Sweep expired verification rows every hour#2193

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: efc8a7ff-27ff-49d6-ade6-8e72a2fa44a4

📥 Commits

Reviewing files that changed from the base of the PR and between dd65cd5b1eb3e6081bea9a572bcb31759052c22b and f5842a3b719abfc599d97851419525d48b1f6959.

📒 Files selected for processing: 5

• dashboard/src/modules/identity/verification-sweep.inngest.ts
• dashboard/src/modules/identity/verification-sweep.server.postgres.test.ts
• dashboard/src/modules/identity/verification-sweep.server.ts
• dashboard/src/modules/inngest/index.ts
• dashboard/src/modules/inngest/policies.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 2 remain after this review.

Summary by CodeRabbit

• New Features
  • Expired verification records are now cleaned up automatically every hour, while records that have not expired are retained.

Adds a database operation that deletes expired verification rows. Registers an hourly Inngest function to run the operation, with three retries and concurrency limited to one. Adds a live database test and policy contract coverage.

Changes: Expired verification sweep

Layer / File(s)	Summary
Delete expired verification rows dashboard/src/modules/identity/verification-sweep.server.ts, dashboard/src/modules/identity/verification-sweep.server.postgres.test.ts	Adds sweepExpiredVerifications, which deletes rows whose expiresAt is earlier than the database’s current time and maps deletion errors to VerificationSweepFailure. The database test checks that expired rows are removed and a future-expiring row remains.
Schedule and register the sweep dashboard/src/modules/identity/verification-sweep.inngest.ts, dashboard/src/modules/inngest/index.ts, dashboard/src/modules/inngest/policies.test.ts	Adds an hourly Inngest function with three retries and concurrency limited to one. Registers the function and adds its retry and concurrency settings to the policy contract test.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Sequence Diagram(s)

mermaid

1	sequenceDiagram
2	participant Inngest
3	participant SweepFunction as createSweepExpiredVerifications
4	participant EffectRunner as runInngestEffect
5	participant VerificationSweep as sweepExpiredVerifications
6	participant Database
7	Inngest->>SweepFunction: hourly trigger
8	SweepFunction->>EffectRunner: run named sweep step
9	EffectRunner->>VerificationSweep: execute sweep Effect
10	VerificationSweep->>Database: delete rows where expiresAt < now()

This adds an hourly cleanup of expired verification rows, so unfinished claim sign-in secrets no longer linger in the table. No merge-blocking risk was found.

The cleanup is restricted to expired records and uses the existing background worker without adding credentials or a public execution route. No introduced security defect was established. Some authentication-library behavior and scheduler rollback behavior remain unverified.

Retained concerns No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The added deletion capability covers all expired verification records in the configured dashboard database, not only claim-related rows or a single tenant. Its SQL operation does not target refresh-token tables or other data stores.

Trust Boundaries and Controls

• observed — The existing claim-binding consumer deletes by the exact user-and-secret-derived identifier and accepts only an unexpired returned binding. The unchanged MCP path requires a request-bound consent grant when issuing organization-bearing claims, providing counterevidence against cleanup of a missing code becoming an authorization bypass.

Resilience and Maintainability Implications

• inferred — For claim-binding consumption, concurrent cleanup either removes the expired row first or leaves consumption to delete and expiry-check it; neither ordering selects another user's binding. Complete verification-consumer compatibility remains unresolved because the MCP lookup delegates expiry enforcement to the external authentication provider, while claim validation and cleanup use different clocks.

^Failed Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage	Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 5 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

^Passed Passed checks: 4 passed

Check name	Status	Explanation
Title check	Passed	The title clearly and concisely describes the main change: an hourly sweep of expired verification rows.
Description check	Passed	The description explains the motivation, implementation, registration, policy settings, and database test for the verification-row sweep.
Linked Issues check	Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	Passed	Check skipped because no linked issues were found for this pull request.

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR