feat: limit concurrent sessions per user with active session management (CW-7169)

app/controllers/api/v1/profile/sessions_controller.rb

@@ -0,0 +1,31 @@
+class Api::V1::Profile::SessionsController < Api::BaseController
+  before_action :set_session, only: [:destroy]
+
+  def index
+    @sessions = current_user.user_sessions.order(last_activity_at: :desc)
+    @current_client_id = request.headers['client']
+  end
+
+  def destroy
+    if @session.current?(request.headers['client'])
+      render json: { error: I18n.t('profile_settings.sessions.cannot_revoke_current') }, status: :unprocessable_entity
+      return
+    end
+
+    revoke_token!(@session.client_id)
+    @session.destroy!
+    head :ok
+  end
+
+  private
+
+  def set_session
+    @session = current_user.user_sessions.find(params[:id])
+  end
+
+  def revoke_token!(client_id)
+    tokens = current_user.tokens
+    tokens.delete(client_id)
+    current_user.update!(tokens: tokens)
+  end
+end

app/controllers/application_controller.rb

@@ -3,6 +3,7 @@ class ApplicationController < ActionController::Base
   include RequestExceptionHandler
   include Pundit::Authorization
   include SwitchLocale
+  include TrackSessionActivity
 
   skip_before_action :verify_authenticity_token
 

app/controllers/concerns/track_session_activity.rb

@@ -0,0 +1,22 @@
+module TrackSessionActivity
+  extend ActiveSupport::Concern
+
+  included do
+    after_action :update_session_activity
+  end
+
+  private
+
+  def update_session_activity
+    return unless current_user
+    return if request.headers['client'].blank?
+
+    UserSessionTrackingService.new(
+      user: current_user,
+      request: request,
+      client_id: request.headers['client']
+    ).update_activity!
+  rescue StandardError => e
+    Rails.logger.warn "Session activity update failed: #{e.message}"
+  end
+end

app/controllers/devise_overrides/sessions_controller.rb

@@ -1,4 +1,6 @@
 class DeviseOverrides::SessionsController < DeviseTokenAuth::SessionsController
+  MAX_SESSIONS = 5
+
   # Prevent session parameter from being passed
   # Unpermitted parameter: session
   wrap_parameters format: []
@@ -14,12 +16,14 @@ class DeviseOverrides::SessionsController < DeviseTokenAuth::SessionsController
 
     user = find_user_for_authentication
     return handle_mfa_required(user) if user&.mfa_enabled?
+    return if user && enforce_session_limit_for_password_login(user)
 
     # Only proceed with standard authentication if no MFA is required
     super
   end
 
   def render_create_success
+    track_user_session
     render partial: 'devise/auth', formats: [:json], locals: { resource: @resource }
   end
 
@@ -53,6 +57,8 @@ class DeviseOverrides::SessionsController < DeviseTokenAuth::SessionsController
   end
 
   def handle_sso_authentication
+    return if enforce_session_limit_for_password_login(@resource)
+
     authenticate_resource_with_sso_token
     yield @resource if block_given?
     render_create_success
@@ -103,6 +109,7 @@ class DeviseOverrides::SessionsController < DeviseTokenAuth::SessionsController
   end
 
