1import time
 2
 3from plain.runtime import settings
 4from plain.sessions.exceptions import SessionInterrupted
 5from plain.utils.cache import patch_vary_headers
 6from plain.utils.http import http_date
 7
 8from .core import SessionStore, UpdateError
 9
10
11class SessionMiddleware:
12    def __init__(self, get_response):
13        self.get_response = get_response
14
15    def __call__(self, request):
16        session_key = request.cookies.get(settings.SESSION_COOKIE_NAME)
17        request.session = SessionStore(session_key)
18
19        response = self.get_response(request)
20
21        """
22        If request.session was modified, or if the configuration is to save the
23        session every time, save the changes and set a session cookie or delete
24        the session cookie if the session has been emptied.
25        """
26        accessed = request.session.accessed
27        modified = request.session.modified
28        empty = request.session.is_empty()
29
30        # First check if we need to delete this cookie.
31        # The session should be deleted only if the session is entirely empty.
32        if settings.SESSION_COOKIE_NAME in request.cookies and empty:
33            response.delete_cookie(
34                settings.SESSION_COOKIE_NAME,
35                path=settings.SESSION_COOKIE_PATH,
36                domain=settings.SESSION_COOKIE_DOMAIN,
37                samesite=settings.SESSION_COOKIE_SAMESITE,
38            )
39            patch_vary_headers(response, ("Cookie",))
40        else:
41            if accessed:
42                patch_vary_headers(response, ("Cookie",))
43            if (modified or settings.SESSION_SAVE_EVERY_REQUEST) and not empty:
44                if settings.SESSION_EXPIRE_AT_BROWSER_CLOSE:
45                    max_age = None
46                    expires = None
47                else:
48                    max_age = settings.SESSION_COOKIE_AGE
49                    expires_time = time.time() + max_age
50                    expires = http_date(expires_time)
51                # Save the session data and refresh the client cookie.
52                # Skip session save for 5xx responses.
53                if response.status_code < 500:
54                    try:
55                        request.session.save()
56                    except UpdateError:
57                        raise SessionInterrupted(
58                            "The request's session was deleted before the "
59                            "request completed. The user may have logged "
60                            "out in a concurrent request, for example."
61                        )
62                    response.set_cookie(
63                        settings.SESSION_COOKIE_NAME,
64                        request.session.session_key,
65                        max_age=max_age,
66                        expires=expires,
67                        domain=settings.SESSION_COOKIE_DOMAIN,
68                        path=settings.SESSION_COOKIE_PATH,
69                        secure=settings.SESSION_COOKIE_SECURE or None,
70                        httponly=settings.SESSION_COOKIE_HTTPONLY or None,
71                        samesite=settings.SESSION_COOKIE_SAMESITE,
72                    )
73        return response