don't want this blowing up silently, so let's 500 on invalid payloads

- was still getting dozens of pages from these two endpoints
- fixed the error chain so this is semantically correct
- improved code quality of legacy code/endpoints

Cargo.lock

@@ -6089,7 +6089,6 @@ dependencies = [
 name = "jwt_signer"
 version = "0.0.1"
 dependencies = [
- "errors",
  "hmac 0.10.1",
  "jwt",
  "sha2 0.9.9",

crates/lib/actix_artcraft/src/sessions/anonymous_visitor_tracking/avt_cookie_manager.rs

@@ -0,0 +1,142 @@
+use actix_web::cookie::time::OffsetDateTime;
+use actix_web::cookie::{Cookie, SameSite};
+use actix_web::HttpRequest;
+use log::warn;
+
+use crate::sessions::anonymous_visitor_tracking::avt_cookie_payload::AvtCookiePayload;
+use crate::sessions::anonymous_visitor_tracking::avt_cookie_payload_error::AvtCookiePayloadError;
+use crate::sessions::anonymous_visitor_tracking::avt_payload_signer::AvtPayloadSigner;
+use tokens::tokens::anonymous_visitor_tracking::AnonymousVisitorTrackingToken;
+
+const VISITOR_COOKIE_NAME : &str = "visitor";
+
+/// Handle "anonymous visitor tracking" cookies.
+/// This enables us to associate results with an anonymous user for a better experience,
+/// as well as do some form of return visitor tracking.
+#[derive(Clone)]
+pub struct AvtCookieManager {
+  cookie_domain: String,
+  payload_signer: AvtPayloadSigner,
+}
+
+impl AvtCookieManager {
+
+  pub fn new(cookie_domain: &str, hmac_secret: &str) -> Result<Self, AvtCookiePayloadError> {
+    Ok(Self {
+      cookie_domain: cookie_domain.to_string(),
+      payload_signer: AvtPayloadSigner::new(hmac_secret)?,
+    })
+  }
+
+  pub fn make_new_cookie(&self) -> Result<Cookie, AvtCookiePayloadError> {
+    let token = AnonymousVisitorTrackingToken::generate();
+    self.make_new_cookie_with_apriori_token(&token)
+  }
+
+  pub fn make_new_cookie_with_apriori_token(
+    &self,
+    token: &AnonymousVisitorTrackingToken,
+  ) -> Result<Cookie, AvtCookiePayloadError> {
+    let payload = AvtCookiePayload::from_token(token.clone());
+    let jwt_string = self.payload_signer.encode(&payload)?;
+
+    let make_secure = !self.cookie_domain.to_lowercase().contains("jungle.horse")
+        && !self.cookie_domain.to_lowercase().contains("localhost");
+
+    let same_site = if make_secure {
+      SameSite::None // NB: Allow usage from other domains
+    } else {
+      SameSite::Lax // NB: You can't set "SameSite=None" on non-secure cookies
+    };
+
+    Ok(Cookie::build(VISITOR_COOKIE_NAME, jwt_string)
+        .secure(make_secure) // HTTPS-only
+        .same_site(same_site)
+        .permanent()
+        .path("/") // NB: Otherwise it'll be set to `/v1`
+        //.domain(&self.cookie_domain)
+        //.http_only(true) // Not exposed to Javascript
+        .finish())
+  }
+
+  pub fn make_delete_cookie(&self) -> Cookie {
+    let mut cookie = Cookie::build(VISITOR_COOKIE_NAME, "DELETED")
+        .expires(OffsetDateTime::UNIX_EPOCH)
+        .path("/") // NB: Otherwise it'll be set to `/v1`
+        .finish();
+    cookie.make_removal();
+    cookie
+  }
+
+  pub fn decode_cookie_payload(
+    &self,
+    visitor_cookie: &Cookie,
+  ) -> Result<AvtCookiePayload, AvtCookiePayloadError> {
+    self.payload_signer.decode(visitor_cookie.value())
+  }
+
+  pub fn decode_cookie_payload_from_request(
+    &self,
+    request: &HttpRequest,
+  ) -> Result<Option<AvtCookiePayload>, AvtCookiePayloadError> {
+    let cookie = match request.cookie(VISITOR_COOKIE_NAME) {
+      None => return Ok(None),
+      Some(cookie) => cookie,
+    };
+
+    match self.decode_cookie_payload(&cookie) {
+      Err(e) => {
+        warn!("Visitor cookie decode error: {:?}", e);
+        Err(e)
+      },
+      Ok(payload) => Ok(Some(payload)),
+    }
+  }
+
+  pub fn get_avt_token_from_request(
+    &self,
+    request: &HttpRequest,
+  ) -> Option<AnonymousVisitorTrackingToken> {
+    self.decode_cookie_payload_from_request(request)
+        .ok()
+        .flatten()
+        .map(|payload| payload.avt_token)
+  }
+}
+
+#[cfg(test)]
+mod tests {
+  use actix_web::test::TestRequest;
+
+  use crate::sessions::anonymous_visitor_tracking::avt_cookie_manager::AvtCookieManager;
+  use tokens::tokens::anonymous_visitor_tracking::AnonymousVisitorTrackingToken;
+
+  #[test]
+  fn test_create_cookie() {
+    // NB: Stable encoding test. If this changes we should bump the cookie version
+    //     so we don't accidentally invalidate visitor tracking on existing cookies.
+    let manager = AvtCookieManager::new("fakeyou.com", "secret").unwrap();
+    let token = AnonymousVisitorTrackingToken::new_from_str("avt_ex_anonymous_visitor_tracking_token");
+    let cookie = manager.make_new_cookie_with_apriori_token(&token).unwrap();
+
+    assert_eq!(cookie.value(), "eyJhbGciOiJIUzI1NiJ9.eyJhdnRfdG9rZW4iOiJhdnRfZXhfYW5vbnltb3VzX3Zpc2l0b3JfdHJhY2tpbmdfdG9rZW4iLCJjb29raWVfdmVyc2lvbiI6IjEifQ.w0KRxBxiyBfTZGxaezRa0IgD8ojmCnhRH4SS33Nq3O8");
+  }
+
+  #[test]
+  fn test_cookie_round_trip() {
+    let manager = AvtCookieManager::new("fakeyou.com", "secret").unwrap();
+    let token = AnonymousVisitorTrackingToken::new_from_str("avt_ex_anonymous_visitor_tracking_token");
+    let cookie = manager.make_new_cookie_with_apriori_token(&token).unwrap();
+
+    let http_request = TestRequest::default()
+        .cookie(cookie)
+        .to_http_request();
+
+    let decoded = manager.decode_cookie_payload_from_request(&http_request)
+        .expect("no error")
+        .expect("must exist");
+
+    assert_eq!(decoded.avt_token.as_str(), "avt_ex_anonymous_visitor_tracking_token");
+    assert_eq!(decoded.cookie_version, 1);
+  }
+}

crates/lib/actix_artcraft/src/sessions/anonymous_visitor_tracking/avt_cookie_payload.rs

@@ -1,7 +1,7 @@
 use std::collections::BTreeMap;
 use std::str::FromStr;
 
-use crate::error::internal_error::InternalError;
+use crate::sessions::anonymous_visitor_tracking::avt_cookie_payload_error::AvtCookiePayloadError;
 use tokens::tokens::anonymous_visitor_tracking::AnonymousVisitorTrackingToken;
 
 /**
@@ -43,18 +43,18 @@ impl AvtCookiePayload {
     }
   }
 
-  pub fn from_map(map: BTreeMap<String, String>) -> Result<Self, InternalError> {
+  pub fn from_map(map: BTreeMap<String, String>) -> Result<Self, AvtCookiePayloadError> {
     let avt_token = map.get("avt_token")
-        .ok_or_else(|| InternalError::VisitorCookieMissingField("avt_token"))?;
+        .ok_or(AvtCookiePayloadError::MissingField("avt_token"))?;
 
     let cookie_version = map
         .get("cookie_version")
-        .ok_or_else(|| InternalError::VisitorCookieMissingField("cookie_version"))?;
+        .ok_or(AvtCookiePayloadError::MissingField("cookie_version"))?;
 
     let avt_token = AnonymousVisitorTrackingToken::new_from_str(avt_token);
 
     let cookie_version = u32::from_str(cookie_version)
-        .map_err(|e| InternalError::VisitorCookieError(
+        .map_err(|e| AvtCookiePayloadError::PayloadDecodeError(
           format!("invalid integer for cookie_version: {:?}, version: {}", e, cookie_version)))?;
 
     Ok(AvtCookiePayload {
@@ -75,7 +75,7 @@ impl AvtCookiePayload {
 mod tests {
   use tokens::tokens::anonymous_visitor_tracking::AnonymousVisitorTrackingToken;
 
-  use crate::http_server::cookies::anonymous_visitor_tracking::avt_cookie_payload::AvtCookiePayload;
+  use crate::sessions::anonymous_visitor_tracking::avt_cookie_payload::AvtCookiePayload;
 
   #[test]
   fn test_new() {

crates/lib/actix_artcraft/src/sessions/anonymous_visitor_tracking/avt_cookie_payload_error.rs

@@ -0,0 +1,55 @@
+use std::error::Error;
+use std::fmt::{Display, Formatter};
+
+use jwt_signer::jwt_signer_error::JwtSignerError;
+
+#[derive(Debug)]
+pub enum AvtCookiePayloadError {
+  /// AVT cookie payload is missing a required field.
+  MissingField(&'static str),
+
+  /// Generic decode error (e.g. invalid integer for cookie_version).
+  PayloadDecodeError(String),
+
+  /// Error encoding, decoding, or constructing the JWT signer.
+  JwtSigner(JwtSignerError),
+}
+
+impl AvtCookiePayloadError {
+  pub fn is_server_error(&self) -> bool {
+    match self {
+      // JWT verify errors (eg. forged cookies) → 400 bad input.
+      AvtCookiePayloadError::JwtSigner(JwtSignerError::JwtVerifyError(_)) => {
+        false
+      },
+      // Server-side JWT signer failures (bad HMAC config, signing failure) → 500.
+      AvtCookiePayloadError::JwtSigner(
+        JwtSignerError::JwtInvalidKeyLength | JwtSignerError::JwtSignError(_)
+      ) => {
+        true
+      },
+      // Other payload decode failures (how did these make it into the wild!?) → 500
+      AvtCookiePayloadError::MissingField(_) | AvtCookiePayloadError::PayloadDecodeError(_) => {
+        true
+      }
+    }
+  }
+}
+
+impl Display for AvtCookiePayloadError {
+  fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+    match self {
+      Self::MissingField(field) => write!(f, "AVT cookie missing field: {}", field),
+      Self::PayloadDecodeError(reason) => write!(f, "AVT cookie decode error: {}", reason),
+      Self::JwtSigner(e) => write!(f, "JWT signer error: {}", e),
+    }
+  }
+}
+
+impl Error for AvtCookiePayloadError {}
+
+impl From<JwtSignerError> for AvtCookiePayloadError {
+  fn from(err: JwtSignerError) -> Self {
+    Self::JwtSigner(err)
+  }
+}

crates/lib/actix_artcraft/src/sessions/anonymous_visitor_tracking/avt_payload_signer.rs

