keepup-admin 0.2.0__tar.gz → 0.3.0__tar.gz

{keepup_admin-0.2.0/keepup_admin.egg-info → keepup_admin-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keepup-admin
-Version: 0.2.0
+Version: 0.3.0
 Summary: An admin framework over FastAPI: plugins, panel, users, replicas
 Author-email: Fedor Sergeev <fksergeev@gmail.com>
 License-Expression: Apache-2.0
@@ -25,17 +25,20 @@ Requires-Dist: sqlalchemy<3,>=2.0
 Requires-Dist: psycopg2-binary>=2.9
 Requires-Dist: apscheduler<4,>=3.10
 Requires-Dist: bcrypt<5,>=4.0
-Requires-Dist: pyjwt[crypto]<3,>=2.10
-Requires-Dist: python-multipart>=0.0.20
+Requires-Dist: pyjwt[crypto]<3,>=2.15
+Requires-Dist: python-multipart>=0.0.31
 Requires-Dist: PyYAML<7,>=6.0
 Requires-Dist: psutil>=7.0
 Requires-Dist: prometheus-client>=0.24
-Requires-Dist: requests>=2.31
+Requires-Dist: requests>=2.33
 Requires-Dist: httpx>=0.28
+Requires-Dist: cryptography>=50.0
+Requires-Dist: urllib3>=2.8
 Provides-Extra: test
 Requires-Dist: pytest>=8; extra == "test"
 Requires-Dist: pytest-asyncio>=0.24; extra == "test"
 Requires-Dist: pytest-cov>=5; extra == "test"
+Requires-Dist: uvicorn>=0.30; extra == "test"
 Provides-Extra: postgres
 Requires-Dist: asyncpg>=0.31; extra == "postgres"
 Dynamic: license-file

keepup_admin-0.3.0/admin_trail.py

@@ -0,0 +1,60 @@
+"""What an administrator changed, written into the event log (keepup-67).
+
+The event log is where a deployment looks for who did what, and the framework's
+own administrative surface left nothing there: purging the log, changing the
+panel's sections, their grants and the themes, and switching a plugin's
+decision were visible only in the application log -- which rotates, is shipped
+elsewhere or nowhere, and is not what an operator reads. Each of those now
+writes one event naming the administrator.
+
+The types below are the framework's. Neither they nor the types an application
+declares can be created by hand through `POST /api/events`: a journal the
+watched party can fill with lookalikes is not evidence (keepup/events_api.py).
+
+Writing the trail never fails the action it records: the action has already
+happened, and answering an error for it would only invite a repeat. A trail
+that could not be written is logged as an error.
+"""
+
+import logging
+from typing import Any, Dict, Optional
+
+from keepup import events
+
+logger = logging.getLogger(__name__)
+
+#: What an application may import from this module. Everything else is
+#: internal and may change without notice -- see doc/keepup.md.
+__all__ = [
+    "ADMIN_EVENT_TYPES",
+    "EVENTS_PURGED",
+    "PLUGIN_DECISION_CHANGED",
+    "SECTIONS_CHANGED",
+    "THEMES_CHANGED",
+    "record",
+]
+
+EVENTS_PURGED = "admin_events_purged"
+SECTIONS_CHANGED = "admin_sections_changed"
+THEMES_CHANGED = "admin_themes_changed"
+PLUGIN_DECISION_CHANGED = "admin_plugin_decision_changed"
+
+ADMIN_EVENT_TYPES = (EVENTS_PURGED, SECTIONS_CHANGED, THEMES_CHANGED, PLUGIN_DECISION_CHANGED)
+
+
+def _author(admin: Optional[Dict[str, Any]]) -> Dict[str, Any]:
+    admin = admin or {}
+    return {"user_id": admin.get("id"), "username": admin.get("username")}
+
+
+async def record(event_type: str, admin: Optional[Dict[str, Any]], text: str,
+                 **details: Any) -> Optional[int]:
+    """Write one administrative event; the id, or None when it could not be written."""
+    data = {"by": _author(admin), **details}
+    try:
+        return await events.event_manager.create_event(
+            event_type=event_type, event_text=text, event_data=data)
+    except Exception as error:
+        logger.error(f"Could not record {event_type} by {data['by'].get('username')}: {error}")
+        return None
+

