fix: clean up expired OAuth codes to prevent memory leak

[nanookclaw]

Closes #30

Problem

Auth codes in the codes sync.Map are only removed when redeemed via POST /oauth/token. Codes that expire without being redeemed accumulate indefinitely, causing unbounded memory growth. This is both a slow leak under normal usage and a DoS vector under targeted abuse (flooding POST /oauth/authorize).

Fix

Start a background goroutine in NewOAuthHandler that ticks every 5 minutes and deletes any codeEntry whose expiresAt is in the past. This mirrors the cleanup approach suggested in the issue.

go func() {
    for range time.Tick(5 * time.Minute) {
        h.codes.Range(func(k, v any) bool {
            if time.Now().After(v.(*codeEntry).expiresAt) {
                h.codes.Delete(k)
            }
            return true
        })
    }
}()

Single-file change to oauth_handler.go. Builds cleanly, passes go vet.

[vercel]

@nanookclaw is attempting to deploy a commit to the freedisch's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Freedisch]

Thanks for your contribution the leaks are the major changes when it's done feel free ask for review again

[Freedisch]

we should ensure that time.Tick is closed bcs it cannot be recovered by a garbage collector and will lead to more memory leaks

[Freedisch]

this goroutine lacks an exit. in this current state there will be accumulation of goroutines if we have users multiple being login in

[Freedisch]

regarding that, I feel like if have the DoS vector attack that can leak huge cpu spike not sure if my current vpc could handle that 😅

we can keep that for now

[nanookclaw]

Ran the local Go test suite from the module root:

cd havril && go test ./...

Result: all packages pass; the repo currently has no Go test files, so this verifies compile/package integrity. The leak fix is limited to NewOAuthHandler: it creates the same handler struct as before, then starts a 5-minute cleanup loop that deletes expired entries from h.codes. It does not change the authorize/token exchange behavior for live codes.

Requesting review again since the branch is ready from my side.

[Freedisch]

Please check the changes mentioned up there about the memory/goroutines leak

[Freedisch]

Result: all packages pass; the repo currently has no Go test files, so this verifies compile/package integrity. The leak fix is limited to NewOAuthHandler: it creates the same handler struct as before, then starts a 5-minute cleanup loop that deletes expired entries from h.codes. It does not change the authorize/token exchange behavior for live codes.

Requesting review again since the branch is ready from my side.

Looks solid, but the background loop will leak a goroutine every time NewOAuthHandler is called because time.Tick doesn't stop. Let's pass a context.Context so the worker can exit cleanly on teardown.

[nanookclaw]

Updated the cleanup worker so it no longer uses time.Tick.

Changes in da042c6:

• NewOAuthHandler now accepts a context.Context and starts cleanup with that context.
• cleanup uses time.NewTicker with defer ticker.Stop().
• the goroutine exits on ctx.Done() instead of running forever after teardown.
• extracted deleteExpiredCodes(now) so the map cleanup stays isolated.

Verification rerun:

cd havril && go test ./...
git diff --check

Both pass locally.

[nanookclaw]

The leak feedback on this PR is addressed in da042c6:

• time.Tick was replaced with time.NewTicker plus defer ticker.Stop().
• The cleanup goroutine now exits on ctx.Done().
• Expiration logic is isolated in deleteExpiredCodes(now).

Local verification from the branch still stands: go test ./... passes. Could you re-review this when you have a chance?