05/06 Fix some notable and quality issues

2026-05-06 11:47:20 -04:00
parent 830bb51f24
commit 02b3e1c45d
11 changed files with 125 additions and 46 deletions
@@ -76,6 +76,11 @@ class RefreshToken(db.Model):
        """
        Look up a refresh token by its raw value.
        Returns the RefreshToken row if valid and unexpired, else None.
+
+        Expired rows are not deleted here — passive cleanup runs in the
+        login route (api/auth.py) each time a user authenticates, removing
+        all expired/revoked tokens for that user.  This keeps the table tidy
+        without requiring a dedicated cron job.
        """
        import hashlib
        hashed = hashlib.sha256(raw_token.encode()).hexdigest()