Fix #40 Auth token verification now uses session from request handler

- This is very difficult to reproduce, so changing the request handler
  (which is currently the only caller of User.verify_auth_token()) to
  send its own session when calling is a best guess at solving this.

nsot/handlers/util.py

@@ -164,7 +164,9 @@ def get_current_user(self):
         if auth_token is None:
             raise exc.Unauthorized('Missing Required argument: auth_token')
 
-        user = models.User.verify_auth_token(email, auth_token)
+        user = models.User.verify_auth_token(
+            email, auth_token, session=self.session
+        )
 
         # If user is bad this time, it's an invalid login
         if user is None:

nsot/models.py

@@ -297,13 +297,17 @@ def verify_secret_key(self, secret_key):
 
     @classmethod
     def verify_auth_token(cls, email, auth_token,
-                          expiration=None):
+                          expiration=None, session=None):
         """Verify token and return a User object."""
         if expiration is None:
             expiration = settings.auth_token_expiry
 
         # First we lookup the user by email
-        user = User.query().filter_by(email=email).scalar()
+        if session is None:
+            query = User.query()
+        else:
+            query = session.query(User)
+        user = query.filter_by(email=email).scalar()
 
         if user is None:
             log.debug('Invalid user when verifying token')

nsot/version.py

@@ -1 +1 @@
-__version__ = "0.5.1"
+__version__ = "0.5.2"