nonce handling in python-openid 2

[Kevin Turner]

On Mon, 2007-04-30 at 15:25 +0200, Wichert Akkerman wrote:
> A nice quality of the python openid 1.x store was that no bookkeeping
> was needed. [...]
> Would it be possible to change the implementation so explicit cleanup is
> not necessary?

Unfortunately the bookkeeping is necessary for the type of nonce
required by the OpenID 2.0 spec.  And I haven't yet figured out a way
for that cleanup to be anything but explicit.  

There are only a few points where the library would have an opportunity
to run code, and they're all in the middle of an OpenID interaction.  It
seems undesirable to have it run with every interaction, and if it just
runs occasionally (i.e. once every two weeks, or ten thousand
interactions, or whatever), that operation would stall the interaction
until it completes.

So, I agree that it's a good idea to have a cleanup method as part of
the standard Store interface, but I think when and how it's invoked is
going to be up to application policy.

Thanks for all your feedback, I'll be following up on some other bits of
it soon.

 - Kevin