3 files changed, 18 insertions, 3 deletions

diff --git a/include/opkele/consumer.h b/include/opkele/consumer.h
index 50ff692..c463787 100644
--- a/include/opkele/consumer.h
+++ b/include/opkele/consumer.h
@@ -68,4 +68,9 @@ namespace opkele {
              * association.
              *
+             * @note
+             * It may be a good idea to pre-expire associations shortly before
+             * their time is really up to avoid association expiry in the
+             * middle of negotiations.
+             *
              * @param server the OpenID server
              * @return the auto_ptr<> for the newly allocated association_t object
@@ -138,4 +143,5 @@ namespace opkele {
              * (supposedly checkid_immediate only)
              * @throw id_res_failed in case of failure
+             * @throw id_res_expired_on_delivery if the association expired before it could've been verified
              * @throw exception in case of other failures
              */
diff --git a/include/opkele/exception.h b/include/opkele/exception.h
index 753a818..2ff44b7 100644
--- a/include/opkele/exception.h
+++ b/include/opkele/exception.h
@@ -171,4 +171,13 @@ namespace opkele {
 
     /**
+     * thrown if the association has expired before it could've been verified.
+     */
+    class id_res_expired_on_delivery : public id_res_failed {
+        public:
+            id_res_expired_on_delivery(OPKELE_E_PARS)
+                : id_res_failed(OPKELE_E_CONS) { }
+    };
+
+    /**
      * openssl malfunction occured
      */
diff --git a/lib/consumer.cc b/lib/consumer.cc
index 66db7dd..9f7530f 100644
--- a/lib/consumer.cc
+++ b/lib/consumer.cc
@@ -185,6 +185,6 @@ namespace opkele {
         try {
             assoc_t assoc = retrieve_assoc(server,pin.get_param("openid.assoc_handle"));
-            if(assoc->is_expired()) /* TODO: or should I throw some other exception to force programmer fix his implementation? */
-                throw failed_lookup(OPKELE_CP_ "retrieve_assoc() has returned expired handle");
+            if(assoc->is_expired())
+                throw id_res_expired_on_delivery(OPKELE_CP_ "retrieve_assoc() has returned expired handle");
             const string& sigenc = pin.get_param("openid.sig");
             vector<unsigned char> sig;
@@ -215,5 +215,5 @@ namespace opkele {
             if(sig.size()!=md_len || memcmp(&(sig.front()),md,md_len))
                 throw id_res_mismatch(OPKELE_CP_ "signature mismatch");
-        }catch(failed_lookup& e) { /* XXX: more specific? */
+        }catch(failed_lookup& e) {
             const string& slist = pin.get_param("openid.signed");
             string::size_type pp = 0;