Allow configuring the cookie domain

[loevgaard]

Fixes #29

Stacked on #50.

Problem

Meta writes _fbp and _fbc on the registrable domain and encodes the level it used in the second segment of the value: fb.1. means example.com, fb.2. means www.example.com, fb.0. means a single label host.

The bundle created host-only cookies, because no domain was ever passed to Cookie::create(), while the SDK value objects default the subdomain index to 1. So on www.example.com the cookie was scoped to that host but its value claimed it was set on the registrable domain. A visitor moving between the apex, www and a checkout subdomain got different cookies, and the browser pixel could write its own domain cookie alongside the server's host-only one, giving one person two _fbp values.

Change

New options:

setono_meta_conversions_api:
    cookies:
        domain: null          # e.g. example.com
        lifetime: '+90 days'

A new Cookie\CookieDomain service answers two questions: which domain to write on, and what subdomain index goes with it. The index is the number of dots in the domain the cookie actually ends up on, which is exactly how Meta's own parameter builder computes it:

$this->sub_domain_index = substr_count($this->etld_plus_1, '.');

It is capped at 2, since the SDK asserts the value is 0, 1 or 2.

Crucially the index is applied where the value is created, in GeneratedFbpContext and QueryBasedFbcContext, not where the cookie is written. That keeps the value in the cookie and the value sent to Meta identical. A value parsed from an existing cookie keeps the index it already had.

Tests

Ten unit tests for CookieDomain covering configured domains, a leading dot, a capped deep subdomain, the request host fallback and the no-request case, plus two new tests each for GeneratedFbpContext, QueryBasedFbcContext and StoreFbpSubscriber asserting the index and the written domain line up.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.07%. Comparing base (0fb55dd) to head (af4b440).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master      #51      +/-   ##
============================================
+ Coverage     97.95%   98.07%   +0.12%     
- Complexity      151      158       +7     
============================================
  Files            32       33       +1     
  Lines           488      519      +31     
============================================
+ Hits            478      509      +31     
  Misses           10       10              

Files with missing lines	Coverage Δ
src/Context/Fbc/QueryBasedFbcContext.php	100.00% <100.00%> (ø)
src/Context/Fbp/GeneratedFbpContext.php	100.00% <100.00%> (ø)
src/Cookie/CookieDomain.php	100.00% <100.00%> (ø)
src/DependencyInjection/Configuration.php	98.94% <100.00%> (+0.19%)	⬆️
...ncyInjection/SetonoMetaConversionsApiExtension.php	97.29% <100.00%> (+0.23%)	⬆️
src/EventSubscriber/StoreFbcSubscriber.php	100.00% <100.00%> (ø)
src/EventSubscriber/StoreFbpSubscriber.php	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[loevgaard]

Closing without merging. The domain and lifetime options solve a real but narrow problem — a site served on both the apex and www, where host-only cookies diverge from the ones the pixel writes on the registrable domain — with the wrong tool. The registrable domain is derivable from the request host, which is what Meta's own parameter builder does automatically via eTLD+1. Asking someone to type example.com into YAML is the lazy version of that, and lifetime has no realistic reason to ever change from Meta's 90 days.

The remaining part, deriving the subdomain index from the host so the value agrees with where the cookie was set, is correct but small, and there is no evidence Meta rejects the mismatch. If the SDK adopts the CookieResolver, both come for free; if not, the multi-host case is rare enough to leave as is.

The branch is deleted here; the work is kept locally if any of it is ever wanted.