From 92692de94d21643a337da77b16959f1fbc62246c Mon Sep 17 00:00:00 2001
From: mrhid6 <mrhid6@gmail.com>
Date: Wed, 12 Aug 2026 14:34:54 +0000
Subject: [PATCH] docs: Correct the middleware fallback in the plan

The plan's Middleware called sessionFromToken even when sessionFromCookie
had already answered a rejected cookie, putting two JSON bodies on the
wire for the ordinary expired-session case. Found in review of Task 5.
---
 docs/superpowers/plans/2026-08-12-api-tokens-openapi.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/docs/superpowers/plans/2026-08-12-api-tokens-openapi.md b/docs/superpowers/plans/2026-08-12-api-tokens-openapi.md
index 349e0ff..507a7e5 100644
--- a/docs/superpowers/plans/2026-08-12-api-tokens-openapi.md
+++ b/docs/superpowers/plans/2026-08-12-api-tokens-openapi.md
@@ -822,6 +822,12 @@ func Middleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		sess, ok := sessionFromCookie(c)
 		if !ok {
+			// A cookie that was presented and rejected has already been
+			// answered. Falling through would put a second JSON body on the
+			// wire for the ordinary expired-session case.
+			if c.IsAborted() {
+				return
+			}
 			sess, ok = sessionFromToken(c)
 		}
 		if !ok {