From 42b971658dfbb5d0b7dc1f75e554747b6e29346f Mon Sep 17 00:00:00 2001
From: Jon Seager <jon@sgrs.uk>
Date: Fri, 6 Feb 2026 18:19:30 +0000
Subject: [PATCH] fix(auth): clean up expired sessions on server startup

Wire the existing delete_expired() method to run at startup so the
sessions table doesn't grow unboundedly with stale rows.
---
 src/application/server.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/application/server.rs b/src/application/server.rs
index 00b38cc..fee29b0 100644
--- a/src/application/server.rs
+++ b/src/application/server.rs
@@ -51,6 +51,11 @@ pub async fn serve(config: ServerConfig) -> anyhow::Result<()> {
         },
     );
 
+    // Clean up expired sessions on startup
+    if let Err(err) = state.session_repo.delete_expired().await {
+        tracing::warn!(error = %err, "failed to clean up expired sessions on startup");
+    }
+
     // Bootstrap: if no users exist, generate a one-time registration token
     bootstrap_registration(
         &state.registration_token_repo,