refactor: use biz layer Revoke in stale token revoker

Rename repo RevokeInactive to FindInactive (query-only) and have the
stale revoker call APITokenUseCase.Revoke per token so audit events
are properly dispatched.

Signed-off-by: Miguel Martinez <miguel@chainloop.dev>

Author: migmartri

app/controlplane/cmd/wire_gen.go

@@ -62,10 +62,9 @@ type APITokenRepo interface {
 	Create(ctx context.Context, name string, description *string, expiresAt *time.Time, organizationID *uuid.UUID, projectID *uuid.UUID, policies []*authz.Policy) (*APIToken, error)
 	List(ctx context.Context, orgID *uuid.UUID, filters *APITokenListFilters) ([]*APIToken, error)
 	Revoke(ctx context.Context, orgID *uuid.UUID, ID uuid.UUID) error
-	// RevokeInactive bulk-revokes tokens in an organization that have been inactive since the given cutoff time.
+	// FindInactive returns tokens in an organization that have been inactive since the given cutoff time.
 	// A token is considered inactive if its last_used_at (or created_at, if never used) is before inactiveSince.
-	// Returns the list of tokens that were revoked.
-	RevokeInactive(ctx context.Context, orgID uuid.UUID, inactiveSince time.Time) ([]*APIToken, error)
+	FindInactive(ctx context.Context, orgID uuid.UUID, inactiveSince time.Time) ([]*APIToken, error)
 	UpdateExpiration(ctx context.Context, ID uuid.UUID, expiresAt time.Time) error
 	UpdateLastUsedAt(ctx context.Context, ID uuid.UUID, lastUsedAt time.Time) error
 	FindByID(ctx context.Context, ID uuid.UUID) (*APIToken, error)

app/controlplane/pkg/biz/apitoken.go

@@ -32,6 +32,7 @@ type APITokenStaleRevoker struct {
 	logger    *log.Helper
 	orgRepo   OrganizationRepo
 	tokenRepo APITokenRepo
+	tokenUC   *APITokenUseCase
 }
 
 // APITokenStaleRevokerOpts configures the sweeper's behavior.
@@ -43,11 +44,12 @@ type APITokenStaleRevokerOpts struct {
 }
 
 // NewAPITokenStaleRevoker creates a new stale token revoker.
-func NewAPITokenStaleRevoker(orgRepo OrganizationRepo, tokenRepo APITokenRepo, logger log.Logger) *APITokenStaleRevoker {
+func NewAPITokenStaleRevoker(orgRepo OrganizationRepo, tokenRepo APITokenRepo, tokenUC *APITokenUseCase, logger log.Logger) *APITokenStaleRevoker {
 	return &APITokenStaleRevoker{
 		logger:    log.NewHelper(log.With(logger, "component", "biz/APITokenStaleRevoker")),
 		orgRepo:   orgRepo,
 		tokenRepo: tokenRepo,
+		tokenUC:   tokenUC,
 	}
 }
 
@@ -122,16 +124,25 @@ func (r *APITokenStaleRevoker) Sweep(ctx context.Context) error {
 		}
 
 		cutoff := now.Add(-time.Duration(*org.APITokenInactivityThresholdDays) * 24 * time.Hour)
-		revoked, err := r.tokenRepo.RevokeInactive(ctx, orgID, cutoff)
+		staleTokens, err := r.tokenRepo.FindInactive(ctx, orgID, cutoff)
 		if err != nil {
-			r.logger.Errorf("revoking stale tokens for org %s (%s): %v", org.Name, org.ID, err)
+			r.logger.Errorf("finding stale tokens for org %s (%s): %v", org.Name, org.ID, err)
 			continue
 		}
 
-		if len(revoked) > 0 {
+		var revokedCount int
+		for _, token := range staleTokens {
+			if err := r.tokenUC.Revoke(ctx, org.ID, token.ID.String()); err != nil {
+				r.logger.Errorf("revoking token %s in org %s: %v", token.ID, org.ID, err)
+				continue
+			}
+			revokedCount++
+		}
+
+		if revokedCount > 0 {
 			r.logger.Infow("msg", "revoked stale API tokens",
 				"org", org.Name, "orgID", org.ID,
-				"count", len(revoked),
+				"count", revokedCount,
 				"thresholdDays", *org.APITokenInactivityThresholdDays,
 			)
 		}

app/controlplane/pkg/biz/apitoken_stale_revoker.go

@@ -46,7 +46,7 @@ func (s *staleRevokerTestSuite) SetupTest() {
 	ctx := context.Background()
 
 	s.TestingUseCases = testhelpers.NewTestingUseCases(t)
-	s.revoker = biz.NewAPITokenStaleRevoker(s.Repos.OrganizationRepo, s.Repos.APITokenRepo, s.L)
+	s.revoker = biz.NewAPITokenStaleRevoker(s.Repos.OrganizationRepo, s.Repos.APITokenRepo, s.APIToken, s.L)
 
 	var err error
 	s.user, err = s.User.UpsertByEmail(ctx, "revoker-test@test.com", nil)

app/controlplane/pkg/biz/apitoken_stale_revoker_integration_test.go

@@ -163,11 +163,8 @@ func (r *APITokenRepo) Revoke(ctx context.Context, orgID *uuid.UUID, id uuid.UUI
 	return nil
 }
 
-// RevokeInactive bulk-revokes tokens that have been inactive since the given cutoff.
-func (r *APITokenRepo) RevokeInactive(ctx context.Context, orgID uuid.UUID, inactiveSince time.Time) ([]*biz.APIToken, error) {
-	now := time.Now()
-
-	// Find matching tokens: not revoked, and inactive since the cutoff
+// FindInactive returns tokens that have been inactive since the given cutoff.
+func (r *APITokenRepo) FindInactive(ctx context.Context, orgID uuid.UUID, inactiveSince time.Time) ([]*biz.APIToken, error) {
 	// A token is inactive if last_used_at < inactiveSince (when used before),
 	// or created_at < inactiveSince (when never used).
 	tokens, err := r.data.DB.APIToken.Query().
@@ -186,25 +183,6 @@ func (r *APITokenRepo) RevokeInactive(ctx context.Context, orgID uuid.UUID, inac
 		return nil, fmt.Errorf("querying inactive tokens: %w", err)
 	}
 
-	if len(tokens) == 0 {
-		return nil, nil
-	}
-
-	// Collect IDs for bulk update
-	ids := make([]uuid.UUID, 0, len(tokens))
-	for _, t := range tokens {
-		ids = append(ids, t.ID)
-	}
-
-	// Bulk revoke
-	if err := r.data.DB.APIToken.Update().
-		Where(apitoken.IDIn(ids...)).
-		SetRevokedAt(now).
-		Exec(ctx); err != nil {
-		return nil, fmt.Errorf("bulk revoking inactive tokens: %w", err)
-	}
-
-	// Return the revoked tokens
 	result := make([]*biz.APIToken, 0, len(tokens))
 	for _, t := range tokens {
 		result = append(result, entAPITokenToBiz(t))