aeat.adapters.persistence.storage.master_key._idle_timeout module

Idle-timeout evaluation for BucketSession.

Every CLI invocation runs evaluate_idle(session, now, configured_minutes) before granting access to the session. The configured value lives in the bucket manifest (ManifestKdfParams is plaintext; idle_lock_minutes is read from the durable config profile. The default is 15 minutes.

The evaluator is a pure function over the session’s idle deadline and the supplied now; it never mutates the session. Mutation happens through session.touch(now) which the caller invokes on a successful authentication so the deadline rolls forward by the configured window.

Returning a typed IdleEvaluation record (rather than a bare boolean) lets the CLI render an actionable “remaining N seconds” hint without re-deriving the math at the verb layer.

class IdleEvaluation(**data)[source]

Bases: BaseModel

Typed outcome of an idle-window evaluation.

Parameters:

  • expired (bool)

  • remaining_seconds (int)

expired: bool
remaining_seconds: int
evaluate_idle(*, session, now, configured_minutes=15)[source]

Evaluate the session’s idle window without mutating it.

Parameters:

  • session (BucketSession) – The session whose idle deadline to evaluate.

  • now (datetime) – UTC timestamp at which the evaluation runs.

  • configured_minutes (int) – Operator-configured idle-lock window in minutes (read from the bucket manifest). Defaults to DEFAULT_IDLE_LOCK_MINUTES (15). Strict positive integer; non-positive values raise.

Return type:

IdleEvaluation

Returns:

An IdleEvaluation record carrying expired and the floor-truncated remaining_seconds until the deadline (zero when expired).

Raises:

StorageValidationError – When configured_minutes is not a strict positive integer.