keepup_admin-0.3.0/api_docs.py

@@ -0,0 +1,76 @@
+"""The API schema and the documentation pages built from it (keepup-96).
+
+FastAPI serves its OpenAPI schema at /openapi.json to anybody, and the schema
+describes every route of the application -- the administrative ones with their
+parameters and bodies. For somebody outside that is a map of where to knock.
+FastAPI has no notion of who is asking, so the framework takes both routes over:
+
+- the schema answers an administrator only, like every other administrative
+  route of the framework, unless the application opens it on purpose
+  (``KeepupSettings.openapi_public``) or removes it (``openapi_url=None``);
+- the documentation pages stay public shells: they fetch the schema from the
+  browser, with the panel's cookie, so an administrator sees the API and anybody
+  else sees the refusal.
+
+Building the schema in code -- ``app.openapi()``, which ci/generate_openapi.py
+calls -- is untouched: it never went through the route.
+"""
+
+from fastapi import Depends
+from fastapi.openapi.docs import (
+    get_redoc_html,
+    get_swagger_ui_html,
+    get_swagger_ui_oauth2_redirect_html,
+)
+from fastapi.responses import JSONResponse
+
+from keepup.auth.dependencies import get_current_admin
+
+#: What an application may import from this module. Everything else is
+#: internal and may change without notice -- see doc/keepup.md.
+__all__ = ["OAUTH2_REDIRECT_URL", "register_api_documentation"]
+
+#: Where Swagger UI returns from an OAuth2 sign-in; FastAPI's own default.
+OAUTH2_REDIRECT_URL = "/docs/oauth2-redirect"
+
+
+def register_api_documentation(app, settings) -> None:
+    """The schema route and the documentation pages, as the settings ask.
+
+    Called right after the application is created: FastAPI used to register
+    these in its constructor, ahead of any route of the application, and a page
+    registered later could be shadowed by a route that happens to match it.
+    """
+    schema_url = settings.openapi_url
+    if not schema_url:
+        # No schema, no pages: they would have nothing to show.
+        return
+
+    if settings.openapi_public:
+        async def api_schema():
+            return JSONResponse(app.openapi())
+    else:
+        async def api_schema(admin: dict = Depends(get_current_admin)):
+            return JSONResponse(app.openapi())
+
+    app.add_api_route(schema_url, api_schema, methods=["GET"], include_in_schema=False)
+
+    if settings.docs_url:
+        async def swagger_page():
+            return get_swagger_ui_html(openapi_url=schema_url, title=f"{app.title} - API",
+                                       oauth2_redirect_url=OAUTH2_REDIRECT_URL)
+
+        async def swagger_redirect():
+            return get_swagger_ui_oauth2_redirect_html()
+
+        app.add_api_route(settings.docs_url, swagger_page, methods=["GET"],
+                          include_in_schema=False)
+        app.add_api_route(OAUTH2_REDIRECT_URL, swagger_redirect, methods=["GET"],
+                          include_in_schema=False)
+
+    if settings.redoc_url:
+        async def redoc_page():
+            return get_redoc_html(openapi_url=schema_url, title=f"{app.title} - API")
+
+        app.add_api_route(settings.redoc_url, redoc_page, methods=["GET"],
+                          include_in_schema=False)

{keepup_admin-0.2.0 → keepup_admin-0.3.0}/audit.py

@@ -131,6 +131,17 @@ incoming_requests_lock = asyncio.Lock()
 
 BUFFER_FLUSH_INTERVAL = 125
 BUFFER_MAX_SIZE = 100
+#: The most requests the buffer holds, whatever happens to the database
+#: (keepup-68). A failed flush puts its rows back, so with the database away the
+#: buffer used to grow with every request; past this the oldest go.
+BUFFER_HARD_LIMIT = 10_000
+#: After a failed flush, requests do not start another one for this long: the
+#: timed flusher still retries, but not every request on its own.
+FLUSH_RETRY_PAUSE_SECONDS = 5.0
+
+_flush_lock = asyncio.Lock()
+_flush_paused_until = 0.0
+dropped_requests = 0
 #: A request running this long is written without its outcome (keepup-41): the
 #: process that would have finished it has most likely gone.
 IN_FLIGHT_STALE_SECONDS = 3600
@@ -170,7 +181,13 @@ class IncomingRequestLogger:
                 'request_start_at': request_start,
                 'created_at': datetime.utcnow()
             }
-            if len(incoming_requests_buffer) >= BUFFER_MAX_SIZE:
+            global dropped_requests
+            while len(incoming_requests_buffer) > BUFFER_HARD_LIMIT:
+                # Insertion order: the first key is the oldest request.
+                incoming_requests_buffer.pop(next(iter(incoming_requests_buffer)))
+                dropped_requests += 1
+            if (len(incoming_requests_buffer) >= BUFFER_MAX_SIZE and not _flush_lock.locked()
+                    and time.monotonic() >= _flush_paused_until):
                 asyncio.create_task(IncomingRequestLogger.flush_buffer())
 
