feat(hydra-cleaner): clean authentication_session table

Reviewed-on: #76

components/hydra-cleaner/files/hydra-cleaner.sh

@@ -16,10 +16,13 @@ set -o nounset
 
 # -> delete "cascade" on table "flow" cleans access, code, oidc, pkce and refresh tables.
 
+# For table authentication_session, a simple delete on this table is enough.
+# Delete all rows without reference from table flow (foreign key)
 
 DSN="${DSN:-postgresql://${HYDRA_DATABASE_USER}:${HYDRA_DATABASE_PASSWORD}@${HYDRA_DATABASE_SERVICE_NAME}:${HYDRA_DATABASE_SERVICE_PORT:-5432}/hydra?sslmode=disable}"
 RETENTION_HOURS="${RETENTION_HOURS:-48}"
 BATCH_SIZE="${BATCH_SIZE:-50}"
+BATCH_SIZE_ORIG="${BATCH_SIZE}"
 LIMIT="${LIMIT:-1000}"
 BEFORE_DATE="$(date +'%Y-%m-%d %H:%M:%S' --date=@$(($(date +%s) - RETENTION_HOURS * 3600)))"
 
@@ -66,6 +69,9 @@ where table_schema = 'public'
 order by 4 desc;
 EOF
 
+### Flow table
+
+log "Cleaning flow table..."
 
 REMAINING_ELMTS="${LIMIT}"
 while [ "${REMAINING_ELMTS}" -gt 0 ]; do
@@ -86,7 +92,7 @@ EOF
     log "${OUTPUT}"
 
     if ! [[ "${OUTPUT}" =~ '^DELETE ' ]] ; then
-	log "Output doesn't seems OK..."
+	log "Output doesn't seem OK..."
 	break
     fi
     OUTPUT_NB=$(echo "${OUTPUT}" | cut -d' ' -f 2)
@@ -101,6 +107,75 @@ EOF
     fi
 done
 
+### Authentication session table
+
+log "Cleaning authentication_session table..."
+
+BATCH_SIZE="${BATCH_SIZE_ORIG}"
+REMAINING_ELMTS="${LIMIT}"
+
+OUTPUT=$(psql "${DSN}" <<EOF
+DO \$\$
+BEGIN
+  DROP TABLE IF EXISTS hydra_cleaner.hydra_childless_auth_session;
+  DROP SCHEMA IF EXISTS hydra_cleaner;
+  CREATE SCHEMA hydra_cleaner;
+  CREATE TABLE hydra_cleaner.hydra_childless_auth_session AS
+  SELECT id
+    FROM hydra_oauth2_authentication_session
+    WHERE NOT EXISTS (
+      SELECT 1
+      FROM hydra_oauth2_flow
+      WHERE hydra_oauth2_authentication_session.id = hydra_oauth2_flow.login_session_id
+    )
+    LIMIT ${REMAINING_ELMTS};
+END \$\$;
+EOF
+)
+
+log "${OUTPUT}"
+
+while [ "${REMAINING_ELMTS}" -gt 0 ]; do
+
+    OUTPUT=$(psql "${DSN}" <<EOF
+WITH childless_auth_session_batch AS (
+    SELECT id
+    FROM hydra_cleaner.hydra_childless_auth_session
+    LIMIT ${BATCH_SIZE}
+),
+auth_session_deleted AS (
+    DELETE
+    FROM hydra_oauth2_authentication_session
+    WHERE hydra_oauth2_authentication_session.id IN (SELECT * FROM childless_auth_session_batch)
+        AND NOT EXISTS (
+            SELECT 1
+            FROM hydra_oauth2_flow
+            WHERE hydra_oauth2_authentication_session.id = hydra_oauth2_flow.login_session_id
+        )
+    )
+DELETE
+FROM hydra_cleaner.hydra_childless_auth_session
+WHERE hydra_cleaner.hydra_childless_auth_session.id IN (SELECT * FROM childless_auth_session_batch);
+EOF
+)
+
+    log "${OUTPUT}"
+
+    if ! [[ "${OUTPUT}" =~ '^DELETE ' ]] ; then
+	log "Output doesn't seem OK..."
+	break
+    fi
+    OUTPUT_NB=$(echo "${OUTPUT}" | cut -d' ' -f 2)
+
+    if [ "${OUTPUT_NB}" -lt "${BATCH_SIZE}" ]; then
+	break
+    fi
+
+    REMAINING_ELMTS=$((REMAINING_ELMTS - BATCH_SIZE))
+    if [ "${REMAINING_ELMTS}" -lt "${BATCH_SIZE}" ]; then
+	BATCH_SIZE="${REMAINING_ELMTS}"
+    fi
+done
 
