LeoVasanko
68dccc1378
Allows Paskia to authenticate the user to a client site. - User friendly client registration flow on the admin app - Redirect-based authentication flow (per spec) - Backchannel logout both ways to keep sessions synchronized - Groups integrated with Paskia's permission system - Adds email, preferred username and telephone fields on user profile - All new user basic info layout to show the new information, better looks - API and DB structures redesigned - Various unrelated fixes to theming and layout
38 lines
1.2 KiB
Python
38 lines
1.2 KiB
Python
"""Utility functions for session validation, derivation, and checking."""
|
|
|
|
from datetime import UTC, datetime
|
|
|
|
from paskia.db import SessionContext
|
|
from paskia.util.timeutil import parse_duration
|
|
|
|
|
|
def check_session_age(ctx: SessionContext, max_age: str | None) -> bool:
|
|
"""Check if a session satisfies the max_age requirement.
|
|
|
|
Uses the credential's last_used timestamp to determine authentication age,
|
|
since session renewal can happen without re-authentication.
|
|
|
|
Args:
|
|
ctx: The session context containing session and credential info
|
|
max_age: Maximum age string (e.g., "5m", "1h", "30s") or None
|
|
|
|
Returns:
|
|
True if authentication is recent enough or max_age is None, False if too old
|
|
|
|
Raises:
|
|
ValueError: If max_age format is invalid
|
|
"""
|
|
if not max_age:
|
|
return True
|
|
|
|
max_age_delta = parse_duration(max_age)
|
|
|
|
# Use credential's last_used time if available, fall back to session renewed time
|
|
if ctx.credential and ctx.credential.last_used:
|
|
auth_time = ctx.credential.last_used
|
|
else:
|
|
auth_time = ctx.session.validated
|
|
|
|
time_since_auth = datetime.now(UTC) - auth_time
|
|
return time_since_auth <= max_age_delta
|