         return request_id
@@ -231,6 +248,13 @@ class IncomingRequestLogger:
         not grow forever; and at shutdown (``include_in_flight``) everything is
         written -- nothing will finish afterwards.
         """
+        # One flush at a time: a full buffer asked for one on every request.
+        async with _flush_lock:
+            return await IncomingRequestLogger._flush_buffer(include_in_flight, now)
+
+    @staticmethod
+    async def _flush_buffer(include_in_flight: bool, now: Optional[datetime]) -> int:
+        global _flush_paused_until, dropped_requests
         now = now or datetime.utcnow()
         # The buffer lock is taken by the start and the end of every request, so
         # it is held only to pick the rows and take them out -- never across the
@@ -279,6 +303,7 @@ class IncomingRequestLogger:
             # Back into the buffer: the next flush tries again. A request that
             # somehow reappeared meanwhile keeps its newer entry.
             logger.error(f"Error flushing incoming requests buffer: {str(e)}")
+            _flush_paused_until = time.monotonic() + FLUSH_RETRY_PAUSE_SECONDS
             async with incoming_requests_lock:
                 for request_id, req in chosen.items():
                     incoming_requests_buffer.setdefault(request_id, req)
@@ -288,6 +313,10 @@ class IncomingRequestLogger:
         # duplicate alike: an ignored one is already in the table.
         if inserted_count:
             logger.info(f"Flushed {inserted_count} incoming requests to database")
+        if dropped_requests:
+            logger.warning(f"{dropped_requests} incoming requests were dropped from the "
+                           f"audit while it could not be written")
+            dropped_requests = 0
         return inserted_count
 
 
@@ -408,6 +437,12 @@ async def background_buffer_flusher():
             await asyncio.sleep(10)
 
 
+def _is_refusal(error: BaseException) -> bool:
+    """An HTTP refusal a route raised on purpose, whose text is its answer."""
+    from starlette.exceptions import HTTPException
+    return isinstance(error, HTTPException)
+
+
 @asynccontextmanager
 async def log_api_request(
         method: str,
@@ -434,10 +469,12 @@ async def log_api_request(
 
     except Exception as e:
         if request_id:
+            # A refusal keeps its reason: it is the answer the client was given.
+            # Anything else keeps its kind, not its text (keepup-76).
             await IncomingRequestLogger.end_request(
                 request_id=request_id,
                 duration_ms=int((time.time() - start_time) * 1000),
-                error_message=str(e)
+                error_message=str(e) if _is_refusal(e) else type(e).__name__
             )
         raise
 

{keepup_admin-0.2.0 → keepup_admin-0.3.0}/auth/dependencies.py

@@ -21,11 +21,17 @@ import jwt
 from jwt import PyJWTError as JWTError
 from starlette import status
 
+from keepup.auth.usernames import is_valid_username
 from keepup.auth import panel_session
 from keepup.auth.dto.token import TokenData
+from keepup.auth.external_accounts import AccountUnavailable
 from keepup.auth.factory import AuthProviderFactory
+from keepup.auth.identity import access
+from keepup.auth.identity import runtime as identity_runtime
+from keepup.auth.identity.contract import IdentityRejected, ProviderUnavailable
 from keepup.auth.providers.base import AuthProvider, ALGORITHM, oauth2_scheme
 from keepup.auth.signing_key import resolve_signing_key
+from keepup.auth import user_roles
 from keepup.roles import ROLE_ADMIN, ROLE_CLIENT
 from keepup.db import DatabaseManagerV2
 
