Fix/session and device management

app/core/config.py

@@ -39,6 +39,8 @@ class Settings(BaseSettings):
     MOBILE_SESSION_LIMIT: int = 3
     MOBILE_SESSION_TTL_SECONDS: int = 180
     MOBILE_SESSION_DAYS: int = 7
+    SESSION_ACTIVITY_THROTTLE_SECONDS: int = 60
+
     # Mobile auth validation defaults
     MOBILE_AUTH_PASSWORD_MIN_LEN: int = 8
     MOBILE_AUTH_PASSWORD_MAX_LEN: int = 128

app/core/image_validation.py

@@ -29,6 +29,7 @@ def sanitise_filename(raw: str | None, extension: str) -> str:
     if not raw:
         return f"{prefix}.{extension}"
     name = re.sub(r'[\\/:*?"<>|\x00-\x1f]', "_", raw)
+    name = name.replace("..", "_")
     name = name.lstrip(".")[:128]
     return f"{prefix}_{name}"
 

app/deps/token_auth.py

@@ -27,7 +27,10 @@ async def get_current_mobile_user(
 ) -> MobileUserSchema:
     """
     Dependency to get the current logged-in mobile user.
-    Fast path: Redis cache (0 DB queries).
+    Fast path: Redis cache hit. Usually 0 DB queries; occasionally 1 cheap,
+    throttled UPDATE to last_active (see SESSION_ACTIVITY_THROTTLE_SECONDS) —
+    this is not a full round trip through the slow path, just a single
+    indexed write on the request's existing connection.
     Slow path: Postgres fallback (2 DB queries) with cache re-population.
     """
     token = credentials.credentials
@@ -49,6 +52,23 @@ async def get_current_mobile_user(
             raise HTTPException(status_code=401, detail="Session expired")
         if cached.blocked:
             raise HTTPException(status_code=403, detail="User is blocked")
+
+        now = datetime.now(timezone.utc)
+        if (now - cached.last_active).total_seconds() > settings.SESSION_ACTIVITY_THROTTLE_SECONDS:
+            await container.session_service.session_querier.update_session_activity(
+                id=cached.session_id
+            )
+            await SessionService.cache_session_for_auth(
+                redis=redis,
+                session_id=cached.session_id,
+                user_id=cached.user_id,
+                email=cached.email,
+                expires_at=cached.expires_at,
+                blocked=cached.blocked,
+                ttl=settings.MOBILE_SESSION_TTL_SECONDS,
+                last_active=now,
+            )
+
         return MobileUserSchema(
             user_id=cached.user_id,
             email=cached.email,
@@ -70,7 +90,9 @@ async def get_current_mobile_user(
     if user.blocked:
         raise HTTPException(status_code=403, detail="User is blocked")
 
-    # Re-populate cache so next request hits Redis
+    # Re-populate cache so next request hits Redis. The session row was just
+    # fetched fresh from Postgres, so its last_active is already accurate —
+    # no extra write needed here, only cache population.
     await SessionService.cache_session_for_auth(
         redis=redis,
         session_id=session.id,
@@ -79,6 +101,7 @@ async def get_current_mobile_user(
         expires_at=session.expires_at,
         blocked=user.blocked,
         ttl=settings.MOBILE_SESSION_TTL_SECONDS,
+        last_active=session.last_active,
     )
 
     return MobileUserSchema(

app/schema/request/mobile/auth.py

@@ -20,7 +20,7 @@ class MobileAuthBaseRequest(BaseModel):
         min_length=1,
         max_length=settings.MOBILE_AUTH_DEVICE_TYPE_MAX_LEN,
     )
-    device_id: UUID
+    physical_device_id: UUID
 
     @field_validator("email", mode="before")
     @classmethod

app/service/device.py

@@ -1,5 +1,4 @@
 from db.generated import devices as device_queries
-from app.core.securite import  create_totp_secret
 import uuid
 from app.core.exceptions import DBException,AppException, DBExceptionImpl
 from db.generated.models import UserDevice
@@ -11,30 +10,6 @@ class DeviceService:
     def init(self: "DeviceService", device_querier: device_queries.AsyncQuerier) -> None:
         self.device_querier = device_querier
 
