From f305ab910232c5e858b14c69c8e3a8b584d66c85 Mon Sep 17 00:00:00 2001
From: Denis Arh <denis.arh@gmail.com>
Date: Tue, 22 Mar 2022 18:04:10 +0100
Subject: [PATCH] Make credentials cleanup flow more robust

---
 system/service/auth.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/system/service/auth.go b/system/service/auth.go
index 0ce55e7b5..1e4853cb2 100644
--- a/system/service/auth.go
+++ b/system/service/auth.go
@@ -1210,8 +1210,8 @@ func (svc auth) cleanupCredentials(ctx context.Context, s store.Credentials, cc
 			update = append(update, c)
 
 		case false, // just a placeholder
-			c.DeletedAt.Add(tokenReqMaxWindow).Before(*now()),
-			c.ExpiresAt.Before(*now()):
+			(c.DeletedAt != nil && c.DeletedAt.Add(tokenReqMaxWindow).Before(*now())),
+			(c.ExpiresAt != nil && c.ExpiresAt.Before(*now())):
 			// schedule all soft-deleted and expired token
 			// for removal
 			remove = append(remove, c)