@@ -63,14 +69,20 @@ def get_user_by_username(username: str):
     loop of its own in a thread that the caller waited for, holding the loop.
     The provider answers synchronously itself now.
     """
-    return auth_provider.lookup_user(username)
+    return user_roles.attach_roles(auth_provider.lookup_user(username))
 
 
 def get_user_by_id(user_id: int):
-    """Return a user by id, for any configured auth provider."""
+    """Return a user by id, with the roles it holds.
+
+    The set travels with the account wherever the framework hands one out: code
+    that asks whether this person holds a role must not have to know which of
+    the two reads it came from.
+    """
     # TODO: auth_provider needs a lookup by id as well; without it this only
     # works against the local database.
-    return DatabaseManagerV2.execute_one("SELECT * FROM users WHERE id = :id", {"id": user_id})
+    return user_roles.attach_roles(
+        DatabaseManagerV2.execute_one("SELECT * FROM users WHERE id = :id", {"id": user_id}))
 
 
 def get_system_user_id():
@@ -97,14 +109,28 @@ def get_system_user_id():
 
 
 def get_all_users():
-    """Return every user, for any configured auth provider."""
-    return DatabaseManagerV2.execute(
+    """Return every user, with the roles each of them holds."""
+    users = DatabaseManagerV2.execute(
         "SELECT id, username, status, role, created_at FROM users ORDER BY created_at DESC"
-    )
+    ) or []
+    held = {}
+    for row in DatabaseManagerV2.execute(
+            "SELECT user_id, role_name FROM user_roles") or []:
+        held.setdefault(row["user_id"], []).append(row["role_name"])
+    # One read for the whole list rather than one per user: this is the panel's
+    # first screen, and a query per row is what makes it slow on a real stand.
+    # An account whose set has never been filled in reads as its mirror says,
+    # which is known from the row already read.
+    return [dict(user, roles=(sorted(held.get(user["id"], []))
+                              or user_roles.held_by(user) or [ROLE_CLIENT]))
+            for user in users]
 
 
 def save_user_to_db(username: str, password: str):
     """Create a user, for any configured auth provider."""
+    if not is_valid_username(username):
+        raise HTTPException(status_code=400, detail="Username may contain letters, digits "
+                                                    "and . _ @ + -, at most 64 characters")
     password_hash = bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt()).decode('utf-8')
 
     query = """
@@ -117,7 +143,13 @@ def save_user_to_db(username: str, password: str):
             query,
             {"username": username, "password_hash": password_hash, "status": "blocked",
              "role": ROLE_CLIENT})
-        return row["id"] if row else None
+        user_id = row["id"] if row else None
+        if user_id is not None:
+            # The set is the truth about who this is, so a new account gets its
+            # row now rather than relying on the read's fallback until the next
+            # start (keepup/auth/user_roles.py).
+            user_roles.set_roles(user_id, [ROLE_CLIENT])
+        return user_id
 
     except Exception as e:
         if "unique constraint" in str(e).lower() or "duplicate" in str(e).lower():
@@ -135,10 +167,11 @@ async def create_user(
 ):
     user_id = auth_provider.create_user_in_db(username, password, email, phone, full_name, agree_terms)
 
-    user_data = {"user_id": user_id, "username": (username,), "password": (password,), "email": email, "phone": phone,
-                 "full_name": full_name, "agree_terms": agree_terms}
-
-    await auth_provider.create_user(user_data)
+    # The account is created once, above. This used to hand the provider the
+    # same account again -- with the name and password as one-element tuples --
+    # and the provider's create_user calls back into this function: a second
+    # insert that failed on every creation and was logged and swallowed
+    # (keepup-79).
 
     # The id is returned to the caller: it was computed and then thrown away,
     # while callers assigned the result to a variable and got None. The nearest
@@ -162,6 +195,14 @@ def update_user(user_id: int, status: Optional[str] = None, role: Optional[str]
         f"UPDATE users SET {assignments}, updated_at = CURRENT_TIMESTAMP WHERE id = :id",
         {**changes, "id": user_id})
 
+    # A caller setting the single role means "this person is a client now", so
+    # the whole set becomes that role. Leaving ADMIN in it would quietly keep a
+    # right the administrator had just taken away (keepup-51). Unchecked, because
+    # this column never checked: turning a call that worked into a refusal is not
+    # what a deprecated field should do on its way out.
+    if role is not None:
+        user_roles.set_roles(user_id, [role], checked=False)
+
 
 async def authenticate(username: str, password: str):
     return await auth_provider.authenticate(username=username, password=password)
@@ -211,6 +252,15 @@ def issue_session_token(user_id: int, username: str, sid: Optional[str] = None,
     if sid is None:
         sid = panel_session.open_session(user_id, lifetime)
     else:
+        # Every renewal is held to the window, not only /api/auth/refresh: the
+        # exchange of a token for the cookie carried a session on without the
+        # check, so a stolen token could be renewed for ever (keepup-64).
+        from keepup.auth import session_lifetime
+        if not session_lifetime.is_renewable(session_started_at):
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="This session has run its course. Sign in again.",
+            )
         panel_session.extend(sid, lifetime)
     token = create_access_token({"sub": username, panel_session.SESSION_CLAIM: sid},
                                 expires_delta=lifetime, session_started_at=session_started_at)
@@ -234,29 +284,49 @@ async def request_token(request: Request, bearer: Optional[str] = Depends(oauth2
     return panel_session.token_from_request(request, bearer)
 
 
-def _session_is_live(payload: dict) -> bool:
-    """A token that names a session is good only while that session is.
-
-    A token without one was issued before sessions were recorded and is accepted
-    until it expires -- at most a day after the deployment.
-    """
-    sid = payload.get(panel_session.SESSION_CLAIM)
-    if sid is None:
-        return True
+def _session_owner(sid: str) -> Optional[int]:
+    """The account the live session ``sid`` belongs to, or None."""
     try:
-        return panel_session.is_active(sid)
+        return panel_session.session_owner(sid)
     except Exception as error:
         # Failing open here would make revocation depend on the database being
         # up; failing closed only costs a retry.
         logger.error(f"Could not check session {str(sid)[:8]}...: {error}")
-        return False
+        return None
 
 
 def _session_and_user(payload: dict, username: str):
-    """Whether the token's session is live and, only if it is, whose account it is."""
-    if not _session_is_live(payload):
+    """Whether the token's session is live and, only if it is, whose account it is.
+
+    A token is good only while its session is live and belongs to the account
+    the token names: otherwise it was not issued by this server, or names an
+    account recreated under the same name (keepup-64). A token without a
+    session is refused: tokens from before sessions were recorded were accepted
+    until they expired, and that transition is over (keepup-81).
+
+    The role set is read here too, in the same hop out of the event loop: one
+    more statement on the thread that read the account, not a second thread and
+    a second loop (keepup-43). It is not cached -- see keepup/auth/user_roles.py.
+    """
+    sid = payload.get(panel_session.SESSION_CLAIM)
+    if not sid:
+        return False, None
+    # One connection and one commit for the three reads, not one each: this
+    # runs on every request, and it was half of what a replica spent (keepup-85).
+    try:
+        with DatabaseManagerV2.shared_session():
+            owner = _session_owner(sid)
+            if owner is None:
+                return False, None
+            user = auth_provider.lookup_user(username)
+            if user is not None and int(user["id"]) != owner:
+                return False, None
+            return True, user_roles.attach_roles(user)
+    except Exception as error:
+        # A failed read leaves the shared session unable to commit; either way
+        # the answer is the one a failed check always gave -- refuse.
+        logger.error(f"Could not check the session of {username}: {error}")
         return False, None
-    return True, auth_provider.lookup_user(username)
 
 
 async def get_current_user(token: str = Depends(request_token)):
@@ -300,17 +370,29 @@ async def _get_local_user(token: Optional[str], ignore_empty_user: bool = False)
             if ignore_empty_user:
                 return None
             raise credentials_exception
-        payload = jwt.decode(token, resolve_signing_key(), algorithms=[ALGORITHM])
+        # Every token this server issues has an expiry, a subject and a session;
+        # one without them was not issued here, or was issued before sessions
+        # were recorded -- long enough ago to have expired (keepup-64, keepup-81).
+        payload = jwt.decode(token, resolve_signing_key(), algorithms=[ALGORITHM],
+                             options={"require": ["exp", "sub", panel_session.SESSION_CLAIM]})
         username: str = payload.get("sub")
         if username is None:
             if ignore_empty_user:
                 return None
             raise credentials_exception
         token_data = TokenData(username=username)
-    except JWTError:
+    except _OUR_TOKEN_REFUSED:
+        # The signature is ours and the rest is not right: expired, not yet
+        # valid, or missing what every token of ours carries. It is refused
+        # here and never shown to the provider, which has no business seeing
+        # this framework's tokens.
         if ignore_empty_user:
             return None
         raise credentials_exception
+    except JWTError:
+        # Not a token of this framework at all: another signature, another
+        # algorithm, not a JWT. The configured provider may know it.
+        return await _foreign_user(token, credentials_exception, ignore_empty_user)
 
     # Both reads are blocking queries, so they leave the loop together: one hop
     # to a worker thread per request, and the account is read once -- it used
@@ -338,6 +420,68 @@ async def _get_local_user(token: Optional[str], ignore_empty_user: bool = False)
     return user
 
 
+#: Refusals that mean the token is ours: the signature matched and something
+#: else did not. Everything else PyJWT raises means somebody else signed it.
+_OUR_TOKEN_REFUSED = (jwt.ExpiredSignatureError, jwt.ImmatureSignatureError,
+                      jwt.MissingRequiredClaimError)
+
+
+async def _foreign_user(token: str, credentials_exception: HTTPException,
+                        ignore_empty_user: bool = False):
+    """The user of a token some other system issued, through the configured provider.
+
+    Only when the deployment switched the provider's token mode on; otherwise a
+    token that is not ours is simply not a token. Every refusal answers the same
+    as a bad token of ours. An unavailable provider is a 503: a client told its
+    token is bad throws it away, and it must not do that because somebody else's
+    server is down.
+    """
+    runtime = identity_runtime.current()
+    if runtime is None or not runtime.config.accept_tokens:
+        if ignore_empty_user:
+            return None
+        raise credentials_exception
+    try:
+        identity = await runtime.identity_for_token(token)
+        account = await runtime.user_for_identity(identity)
+    except IdentityRejected as refusal:
+        logger.info("Token refused by identity provider %s: %s", runtime.config.name, refusal)
+        if ignore_empty_user:
+            return None
+        raise credentials_exception
+    except (ProviderUnavailable, AccountUnavailable) as error:
+        if isinstance(error, AccountUnavailable):
+            logger.error("Account for identity provider %s unavailable: %s",
+                         runtime.config.name, error)
+        if ignore_empty_user:
+            return None
+        raise HTTPException(status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+                            detail=access.UNAVAILABLE)
+
+    if account.get("status") != "active":
+        # Vouched for there is not the same as allowed in here.
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="User account is blocked",
+        )
+    return runtime.signed_in(account, identity)
+
+
+def refuse_foreign_session(current_user: dict) -> None:
+    """Refuse to turn a token of another system into a session of this one.
+
+    Both renewal and the move into the panel cookie issue a session here. For a
+    caller who came with the provider's token that would be a session the
+    other system cannot revoke, outliving the token it was traded for.
+    """
+    source = (current_user or {}).get("authenticated_by")
+    if source:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f"This token was issued by {source}; renew it there.",
+        )
+
+
 async def get_optional_user(token: Optional[str]):
     """The user of this token, or None when there is none.
 
@@ -356,7 +500,9 @@ async def get_optional_user(token: Optional[str]):
 
 
 async def get_current_admin(current_user: dict = Depends(get_current_user)):
-    if current_user["role"] != ROLE_ADMIN:
+    # The right is ADMIN being among the roles, not one role being equal to it:
+    # somebody who is both an administrator and a client holds two (keepup-51).
+    if not user_roles.has_role(current_user, ROLE_ADMIN):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="Admin access required",
@@ -384,7 +530,7 @@ def configure_panel_gate(pending=None):
 
 def _authenticated_by_cookie(request: Request) -> bool:
     return panel_session.real_bearer(_bearer_of(request)) is None \
-        and bool(request.cookies.get(panel_session.SESSION_COOKIE))
+        and bool(panel_session.session_token_in(request.cookies))
 
 
 def _bearer_of(request: Request) -> Optional[str]: