Cookie Store API events integration

[annevk]

https://johannhof.github.io/draft-annevk-johannhof-httpbis-cookies/draft-annevk-johannhof-httpbis-cookies.html is currently lacking in that it doesn't support events.

Now we don't want the I-D to have to deal with events or callbacks. So Johann and I came up with this scheme:

• Store a Cookie will no longer call the cookie removal algorithms (expiry and excess) at the end. Instead callers of Store a Cookie will be responsible for that.
• We will no longer call the expiry or excess algorithms directly in the I-D, except for non-browser user agents. For browser user agents we will detail when to call them in a web platform specification as that will enable us to dispatch events at the same time. We will still make the I-D require that web platform specifications call them, just to make it clear that the requirements are roughly the same, just that the layering is allowed to be different.
• Store a Cookie will return the cookie that was changed or null.
• Remove Expired Cookies will return a list of removed cookies (potentially empty).
• Remove Excess Cookies for a Host will return a list of removed cookies (potentially empty).
• Remove Global Excess Cookies will return a list of removed cookies (potentially empty).
• The web platform specifications calling the above algorithms will have to deduplicate the information in the returned lists (using a map most likely, see last bullet point of https://github.com/WICG/cookie-store/issues/230#issuecomment-2143035238) and will also have to distribute the changes across the impacted origins. This unfortunately requires the calling specification to be aware of how cookies are keyed as well, but so be it?

The current Cookie Store API seems to hand-wave a lot of the complexity away, but we hope to improve on that by making it all a bit more grounded. E.g., one of the things that is currently unclear is how the cookie changes are distributed across the various global environments of different origins.

[annevk]

One particular interesting case of this is that Store a Cookie will be followed by a call to Remove Expired Cookies and these might both return the same cookie (meaning it was stored with an expiry-time in the past). The caller will have to deduplicate this into a single removed cookie to be reported through a change event.