fix(shield-swap): cookie session outranks bearer; onboarding idempotent under cookie auth

- _headers: prefer the live session (csrf + cookies) over Authorization;
  ss_ tokens don't cover the /access tier and the server reads the header first
- 401 while both credentials are loaded drops the expired session and
  retries as bearer (15-min sessions)
- _auth_done recognizes cookie sessions; CSRF never persisted as jwt;
  from_profile prefers the durable ss_ token over stale session creds

Author: iamalwaysuncomfortable

shield-swap-sdk/python/aleo_shield_swap/api.py

@@ -110,23 +110,40 @@ def is_authenticated(self) -> bool:
 
     def _headers(self) -> dict[str, str]:
         headers = {"accept": "application/json"}
-        if self._token:
-            headers["authorization"] = f"Bearer {self._token}"
         if self._csrf:
-            # Cookie sessions: the access token rides as an httpOnly cookie
-            # on self._session; state-changing calls must echo the CSRF.
+            # A live cookie session outranks a bearer credential: it covers
+            # every tier (ss_ tokens are data/trading-only) and the server
+            # honors the Authorization header over cookies when both are
+            # sent.  The access token rides as an httpOnly cookie on
+            # self._session; requests echo the CSRF.
             headers["x-csrf-token"] = self._csrf
+        elif self._token:
+            headers["authorization"] = f"Bearer {self._token}"
         return headers
 
+    def _expired_session(self, resp: Any) -> bool:
+        """A 401 while riding a cookie session with a bearer in reserve:
+        the (15-min) session expired — drop it and retry as bearer."""
+        if resp.status_code == 401 and self._csrf and self._token:
+            self._csrf = None
+            return True
+        return False
+
     def _get(self, path: str, params: dict[str, Any] | None = None) -> Any:
         resp = self._session.get(f"{self.base_url}{path}", params=params,
                                  headers=self._headers(), timeout=_TIMEOUT)
+        if self._expired_session(resp):
+            resp = self._session.get(f"{self.base_url}{path}", params=params,
+                                     headers=self._headers(), timeout=_TIMEOUT)
         _check(resp)
         return resp.json()
 
     def _post(self, path: str, body: dict[str, Any]) -> Any:
         resp = self._session.post(f"{self.base_url}{path}", json=body,
                                   headers=self._headers(), timeout=_TIMEOUT)
+        if self._expired_session(resp):
+            resp = self._session.post(f"{self.base_url}{path}", json=body,
+                                      headers=self._headers(), timeout=_TIMEOUT)
         _check(resp)
         return resp.json()
 
@@ -314,21 +331,34 @@ def is_authenticated(self) -> bool:
 
     def _headers(self) -> dict[str, str]:
         headers = {"accept": "application/json"}
-        if self._token:
-            headers["authorization"] = f"Bearer {self._token}"
         if self._csrf:
+            # Cookie session outranks bearer — see ApiClient._headers.
             headers["x-csrf-token"] = self._csrf
+        elif self._token:
+            headers["authorization"] = f"Bearer {self._token}"
         return headers
 
+    def _expired_session(self, resp: Any) -> bool:
+        if resp.status_code == 401 and self._csrf and self._token:
+            self._csrf = None
+            return True
+        return False
+
     async def _get(self, path: str, params: dict[str, Any] | None = None) -> Any:
         resp = await self._client.get(f"{self.base_url}{path}", params=params,
                                       headers=self._headers())
+        if self._expired_session(resp):
+            resp = await self._client.get(f"{self.base_url}{path}", params=params,
+                                          headers=self._headers())
         _check(resp)
         return resp.json()
 
     async def _post(self, path: str, body: dict[str, Any]) -> Any:
         resp = await self._client.post(f"{self.base_url}{path}", json=body,
                                        headers=self._headers())
+        if self._expired_session(resp):
+            resp = await self._client.post(f"{self.base_url}{path}", json=body,
+                                           headers=self._headers())
         _check(resp)
         return resp.json()
 

