From 889897e9e90be4777d471ece7b63058fe6544561 Mon Sep 17 00:00:00 2001
From: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
Date: Thu, 9 Jul 2026 16:15:23 +0200
Subject: [PATCH] feat(login): clean remember me tokens

Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
---
 lib/composer/composer/autoload_classmap.php   |  2 +
 lib/composer/composer/autoload_static.php     |  2 +
 lib/private/Repair.php                        |  2 +
 lib/private/Repair/AddCleanupLoginTokens.php  | 32 ++++++++++++++++
 lib/private/Setup.php                         |  2 +
 .../BackgroundJobs/CleanupLoginTokens.php     | 38 +++++++++++++++++++
 6 files changed, 78 insertions(+)
 create mode 100644 lib/private/Repair/AddCleanupLoginTokens.php
 create mode 100644 lib/private/User/BackgroundJobs/CleanupLoginTokens.php

diff --git a/lib/composer/composer/autoload_classmap.php b/lib/composer/composer/autoload_classmap.php
index aa4e54cf997ef..26cac7bb71c5f 100644
--- a/lib/composer/composer/autoload_classmap.php
+++ b/lib/composer/composer/autoload_classmap.php
@@ -1957,6 +1957,7 @@
     'OC\\RepairException' => $baseDir . '/lib/private/RepairException.php',
     'OC\\Repair\\AddBruteForceCleanupJob' => $baseDir . '/lib/private/Repair/AddBruteForceCleanupJob.php',
     'OC\\Repair\\AddCleanupDeletedUsersBackgroundJob' => $baseDir . '/lib/private/Repair/AddCleanupDeletedUsersBackgroundJob.php',
+    'OC\\Repair\\AddCleanupLoginTokens' => $baseDir . '/lib/private/Repair/AddCleanupLoginTokens.php',
     'OC\\Repair\\AddCleanupUpdaterBackupsJob' => $baseDir . '/lib/private/Repair/AddCleanupUpdaterBackupsJob.php',
     'OC\\Repair\\AddMetadataGenerationJob' => $baseDir . '/lib/private/Repair/AddMetadataGenerationJob.php',
     'OC\\Repair\\AddRemoveOldTasksBackgroundJob' => $baseDir . '/lib/private/Repair/AddRemoveOldTasksBackgroundJob.php',
@@ -2170,6 +2171,7 @@
     'OC\\User\\AvailabilityCoordinator' => $baseDir . '/lib/private/User/AvailabilityCoordinator.php',
     'OC\\User\\Backend' => $baseDir . '/lib/private/User/Backend.php',
     'OC\\User\\BackgroundJobs\\CleanupDeletedUsers' => $baseDir . '/lib/private/User/BackgroundJobs/CleanupDeletedUsers.php',
+    'OC\\User\\BackgroundJobs\\CleanupLoginTokens' => $baseDir . '/lib/private/User/BackgroundJobs/CleanupLoginTokens.php',
     'OC\\User\\Database' => $baseDir . '/lib/private/User/Database.php',
     'OC\\User\\DisabledUserException' => $baseDir . '/lib/private/User/DisabledUserException.php',
     'OC\\User\\DisplayNameCache' => $baseDir . '/lib/private/User/DisplayNameCache.php',
diff --git a/lib/composer/composer/autoload_static.php b/lib/composer/composer/autoload_static.php
index 0dea7fd24d5a0..482a0a986e8eb 100644
--- a/lib/composer/composer/autoload_static.php
+++ b/lib/composer/composer/autoload_static.php
@@ -1998,6 +1998,7 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2
         'OC\\RepairException' => __DIR__ . '/../../..' . '/lib/private/RepairException.php',
         'OC\\Repair\\AddBruteForceCleanupJob' => __DIR__ . '/../../..' . '/lib/private/Repair/AddBruteForceCleanupJob.php',
         'OC\\Repair\\AddCleanupDeletedUsersBackgroundJob' => __DIR__ . '/../../..' . '/lib/private/Repair/AddCleanupDeletedUsersBackgroundJob.php',
+        'OC\\Repair\\AddCleanupLoginTokens' => __DIR__ . '/../../..' . '/lib/private/Repair/AddCleanupLoginTokens.php',
         'OC\\Repair\\AddCleanupUpdaterBackupsJob' => __DIR__ . '/../../..' . '/lib/private/Repair/AddCleanupUpdaterBackupsJob.php',
         'OC\\Repair\\AddMetadataGenerationJob' => __DIR__ . '/../../..' . '/lib/private/Repair/AddMetadataGenerationJob.php',
         'OC\\Repair\\AddRemoveOldTasksBackgroundJob' => __DIR__ . '/../../..' . '/lib/private/Repair/AddRemoveOldTasksBackgroundJob.php',
@@ -2211,6 +2212,7 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2
         'OC\\User\\AvailabilityCoordinator' => __DIR__ . '/../../..' . '/lib/private/User/AvailabilityCoordinator.php',
         'OC\\User\\Backend' => __DIR__ . '/../../..' . '/lib/private/User/Backend.php',
         'OC\\User\\BackgroundJobs\\CleanupDeletedUsers' => __DIR__ . '/../../..' . '/lib/private/User/BackgroundJobs/CleanupDeletedUsers.php',
+        'OC\\User\\BackgroundJobs\\CleanupLoginTokens' => __DIR__ . '/../../..' . '/lib/private/User/BackgroundJobs/CleanupLoginTokens.php',
         'OC\\User\\Database' => __DIR__ . '/../../..' . '/lib/private/User/Database.php',
         'OC\\User\\DisabledUserException' => __DIR__ . '/../../..' . '/lib/private/User/DisabledUserException.php',
         'OC\\User\\DisplayNameCache' => __DIR__ . '/../../..' . '/lib/private/User/DisplayNameCache.php',
diff --git a/lib/private/Repair.php b/lib/private/Repair.php
index 85a6906eb5b52..c020045518182 100644
--- a/lib/private/Repair.php
+++ b/lib/private/Repair.php
@@ -10,6 +10,7 @@
 use OC\DB\ConnectionAdapter;
 use OC\Repair\AddBruteForceCleanupJob;
 use OC\Repair\AddCleanupDeletedUsersBackgroundJob;
+use OC\Repair\AddCleanupLoginTokens;
 use OC\Repair\AddCleanupUpdaterBackupsJob;
 use OC\Repair\AddMetadataGenerationJob;
 use OC\Repair\AddRemoveOldTasksBackgroundJob;
@@ -197,6 +198,7 @@ public static function getRepairSteps(): array {
 			\OCP\Server::get(RepairLogoDimension::class),
 			\OCP\Server::get(RemoveLegacyDatadirFile::class),
 			\OCP\Server::get(AddCleanupDeletedUsersBackgroundJob::class),
+			\OCP\Server::get(AddCleanupLoginTokens::class),
 			\OCP\Server::get(SanitizeAccountProperties::class),
 			\OCP\Server::get(ConfigKeyMigration::class),
 		];
diff --git a/lib/private/Repair/AddCleanupLoginTokens.php b/lib/private/Repair/AddCleanupLoginTokens.php
new file mode 100644
index 0000000000000..9f8d196771e6f
--- /dev/null
+++ b/lib/private/Repair/AddCleanupLoginTokens.php
@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OC\Repair;
+
+use OC\User\BackgroundJobs\CleanupLoginTokens;
+use OCP\BackgroundJob\IJobList;
+use OCP\Migration\IOutput;
+use OCP\Migration\IRepairStep;
+
+class AddCleanupLoginTokens implements IRepairStep {
+	public function __construct(
+		private IJobList $jobList,
+	) {
+	}
+
+	#[\Override]
+	public function getName(): string {
+		return 'Add cleanup login tokens background job';
+	}
+
+	#[\Override]
+	public function run(IOutput $output): void {
+		$this->jobList->add(CleanupLoginTokens::class);
+	}
+}
diff --git a/lib/private/Setup.php b/lib/private/Setup.php
index 04d822cf8221c..bce8d002fc928 100644
--- a/lib/private/Setup.php
+++ b/lib/private/Setup.php
@@ -19,6 +19,7 @@
 use OC\Preview\BackgroundCleanupJob;
 use OC\TextProcessing\RemoveOldTasksBackgroundJob;
 use OC\User\BackgroundJobs\CleanupDeletedUsers;
+use OC\User\BackgroundJobs\CleanupLoginTokens;
 use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\BackgroundJob\IJobList;
 use OCP\Defaults;
@@ -517,6 +518,7 @@ public static function installBackgroundJobs(): void {
 		$jobList->add(BackgroundCleanupJob::class);
 		$jobList->add(RemoveOldTasksBackgroundJob::class);
 		$jobList->add(CleanupDeletedUsers::class);
+		$jobList->add(CleanupLoginTokens::class);
 		$jobList->add(GenerateMetadataJob::class);
 	}
 