   def sign_in_mfa_user(user)
+    evict_oldest_session(user) if sessions_limit_reached?(user)
     @resource = user
     @token = @resource.create_token
     @resource.save!
@@ -114,6 +121,109 @@ class DeviseOverrides::SessionsController < DeviseTokenAuth::SessionsController
   def render_mfa_error(message_key, status = :bad_request)
     render json: { error: I18n.t(message_key) }, status: status
   end
+
+  def sessions_limit_reached?(user)
+    (user.tokens || {}).keys.size >= MAX_SESSIONS
+  end
+
+  # Returns true when the response has been rendered (e.g., 409 picker shown). Browsers see
+  # the picker; non-browser clients (mobile, API) auto-evict so they don't get stuck on a UI
+  # they can't render. If the user is revoking, perform the revoke and let login proceed.
+  def enforce_session_limit_for_password_login(user)
+    if revoking_sessions?
+      revoke_sessions_for_login(user)
+      return false
+    end
+
+    return false unless sessions_limit_reached?(user)
+
+    if browser_request?
+      handle_sessions_limit_for_login(user)
+      true
+    else
+      evict_oldest_session(user)
+      false
+    end
+  end
+
+  def browser_request?
+    request.user_agent.to_s.include?('Mozilla')
+  end
+
+  def revoking_sessions?
+    params[:revoke_session_id].present? || params[:revoke_all_sessions].present?
+  end
+
+  def revoke_sessions_for_login(user)
+    if params[:revoke_all_sessions].present?
+      user.tokens = {}
+      user.save!
+      user.user_sessions.destroy_all
+    elsif params[:revoke_session_id].present?
+      session = user.user_sessions.find_by(id: params[:revoke_session_id])
+      return unless session
+
+      user.tokens.delete(session.client_id)
+      user.save!
+      session.destroy!
+    end
+  end
+
+  def evict_oldest_session(user)
+    oldest_session = user.user_sessions.order(Arel.sql('COALESCE(last_activity_at, created_at) ASC')).first
+    return evict_oldest_token(user) unless oldest_session
+
+    user.tokens.delete(oldest_session.client_id)
+    user.save!
+    oldest_session.destroy!
+  end
+
+  # Fallback if a token exists without a UserSession row (e.g., legacy data before tracking shipped).
+  def evict_oldest_token(user)
+    return if user.tokens.blank?
+
+    oldest_client_id = user.tokens.min_by { |_, v| v['expiry'].to_i }&.first
+    return unless oldest_client_id
+
+    user.tokens.delete(oldest_client_id)
+    user.save!
+  end
+
+  def handle_sessions_limit_for_login(user)
+    sessions = user.user_sessions.order(last_activity_at: :desc).map do |session|
+      {
+        id: session.id,
+        browser_name: session.browser_name,
+        browser_version: session.browser_version,
+        device_name: session.device_name,
+        platform_name: session.platform_name,
+        platform_version: session.platform_version,
+        ip_address: session.ip_address,
+        city: session.city,
+        country: session.country,
+        last_activity_at: session.last_activity_at,
+        created_at: session.created_at
+      }
+    end
+
+    render json: {
+      sessions_limit_reached: true,
+      sessions: sessions
+    }, status: :conflict
+  end
+
+  def track_user_session
+    client_id = @token&.try(:client) || response.headers['client']
+    return unless client_id.present? && @resource.present?
+
+    UserSessionTrackingService.new(
+      user: @resource,
+      request: request,
+      client_id: client_id
+    ).create_or_update!
+  rescue StandardError => e
+    Rails.logger.warn "Session tracking failed: #{e.message}"
+  end
 end
 
 DeviseOverrides::SessionsController.prepend_mod_with('DeviseOverrides::SessionsController')

app/javascript/dashboard/api/auth.js

@@ -106,4 +106,10 @@ export default {
     const urlData = endPoints('resetAccessToken');
     return axios.post(urlData.url);
   },
+  getSessions() {
+    return axios.get('/api/v1/profile/sessions');
+  },
+  revokeSession(id) {
+    return axios.delete(`/api/v1/profile/sessions/${id}`);
+  },
 };

