From 2456730f709ffa7e1f43ed99c2ad66d25f095a37 Mon Sep 17 00:00:00 2001
From: Leo Vasanko <git@vasanko.com>
Date: Tue, 11 Aug 2026 00:56:01 +0000
Subject: [PATCH] Check max-age only after checking permissions: if neither is
 passing, we want a 403 error; simply authenticating again won't fix it so
 don't bother reauth flow. After forbidden flow e.g. account change we are
 already good with max-age too.

---
 paskia/fastapi/authz.py | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/paskia/fastapi/authz.py b/paskia/fastapi/authz.py
index 0f0bfb6..97c55ca 100644
--- a/paskia/fastapi/authz.py
+++ b/paskia/fastapi/authz.py
@@ -88,20 +88,6 @@ async def verify(
     # User's theme preference for iframe (only if explicitly set)
     user_theme = ctx.user.theme if ctx.user.theme else None
 
-    # Check max_age requirement if specified
-    if max_age:
-        try:
-            if not sessionutil.check_session_age(ctx, max_age):
-                raise AuthException(
-                    status_code=401,
-                    detail="Additional authentication required",
-                    mode="reauth",
-                    theme=user_theme,
-                )
-        except ValueError as e:
-            # Invalid max_age format - log but don't fail the request
-            logger.warning(f"Invalid max_age format '{max_age}': {e}")
-
     groups = [(p,) if isinstance(p, str) else tuple(p) for p in perm]
     ok = match(ctx, perm) if match else permutil.has_all_groups(ctx, groups)
     if not ok:
@@ -125,4 +111,18 @@ async def verify(
             theme=user_theme,
         )
 
+    # Check max_age requirement if specified
+    if max_age:
+        try:
+            if not sessionutil.check_session_age(ctx, max_age):
+                raise AuthException(
+                    status_code=401,
+                    detail="Additional authentication required",
+                    mode="reauth",
+                    theme=user_theme,
+                )
+        except ValueError as e:
+            # Invalid max_age format - log but don't fail the request
+            logger.warning(f"Invalid max_age format '{max_age}': {e}")
+
     return ctx