feat(hydra-cleaner): clean authentication_session table

Reviewed-on: #76

components/hydra-cleaner/files/hydra-cleaner.sh

@@ -16,7 +16,8 @@ set -o nounset
 
 # -> delete "cascade" on table "flow" cleans access, code, oidc, pkce and refresh tables.
 
-# For table authentication_session, a simple delete on this table should be enough.
+# For table authentication_session, a simple delete on this table is enough.
+# Delete all rows without reference from table flow (foreign key)
 
 DSN="${DSN:-postgresql://${HYDRA_DATABASE_USER}:${HYDRA_DATABASE_PASSWORD}@${HYDRA_DATABASE_SERVICE_NAME}:${HYDRA_DATABASE_SERVICE_PORT:-5432}/hydra?sslmode=disable}"
 RETENTION_HOURS="${RETENTION_HOURS:-48}"
@@ -68,6 +69,9 @@ where table_schema = 'public'
 order by 4 desc;
 EOF
 
+### Flow table
+
+log "Cleaning flow table..."
 
 REMAINING_ELMTS="${LIMIT}"
 while [ "${REMAINING_ELMTS}" -gt 0 ]; do
@@ -103,23 +107,57 @@ EOF
     fi
 done
 
+### Authentication session table
+
+log "Cleaning authentication_session table..."
 
 BATCH_SIZE="${BATCH_SIZE_ORIG}"
 REMAINING_ELMTS="${LIMIT}"
-while [ "${REMAINING_ELMTS}" -gt 0 ]; do
+
-    OUTPUT=$(psql "${DSN}" <<EOF
+OUTPUT=$(psql "${DSN}" <<EOF
-DELETE
+DO \$\$
-FROM hydra_oauth2_authentication_session
+BEGIN
-WHERE id = ANY (
+  DROP TABLE IF EXISTS hydra_cleaner.hydra_childless_auth_session;
-  array(
+  DROP SCHEMA IF EXISTS hydra_cleaner;
-    SELECT id
+  CREATE SCHEMA hydra_cleaner;
+  CREATE TABLE hydra_cleaner.hydra_childless_auth_session AS
+  SELECT id
     FROM hydra_oauth2_authentication_session
-    WHERE authenticated_at < '${BEFORE_DATE}'
+    WHERE NOT EXISTS (
-    LIMIT ${BATCH_SIZE}
+      SELECT 1
-  )
+      FROM hydra_oauth2_flow
-);
+      WHERE hydra_oauth2_authentication_session.id = hydra_oauth2_flow.login_session_id
-EOF
     )
+    LIMIT ${REMAINING_ELMTS};
+END \$\$;
+EOF
+)
+
+log "${OUTPUT}"
+
+while [ "${REMAINING_ELMTS}" -gt 0 ]; do
+
+    OUTPUT=$(psql "${DSN}" <<EOF
+WITH childless_auth_session_batch AS (
+    SELECT id
+    FROM hydra_cleaner.hydra_childless_auth_session
+    LIMIT ${BATCH_SIZE}
+),
+auth_session_deleted AS (
+    DELETE
+    FROM hydra_oauth2_authentication_session
+    WHERE hydra_oauth2_authentication_session.id IN (SELECT * FROM childless_auth_session_batch)
+        AND NOT EXISTS (
+            SELECT 1
+            FROM hydra_oauth2_flow
+            WHERE hydra_oauth2_authentication_session.id = hydra_oauth2_flow.login_session_id
+        )
+    )
+DELETE
+FROM hydra_cleaner.hydra_childless_auth_session
+WHERE hydra_cleaner.hydra_childless_auth_session.id IN (SELECT * FROM childless_auth_session_batch);
+EOF
+)
 
     log "${OUTPUT}"
 
@@ -139,7 +177,6 @@ EOF
     fi
 done
 
-
 log "Final estimated size:"
 psql "${DSN}" <<EOF
 select

resources/hydra-dispatcher/resources/hydra-dispatcher-deployment.yaml

@@ -19,14 +19,14 @@ spec:
     spec:
       containers:
         - name: hydra-dispatcher-php-fpm
-          image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2025.6.13-develop.1332.c8d277f
+          image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2025.8.28-develop.1505.75881cb
-          args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+          args: ["/usr/sbin/php-fpm84", "-F", "-e"]
           readinessProbe:
             exec:
               command:
                 - sh
                 - -c
-                - test -f /etc/php81/php-fpm.d/www.conf
+                - test -f /etc/php84/php-fpm.d/www.conf
           livenessProbe:
             exec:
               command:
@@ -51,7 +51,7 @@ spec:
                 name: hydra-dispatcher-env
           volumeMounts:
             - name: hydra-dispatcher-php-ini
-              mountPath: /etc/php81/conf.d/03_base.ini
+              mountPath: /etc/php84/conf.d/03_base.ini
               subPath: 03_base.ini
             - name: dispatcher-tmp
               mountPath: /tmp
@@ -61,7 +61,7 @@ spec:
             runAsGroup: 1000
             runAsUser: 1000
         - name: hydra-dispatcher-caddy
-          image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2025.6.13-develop.1332.c8d277f
+          image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2025.8.28-develop.1505.75881cb
           imagePullPolicy: IfNotPresent
           args:
             [