oauth: automatically clean up expired oauth state in db

internal/domains/authentication/auth.go

@@ -81,6 +81,24 @@ func New(ctx context.Context, db *pgxpool.Pool) (*Authenticator, error) {
 	}, nil
 }
 
+func (a *Authenticator) RunBackgroundCleanup(ctx context.Context) error {
+	for {
+		if _, err := a.db.Exec(ctx, "DELETE FROM oauth_tokens WHERE expiry < NOW()"); err != nil {
+			return fmt.Errorf("failed to delete all oauth_tokens rows that are expired: %w", err)
+		}
+
+		if _, err := a.db.Exec(ctx, "DELETE FROM oauth_login_states WHERE expiration < NOW()"); err != nil {
+			return fmt.Errorf("failed to delete all oauth_login_states rows that are expired: %w", err)
+		}
+
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-time.After(time.Minute):
+		}
+	}
+}
+
 // Exchange exchanges an auth code for an access token.
 func (a *Authenticator) Exchange(ctx context.Context, state, code string) (accessToken string, expiration time.Time, err error) {
 	// validate state