Reset authorization should not compute autorizaiton expiration from created_at

Author: matllubos

auth_token/contrib/rest_framework_auth/views.py

@@ -58,9 +58,8 @@ def post(self, request, *args, **kwargs):
                                            context={'request': request})
         serializer.is_valid(raise_exception=True)
         user = serializer.validated_data['user']
-
         login(
-            request._request, user, not serializer.validated_data.get('permanent', False),
+            request._request, user, preserve_cookie=not serializer.validated_data.get('permanent', False),
             allowed_cookie=self.allowed_cookie, allowed_header=self.allowed_header
         )
         return Response({'token': request._request.token.secret_key})

auth_token/utils.py

@@ -568,16 +568,14 @@ def reset_authorization_request(authorization_request, expiration=None):
     Reset authorization request and increase its expiration.
     Args:
         authorization_request: authorization request where new OTP will be created.
-        expiration: expiration time in seconds. Empty value means that original expiration time will be used.
+        expiration: expiration time in seconds.
 
     Returns:
         AuthorizationRequest instance with new authorization data
     """
     assert authorization_request.result is None
     backend = get_authorization_backend(authorization_request.backend, raise_exception=True)
-
-    if expiration is None:
-        expiration = (authorization_request.expires_at - authorization_request.created_at).total_seconds()
+    expiration = expiration or settings.DEFAULT_AUTHORIZATION_REQUEST_AGE
 
     authorization_request.change_and_save(expires_at=compute_expires_at(expiration))
     backend.initialize(authorization_request)

docs/authorization_request.rst

@@ -33,7 +33,7 @@ To reset authorization request for example with purpose to create new OTP you ca
 .. function:: reset_authorization_request(authorization_request, expiration=None)
 
   * ``authorization_request`` - authorization request only with type OTP.
-  * ``expiration`` - expiration time in seconds. Empty value means that original expiration time will be used.
+  * ``expiration`` - expiration time in seconds.
 
 
 Check authorization request