app/javascript/dashboard/components/auth/SessionLimitOverlay.vue

@@ -0,0 +1,133 @@
+<script setup>
+import { ref, computed } from 'vue';
+import { useI18n } from 'vue-i18n';
+import { format, parseISO } from 'date-fns';
+
+import Icon from 'dashboard/components-next/icon/Icon.vue';
+import NextButton from 'dashboard/components-next/button/Button.vue';
+
+const props = defineProps({
+  sessions: {
+    type: Array,
+    required: true,
+  },
+});
+
+const emit = defineEmits(['revoke', 'revokeAll', 'cancel']);
+
+const { t } = useI18n();
+const revokingId = ref(null);
+const revokingAll = ref(false);
+
+const sortedSessions = computed(() =>
+  [...props.sessions].sort(
+    (a, b) => new Date(b.created_at) - new Date(a.created_at)
+  )
+);
+
+const formatDate = dateStr => {
+  if (!dateStr) return '';
+  return format(parseISO(dateStr), 'MMMM d, yyyy');
+};
+
+const formatTime = dateStr => {
+  if (!dateStr) return '';
+  return format(parseISO(dateStr), 'hh:mma');
+};
+
+const isUnknown = val => !val || val === 'Unknown' || val === 'Unknown Browser';
+
+const sessionLabel = session => {
+  const parts = [];
+  if (!isUnknown(session.browser_name)) parts.push(session.browser_name);
+  if (!isUnknown(session.platform_name)) parts.push(session.platform_name);
+  return parts.join(' on ') || t('SESSION_LIMIT.UNKNOWN_DEVICE');
+};
+
+const handleRevoke = session => {
+  revokingId.value = session.id;
+  emit('revoke', session.id);
+};
+
+const handleRevokeAll = () => {
+  revokingAll.value = true;
+  emit('revokeAll');
+};
+</script>
+
+<template>
+  <div class="w-full max-w-lg mx-auto">
+    <div
+      class="bg-white shadow dark:bg-n-solid-2 p-11 sm:shadow-lg sm:rounded-lg"
+    >
+      <!-- Header -->
+      <div class="flex items-start justify-between gap-4 mb-6">
+        <div>
+          <h2 class="text-2xl font-semibold text-n-slate-12">
+            {{ $t('SESSION_LIMIT.TITLE') }}
+          </h2>
+          <p class="text-sm text-n-slate-11 mt-2">
+            {{ $t('SESSION_LIMIT.DESCRIPTION') }}
+          </p>
+        </div>
+        <NextButton
+          type="button"
+          faded
+          sm
+          class="flex-shrink-0 whitespace-nowrap"
+          :label="$t('SESSION_LIMIT.END_ALL')"
+          :is-loading="revokingAll"
+          :disabled="revokingId !== null"
+          @click="handleRevokeAll"
+        />
+      </div>
+
+      <!-- Session List -->
+      <div class="flex flex-col gap-3 max-h-80 overflow-y-auto">
+        <div
+          v-for="session in sortedSessions"
+          :key="session.id"
+          class="flex items-center justify-between gap-4 rounded-xl border border-n-slate-4 bg-n-background px-4 py-3"
+        >
+          <div class="flex items-center gap-3 min-w-0">
+            <Icon
+              icon="i-lucide-monitor"
+              class="size-4 text-n-slate-10 flex-shrink-0"
+            />
+            <div class="flex flex-col gap-0.5 min-w-0">
+              <span class="text-sm font-medium text-n-slate-12">
+                {{ sessionLabel(session) }}
+              </span>
+              <span class="text-xs text-n-slate-10">
+                {{
+                  `${$t('SESSION_LIMIT.STARTED')} ${formatDate(session.created_at)}, ${formatTime(session.created_at)}`
+                }}
+              </span>
+            </div>
+          </div>
+          <button
+            type="button"
+            class="text-sm font-medium text-n-slate-11 hover:text-n-slate-12 flex-shrink-0 disabled:opacity-50"
+            :disabled="revokingId !== null || revokingAll"
+            @click="handleRevoke(session)"
+          >
+            {{ $t('SESSION_LIMIT.END') }}
+          </button>
+        </div>
+      </div>
+
+      <!-- Cancel -->
+      <div class="text-center pt-4">
+        <NextButton
+          sm
+          slate
+          link
+          type="button"
+          class="w-full hover:!no-underline"
+          :label="$t('SESSION_LIMIT.CANCEL')"
+          @click="() => emit('cancel')"
+        />
+      </div>
+    </div>
+  </div>
+</template>

app/javascript/dashboard/i18n/locale/en/index.js

@@ -40,6 +40,7 @@ import whatsappTemplates from './whatsappTemplates.json';
 import contentTemplates from './contentTemplates.json';
 import mfa from './mfa.json';
 import onboarding from './onboarding.json';
+import sessionLimit from './sessionLimit.json';
 import yearInReview from './yearInReview.json';
 
 export default {
@@ -85,5 +86,6 @@ export default {
   ...contentTemplates,
   ...mfa,
   ...onboarding,
+  ...sessionLimit,
   ...yearInReview,
 };

app/javascript/dashboard/i18n/locale/en/sessionLimit.json

@@ -0,0 +1,12 @@
+{
+  "SESSION_LIMIT": {
+    "TITLE": "Active session limit reached",
+    "DESCRIPTION": "You have reached your limit of active sessions. Please end a session before logging in.",
+    "END": "End",
+    "END_ALL": "End all sessions",
+    "LOG_IN": "Log in",
+    "CANCEL": "Back to login",
+    "UNKNOWN_DEVICE": "Unknown device",
+    "STARTED": "Started"
+  }
+}

app/javascript/dashboard/i18n/locale/en/settings.json

@@ -86,6 +86,16 @@
         "NOTE": "Manage additional security features for your account.",
         "MFA_BUTTON": "Manage Two-Factor Authentication"
       },
+      "SESSIONS_SECTION": {
+        "TITLE": "Active Sessions",
+        "NOTE": "These are the devices currently logged in to your account.",
+        "CURRENT": "Current session",
+        "REVOKE": "Revoke",
+        "REVOKE_SUCCESS": "Session revoked successfully",
+        "REVOKE_ERROR": "Unable to revoke session. Please try again.",
+        "FETCH_ERROR": "Unable to fetch sessions. Please try again.",
+        "LAST_ACTIVE": "Last active"
+      },
       "ACCESS_TOKEN": {
         "TITLE": "Access Token",
         "NOTE": "This token can be used if you are building an API based integration",

app/javascript/dashboard/routes/dashboard/settings/profile/ActiveSessions.vue

@@ -0,0 +1,131 @@
+<script setup>
+import { ref, onMounted } from 'vue';
+import { useI18n } from 'vue-i18n';
+import { formatDistanceToNow, parseISO } from 'date-fns';
+import { useAlert } from 'dashboard/composables';
+import authAPI from 'dashboard/api/auth';
+import Icon from 'dashboard/components-next/icon/Icon.vue';
+import Button from 'dashboard/components-next/button/Button.vue';
+
+const { t } = useI18n();
+const sessions = ref([]);
+const loading = ref(false);
+
+const relativeTime = dateStr => {
+  if (!dateStr) return '';
+  return formatDistanceToNow(parseISO(dateStr), { addSuffix: true });
+};
+
+const isUnknown = val => !val || val === 'Unknown' || val === 'Unknown Browser';
+
+const deviceIcon = session => {
+  const name = (session.device_name || '').toLowerCase();
+  if (
+    name.includes('iphone') ||
+    name.includes('android') ||
+    name.includes('mobile')
+  ) {
+    return 'i-lucide-smartphone';
+  }
+  if (name.includes('ipad') || name.includes('tablet')) {
+    return 'i-lucide-tablet';
+  }
+  return 'i-lucide-monitor';
+};
+
+const sessionLabel = session => {
+  const parts = [];
+  if (!isUnknown(session.browser_name)) {
+    parts.push(
+      session.browser_version
+        ? `${session.browser_name} ${session.browser_version}`
+        : session.browser_name
+    );
+  }
+  if (!isUnknown(session.platform_name)) parts.push(session.platform_name);
+  return parts.join(' on ') || t('SESSION_LIMIT.UNKNOWN_DEVICE');
+};
+
+const locationLabel = session => {
+  const parts = [];
+  if (session.city) parts.push(session.city);
+  if (session.country) parts.push(session.country);
+  return parts.join(', ');
+};
+
+const fetchSessions = async () => {
+  loading.value = true;
+  try {
+    const { data } = await authAPI.getSessions();
+    sessions.value = data;
+  } catch {
+    useAlert(t('PROFILE_SETTINGS.FORM.SESSIONS_SECTION.FETCH_ERROR'));
+  } finally {
+    loading.value = false;
+  }
+};
+
+const revokeSession = async session => {
+  try {
+    await authAPI.revokeSession(session.id);
+    sessions.value = sessions.value.filter(s => s.id !== session.id);
+    useAlert(t('PROFILE_SETTINGS.FORM.SESSIONS_SECTION.REVOKE_SUCCESS'));
+  } catch {
+    useAlert(t('PROFILE_SETTINGS.FORM.SESSIONS_SECTION.REVOKE_ERROR'));
+  }
+};
+
+onMounted(fetchSessions);
+</script>
+
+<template>
+  <div class="flex flex-col gap-3">
+    <div
+      v-for="session in sessions"
+      :key="session.id"
+      class="flex items-center justify-between gap-4 rounded-xl border border-n-slate-4 bg-n-background p-4"
+    >
+      <div class="flex items-start gap-3">
+        <Icon
+          :icon="deviceIcon(session)"
+          class="size-5 mt-0.5 text-n-slate-10 flex-shrink-0"
+        />
+        <div class="flex flex-col gap-1">
+          <div class="flex items-center gap-2">
+            <span class="text-heading-3 text-n-slate-12">
+              {{ sessionLabel(session) }}
+            </span>
+            <span
+              v-if="session.current"
+              class="rounded-full bg-n-teal-3 px-2 py-0.5 text-caption text-n-teal-11"
+            >
+              {{ $t('PROFILE_SETTINGS.FORM.SESSIONS_SECTION.CURRENT') }}
+            </span>
+          </div>
+          <span
+            v-if="locationLabel(session)"
+            class="text-body-b3 text-n-slate-11"
+          >
+            {{ locationLabel(session) }}
+          </span>
+          <span
+            v-if="session.last_activity_at"
+            class="text-body-b3 text-n-slate-10"
+          >
+            {{ $t('PROFILE_SETTINGS.FORM.SESSIONS_SECTION.LAST_ACTIVE') }}
+            {{ relativeTime(session.last_activity_at) }}
+          </span>
+        </div>
+      </div>
+      <Button
+        v-if="!session.current"
+        type="button"
+        faded
+        xs
+        :label="$t('PROFILE_SETTINGS.FORM.SESSIONS_SECTION.REVOKE')"
+        color-scheme="alert"
+        @click="revokeSession(session)"
+      />
+    </div>
+  </div>
+</template>

