate, getCookieDomain(window.location.hostname));
   }
 
   static get(name: string) {
@@ -43,6 +34,36 @@ export class Cookie {
   }
 }
 
+function getCookieDomain(host: string) {
+  if (host.indexOf('.') === -1) {
+    return undefined;
+  }
+
+  const domainParts = host.split('.');
+  for (let domainLength = 2; domainLength <= domainParts.length; domainLength++) {
+    const domain = domainParts.slice(-domainLength).join('.');
+    if (supportsCookieDomain(domain)) {
+      return domain;
+    }
+  }
+
+  return undefined;
+}
+
+function supportsCookieDomain(domain: string) {
+  const name = `__coveo_cookie_domain_test_${Math.random().toString(36).substring(2)}`;
+  try {
+    writeCookie(name, '1', undefined, domain);
+    return Cookie.get(name) === '1';
+  } catch {
+    return false;
+  } finally {
+    try {
+      writeCookie(name, '', new Date(0), domain);
+    } catch {}
+  }
+}
+
 function writeCookie(name: string, value: string, expirationDate?: Date, domain?: string) {
   document.cookie =
     `${name}=${value}` +