@@ -0,0 +1,77 @@
+use crate::sessions::anonymous_visitor_tracking::avt_cookie_payload::AvtCookiePayload;
+use crate::sessions::anonymous_visitor_tracking::avt_cookie_payload_error::AvtCookiePayloadError;
+use jwt_signer::jwt_signer::JwtSigner;
+
+/// Signs and verifies the AVT cookie payload using HMAC-signed JWTs.
+/// This module is intentionally HTTP-agnostic. The HTTP / cookie wrapper lives in `avt_cookie_manager`.
+#[derive(Clone)]
+pub struct AvtPayloadSigner {
+  jwt_signer: JwtSigner,
+}
+
+impl AvtPayloadSigner {
+  pub fn new(hmac_secret: &str) -> Result<Self, AvtCookiePayloadError> {
+    Ok(Self {
+      jwt_signer: JwtSigner::new(hmac_secret)?,
+    })
+  }
+
+  pub fn encode(&self, payload: &AvtCookiePayload) -> Result<String, AvtCookiePayloadError> {
+    let claims = payload.to_map();
+    let jwt_string = self.jwt_signer.claims_to_jwt(&claims)?;
+    Ok(jwt_string)
+  }
+
+  pub fn decode(&self, jwt: &str) -> Result<AvtCookiePayload, AvtCookiePayloadError> {
+    let claims = self.jwt_signer.jwt_to_claims(jwt)?;
+    AvtCookiePayload::from_map(claims)
+  }
+}
+
+#[cfg(test)]
+mod tests {
+  use crate::sessions::anonymous_visitor_tracking::avt_cookie_payload::AvtCookiePayload;
+  use crate::sessions::anonymous_visitor_tracking::avt_payload_signer::AvtPayloadSigner;
+  use tokens::tokens::anonymous_visitor_tracking::AnonymousVisitorTrackingToken;
+
+  #[test]
+  fn test_encode() {
+    // NB: Stable encoding test. If this changes we should bump the cookie version.
+    let signer = AvtPayloadSigner::new("fake_secret").unwrap();
+    let token = AnonymousVisitorTrackingToken::new_from_str("avt_ex_anonymous_visitor_tracking_token");
+    let payload = AvtCookiePayload::from_token(token);
+
+    let encoded = signer.encode(&payload).unwrap();
+
+    assert_eq!(
+      encoded,
+      "eyJhbGciOiJIUzI1NiJ9.eyJhdnRfdG9rZW4iOiJhdnRfZXhfYW5vbnltb3VzX3Zpc2l0b3JfdHJhY2tpbmdfdG9rZW4iLCJjb29raWVfdmVyc2lvbiI6IjEifQ.5jgQfSXue684okKBzW3847jEhL7eLQKzelyAkgnwe_I"
+    );
+  }
+
+  #[test]
+  fn test_decode_version_1() {
+    // NB: Version 1 payload. The expected encoded value below was generated by `test_encode`.
+    let payload =
+        "eyJhbGciOiJIUzI1NiJ9.eyJhdnRfdG9rZW4iOiJhdnRfZXhfYW5vbnltb3VzX3Zpc2l0b3JfdHJhY2tpbmdfdG9rZW4iLCJjb29raWVfdmVyc2lvbiI6IjEifQ.5jgQfSXue684okKBzW3847jEhL7eLQKzelyAkgnwe_I";
+
+    let signer = AvtPayloadSigner::new("fake_secret").unwrap();
+    let decoded = signer.decode(payload).unwrap();
+
+    assert_eq!(decoded.avt_token.as_str(), "avt_ex_anonymous_visitor_tracking_token");
+    assert_eq!(decoded.cookie_version, 1);
+  }
+
+  #[test]
+  fn test_round_trip() {
+    let signer = AvtPayloadSigner::new("fake_secret").unwrap();
+    let token = AnonymousVisitorTrackingToken::new_from_str("avt_ex_anonymous_visitor_tracking_token");
+    let payload = AvtCookiePayload::from_token(token);
+
+    let encoded = signer.encode(&payload).unwrap();
+    let decoded = signer.decode(&encoded).unwrap();
+
+    assert_eq!(decoded.avt_token.as_str(), "avt_ex_anonymous_visitor_tracking_token");
+    assert_eq!(decoded.cookie_version, 1);
+  }
+}

crates/lib/actix_artcraft/src/sessions/anonymous_visitor_tracking/mod.rs

@@ -0,0 +1,4 @@
+pub mod avt_cookie_manager;
+pub mod avt_cookie_payload;
+pub mod avt_cookie_payload_error;
+pub mod avt_payload_signer;

crates/lib/actix_artcraft/src/sessions/http_user_session_payload.rs

@@ -1,10 +0,0 @@
-
-#[derive(Clone)]
-pub struct HttpUserSessionPayload {
-  /// The database primary key for the session instance.
-  pub session_token: String,
-
-  /// The primary key identifier of the user.
-  /// Version 1 cookies do not have a user token, hence it is optional.
-  pub maybe_user_token: Option<String>,
-}

crates/lib/actix_artcraft/src/sessions/mod.rs

@@ -1,3 +1,2 @@
-pub mod http_user_session_manager;
-pub mod http_user_session_payload;
-pub mod payload_signer;
+pub mod anonymous_visitor_tracking;
+pub mod user_sessions;

crates/lib/actix_artcraft/src/sessions/user_sessions/http_user_session_manager.rs

@@ -6,12 +6,11 @@
 use actix_web::cookie::time::OffsetDateTime;
 use actix_web::cookie::{Cookie, SameSite};
 use actix_web::HttpRequest;
-use anyhow::anyhow;
 use log::warn;
 
-use crate::sessions::http_user_session_payload::HttpUserSessionPayload;
-use crate::sessions::payload_signer::HttpUserSessionPayloadSigner;
-use errors::AnyhowResult;
+use crate::sessions::user_sessions::http_user_session_payload::HttpUserSessionPayload;
+use crate::sessions::user_sessions::http_user_session_payload_signer::HttpUserSessionPayloadSigner;
+use crate::sessions::user_sessions::http_user_session_payload_error::HttpUserSessionPayloadError;
 use tokens::tokens::user_sessions::UserSessionToken;
 use tokens::tokens::users::UserToken;
 
@@ -31,19 +30,41 @@ pub struct HttpUserSessionManager {
 }
 
 impl HttpUserSessionManager {
-  pub fn new(cookie_domain: &str, hmac_secret: &str) -> AnyhowResult<Self> {
+  pub fn new(cookie_domain: &str, hmac_secret: &str) -> Result<Self, HttpUserSessionPayloadError> {
+    let payload_signer = HttpUserSessionPayloadSigner::new(hmac_secret)
+      .map_err(|e| {
+        warn!("Failed to construct HttpUserSessionPayloadSigner: {}", e);
+        e
+      })?;
+
     Ok(Self {
       cookie_domain: cookie_domain.to_string(),
-      payload_signer: HttpUserSessionPayloadSigner::new(hmac_secret)?,
+      payload_signer,
     })
   }
 
-  pub fn encode_session_payload(&self, session_token: &UserSessionToken, user_token: &UserToken) -> AnyhowResult<String> {
+  pub fn encode_session_payload(
+    &self,
+    session_token: &UserSessionToken,
+    user_token: &UserToken,
+  ) -> Result<String, HttpUserSessionPayloadError> {
     self.payload_signer.encode(session_token, user_token)
+      .map_err(|e| {
+        warn!("Failed to encode session payload: {}", e);
+        e
+      })
   }
 
-  pub fn create_cookie(&self, session_token: &UserSessionToken, user_token: &UserToken) -> AnyhowResult<Cookie> {
-    let jwt_string = self.payload_signer.encode(session_token, user_token)?;
+  pub fn create_cookie(
+    &self,
+    session_token: &UserSessionToken,
+    user_token: &UserToken,
+  ) -> Result<Cookie, HttpUserSessionPayloadError> {
+    let jwt_string = self.payload_signer.encode(session_token, user_token)
+      .map_err(|e| {
+        warn!("Failed to encode session cookie payload: {}", e);
+        e
+      })?;
 
     let make_secure = !self.cookie_domain.to_lowercase().contains("jungle.horse")
       && !self.cookie_domain.to_lowercase().contains("localhost");
@@ -76,8 +97,8 @@ impl HttpUserSessionManager {
 
   pub fn decode_session_payload_from_request(
     &self,
-    request: &HttpRequest
-  ) -> AnyhowResult<Option<HttpUserSessionPayload>>
+    request: &HttpRequest,
+  ) -> Result<Option<HttpUserSessionPayload>, HttpUserSessionPayloadError>
   {
     let signed_session_payload = self.session_payload_from_request(request)?;
 
@@ -88,8 +109,8 @@ impl HttpUserSessionManager {
 
     match self.payload_signer.decode(&signed_session_payload) {
       Err(e) => {
-        warn!("Session cookie decode error: {:?}", e);
-        Err(anyhow!("Could not decode session cookie: {:?}", e))
+        warn!("Session cookie decode error: {}", e);
+        Err(e)
       },
       Ok(payload) => Ok(Some(payload)),
     }
@@ -97,7 +118,10 @@ impl HttpUserSessionManager {
 
   // NB: THIS IS ONLY FOR A QUICK HACK FOR FREAKING CORS UGH
   // THIS IS A HUGE STUPID SECURITY VULN. DAMNIT GOOGLE DAMNIT CORS.
-  pub fn check_and_return_session_token_decodes(&self, request: &HttpRequest) -> AnyhowResult<Option<String>> {
+  pub fn check_and_return_session_token_decodes(
+    &self,
+    request: &HttpRequest,
+  ) -> Result<Option<String>, HttpUserSessionPayloadError> {
     let signed_session_payload = self.session_payload_from_request(request)?;
 
     let signed_session_payload = match signed_session_payload {
@@ -107,8 +131,8 @@ impl HttpUserSessionManager {
 
     match self.payload_signer.decode(&signed_session_payload) {
       Err(e) => {
-        warn!("Session cookie decode error: {:?}", e);
-        return Err(anyhow!("Could not decode session cookie: {:?}", e));
+        warn!("Session cookie decode error: {}", e);
+        return Err(e);
       },
       Ok(_payload) => {}, // Good! We'll just discard this.
     }
@@ -116,15 +140,23 @@ impl HttpUserSessionManager {
     Ok(Some(signed_session_payload))
   }
 
-  fn session_payload_from_request(&self, request: &HttpRequest) -> AnyhowResult<Option<String>> {
-    let mut signed_session_payload= request.cookie(SESSION_COOKIE_NAME)
+  fn session_payload_from_request(
+    &self,
+    request: &HttpRequest,
+  ) -> Result<Option<String>, HttpUserSessionPayloadError> {
+    let mut signed_session_payload = request.cookie(SESSION_COOKIE_NAME)
         .map(|cookie| cookie.value().to_string());
 
     if signed_session_payload.is_none() {
-      signed_session_payload = request.headers().get(SESSION_HEADER_NAME)
-          .map(|header| header.to_str())
-          .transpose()?
-          .map(|payload| payload.to_string());
+      let maybe_header = request.headers().get(SESSION_HEADER_NAME);
+      if let Some(header) = maybe_header {
+        let header_str = header.to_str()
+          .map_err(|e| {
+            warn!("Failed to read session HTTP header as str: {}", e);
+            HttpUserSessionPayloadError::HttpSessionHeaderError(e.to_string())
+          })?;
+        signed_session_payload = Some(header_str.to_string());
+      }
     }
 
