refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

* refactor(auth): replace dashboard sessions with stateless tokens

* feat(auth): harden session issuance and distributed enforcement

* fix(proxy): preserve trusted proxy compatibility defaults

* refactor: address dashboard auth review feedback

* refactor: remove classic frontend and flatten web app

service/auth_cleanup.go

@@ -0,0 +1,51 @@
+package service
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/QuantumNous/new-api/common"
+	"github.com/QuantumNous/new-api/model"
+)
+
+const authArtifactCleanupInterval = time.Hour
+
+// StartAuthArtifactCleanup removes expired dashboard Sessions and old
+// one-time authentication flows. Only the master instance performs cleanup.
+func StartAuthArtifactCleanup() {
+	if !common.IsMasterNode {
+		return
+	}
+	go func() {
+		cleanupAuthArtifacts()
+		ticker := time.NewTicker(authArtifactCleanupInterval)
+		defer ticker.Stop()
+		for range ticker.C {
+			cleanupAuthArtifacts()
+		}
+	}()
+}
+
+func cleanupAuthArtifacts() {
+	now := time.Now()
+	count, err := model.CountUserSessionsCreatedSince(0, now.Add(-time.Hour).Unix())
+	if err != nil {
+		common.SysError("failed to count hourly user session issuance: " + err.Error())
+	} else if count > int64(common.UserSessionHourlyAlertThreshold) {
+		common.SysError(fmt.Sprintf(
+			"hourly user session issuance exceeded alert threshold: count=%d threshold=%d window_seconds=%d",
+			count,
+			common.UserSessionHourlyAlertThreshold,
+			int64(time.Hour/time.Second),
+		))
+	}
+	if err := model.DeleteExpiredUserSessions(now.Unix()); err != nil {
+		common.SysError("failed to delete expired user sessions: " + err.Error())
+	}
+	if err := model.DeleteOldRevokedUserSessions(now.Unix()); err != nil {
+		common.SysError("failed to delete old revoked user sessions: " + err.Error())
+	}
+	if err := model.DeleteExpiredAuthFlows(now); err != nil {
+		common.SysError("failed to delete expired authentication flows: " + err.Error())
+	}
+}