app/javascript/dashboard/routes/dashboard/settings/profile/Index.vue

@@ -20,6 +20,7 @@ import SectionLayout from '../account/components/SectionLayout.vue';
 import BaseSettingsHeader from '../components/BaseSettingsHeader.vue';
 import AccessToken from './AccessToken.vue';
 import MfaSettingsCard from './MfaSettingsCard.vue';
+import ActiveSessions from './ActiveSessions.vue';
 import Policy from 'dashboard/components/policy.vue';
 import RadioCard from 'dashboard/components-next/radioCard/RadioCard.vue';
 import {
@@ -42,6 +43,7 @@ export default {
     AudioNotifications,
     AccessToken,
     MfaSettingsCard,
+    ActiveSessions,
     BaseSettingsHeader,
   },
   setup() {
@@ -307,6 +309,13 @@ export default {
     >
       <MfaSettingsCard />
     </SectionLayout>
+    <SectionLayout
+      with-border
+      :title="$t('PROFILE_SETTINGS.FORM.SESSIONS_SECTION.TITLE')"
+      :description="$t('PROFILE_SETTINGS.FORM.SESSIONS_SECTION.NOTE')"
+    >
+      <ActiveSessions />
+    </SectionLayout>
     <Policy :permissions="audioNotificationPermissions">
       <SectionLayout
         with-border

app/javascript/v3/api/auth.js

@@ -43,6 +43,15 @@ export const login = async ({
         mfaToken: error.response.data.mfa_token,
       };
     }
+    if (
+      error.response?.status === 409 &&
+      error.response?.data?.sessions_limit_reached
+    ) {
+      return {
+        sessionsLimitReached: true,
+        sessions: error.response.data.sessions,
+      };
+    }
     const loginError = new Error(parseAPIErrorResponse(error));
     loginError.errorCode = error.response?.data?.error_code;
     throw loginError;

app/javascript/v3/views/login/Index.vue

@@ -17,6 +17,7 @@ import Spinner from 'shared/components/Spinner.vue';
 import Icon from 'dashboard/components-next/icon/Icon.vue';
 import NextButton from 'dashboard/components-next/button/Button.vue';
 import MfaVerification from 'dashboard/components/auth/MfaVerification.vue';
+import SessionLimitOverlay from 'dashboard/components/auth/SessionLimitOverlay.vue';
 
 const ERROR_MESSAGES = {
   'no-account-found': 'LOGIN.OAUTH.NO_ACCOUNT_FOUND',
@@ -36,6 +37,7 @@ export default {
     NextButton,
     SimpleDivider,
     MfaVerification,
+    SessionLimitOverlay,
     Icon,
   },
   props: {
@@ -68,6 +70,8 @@ export default {
       error: '',
       mfaRequired: false,
       mfaToken: null,
+      sessionsLimitReached: false,
+      limitedSessions: [],
     };
   },
   validations() {
@@ -182,6 +186,14 @@ export default {
             return;
           }
 