     Ok(signed_session_payload)
@@ -138,7 +170,7 @@ mod tests {
   use tokens::tokens::user_sessions::UserSessionToken;
   use tokens::tokens::users::UserToken;
 
-  use crate::sessions::http_user_session_manager::HttpUserSessionManager;
+  use crate::sessions::user_sessions::http_user_session_manager::HttpUserSessionManager;
 
   #[test]
   fn test_create_cookie_payload() {

crates/lib/actix_artcraft/src/sessions/user_sessions/http_user_session_payload.rs

@@ -0,0 +1,74 @@
+use std::collections::BTreeMap;
+
+use crate::sessions::user_sessions::http_user_session_payload_error::HttpUserSessionPayloadError;
+
+#[derive(Clone)]
+pub struct HttpUserSessionPayload {
+  /// The database primary key for the session instance.
+  pub session_token: String,
+
+  /// The primary key identifier of the user.
+  /// Version 1 cookies do not have a user token, hence it is optional.
+  pub maybe_user_token: Option<String>,
+}
+
+impl HttpUserSessionPayload {
+  pub fn from_map(
+    map: BTreeMap<String, String>,
+  ) -> Result<Self, HttpUserSessionPayloadError> {
+    let session_token = map
+        .get("session_token")
+        .ok_or(HttpUserSessionPayloadError::MissingField("session_token"))?
+        .clone();
+
+    let maybe_user_token = map.get("user_token").map(|t| t.to_string());
+
+    Ok(Self {
+      session_token,
+      maybe_user_token,
+    })
+  }
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  fn map_of(pairs: &[(&str, &str)]) -> BTreeMap<String, String> {
+    pairs.iter().map(|(k, v)| (k.to_string(), v.to_string())).collect()
+  }
+
+  #[test]
+  fn from_map_with_session_and_user_tokens() {
+    let payload = HttpUserSessionPayload::from_map(map_of(&[
+      ("session_token", "ex_session_token"),
+      ("user_token", "ex_user_token"),
+      ("version", "3"),
+    ])).unwrap();
+
+    assert_eq!(payload.session_token, "ex_session_token");
+    assert_eq!(payload.maybe_user_token.as_deref(), Some("ex_user_token"));
+  }
+
+  #[test]
+  fn from_map_without_user_token_is_ok() {
+    let payload = HttpUserSessionPayload::from_map(map_of(&[
+      ("session_token", "ex_session_token"),
+    ])).unwrap();
+
+    assert_eq!(payload.session_token, "ex_session_token");
+    assert!(payload.maybe_user_token.is_none());
+  }
+
+  #[test]
+  fn from_map_missing_session_token_errors() {
+    let result = HttpUserSessionPayload::from_map(map_of(&[
+      ("user_token", "ex_user_token"),
+    ]));
+
+    match result.err().expect("expected error") {
+      HttpUserSessionPayloadError::MissingField("session_token") => {}
+      other => panic!("expected MissingField(session_token), got {:?}", other),
+    }
+  }
+}

crates/lib/actix_artcraft/src/sessions/user_sessions/http_user_session_payload_error.rs

@@ -0,0 +1,59 @@
+use std::error::Error;
+use std::fmt::{Display, Formatter};
+
+use jwt_signer::jwt_signer_error::JwtSignerError;
+
+#[derive(Debug)]
+pub enum HttpUserSessionPayloadError {
+  /// Error reading HTTP header
+  HttpSessionHeaderError(String),
+
+  /// Session payload is missing a required field.
+  MissingField(&'static str),
+
+  /// Error encoding, decoding, or constructing the JWT signer.
+  JwtSigner(JwtSignerError),
+}
+
+impl HttpUserSessionPayloadError {
+  pub fn is_server_error(&self) -> bool {
+    match self {
+      // Client HTTP header errors → 400 bad input.
+      HttpUserSessionPayloadError::HttpSessionHeaderError(_) => {
+        false
+      }
+      // JWT verify errors (eg. forged cookies) → 400 bad input.
+      HttpUserSessionPayloadError::JwtSigner(JwtSignerError::JwtVerifyError(_)) => {
+        false
+      }
+      // Server-side JWT signer failures (bad HMAC config, signing failure) → 500.
+      HttpUserSessionPayloadError::JwtSigner(
+        JwtSignerError::JwtInvalidKeyLength | JwtSignerError::JwtSignError(_)
+      ) => {
+        true
+      },
+      // Missing field in a verified JWT — how did this make it into the wild!? → 500
+      HttpUserSessionPayloadError::MissingField(_) => {
+        true
+      }
+    }
+  }
+}
+
+impl Display for HttpUserSessionPayloadError {
+  fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+    match self {
+      Self::HttpSessionHeaderError(msg) => write!(f, "HTTP session header error: {}", msg),
+      Self::MissingField(field) => write!(f, "HTTP session payload missing field: {}", field),
+      Self::JwtSigner(e) => write!(f, "JWT signer error: {}", e),
+    }
+  }
+}
+
+impl Error for HttpUserSessionPayloadError {}
+
+impl From<JwtSignerError> for HttpUserSessionPayloadError {
+  fn from(err: JwtSignerError) -> Self {
+    Self::JwtSigner(err)
+  }
+}

crates/lib/actix_artcraft/src/sessions/user_sessions/http_user_session_payload_signer.rs

@@ -1,8 +1,8 @@
 use std::collections::BTreeMap;
 
-use crate::sessions::http_user_session_payload::HttpUserSessionPayload;
+use crate::sessions::user_sessions::http_user_session_payload::HttpUserSessionPayload;
+use crate::sessions::user_sessions::http_user_session_payload_error::HttpUserSessionPayloadError;
 use jwt_signer::jwt_signer::JwtSigner;
-use errors::AnyhowResult;
 use tokens::tokens::user_sessions::UserSessionToken;
 use tokens::tokens::users::UserToken;
 
@@ -21,14 +21,18 @@ pub struct HttpUserSessionPayloadSigner {
 }
 
 impl HttpUserSessionPayloadSigner {
-  pub fn new(hmac_secret: &str) -> AnyhowResult<Self> {
+  pub fn new(hmac_secret: &str) -> Result<Self, HttpUserSessionPayloadError> {
     Ok(Self {
-      jwt_signer: JwtSigner::new(hmac_secret)?
+      jwt_signer: JwtSigner::new(hmac_secret)?,
     })
   }
 
-  pub fn encode(&self, session_token: &UserSessionToken, user_token: &UserToken) -> AnyhowResult<String> {
-    let mut claims = BTreeMap::new();
+  pub fn encode(
+    &self,
+    session_token: &UserSessionToken,
+    user_token: &UserToken,
+  ) -> Result<String, HttpUserSessionPayloadError> {
+    let mut claims: BTreeMap<&str, &str> = BTreeMap::new();
     let payload_version = PAYLOAD_VERSION.to_string();
 
     claims.insert("session_token", session_token.as_str());
@@ -36,27 +40,21 @@ impl HttpUserSessionPayloadSigner {
     claims.insert("version", &payload_version);
 
     let jwt_string = self.jwt_signer.claims_to_jwt(&claims)?;
-
     Ok(jwt_string)
   }
 
-  pub fn decode(&self, session_payload_contents: &str) -> AnyhowResult<HttpUserSessionPayload> {
-    let claims = self.jwt_signer.jwt_to_claims(&session_payload_contents)?;
-
-    let session_token = claims["session_token"].clone();
-    let maybe_user_token = claims.get("user_token")
-        .map(|t| t.to_string());
-
-    Ok(HttpUserSessionPayload {
-      session_token,
-      maybe_user_token,
-    })
+  pub fn decode(
+    &self,
+    session_payload_contents: &str,
+  ) -> Result<HttpUserSessionPayload, HttpUserSessionPayloadError> {
+    let claims = self.jwt_signer.jwt_to_claims(session_payload_contents)?;
+    HttpUserSessionPayload::from_map(claims)
   }
 }
 
 #[cfg(test)]
 mod tests {
-  use crate::sessions::payload_signer::HttpUserSessionPayloadSigner;
+  use crate::sessions::user_sessions::http_user_session_payload_signer::HttpUserSessionPayloadSigner;
   use tokens::tokens::user_sessions::UserSessionToken;
   use tokens::tokens::users::UserToken;
 

crates/lib/actix_artcraft/src/sessions/user_sessions/mod.rs

@@ -0,0 +1,4 @@
+pub mod http_user_session_manager;
+pub mod http_user_session_payload;
+pub mod http_user_session_payload_error;
+pub mod http_user_session_payload_signer;

crates/lib/jwt_signer/Cargo.toml

@@ -19,9 +19,6 @@ normal = ["workspace-build-acceleration"]
 # Workspace hack (faster compile times)
 workspace-build-acceleration = { version = "0.1", path = "../../workspace-build-acceleration" }
 
-# Internal
-errors.workspace = true
-
 # External
 hmac = "0.10.1" # jwt signing
 jwt = "0.13.0"

crates/lib/jwt_signer/src/jwt_signer.rs

@@ -6,7 +6,7 @@ use jwt::SignWithKey;
 use jwt::VerifyWithKey;
 use sha2::Sha256;
 
-use errors::{anyhow, AnyhowResult};
+use crate::jwt_signer_error::JwtSignerError;
 
 #[derive(Clone)]
 pub struct JwtSigner {
@@ -15,9 +15,9 @@ pub struct JwtSigner {
 
 impl JwtSigner {
 
-  pub fn new(hmac_secret: &str) -> AnyhowResult<Self> {
+  pub fn new(hmac_secret: &str) -> Result<Self, JwtSignerError> {
     let hmac_key = Hmac::new_varkey(hmac_secret.as_bytes())
-        .map_err(|e| anyhow!("invalid hmac: {:?}", e))?;
+        .map_err(|_| JwtSignerError::JwtInvalidKeyLength)?;
 
     Ok(Self {
       hmac_key,
@@ -25,33 +25,32 @@ impl JwtSigner {
   }
 
   /// Turn a map of claims into a signed JWT cookie payload (string)
-  pub fn claims_to_jwt(&self, claims: &impl Claimable) -> AnyhowResult<String> {
-    let jwt_string = claims.sign(&self.hmac_key)?;
-    Ok(jwt_string)
+  pub fn claims_to_jwt(&self, claims: &impl Claimable) -> Result<String, JwtSignerError> {
+    claims.sign(&self.hmac_key)
   }
 
   /// Turn a JWT cookie payload (string) into a map of (key, value) claims
-  pub fn jwt_to_claims(&self, jwt: &str) -> AnyhowResult<BTreeMap<String, String>> {
-    let claims = jwt.verify_with_key(&self.hmac_key)?;
-    Ok(claims)
+  pub fn jwt_to_claims(&self, jwt: &str) -> Result<BTreeMap<String, String>, JwtSignerError> {
+    jwt.verify_with_key(&self.hmac_key)
+      .map_err(JwtSignerError::JwtVerifyError)
   }
 }
 
 pub trait Claimable {
-  fn sign(&self, hmac_key: &Hmac<Sha256>) -> AnyhowResult<String>;
+  fn sign(&self, hmac_key: &Hmac<Sha256>) -> Result<String, JwtSignerError>;
 }
 
 impl Claimable for BTreeMap<String, String> {
-  fn sign(&self, hmac_key: &Hmac<Sha256>) -> AnyhowResult<String> {
-    let claims = self.sign_with_key(hmac_key)?;
-    Ok(claims)
+  fn sign(&self, hmac_key: &Hmac<Sha256>) -> Result<String, JwtSignerError> {
+    self.sign_with_key(hmac_key)
+      .map_err(JwtSignerError::JwtSignError)
   }
 }
 
 impl Claimable for BTreeMap<&str, &str> {
-  fn sign(&self, hmac_key: &Hmac<Sha256>) -> AnyhowResult<String> {
-    let claims = self.sign_with_key(hmac_key)?;
-    Ok(claims)
+  fn sign(&self, hmac_key: &Hmac<Sha256>) -> Result<String, JwtSignerError> {
+    self.sign_with_key(hmac_key)
+      .map_err(JwtSignerError::JwtSignError)
   }
 }
 
