Updated functionalities 2

app/api/auth.py

@@ -31,7 +31,7 @@ GET /api/v1/auth/me
 import logging
 
 from flask import Blueprint, request, g
-from app import db
+from app import db, limiter
 from app.models.user import User
 from app.models.api_token import RefreshToken, DeviceToken
 from app.api.errors import api_ok, api_error
@@ -59,6 +59,7 @@ def _user_payload(user: User) -> dict:
 # ── Login ─────────────────────────────────────────────────────────────────────
 
 @bp.route('/auth/login', methods=['POST'])
+@limiter.limit('10 per minute; 3 per second')
 def login():
     """
     Authenticate with username + password.
@@ -116,6 +117,23 @@ def login():
     )
     db.session.commit()
 
+    # Passive cleanup — delete expired/revoked tokens for this user only
+    # so the table never accumulates dead rows without a cron dependency.
+    try:
+        from app.utils.time_utils import now_eastern
+        now = now_eastern()
+        RefreshToken.query.filter(
+            RefreshToken.user_id == user.id,
+            db.or_(
+                RefreshToken.expires_at < now,
+                RefreshToken.revoked == True,   # noqa: E712
+            ),
+        ).delete(synchronize_session=False)
+        db.session.commit()
+    except Exception as _cleanup_exc:
+        logger.warning('API LOGIN passive token cleanup failed: %s', _cleanup_exc)
+        db.session.rollback()
+
     log_action(ACTION_LOGIN, 'User', user.id, user.username,
                f'source=mobile_api; device_id={device_id}')
 
@@ -134,6 +152,7 @@ def login():
 # ── Refresh ───────────────────────────────────────────────────────────────────
 
 @bp.route('/auth/refresh', methods=['POST'])
+@limiter.limit('30 per minute; 5 per second')
 def refresh():
     """
     Exchange a valid refresh token for a new access token.