Oban cron worker for cleaning up expired tokens.
Runs daily. Deletes tokens older than the maximum TTL for each context:
"confirm"/"confirm_code": 48 hours"reset_password": 1 hour"magic_link": 15 minutes"session": 60 days
Also callable directly via cleanup_expired_tokens/2 for opportunistic
cleanup during token verification (belt and suspenders).
Threat Mitigation
Uses conservative max TTL values to ensure only truly expired tokens are deleted (T-3-INFRA-02). Never deletes tokens within their TTL.
Summary
Functions
Deletes expired sessions from the database.
Deletes expired tokens from the database.
Deletes expired mfa_pending sessions from the database.
Deletes superseded JWT refresh tokens past retention period.
Deletes revoked and expired API tokens past the retention period.
Functions
@spec cleanup_expired_sessions(Sigra.Config.t()) :: :ok
Deletes expired sessions from the database.
Cleans up:
- Standard sessions older than
absolute_timeout - Remember-me sessions older than
remember_me_max_age
Parameters
config-%Sigra.Config{}struct with session configuration
Deletes expired tokens from the database.
Called by the Oban worker on schedule and optionally called opportunistically during token verification.
Parameters
repo- The Ecto Repo moduletoken_schema- The token Ecto schema module
@spec cleanup_mfa_pending_sessions(Sigra.Config.t()) :: :ok
Deletes expired mfa_pending sessions from the database.
Cleans up sessions with type = "mfa_pending" that are older than
the configured pending_timeout (default: 300 seconds / 5 minutes).
Emits [:sigra, :mfa, :pending_expired] telemetry event for each
batch of expired sessions found.
Parameters
config-%Sigra.Config{}struct with MFA and session configuration
Deletes superseded JWT refresh tokens past retention period.
Cleans up tokens with context "api_refresh" older than 90 days.
Parameters
repo- The Ecto Repo moduletoken_schema- The token Ecto schema module
@spec cleanup_revoked_api_tokens(Sigra.Config.t()) :: :ok
Deletes revoked and expired API tokens past the retention period.
Retention period defaults to 90 days (configurable via api_token[:cleanup_retention]).
Parameters
config- A%Sigra.Config{}struct with API token configuration