feat: add scheduled refresh token and password reset cleanup job

backend/.env.example

@@ -19,6 +19,10 @@ REDIS_HOST=localhost
 REDIS_PORT=6379
 USE_REDIS_CACHE=true
 
+# ─── Token Cleanup ──────────────────────────────────────────────────────────────
+# Cron expression for the scheduled cleanup job (default: 3 AM daily).
+REFRESH_TOKEN_CLEANUP_CRON="0 3 * * *"
+
 # ─── Rate Limiting ──────────────────────────────────────────────────────────────
 # TTL values are in milliseconds.
 THROTTLE_TTL_MS=60000

backend/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:14
+FROM node:20-slim
 
 # Create app directory
 WORKDIR /usr/src/app

backend/package.json

@@ -52,6 +52,7 @@
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.2",
     "cookie-parser": "^1.4.7",
+    "cron": "^4.3.3",
     "dotenv": "^16.4.5",
     "figlet": "^1.8.0",
     "helmet": "^8.0.0",

backend/src/config/env.validation.ts

@@ -1,4 +1,5 @@
 import * as Joi from 'joi';
+import { DEFAULT_CLEANUP_CRON } from '../modules/auth/token-cleanup.constants';
 
 export const envValidationSchema = Joi.object({
   // Application
@@ -55,4 +56,7 @@ export const envValidationSchema = Joi.object({
   UEX_RATE_LIMIT_PAUSE_MS: Joi.number().default(2000),
   UEX_ENDPOINTS_PAUSE_MS: Joi.number().default(2000),
   UEX_API_KEY: Joi.string().allow('').default(''),
+
+  // Token cleanup scheduler (optional — defaults to 3 AM daily)
+  REFRESH_TOKEN_CLEANUP_CRON: Joi.string().default(DEFAULT_CLEANUP_CRON),
 });

backend/src/data-source.ts

@@ -48,6 +48,7 @@ import { AddOrgInventorySummaryView1764950757207 } from './migrations/1764950757
 import { SeedInventoryManagerRole1764961461064 } from './migrations/1764961461064-SeedInventoryManagerRole';
 import { CreateOrgInventoryItemsTable1764964935270 } from './migrations/1764964935270-CreateOrgInventoryItemsTable';
 import { AddUserInventoryUniqueIndex1765035000000 } from './migrations/1765035000000-AddUserInventoryUniqueIndex';
+import { AddTokenCleanupIndexes1765038000000 } from './migrations/1765038000000-AddTokenCleanupIndexes';
 
 export const AppDataSource = new DataSource({
   type: 'postgres',
@@ -114,6 +115,9 @@ export const AppDataSource = new DataSource({
     SeedInventoryManagerRole1764961461064,
     CreateOrgInventoryItemsTable1764964935270,
     AddUserInventoryUniqueIndex1765035000000,
+
+    // Token cleanup indexes (supports efficient revoked/expired deletes)
+    AddTokenCleanupIndexes1765038000000,
   ],
   synchronize: false,
 });

backend/src/migrations/1765038000000-AddTokenCleanupIndexes.ts

@@ -0,0 +1,60 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+/**
+ * Adds indexes to support efficient token cleanup queries.
+ *
+ * The cleanup job deletes rows matching:
+ *   refresh_tokens: revoked = true OR "expiresAt" < now
+ *   password_resets: used = true OR "expiresAt" < now
+ *
+ * Partial indexes on the boolean flags keep index size small by only
+ * covering the rows that will actually be deleted.
+ */
+export class AddTokenCleanupIndexes1765038000000 implements MigrationInterface {
+  name = 'AddTokenCleanupIndexes1765038000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    // Partial index on revoked refresh tokens — optimizes the `revoked = true`
+    // predicate in the cleanup DELETE. Does not cover the expiresAt branch of
+    // the OR; that is handled by IDX_refresh_tokens_expiresAt below.
+    await queryRunner.query(`
+      CREATE INDEX IF NOT EXISTS "IDX_refresh_tokens_revoked"
+      ON "refresh_tokens" ("revoked")
+      WHERE "revoked" = TRUE
+    `);
+
+    // Range index for expiry-based cleanup of refresh tokens
+    await queryRunner.query(`
+      CREATE INDEX IF NOT EXISTS "IDX_refresh_tokens_expiresAt"
+      ON "refresh_tokens" ("expiresAt")
+    `);
+
+    // Partial index on used password resets — optimizes the `used = true`
+    // predicate in the cleanup DELETE. Does not cover the expiresAt branch of
+    // the OR; that is handled by IDX_password_resets_expiresAt below.
+    await queryRunner.query(`
+      CREATE INDEX IF NOT EXISTS "IDX_password_resets_used"
+      ON "password_resets" ("used")
+      WHERE "used" = TRUE
+    `);
+
+    // Range index for expiry-based cleanup of password resets
+    await queryRunner.query(`
+      CREATE INDEX IF NOT EXISTS "IDX_password_resets_expiresAt"
+      ON "password_resets" ("expiresAt")
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP INDEX IF EXISTS "IDX_password_resets_expiresAt"`,
+    );
+    await queryRunner.query(`DROP INDEX IF EXISTS "IDX_password_resets_used"`);
+    await queryRunner.query(
+      `DROP INDEX IF EXISTS "IDX_refresh_tokens_expiresAt"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX IF EXISTS "IDX_refresh_tokens_revoked"`,
+    );
+  }
+}

backend/src/modules/auth/auth.module.ts

@@ -4,6 +4,7 @@ import { JwtModule } from '@nestjs/jwt';
 import { TypeOrmModule } from '@nestjs/typeorm';
 import { AuthController } from './auth.controller';
 import { AuthService } from './auth.service';
+import { TokenCleanupService } from './token-cleanup.service';
 import { LocalStrategy } from './local.strategy';
 import { JwtStrategy } from './jwt.strategy';
 import { UsersModule } from '../users/users.module';
@@ -26,7 +27,7 @@ import { ConfigModule, ConfigService } from '@nestjs/config';
     }),
   ],
   controllers: [AuthController],
-  providers: [AuthService, LocalStrategy, JwtStrategy],
+  providers: [AuthService, TokenCleanupService, LocalStrategy, JwtStrategy],
   exports: [AuthService],
 })
 export class AuthModule {}

backend/src/modules/auth/token-cleanup.constants.ts

@@ -0,0 +1 @@
+export const DEFAULT_CLEANUP_CRON = '0 3 * * *';