feat(mcp): repository RevokeBySession + ReapStaleSystemTokens + PurgeExpired

internal/mcp/repository.go

@@ -209,16 +209,36 @@ func (r *pgRepo) Revoke(ctx context.Context, id uuid.UUID) (uuid.UUID, error) {
 	return fromPgUUID(row), nil
 }
 
-func (r *pgRepo) RevokeBySession(_ context.Context, _ uuid.UUID) ([]uuid.UUID, error) {
+func (r *pgRepo) RevokeBySession(ctx context.Context, sessionID uuid.UUID) ([]uuid.UUID, error) {
-	panic("not implemented: RevokeBySession")
+	rows, err := r.q.RevokeMcpTokensBySession(ctx, toPgUUID(sessionID))
+	if err != nil {
+		return nil, errs.Wrap(err, errs.CodeInternal, "revoke mcp_tokens by session")
+	}
+	out := make([]uuid.UUID, 0, len(rows))
+	for _, row := range rows {
+		out = append(out, fromPgUUID(row))
+	}
+	return out, nil
 }
 
-func (r *pgRepo) ReapStaleSystemTokens(_ context.Context) ([]uuid.UUID, error) {
+func (r *pgRepo) ReapStaleSystemTokens(ctx context.Context) ([]uuid.UUID, error) {
-	panic("not implemented: ReapStaleSystemTokens")
+	rows, err := r.q.ReapStaleSystemTokens(ctx)
+	if err != nil {
+		return nil, errs.Wrap(err, errs.CodeInternal, "reap stale system tokens")
+	}
+	out := make([]uuid.UUID, 0, len(rows))
+	for _, row := range rows {
+		out = append(out, fromPgUUID(row))
+	}
+	return out, nil
 }
 
-func (r *pgRepo) PurgeExpired(_ context.Context, _ time.Time) (int64, error) {
+func (r *pgRepo) PurgeExpired(ctx context.Context, before time.Time) (int64, error) {
-	panic("not implemented: PurgeExpired")
+	n, err := r.q.PurgeMcpTokensExpired(ctx, pgtype.Timestamptz{Time: before, Valid: true})
+	if err != nil {
+		return 0, errs.Wrap(err, errs.CodeInternal, "purge expired mcp_tokens")
+	}
+	return n, nil
 }
 
 func (r *pgRepo) DeleteByID(ctx context.Context, id uuid.UUID) error {