feat: add clear_expired_tokens task to remove oauth expired tokens by Anas12091101 · Pull Request #3835 · mitodl/mitxpro

Anas12091101 · 2026-03-04T15:08:58Z

What are the relevant tickets?

https://github.com/mitodl/hq/issues/10115

Description (What does it do?)

This PR adds clear_expired_tokens task to remove OAuth expired tokens. The task is set to run every week.

Screenshots (if appropriate):

Desktop screenshots
Mobile width screenshots

How can this be tested?

Create 1M access and refresh tokens using this management command: seed_expired_tokens.py
Run the command ./manage.py cleartokens and verify it deletes only expired tokens

Additional Context

Anas12091101 · 2026-03-05T09:51:29Z

@dsubak, there are approximately ~1.8M access and refresh tokens in xPRO, and the COUNT(*) query returned almost instantly. Given that, it seems the table size isn’t causing performance issues.

Do you think we still need the chunked_oauth_access_token_delete.py script in this case?

dsubak · 2026-03-05T14:08:39Z

@dsubak, there are approximately ~1.8M access and refresh tokens in xPRO, and the COUNT(*) query returned almost instantly. Given that, it seems the table size isn’t causing performance issues.

Do you think we still need the chunked_oauth_access_token_delete.py script in this case?

@Anas12091101 I'd give a manual run of cleartokens a shot first. No need to use my weird script unless it doesn't succeed!

arslanashraf7 · 2026-03-06T12:53:42Z

+log = logging.getLogger(__name__)
+
+
+@app.task(acks_late=True)


It could be a shared task; it doesn't need to depend on an app.

arslanashraf7 · 2026-03-06T12:55:06Z

+CRON_CLEAR_TOKENS_HOURS = get_string(
+    name="CRON_CLEAR_TOKENS_HOURS",
+    default=0,
+    description="'hours' value for the 'clear-expired-tokens' scheduled task (defaults to midnight)",
+)
+CRON_CLEAR_TOKENS_DAYS = get_string(
+    name="CRON_CLEAR_TOKENS_DAYS",
+    default="*",
+    description="'day_of_month' value for 'clear-expired-tokens' scheduled task (default will run every day)",
+)
+


This is more like a one-off setting, and I don't think we are going to tweak it often. We should probably remove these settings.

arslanashraf7 · 2026-03-06T12:57:26Z

+    "clear-expired-tokens": {
+        "task": "mitxpro.tasks.clear_expired_tokens",
+        "schedule": crontab(
+            minute=0,
+            hour=CRON_CLEAR_TOKENS_HOURS,
+            day_of_week="*",
+            day_of_month=CRON_CLEAR_TOKENS_DAYS,
+            month_of_year="*",
+        ),
+    },


Was there a decision on running it daily?

The configurations can be shortened depending on the decision. Daily sounds too often for this task.

@arslanashraf7 I’ve configured it similar to MITxOnline, so the task will run every Monday at 9 AM.

arslanashraf7 · 2026-03-06T13:04:16Z

+    "REFRESH_TOKEN_EXPIRE_SECONDS": {
+      "description": "Number of seconds until a refresh token expires",
+      "required": false
+    },


Did you run generate_app_json command for this?

arslanashraf7 · 2026-03-06T14:13:55Z

+def clear_expired_tokens():
+    """Clear expired OAuth2 access, refresh, and ID tokens via the cleartokens management command."""
+    log.info("Starting clear_expired_tokens...")
+    call_command("cleartokens")


In mitodl/mitxonline#3248, we switched from the command to the direct method from oauth2_provider.models import clear_expired. Perhaps we should do the same.

arslanashraf7 · 2026-03-10T16:12:14Z

+def test_clear_tokens_does_not_delete_unexpired_tokens(settings):
+    """Test that cleartokens does not delete tokens that have not yet expired"""
+    settings.OAUTH2_PROVIDER = {
+        **settings.OAUTH2_PROVIDER,
+        "REFRESH_TOKEN_EXPIRE_SECONDS": 60 * 60 * 24 * 30,  # 30 days
+    }
+
+    user = UserFactory.create()
+    application = Application.objects.create(
+        name="test-cleartokens-app",
+        client_type="confidential",
+        authorization_grant_type="authorization-code",
+        skip_authorization=True,
+    )
+
+    now = timezone.now()
+
+    # Create an unexpired access token (expires 1 hour from now)
+    access_token = AccessToken.objects.create(
+        user=user,
+        application=application,
+        token=uuid.uuid4().hex,
+        expires=now + timedelta(hours=1),
+        scope="read write",
+    )
+
+    # Create a non-revoked refresh token
+    refresh_token = RefreshToken.objects.create(
+        user=user,
+        application=application,
+        token=uuid.uuid4().hex,
+        access_token=access_token,
+    )
+
+    tasks.clear_expired_tokens()
+
+    # Unexpired tokens should still exist
+    assert AccessToken.objects.filter(pk=access_token.pk).exists()
+    assert RefreshToken.objects.filter(pk=refresh_token.pk).exists()
+
+
+@pytest.mark.django_db
+def test_clear_tokens_deletes_expired_tokens(settings):


Both of these could be converted into a single parameterized test. This will also reduce the code by a large extent.

arslanashraf7

👍. One small change suggested in tests.

arslanashraf7 · 2026-03-12T11:36:08Z

+        pytest.param(timedelta(hours=1), None, False, id="unexpired"),
+        pytest.param(timedelta(days=-60), timedelta(days=-60), True, id="expired"),


we should add more params for safe side:

one where we give both token_expires_delta and token_revoked_delta values in positive

one where we give both token_expires_delta as negative and token_revoked_delta as None

Anas12091101 added the Needs Review label Mar 4, 2026

feat: add clear_expired_tokens task to remove oauth expired tokens

a4662cb

Anas12091101 force-pushed the anas/add-clear_expired_tokens-task branch from 46b5174 to a4662cb Compare March 4, 2026 15:09

Anas12091101 added 2 commits March 4, 2026 23:05

fix: tests

e75f538

fix: js test

6af50ce

Anas12091101 force-pushed the anas/add-clear_expired_tokens-task branch from 39a54ac to 6af50ce Compare March 4, 2026 18:25

test: add test

f593e92

Anas12091101 requested a review from arslanashraf7 March 5, 2026 09:19

arslanashraf7 self-assigned this Mar 6, 2026

arslanashraf7 requested changes Mar 6, 2026

View reviewed changes

arslanashraf7 added Waiting on Author and removed Needs Review labels Mar 6, 2026

Anas12091101 added 2 commits March 9, 2026 16:17

fix: issues

0b33082

fix: issues

53ef239

Anas12091101 added Needs Review and removed Waiting on Author labels Mar 9, 2026

Anas12091101 requested a review from arslanashraf7 March 9, 2026 11:34

arslanashraf7 requested changes Mar 10, 2026

View reviewed changes

arslanashraf7 added Waiting on Author and removed Needs Review labels Mar 10, 2026

test: update test

4b9f001

Anas12091101 added Needs Review and removed Waiting on Author labels Mar 12, 2026

arslanashraf7 approved these changes Mar 12, 2026

View reviewed changes

arslanashraf7 added Waiting on Author and removed Needs Review labels Mar 12, 2026

test: add more parametrized

db9f343

Anas12091101 force-pushed the anas/add-clear_expired_tokens-task branch from 8295c3e to db9f343 Compare March 12, 2026 14:50

Anas12091101 merged commit 91fe1f3 into master Mar 12, 2026
9 checks passed

Anas12091101 deleted the anas/add-clear_expired_tokens-task branch March 12, 2026 17:21

This was referenced Mar 19, 2026

Release 0.193.0 #3855

Closed

Release 0.192.4 #3859

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add clear_expired_tokens task to remove oauth expired tokens#3835

feat: add clear_expired_tokens task to remove oauth expired tokens#3835
Anas12091101 merged 8 commits intomasterfrom
anas/add-clear_expired_tokens-task

Anas12091101 commented Mar 4, 2026

Uh oh!

Anas12091101 commented Mar 5, 2026

Uh oh!

dsubak commented Mar 5, 2026

Uh oh!

arslanashraf7 Mar 6, 2026

Uh oh!

arslanashraf7 Mar 6, 2026

Uh oh!

arslanashraf7 Mar 6, 2026

Uh oh!

arslanashraf7 Mar 6, 2026

Uh oh!

Anas12091101 Mar 9, 2026

Uh oh!

arslanashraf7 Mar 6, 2026

Uh oh!

arslanashraf7 Mar 6, 2026

Uh oh!

arslanashraf7 Mar 10, 2026

Uh oh!

arslanashraf7 left a comment

Uh oh!

arslanashraf7 Mar 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		pytest.param(timedelta(hours=1), None, False, id="unexpired"),
		pytest.param(timedelta(days=-60), timedelta(days=-60), True, id="expired"),

		log = logging.getLogger(__name__)


		@app.task(acks_late=True)

Conversation

Anas12091101 commented Mar 4, 2026

What are the relevant tickets?

Description (What does it do?)

Screenshots (if appropriate):

How can this be tested?

Additional Context

Uh oh!

Anas12091101 commented Mar 5, 2026

Uh oh!

dsubak commented Mar 5, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arslanashraf7 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants