From c6823064baa80ce8ae3a34eb940caebbce68ad23 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Mon, 6 Apr 2026 23:17:37 -0400
Subject: [PATCH] cleanup

---
 .../common_responses/advanced_common_web_error.rs    | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/crates/service/web/storyteller_web/src/http_server/common_responses/advanced_common_web_error.rs b/crates/service/web/storyteller_web/src/http_server/common_responses/advanced_common_web_error.rs
index c3998879f9..1bf89948a4 100644
--- a/crates/service/web/storyteller_web/src/http_server/common_responses/advanced_common_web_error.rs
+++ b/crates/service/web/storyteller_web/src/http_server/common_responses/advanced_common_web_error.rs
@@ -202,14 +202,14 @@ impl From<RequireUserSessionError> for AdvancedCommonWebError {
 impl From<HttpUserSessionPayloadError> for AdvancedCommonWebError {
   fn from(value: HttpUserSessionPayloadError) -> Self {
     match &value {
-      // Other JWT errors (verify failure, etc.) → 400 bad input.
-      HttpUserSessionPayloadError::JwtSigner(JwtSignerError::JwtVerifyError(_)) => {
-        Self::BadInputWithSimpleMessage("invalid session".to_string())
-      }
       // Client HTTP header errors → 400 bad input.
       HttpUserSessionPayloadError::HttpSessionHeaderError(_) => {
         Self::BadInputWithSimpleMessage("invalid session".to_string())
       }
+      // JWT verify errors (eg. forged cookies) → 400 bad input.
+      HttpUserSessionPayloadError::JwtSigner(JwtSignerError::JwtVerifyError(_)) => {
+        Self::BadInputWithSimpleMessage("invalid session".to_string())
+      }
       // Server-side JWT signer failures (bad HMAC config, signing failure) → 500.
       HttpUserSessionPayloadError::JwtSigner(
         JwtSignerError::JwtInvalidKeyLength
@@ -224,11 +224,11 @@ impl From<HttpUserSessionPayloadError> for AdvancedCommonWebError {
 impl From<AvtCookiePayloadError> for AdvancedCommonWebError {
   fn from(err: AvtCookiePayloadError) -> Self {
     match &err {
-      // JWT verify errors → 400 bad input.
+      // JWT verify errors (eg. forged cookies) → 400 bad input.
       AvtCookiePayloadError::JwtSigner(JwtSignerError::JwtVerifyError(_)) => {
         Self::BadInputWithSimpleMessage("invalid AVT cookie".to_string())
       }
-      // Server-side JWT signer failures → 500.
+      // Server-side JWT signer failures (bad HMAC config, signing failure) → 500.
       AvtCookiePayloadError::JwtSigner(
         JwtSignerError::JwtInvalidKeyLength
         | JwtSignerError::JwtSignError(_),