Throttle set_session_expires.

gittip/models/participant.py

@@ -18,7 +18,6 @@
 from aspen.utils import typecheck
 from postgres.orm import Model
 from psycopg2 import IntegrityError
-import pytz
 
 import gittip
 from gittip import NotSane
@@ -141,17 +140,26 @@ def _update_session_token(self, new_token):
     def set_session_expires(self, expires):
         """Set session_expires in the database.
 
-        :param float expires: A UNIX timestamp, which XXX we assume is UTC?
+        :param datetime expires:
         :database: One UPDATE, one row
 
         """
-        session_expires = datetime.datetime.fromtimestamp(expires) \
-                                                      .replace(tzinfo=pytz.utc)
-        self.db.run( "UPDATE participants SET session_expires=%s "
-                     "WHERE id=%s AND is_suspicious IS NOT true"
-                   , (session_expires, self.id,)
-                    )
-        self.set_attributes(session_expires=session_expires)
+        if not self.session_expires + datetime.timedelta(hours=12) < expires:
+            return
+        with self.db.get_cursor() as c:
+            done = c.one("""
+                UPDATE participants SET session_expires=%(expires)s
+                WHERE id=%(id)s
+                AND is_suspicious IS NOT true
+                AND session_expires + INTERVAL '12 hours' < %(expires)s
+                RETURNING id
+            """, dict(expires=expires, id=self.id))
+            if done is None:
+                return
+            add_event(c, 'participant',
+                dict(action='set', id=self.id, values=dict(session_expires=unicode(expires))))
+        self.set_attributes(session_expires=expires)
+
 
 
     # Claimed-ness

gittip/security/authentication.py

@@ -1,16 +1,18 @@
 """Defines website authentication helpers.
 """
 import rfc822
-import time
+from datetime import datetime, timedelta
 
+import pytz
 import gittip
 from aspen import Response
 from gittip.security import csrf
 from gittip.security.user import User
 
 
 BEGINNING_OF_EPOCH = rfc822.formatdate(0)
-TIMEOUT = 60 * 60 * 24 * 7 # one week
+TIMEOUT = timedelta(weeks=1)
+EPOCH = datetime(1970, 1, 1, tzinfo=pytz.utc)
 ROLES = ['anonymous', 'authenticated', 'owner', 'admin']
 ROLES_SHOULD_BE = "It should be one of: {}.".format(', '.join(ROLES))
 
@@ -92,14 +94,15 @@ def outbound(request, response):
         else:
             # expired cookie in the request, instruct browser to delete it
             response.headers.cookie['session'] = ''
-            expires = 0
+            expires = EPOCH
     else: # user is authenticated
         response.headers['Expires'] = BEGINNING_OF_EPOCH # don't cache
         response.headers.cookie['session'] = user.participant.session_token
-        expires = time.time() + TIMEOUT
+        expires = datetime.now(tz=pytz.utc) + TIMEOUT
         user.keep_signed_in_until(expires)
 
     cookie = response.headers.cookie['session']
+    expires = (expires - EPOCH).total_seconds()
     # I am not setting domain, because it is supposed to default to what we
     # want: the domain of the object requested.
     #cookie['domain']

gittip/security/user.py

@@ -54,7 +54,7 @@ def sign_in(self):
     def keep_signed_in_until(self, expires):
         """Extend the user's current session.
 
-        :param float expires: A UNIX timestamp (XXX timezone?)
+        :param datetime expires:
 
         """
         self.participant.set_session_expires(expires)

tests/py/test_goal_json.py

@@ -83,6 +83,10 @@ def test_all_goals_are_stored_in_events_table(self):
         self.change_goal("custom", "300", alice)
         self.change_goal("null", "", alice)
         self.change_goal("custom", "400", alice)
-        actual = self.db.all("SELECT (payload->'values'->>'goal')::int AS goal "
-                             "FROM events ORDER BY ts DESC")
-        assert actual == [400, None, 300, 200, 100, None]
+        actual = self.db.all("""
+            SELECT (payload->'values'->>'goal')::int AS goal
+            FROM events
+            WHERE 'goal' IN (SELECT * FROM json_object_keys(payload->'values'))
+            ORDER BY ts DESC
+        """)
+        assert actual == [400, None, 300, 200, 100]