Solution

You'll wrap document.cookie: set serializes an encoded name=value plus attributes, getAll parses the read string into a decoded object, get reads one key from it, and remove re-sets the cookie with max-age=0.

The problem, in plain English

document.cookie is asymmetric. Reading returns all cookies as "a=1; b=2". Writing takes one cookie's serialized form and merges it in. So the wrapper has two halves: a serializer (set/remove) that builds name=value; path=…; max-age=… strings, and a parser (get/getAll) that splits the read string back into an object. Both halves must URL-encode/decode, because a value like a=b; c contains the very delimiters cookies use — leave it raw and you'd write a broken, ambiguous string. And there's no "delete cookie" call: you remove one by setting it with an already-elapsed lifetime (max-age=0).

The mental model

Two directions:

• Out (write): set(name, value, opts) → encodeURIComponent both parts, append ; path=… and ; max-age=…, assign to document.cookie. remove is a set with max-age=0.
• In (read): getAll() → split document.cookie on '; ', split each pair on its first =, decodeURIComponent both sides into an object. get(name) is a lookup in that object.

Encoding is the thread through both: encode on the way out, decode on the way in, so arbitrary values round-trip.

A first attempt

The naive version skips encoding and parses too eagerly:

function cookieStoreNaive() {
  return {
    set: (name, value) => { document.cookie = `${name}=${value}`; }, // no encode, no path
    get: (name) => {
      const pairs = document.cookie.split(';');            // no space handling
      for (const p of pairs) {
        const [k, v] = p.split('=');                        // breaks on '=' in value
        if (k === name) return v;                           // stray whitespace in k
      }
      return null;
    },
  };
}

Bugs everywhere. Setting a value containing ; or = (a JWT, a JSON blob) corrupts the cookie string. split('=') breaks any value that itself contains = (base64 padding!). split(';') without trimming leaves leading spaces on names ( b vs b). And there's no max-age/path, so remove is impossible. Encoding, splitting on the first =, and trimming fix it.

The working solution

function cookieStore() {
  function set(name, value, options = {}) {
    const { maxAge, path = '/' } = options;
    let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
    cookie += `; path=${path}`;
    if (maxAge !== undefined) cookie += `; max-age=${maxAge}`;
    document.cookie = cookie;
  }

  function getAll() {
    const result = {};
    if (!document.cookie) return result;
    for (const pair of document.cookie.split('; ')) {
      const eq = pair.indexOf('='); // split on the FIRST '=' only
      if (eq === -1) continue;
      const name = decodeURIComponent(pair.slice(0, eq));
      const value = decodeURIComponent(pair.slice(eq + 1));
      result[name] = value;
    }
    return result;
  }

  function get(name) {
    const all = getAll();
    return name in all ? all[name] : null;
  }

  function remove(name, options = {}) {
    const { path = '/' } = options;
    // Expire it: same name/path, zero lifetime.
    document.cookie = `${encodeURIComponent(name)}=; path=${path}; max-age=0`;
  }

  return { get, set, remove, getAll };
}

module.exports = { cookieStore };

set encodes both name and value (so delimiters survive), always writes path=/ (so remove can target the same cookie), and appends max-age when given. getAll parses document.cookie: split on '; ', then split each pair on the first = via indexOf/slice (a value can contain encoded/real =), decoding both sides into an object. get is a lookup with an explicit null for absence. remove re-sets the cookie with max-age=0 and the same path, which the browser treats as "expired now" and drops. Encoding on write + decoding on read makes any value round-trip.

Walking through one call

store.set('token', 'a=b; c') then store.get('token'), then store.remove('token'):

• set — encodeURIComponent('a=b; c') → 'a%3Db%3B%20c'. Writes token=a%3Db%3B%20c; path=/. The ;/=/space are now safely %3B/%3D/%20, so the cookie string isn't corrupted.
• get — getAll splits document.cookie on '; ', finds token=a%3Db%3B%20c, splits on the first = → name token, value a%3Db%3B%20c; decodeURIComponent → 'a=b; c'. The exact original value came back.
• remove — writes token=; path=/; max-age=0. The browser expires it immediately; a subsequent get('token') returns null.

Gotchas

• Not encoding — a value with ;/=/space corrupts the cookie string (or splits into phantom cookies). encodeURIComponent both name and value.
• split('=') on a pair — breaks values containing = (base64 ==, a=b). Split on the first = with indexOf/slice.
• Not trimming after split(';') — names get a leading space. Split on '; ' (or .trim()).
• Trying to "delete" — there's no delete API; re-set with max-age=0 (and the same path, or the browser won't match the cookie you meant).

Going further

• SameSite / Secure / HttpOnly — real cookies carry security attributes; HttpOnly cookies are invisible to document.cookie entirely (that's the point).
• Signed / JSON cookies — layering JSON.stringify + a signature over set/get gives typed, tamper-evident cookies.
• The Cookie Store API — the modern async cookieStore.get()/set() (a real browser API) supersedes document.cookie; this exercise reimplements its ergonomics over the legacy string.