fix: expire authentication tokens

simple_login/tests/__init__.py

@@ -0,0 +1 @@
+

simple_login/tests/settings.py

@@ -0,0 +1,18 @@
+SECRET_KEY = 'test-secret-key'
+
+INSTALLED_APPS = [
+    'django.contrib.auth',
+    'django.contrib.contenttypes',
+    'rest_framework.authtoken',
+    'simple_login',
+]
+
+DATABASES = {
+    'default': {
+        'ENGINE': 'django.db.backends.sqlite3',
+        'NAME': ':memory:',
+    }
+}
+
+USE_TZ = True
+ROOT_URLCONF = 'simple_login.tests.urls'

simple_login/tests/test_authentication.py

@@ -0,0 +1,31 @@
+from datetime import timedelta
+from unittest import mock
+
+from django.test import SimpleTestCase, override_settings
+from django.utils import timezone
+
+from simple_login.utils.authentication import TokenAuthentication
+
+
+class TokenAuthenticationTests(SimpleTestCase):
+    @override_settings(SIMPLE_LOGIN_TOKEN_EXPIRY=60)
+    def test_integer_token_expiry_is_treated_as_seconds(self):
+        self.assertEqual(TokenAuthentication.get_token_expiry(), timedelta(seconds=60))
+
+    @override_settings(SIMPLE_LOGIN_TOKEN_EXPIRY=None)
+    def test_none_disables_token_expiry(self):
+        token = mock.Mock(created=timezone.now() - timedelta(days=365))
+
+        self.assertFalse(TokenAuthentication.has_token_expired(token))
+
+    @override_settings(SIMPLE_LOGIN_TOKEN_EXPIRY=timedelta(days=30))
+    def test_old_token_is_expired(self):
+        token = mock.Mock(created=timezone.now() - timedelta(days=31))
+
+        self.assertTrue(TokenAuthentication.has_token_expired(token))
+
+    @override_settings(SIMPLE_LOGIN_TOKEN_EXPIRY=timedelta(days=30))
+    def test_recent_token_is_valid(self):
+        token = mock.Mock(created=timezone.now() - timedelta(days=1))
+
+        self.assertFalse(TokenAuthentication.has_token_expired(token))

simple_login/tests/urls.py

@@ -0,0 +1 @@
+urlpatterns = []

simple_login/utils/authentication.py

@@ -15,9 +15,36 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 
+from datetime import timedelta
+
+from django.conf import settings
+from django.utils import timezone
+from rest_framework import exceptions
 from rest_framework.authentication import TokenAuthentication as TokenAuth
+
 from simple_login.models.api import Tokens
 
 
 class TokenAuthentication(TokenAuth):
     model = Tokens
+
+    def authenticate_credentials(self, key):
+        user, token = super().authenticate_credentials(key)
+        if self.has_token_expired(token):
+            token.delete()
+            raise exceptions.AuthenticationFailed('Token has expired.')
+        return user, token
+
+    @staticmethod
+    def get_token_expiry():
+        expiry = getattr(settings, 'SIMPLE_LOGIN_TOKEN_EXPIRY', timedelta(days=30))
+        if isinstance(expiry, int):
+            return timedelta(seconds=expiry)
+        return expiry
+
+    @classmethod
+    def has_token_expired(cls, token):
+        expiry = cls.get_token_expiry()
+        if expiry is None:
+            return False
+        return token.created + expiry < timezone.now()