[nycomp]

Problem

POST /logins/{session_id}/token serves client principals only — campus.auth's A10 guard (authz.forbid_user_principal, #854 lineage) denies user bearers outright. But Login.token() sent its request on the shared session's ambient Authorization header, whatever it happened to hold.

The breakage shows whenever with_user_session() runs nested inside another with_user_session(): the outer session has set Authorization: Bearer <user token> on the shared auth client, so the inner session's re-acquisition presents a user token to the route → 403 FORBIDDEN → (in campus-classroom) BrokerConfigError → 502 on every enrollment-gated submission mutation.

Found live on dev, 2026-10-27, during the campus-classroom #14 verification pass: the /a/ answer sheet's Save-draft/Submit 502'd while the page render's identical broker release succeeded seconds earlier — the render path enters with_user_session with a fresh (Basic) header because the preceding app-scoped read resets it; the mutation path enters nested.

The SDK's own 401-refresh hook already documented the discipline this route needs — "the login-session token route denies user principals outright (campus#964/A10), so the session's stale bearer must not be presented mid-rotation" (refresh_bearer() revokes first) — the initial acquisition path just didn't follow it.

Fix

Login.token() now:

1. snapshots the ambient Authorization header,
2. reset_authorization() → the client's Basic credentials for the call,
3. restores a prior Bearer afterwards — in a finally, so the enclosing session keeps its authorization even when the route answers 403/400.

The enclosing with_user_session() immediately overwrites the header via use_token(<fresh bearer>), so restore-then-overwrite is correct in both the top-level and nested cases.

Tests

TestLoginTokenPresentsBasicOnly (4 cases, mock-client contract style matching the file):

• exact call ordering reset_authorization → POST /logins/{id}/token → set_bearer_authorization(<prior>) when a bearer is ambient,
• the ambient bearer is restored after the call,
• it is restored even when the route answers 403,
• no ambient header → Basic stays, no spurious set_bearer.

Full suite: 321 passed.

Impact on consumers

After this, nested with_user_session() blocks work; the outer session's subsequent calls may ride the inner session's finally reset (Basic) and self-heal through the existing 401 hook (+1 round trip) — the same healing path an expired bearer already takes.