snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

server/channels/jobs/cleanup_expired_access_tokens/scheduler.go

@@ -0,0 +1,20 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package cleanup_expired_access_tokens
+
+import (
+	"time"
+
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/v8/channels/jobs"
+)
+
+const schedFreq = 1 * time.Hour
+
+func MakeScheduler(jobServer *jobs.JobServer) *jobs.PeriodicScheduler {
+	isEnabled := func(cfg *model.Config) bool {
+		return *cfg.ServiceSettings.EnableUserAccessTokens
+	}
+	return jobs.NewPeriodicScheduler(jobServer, model.JobTypeCleanupExpiredAccessTokens, schedFreq, isEnabled)
+}

server/channels/jobs/cleanup_expired_access_tokens/worker.go

@@ -0,0 +1,134 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package cleanup_expired_access_tokens
+
+import (
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/public/shared/mlog"
+	"github.com/mattermost/mattermost/server/public/shared/request"
+	"github.com/mattermost/mattermost/server/v8/channels/jobs"
+)
+
+const (
+	workerName = "CleanupExpiredAccessTokens"
+	// batchLimit bounds both the number of rows fetched by GetExpiredBefore
+	// and the corresponding DeleteByIds call, keeping the transaction
+	// footprint bounded even when a large number of tokens expire at once.
+	batchLimit = 1000
+	// maxBatches caps the number of iterations per job execution so that very
+	// large expiry backlogs are drained across multiple scheduled runs rather
+	// than a single unbounded loop.
+	maxBatches = 1000
+)
+
+// expiredTokenStore is the subset of UserAccessTokenStore used by the worker.
+// Defined here rather than depending on the full store interface so the
+// orchestration logic can be unit-tested with a small fake.
+type expiredTokenStore interface {
+	GetExpiredBefore(cutoff int64, limit int) ([]*model.UserAccessToken, error)
+	DeleteByIds(tokenIDs []string) (int64, error)
+}
+
+// MakeWorker creates a worker that periodically deletes personal access tokens
+// whose ExpiresAt has passed, along with any sessions created from them.
+// The work is done in batches to keep the transaction footprint bounded.
+//
+// clearSessionCache is called for each affected user after their tokens are
+// deleted so that in-memory session caches don't serve stale sessions.
+//
+// notifyExpired is called with each batch of expired tokens immediately before
+// they are deleted, so the owner can be DMed that their token has been removed.
+// It is best-effort: any failure is handled internally and must not block the
+// cleanup. Note that after this change PAT expiry notifications come from two
+// jobs — the pre-expiry warning cascade (pat_expiry_notify) and this
+// at-deletion notice — so a future reader shouldn't be surprised to find an
+// expiry DM originating from the cleanup job.
+func MakeWorker(jobServer *jobs.JobServer, clearSessionCache func(userID string), notifyExpired func(rctx request.CTX, tokens []*model.UserAccessToken)) *jobs.SimpleWorker {
+	isEnabled := func(cfg *model.Config) bool {
+		return *cfg.ServiceSettings.EnableUserAccessTokens
+	}
+
+	execute := func(logger mlog.LoggerIFace, job *model.Job) error {
+		defer jobServer.HandleJobPanic(logger, job)
+		return cleanupExpired(
+			request.EmptyContext(logger),
+			jobServer.Store.UserAccessToken(),
+			clearSessionCache,
+			notifyExpired,
+			model.GetMillis(),
+			batchLimit,
+			maxBatches,
+		)
+	}
+
+	return jobs.NewSimpleWorker(workerName, jobServer, execute, isEnabled)
+}
+
+// cleanupExpired drains expired personal access tokens in batches up to
+// maxBatches iterations. It is extracted from MakeWorker so that the batching
+// and error-propagation logic can be exercised by unit tests with a fake store.
+//
+// clearSessionCache is called for each unique user whose tokens were deleted so
+// that in-memory session caches don't continue serving the removed sessions.
+//
+// notifyExpired is called with each batch immediately before deletion so token
+// owners can be notified. It runs best-effort: it is invoked before the delete
+// so the token→owner mapping is still available, and the delete proceeds
+// regardless of what it does. The worst case (a crash between notify and
+// delete) is a single duplicate DM on the next run, which is acceptable. The
+// request context is passed through so the notifier logs under the job's logger.
+func cleanupExpired(
+	rctx request.CTX,
+	store expiredTokenStore,
+	clearSessionCache func(userID string),
+	notifyExpired func(rctx request.CTX, tokens []*model.UserAccessToken),
+	cutoff int64,
+	limit int,
+	maxIter int,
+) error {
+	var totalDeleted int64
+
+	for range maxIter {
+		expired, err := store.GetExpiredBefore(cutoff, limit)
+		if err != nil {
+			return err
+		}
+		if len(expired) == 0 {
+			break
+		}
+
+		ids := make([]string, len(expired))
+		userIDs := make(map[string]struct{}, len(expired))
+		for i, token := range expired {
+			ids[i] = token.Id
+			userIDs[token.UserId] = struct{}{}
+		}
+
+		if notifyExpired != nil {
+			notifyExpired(rctx, expired)
+		}
+
+		deleted, err := store.DeleteByIds(ids)
+		if err != nil {
+			return err
+		}
+		totalDeleted += deleted
+
+		for userID := range userIDs {
+			clearSessionCache(userID)
+		}
+
+		if len(expired) < limit {
+			break
+		}
+	}
+
+	rctx.Logger().Info(
+		"Cleaned up expired personal access tokens",
+		mlog.Int("deleted", int(totalDeleted)),
+		mlog.Int("cutoff", int(cutoff)),
+	)
+
+	return nil
+}

