fix(auth): touch Explorer sessions at most once a minute instead of on every request - #20
Merged
Merged
Conversation
…n every request TL;DR: Validating an Explorer session no longer writes to SQLite on every request. The last-seen and idle-expiry columns are rewritten only when the previous touch is more than a minute old, which turns a page load's burst of requests into a single write and keeps the stated 60-minute idle limit accurate to the minute. One minute is the convention across Auth, Explorer, and Lens. Problem: get_identity opened every check with BEGIN IMMEDIATE and issued an UPDATE, so each authenticated request took the SQLite write lock and flushed a transaction to record a timestamp that carried no new information. Explorer's inbox page fires several requests per load; with a few dozen users that is hundreds of write transactions per minute against the access-list database. Fix: - SESSION_TOUCH_SECONDS = 60, documented as the Elcano convention for service sessions and deliberately a constant. - get_identity reads first without taking the write lock, then writes only if timestamp - last_seen_at is at least the interval; the UPDATE is guarded with revoked_at IS NULL. Expiry and revocation checks are unchanged, so the idle limit behaves as "60 minutes minus at most one minute", never longer. - README notes the behaviour. Tests: - New: two validations inside the interval leave last_seen_at and idle_expires_at untouched; the first validation past the interval writes once and moves the idle clock forward from the request; a request at idle_expires_at is rejected. - Ran: pytest -q, ruff check, ruff format --check.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TLDR
get_identityno longer takes the SQLite write lock and rewriteslast_seen_at/idle_expires_aton every request. It reads first and writes only when the previous touch is more than a minute old, so a page load's burst costs one write and the 60-minute idle limit stays accurate to the minute (never longer). One minute is the convention across Auth, Explorer, and Lens (ElcanoTek/auth PR "one-minute session touch" records it indocs/AUTH_V2_IMPLEMENTATION.md).Tests
New test covers no-write inside the interval, one write past it, and idle enforcement at the boundary. pytest, ruff check, ruff format all green.