fix: prevent cookie header value corruption when saving authenticated pages

[nicomiguelino]

Summary

• Cookie values were re-encoded before being sent as the Cookie header, corrupting tokens containing characters like =, +, /, or %
• Consolidates cookie handling into a small utility (src/assets/ts/utils/cookies.ts) that preserves values verbatim and centralizes domain-matching logic
• Cookies are now gathered for the page URL itself in addition to its resource entries
• Fixes domain matching for the primary-domain-only filter (hostname-based instead of host-based, correct handling of apex/subdomain and host-only cookies)
• Removes the now-unused cookie npm dependency

Test plan

• Added unit tests covering verbatim serialization and domain-matching behavior (src/test/spec/utils/test-cookies.tsx)
• npm test passes (29 specs, 0 failures)
• npm run lint:check and npm run format:check pass
• npm run build compiles cleanly

[Copilot]

Pull request overview

Fixes authenticated asset capture by ensuring cookie values are sent verbatim (no re-encoding) and by centralizing cookie domain-matching logic into a shared utility.

Changes:

• Added buildCookieHeader (verbatim serialization) and filterCookiesByOriginDomain (hostname-based matching) in a new cookies utility.
• Updated asset submission to use the new cookie header builder and removed the cookie npm dependency.
• Updated cookie gathering to include the page URL itself (in addition to resource URLs) and to apply corrected primary-domain filtering, with unit tests added.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/test/spec/utils/test-cookies.tsx	Adds unit tests for verbatim cookie header serialization and domain/host-only matching.
src/assets/ts/utils/cookies.ts	Introduces centralized cookie header building and origin-domain filtering utilities.
src/assets/ts/features/asset/thunks/submit-asset.ts	Switches to buildCookieHeader to avoid value corruption; removes cookie usage.
src/assets/ts/features/asset/thunks/prepare-to-add-to-screenly.ts	Collects cookies for pageUrl plus resources and applies hostname-based domain filtering via the new utility.
package.json	Removes the direct cookie dependency.
package-lock.json	Removes the locked cookie package entry.

Comments suppressed due to low confidence (1)

src/assets/ts/features/asset/thunks/prepare-to-add-to-screenly.ts:83

• The cookie de-duplication key only uses [cookie.domain, cookie.name], which will collapse distinct cookies that share a name/domain but differ by path (and potentially hostOnly). That can drop cookies that would normally be sent together for a URL and can change which value is preserved now that pageUrl is included ahead of resource URLs.

      let cookieJar = Array.from(
        new Map(
          results
            .flat(1)
            .map((cookie: Cookie) => [
              JSON.stringify([cookie.domain, cookie.name]),
              cookie,
            ]),

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.