Ability to set ds_actor cookie such that it expires

[simonw]

I need this for datasette-auth-github: simonw/datasette-auth-github#62 (comment)

[simonw]

itsdangerous has this ability but you specify the max-age when you call unsign: https://itsdangerous.palletsprojects.com/en/1.1.x/timed/

s.unsign(string, max_age=5)
Traceback (most recent call last):
  ...
itsdangerous.exc.SignatureExpired: Signature age 15 > 5 seconds

I currently only decode the ds_actor cookie in one place:

datasette/datasette/actor_auth_cookie.py

Lines 5 to 12 in d828aba

	@hookimpl
	def actor_from_request(datasette, request):
	if "ds_actor" not in request.cookies:
	return None
	try:
	return datasette.unsign(request.cookies["ds_actor"], "actor")
	except BadSignature:
	return None

If plugins want to be able to set their own policies on how long the ds_actor cookie should remain valid, how do I know to listen to them when decoding the cookie here?

[simonw]

Some options:

• Redesign the ds_actor cookie to be {"expires_at": 1591811250, "actor": ...} - check if it has expired in that default actor_from_request hook
• Let plugins set an additional cookie of some sort
• Expect plugins that care about this to set a cookie with a different name and implement their own actor_from_request against that

[simonw]

I'm going with expires_at - except to keep the cookies shorter the key will be called e and the actor will go in a, like this:

{
    "e": "1UuHoo",
    "a": {"id": "root"}
}

That e value is a base64 encoded expiry integer timestamp (again for a shorter cookie) - using https://pypi.org/project/python-baseconv/

[simonw]

And the e key can be nullor missing for "never expires".

[simonw]

Even shorter: encode an integer that is the difference between that expiry timestamp and a more recent epoch - June 1st 2020 will do.

>>> import datetime, calendar
>>> calendar.timegm(datetime.date(2020, 6, 1).timetuple())
1590969600
>>> import baseconv
>>> baseconv.base62.encode(int(time.time() - 1590969600))
'3XST'

[simonw]

I didn't bother with the alternative epoch - it only shaves off two or three bytes from the cookie.

Documentation for the new ds_actor cookie shape is here: https://datasette.readthedocs.io/en/latest/authentication.html#the-ds-actor-cookie