shield-swap-sdk/python/aleo_shield_swap/client.py

@@ -126,10 +126,12 @@ def from_profile(cls, home: Any = None) -> "ShieldSwap":
         dex = cls(aleo)
         dex.profile = profile
         dex.journal = Journal(profile.journal_path)
-        if creds.get("jwt"):
-            dex.api.set_token(creds["jwt"])       # session tier (24h)
-        elif creds.get("dex_api_token"):
+        # Durable ss_ token first — session JWTs are short-lived and stale
+        # ones would shadow a perfectly good API token.
+        if creds.get("dex_api_token"):
             dex.api.set_token(creds["dex_api_token"])  # durable data tier
+        elif creds.get("jwt"):
+            dex.api.set_token(creds["jwt"])       # session tier
         return dex
 
     def _refresh_credentials(self) -> None:

shield-swap-sdk/python/aleo_shield_swap/lifecycle.py

@@ -60,9 +60,12 @@ class Stage:
 # ── Stages ────────────────────────────────────────────────────────────────────
 
 def _auth_done(ctx: _Ctx) -> bool:
-    if getattr(ctx.dex.api, "_token", None) is None:
+    # A credential may be a bearer token OR a cookie session (staging).
+    authed = getattr(ctx.dex.api, "is_authenticated",
+                     getattr(ctx.dex.api, "_token", None) is not None)
+    if not authed:
         return False
-    try:                                  # a stored-but-expired JWT is not auth
+    try:                                  # a stored-but-expired credential is not auth
         ctx.dex.api.access_status()
         return True
     except NotAuthenticatedError:
@@ -73,10 +76,16 @@ def _auth_run(ctx: _Ctx) -> str:
     import aleo
     net = getattr(aleo, ctx.profile.network)
     pk = net.PrivateKey.from_string(ctx.profile.private_key)
-    jwt = ctx.dex.api.authenticate(ctx.profile.address,
-                                   lambda msg: str(pk.sign(msg.encode())))
-    ctx.profile.save_credentials(jwt=jwt)
-    return "authenticated (24h JWT)"
+    ctx.dex.api.authenticate(ctx.profile.address,
+                             lambda msg: str(pk.sign(msg.encode())))
+    # Only a body-JWT (legacy deployments) is worth persisting — a cookie
+    # session's CSRF token is useless in a new process and would shadow the
+    # durable ss_ token if saved as "jwt".
+    jwt = getattr(ctx.dex.api, "_token", None)
+    if jwt:
+        ctx.profile.save_credentials(jwt=jwt)
+        return "authenticated (JWT)"
+    return "authenticated (cookie session)"
 
 
 def _redeem_done(ctx: _Ctx) -> bool:
@@ -87,7 +96,9 @@ def _redeem_run(ctx: _Ctx) -> str:
     if not ctx.invite_code:
         raise NotRedeemedError()
     out = ctx.dex.api.redeem_code(ctx.invite_code)
-    ctx.profile.save_credentials(jwt=getattr(out, "token", None))
+    token = getattr(out, "token", None)
+    if token:                             # legacy deployments only
+        ctx.profile.save_credentials(jwt=token)
     return f"invite redeemed ({out.status})"
 
 

shield-swap-sdk/tests/test_api_client.py

@@ -220,3 +220,29 @@ def test_access_code_self_registration_flow():
     assert out.status == "redeemed"
     assert [c[1] for c in s.calls] == ["https://x/access/generate",
                                        "https://x/access/redeem"]
+
+
+def test_cookie_session_outranks_bearer():
+    # With both credentials loaded, requests ride the cookie session (CSRF
+    # header, no Authorization) — the server honors Authorization first and
+    # ss_ tokens don't cover the /access tier.
+    s = _Session([_Resp(200, {"data": []})])
+    api = ApiClient(base_url="https://x", session=s, token="ss_durable")
+    api._csrf = "csrf-1"
+    api._get("/access/status")
+    headers = s.calls[0][3]
+    assert headers["x-csrf-token"] == "csrf-1"
+    assert "authorization" not in headers
+
+
+def test_expired_cookie_session_falls_back_to_bearer():
+    s = _Session([
+        _Resp(401, {"error": "session expired"}),
+        _Resp(200, {"data": []}),
+    ])
+    api = ApiClient(base_url="https://x", session=s, token="ss_durable")
+    api._csrf = "csrf-1"
+    api._get("/route")
+    assert api._csrf is None                         # session dropped
+    assert s.calls[0][3]["x-csrf-token"] == "csrf-1"
+    assert s.calls[1][3]["authorization"] == "Bearer ss_durable"