Self-heal duplicate session cookies from the Domain rollout

Browsers that logged in before the session cookie became Domain-scoped
still hold the old host-only descrybe_session for api.descrybe.io. They
then send BOTH cookies — older (stale) first — and Go reads the first
match, so the stale relic shadows the fresh Domain cookie and every
request 401s even immediately after a successful login. Clearing
browser cookies fixed it manually; users should never have to.

New DedupeSessionCookies middleware (mounted before scs LoadAndSave):
when duplicate session cookies arrive, pick the token that resolves in
the session store, rewrite the Cookie header to just that one, expire
the host-only relic (Set-Cookie without Domain only touches the
host-only variant), and re-issue the surviving token on the canonical
Domain cookie. One request converges the browser to a single cookie.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/api/internal/httpapi/middleware.go

@@ -349,6 +349,91 @@ func LoadSession(sm *scs.SessionManager) func(http.Handler) http.Handler {
 	return sm.LoadAndSave
 }
 
+// DedupeSessionCookies collapses duplicate session cookies into the one whose
+// token resolves in the session store, BEFORE scs reads the request.
+//
+// Why: the session cookie is Domain-scoped (Config.SessionCookieParentDomain)
+// so SvelteKit SSR on the web host receives it. Browsers that still hold the
+// old host-only cookie (pre-rollout) then send BOTH cookies, older first —
+// Go reads the first match, so a stale host-only relic shadows the fresh
+// Domain cookie and every request 401s even right after a successful login.
+// This middleware picks the token that exists in the store, rewrites the
+// Cookie header to just that one, expires the host-only relic, and re-issues
+// the surviving token on the canonical Domain cookie — users self-heal on the
+// next request instead of having to clear cookies.
+func (s *Server) DedupeSessionCookies(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		name := s.Config.SessionCookieName
+		var tokens []string
+		for _, c := range r.Cookies() {
+			if c.Name == name && c.Value != "" {
+				tokens = append(tokens, c.Value)
+			}
+		}
+		if len(tokens) <= 1 {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		chosen := ""
+		if s.Sessions != nil && s.Sessions.Store != nil {
+			for _, tok := range tokens {
+				if _, found, err := s.Sessions.Store.Find(tok); err == nil && found {
+					chosen = tok
+					break
+				}
+			}
+		}
+		if chosen == "" {
+			// No live session among the duplicates — keep the newest cookie
+			// (browsers send older cookies first) so login flows converge.
+			chosen = tokens[len(tokens)-1]
+		}
+
+		var rebuilt []string
+		for _, c := range r.Cookies() {
+			if c.Name == name {
+				continue
+			}
+			rebuilt = append(rebuilt, c.Name+"="+c.Value)
+		}
+		rebuilt = append(rebuilt, name+"="+chosen)
+		r.Header.Set("Cookie", strings.Join(rebuilt, "; "))
+
+		// Expire the host-only relic (Set-Cookie without Domain only touches the
+		// host-only variant) and re-issue the surviving token on the Domain
+		// cookie; if scs also writes the session cookie later in this response,
+		// its header comes after ours and wins.
+		secure := s.Config.CookieSecure()
+		http.SetCookie(w, &http.Cookie{
+			Name:     name,
+			Value:    "",
+			Path:     "/",
+			MaxAge:   -1,
+			HttpOnly: true,
+			Secure:   secure,
+			SameSite: http.SameSiteLaxMode,
+		})
+		if domain := s.Config.SessionCookieParentDomain(); domain != "" {
+			idle := s.Config.SessionIdleHours
+			if idle <= 0 {
+				idle = 24
+			}
+			http.SetCookie(w, &http.Cookie{
+				Name:     name,
+				Value:    chosen,
+				Path:     "/",
+				Domain:   domain,
+				MaxAge:   idle * 3600,
+				HttpOnly: true,
+				Secure:   secure,
+				SameSite: http.SameSiteLaxMode,
+			})
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
 // MaintenanceGate enforces MAINTENANCE_MODE / READ_ONLY_MODE.
 // /healthz and /readyz always pass so cutover rehearsal probes keep working.
 func (s *Server) MaintenanceGate(next http.Handler) http.Handler {