fix #557: guide permission-driven VPD flow

src/main/resources/mapper/BearerTokenMapper.xml

@@ -7,6 +7,8 @@
            k.expires_at, k.revoked_at, k.description
     FROM cb_agent_bearer_key k
     JOIN cb_app_user u ON u.user_id = k.user_id
+    WHERE #{includeInactive} = 1
+       OR (k.revoked_at IS NULL AND k.expires_at > SYSTIMESTAMP)
     ORDER BY k.key_id DESC
   </select>