 log "Final estimated size:"
 psql "${DSN}" <<EOF

components/hydra-oidc/resources/hydra-oidc-deployment.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: hydra-oidc-php-fpm
-        image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
+        image: reg.cadoles.com/cadoles/hydra-oidc-base:2025.6.13-develop.1333.aa5c382
         imagePullPolicy: IfNotPresent
         args: ["/usr/sbin/php-fpm81", "-F", "-e"]
         readinessProbe:
@@ -45,6 +45,9 @@ spec:
         envFrom:
           - configMapRef:
               name: hydra-oidc-env
+        volumeMounts:
+          - name: oidc-tmp
+            mountPath: /tmp
         resources: {}
         securityContext:
           runAsNonRoot: true
@@ -52,7 +55,7 @@ spec:
           runAsUser: 1000
 
       - name: hydra-oidc-caddy
-        image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
+        image: reg.cadoles.com/cadoles/hydra-oidc-base:2025.6.13-develop.1333.aa5c382
         imagePullPolicy: IfNotPresent
         args:
           [
@@ -94,9 +97,17 @@ spec:
             value: "/tmp/caddy"
           - name: CADDY_APP_ROOT_PUBLIC
             value: "/app/public/"
+          - name: CADDY_LOG_FILTER
+            value: healthy|metrics
+          - name: CADDY_LOG_SKIP
+            value: "true"
         resources: {}
         securityContext:
           runAsNonRoot: true
           runAsGroup: 1000
           runAsUser: 1000
       restartPolicy: Always
+      volumes:
+        - name: oidc-tmp
+          emptyDir:
+            medium: Memory

components/hydra-sql/files/sql_login.yaml

@@ -1,7 +0,0 @@
-sql_login:
-  login_column_name: mail
-  password_column_name: password
-  salt_column_name: salt
-  table_name: user
-  data_to_fetch:
-  - mail

components/hydra-sql/kustomization.yaml

@@ -27,9 +27,6 @@ configMapGenerator:
   - ALTCHA_HOST=http://altcha:3333
   - ALTCHA_BASE_URL=/altcha
   - ALTCHA_ENABLED=true
-- name: sql-login-config
-  files:
-  - ./files/sql_login.yaml
 - name: hydra-sql-php-ini
   files:
   - ./files/03_base.ini

components/hydra-sql/resources/hydra-sql-deployment.yaml

@@ -21,15 +21,15 @@ spec:
     spec:
       containers:
       - name: hydra-sql-fpm
-        image: reg.cadoles.com/cadoles/hydra-sql-base:2025.4.10-develop.1612.303b027
+        image: reg.cadoles.com/cadoles/hydra-sql-base:2025.7.30-develop.1146.5f2654c
         imagePullPolicy: IfNotPresent
-        args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+        args: ["/usr/sbin/php-fpm84", "-F", "-e"]
         readinessProbe:
           exec:
             command:
             - sh
             - -c
-            - test -f /etc/php81/php-fpm.d/www.conf
+            - test -f /etc/php84/php-fpm.d/www.conf
         livenessProbe:
           exec:
             command:
@@ -60,15 +60,14 @@ spec:
         - name: OPCACHE_REVALIDATE_FREQ
           value: "0"
         volumeMounts:
-        - name: sql-login-config
-          mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
-          subPath: "sql_login.yaml"
         - name: hydra-sql-php-ini
-          mountPath: /etc/php81/conf.d/03_base.ini
+          mountPath: /etc/php84/conf.d/03_base.ini
           subPath: 03_base.ini
+        - name: sql-tmp
+          mountPath: /tmp
 
       - name: hydra-sql-caddy
-        image: reg.cadoles.com/cadoles/hydra-sql-base:2025.4.10-develop.1612.303b027
+        image: reg.cadoles.com/cadoles/hydra-sql-base:2025.7.30-develop.1146.5f2654c
         imagePullPolicy: IfNotPresent
         args: ["/usr/sbin/caddy", "run", "--adapter", "caddyfile", "--config", "/etc/caddy/Caddyfile"]
         readinessProbe:
@@ -99,6 +98,10 @@ spec:
           value: "/tmp/caddy"
         - name: CADDY_APP_ROOT_PUBLIC
           value: "/app/public/"
+        - name: CADDY_LOG_FILTER
+          value: health|metrics
+        - name: CADDY_LOG_SKIP
+          value: "true"
         resources: {}
         securityContext:
           runAsNonRoot: true
@@ -107,16 +110,12 @@ spec:
         ports:
         - containerPort: 8080
           name: http
-        volumeMounts:
-        - name: sql-login-config
-          mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
-          subPath: "sql_login.yaml"
       volumes:
-      - name: sql-login-config
-        configMap:
-          name: sql-login-config
       - name: hydra-sql-php-ini
         configMap:
           name: hydra-sql-php-ini
+      - name: sql-tmp
+        emptyDir:
+          medium: Memory
 
       restartPolicy: Always

resources/hydra-dispatcher/files/hydra/default.yaml

@@ -1,16 +0,0 @@
-parameters:
-  env(HYDRA_DISPATCHER_WEBHOOK_ENABLED): false
-  env(HYDRA_DISPATCHER_WEBHOOK_API_URL): ""
-  env(HYDRA_DISPATCHER_WEBHOOK_API_KEY): ""
-  env(HYDRA_DISPATCHER_WEBHOOK_API_METHOD): POST
-  env(HYDRA_DISPATCHER_FIREWALL_ADDITIONAL_PROPERTIES): true
-
-hydra:
-  apps: []
-  webhook:
-    enabled: "%env(bool:HYDRA_DISPATCHER_WEBHOOK_ENABLED)%"
-    api_url: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_URL)%"
-    api_key: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_KEY)%"
-    api_method: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_METHOD)%"
-  webhook_post_login:
-    enabled: false

resources/hydra-dispatcher/kustomization.yaml

@@ -26,9 +26,6 @@ configMapGenerator:
   - DEFAULT_LOCALE=fr
   - APP_LOCALES=fr,en
   - REDIS_DSN="redis://redis:6379"
-- name: hydra-dispatcher-apps
-  files:
-  - apps.yaml=./files/hydra/default.yaml
 - name: hydra-dispatcher-php-ini
   files:
   - ./files/03_base.ini

resources/hydra-dispatcher/resources/hydra-dispatcher-deployment.yaml

@@ -19,14 +19,14 @@ spec:
     spec:
       containers:
         - name: hydra-dispatcher-php-fpm
-          image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2025.3.18-develop.1401.4646fbb
+          image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2025.8.28-develop.1505.75881cb
-          args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+          args: ["/usr/sbin/php-fpm84", "-F", "-e"]
           readinessProbe:
             exec:
               command:
                 - sh
                 - -c
-                - test -f /etc/php81/php-fpm.d/www.conf
+                - test -f /etc/php84/php-fpm.d/www.conf
           livenessProbe:
             exec:
               command:
@@ -50,18 +50,18 @@ spec:
             - configMapRef:
                 name: hydra-dispatcher-env
           volumeMounts:
-            - mountPath: /app/config/hydra
-              name: hydra-dispatcher-apps
             - name: hydra-dispatcher-php-ini
-              mountPath: /etc/php81/conf.d/03_base.ini
+              mountPath: /etc/php84/conf.d/03_base.ini
               subPath: 03_base.ini
+            - name: dispatcher-tmp
+              mountPath: /tmp
           resources: {}
           securityContext:
             runAsNonRoot: true
             runAsGroup: 1000
             runAsUser: 1000
         - name: hydra-dispatcher-caddy
-          image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2025.3.18-develop.1401.4646fbb
+          image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2025.8.28-develop.1505.75881cb
           imagePullPolicy: IfNotPresent
           args:
             [
@@ -100,6 +100,10 @@ spec:
               value: "/tmp/caddy"
             - name: CADDY_APP_ROOT_PUBLIC
               value: "/app/public/"
+            - name: CADDY_LOG_FILTER
+              value: health|metrics
+            - name: CADDY_LOG_SKIP
+              value: "true"
           ports:
             - containerPort: 8080
               name: http
@@ -110,9 +114,9 @@ spec:
             runAsUser: 1000
       restartPolicy: Always
       volumes:
-        - name: hydra-dispatcher-apps
-          configMap:
-            name: hydra-dispatcher-apps
         - name: hydra-dispatcher-php-ini
           configMap:
             name: hydra-dispatcher-php-ini
+        - name: dispatcher-tmp
+          emptyDir:
+            medium: Memory