@@ -92,4 +91,4 @@ mod tests {
 
     assert_eq!("eyJhbGciOiJIUzI1NiJ9.eyJiYXIiOiJubyIsImZvbyI6InllcyJ9.k4eRvIrtw4tuGDtQqSmEDngtGYAaQVRYVMCK5N3JcZA", &jwt);
   }
-}
+}

crates/lib/jwt_signer/src/jwt_signer_error.rs

@@ -0,0 +1,26 @@
+use std::error::Error;
+use std::fmt::{Display, Formatter};
+
+#[derive(Debug)]
+pub enum JwtSignerError {
+  /// Error decoding and verifying a JWT to claims
+  JwtVerifyError(jwt::Error),
+
+  /// Error encoding and signing JWT claims
+  JwtSignError(jwt::Error),
+
+  /// Error constructing the JWT signer.
+  JwtInvalidKeyLength,
+}
+
+impl Display for JwtSignerError {
+  fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+    match self {
+      Self::JwtVerifyError(e) => write!(f, "JWT verify error: {}", e),
+      Self::JwtSignError(e) => write!(f, "JWT sign error: {}", e),
+      Self::JwtInvalidKeyLength => write!(f, "JWT signer construction failed: invalid key length"),
+    }
+  }
+}
+
+impl Error for JwtSignerError {}

crates/lib/jwt_signer/src/lib.rs

@@ -18,4 +18,5 @@
 #![allow(dead_code)]
 #![allow(non_snake_case)]
 
-pub mod jwt_signer;
+pub mod jwt_signer;
+pub mod jwt_signer_error;

crates/schema/database/mysql_queries/src/queries/users/user_sessions/get_user_session_by_token.rs

@@ -2,13 +2,11 @@
 #![forbid(unused_imports)]
 #![forbid(unused_mut)]
 
-use anyhow::anyhow;
 use log::warn;
 use sqlx::{Executor, MySql};
 use sqlx::pool::PoolConnection;
 
 use enums::common::visibility::Visibility;
-use errors::AnyhowResult;
 use tokens::tokens::users::UserToken;
 
 use crate::helpers::boolean_converters::{i8_to_bool, nullable_i8_to_bool_default_false, nullable_i8_to_optional_bool};
@@ -99,7 +97,7 @@ impl SessionUserRecord {
 pub async fn get_user_session_by_token_pooled_connection(
   mysql_connection: &mut PoolConnection<MySql>,
   session_token: &str,
-) -> AnyhowResult<Option<SessionUserRecord>> {
+) -> Result<Option<SessionUserRecord>, sqlx::Error> {
   get_user_session_by_token(&mut **mysql_connection, session_token).await
 }
 
@@ -107,7 +105,7 @@ pub async fn get_user_session_by_token_pooled_connection(
 pub async fn get_user_session_by_token<'e, 'c : 'e, E>(
   mysql_executor: E,
   session_token: &str,
-) -> AnyhowResult<Option<SessionUserRecord>>
+) -> Result<Option<SessionUserRecord>, sqlx::Error>
   where E: 'e + Executor<'c, Database = MySql>
 {
   // NB: Lookup failure is Err(RowNotFound).
@@ -236,17 +234,13 @@ WHERE user_sessions.token = ?
 
       Ok(Some(result_user_record))
     },
+    Err(sqlx::Error::RowNotFound) => {
+      warn!("Valid cookie; invalid session: {}", session_token);
+      Ok(None)
+    },
     Err(err) => {
-      match err {
-        sqlx::Error::RowNotFound => {
-          warn!("Valid cookie; invalid session: {}", session_token);
-          Ok(None)
-        },
-        _ => {
-          warn!("Session query error: {:?}", err);
-          Err(anyhow!("session query error: {:?}", err))
-        }
-      }
+      warn!("Session query error: {:?}", err);
+      Err(err)
     }
   }
 

crates/schema/database/mysql_queries/src/queries/users/user_sessions/get_user_session_by_token_light.rs

@@ -2,12 +2,9 @@
 #![forbid(unused_imports)]
 #![forbid(unused_mut)]
 
-use anyhow::anyhow;
 use log::warn;
 use sqlx::{Executor, MySql};
 
-use errors::AnyhowResult;
-
 #[derive(Clone, Serialize, Deserialize)]
 pub struct SessionRecord {
   pub session_token: String,
@@ -17,7 +14,7 @@ pub struct SessionRecord {
 pub async fn get_user_session_by_token_light<'e, 'c : 'e, E>(
   mysql_executor: E,
   session_token: &str,
-) -> AnyhowResult<Option<SessionRecord>>
+) -> Result<Option<SessionRecord>, sqlx::Error>
   where E: 'e + Executor<'c, Database = MySql>
 {
   let maybe_session_record = sqlx::query_as!(
@@ -37,17 +34,13 @@ AND deleted_at IS NULL
 
   match maybe_session_record {
     Ok(session_record) => Ok(Some(session_record)),
+    Err(sqlx::Error::RowNotFound) => {
+      warn!("Valid cookie; invalid session: {}", session_token);
+      Ok(None)
+    },
     Err(err) => {
-      match err {
-        sqlx::Error::RowNotFound => {
-          warn!("Valid cookie; invalid session: {}", session_token);
-          Ok(None)
-        },
-        _ => {
-          warn!("Session query error: {:?}", err);
-          Err(anyhow!("session query error: {:?}", err))
-        }
-      }
+      warn!("Session query error: {:?}", err);
+      Err(err)
     }
   }
 }

crates/service/plugins/billing_artcraft/src/endpoints/checkout_with_user_signup/stripe_artcraft_create_subscription_checkout_with_user_signup_handler.rs

@@ -5,7 +5,7 @@ use crate::endpoints::checkout_with_user_signup::user_creation_case::user_creati
 use crate::endpoints::checkout_with_user_signup::user_exists_case::user_exists_case;
 use crate::utils::artcraft_stripe_config::ArtcraftStripeConfigWithClient;
 use crate::utils::common_web_error::CommonWebError;
-use actix_artcraft::sessions::http_user_session_manager::HttpUserSessionManager;
+use actix_artcraft::sessions::user_sessions::http_user_session_manager::HttpUserSessionManager;
 use actix_web::web::{Data, Json};
 use actix_web::{web, HttpRequest, HttpResponse};
 use artcraft_api_defs::stripe_artcraft::create_create_new_user_account_and_subscription_checkout::{PlanBillingCadence, SessionDetails, StripeArtcraftCreateSubscriptionCheckoutWithUserSignupRequest, StripeArtcraftCreateSubscriptionCheckoutWithUserSignupResponse, UserDetails};

crates/service/web/storyteller_web/src/api_doc_cli.rs

@@ -30,7 +30,6 @@ pub mod billing;
 pub mod configs;
 pub mod docs;
 pub mod email;
-pub mod error;
 pub mod http_server;
 pub mod startup;
 pub mod state;

crates/service/web/storyteller_web/src/api_doc_server.rs

@@ -32,7 +32,6 @@ pub mod billing;
 pub mod configs;
 pub mod docs;
 pub mod email;
-pub mod error;
 pub mod http_server;
 pub mod startup;
 pub mod state;

crates/service/web/storyteller_web/src/docs/api_doc.rs

@@ -905,7 +905,6 @@ use crate::http_server::endpoints::media_files::list::list_batch_generated_redux
     ListPinnedMediaFilesSuccessResponse,
     ListPinnedWeightsError,
     ListPinnedWeightsSuccessResponse,
-    ListSessionJobsError,
     ListSessionJobsItem,
     ListSessionJobsQueryParams,
     ListSessionJobsSuccessResponse,
@@ -970,7 +969,6 @@ use crate::http_server::endpoints::media_files::list::list_batch_generated_redux
     SearchModelWeightsSortDirection,
     SearchModelWeightsSortField,
     SearchModelWeightsSuccessResponse,
-    SessionInfoError,
     SessionTokenInfoError,
     SessionTokenInfoSuccessResponse,
     SetMediaFileCoverImageError,

crates/service/web/storyteller_web/src/error/internal_error.rs

@@ -1,37 +0,0 @@
-use std::error::Error;
-use std::fmt::{Debug, Display, Formatter};
-
-/// Any generic errors arising internally.
-/// An error class that we do not expose via the API.
-/// This should be massaged before we send it to the user.
-#[derive(Debug)]
-pub enum InternalError {
-  /// Issue with HMAC decoding
-  /// This is typically when using development cookies against production,
-  /// or vice versa.
-  VisitorCookieError(String),
-  
-  /// Decode error with AVT cookie missing a required field.
-  VisitorCookieMissingField(&'static str),
-
-  /// Catch instances of anyhow::Error.
-  AnyhowError(anyhow::Error),
-}
-
-impl Error for InternalError {}
-
-impl Display for InternalError {
-  fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
-    match self {
-      InternalError::VisitorCookieError(reason) => write!(f, "Visitor cookie error: {:?}", reason),
-      InternalError::VisitorCookieMissingField(field) => write!(f, "Visitor cookie missing field: {}", field),
-      InternalError::AnyhowError(err) => write!(f, "Anyhow error: {}", err),
-    }
-  }
-}
-
-impl From<anyhow::Error> for InternalError {
-  fn from(err: anyhow::Error) -> Self {
-    InternalError::AnyhowError(err)
-  }
-}

crates/service/web/storyteller_web/src/error/mod.rs

@@ -1 +0,0 @@
-pub mod internal_error;

crates/service/web/storyteller_web/src/http_server/common_responses/advanced_common_web_error.rs

@@ -1,10 +1,14 @@
 use std::fmt::{Display, Formatter};
 use std::sync::Arc;
 
+use crate::http_server::common_responses::common_web_error::CommonWebError;
+use crate::http_server::session::session_checker_error::SessionCheckerError;
+use crate::http_server::web_utils::user_session::require_user_session::RequireUserSessionError;
+use actix_artcraft::sessions::anonymous_visitor_tracking::avt_cookie_payload_error::AvtCookiePayloadError;
+use actix_artcraft::sessions::user_sessions::http_user_session_payload_error::HttpUserSessionPayloadError;
 use actix_http::StatusCode;
 use actix_web::{HttpResponse, HttpResponseBuilder, ResponseError};
 use anyhow::anyhow;
-use crate::http_server::web_utils::user_session::require_user_session::RequireUserSessionError;
 
 /// An error type for actix-web handlers that wraps causal errors for debugging
 /// and paging while presenting safe, generic HTTP responses to users.
@@ -194,9 +198,43 @@ impl From<RequireUserSessionError> for AdvancedCommonWebError {
   }
 }
 
-impl From<crate::http_server::common_responses::common_web_error::CommonWebError> for AdvancedCommonWebError {
-  fn from(value: crate::http_server::common_responses::common_web_error::CommonWebError) -> Self {
-    use crate::http_server::common_responses::common_web_error::CommonWebError;
+impl From<HttpUserSessionPayloadError> for AdvancedCommonWebError {
+  fn from(err: HttpUserSessionPayloadError) -> Self {
+    if err.is_server_error() {
+      Self::from_error(err)
+    } else {
+      Self::BadInputWithSimpleMessage("invalid session".to_string())
+    }
+  }
+}
+
+impl From<AvtCookiePayloadError> for AdvancedCommonWebError {
+  fn from(err: AvtCookiePayloadError) -> Self {
+    if err.is_server_error() {
+      Self::from_error(err)
+    } else {
+      Self::BadInputWithSimpleMessage("invalid AVT cookie".to_string())
+    }
+  }
+}
+
+impl From<SessionCheckerError> for AdvancedCommonWebError {
+  fn from(value: SessionCheckerError) -> Self {
+    match value {
+      // Bad / forged session cookie → 401 (don't page on this)
+      // NOTE: If there's an elevated rate of across-the-board 401s,
+      // then we probably misconfigured the HMAC secret
+      SessionCheckerError::SessionPayload(_) => Self::NotAuthorized,
+      // Underlying DB / cache errors → 500 with paging
+      SessionCheckerError::Sqlx(err) => Self::from_error(err),
+      // Likely Redis caching middleware
+      SessionCheckerError::OtherError(err) => Self::from_anyhow_error(err),
+    }
+  }
+}
+
+impl From<CommonWebError> for AdvancedCommonWebError {
+  fn from(value: CommonWebError) -> Self {
     match value {
       CommonWebError::BadInputWithSimpleMessage(msg) => Self::BadInputWithSimpleMessage(msg),
       CommonWebError::NotAuthorized => Self::NotAuthorized,

crates/service/web/storyteller_web/src/http_server/common_responses/common_web_error.rs

@@ -4,6 +4,7 @@ use log::{error, warn};
 use mysql_queries::errors::mysql_error::{MysqlCrateErrorSubtype, MysqlError};
 use std::error::Error;
 use std::fmt::{Display, Formatter};
+use crate::http_server::session::session_checker_error::SessionCheckerError;
 use crate::http_server::web_utils::user_session::require_user_session::RequireUserSessionError;
 
 #[derive(Debug, utoipa::ToSchema)]
@@ -109,6 +110,27 @@ impl From<RequireUserSessionError> for CommonWebError {
   }
 }
 
+impl From<SessionCheckerError> for CommonWebError {
+  fn from(value: SessionCheckerError) -> Self {
+    match value {
+      // Bad / forged session cookie → 401
+      // NOTE: If there's an elevated rate of across-the-board 401s,
+      // then we probably misconfigured the HMAC secret
+      SessionCheckerError::SessionPayload(_) => Self::NotAuthorized,
+      // Underlying DB / cache errors → 500
+      SessionCheckerError::Sqlx(err) => {
+        error!("SessionChecker sqlx error: {:?}", err);
+        Self::ServerError
+      },
+      // Likely Redis caching middleware
+      SessionCheckerError::OtherError(err) => {
+        error!("SessionChecker other error: {:?}", err);
+        Self::ServerError
+      },
+    }
+  }
+}
+
 #[cfg(test)]
 mod tests {
   use super::*;

crates/service/web/storyteller_web/src/http_server/cookies/anonymous_visitor_tracking/avt_cookie_manager.rs

@@ -1,99 +0,0 @@
-use actix_web::cookie::time::OffsetDateTime;
-use actix_web::cookie::{Cookie, SameSite};
-use actix_web::HttpRequest;
-use anyhow::anyhow;
-use log::warn;
-
-use crate::error::internal_error::InternalError;
-use crate::http_server::cookies::anonymous_visitor_tracking::avt_cookie_payload::AvtCookiePayload;
-use jwt_signer::jwt_signer::JwtSigner;
-use errors::AnyhowResult;
-use tokens::tokens::anonymous_visitor_tracking::AnonymousVisitorTrackingToken;
-
-const VISITOR_COOKIE_NAME : &str = "visitor";
-
-/// Handle "anonymous visitor tracking" cookies.
-/// This enables us to associate results with an anonymous user for a better experience,
-/// as well as do some form of return visitor tracking.
-#[derive(Clone)]
-pub struct AvtCookieManager {
-  cookie_domain: String,
-  jwt_signer: JwtSigner,
-}
-
-impl AvtCookieManager {
-
-  pub fn new(cookie_domain: &str, hmac_secret: &str) -> AnyhowResult<Self> {
-    Ok(Self {
-      cookie_domain: cookie_domain.to_string(),
-      jwt_signer: JwtSigner::new(hmac_secret)?,
-    })
-  }
-
-  pub fn make_new_cookie(&self) -> AnyhowResult<Cookie> {
-    let token = AnonymousVisitorTrackingToken::generate();
-    self.make_new_cookie_with_apriori_token(&token)
-  }
-
-  pub fn make_new_cookie_with_apriori_token(&self, token: &AnonymousVisitorTrackingToken) -> AnyhowResult<Cookie> {
-    let payload = AvtCookiePayload::from_token(token.clone());
-    let claims = payload.to_map();
-    let jwt_string = self.jwt_signer.claims_to_jwt(&claims)?;
-
-    let make_secure = !self.cookie_domain.to_lowercase().contains("jungle.horse")
-        && !self.cookie_domain.to_lowercase().contains("localhost");
-
-    let same_site = if make_secure {
-      SameSite::None // NB: Allow usage from other domains
-    } else {
-      SameSite::Lax // NB: You can't set "SameSite=None" on non-secure cookies
-    };
-
-    Ok(Cookie::build(VISITOR_COOKIE_NAME, jwt_string)
-        .secure(make_secure) // HTTPS-only
-        .same_site(same_site)
-        .permanent()
-        .path("/") // NB: Otherwise it'll be set to `/v1`
-        //.domain(&self.cookie_domain)
-        //.http_only(true) // Not exposed to Javascript
-        .finish())
-  }
-
-  pub fn make_delete_cookie(&self) -> Cookie {
-    let mut cookie = Cookie::build(VISITOR_COOKIE_NAME, "DELETED")
-        .expires(OffsetDateTime::UNIX_EPOCH)
-        .path("/") // NB: Otherwise it'll be set to `/v1`
-        .finish();
-    cookie.make_removal();
-    cookie
-  }
-
-  pub fn decode_cookie_payload(&self, visitor_cookie: &Cookie) -> AnyhowResult<AvtCookiePayload> {
-    let cookie_contents = visitor_cookie.value().to_string();
-    let claims = self.jwt_signer.jwt_to_claims(&cookie_contents)?;
-    let payload = AvtCookiePayload::from_map(claims)?;
-    Ok(payload)
-  }
-
-  pub fn decode_cookie_payload_from_request(&self, request: &HttpRequest) -> Result<Option<AvtCookiePayload>, InternalError> {
-    let cookie = match request.cookie(VISITOR_COOKIE_NAME) {
-      None => return Ok(None),
-      Some(cookie) => cookie,
-    };
-
-    match self.decode_cookie_payload(&cookie) {
-      Err(e) => {
-        warn!("Visitor cookie decode error: {:?}", e);
-        Err(InternalError::VisitorCookieError(e.to_string()))
-      },
-      Ok(payload) => Ok(Some(payload)),
-    }
-  }
-
-  pub fn get_avt_token_from_request(&self, request: &HttpRequest) -> Option<AnonymousVisitorTrackingToken> {
-    self.decode_cookie_payload_from_request(request)
-        .ok()
-        .flatten()
-        .map(|payload| payload.avt_token)
-  }
-}

crates/service/web/storyteller_web/src/http_server/cookies/anonymous_visitor_tracking/mod.rs

@@ -1,2 +0,0 @@
-pub mod avt_cookie_manager;
-pub mod avt_cookie_payload;

crates/service/web/storyteller_web/src/http_server/cookies/mod.rs

@@ -1 +0,0 @@
-pub mod anonymous_visitor_tracking;

crates/service/web/storyteller_web/src/http_server/endpoints/app_state/get_app_state_handler.rs

@@ -1,4 +1,4 @@
-use crate::http_server::cookies::anonymous_visitor_tracking::avt_cookie_manager::AvtCookieManager;
+use actix_artcraft::sessions::anonymous_visitor_tracking::avt_cookie_manager::AvtCookieManager;
 use crate::http_server::endpoints::app_state::components::get_permissions::{get_permissions, AppStatePermissions};
 use crate::http_server::endpoints::app_state::components::get_premium_info::{get_premium_info, AppStatePremiumInfo};
 use crate::http_server::endpoints::app_state::components::get_server_info::{get_server_info, AppStateServerInfo};

crates/service/web/storyteller_web/src/http_server/endpoints/characters/create_character_handler.rs

@@ -64,7 +64,7 @@ pub async fn create_character_handler(
       .await
       .map_err(|e| {
         warn!("Session checker error: {:?}", e);
-        AdvancedCommonWebError::from_anyhow_error(e)
+        AdvancedCommonWebError::from(e)
       })?;
 
   let user_session = match maybe_user_session {

crates/service/web/storyteller_web/src/http_server/endpoints/generate/video/multi_function/seedance_2p0_multi_function_video_gen_handler.rs

@@ -97,7 +97,7 @@ pub async fn seedance_2p0_multi_function_video_gen_handler(
       .await
       .map_err(|e| {
         warn!("Session checker error: {:?}", e);
-        AdvancedCommonWebError::from_anyhow_error(e)
+        AdvancedCommonWebError::from(e)
       })?;
 
   let user_session = match maybe_user_session {

crates/service/web/storyteller_web/src/http_server/endpoints/inference_job/list/list_session_jobs_handler.rs

@@ -1,7 +1,7 @@
 use std::collections::HashSet;
-use std::fmt;
 use std::sync::Arc;
 
+use crate::http_server::common_responses::advanced_common_web_error::AdvancedCommonWebError;
 use crate::http_server::common_responses::media::media_domain::MediaDomain;
 use crate::http_server::common_responses::media::media_links_builder::MediaLinksBuilder;
 use crate::http_server::endpoints::inference_job::utils::estimates::estimate_job_progress::estimate_job_progress;
@@ -10,12 +10,9 @@ use crate::http_server::endpoints::inference_job::utils::extractors::extract_liv
 use crate::http_server::endpoints::inference_job::utils::extractors::extract_polymorphic_inference_args::extract_polymorphic_inference_args;
 use crate::http_server::endpoints::media_files::helpers::get_media_domain::get_media_domain;
 use crate::http_server::web_utils::filter_model_name::maybe_filter_model_name;
-use crate::http_server::web_utils::response_error_helpers::to_simple_json_error;
 use crate::state::server_state::ServerState;
-use actix_web::error::ResponseError;
-use actix_web::http::StatusCode;
 use actix_web::web::Json;
-use actix_web::{web, HttpRequest, HttpResponse};
+use actix_web::{web, HttpRequest};
 use actix_web_lab::extract::Query;
 use artcraft_api_defs::jobs::list_session_jobs::{ListSessionJobsItem, ListSessionJobsQueryParams, ListSessionJobsSuccessResponse, ListSessionRequestDetailsResponse, ListSessionResultDetailsResponse, ListSessionStatusDetailsResponse};
 use bucket_paths::legacy::typified_paths::public::media_files::bucket_file_path::MediaFileBucketPath;
@@ -34,7 +31,7 @@ use redis_common::redis_keys::RedisKeys;
 use server_environment::ServerEnvironment;
 use tokens::tokens::generic_inference_jobs::InferenceJobToken;
 use tokens::tokens::media_files::MediaFileToken;
-use utoipa::{IntoParams, ToSchema};
+use utoipa::IntoParams;
 