-    async def create_device(
-        self: "DeviceService",
-        user_id: uuid.UUID,
-        device_name: str,
-        device_type: str,
-        id: uuid.UUID | None = None,
-    ) -> UserDevice | None:
-        try :
-            DeviceCount = await self.count_devices(user_id=user_id)
-            if  DeviceCount >=3:
-                raise AppException.bad_request("You can only have 3 devices")
-            return await self.device_querier.create_device(
-                arg=device_queries.CreateDeviceParams(
-                column_1=id,
-                user_id=user_id,
-                device_name=device_name,
-                device_type=device_type,
-                totp_secret=create_totp_secret(),
-                )
-
-            )
-        except Exception as e :
-            raise DBException.handle(e)
-
     async def activate_device(
         self: "DeviceService",
         device_id: uuid.UUID,

app/service/session.py

@@ -14,6 +14,7 @@ class MobileSessionCache(BaseModel):
     email: str
     expires_at: datetime
     blocked: bool
+    last_active: datetime
 
 
 class SessionService:
@@ -35,6 +36,7 @@ async def cache_session_for_auth(
         expires_at: datetime,
         blocked: bool,
         ttl: int,
+        last_active: datetime
     ) -> None:
         key = RedisKey.MobileSessionCache.value.format(session_id=session_id)
         payload = MobileSessionCache(
@@ -43,6 +45,7 @@ async def cache_session_for_auth(
             email=email,
             expires_at=expires_at,
             blocked=blocked,
+            last_active=last_active
         )
         await redis.set(key=key, value=payload.model_dump_json(), expire=ttl)
 

app/service/users.py

@@ -31,7 +31,7 @@
 from db.generated import user as user_queries
 from db.generated import devices as device_queries
 from db.generated import session as session_queries
-from db.generated.models import User, UserDevice
+from db.generated.models import User, UserDevice, UserSession
 from app.core.logger import logger
 from app.service.face_embedding import FaceImagePayload, FaceEmbeddingService
 from app.schema.internal.single_face_match import ClosestUserMatch
@@ -62,26 +62,28 @@ async def _ensure_device_for_login(
         user_id: uuid.UUID,
         req: MobileAuthBaseRequest,
     ) -> UserDevice:
-        existing_device = await self.device_querier.get_device_by_id_any(id=req.device_id)
+        existing_device = await self.device_querier.get_device_by_physical_id(
+            user_id=user_id,
+            physical_device_id=req.physical_device_id
+        )
 
         if existing_device:
-            if existing_device.user_id != user_id:
-                raise AppException.forbidden("Device already registered to another user")
             if existing_device.is_invalid_token:
                 raise AppException.forbidden(
                     "Device push token is invalid. Update the token before logging in."
                 )
             if not existing_device.is_active:
-                await self.device_querier.activate_device(id=req.device_id, user_id=user_id)
+                await self.device_querier.activate_device(id=existing_device.id, user_id=user_id)
             return existing_device
 
         device = await self.device_querier.create_device(
             arg=device_queries.CreateDeviceParams(
-                column_1=req.device_id,
+                column_1=None,
                 user_id=user_id,
                 device_name=req.device_name,
                 device_type=req.device_type,
                 totp_secret=None,
+                physical_device_id=req.physical_device_id
             )
         )
         if not device:
@@ -274,25 +276,34 @@ async def _create_mobile_session(
     ) -> MobileAuthResponse:
         user_id: uuid.UUID = user.id
 
-        session_count = await self.session_querier.count_user_sessions(user_id=user_id)
-        if session_count and session_count >= AuthService.SESSION_LIMIT:
-            logger.warning(
-                "session_limit_reached user_id=%s limit=%s",
-                user_id,
-                AuthService.SESSION_LIMIT,
-            )
-            raise AppException.forbidden("Maximum session limit reached")
+        device = await self._ensure_device_for_login(user_id, req)
+
+        existing_session = await self.session_querier.get_session_by_device_for_user(
+            device_id=device.id,
+            user_id=user_id,
+        )
+
+        if existing_session is None:
+            sessions: list[UserSession] = []
+            async for s in self.session_querier.list_sessions_by_user(user_id=user_id):
+                sessions.append(s)
+
+            if len(sessions) >= AuthService.SESSION_LIMIT:
+                oldest = min(sessions, key=lambda s: (s.last_active, s.created_at))
+                await SessionService.delete_session_cache(redis, oldest.id)
+                await self.session_querier.delete_session_by_id(id=oldest.id, user_id=user_id)
+                logger.warning(
+                    "session_evicted user_id=%s evicted_session_id=%s",
+                    user_id, oldest.id,
+                )
 
