Port upstream 0.68.0: Venice web session per-browser fall-through (stacked on #626)

rust/src/browser/cookies.rs

@@ -770,6 +770,22 @@ pub fn get_cookie_headers_for_domain(
     Ok(headers)
 }
 
+/// Get cookie candidates from every detected browser that has readable cookies
+/// for a domain, preserving browser order and cookie metadata for provider-side
+/// host filtering. Reports App-Bound Encryption when it is the only blocker.
+pub fn get_cookies_by_browser_for_domain(
+    domain: &str,
+) -> Result<Vec<(BrowserType, Vec<Cookie>)>, CookieError> {
+    let scan = extract_domain_candidates(domain)?;
+    if scan.candidates.is_empty() && scan.abe_error_seen {
+        return Err(CookieError::AppBoundEncryption);
+    }
+    if scan.candidates.is_empty() {
+        return Err(CookieError::NotFound(domain.to_string()));
+    }
+    Ok(scan.candidates)
+}
+
 /// Get a cookie header string for a domain
 pub fn get_cookie_header(domain: &str) -> Result<String, CookieError> {
     let cookies = get_cookies_for_domain(domain)?;

rust/src/providers/mod.rs

@@ -232,6 +232,19 @@ pub(crate) fn browser_cookie_headers_for_domain(
         .map_err(map_browser_cookie_error)
 }
 
+pub(crate) fn browser_cookie_candidates_for_domain(
+    domain: &str,
+) -> Result<
+    Vec<(
+        crate::browser::detection::BrowserType,
+        Vec<crate::browser::cookies::Cookie>,
+    )>,
+    crate::core::ProviderError,
+> {
+    crate::browser::cookies::get_cookies_by_browser_for_domain(domain)
+        .map_err(map_browser_cookie_error)
+}
+
 /// All non-empty values for one cookie name in a `Cookie:` header, in order.
 /// Returns every value so callers can reject duplicates instead of silently
 /// picking the first.