Fix cookie parameters silently dropped in API calls

The schema declared `in: cookie` as valid but callApi never sent them.
Cookie parameters are now collected and sent as a Cookie header.

Author: andreogle

src/api/call.test.ts

@@ -330,6 +330,33 @@ describe('callApi', () => {
     expect(options.body).toBe(JSON.stringify({ amount: '1000' }));
   });
 
+  test('sends cookie parameters as Cookie header', async () => {
+    const api = makeApi();
+    const endpoint = makeEndpoint({
+      parameters: [
+        { name: 'session', in: 'cookie', required: true, secret: false, fixed: 'abc123' },
+        { name: 'tracking', in: 'cookie', required: false, secret: false },
+      ],
+    });
+
+    await callApi(api, endpoint, { tracking: 'xyz' });
+
+    const { options } = fetchCallArguments();
+    expect((options.headers as Record<string, string>)['Cookie']).toBe('session=abc123; tracking=xyz');
+  });
+
+  test('omits Cookie header when no cookie parameters have values', async () => {
+    const api = makeApi();
+    const endpoint = makeEndpoint({
+      parameters: [{ name: 'session', in: 'cookie', required: false, secret: false }],
+    });
+
+    await callApi(api, endpoint, {});
+
+    const { options } = fetchCallArguments();
+    expect((options.headers as Record<string, string>)['Cookie']).toBeUndefined();
+  });
+
   test('returns null data for empty response body (204 No Content)', async () => {
     fetchMock.mockResolvedValue({
       text: () => Promise.resolve(''),

src/api/call.ts

@@ -43,6 +43,7 @@ async function callApi(
   const headerParameters = Object.fromEntries(
     resolvedParameters.filter((p) => p.in === 'header' && !isNil(p.value)).map((p) => [p.name, p.value as string])
   );
+  const cookieParameters = resolvedParameters.filter((p) => p.in === 'cookie' && !isNil(p.value));
   const bodyParameters = Object.fromEntries(
     resolvedParameters.filter((p) => p.in === 'body' && !isNil(p.value)).map((p) => [p.name, p.value])
   );
@@ -65,6 +66,12 @@ async function callApi(
     ...api.headers,
   };
 
+  if (cookieParameters.length > 0) {
+    const cookieString = cookieParameters.map((p) => `${p.name}=${p.value as string}`).join('; ');
+    const existing = headers['Cookie'];
+    headers['Cookie'] = existing ? `${existing}; ${cookieString}` : cookieString; // eslint-disable-line functional/immutable-data
+  }
+
   const hasBody = endpoint.method === 'POST' || endpoint.method === 'PUT' || endpoint.method === 'PATCH';
   const body = hasBody && Object.keys(bodyParameters).length > 0 ? JSON.stringify(bodyParameters) : undefined;