Updated functionalities 2

app/routes/notifications.py

@@ -223,4 +223,46 @@ def check_sla():
     sent = send_sla_alerts()
 
     logger.info('SLA CHECK TRIGGERED | notifications_sent=%s', sent)
-    return jsonify({'ok': True, 'notifications_sent': sent})
+    return jsonify({'ok': True, 'notifications_sent': sent})
+
+
+# ── Expired token cleanup (called by cron) ────────────────────────────────────
+
+@bp.route('/cleanup-tokens', methods=['POST'])
+@csrf.exempt
+def cleanup_tokens():
+    """Purge expired and revoked refresh tokens from api_refresh_tokens.
+
+    Safe to run frequently — only deletes rows where expires_at has passed
+    OR revoked=True.  Keeps the table lean without touching live sessions.
+
+    Recommended cron schedule — nightly is sufficient:
+
+        0 3 * * * curl -s -X POST https://yourdomain.com/notifications/cleanup-tokens \\
+            -d "token=YOUR_DIGEST_SECRET"
+    """
+    token    = request.form.get('token') or request.args.get('token')
+    expected = current_app.config.get('DIGEST_SECRET')
+
+    if not expected or token != expected:
+        logger.warning('TOKEN CLEANUP REJECTED | bad or missing token')
+        abort(403)
+
+    from app.models.api_token import RefreshToken
+    from app.utils.time_utils import now_eastern
+
+    now = now_eastern()
+    deleted = (
+        RefreshToken.query
+        .filter(
+            db.or_(
+                RefreshToken.expires_at < now,
+                RefreshToken.revoked == True,       # noqa: E712
+            )
+        )
+        .delete(synchronize_session=False)
+    )
+    db.session.commit()
+
+    logger.info('TOKEN CLEANUP | deleted=%s expired/revoked rows', deleted)
+    return jsonify({'ok': True, 'deleted': deleted})