+          // Check if sessions limit reached
+          if (result?.sessionsLimitReached) {
+            this.loginApi.showLoading = false;
+            this.sessionsLimitReached = true;
+            this.limitedSessions = result.sessions;
+            return;
+          }
+
           this.handleImpersonation();
           this.showAlertMessage(this.$t('LOGIN.API.SUCCESS_MESSAGE'));
         })
@@ -224,6 +236,50 @@ export default {
       this.mfaToken = null;
       this.credentials.password = '';
     },
+    retryLoginWithParams(extraParams) {
+      const credentials = {
+        email: this.email
+          ? decodeURIComponent(this.email)
+          : this.credentials.email,
+        password: this.credentials.password,
+        sso_auth_token: this.ssoAuthToken,
+        ssoAccountId: this.ssoAccountId,
+        ssoConversationId: this.ssoConversationId,
+        ...extraParams,
+      };
+
+      this.sessionsLimitReached = false;
+      this.limitedSessions = [];
+      this.loginApi.showLoading = true;
+      login(credentials)
+        .then(result => {
+          if (result?.sessionsLimitReached) {
+            this.loginApi.showLoading = false;
+            this.sessionsLimitReached = true;
+            this.limitedSessions = result.sessions;
+            return;
+          }
+          this.handleImpersonation();
+          this.showAlertMessage(this.$t('LOGIN.API.SUCCESS_MESSAGE'));
+        })
+        .catch(response => {
+          this.loginApi.hasErrored = true;
+          this.showAlertMessage(
+            response?.message || this.$t('LOGIN.API.UNAUTH')
+          );
+        });
+    },
+    handleSessionRevoke(sessionId) {
+      this.retryLoginWithParams({ revoke_session_id: sessionId });
+    },
+    handleSessionRevokeAll() {
+      this.retryLoginWithParams({ revoke_all_sessions: true });
+    },
+    handleSessionLimitCancel() {
+      this.sessionsLimitReached = false;
+      this.limitedSessions = [];
+      this.credentials.password = '';
+    },
   },
 };
 </script>
@@ -255,8 +311,18 @@ export default {
       </p>
     </section>
 
+    <!-- Session Limit Section -->
+    <section v-if="sessionsLimitReached" class="mt-11">
+      <SessionLimitOverlay
+        :sessions="limitedSessions"
+        @revoke="handleSessionRevoke"
+        @revoke-all="handleSessionRevokeAll"
+        @cancel="handleSessionLimitCancel"
+      />
+    </section>
+
     <!-- MFA Verification Section -->
-    <section v-if="mfaRequired" class="mt-11">
+    <section v-else-if="mfaRequired" class="mt-11">
       <MfaVerification
         :mfa-token="mfaToken"
         @verified="handleMfaVerified"

app/models/user.rb

@@ -101,6 +101,7 @@ class User < ApplicationRecord
   has_many :messages, as: :sender, dependent: :nullify
   has_many :invitees, through: :account_users, class_name: 'User', foreign_key: 'inviter_id', source: :inviter, dependent: :nullify
 
+  has_many :user_sessions, dependent: :destroy
   has_many :custom_filters, dependent: :destroy_async
   has_many :dashboard_apps, dependent: :nullify
   has_many :mentions, dependent: :destroy_async
@@ -118,6 +119,7 @@ class User < ApplicationRecord
 
   before_validation :set_password_and_uid, on: :create
   after_destroy :remove_macros
+  after_save :sync_user_sessions, if: :saved_change_to_tokens?
 
   scope :order_by_full_name, -> { order('lower(name) ASC') }
 
@@ -214,6 +216,11 @@ class User < ApplicationRecord
 
   private
 
+  def sync_user_sessions
+    active_client_ids = (tokens || {}).keys
+    user_sessions.where.not(client_id: active_client_ids).destroy_all
+  end
+
   def remove_macros
     macros.personal.destroy_all
   end