-        device_id = req.device_id
         expires_at = datetime.now(timezone.utc) + timedelta(
             days=settings.MOBILE_SESSION_DAYS
         )
 
-        await self._ensure_device_for_login(user_id, req)
-
         session = await self.session_querier.upsert_session(
             user_id=user_id,
-            device_id=device_id,
+            device_id=device.id,
             expires_at=expires_at,
         )
 
@@ -312,6 +323,7 @@ async def _create_mobile_session(
             expires_at=session.expires_at,
             blocked=user.blocked,
             ttl=AuthService.REDIS_SESSION_TTL,
+            last_active=session.last_active
         )
 
         return MobileAuthResponse(

db/generated/devices.py

@@ -33,11 +33,12 @@
     user_id,
     device_name,
     device_type,
-    totp_secret
+    totp_secret,
+    physical_device_id
 ) VALUES (
-    COALESCE(:p1, uuid_generate_v4()), :p2, :p3, :p4, :p5
+    COALESCE(:p1, uuid_generate_v4()), :p2, :p3, :p4, :p5, :p6
 )
-RETURNING id, user_id, device_name, device_type, totp_secret, is_2fa_enabled, last_active, created_at, push_token, is_active, is_invalid_token
+RETURNING id, user_id, device_name, device_type, totp_secret, is_2fa_enabled, last_active, created_at, push_token, is_active, is_invalid_token, physical_device_id
 """
 
 
@@ -48,6 +49,7 @@ class CreateDeviceParams:
     device_name: Optional[str]
     device_type: Optional[str]
     totp_secret: Optional[str]
+    physical_device_id: uuid.UUID
 
 
 DEACTIVATE_DEVICE = """-- name: deactivate_device \\:exec
@@ -67,21 +69,33 @@ class CreateDeviceParams:
 """
 
 
+GET_ANY_DEVICE_BY_PHYSICAL_ID = """-- name: get_any_device_by_physical_id \\:many
+SELECT id, user_id, device_name, device_type, totp_secret, is_2fa_enabled, last_active, created_at, push_token, is_active, is_invalid_token, physical_device_id FROM user_devices
+WHERE physical_device_id = :p1
+"""
+
+
 GET_DEVICE_BY_ID = """-- name: get_device_by_id \\:one
-SELECT id, user_id, device_name, device_type, totp_secret, is_2fa_enabled, last_active, created_at, push_token, is_active, is_invalid_token from user_devices
+SELECT id, user_id, device_name, device_type, totp_secret, is_2fa_enabled, last_active, created_at, push_token, is_active, is_invalid_token, physical_device_id from user_devices
 WHERE id = :p1
 AND user_id = :p2
 """
 
 
 GET_DEVICE_BY_ID_ANY = """-- name: get_device_by_id_any \\:one
-SELECT id, user_id, device_name, device_type, totp_secret, is_2fa_enabled, last_active, created_at, push_token, is_active, is_invalid_token from user_devices
+SELECT id, user_id, device_name, device_type, totp_secret, is_2fa_enabled, last_active, created_at, push_token, is_active, is_invalid_token, physical_device_id from user_devices
 WHERE id = :p1
 """
 
 
+GET_DEVICE_BY_PHYSICAL_ID = """-- name: get_device_by_physical_id \\:one
+SELECT id, user_id, device_name, device_type, totp_secret, is_2fa_enabled, last_active, created_at, push_token, is_active, is_invalid_token, physical_device_id FROM user_devices
+WHERE user_id = :p1 AND physical_device_id = :p2
+"""
+
+
 LIST_USER_DEVICES = """-- name: list_user_devices \\:many
-SELECT id, user_id, device_name, device_type, totp_secret, is_2fa_enabled, last_active, created_at, push_token, is_active, is_invalid_token
+SELECT id, user_id, device_name, device_type, totp_secret, is_2fa_enabled, last_active, created_at, push_token, is_active, is_invalid_token, physical_device_id
 FROM user_devices
 WHERE user_id = :p1
 ORDER BY last_active DESC
@@ -119,7 +133,7 @@ class CreateDeviceParams:
     is_invalid_token = FALSE
 WHERE id = :p1
 AND user_id = :p3
-RETURNING id, user_id, device_name, device_type, totp_secret, is_2fa_enabled, last_active, created_at, push_token, is_active, is_invalid_token
+RETURNING id, user_id, device_name, device_type, totp_secret, is_2fa_enabled, last_active, created_at, push_token, is_active, is_invalid_token, physical_device_id
 """
 
