Function monitor_auth

app/socket_api.py:31–66

Decorator that monitors the session’s auth state of the socket. When socket events come in, it checks whether the session still satisfies the auth requirement by making calls to `session.is_auth_valid()`. If the session’s auth state has become invalid, it disconnects the client. It

(handler)

def monitor_auth(handler):
    """Decorator that monitors the session’s auth state of the socket.

    When socket events come in, it checks whether the session still satisfies
    the auth requirement by making calls to `session.is_auth_valid()`. If the
    session’s auth state has become invalid, it disconnects the client.

    It doesn’t carry out the check for every incoming socket event, but it
    caches the result for a short amount of time, before triggering a fresh
    check. The reason is that a call to `session.is_auth_valid()` might take
    several milliseconds, and we don’t want to add that latency on every single
    incoming socket event. So the periodic caching behaviour is a tradeoff
    between security and performance.

    Example of usage:
        @monitor_auth
        def on_socket_event():
            ...
    """
    cache_ttl_seconds = 10

    @functools.wraps(handler)
    def handler_with_auth_check(*args, **kwargs):
        next_check_due = _auth_expiry_timestamps.get(flask.request.sid, None)

        if (not next_check_due) or (utc.now() > next_check_due):
            if not session.is_auth_valid(satisfies_role=auth.Role.OPERATOR):
                flask_socketio.disconnect()
                return None

            _auth_expiry_timestamps[flask.request.sid] = utc.now(
            ) + datetime.timedelta(seconds=cache_ttl_seconds)

        return handler(*args, **kwargs)

    return handler_with_auth_check


@socketio.on('keystroke')