 /// For certain jobs or job classes (eg. non-premium), we kill the jobs if the user hasn't
 /// maintained a keepalive. This prevents wasted work when users who are unlikely to return
@@ -42,40 +39,6 @@ use utoipa::{IntoParams, ToSchema};
 /// typically do not require keepalive.
 const JOB_KEEPALIVE_TTL_SECONDS : u64 = 60 * 3;
 
-#[derive(Debug, ToSchema)]
-pub enum ListSessionJobsError {
-  ServerError,
-  NotFound,
-  NotAuthorized,
-}
-
-impl ResponseError for ListSessionJobsError {
-  fn status_code(&self) -> StatusCode {
-    match *self {
-      ListSessionJobsError::ServerError => StatusCode::INTERNAL_SERVER_ERROR,
-      ListSessionJobsError::NotFound => StatusCode::NOT_FOUND,
-      ListSessionJobsError::NotAuthorized => StatusCode::UNAUTHORIZED,
-    }
-  }
-
-  fn error_response(&self) -> HttpResponse {
-    let error_reason = match self {
-      Self::ServerError => "server error".to_string(),
-      Self::NotFound => "not found".to_string(),
-      Self::NotAuthorized => "not authorized".to_string(),
-    };
-
-    to_simple_json_error(&error_reason, self.status_code())
-  }
-}
-
-// NB: Not using derive_more::Display since Clion doesn't understand it.
-impl fmt::Display for ListSessionJobsError {
-  fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-    write!(f, "{:?}", self)
-  }
-}
-
 /// List job statuses for jobs that are associated with the user's session.
 ///
 /// The user must be logged in. This endpoint will only show the last 36 hours
@@ -89,7 +52,8 @@ impl fmt::Display for ListSessionJobsError {
   path = "/v1/jobs/session",
   responses(
     (status = 200, body = ListSessionJobsSuccessResponse),
-    (status = 500, body = ListSessionJobsError),
+    (status = 401, description = "Not authorized"),
+    (status = 500, description = "Server error"),
   ),
   params(
     ListSessionJobsQueryParams
@@ -99,29 +63,21 @@ pub async fn list_session_jobs_handler(
   http_request: HttpRequest,
   query: Query<ListSessionJobsQueryParams>,
   server_state: web::Data<Arc<ServerState>>
-) -> Result<Json<ListSessionJobsSuccessResponse>, ListSessionJobsError> {
+) -> Result<Json<ListSessionJobsSuccessResponse>, AdvancedCommonWebError> {
 
-  let mut mysql_connection = server_state.mysql_pool
-      .acquire()
-      .await
-      .map_err(|err| {
-        warn!("MySql pool error: {:?}", err);
-        ListSessionJobsError::ServerError
-      })?;
+  let mut mysql_connection = server_state.mysql_pool.acquire().await?;
 
   let maybe_avt_token = server_state.avt_cookie_manager
       .get_avt_token_from_request(&http_request);
 
   // ==================== USER SESSION ==================== //
 
+  // NB: SessionCheckerError → AdvancedCommonWebError maps payload errors (bad cookie) to 401
+  //     and DB / cache errors to 500.
   let maybe_user_session = server_state
       .session_checker
       .maybe_get_user_session_extended_from_connection(&http_request, &mut mysql_connection)
-      .await
-      .map_err(|e| {
-        warn!("Session checker error: {:?}", e);
-        ListSessionJobsError::ServerError
-      })?;
+      .await?;
 
   let include_states = query.include_states
       .as_deref()
@@ -135,20 +91,14 @@ pub async fn list_session_jobs_handler(
           .filter_map(|status| JobStatusPlus::from_str(status).ok())
           .collect::<HashSet<_>>());
 
-  let user;
-
-  match (maybe_user_session.as_ref(), maybe_avt_token.as_ref()) {
-    (Some(session), _) => {
-      user = SessionUser::User(&session.user_token_typed);
-    }
-    (None, Some(avt_token)) => {
-      user = SessionUser::Anonymous(avt_token);
-    }
+  let user = match (maybe_user_session.as_ref(), maybe_avt_token.as_ref()) {
+    (Some(session), _) => SessionUser::User(&session.user_token_typed),
+    (None, Some(avt_token)) => SessionUser::Anonymous(avt_token),
     (None, None) => {
       // TODO(bt,2025-04-15): We should install an AVT cookie.
-      return Err(ListSessionJobsError::NotAuthorized);
+      return Err(AdvancedCommonWebError::NotAuthorized);
     }
-  }
+  };
 
   let args = ListSessionJobsForUserArgs {
     user,
@@ -157,23 +107,11 @@ pub async fn list_session_jobs_handler(
   };
 
   // NB: Since this is publicly exposed, we don't query sensitive data.
-  let maybe_records = list_session_jobs_from_connection(
-    args, &mut mysql_connection).await;
-
-  let records = match maybe_records {
-    Ok(records) => records,
-    Err(err) => {
-      error!("tts job query error: {:?}", err);
-      return Err(ListSessionJobsError::ServerError);
-    }
-  };
+  let records = list_session_jobs_from_connection(args, &mut mysql_connection).await?;
 
   let mut redis = server_state.redis_pool
       .get()
-      .map_err(|e| {
-        error!("redis error: {:?}", e);
-        ListSessionJobsError::ServerError
-      })?;
+      .map_err(AdvancedCommonWebError::from_error)?;
 
   // TODO(bt,2024-04-22): Look up the extra redis statuses per item.
 
@@ -204,7 +142,7 @@ fn records_to_response(
   records: Vec<GenericInferenceJobStatus>,
   server_environment: ServerEnvironment,
   media_domain: MediaDomain,
-) -> Result<Json<ListSessionJobsSuccessResponse>, ListSessionJobsError> {
+) -> Result<Json<ListSessionJobsSuccessResponse>, AdvancedCommonWebError> {
   let mut records = records.into_iter()
       .map(|record| {
         db_record_to_response_payload(record, None, server_environment, media_domain)

crates/service/web/storyteller_web/src/http_server/endpoints/omni_gen/generate/image/omni_gen_image_generate_handler.rs

@@ -81,7 +81,7 @@ pub async fn omni_gen_image_generate_handler(
     .await
     .map_err(|e| {
       warn!("Session checker error: {:?}", e);
-      AdvancedCommonWebError::from_anyhow_error(e)
+      AdvancedCommonWebError::from(e)
     })?;
 
   let user_token = match maybe_user_session.as_ref() {

crates/service/web/storyteller_web/src/http_server/endpoints/omni_gen/generate/video/omni_gen_video_generate_handler.rs

@@ -81,7 +81,7 @@ pub async fn omni_gen_video_generate_handler(
     .await
     .map_err(|e| {
       warn!("Session checker error: {:?}", e);
-      AdvancedCommonWebError::from_anyhow_error(e)
+      AdvancedCommonWebError::from(e)
     })?;
 
   let user_token = match maybe_user_session.as_ref() {

crates/service/web/storyteller_web/src/http_server/endpoints/users/create_account_handler.rs

@@ -12,7 +12,7 @@ use crate::http_server::validations::validate_passwords::validate_passwords;
 use crate::http_server::validations::validate_username::validate_username;
 use crate::util::enroll_in_studio::enroll_in_studio;
 use actix_artcraft::requests::get_request_signup_source_enum::get_request_signup_source_enum;
-use actix_artcraft::sessions::http_user_session_manager::HttpUserSessionManager;
+use actix_artcraft::sessions::user_sessions::http_user_session_manager::HttpUserSessionManager;
 use actix_web::error::ResponseError;
 use actix_web::http::StatusCode;
 use actix_web::{web, HttpRequest, HttpResponse};

crates/service/web/storyteller_web/src/http_server/endpoints/users/google_sso/google_sso_handler.rs

@@ -10,7 +10,7 @@ use crate::http_server::endpoints::users::google_sso::check_claims::check_claims
 use crate::http_server::endpoints::users::google_sso::handle_existing_sso_account::{handle_existing_sso_account, ExistingAccountArgs};
 use crate::http_server::endpoints::users::google_sso::handle_new_sso_account::{handle_new_sso_account, NewSsoArgs};
 use crate::state::certs::google_sign_in_cert::GoogleSignInCert;
-use actix_artcraft::sessions::http_user_session_manager::HttpUserSessionManager;
+use actix_artcraft::sessions::user_sessions::http_user_session_manager::HttpUserSessionManager;
 use actix_web::error::ResponseError;
 use actix_web::http::StatusCode;
 use actix_web::web::{Data, Json};

crates/service/web/storyteller_web/src/http_server/endpoints/users/login_handler.rs

@@ -1,7 +1,7 @@
 use std::fmt;
 use std::fmt::Formatter;
 
-use actix_artcraft::sessions::http_user_session_manager::HttpUserSessionManager;
+use actix_artcraft::sessions::user_sessions::http_user_session_manager::HttpUserSessionManager;
 use actix_web::error::ResponseError;
 use actix_web::http::StatusCode;
 use actix_web::{web, HttpRequest, HttpResponse};

crates/service/web/storyteller_web/src/http_server/endpoints/users/logout_handler.rs

@@ -5,7 +5,7 @@
 
 use std::fmt;
 
-use actix_artcraft::sessions::http_user_session_manager::HttpUserSessionManager;
+use actix_artcraft::sessions::user_sessions::http_user_session_manager::HttpUserSessionManager;
 use actix_web::error::ResponseError;
 use actix_web::http::StatusCode;
 use actix_web::{web, HttpRequest, HttpResponse};

crates/service/web/storyteller_web/src/http_server/endpoints/users/password_reset_redeem_handler.rs

@@ -1,6 +1,6 @@
 use std::fmt::Display;
 
-use actix_artcraft::sessions::http_user_session_manager::HttpUserSessionManager;
+use actix_artcraft::sessions::user_sessions::http_user_session_manager::HttpUserSessionManager;
 use actix_web::http::StatusCode;
 use actix_web::{web, HttpRequest, HttpResponse, ResponseError};
 use http_server_common::request::get_request_ip::get_request_ip;

crates/service/web/storyteller_web/src/http_server/endpoints/users/session_info_handler.rs

@@ -3,60 +3,26 @@
 #![forbid(unused_mut)]
 #![forbid(unused_variables)]
 
-use std::fmt;
-
-use actix_web::error::ResponseError;
-use actix_web::http::StatusCode;
 use actix_web::{web, HttpRequest, HttpResponse};
 use log::warn;
 use sqlx::MySqlPool;
-use utoipa::ToSchema;
 
 use artcraft_api_defs::users::session_info::{FakeYouPlan, SessionInfoSuccessResponse, SessionOnboardingState, SessionUserInfo, StorytellerStreamPlan};
 use enums::by_table::users::user_feature_flag::UserFeatureFlag;
-use http_server_common::response::response_error_helpers::to_simple_json_error;
 
+use crate::http_server::common_responses::advanced_common_web_error::AdvancedCommonWebError;
 use crate::http_server::common_responses::user_details_lite_builder::UserDetailsLightBuilder;
-use crate::http_server::cookies::anonymous_visitor_tracking::avt_cookie_manager::AvtCookieManager;
+use actix_artcraft::sessions::anonymous_visitor_tracking::avt_cookie_manager::AvtCookieManager;
 use crate::http_server::session::lookup::user_session_feature_flags::UserSessionFeatureFlags;
 use crate::http_server::session::session_checker::SessionChecker;
 
-
-#[derive(Debug, ToSchema)]
-pub enum SessionInfoError {
-  ServerError,
-}
-
-impl ResponseError for SessionInfoError {
-  fn status_code(&self) -> StatusCode {
-    match *self {
-      SessionInfoError::ServerError=> StatusCode::INTERNAL_SERVER_ERROR,
-    }
-  }
-
-  fn error_response(&self) -> HttpResponse {
-    let error_reason = match self {
-      SessionInfoError::ServerError => "server error".to_string(),
-    };
-
-    to_simple_json_error(&error_reason, self.status_code())
-  }
-}
-
-// NB: Not using derive_more::Display since Clion doesn't understand it.
-impl fmt::Display for SessionInfoError {
-  fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-    write!(f, "{:?}", self)
-  }
-}
-
 #[utoipa::path(
   get,
   tag = "Users",
   path = "/v1/session",
   responses(
     (status = 200, description = "Get profile", body = SessionInfoSuccessResponse),
-    (status = 500, description = "Server error", body = SessionInfoError),
+    (status = 500, description = "Server error"),
   ),
 )]
 pub async fn session_info_handler(
@@ -64,100 +30,85 @@ pub async fn session_info_handler(
   mysql_pool: web::Data<MySqlPool>,
   session_checker: web::Data<SessionChecker>,
   avt_manager: web::Data<AvtCookieManager>,
-) -> Result<HttpResponse, SessionInfoError>
+) -> Result<HttpResponse, AdvancedCommonWebError>
 {
-  let mut mysql_connection = mysql_pool.acquire()
-      .await
-      .map_err(|e| {
-        warn!("Could not acquire DB pool: {:?}", e);
-        SessionInfoError::ServerError
-      })?;
+  let mut mysql_connection = mysql_pool.acquire().await?;
 
   let maybe_user_session = session_checker
     .maybe_get_user_session_from_connection(&http_request, &mut mysql_connection)
     .await
-    .map_err(|e| {
-      warn!("Session checker error: {:?}", e);
-      SessionInfoError::ServerError
+    .map_err(|err| {
+      warn!("Error checking session: {:?}", err);
+      err
     })?;
 
   let mut logged_in = false;
   let mut user_info = None;
 
-  match maybe_user_session {
-    None => {}
-    Some(session_data) => {
-      let feature_flags =
-          UserSessionFeatureFlags::new(session_data.maybe_feature_flags.as_deref());
+  if let Some(session_data) = maybe_user_session {
+    let feature_flags =
+        UserSessionFeatureFlags::new(session_data.maybe_feature_flags.as_deref());
 
-      if !session_data.is_banned {
-        // NB: Banned users can't be logged in
-        logged_in = true;
-        user_info = Some(SessionUserInfo {
-          core_info: UserDetailsLightBuilder::from_db_fields(
-            &session_data.user_token,
-            &session_data.username,
-            &session_data.display_name,
-            &session_data.email_gravatar_hash,
-          ),
-          onboarding: SessionOnboardingState {
-            email_not_set: session_data.email_is_synthetic,
-            email_not_confirmed: !(session_data.email_confirmed || session_data.email_confirmed_by_google),
-            password_not_set: session_data.is_without_password,
-            username_not_customized: session_data.username_is_not_customized,
-          },
-          user_token: session_data.user_token,
-          username: session_data.username.to_string(),
-          display_name: session_data.display_name.to_string(),
-          email_gravatar_hash: session_data.email_gravatar_hash.to_string(),
+    if !session_data.is_banned {
+      // NB: Banned users can't be logged in
+      logged_in = true;
+      user_info = Some(SessionUserInfo {
+        core_info: UserDetailsLightBuilder::from_db_fields(
+          &session_data.user_token,
+          &session_data.username,
+          &session_data.display_name,
+          &session_data.email_gravatar_hash,
+        ),
+        onboarding: SessionOnboardingState {
+          email_not_set: session_data.email_is_synthetic,
+          email_not_confirmed: !(session_data.email_confirmed || session_data.email_confirmed_by_google),
+          password_not_set: session_data.is_without_password,
+          username_not_customized: session_data.username_is_not_customized,
+        },
+        user_token: session_data.user_token,
+        username: session_data.username.to_string(),
+        display_name: session_data.display_name.to_string(),
+        email_gravatar_hash: session_data.email_gravatar_hash.to_string(),
 
-          // Rollout / feature flags:
-          can_access_studio: feature_flags.has_flag(UserFeatureFlag::Studio),
-          maybe_feature_flags: feature_flags.clone_flags(),
+        // Rollout / feature flags:
+        can_access_studio: feature_flags.has_flag(UserFeatureFlag::Studio),
+        maybe_feature_flags: feature_flags.clone_flags(),
 
-          // Premium plans:
-          fakeyou_plan: FakeYouPlan::Free,
-          storyteller_stream_plan: StorytellerStreamPlan::Free,
+        // Premium plans:
+        fakeyou_plan: FakeYouPlan::Free,
+        storyteller_stream_plan: StorytellerStreamPlan::Free,
 
-          // Usage permissions:
-          can_use_tts: session_data.can_use_tts,
-          can_use_w2l: session_data.can_use_w2l,
-          can_delete_own_tts_results: session_data.can_delete_own_tts_results,
-          can_delete_own_w2l_results: session_data.can_delete_own_w2l_results,
-          can_delete_own_account: session_data.can_delete_own_account,
+        // Usage permissions:
+        can_use_tts: session_data.can_use_tts,
+        can_use_w2l: session_data.can_use_w2l,
+        can_delete_own_tts_results: session_data.can_delete_own_tts_results,
+        can_delete_own_w2l_results: session_data.can_delete_own_w2l_results,
+        can_delete_own_account: session_data.can_delete_own_account,
 
-          // Contribution permissions:
-          can_upload_tts_models: session_data.can_upload_tts_models,
-          can_upload_w2l_templates: session_data.can_upload_w2l_templates,
-          can_delete_own_tts_models: session_data.can_delete_own_tts_models,
-          can_delete_own_w2l_templates: session_data.can_delete_own_w2l_templates,
+        // Contribution permissions:
+        can_upload_tts_models: session_data.can_upload_tts_models,
+        can_upload_w2l_templates: session_data.can_upload_w2l_templates,
+        can_delete_own_tts_models: session_data.can_delete_own_tts_models,
+        can_delete_own_w2l_templates: session_data.can_delete_own_w2l_templates,
 
-          // Moderation permissions:
-          can_approve_w2l_templates: session_data.can_approve_w2l_templates,
-          can_edit_other_users_profiles: session_data.can_edit_other_users_profiles,
-          can_edit_other_users_tts_models: session_data.can_edit_other_users_tts_models,
-          can_edit_other_users_w2l_templates: session_data.can_edit_other_users_w2l_templates,
-          can_delete_other_users_tts_models: session_data.can_delete_other_users_tts_models,
-          can_delete_other_users_tts_results: session_data.can_delete_other_users_tts_results,
-          can_delete_other_users_w2l_templates: session_data.can_delete_other_users_w2l_templates,
-          can_delete_other_users_w2l_results: session_data.can_delete_other_users_w2l_results,
-          can_ban_users: session_data.can_ban_users,
-          can_delete_users: session_data.can_delete_users,
-        });
-      }
+        // Moderation permissions:
+        can_approve_w2l_templates: session_data.can_approve_w2l_templates,
+        can_edit_other_users_profiles: session_data.can_edit_other_users_profiles,
+        can_edit_other_users_tts_models: session_data.can_edit_other_users_tts_models,
+        can_edit_other_users_w2l_templates: session_data.can_edit_other_users_w2l_templates,
+        can_delete_other_users_tts_models: session_data.can_delete_other_users_tts_models,
+        can_delete_other_users_tts_results: session_data.can_delete_other_users_tts_results,
+        can_delete_other_users_w2l_templates: session_data.can_delete_other_users_w2l_templates,
+        can_delete_other_users_w2l_results: session_data.can_delete_other_users_w2l_results,
+        can_ban_users: session_data.can_ban_users,
+        can_delete_users: session_data.can_delete_users,
+      });
     }
   }
 
   let maybe_avt_cookie = match avt_manager.decode_cookie_payload_from_request(&http_request) {
     Ok(Some(_avt_cookie)) => None,
-    _ => {
-      let cookie = avt_manager.make_new_cookie()
-          .map_err(|e| {
-            warn!("avt cookie creation error: {:?}", e);
-            SessionInfoError::ServerError
-          })?;
-      Some(cookie)
-    }
+    _ => Some(avt_manager.make_new_cookie()?),
   };
 
   let response = SessionInfoSuccessResponse {
@@ -166,8 +117,7 @@ pub async fn session_info_handler(
     user: user_info,
   };
 
-  let body = serde_json::to_string(&response)
-    .map_err(|_e| SessionInfoError::ServerError)?;
+  let body = serde_json::to_string(&response)?;
 
   let mut response_builder = HttpResponse::Ok();
 

crates/service/web/storyteller_web/src/http_server/mod.rs

@@ -1,7 +1,6 @@
 pub mod common_requests;
 pub mod common_responses;
 pub mod endpoint_helpers;
-pub mod cookies;
 pub mod deprecated_endpoints;
 pub mod endpoints;
 pub mod middleware;

crates/service/web/storyteller_web/src/http_server/session/mod.rs

@@ -1,2 +1,3 @@
 pub mod lookup;
-pub mod session_checker;
+pub mod session_checker;
+pub mod session_checker_error;

crates/service/web/storyteller_web/src/http_server/session/session_checker.rs

@@ -3,9 +3,8 @@
 #![forbid(unused_mut)]
 #![forbid(unused_variables)]
 
-use actix_artcraft::sessions::http_user_session_manager::HttpUserSessionManager;
+use actix_artcraft::sessions::user_sessions::http_user_session_manager::HttpUserSessionManager;
 use actix_web::HttpRequest;
-use errors::AnyhowResult;
 use log::warn;
 use mysql_queries::queries::users::user_sessions::get_user_session_by_token::{get_user_session_by_token, get_user_session_by_token_pooled_connection, SessionUserRecord};
 use mysql_queries::queries::users::user_sessions::get_user_session_by_token_light::{get_user_session_by_token_light, SessionRecord};
@@ -17,6 +16,7 @@ use sqlx::{Executor, MySql, MySqlPool};
 
 use crate::http_server::session::lookup::user_session_extended::{UserSessionExtended, UserSessionPreferences, UserSessionPremiumPlanInfo, UserSessionRoleAndPermissions, UserSessionSubscriptionPlan, UserSessionUserDetails};
 use crate::http_server::session::lookup::user_session_feature_flags::UserSessionFeatureFlags;
+use crate::http_server::session::session_checker_error::SessionCheckerError;
 
 #[derive(Clone)]
 pub struct SessionChecker {
@@ -40,7 +40,7 @@ impl SessionChecker {
     }
   }
 
-  pub fn get_session_token(&self, request: &HttpRequest) -> AnyhowResult<Option<String>> {
+  pub fn get_session_token(&self, request: &HttpRequest) -> Result<Option<String>, SessionCheckerError> {
     Ok(self.cookie_manager.decode_session_payload_from_request(request)?
         .map(|payload| payload.session_token))
   }
@@ -56,7 +56,7 @@ impl SessionChecker {
     &self,
     request: &HttpRequest,
     pool: &MySqlPool
-  ) -> AnyhowResult<Option<SessionRecord>>
+  ) -> Result<Option<SessionRecord>, SessionCheckerError>
   {
     self.do_session_light_lookup_and_cookie_decode(request, pool).await
   }
@@ -66,7 +66,7 @@ impl SessionChecker {
     &self,
     request: &HttpRequest,
     mysql_connection: &mut PoolConnection<MySql>,
-  ) -> AnyhowResult<Option<SessionRecord>>
+  ) -> Result<Option<SessionRecord>, SessionCheckerError>
   {
     self.do_session_light_lookup_and_cookie_decode(request, &mut **mysql_connection).await
   }
@@ -76,7 +76,7 @@ impl SessionChecker {
     &self,
     request: &HttpRequest,
     mysql_executor: E,
-  ) -> AnyhowResult<Option<SessionRecord>>
+  ) -> Result<Option<SessionRecord>, SessionCheckerError>
     where E: 'e + Executor<'c, Database = MySql>
   {
     let maybe_session_token = self.cookie_manager.decode_session_payload_from_request(request)?
@@ -95,18 +95,23 @@ impl SessionChecker {
     &self,
     mysql_executor: E,
     session_token: &str,
-  ) -> AnyhowResult<Option<SessionRecord>>
+  ) -> Result<Option<SessionRecord>, SessionCheckerError>
     where E: 'e + Executor<'c, Database = MySql>
   {
     match self.maybe_get_redis_cache_connection() {
       None => {
-        get_user_session_by_token_light(mysql_executor, session_token).await
+        Ok(get_user_session_by_token_light(mysql_executor, session_token).await?)
       }
       Some(mut redis_ttl_cache) => {
         let cache_key = RedisCacheKeys::session_record_light(session_token);
-        redis_ttl_cache.lazy_load_if_not_cached(&cache_key, move || {
+        // NB: Redis cache requires AnyhowResult; convert sqlx::Error to anyhow inside the closure,
+        //     then map any error from the cache layer back to SessionCheckerError::OtherError.
+        let result = redis_ttl_cache.lazy_load_if_not_cached(&cache_key, move || async move {
           get_user_session_by_token_light(mysql_executor, session_token)
-        }).await
+              .await
+              .map_err(anyhow::Error::from)
+        }).await;
+        result.map_err(SessionCheckerError::OtherError)
       }
     }
   }
@@ -119,7 +124,7 @@ impl SessionChecker {
     &self,
     request: &HttpRequest,
     pool: &MySqlPool,
-  ) -> AnyhowResult<Option<SessionUserRecord>>
+  ) -> Result<Option<SessionUserRecord>, SessionCheckerError>
   {
     self.do_user_session_lookup_and_cookie_decode(request, pool).await
   }
@@ -129,7 +134,7 @@ impl SessionChecker {
     &self,
     request: &HttpRequest,
     mysql_connection: &mut PoolConnection<MySql>,
-  ) -> AnyhowResult<Option<SessionUserRecord>>
+  ) -> Result<Option<SessionUserRecord>, SessionCheckerError>
   {
     self.do_user_session_lookup_and_cookie_decode(request, &mut **mysql_connection).await
   }
@@ -139,7 +144,7 @@ impl SessionChecker {
     &self,
     request: &HttpRequest,
     mysql_executor: E,
-  ) -> AnyhowResult<Option<SessionUserRecord>>
+  ) -> Result<Option<SessionUserRecord>, SessionCheckerError>
     where E: 'e + Executor<'c, Database = MySql>
   {
     let session_token = match self.get_session_token(request)? {
@@ -155,18 +160,21 @@ impl SessionChecker {
     &self,
     mysql_executor: E,
     session_token: &str,
-  ) -> AnyhowResult<Option<SessionUserRecord>>
+  ) -> Result<Option<SessionUserRecord>, SessionCheckerError>
     where E: 'e + Executor<'c, Database = MySql>
   {
     match self.maybe_get_redis_cache_connection() {
       None => {
-        get_user_session_by_token(mysql_executor, session_token).await
+        Ok(get_user_session_by_token(mysql_executor, session_token).await?)
       }
       Some(mut redis_ttl_cache) => {
         let cache_key = RedisCacheKeys::session_record_user(session_token);
-        redis_ttl_cache.lazy_load_if_not_cached(&cache_key, move || {
+        let result = redis_ttl_cache.lazy_load_if_not_cached(&cache_key, move || async move {
           get_user_session_by_token(mysql_executor, session_token)
-        }).await
+              .await
+              .map_err(anyhow::Error::from)
+        }).await;
+        result.map_err(SessionCheckerError::OtherError)
       }
     }
   }
@@ -179,7 +187,7 @@ impl SessionChecker {
     &self,
     request: &HttpRequest,
     pool: &MySqlPool,
-  ) -> AnyhowResult<Option<UserSessionExtended>>
+  ) -> Result<Option<UserSessionExtended>, SessionCheckerError>
   {
     let mut connection = pool.acquire().await?;
     self.maybe_get_user_session_extended_from_connection(request, &mut connection).await
@@ -189,7 +197,7 @@ impl SessionChecker {
     &self,
     request: &HttpRequest,
     mysql_connection: &mut PoolConnection<MySql>,
-  ) -> AnyhowResult<Option<UserSessionExtended>>
+  ) -> Result<Option<UserSessionExtended>, SessionCheckerError>
   {
     let session_payload= match self.cookie_manager.decode_session_payload_from_request(request)? {
       None => return Ok(None),
@@ -209,7 +217,8 @@ impl SessionChecker {
         list_active_user_subscriptions(
           mysql_connection,
           user_session.user_token.as_str()
-        ).await?;
+        ).await
+        .map_err(SessionCheckerError::OtherError)?;
 
     Ok(Some(UserSessionExtended {
       user_token: user_session.user_token.as_str().to_string(),
@@ -283,4 +292,3 @@ impl SessionChecker {
     result.flatten()
   }
 }
-

crates/service/web/storyteller_web/src/http_server/session/session_checker_error.rs

@@ -0,0 +1,49 @@
+use std::error::Error;
+use std::fmt::{Display, Formatter};
+
+use actix_artcraft::sessions::user_sessions::http_user_session_payload_error::HttpUserSessionPayloadError;
+
+#[derive(Debug)]
+pub enum SessionCheckerError {
+  /// Error decoding or verifying the session.
+  /// Rate of failures can point to the cause:
+  /// - One-off errors: probably session forgeries
+  /// - Lots of errors: maybe the wrong hmac secret
+  SessionPayload(HttpUserSessionPayloadError),
+
+  /// Error looking up the session from the database.
+  Sqlx(sqlx::Error),
+
+  /// Some other kind of error - perhaps with the Redis middleware.
+  OtherError(anyhow::Error),
+}
+
+impl Display for SessionCheckerError {
+  fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+    match self {
+      Self::SessionPayload(e) => write!(f, "session payload error: {}", e),
+      Self::Sqlx(e) => write!(f, "sqlx error: {}", e),
+      Self::OtherError(e) => write!(f, "other error: {}", e),
+    }
+  }
+}
+
+impl Error for SessionCheckerError {}
+
+impl From<HttpUserSessionPayloadError> for SessionCheckerError {
+  fn from(err: HttpUserSessionPayloadError) -> Self {
+    Self::SessionPayload(err)
+  }
+}
+
+impl From<sqlx::Error> for SessionCheckerError {
+  fn from(err: sqlx::Error) -> Self {
+    Self::Sqlx(err)
+  }
+}
+
+impl From<anyhow::Error> for SessionCheckerError {
+  fn from(err: anyhow::Error) -> Self {
+    Self::OtherError(err)
+  }
+}

crates/service/web/storyteller_web/src/main.rs

@@ -21,7 +21,7 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use actix::Actor;
-use actix_artcraft::sessions::http_user_session_manager::HttpUserSessionManager;
+use actix_artcraft::sessions::user_sessions::http_user_session_manager::HttpUserSessionManager;
 use actix_cors_configs::cors::build_cors_config;
 use actix_cors_configs::shared_array_buffer_cors::shared_array_buffer_cors;
 use actix_helpers::middleware::banned_cidr_filter::banned_cidr_filter::BannedCidrFilter;
@@ -71,7 +71,7 @@ use crate::billing::stripe_internal_user_lookup_impl::StripeInternalUserLookupIm
 use crate::configs::app_startup::redis_rate_limiters::configure_redis_rate_limiters;
 use crate::configs::connect_to_database::connect_to_database;
 use crate::configs::static_api_tokens::StaticApiTokenSet;
-use crate::http_server::cookies::anonymous_visitor_tracking::avt_cookie_manager::AvtCookieManager;
+use actix_artcraft::sessions::anonymous_visitor_tracking::avt_cookie_manager::AvtCookieManager;
 use crate::http_server::middleware::error_alerting_middleware::error_alerting_middleware::ErrorAlertingMiddleware;
 use crate::http_server::middleware::pushback_filter_middleware::PushbackFilter;
 use crate::http_server::routes::add_routes::add_routes;
@@ -93,7 +93,6 @@ use crate::util::troll_user_bans::troll_user_ban_list::TrollUserBanList;
 pub mod billing;
 pub mod configs;
 pub mod email;
-pub mod error;
 pub mod http_server;
 pub mod startup;
 pub mod state;

crates/service/web/storyteller_web/src/state/server_state.rs

@@ -1,4 +1,4 @@
-use actix_artcraft::sessions::http_user_session_manager::HttpUserSessionManager;
+use actix_artcraft::sessions::user_sessions::http_user_session_manager::HttpUserSessionManager;
 use actix_helpers::middleware::banned_cidr_filter::banned_cidr_set::BannedCidrSet;
 use actix_helpers::middleware::banned_ip_filter::ip_ban_list::ip_ban_list::IpBanList;
 use billing_artcraft_component::utils::artcraft_stripe_config::ArtcraftStripeConfigWithClient;
@@ -25,7 +25,7 @@ use url_config::third_party_url_redirector::ThirdPartyUrlRedirector;
 
 use crate::configs::app_startup::username_set::UsernameSet;
 use crate::configs::static_api_tokens::StaticApiTokenSet;
-use crate::http_server::cookies::anonymous_visitor_tracking::avt_cookie_manager::AvtCookieManager;
+use actix_artcraft::sessions::anonymous_visitor_tracking::avt_cookie_manager::AvtCookieManager;
 use crate::http_server::deprecated_endpoints::categories::tts::list_fully_computed_assigned_tts_categories::list_fully_computed_assigned_tts_categories::ModelTokensByCategoryToken;
 use crate::http_server::deprecated_endpoints::leaderboard::get_leaderboard::LeaderboardInfo;
 use crate::http_server::endpoints::media_files::list::list_featured_media_files_handler::ListFeaturedMediaFilesQueryParams;