From 23a6e441149583be3e44137d347b8b59f0e4b711 Mon Sep 17 00:00:00 2001
From: Matthew Hilton <matthewhilton@catalyst-au.net>
Date: Mon, 19 Oct 2026 16:34:00 +1000
Subject: [PATCH] fix outage key cookie being dropped during IdP flow

---
 classes/local/outagelib.php    | 15 ++++++++++++---
 tests/local/outagelib_test.php | 18 ++++++++++++++++--
 version.php                    |  4 ++--
 3 files changed, 30 insertions(+), 7 deletions(-)

diff --git a/classes/local/outagelib.php b/classes/local/outagelib.php
index 15c40c9..8cca004 100644
--- a/classes/local/outagelib.php
+++ b/classes/local/outagelib.php
@@ -276,6 +276,8 @@ class outagelib {
         // Since Moodle 4.3 cookiehttponly is default to true and this CFG is not set.
         // so if not set, default to true.
         $cookiehttponly = isset($CFG->cookiehttponly) ? (bool) $CFG->cookiehttponly : true;
+        // SameSite=None lets the cookie accompany the IdP's cross-site POST back to the site.
+        $cookiesamesite = $cookiesecure ? 'None' : 'Lax';
 
         $code = <<<'EOT'
 <?php
@@ -292,7 +294,14 @@ if ((time() >= {{STARTTIME}}) && (time() < {{STOPTIME}})) {
     $isphpunit = defined('PHPUNIT_TEST');
 
     if (!empty($urlaccesskey) && !$isphpunit) {
-        setcookie('auth_outage_accesskey', $urlaccesskey, time() + 86400, '/', '', {{COOKIESECURE}}, {{COOKIEHTTPONLY}});
+        setcookie('auth_outage_accesskey', $urlaccesskey, [
+            'expires' => time() + 86400,
+            'path' => '/',
+            'domain' => '',
+            'secure' => {{COOKIESECURE}},
+            'httponly' => {{COOKIEHTTPONLY}},
+            'samesite' => {{COOKIESAMESITE}},
+        ]);
     }
 
     // Use url access key if given, else the cookie, else null.
@@ -347,11 +356,11 @@ if ((time() >= {{STARTTIME}}) && (time() < {{STOPTIME}})) {
 }
 EOT;
         $search = ['{{STARTTIME}}', '{{STOPTIME}}', '{{USEALLOWEDIPS}}', '{{ALLOWEDIPS}}', '{{USEACCESSKEY}}', '{{ACCESSKEY}}',
-            '{{YOURIP}}', '{{COOKIESECURE}}', '{{COOKIEHTTPONLY}}', '{{METADATA}}'];
+            '{{YOURIP}}', '{{COOKIESECURE}}', '{{COOKIEHTTPONLY}}', '{{COOKIESAMESITE}}', '{{METADATA}}'];
         // Note that var_export is required because (string) false == '', not 'false'.
         $replace = [$starttime, $stoptime, var_export(!empty($allowedips), true), $allowedips, var_export(!empty($accesskey), true),
             $accesskey, getremoteaddr('n/a'), var_export($cookiesecure, true),
-            var_export($cookiehttponly, true), var_export($metadata, true)];
+            var_export($cookiehttponly, true), var_export($cookiesamesite, true), var_export($metadata, true)];
         return str_replace($search, $replace, $code);
     }
 
diff --git a/tests/local/outagelib_test.php b/tests/local/outagelib_test.php
index 49e38a6..eba6008 100644
--- a/tests/local/outagelib_test.php
+++ b/tests/local/outagelib_test.php
@@ -276,7 +276,14 @@ if ((time() >= 123) && (time() < 456)) {
     $isphpunit = defined('PHPUNIT_TEST');
 
     if (!empty($urlaccesskey) && !$isphpunit) {
-        setcookie('auth_outage_accesskey', $urlaccesskey, time() + 86400, '/', '', true, false);
+        setcookie('auth_outage_accesskey', $urlaccesskey, [
+            'expires' => time() + 86400,
+            'path' => '/',
+            'domain' => '',
+            'secure' => true,
+            'httponly' => false,
+            'samesite' => 'None',
+        ]);
     }
 
     // Use url access key if given, else the cookie, else null.
@@ -362,7 +369,14 @@ if ((time() >= 123) && (time() < 456)) {
     $isphpunit = defined('PHPUNIT_TEST');
 
     if (!empty($urlaccesskey) && !$isphpunit) {
-        setcookie('auth_outage_accesskey', $urlaccesskey, time() + 86400, '/', '', true, false);
+        setcookie('auth_outage_accesskey', $urlaccesskey, [
+            'expires' => time() + 86400,
+            'path' => '/',
+            'domain' => '',
+            'secure' => true,
+            'httponly' => false,
+            'samesite' => 'None',
+        ]);
     }
 
     // Use url access key if given, else the cookie, else null.
diff --git a/version.php b/version.php
index a1ed2ed..ad7f3ef 100644
--- a/version.php
+++ b/version.php
@@ -28,8 +28,8 @@
 defined('MOODLE_INTERNAL') || die();
 
 $plugin->component = "auth_outage";
-$plugin->version = 2024081907;                  // The current plugin version (Date: YYYYMMDDXX).
-$plugin->release = 2024081907;                  // Human-readable release information.
+$plugin->version = 2024081908;                  // The current plugin version (Date: YYYYMMDDXX).
+$plugin->release = 2024081908;                  // Human-readable release information.
 $plugin->requires = 2017111309;                 // 2017111309 = T13, but this really requires 3.9 and higher.
 $plugin->maturity = MATURITY_STABLE;            // Suitable for PRODUCTION environments!
 $plugin->supported = [39, 405];                 // A range of branch numbers of supported moodle versions.