Django不活跃用户自动登出：会话管理与服务器端任务的权衡

# myapp/middleware.py
from django.contrib.auth import logout
from django.utils import timezone
from datetime import timedelta

class AutoLogoutMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response
        # 定义不活跃超时时间，例如30分钟
        self.INACTIVITY_TIMEOUT = timedelta(minutes=30)

    def __call__(self, request):
        # 仅对已认证的用户进行处理
        if request.user.is_authenticated:
            # 从会话中获取或初始化最后活跃时间
            last_activity_str = request.session.get('last_activity')
            last_activity = None
            if last_activity_str:
                try:
                    last_activity = timezone.datetime.fromisoformat(last_activity_str)
                except ValueError:
                    # 如果存储的格式不正确，则重置
                    last_activity = None

            # 如果没有记录或记录有问题，则视为当前请求为首次活跃
            if not last_activity:
                request.session['last_activity'] = timezone.now().isoformat()
                # 设置会话过期时间为不活跃超时时间
                request.session.set_expiry(self.INACTIVITY_TIMEOUT.total_seconds())
            else:
                # 检查是否超时
                if (timezone.now() - last_activity) > self.INACTIVITY_TIMEOUT:
                    # 用户不活跃，执行登出操作
                    logout(request)
                    # 清除会话中的last_activity，防止下次请求误判
                    if 'last_activity' in request.session:
                        del request.session['last_activity']
                    # 可选：在这里更新用户模型中的isCurrentlyActive字段
                    # 例如：request.user.userprofile.isCurrentlyActive = False
                    #       request.user.userprofile.save()
                    print(f"User {request.user.username} logged out due to inactivity.")
                else:
                    # 用户活跃，更新最后活跃时间并延长会话过期时间
                    request.session['last_activity'] = timezone.now().isoformat()
                    request.session.set_expiry(self.INACTIVITY_TIMEOUT.total_seconds())

        response = self.get_response(request)
        return response

# 在settings.py中添加此中间件
# MIDDLEWARE = [
#     ...
#     'myapp.middleware.AutoLogoutMiddleware',
#     ...
# ]

# myapp/tasks.py
from celery import shared_task
from django.utils import timezone
from datetime import timedelta
from django.contrib.sessions.models import Session
from django.contrib.auth.models import User # 假设UserProfile关联User

# 假设用户模型扩展或有UserProfile模型，包含last_active_timestamp和isCurrentlyActive
# from myapp.models import UserProfile 

@shared_task
def check_inactive_users():
    """
    定期检查并处理不活跃用户。
    """
    INACTIVITY_THRESHOLD = timedelta(minutes=30) # 不活跃阈值
    now = timezone.now()

    # 找出所有在阈值时间前活跃，且当前标记为活跃的用户
    # 这里假设User模型有last_active_timestamp和isCurrentlyActive字段
    # 如果是UserProfile，则查询UserProfile
    inactive_users = User.objects.filter(
        last_active_timestamp__lt=now - INACTIVITY_THRESHOLD,
        isCurrentlyActive=True # 仅处理当前被标记为活跃的用户
    )

    for user in inactive_users:
        # 更新用户状态为不活跃
        user.isCurrentlyActive = False
        user.save()
        print(f"User {user.username} marked as inactive.")

        # 可选：强制登出用户，删除其所有会话
        # 注意：这会登出用户在所有设备上的会话
        # user.get_all_sessions() 是一个方便的方法来获取用户的所有会话
        for session in user.get_all_sessions():
            session.delete()
        print(f"User {user.username}'s sessions have been deleted (forced logout).")

# 配置Celery Beat来调度此任务，例如每隔1分钟运行一次
# 在 settings.py 中配置 Celery Beat
# CELERY_BEAT_SCHEDULE = {
#     'check-inactive-users-every-minute': {
#         'task': 'myapp.tasks.check_inactive_users',
#         'schedule': timedelta(minutes=1),
#     },
# }