feat: add clear expired tokens task in ol-social-auth by Anas12091101 · Pull Request #778 · mitodl/open-edx-plugins

Anas12091101 · 2026-04-01T09:44:10Z

What are the relevant tickets?

https://github.com/mitodl/hq/issues/10116

Description (What does it do?)

This PR adds a clear_expired_tokens task in the ol-social-auth plugin to periodically delete the expired access and refresh tokens from the edX database.

Screenshots (if appropriate):

Desktop screenshots
Mobile width screenshots

How can this be tested?

Use this seed_tokens.py script to generate the seed data. This will create 500k expired access and refresh tokens.

In the LMS shell run the task:

 from ol_social_auth.tasks import clear_expired_tokens
 clear_expired_tokens.delay()

Verify that all the expired access and refresh tokens have been deleted successfully, and non-expired tokens are still present

Additional Context

arslanashraf7 · 2026-04-08T12:34:53Z

+    )
+    if not hasattr(settings, "CELERY_BEAT_SCHEDULE"):
+        settings.CELERY_BEAT_SCHEDULE = {}
+    settings.CELERY_BEAT_SCHEDULE["clear_expired_tokens"] = {


Let's distinguish it.

Suggested change

settings.CELERY_BEAT_SCHEDULE["clear_expired_tokens"] = {

settings.CELERY_BEAT_SCHEDULE["ol_clear_expired_tokens"] = {

arslanashraf7 · 2026-04-08T12:36:24Z

+    if not hasattr(settings, "CELERY_BEAT_SCHEDULE"):
+        settings.CELERY_BEAT_SCHEDULE = {}
+    settings.CELERY_BEAT_SCHEDULE["clear_expired_tokens"] = {
+        "task": "ol_social_auth.tasks.clear_expired_tokens",


Let's do it here as well

Suggested change

"task": "ol_social_auth.tasks.clear_expired_tokens",

"task": "ol_social_auth.tasks.ol_clear_expired_tokens",

arslanashraf7 · 2026-04-08T12:36:40Z

+        settings.CELERY_BEAT_SCHEDULE = {}
+    settings.CELERY_BEAT_SCHEDULE["clear_expired_tokens"] = {
+        "task": "ol_social_auth.tasks.clear_expired_tokens",
+        "schedule": crontab(hour=9, minute=0, day_of_week="monday"),


Why not midnight?

Suggested change

"schedule": crontab(hour=9, minute=0, day_of_week="monday"),

"schedule": crontab(hour=0, minute=0, day_of_week="monday"),

I’m not entirely sure, but this task is scheduled for 9 AM in our other applications as well; for example, MITxOnline and MITxPRO

@pdpinch, what are your thoughts on this?

If it's a task that we care about succeeding, I prefer to do it during business hours, so we have a better chance of noticing a problem and fixing it.

For this task, like this, really, any time would be fine.

arslanashraf7 · 2026-04-08T12:37:55Z

+
+
+def plugin_settings(settings):
+    """Add clear_expired_tokens to the Celery beat schedule."""


The docstrings are for the while plugin_settings, so they need to be generic.

arslanashraf7 · 2026-04-08T12:39:19Z

+    # Suppress debug-level logs from oauth2_provider during cleanup.
+    # Its batch_delete debug logs lack the 'userid' field expected by
+    # Open edX's custom log formatter, causing noisy ValueError tracebacks.


Can you explain this a little bit more? I am having a hard time getting it. Did we copy it from Open edX?

This wasn't copied from Open edX — it's a workaround for an incompatibility between django-oauth-toolkit and Open edX's custom log formatter.

The problem: clear_expired() internally calls batch_delete(), which emits debug-level log messages like "10000 tokens deleted, X left". Open edX configures a custom log formatter that expects every log record to have a userid field (used for request-scoped user tracking). The oauth2_provider library doesn't add this field to its log records, so every debug message it emits causes a ValueError: Formatting field not found in record: 'userid' — producing a noisy traceback in the logs on every batch deletion.

The fix: Before calling clear_expired(), we temporarily raise the oauth2_provider logger level to INFO, which silences the debug-level batch messages. After the call completes (or fails), we restore the original level. This way the deletion still happens correctly — we just suppress the log messages that would trigger the formatter error.

To reproduce the issue, run the clear_expired() fn without suppressing the logs.

arslanashraf7 · 2026-04-08T12:40:47Z

+
+**Behavior:**
+
+* Runs every **Monday at 9:00 AM** (server time) via Celery Beat by default. The schedule can be customized by overriding the ``clear_expired_tokens`` entry in ``CELERY_BEAT_SCHEDULE``.


this will change too if we decide to run the task at midnight.

for more information, see https://pre-commit.ci

arslanashraf7 · 2026-04-15T11:04:41Z

+    if not hasattr(settings, "CELERY_BEAT_SCHEDULE"):
+        settings.CELERY_BEAT_SCHEDULE = {}
+    settings.CELERY_BEAT_SCHEDULE["ol_clear_expired_tokens"] = {
+        "task": "ol_social_auth.tasks.ol_clear_expired_tokens",
+        "schedule": crontab(hour=9, minute=0, day_of_week="monday"),


I was able to test it manually via Django shell, but I wasn't able to test it via the beat schedule and the task being run in auto mode. Were you able to test it?

Also, Open edX has CELERYBEAT_SCHEDULE in the settings in common.py instead of CELERY_BEAT_SCHEDULE. Could you tell if there was any specific reason for using a new env key rather than using the existing openedx one? And also, could this be the reason the task schedule isn't working?

Good catch. I’ve updated the setting name in dce4d4b and verified that the tasks are running as expected according to the beat schedule.

arslanashraf7

LGTM 👍 One question for @blarghmatey before merging.

arslanashraf7 · 2026-04-17T10:08:50Z

+def plugin_settings(settings):
+    """Settings for the ol-social-auth plugin."""  # noqa: D401
+    settings.OAUTH2_PROVIDER["REFRESH_TOKEN_EXPIRE_SECONDS"] = (
+        30 * 24 * 60 * 60  # 30 days


I'd suggest checking with @blarghmatey this time range as well, since we're using service tokens before merging the PR. Since DevOps creates service tokens, I'm not sure what expiry time they set. I want to make sure they will not be deleted automatically.

The OAuth service accounts that we rely on are using client credentials grants so we're not worried about token expiration. Thanks for checking.

* feat: add task * fix: issues * chore: bump version * docs: update readme * fix: issues * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * fix: rename to CELERYBEAT_SCHEDULE --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: arslanashraf7 <34372316+arslanashraf7@users.noreply.github.com>

Reverts the changes introduced by two commits that were accidentally included in this branch during an earlier rebase on a shallow clone: - f71e486 (feat: add clear expired tokens task in ol-social-auth #778) - 7226134 ([pre-commit.ci] pre-commit autoupdate #783) These commits are already in main; including them here caused the PR to show unrelated ol_social_auth and pre-commit changes. Co-authored-by: arslanashraf7 <34372316+arslanashraf7@users.noreply.github.com>

Anas12091101 added 2 commits March 17, 2026 19:41

feat: add task

3e70bc1

fix: issues

70d4e25

sentry Bot reviewed Apr 1, 2026

View reviewed changes

Comment thread src/ol_social_auth/ol_social_auth/settings/common.py

Anas12091101 added 2 commits April 1, 2026 14:55

chore: bump version

086597d

docs: update readme

cd07aeb

Anas12091101 mentioned this pull request Apr 1, 2026

config: update REFRESH_TOKEN_EXPIRE_SECONDS to 30 days mitodl/ol-infrastructure#4419

Merged

2 tasks

Anas12091101 changed the title ~~Anas/add clear expired tokens task~~ feat: add clear expired tokens task in ol-social-auth Apr 1, 2026

Anas12091101 requested a review from arslanashraf7 April 1, 2026 10:57

Anas12091101 added the Needs Review label Apr 1, 2026

arslanashraf7 self-assigned this Apr 1, 2026

arslanashraf7 requested changes Apr 8, 2026

View reviewed changes

arslanashraf7 added Waiting on Author and removed Needs Review labels Apr 8, 2026

Anas12091101 and others added 2 commits April 10, 2026 16:42

fix: issues

b443211

[pre-commit.ci] auto fixes from pre-commit.com hooks

e831d54

for more information, see https://pre-commit.ci

Anas12091101 added Needs Review and removed Waiting on Author labels Apr 10, 2026

Anas12091101 requested a review from arslanashraf7 April 13, 2026 14:26

arslanashraf7 requested changes Apr 15, 2026

View reviewed changes

arslanashraf7 added Waiting on Author and removed Needs Review labels Apr 15, 2026

fix: rename to CELERYBEAT_SCHEDULE

dce4d4b

Anas12091101 added Needs Review and removed Waiting on Author labels Apr 17, 2026

Anas12091101 requested a review from arslanashraf7 April 17, 2026 06:04

arslanashraf7 approved these changes Apr 17, 2026

View reviewed changes

arslanashraf7 added Waiting on Author and removed Needs Review labels Apr 17, 2026

Anas12091101 merged commit fef5276 into main Apr 17, 2026
10 checks passed

Anas12091101 deleted the anas/add-clear_expired_tokens-task branch April 17, 2026 12:37

	settings.CELERY_BEAT_SCHEDULE["clear_expired_tokens"] = {
	settings.CELERY_BEAT_SCHEDULE["ol_clear_expired_tokens"] = {

	"task": "ol_social_auth.tasks.clear_expired_tokens",
	"task": "ol_social_auth.tasks.ol_clear_expired_tokens",

	"schedule": crontab(hour=9, minute=0, day_of_week="monday"),
	"schedule": crontab(hour=0, minute=0, day_of_week="monday"),



		def plugin_settings(settings):
		"""Add clear_expired_tokens to the Celery beat schedule."""


		Behavior:

		* Runs every Monday at 9:00 AM (server time) via Celery Beat by default. The schedule can be customized by overriding the ``clear_expired_tokens`` entry in ``CELERY_BEAT_SCHEDULE``.

Conversation

Anas12091101 commented Apr 1, 2026

What are the relevant tickets?

Description (What does it do?)

Screenshots (if appropriate):

How can this be tested?

Additional Context

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Anas12091101 Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arslanashraf7 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Anas12091101 Apr 8, 2026 •

edited

Loading