47 lines
1.4 KiB
Python
47 lines
1.4 KiB
Python
"""Session duration policy for accounts and organizations."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.models import Account
|
|
from app.services.org_security import get_or_create_security_settings
|
|
|
|
DEFAULT_SESSION_TIMEOUT_MINUTES = 10_080 # 1 week
|
|
|
|
ALLOWED_SESSION_TIMEOUTS = (
|
|
60, # 1 hour
|
|
120, # 2 hours
|
|
240, # 4 hours
|
|
480, # 8 hours
|
|
720, # 12 hours
|
|
1_440, # 1 day
|
|
2_880, # 2 days
|
|
4_320, # 3 days
|
|
7_200, # 5 days
|
|
10_080, # 1 week
|
|
20_160, # 2 weeks
|
|
43_200, # 30 days
|
|
64_800, # 45 days
|
|
86_400, # 60 days
|
|
129_600, # 90 days
|
|
)
|
|
|
|
ALLOWED_SESSION_TIMEOUT_SET = set(ALLOWED_SESSION_TIMEOUTS)
|
|
|
|
|
|
def validate_session_timeout_minutes(minutes: int) -> None:
|
|
if minutes not in ALLOWED_SESSION_TIMEOUT_SET:
|
|
allowed = ", ".join(str(value) for value in ALLOWED_SESSION_TIMEOUTS)
|
|
raise ValueError(f"Session timeout must be one of: {allowed}")
|
|
|
|
|
|
async def resolve_session_timeout_minutes(
|
|
session: AsyncSession,
|
|
account: Account,
|
|
) -> int:
|
|
timeout = account.session_timeout_minutes or DEFAULT_SESSION_TIMEOUT_MINUTES
|
|
if account.company_domain:
|
|
org = await get_or_create_security_settings(session, account.company_domain)
|
|
timeout = min(timeout, org.session_timeout_minutes)
|
|
return timeout
|