WebTest 2.0.2 breaks tests. :(

Currently, only 1 test is failing.

Using ./bin/nosetests
+ CELERY_CONFIG_MODULE=mediagoblin.init.celery.from_tests
+ exec ./bin/nosetests ./mediagoblin/tests
...........E.............................................................................
======================================================================
ERROR: mediagoblin.tests.test_csrf_middleware.test_csrf_cookie_set
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/dave/Code/mediagoblin/lib/python2.7/site-packages/nose-1.2.1-py2.7.egg/nose/case.py", line 197, in runTest
    self.test(*self.arg)
  File "/home/dave/Code/mediagoblin/mediagoblin/tests/test_csrf_middleware.py", line 30, in test_csrf_cookie_set
    assert cookie_name in response.cookies_set
AttributeError: 'TestResponse' object has no attribute 'cookies_set'
-------------------- >> begin captured logging << --------------------
mediagoblin.tools.routing: DEBUG: endpoint: mediagoblin.auth.login view_func: <function login at 0x49ad6e0>
--------------------- >> end captured logging << ---------------------
 
----------------------------------------------------------------------
Ran 89 tests in 131.405s
 
FAILED (errors=1)

I deleted a photo. I then took a new photo and saved it as the same name as the old photo, locally.

When uploading the new photo, the old photo appears in MediaGoblin.

Its as if the old photo is still in the database and gets re-associated when uploading a new picture with the same name.

We want to switch from beaker sessions to itsdangerous based sessions. Why? We should come up with a better list of reaasons than "The core developers like this idea".

What's needed?

1. Remove beaker sessions from paste*.ini
2. Create a class that will be our new request.session
3. Create code to create such an instance from a received cookie.
4. Create code to send a (modified) session as a cookie to the client.

Some more Details

Create a class that will be our new request.session

Some pseudo code:

class MGSession(dict):

    def save(self):
        self.send_new_cookie = True

    def delete(self):
        self.clear()
        self.save()

Create Session Instance from cookie

Here's some pseudo code to do that. It includes code for future "revocation support". Because we do not store anything locally any more, one can only forcibly block sessions by blacklisting. In the first step, its okay to document the needed approach in the code.

class SessionManager(object):
    def load_session_from_cookie(request, cookie_name):
        cookie = request.get_cookie(cookie_name)
        if not cookie:
            request.session = MGSession()
            return
        m = BadCookie.query.filter_by(cookie = cookie)
        if m:
            _log.warn("Bad cookie received: %s", m.reason)
            raise BadRequest()
        parsed_dict = self.signer.loads(cookie, max_age=...)
        requestion.session = MGSession(parsed_dict)

Send cookie

• Only send a cookie, if an update is needed
• If the session is empty delete the cookie on the client (MGSession.delete() was called probably)
• Bonus points: Consider sending a new cookie, if the old one is going to expire soon