Detect HTTP-header cookies via CookieStore change event

Progressive enhancement for Chromium browsers: listen on the
CookieStore change event to catch cookies set by Set-Cookie HTTP
response headers, which the document.cookie setter hook cannot see.
Adds a new "http" cookie source through the full stack.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/coredata/cookie_source.go

@@ -24,12 +24,14 @@ type CookieSource string
 const (
 	CookieSourceScript      CookieSource = "SCRIPT"
 	CookieSourcePreExisting CookieSource = "PRE_EXISTING"
+	CookieSourceHTTP        CookieSource = "HTTP"
 )
 
 func CookieSources() []CookieSource {
 	return []CookieSource{
 		CookieSourceScript,
 		CookieSourcePreExisting,
+		CookieSourceHTTP,
 	}
 }
 
@@ -53,6 +55,8 @@ func (s *CookieSource) Scan(value any) error {
 		*s = CookieSourceScript
 	case CookieSourcePreExisting:
 		*s = CookieSourcePreExisting
+	case CookieSourceHTTP:
+		*s = CookieSourceHTTP
 	default:
 		return fmt.Errorf("invalid CookieSource value: %q", v)
 	}
@@ -62,7 +66,8 @@ func (s *CookieSource) Scan(value any) error {
 func (s CookieSource) Value() (driver.Value, error) {
 	switch s {
 	case CookieSourceScript,
-		CookieSourcePreExisting:
+		CookieSourcePreExisting,
+		CookieSourceHTTP:
 		return string(s), nil
 	default:
 		return nil, fmt.Errorf("invalid CookieSource: %s", s)

pkg/coredata/migrations/20260506T144600Z.sql

@@ -0,0 +1,15 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+ALTER TYPE cookie_source ADD VALUE IF NOT EXISTS 'HTTP';

pkg/server/api/cookiebanner/v1/handler.go

@@ -266,6 +266,8 @@ func (h *Handler) handleReportDetectedCookies(w http.ResponseWriter, r *http.Req
 		switch strings.TrimSpace(c.Source) {
 		case "pre-existing":
 			source = coredata.CookieSourcePreExisting
+		case "http":
+			source = coredata.CookieSourceHTTP
 		default:
 			source = coredata.CookieSourceScript
 		}
@@ -358,6 +360,8 @@ func (h *Handler) handleReportDetectedTrackers(w http.ResponseWriter, r *http.Re
 		switch strings.TrimSpace(c.Source) {
 		case "pre-existing":
 			source = coredata.CookieSourcePreExisting
+		case "http":
+			source = coredata.CookieSourceHTTP
 		default:
 			source = coredata.CookieSourceScript
 		}