[SKroman108]

Summary

Fixes #61833.

Auth tokens with an explicit expires timestamp are rejected by PublicKeyTokenProvider::getToken() once it has passed, but invalidateOldTokens() only looks at last_activity. A PERMANENT_TOKEN with an expiry therefore stays in oc_authtoken, and in Settings → Security → Devices & sessions, for token_auth_token_retention (one year by default).

The Passwords app creates such a token for every web UI session. On my instance (Nextcloud 35.0.2) this left 310 "Passwords Session …" entries for one user, all expired. 306 of them expired more than a week ago.

Change

• PublicKeyTokenMapper::invalidateExpired(int $expiredBefore) deletes tokens with expires > 0 that expired before the given time. It skips WIPE_TOKEN, which already has its own retention (token_auth_wipe_token_retention).
• invalidateOldTokens(), which already runs from the hourly clean-up job, calls it with a grace period from the new system config token_auth_expired_token_retention (default 7 days). The grace period keeps the current behaviour from Session::isTokenPassword(): a client still sending a recently expired token gets a quiet rejection, not a failed login for brute-force protection.
• Tokens without an expiry (expires NULL/0) are not affected.

TODO

• Document token_auth_expired_token_retention next to the other token_auth_* options in the admin docs, if wanted

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included: a mapper test with expired/recent/valid/wipe tokens and an updated provider test
• Screenshots before/after for front-end changes — not applicable
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

I only checked syntax locally (php -l) and ran the delete condition as a read-only SELECT on a real instance. The unit tests will run in CI.

🤖 Generated with Claude Code