Comparison

mod_tokenauth: Save grant after removing expired tokens Ensures the periodic cleanup really does remove expired tokens.

comparison

equal deleted inserted replaced

-:ddfe07041fc5
+:5db61e0dfc62
 		module:log("debug", "Token grant without tokens, cleaning up");
 		token_store:set_key(username, grant.id, nil);
 		return nil, "invalid";
 	end
 	for secret_hash, token_info in pairs(grant.tokens) do
+		local found_expired = false
 		if token_info.expires and token_info.expires < now then
 			module:log("debug", "Token has expired, cleaning it up");
 			grant.tokens[secret_hash] = nil;
+			found_expired = true;
+		end
+		if found_expired then
+			token_store:set_key(username, grant.id, nil);
 		end
 	end
 	if not grant.expires and next(grant.tokens) == nil and grant.accessed + empty_grant_lifetime < now then
 		module:log("debug", "Token grant has no tokens, discarding");