feat: add mfa cleanup

internal/models/cleanup.go

@@ -31,6 +31,7 @@ func init() {
 	tableSessions := Session{}.TableName()
 	tableRelayStates := SAMLRelayState{}.TableName()
 	tableFlowStates := FlowState{}.TableName()
+	tableMFAChallenges := Challenge{}.TableName()
 
 	// These statements intentionally use SELECT ... FOR UPDATE SKIP LOCKED
 	// as this makes sure that only rows that are not being used in another
@@ -45,6 +46,7 @@ func init() {
 		fmt.Sprintf("delete from %q where id in (select id from %q where not_after < now() - interval '72 hours' limit 10 for update skip locked);", tableSessions, tableSessions),
 		fmt.Sprintf("delete from %q where id in (select id from %q where created_at < now() - interval '24 hours' limit 100 for update skip locked);", tableRelayStates, tableRelayStates),
 		fmt.Sprintf("delete from %q where id in (select id from %q where created_at < now() - interval '24 hours' limit 100 for update skip locked);", tableFlowStates, tableFlowStates),
+		fmt.Sprintf("delete from %q where id in (select id from %q where created_at < now() - interval '12 hours' limit 100 for update skip locked);", tableMFAChallenges, tableMFAChallenges),
 	)
 
 	var err error

migrations/20230508135423_add_cleanup_indexes.up.sql

@@ -15,3 +15,7 @@ create index if not exists
 create index if not exists
   sessions_not_after_idx
   on {{ index .Options "Namespace" }}.sessions (not_after desc);
+
+create index if not exists
+  mfa_challenge_created_at_idx
+  on {{ index .Options "Namespace" }}.mfa_challenges (created_at desc);