perf(auth): debounce access token "last used" writes

models/auth/access_token.go

@@ -152,6 +152,18 @@ func (opts ListAccessTokensOptions) ToOrders() string {
 	return "created_unix DESC"
 }
 
+// AccessTokenUseInterval is how often access_token.updated_unix ("last used") is
+// persisted after a successful token authentication. Must stay well below the
+// 7-day HasRecentActivity window, which is the only thing the column feeds
+// besides its own display.
+const AccessTokenUseInterval = 30 * time.Second
+
+// ShouldPersistTokenUse reports whether a token's updated_unix is stale enough
+// to be worth writing back. Avoids a DB write on every authenticated request.
+func ShouldPersistTokenUse(last timeutil.TimeStamp, now time.Time) bool {
+	return now.Sub(last.AsTime()) >= AccessTokenUseInterval
+}
+
 // UpdateAccessToken updates information of access token.
 func UpdateAccessToken(ctx context.Context, t *AccessToken) error {
 	_, err := db.GetEngine(ctx).ID(t.ID).AllCols().Update(t)

models/auth/access_token_test.go

@@ -5,15 +5,52 @@ package auth_test
 
 import (
 	"testing"
+	"time"
 
 	auth_model "gitea.dev/models/auth"
 	"gitea.dev/models/db"
 	"gitea.dev/models/unittest"
+	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 )
 
+func TestShouldPersistTokenUse(t *testing.T) {
+	now := time.Now()
+	tests := []struct {
+		name string
+		last timeutil.TimeStamp
+		want bool
+	}{
+		{
+			name: "fresh, skip write",
+			last: timeutil.TimeStamp(now.Add(-5 * time.Second).Unix()),
+			want: false,
+		},
+		{
+			name: "exactly at interval, write",
+			last: timeutil.TimeStamp(now.Add(-auth_model.AccessTokenUseInterval).Unix()),
+			want: true,
+		},
+		{
+			name: "stale, write",
+			last: timeutil.TimeStamp(now.Add(-2 * auth_model.AccessTokenUseInterval).Unix()),
+			want: true,
+		},
+		{
+			name: "zero (never used), write",
+			last: 0,
+			want: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, auth_model.ShouldPersistTokenUse(tt.last, now))
+		})
+	}
+}
+
 func TestNewAccessToken(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 	token := &auth_model.AccessToken{

services/auth/basic.go

@@ -7,6 +7,7 @@ package auth
 import (
 	"errors"
 	"net/http"
+	"time"
 
 	actions_model "gitea.dev/models/actions"
 	auth_model "gitea.dev/models/auth"
@@ -96,9 +97,11 @@ func (b *Basic) VerifyAuthToken(req *http.Request, w http.ResponseWriter, store
 			return nil, err
 		}
 
-		token.UpdatedUnix = timeutil.TimeStampNow()
-		if err = auth_model.UpdateAccessToken(req.Context(), token); err != nil {
-			log.Error("UpdateAccessToken:  %v", err)
+		if auth_model.ShouldPersistTokenUse(token.UpdatedUnix, time.Now()) {
+			token.UpdatedUnix = timeutil.TimeStampNow()
+			if err = auth_model.UpdateAccessToken(req.Context(), token); err != nil {
+				log.Error("UpdateAccessToken:  %v", err)
+			}
 		}
 
 		store.GetData()["LoginMethod"] = AccessTokenMethodName

services/auth/oauth2.go

@@ -136,9 +136,11 @@ func (o *OAuth2) userFromToken(ctx context.Context, tokenSHA string, store DataS
 		return nil, err
 	}
 
-	t.UpdatedUnix = timeutil.TimeStampNow()
-	if err = auth_model.UpdateAccessToken(ctx, t); err != nil {
-		log.Error("UpdateAccessToken: %v", err)
+	if auth_model.ShouldPersistTokenUse(t.UpdatedUnix, time.Now()) {
+		t.UpdatedUnix = timeutil.TimeStampNow()
+		if err = auth_model.UpdateAccessToken(ctx, t); err != nil {
+			log.Error("UpdateAccessToken: %v", err)
+		}
 	}
 	store.GetData()["ApiTokenScope"] = t.Scope
 	return user_model.GetUserByID(ctx, t.UID)