server/channels/jobs/cleanup_expired_access_tokens/worker_test.go

@@ -0,0 +1,202 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package cleanup_expired_access_tokens
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/public/shared/mlog"
+	"github.com/mattermost/mattermost/server/public/shared/request"
+)
+
+// fakeStore implements expiredTokenStore. Each call to GetExpiredBefore pops
+// the next pre-programmed batch off batches, then returns the configured error
+// (which can be nil). DeleteByIds returns deleteCount/deleteErr and records
+// the ids it was called with.
+type fakeStore struct {
+	batches    [][]*model.UserAccessToken
+	getCalls   int
+	getErrAt   int // 1-based call index that returns getErr; 0 == no error
+	getErr     error
+	deleteCnt  int64
+	deleteErr  error
+	deletedIDs [][]string
+}
+
+func (f *fakeStore) GetExpiredBefore(_ int64, _ int) ([]*model.UserAccessToken, error) {
+	f.getCalls++
+	if f.getErrAt != 0 && f.getCalls == f.getErrAt {
+		return nil, f.getErr
+	}
+	if len(f.batches) == 0 {
+		return nil, nil
+	}
+	next := f.batches[0]
+	f.batches = f.batches[1:]
+	return next, nil
+}
+
+func (f *fakeStore) DeleteByIds(ids []string) (int64, error) {
+	f.deletedIDs = append(f.deletedIDs, ids)
+	if f.deleteErr != nil {
+		return 0, f.deleteErr
+	}
+	if f.deleteCnt != 0 {
+		return f.deleteCnt, nil
+	}
+	return int64(len(ids)), nil
+}
+
+func makeTokens(n int, base int64) []*model.UserAccessToken {
+	out := make([]*model.UserAccessToken, n)
+	for i := range n {
+		out[i] = &model.UserAccessToken{
+			Id:        model.NewId(),
+			UserId:    model.NewId(),
+			ExpiresAt: base + int64(i),
+			IsActive:  true,
+		}
+	}
+	return out
+}
+
+func nopClearSession(_ string) {}
+
+func nopNotify(_ request.CTX, _ []*model.UserAccessToken) {}
+
+func TestCleanupExpired(t *testing.T) {
+	rctx := request.EmptyContext(mlog.CreateConsoleTestLogger(t))
+
+	t.Run("happy path single batch", func(t *testing.T) {
+		tokens := makeTokens(3, 1000)
+		store := &fakeStore{batches: [][]*model.UserAccessToken{tokens}}
+
+		err := cleanupExpired(rctx, store, nopClearSession, nopNotify, 9999, 1000, 10)
+		require.NoError(t, err)
+
+		// Exactly one DeleteByIds call with the three token ids. A partial first
+		// batch (len < limit) must short-circuit the loop, so GetExpiredBefore is
+		// called exactly once.
+		require.Len(t, store.deletedIDs, 1)
+		require.Len(t, store.deletedIDs[0], 3)
+		require.Equal(t, 1, store.getCalls)
+	})
+
+	t.Run("empty result is no-op", func(t *testing.T) {
+		store := &fakeStore{} // no batches, no errors
+
+		err := cleanupExpired(rctx, store, nopClearSession, nopNotify, 9999, 1000, 10)
+		require.NoError(t, err)
+
+		require.Equal(t, 1, store.getCalls)
+		require.Empty(t, store.deletedIDs)
+	})
+
+	t.Run("full batch triggers next iteration", func(t *testing.T) {
+		const limit = 5
+		first := makeTokens(limit, 1000) // full batch -> loop continues
+		second := makeTokens(2, 2000)    // partial batch -> loop stops
+		store := &fakeStore{batches: [][]*model.UserAccessToken{first, second}}
+
+		err := cleanupExpired(rctx, store, nopClearSession, nopNotify, 9999, limit, 10)
+		require.NoError(t, err)
+
+		require.Equal(t, 2, store.getCalls)
+		require.Len(t, store.deletedIDs, 2)
+		require.Len(t, store.deletedIDs[0], limit)
+		require.Len(t, store.deletedIDs[1], 2)
+	})
+
+	t.Run("max iter cap", func(t *testing.T) {
