Police-Data-Accessibility-Project / data-sources-app

An API and UI for using and maintaining the Data Sources database
MIT License
2 stars 4 forks source link

Remove unnecessary where condition in `RefreshSession` post method #308

Open maxachis opened 1 month ago

maxachis commented 1 month ago

Here is the script for RefreshSession:


class RefreshSession(PsycopgResource):
    """
    Provides a resource for refreshing a user's session token.
    If the provided session token is valid and not expired, it is replaced with a new one.
    """

    @handle_exceptions
    def post(self) -> Dict[str, Any]:
        """
        Processes the session token refresh request. If the provided session token is valid,
        it generates a new session token, invalidates the old one, and returns the new token.

        Returns:
        - A dictionary containing a message of success or failure, and the new session token if successful.
        """
        # ...
        cursor.execute(
            f"delete from session_tokens where token = '{old_token}' and expiration_date < '{dt.utcnow()}'"
        )
        # ...

Unless I'm missing something, and expiration_date < '{dt.utcnow()} is unnecessary and adds a bug: Each session token should be unique, so that should be sufficient. And since we're refreshing a session token, the expiration date shouldn't matter. As is, this means that if /refresh_session is called before the session token expires, the previous session token will still exist in the database, even as a new session token is created.

This part of the where clause should thus be removed. To be safe, tests should make sure that no unexpected downstream effects occur from getting rid of this.