Merge lp://qastaging/~marcustomlinson/unity-scopes-api/strict_idle_timeout into lp://qastaging/unity-scopes-api/devel

Looks good to me. Did we have problems with a scopes setting unreasonable values?

Not sure where the -1 problem is. The previous code complained if the value was < 0, meaning that you can have a scope that times out immediately. (Not that useful, I admit.)

I can't recall why we allowed maxint :-(

> Looks good to me. Did we have problems with a scopes setting unreasonable
> values?

I don't know of a particular case where a scope is doing this, but that's part of the concern I suppose. Feels like a bit of a security risk allowing scopes to essentially act like daemons this way.

>
> Not sure where the -1 problem is. The previous code complained if the value
> was < 0, meaning that you can have a scope that times out immediately. (Not
> that useful, I admit.)

If you look at the diff we allowed ((>=0 && <= max) || -1)

>
> I can't recall why we allowed maxint :-(

Me neither.

> I don't know of a particular case where a scope is doing this, but that's part
> of the concern I suppose. Feels like a bit of a security risk allowing scopes
> to essentially act like daemons this way.

Back then, we knew little about how scopes would be used and what they might be doing. I suspect that's why it ended up being so liberal.

> If you look at the diff we allowed ((>=0 && <= max) || -1)

Ah, yes. I didn't read it closely enough. Anyway, I think it's fine a limit it to five minutes. If that breaks some scope, we'll find out soon enough.