From 65bab7c9f984d6fe45ce72e7db014c40eba4d240 Mon Sep 17 00:00:00 2001
From: Michael Krelin <hacker@klever.net>
Date: Thu, 09 Aug 2007 11:23:36 +0000
Subject: associations robustness improvements and documentation updates

---
diff --git a/include/opkele/association.h b/include/opkele/association.h
index a8f3915..72eff5b 100644
--- a/include/opkele/association.h
+++ b/include/opkele/association.h
@@ -61,6 +61,8 @@ namespace opkele {
 	    virtual secret_t secret() const { return _secret; }
 	    virtual int expires_in() const { return _expires-time(0); }
 	    virtual bool stateless() const { return _stateless; }
+
+	    virtual bool is_expired() const { return _expires<time(0); }
     };
 
 }
diff --git a/include/opkele/consumer.h b/include/opkele/consumer.h
index 042e2d1..b9d1e54 100644
--- a/include/opkele/consumer.h
+++ b/include/opkele/consumer.h
@@ -13,6 +13,11 @@ namespace opkele {
 
     /**
      * implementation of basic consumer functionality
+     *
+     * @note
+     * The consumer uses libcurl internally, which means that if you're using
+     * libopkele in multithreaded environment you should call curl_global_init
+     * yourself before spawning any threads.
      */
     class consumer_t {
 	public:
@@ -31,10 +36,16 @@ namespace opkele {
 	     * retrieve stored association. The function should be overridden
 	     * in the real implementation to provide persistent assocations
 	     * store.
+	     *
+	     * @note
+	     * The user is responsible for handling associations expiry and
+	     * this function should never return an expired or invalidated
+	     * association.
+	     *
 	     * @param server the OpenID server
 	     * @param handle association handle
 	     * @return the autho_ptr<> for the newly allocated association_t object
-	     * @throw failed_lookup in case of error
+	     * @throw failed_lookup if no unexpired association found
 	     */
 	    virtual assoc_t retrieve_assoc(const string& server,const string& handle) = 0;
 	    /**
@@ -48,6 +59,12 @@ namespace opkele {
 	     * retrieve any unexpired association for the server. If the
 	     * function is not overridden in the real implementation, the new
 	     * association will be established for each request.
+	     *
+	     * @note
+	     * The user is responsible for handling associations and this
+	     * function should never return an expired or invalidated
+	     * association.
+	     *
 	     * @param server the OpenID server
 	     * @return the auto_ptr<> for the newly allocated association_t object
 	     * @throw failed_lookup in case of absence of the handle
diff --git a/lib/consumer.cc b/lib/consumer.cc
index dd8e150..af309c1 100644
--- a/lib/consumer.cc
+++ b/lib/consumer.cc
@@ -144,6 +144,8 @@ namespace opkele {
 	p["return_to"] = return_to;
 	try {
 	    string ah = find_assoc(server)->handle();
+	    if(ah->is_expired()) /* TODO: or should I throw some other exception to force programmer fix his implementation? */
+		throw failed_lookup(OPKELE_CP_ "find_assoc() has returned expired handle");
 	    p["assoc_handle"] = ah;
 	}catch(failed_lookup& fl) {
 	    string ah = associate(server)->handle();
@@ -161,6 +163,8 @@ namespace opkele {
 	params_t ps;
 	try {
 	    assoc_t assoc = retrieve_assoc(server,pin.get_param("openid.assoc_handle"));
+	    if(assoc->is_expired()) /* TODO: or should I throw some other exception to force programmer fix his implementation? */
+		throw failed_lookup(OPKELE_CP_ "retrieve_assoc() has returned expired handle");
 	    const string& sigenc = pin.get_param("openid.sig");
 	    vector<unsigned char> sig;
 	    util::decode_base64(sigenc,sig);
--
cgit v0.9.0.2