"""Absolute session limit; the idle limit is SESSION_COOKIE_AGE with save-every-request."""

import time

from django.conf import settings

from .session_store import CREATED_AT


class AbsoluteSessionLimitMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        session = request.session
        created = session.get(CREATED_AT)
        if created is not None and time.time() - created > settings.SESSION_ABSOLUTE_SECONDS:
            # flush() deletes the row; the empty session makes SessionMiddleware clear the cookie.
            session.flush()
        return self.get_response(request)