from django.utils import timezone


def grant_scoped_session_access(request, grant_key, grant_id, expires_at, *, preserve_expiry=False):
    """Rotate anonymous session keys; resource grants still validate their own expiry."""
    session = request.session
    session.cycle_key()
    session[grant_key] = grant_id
    seconds = max(1, int((expires_at - timezone.now()).total_seconds()))
    if preserve_expiry:
        seconds = max(session.get_expiry_age(), seconds)
    session.set_expiry(seconds)