Only accept the cookie values written by the toggle action

src/Context/CookieBasedVatContext.php

@@ -22,11 +22,12 @@ public function displayWithVat(): bool
             throw new NoVatContextException();
         }
 
-        $cookie = $request->cookies->get($this->cookieName);
-        if (null === $cookie) {
-            throw new NoVatContextException();
-        }
-
-        return (bool) $cookie;
+        // Anything but the two values written by the toggle action is treated as 'no context', which makes the
+        // composite context fall through to the next context instead of interpreting an arbitrary value
+        return match ($request->cookies->get($this->cookieName)) {
+            '1' => true,
+            '0' => false,
+            default => throw new NoVatContextException(),
+        };
     }
 }

tests/Context/CookieBasedVatContextTest.php

@@ -51,7 +51,7 @@ public function it_throws_exception_if_cookie_is_not_set(): void
     }
 
     /** @test */
-    public function it_returns_true_if_cookie_value_is_truthy(): void
+    public function it_returns_true_if_cookie_value_is_one(): void
     {
         $this->requestStack->push(Request::create(
             uri: '/',
@@ -69,7 +69,7 @@ public function it_returns_true_if_cookie_value_is_truthy(): void
     }
 
     /** @test */
-    public function it_returns_false_if_cookie_value_is_falsy(): void
+    public function it_returns_false_if_cookie_value_is_zero(): void
     {
         $this->requestStack->push(Request::create(
             uri: '/',
@@ -85,4 +85,37 @@ public function it_returns_false_if_cookie_value_is_falsy(): void
 
         $this->assertFalse($vatContext->displayWithVat());
     }
+
+    /**
+     * @test
+     *
+     * @dataProvider unrecognizedCookieValueProvider
+     */
+    public function it_throws_exception_if_cookie_value_is_not_recognized(string $value): void
+    {
+        $this->expectException(NoVatContextException::class);
+
+        $this->requestStack->push(Request::create(
+            uri: '/',
+            cookies: [
+                $this->cookieName => $value,
+            ],
+        ));
+
+        (new CookieBasedVatContext(
+            $this->requestStack,
+            $this->cookieName,
+        ))->displayWithVat();
+    }
+
+    /**
+     * @return iterable<array-key, array{string}>
+     */
+    public function unrecognizedCookieValueProvider(): iterable
+    {
+        yield 'empty string' => [''];
+        yield 'the string false' => ['false'];
+        yield 'the string true' => ['true'];
+        yield 'an arbitrary value' => ['yes please'];
+    }
 }