Caveman 提交信息

Write a commit message for this staged diff: ```diff --- a/src/auth/session.py +++ b/src/auth/session.py @@ -8,9 +8,15 @@ SESSION_TTL = timedelta(hours=12) def is_session_valid(session) -> bool: - return session.created_at + SESSION_TTL > datetime.now() + # created_at is stored in UTC; naive local now() made sessions expire + # early or late depending on the server's timezone. + return session.created_at + SESSION_TTL > datetime.now(timezone.utc) --- a/tests/test_session.py +++ b/tests/test_session.py @@ -20,3 +20,12 @@ def test_session_expires_after_ttl(): assert not is_session_valid(old) + + +def test_session_valid_on_non_utc_server(monkeypatch): + monkeypatch.setenv("TZ", "Asia/Shanghai") + time.tzset() + fresh = make_session(created_at=datetime.now(timezone.utc)) + assert is_session_valid(fresh) ``` Users on our Singapore and Shanghai servers were being logged out about 8 hours early. This fixes issue #214.

fix(auth): compare session expiry against UTC now

created_at is stored in UTC, but expiry was checked against naive
local datetime.now(). On UTC+8 servers (Singapore, Shanghai) users
were logged out ~8 hours early.

Closes #214