Ebbe BaßandClaude Sonnet 5.5
73505ac717
Audit entries written only inside the caller's transaction, database throttle counters that refuse to run inside a transaction that could roll back, and a database session store with the user key in its own column, end_sessions and idle and absolute limits. Ticket 1.3. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Sk72AxLwQnYttF6VFSxQLt
53 lines
1.6 KiB
Python
53 lines
1.6 KiB
Python
"""Session user and the only way to end sessions (AD-3, AD-6)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import time
|
|
from dataclasses import dataclass
|
|
|
|
from .models import UserSession
|
|
from .session_store import CREATED_AT, USER_KEY, USER_SAM
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class SessionUser:
|
|
key: str # lower-case, used for every database key
|
|
sam: str # exact sAMAccountName from AD
|
|
|
|
@classmethod
|
|
def from_sam(cls, sam: str) -> SessionUser:
|
|
return cls(key=sam.lower(), sam=sam)
|
|
|
|
|
|
def start_session(request, sam: str) -> SessionUser:
|
|
"""Sign a user in on this request; the session key is rotated and old data dropped."""
|
|
user = SessionUser.from_sam(sam)
|
|
request.session.flush()
|
|
request.session[USER_KEY] = user.key
|
|
request.session[USER_SAM] = user.sam
|
|
request.session[CREATED_AT] = time.time()
|
|
return user
|
|
|
|
|
|
def current_user(request) -> SessionUser | None:
|
|
session = getattr(request, "session", None)
|
|
if session is None:
|
|
return None
|
|
key = session.get(USER_KEY)
|
|
sam = session.get(USER_SAM)
|
|
if not key or not sam:
|
|
return None
|
|
return SessionUser(key=key, sam=sam)
|
|
|
|
|
|
def end_sessions(user: SessionUser | str, except_session_key: str | None = None) -> int:
|
|
"""Delete every session of one user, optionally keeping one. Returns how many were ended."""
|
|
key = (user.key if isinstance(user, SessionUser) else str(user)).lower()
|
|
if not key:
|
|
return 0
|
|
qs = UserSession.objects.filter(username=key)
|
|
if except_session_key:
|
|
qs = qs.exclude(session_key=except_session_key)
|
|
deleted, _ = qs.delete()
|
|
return deleted
|