[CV2-4007] update _checkdesk_session cookie permissions to entire dom…

…ain (#1929)

* [CV2-4007] Set _checkdesk_session_cookie name depending on configuration and environment

[CV2-4007] Set _checkdesk_session_cookie name depending on configuration and environment

---------

Co-authored-by: Skye Bender-deMoll <[email protected]>
Co-authored-by: Jay Joshua <[email protected]>

config/config.yml.example

@@ -273,6 +273,9 @@ development: &default
   devise_unlock_accounts_after: 1
   login_rate_limit: 10
   api_rate_limit: 100
+
+  session_store_key: '_checkdesk_session_dev'
+  session_store_domain: 'localhost'
 test:
   <<: *default
   checkdesk_base_url_private: http://api:3000

config/initializers/session_store.rb

@@ -1,3 +1,8 @@
 # Be sure to restart your server when you modify this file.
 
-Rails.application.config.session_store :cookie_store, key: '_checkdesk_session'
+# Retrieve the session key and domain based on the environment using CheckConfig.
+cookie_key = CheckConfig.get('session_store_key', '_checkdesk_session')
+domain_setting = CheckConfig.get('session_store_domain', Rails.env.development? ? 'localhost' : '.checkmedia.org')
+
+# Configure the session store with the dynamically obtained session key and domain.
+Rails.application.config.session_store :cookie_store, key: cookie_key, domain: domain_setting

test/lib/check_session_store_test.rb

@@ -0,0 +1,37 @@
+require 'test_helper'
+
+class SessionStoreTest < ActiveSupport::TestCase
+  def with_environment(env)
+    original_env = Rails.env
+    Rails.singleton_class.class_eval do
+      define_method(:env) { ActiveSupport::StringInquirer.new(env) }
+    end
+    yield
+  ensure
+    Rails.singleton_class.class_eval do
+      define_method(:env) { original_env }
+    end
+  end
+
+  test "session store configuration with default key and domain when config values are not set" do
+    with_environment('production') do
+      stub_configs({ 'session_store_key' => nil, 'session_store_domain' => nil }) do
+        load Rails.root.join('config/initializers/session_store.rb')
+        assert_equal ActionDispatch::Session::CookieStore, Rails.application.config.session_store
+        assert_equal '_checkdesk_session', Rails.application.config.session_options[:key]
+        assert_equal '.checkmedia.org', Rails.application.config.session_options[:domain]
+      end
+    end
+  end
+
+  test "session store configuration with overriding key and domain in config" do
+    with_environment('production') do
+      stub_configs({ 'session_store_key' => '_checkdesk_session_qa', 'session_store_domain' => 'qa.checkmedia.org' }) do
+        load Rails.root.join('config/initializers/session_store.rb')
+        assert_equal ActionDispatch::Session::CookieStore, Rails.application.config.session_store
+        assert_equal '_checkdesk_session_qa', Rails.application.config.session_options[:key]
+        assert_equal 'qa.checkmedia.org', Rails.application.config.session_options[:domain]
+      end
+    end
+  end
+end