Replace session.renewed with .expiry for consistency with other expiring items. Fix migration script.

paskia/fastapi/admin.py

@@ -5,7 +5,7 @@ from uuid import UUID, uuid4
 from fastapi import Body, FastAPI, HTTPException, Request, Response
 from fastapi.responses import JSONResponse
 
-from paskia.authsession import reset_expires
+from paskia.authsession import EXPIRES, reset_expires
 from paskia.fastapi import authz
 from paskia.fastapi.session import AUTH_COOKIE
 from paskia import db
@@ -556,6 +556,7 @@ async def admin_get_user_detail(
     current_session_key = session_key(auth)
     sessions_payload: list[dict] = []
     for entry in session_records:
+        renewed = entry.expiry - EXPIRES
         sessions_payload.append(
             {
                 "id": encode_session_key(entry.key),
@@ -564,11 +565,11 @@ async def admin_get_user_detail(
                 "ip": entry.ip,
                 "user_agent": useragent.compact_user_agent(entry.user_agent),
                 "last_renewed": (
-                    entry.renewed.astimezone(timezone.utc)
+                    renewed.astimezone(timezone.utc)
                     .isoformat()
                     .replace("+00:00", "Z")
-                    if entry.renewed.tzinfo
-                    else entry.renewed.replace(tzinfo=timezone.utc)
+                    if renewed.tzinfo
+                    else renewed.replace(tzinfo=timezone.utc)
                     .isoformat()
                     .replace("+00:00", "Z")
                 ),

paskia/fastapi/api.py

@@ -18,7 +18,6 @@ from paskia.authsession import (
     get_reset,
     get_session,
     refresh_session_token,
-    session_expiry,
 )
 from paskia.fastapi import authz, session, user
 from paskia.fastapi.session import AUTH_COOKIE, AUTH_COOKIE_NAME
@@ -98,8 +97,7 @@ async def validate_token(
         raise
     renewed = False
     if auth:
-        current_expiry = session_expiry(ctx.session)
-        consumed = EXPIRES - (current_expiry - datetime.now(timezone.utc))
+        consumed = EXPIRES - (ctx.session.expiry - datetime.now(timezone.utc))
         if not timedelta(0) < consumed < _REFRESH_INTERVAL:
             try:
                 await refresh_session_token(
@@ -160,12 +158,12 @@ async def forward_authentication(
             "Remote-Role": str(ctx.role.uuid),
             "Remote-Role-Name": ctx.role.display_name,
             "Remote-Session-Expires": (
-                session_expiry(ctx.session)
+                ctx.session.expiry
                 .astimezone(timezone.utc)
                 .isoformat()
                 .replace("+00:00", "Z")
-                if session_expiry(ctx.session).tzinfo
-                else session_expiry(ctx.session)
+                if ctx.session.expiry.tzinfo
+                else ctx.session.expiry
                 .replace(tzinfo=timezone.utc)
                 .isoformat()
                 .replace("+00:00", "Z")