test: cover cookie merge, request_order precedence, and stale $_REQUEST

- Make Superglobals::getRequestData() accept an optional request_order
  override so precedence and cookie branches can be tested deterministically.
- Add tests for cookie merging, order-sensitive overwrite behavior, and
  unknown order types.
- Add a regression test proving getVar() reflects $_GET changes even when
  $_REQUEST is stale.

Author: rahul05ranjan

system/Superglobals.php

@@ -397,14 +397,20 @@ public function setRequestArray(array $array): self
      * stale. This method returns the current merged values so callers can
      * read up-to-date request data without relying on the stale $_REQUEST.
      *
+     * @param string|null $requestOrder Overrides the ini setting for testing.
+     *
      * @return array<string, request_items>
      */
-    public function getRequestData(): array
+    public function getRequestData(?string $requestOrder = null): array
     {
-        $requestOrder = ini_get('request_order');
+        if ($requestOrder === null) {
+            $requestOrder = ini_get('request_order');
+        }
+
         if ($requestOrder === false || $requestOrder === '') {
             $requestOrder = ini_get('variables_order');
         }
+
         if ($requestOrder === false || $requestOrder === '') {
             $requestOrder = 'GP';
         }

tests/system/HTTP/IncomingRequestTest.php

@@ -76,6 +76,17 @@ public function testCanGrabRequestVars(): void
         $this->assertNull($this->request->getVar('TESTY'));
     }
 
+    public function testGetVarReflectsGetChangesWhenRequestIsStale(): void
+    {
+        // Simulate the state after SiteURIFactory updates $_GET: $_REQUEST
+        // still holds the original value while $_GET has been refreshed.
+        service('superglobals')
+            ->setGetArray(['code' => 'good'])
+            ->setRequestArray(['code' => 'stale']);
+
+        $this->assertSame('good', $this->request->getVar('code'));
+    }
+
     public function testCanGrabGetVars(): void
     {
         service('superglobals')->setGet('TEST', '5');

tests/system/SuperglobalsTest.php

@@ -325,6 +325,40 @@ public function testGetRequestDataReflectsGetChanges(): void
         $this->assertSame('new', $this->superglobals->getRequestData()['key']);
     }
 
+    public function testGetRequestDataMergesCookie(): void
+    {
+        $this->superglobals->setGetArray(['get_key' => 'get_value']);
+        $this->superglobals->setPostArray(['post_key' => 'post_value']);
+        $this->superglobals->setCookieArray(['cookie_key' => 'cookie_value']);
+
+        $data = $this->superglobals->getRequestData('GPC');
+
+        $this->assertSame('get_value', $data['get_key']);
+        $this->assertSame('post_value', $data['post_key']);
+        $this->assertSame('cookie_value', $data['cookie_key']);
+    }
+
+    public function testGetRequestDataRespectsOrder(): void
+    {
+        $this->superglobals->setGetArray(['shared' => 'get']);
+        $this->superglobals->setPostArray(['shared' => 'post']);
+        $this->superglobals->setCookieArray(['shared' => 'cookie']);
+
+        // Later sources overwrite earlier ones, matching PHP's request_order.
+        $this->assertSame('post', $this->superglobals->getRequestData('GP')['shared']);
+        $this->assertSame('cookie', $this->superglobals->getRequestData('GPC')['shared']);
+        $this->assertSame('get', $this->superglobals->getRequestData('PG')['shared']);
+    }
+
+    public function testGetRequestDataIgnoresUnknownOrderTypes(): void
+    {
+        $this->superglobals->setGetArray(['get_key' => 'get_value']);
+
+        $data = $this->superglobals->getRequestData('GX');
+
+        $this->assertSame(['get_key' => 'get_value'], $data);
+    }
+
     // $_FILES tests
     public function testFilesGetArray(): void
     {