 
@@ -143,6 +157,7 @@ async def create_device(self, arg: CreateDeviceParams) -> Optional[models.UserDe
             "p3": arg.device_name,
             "p4": arg.device_type,
             "p5": arg.totp_secret,
+            "p6": arg.physical_device_id,
         })).first()
         if row is None:
             return None
@@ -158,6 +173,7 @@ async def create_device(self, arg: CreateDeviceParams) -> Optional[models.UserDe
             push_token=row[8],
             is_active=row[9],
             is_invalid_token=row[10],
+            physical_device_id=row[11],
         )
 
     async def deactivate_device(self, *, id: uuid.UUID, user_id: uuid.UUID) -> None:
@@ -166,6 +182,24 @@ async def deactivate_device(self, *, id: uuid.UUID, user_id: uuid.UUID) -> None:
     async def enable_device2_fa(self, *, id: uuid.UUID, user_id: uuid.UUID) -> None:
         await self._conn.execute(sqlalchemy.text(ENABLE_DEVICE2_FA), {"p1": id, "p2": user_id})
 
+    async def get_any_device_by_physical_id(self, *, physical_device_id: uuid.UUID) -> AsyncIterator[models.UserDevice]:
+        result = await self._conn.stream(sqlalchemy.text(GET_ANY_DEVICE_BY_PHYSICAL_ID), {"p1": physical_device_id})
+        async for row in result:
+            yield models.UserDevice(
+                id=row[0],
+                user_id=row[1],
+                device_name=row[2],
+                device_type=row[3],
+                totp_secret=row[4],
+                is_2fa_enabled=row[5],
+                last_active=row[6],
+                created_at=row[7],
+                push_token=row[8],
+                is_active=row[9],
+                is_invalid_token=row[10],
+                physical_device_id=row[11],
+            )
+
     async def get_device_by_id(self, *, id: uuid.UUID, user_id: uuid.UUID) -> Optional[models.UserDevice]:
         row = (await self._conn.execute(sqlalchemy.text(GET_DEVICE_BY_ID), {"p1": id, "p2": user_id})).first()
         if row is None:
@@ -182,6 +216,7 @@ async def get_device_by_id(self, *, id: uuid.UUID, user_id: uuid.UUID) -> Option
             push_token=row[8],
             is_active=row[9],
             is_invalid_token=row[10],
+            physical_device_id=row[11],
         )
 
     async def get_device_by_id_any(self, *, id: uuid.UUID) -> Optional[models.UserDevice]:
@@ -200,6 +235,26 @@ async def get_device_by_id_any(self, *, id: uuid.UUID) -> Optional[models.UserDe
             push_token=row[8],
             is_active=row[9],
             is_invalid_token=row[10],
+            physical_device_id=row[11],
+        )
+
+    async def get_device_by_physical_id(self, *, user_id: uuid.UUID, physical_device_id: uuid.UUID) -> Optional[models.UserDevice]:
+        row = (await self._conn.execute(sqlalchemy.text(GET_DEVICE_BY_PHYSICAL_ID), {"p1": user_id, "p2": physical_device_id})).first()
+        if row is None:
+            return None
+        return models.UserDevice(
+            id=row[0],
+            user_id=row[1],
+            device_name=row[2],
+            device_type=row[3],
+            totp_secret=row[4],
+            is_2fa_enabled=row[5],
+            last_active=row[6],
+            created_at=row[7],
+            push_token=row[8],
+            is_active=row[9],
+            is_invalid_token=row[10],
+            physical_device_id=row[11],
         )
 
     async def list_user_devices(self, *, user_id: uuid.UUID) -> AsyncIterator[models.UserDevice]:
@@ -217,6 +272,7 @@ async def list_user_devices(self, *, user_id: uuid.UUID) -> AsyncIterator[models
                 push_token=row[8],
                 is_active=row[9],
                 is_invalid_token=row[10],
+                physical_device_id=row[11],
             )
 
     async def mark_device_token_invalid(self, *, push_token: Optional[str]) -> None:
@@ -244,4 +300,5 @@ async def update_device_push_token(self, *, id: uuid.UUID, push_token: Optional[
             push_token=row[8],
             is_active=row[9],
             is_invalid_token=row[10],
+            physical_device_id=row[11],
         )