diff --git a/lib/private/User/BackgroundJobs/CleanupLoginTokens.php b/lib/private/User/BackgroundJobs/CleanupLoginTokens.php
new file mode 100644
index 0000000000000..1e0f68c51db39
--- /dev/null
+++ b/lib/private/User/BackgroundJobs/CleanupLoginTokens.php
@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OC\User\BackgroundJobs;
+
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\BackgroundJob\TimedJob;
+use OCP\IConfig;
+use OCP\IDBConnection;
+
+class CleanupLoginTokens extends TimedJob {
+	public function __construct(
+		ITimeFactory $time,
+		private readonly IDBConnection $connection,
+		private readonly IConfig $config,
+	) {
+		parent::__construct($time);
+		$this->setTimeSensitivity(self::TIME_INSENSITIVE);
+		$this->setInterval(24 * 60 * 60);
+	}
+
+	#[\Override]
+	protected function run($argument): void {
+		$rememberMeMaxAge = $this->config->getSystemValueInt('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
+		$qb = $this->connection->getQueryBuilder();
+		$qb
+			->delete()
+			->where($qb->expr()->eq('appid', $qb->expr()->literal('login_token')))
+			->andWhere($qb->expr()->lt('configvalue', $qb->createNamedParameter(time() - $rememberMeMaxAge)))
+			->executeStatement();
+	}
+}