+		const limit = 3
+		const maxIter = 2
+		store := &fakeStore{batches: [][]*model.UserAccessToken{
+			makeTokens(limit, 1000),
+			makeTokens(limit, 2000),
+			makeTokens(limit, 3000), // never reached
+		}}
+
+		err := cleanupExpired(rctx, store, nopClearSession, nopNotify, 9999, limit, maxIter)
+		require.NoError(t, err)
+
+		require.Equal(t, maxIter, store.getCalls, "loop must cap at maxIter")
+		require.Len(t, store.deletedIDs, maxIter)
+	})
+
+	t.Run("get error propagates", func(t *testing.T) {
+		wantErr := errors.New("get failed")
+		store := &fakeStore{
+			batches:  [][]*model.UserAccessToken{makeTokens(2, 1000)},
+			getErrAt: 1,
+			getErr:   wantErr,
+		}
+
+		err := cleanupExpired(rctx, store, nopClearSession, nopNotify, 9999, 1000, 10)
+		require.ErrorIs(t, err, wantErr)
+		require.Empty(t, store.deletedIDs, "delete must not run when get fails")
+	})
+
+	t.Run("delete error propagates", func(t *testing.T) {
+		wantErr := errors.New("delete failed")
+		store := &fakeStore{
+			batches:   [][]*model.UserAccessToken{makeTokens(2, 1000)},
+			deleteErr: wantErr,
+		}
+
+		err := cleanupExpired(rctx, store, nopClearSession, nopNotify, 9999, 1000, 10)
+		require.ErrorIs(t, err, wantErr)
+		require.Len(t, store.deletedIDs, 1, "DeleteByIds was called once before failing")
+	})
+
+	t.Run("session cache cleared for each unique user after delete", func(t *testing.T) {
+		sharedUserID := model.NewId()
+		tokens := []*model.UserAccessToken{
+			{Id: model.NewId(), UserId: sharedUserID, ExpiresAt: 1000, IsActive: true},
+			{Id: model.NewId(), UserId: sharedUserID, ExpiresAt: 1001, IsActive: true},
+			{Id: model.NewId(), UserId: model.NewId(), ExpiresAt: 1002, IsActive: true},
+		}
+		store := &fakeStore{batches: [][]*model.UserAccessToken{tokens}}
+
+		cleared := map[string]int{}
+		err := cleanupExpired(rctx, store, func(userID string) { cleared[userID]++ }, nopNotify, 9999, 1000, 10)
+		require.NoError(t, err)
+
+		require.Len(t, cleared, 2, "cache must be cleared for each unique user")
+		require.Equal(t, 1, cleared[sharedUserID], "each user cleared exactly once per batch")
+	})
+
+	t.Run("notify is called with each batch before delete", func(t *testing.T) {
+		const limit = 3
+		first := makeTokens(limit, 1000) // full batch -> loop continues
+		second := makeTokens(1, 2000)    // partial batch -> loop stops
+		store := &fakeStore{batches: [][]*model.UserAccessToken{first, second}}
+
+		var notified [][]*model.UserAccessToken
+		notify := func(_ request.CTX, tokens []*model.UserAccessToken) {
+			// Each batch must be notified before it is deleted: at the Nth
+			// notify call exactly N-1 prior batches should have been deleted.
+			require.Len(t, store.deletedIDs, len(notified), "notify must run before this batch's DeleteByIds")
+			notified = append(notified, tokens)
+		}
+
+		err := cleanupExpired(rctx, store, nopClearSession, notify, 9999, limit, 10)
+		require.NoError(t, err)
+
+		require.Len(t, notified, 2, "notify called once per batch")
+		require.Equal(t, first, notified[0])
+		require.Equal(t, second, notified[1])
+	})
+
+	t.Run("nil notify is tolerated", func(t *testing.T) {
+		store := &fakeStore{batches: [][]*model.UserAccessToken{makeTokens(2, 1000)}}
+
+		err := cleanupExpired(rctx, store, nopClearSession, nil, 9999, 1000, 10)
+		require.NoError(t, err)
+		require.Len(t, store.deletedIDs, 1)
+	})
+}