yhttp-auth 9.3.1__tar.gz → 9.3.2__tar.gz

{yhttp_auth-9.3.1/yhttp_auth.egg-info → yhttp_auth-9.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: yhttp-auth
-Version: 9.3.1
+Version: 9.3.2
 Summary: A very micro http framework.
 Home-page: http://github.com/yhttp/yhttp-auth
 Author: Vahid Mardani

{yhttp_auth-9.3.1 → yhttp_auth-9.3.2}/tests/test_accesstoken.py

@@ -13,6 +13,7 @@ def test_accesstoken(app, httpreq, redis):
     domain: example.com
     accesstoken:
       maxage: 30
+      leeway: 4
     refreshtoken:
       enabled: false
     ''')
@@ -65,7 +66,7 @@ def test_accesstoken(app, httpreq, redis):
         assert status == 201
         assert response.cookies['yhttp-accesstoken'] == \
             f'{accesstoken_expected}; ' \
-            'Domain=example.com; HttpOnly; Max-Age=30; Path=/; ' \
+            'Domain=example.com; HttpOnly; Max-Age=34; Path=/; ' \
             'SameSite=Strict'
         assert 'yhttp-refreshtoken' not in response.cookies
         accesstoken = response.cookies['yhttp-accesstoken'].split(';', 1)[0]

{yhttp_auth-9.3.1 → yhttp_auth-9.3.2}/tests/test_refreshtoken.py

@@ -15,9 +15,11 @@ def test_refreshtoken(app, httpreq, redis):
     domain: example.com
     accesstoken:
       maxage: 30
+      leeway: 4
     refreshtoken:
       enabled: true
       maxage: 3600
+      leeway: 20
       cookie:
         path: /tokens
     ''')
@@ -67,11 +69,11 @@ def test_refreshtoken(app, httpreq, redis):
         assert status == 201
         assert response.cookies['yhttp-accesstoken'] == \
             f'{accesstoken_expected}; ' \
-            'Domain=example.com; HttpOnly; Max-Age=30; Path=/; ' \
+            'Domain=example.com; HttpOnly; Max-Age=34; Path=/; ' \
             'SameSite=Strict'
         assert response.cookies['yhttp-refreshtoken'] == \
             f'{refreshtoken_expected}; ' \
-            'Domain=example.com; HttpOnly; Max-Age=3600; Path=/tokens; ' \
+            'Domain=example.com; HttpOnly; Max-Age=3620; Path=/tokens; ' \
             'SameSite=Strict'
         accesstoken = response.cookies['yhttp-accesstoken'].split(';', 1)[0]
         refreshtoken = response.cookies['yhttp-refreshtoken'].split(';', 1)[0]
@@ -95,7 +97,7 @@ def test_refreshtoken(app, httpreq, redis):
              cookies={
                  'yhttp-refreshtoken': refreshtoken,
              })
-        assert status == 401
+        assert status == 201
 
         when(title='Try to refresh token with access token but without the '
                    'refreshtoken',
@@ -136,7 +138,7 @@ def test_refreshtoken(app, httpreq, redis):
                  'yhttp-accesstoken': accesstoken,
                  'yhttp-refreshtoken': bob_refreshtoken,
              })
-        assert status == 401
+        assert status == 201
 
         when(title='Try to refresh the access-token',
              path='/tokens',
@@ -148,11 +150,11 @@ def test_refreshtoken(app, httpreq, redis):
         assert status == 201
         assert response.cookies['yhttp-accesstoken'] == \
             f'{accesstoken_expected}; ' \
-            'Domain=example.com; HttpOnly; Max-Age=30; Path=/; ' \
+            'Domain=example.com; HttpOnly; Max-Age=34; Path=/; ' \
             'SameSite=Strict'
         assert response.cookies['yhttp-refreshtoken'] == \
             f'{refreshtoken_expected}; ' \
-            'Domain=example.com; HttpOnly; Max-Age=3600; Path=/tokens; ' \
+            'Domain=example.com; HttpOnly; Max-Age=3620; Path=/tokens; ' \
             'SameSite=Strict'
         accesstoken = response.cookies['yhttp-accesstoken'].split(';', 1)[0]
 

{yhttp_auth-9.3.1 → yhttp_auth-9.3.2}/yhttp/ext/auth/__init__.py

@@ -4,4 +4,4 @@ from .exceptions import AuthException, TokenDecodeError, TokenExpiredError, \
     TokenMissmatchError, TokenMissingError, HeaderMissingError, BlacklistError
 
 
-__version__ = '9.3.1'
+__version__ = '9.3.2'

{yhttp_auth-9.3.1 → yhttp_auth-9.3.2}/yhttp/ext/auth/authenticator.py

@@ -139,7 +139,7 @@ class Authenticator:
         )
 
         if hasattr(settings, 'maxage'):
-            entry['max-age'] = settings.maxage
+            entry['max-age'] = settings.maxage + settings.leeway
         elif hasattr(settings.cookie, 'maxage'):
             entry['max-age'] = settings.cookie.maxage
 
@@ -183,21 +183,11 @@ class Authenticator:
         )
 
     def session_refresh(self, req):
-        # ensure the access token (even expired) but not invalid
-        accesstoken = self.token_fromcookie(
-            req,
-            AccessToken,
-            verifyexp=False
-        )
-
         refreshtoken = self.token_fromcookie(
             req,
             RefreshToken
         )
 
-        if refreshtoken.id != accesstoken.id:
-            raise TokenMissmatchError()
-
         accesstoken = AccessToken.create_from(refreshtoken)
         self.session_new(req, accesstoken)
 

{yhttp_auth-9.3.1 → yhttp_auth-9.3.2/yhttp_auth.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: yhttp-auth
-Version: 9.3.1
+Version: 9.3.2
 Summary: A very micro http framework.
 Home-page: http://github.com/yhttp/yhttp-auth
 Author: Vahid Mardani