auth/cleanup.ts

Periodic auth cleanup — sweeps expired sessions and role_grant offers.

Single entry point for consumers scheduling auth maintenance. Internally runs every known sweep and emits the corresponding audit events so consumer code only manages cadence, not per-task wiring.

The per-task primitives remain exported from their home modules (query_session_cleanup_expired, query_role_grant_offer_sweep_expired); cleanup_expired_role_grant_offers here wraps the latter with the required role_grant_offer_expire audit emission and is the piece most likely to be reused in a consumer's bespoke scheduler.

Idempotency: the audit log has no tombstone on role_grant_offer_expire, so concurrent sweep runs double-audit. The expected deployment pattern is a single scheduled invocation per instance — matching query_session_cleanup_expired.

view source

Declarations
#

4 declarations

AuthCleanupDeps
#

auth/cleanup.ts view source

AuthCleanupDeps import type {AuthCleanupDeps} from '@fuzdev/fuz_app/auth/cleanup.js';

Dependencies for the cleanup helpers.

inheritance

extends: QueryDeps

`log`

type Logger

`audit`

Bound audit emitter. cleanup_expired_role_grant_offers writes via audit.emit_pool (the captured pool + config + listener chain), so one slot covers both row persistence and SSE/WS fan-out. Required — production wiring always has a bound emitter on AppDeps.audit, and tests that need a no-op pass create_test_audit_emitter().

type AuditEmitter

AuthCleanupResult
#

auth/cleanup.ts view source

AuthCleanupResult import type {AuthCleanupResult} from '@fuzdev/fuz_app/auth/cleanup.js';

Result of run_auth_cleanup.

`expired_sessions`

Number of expired session rows deleted.

type number

`expired_offers`

Number of expired role_grant offer rows audit-stamped.

type number

cleanup_expired_role_grant_offers
#

auth/cleanup.ts view source

(deps: AuthCleanupDeps): Promise<number> import {cleanup_expired_role_grant_offers} from '@fuzdev/fuz_app/auth/cleanup.js';

Sweep expired role_grant offers and emit one role_grant_offer_expire audit event per row.

Returns the count of offers audit-stamped. The offer rows themselves are preserved — offers carry audit value for the history view even after expiry, and accepted rows are the provenance for the resulting role_grant (deleting expired rows would not threaten that, but keeping them uniform with the retention policy for terminal rows is simpler).

`deps`

type AuthCleanupDeps

returns

Promise<number>

run_auth_cleanup
#

auth/cleanup.ts view source

(deps: AuthCleanupDeps): Promise<AuthCleanupResult> import {run_auth_cleanup} from '@fuzdev/fuz_app/auth/cleanup.js';

Run every auth cleanup sweep — expired sessions and expired role_grant offers — and return the counts.

Consumers call this from a scheduled task (setInterval, cron, etc.) alongside their own domain cleanup. Errors from individual sweeps are re-thrown so the caller's scheduler can log/alert; use the per-task helpers (query_session_cleanup_expired, cleanup_expired_role_grant_offers) directly if you need finer error isolation.

`deps`

type AuthCleanupDeps

returns

Promise<AuthCleanupResult>

throws

Error - re-thrown from any sweep that fails (no per-sweep isolation here)