don't allow redeeming if token is no longer valid

src/c3nav/mapdata/models/access.py

@@ -62,6 +62,10 @@ class AccessPermissionToken(models.Model):
     def redeem(self, user=None):
         if self.redeemed_by_id or (user is None and self.redeemed):
             raise TypeError('Already redeemed.')
+
+        if timezone.now()+timedelta(minutes=300 if self.redeemed else 0) < self.valid_until:
+            raise TypeError('No longer valid.')
+
         self.redeemed = True
         if user:
             for pk, expire_date in self.restrictions: