When can you use "adjective + cookie" to mean person?

I’ve seen people use things like "smart cookie" or "strong cookie" when referring to intelligent or strong people, respectively, and I was wondering when and which adjectives you can use in these "constructions", or if you can use any adjective you want.