Move the session user loader to module level

server/mergin/app.py

@@ -155,7 +155,7 @@ def create_app(public_keys: List[str] = None) -> Flask:
     from itsdangerous import BadTimeSignature, BadSignature
 
     from .audit import register as register_audit
-    from .auth import auth_required, decode_token, register as register_auth
+    from .auth import auth_required, decode_token, load_user, register as register_auth
     from .auth.models import User
     from .sync.app import register as register_sync
     from .sync.project_handler import ProjectHandler
@@ -190,14 +190,7 @@ def create_app(public_keys: List[str] = None) -> Flask:
     server_commands(app.app)
 
     # adjust login manager
-    @login_manager.user_loader
-    def load_user(session_id):  # pylint: disable=W0613,W0612
-        user_id, *rest = session_id.split(":")
-        # legacy session cookies carry only the user id
-        auth_version = int(rest[0]) if rest else 0
-        user = User.query.get(user_id)
-        if user and user.active and user.auth_version == auth_version:
-            return user
+    login_manager.user_loader(load_user)
 
     @login_manager.header_loader
     def load_user_from_header(header_val):  # pylint: disable=W0613,W0612

server/mergin/auth/__init__.py

@@ -3,4 +3,4 @@
 # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-MerginMaps-Commercial
 
 from .bearer import decode_token
-from .app import auth_required, register
+from .app import auth_required, load_user, register

server/mergin/auth/app.py

@@ -99,6 +99,16 @@ def wrapped_func(*args, **kwargs):
     return wrapped_func
 
 
+def load_user(session_id):
+    """Flask-Login user loader for session cookies"""
+    user_id, *rest = session_id.split(":")
+    # legacy session cookies carry only the user id
+    auth_version = int(rest[0]) if rest else 0
+    user = User.query.get(user_id)
+    if user and user.active and user.auth_version == auth_version:
+        return user
+
+
 def authenticate(login, password):
     from ..app import db