Function is_auth_valid

app/session.py:48–118

Checks whether a session’s auth state is valid. This method effectively performs a combined authentication and authorization check (short: “auth”), while taking into account whether the system requires any auth check at all. Optionally and additionally, it checks whether the session

(satisfies_role=None)

def is_auth_valid(satisfies_role=None):
    """Checks whether a session’s auth state is valid.

    This method effectively performs a combined authentication and
    authorization check (short: “auth”), while taking into account whether the
    system requires any auth check at all. Optionally and additionally, it
    checks whether the session satisfies a certain role requirement in order to
    proceed with the request.

    On a high-level, our auth policy is this:
    -> Is authentication generally required to use the system?
      - If no: ALLOW!
      - If yes -> is the session logged-in?
        - If no: DENY!
        - If yes -> is there a role requirement and does the user’s assigned
          role satisfy it?
          - If no: DENY!
          - If yes: ALLOW!

    Note: this method aims to encapsulate the aforementioned rules as strongly
    as sensibly possible, and tries to boil down the question “is the user
    allowed to proceed” to a binary yes/no outcome. That way, we free the
    call-side from conditional logic and combinatorial complexity, at the
    expense of slightly unconventional internal semantics (e.g., treating all
    sessions as having ADMIN privileges if - yet only if! - the auth
    requirement is turned off).

    Args:
        satisfies_role: (auth.Role) Optional.

    Returns:
        Bool
    """
    # If the auth requirement is turned off, then no users exist in the system.
    # In this case, the question of authentication is obsolete: every visitor
    # practically has full access to the system, just so as if they had a
    # dedicated user account with `auth.Role.ADMIN` explicitly granted to them.
    if not auth.is_authentication_required():
        return True

    # If the session does not contain any user information, it means the user
    # didn’t authenticate albeit they are required to. We deny access.
    username = get_username()
    credentials_last_changed = _get_credentials_last_changed()
    if not username or not credentials_last_changed:
        return False

    # If the user does not exist in the database, deny access. (This may occur
    # when the user account had been deleted in the meantime, i.e., after they
    # had logged in initially.)
    try:
        user = auth.get_account(username)
    except db.users.UserDoesNotExistError:
        return False

    # If the user’s credentials have changed in the meantime (i.e., since their
    # initial log-in), deny access.
    if user.credentials_last_changed != credentials_last_changed: