05/02/2026 updated code for security

app/__init__.py

@@ -15,6 +15,14 @@ login_manager = LoginManager()
 csrf = CSRFProtect()
 limiter = Limiter(key_func=get_remote_address)
 
+# APScheduler is used for the background token-blacklist cleanup job.
+# Imported here so it is available at module level; started inside create_app().
+try:
+    from apscheduler.schedulers.background import BackgroundScheduler
+    _scheduler_available = True
+except ImportError:  # pragma: no cover — optional dependency
+    _scheduler_available = False
+
 
 def create_app(config_name: str = 'development') -> Flask:
     app = Flask(__name__)
@@ -115,4 +123,33 @@ def create_app(config_name: str = 'development') -> Flask:
     def recover_page():
         return render_template('auth/recover.html')
 
+    # ── Background scheduler — token blacklist cleanup ─────────────────────────
+    # Runs cleanup_expired() every hour so the token_blacklist table never
+    # accumulates unbounded rows. Runs in a daemon thread — no request context.
+    if _scheduler_available:
+        def _cleanup_expired_tokens():
+            with app.app_context():
+                try:
+                    from app.models.token_blacklist import TokenBlacklist
+                    TokenBlacklist.cleanup_expired()
+                    import logging
+                    logging.getLogger(__name__).debug(
+                        '[PassKeeper] token_blacklist cleanup completed'
+                    )
+                except Exception as exc:  # pragma: no cover
+                    import logging
+                    logging.getLogger(__name__).warning(
+                        '[PassKeeper] token_blacklist cleanup failed: %s', exc
+                    )
+
+        scheduler = BackgroundScheduler(daemon=True)
+        scheduler.add_job(
+            _cleanup_expired_tokens,
+            trigger='interval',
+            hours=1,
+            id='token_blacklist_cleanup',
+            replace_existing=True,
+        )
+        scheduler.start()
+
     return app