app/models/user_session.rb

@@ -0,0 +1,46 @@
+# == Schema Information
+#
+# Table name: user_sessions
+#
+#  id               :bigint           not null, primary key
+#  browser_name     :string
+#  browser_version  :string
+#  city             :string
+#  country          :string
+#  country_code     :string
+#  device_name      :string
+#  ip_address       :string
+#  last_activity_at :datetime
+#  platform_name    :string
+#  platform_version :string
+#  user_agent       :string
+#  created_at       :datetime         not null
+#  updated_at       :datetime         not null
+#  client_id        :string           not null
+#  user_id          :bigint           not null
+#
+# Indexes
+#
+#  index_user_sessions_on_user_id                (user_id)
+#  index_user_sessions_on_user_id_and_client_id  (user_id,client_id) UNIQUE
+#
+# Foreign Keys
+#
+#  fk_rails_...  (user_id => users.id)
+#
+
+class UserSession < ApplicationRecord
+  ACTIVITY_THROTTLE = 5.minutes
+
+  belongs_to :user
+
+  validates :client_id, presence: true, uniqueness: { scope: :user_id }
+
+  def current?(active_client_id)
+    client_id == active_client_id
+  end
+
+  def should_update_activity?
+    last_activity_at.nil? || last_activity_at < ACTIVITY_THROTTLE.ago
+  end
+end

app/services/user_session_tracking_service.rb

@@ -0,0 +1,42 @@
+class UserSessionTrackingService
+  def initialize(user:, request:, client_id:)
+    @user = user
+    @request = request
+    @client_id = client_id
+  end
+
+  def create_or_update!
+    session = @user.user_sessions.find_or_initialize_by(client_id: @client_id)
+    session.assign_attributes(session_attributes)
+    session.last_activity_at = Time.current
+    session.save!
+    session
+  end
+
+  def update_activity!
+    session = @user.user_sessions.find_by(client_id: @client_id)
+    return unless session&.should_update_activity?
+
+    session.update_columns(last_activity_at: Time.current) # rubocop:disable Rails/SkipsModelValidations
+  end
+
+  private
+
+  def session_attributes
+    browser = Browser.new(@request.user_agent)
+    location = IpLookupService.new.perform(@request.remote_ip)
+
+    {
+      ip_address: @request.remote_ip,
+      user_agent: @request.user_agent,
+      browser_name: browser.name,
+      browser_version: browser.full_version,
+      device_name: browser.device.name,
+      platform_name: browser.platform.name,
+      platform_version: browser.platform.version,
+      city: location&.city,
+      country: location&.country,
+      country_code: location&.country_code
+    }
+  end
+end

app/views/api/v1/profile/sessions/index.json.jbuilder

@@ -0,0 +1,15 @@
+json.array! @sessions do |session|
+  json.id session.id
+  json.browser_name session.browser_name
+  json.browser_version session.browser_version
+  json.device_name session.device_name
+  json.platform_name session.platform_name
+  json.platform_version session.platform_version
+  json.ip_address session.ip_address
+  json.city session.city
+  json.country session.country
+  json.country_code session.country_code
+  json.last_activity_at session.last_activity_at
+  json.created_at session.created_at
+  json.current session.current?(@current_client_id)
+end

config/initializers/devise_token_auth.rb

@@ -15,7 +15,7 @@ DeviseTokenAuth.setup do |config|
 
   # Sets the max number of concurrent devices per user, which is 10 by default.
   # After this limit is reached, the oldest tokens will be removed.
-  config.max_number_of_devices = 25
+  config.max_number_of_devices = 10
 
   # Sometimes it's necessary to make several requests to the API at the same
   # time. In this case, each request in the batch will need to share the same

config/locales/en.yml

@@ -47,6 +47,10 @@ en:
     saml_not_available: SAML authentication is not available in this installation.
     inbox_deletetion_response: Your inbox deletion request will be processed in some time.
 
+  profile_settings:
+    sessions:
+      cannot_revoke_current: You cannot revoke the current session.
+
   errors:
     account:
       reporting_timezone:

config/routes.rb

@@ -433,6 +433,7 @@ Rails.application.routes.draw do
             post :verify
             post :backup_codes
           end
+          resources :sessions, only: [:index, :destroy]
         end
       end
 

db/migrate/20260523000000_create_user_sessions.rb

@@ -0,0 +1,23 @@
+class CreateUserSessions < ActiveRecord::Migration[7.0]
+  def change
+    create_table :user_sessions do |t|
+      t.references :user, null: false, foreign_key: true
+      t.string :client_id, null: false
+      t.string :ip_address
+      t.string :user_agent
+      t.string :browser_name
+      t.string :browser_version
+      t.string :device_name
+      t.string :platform_name
+      t.string :platform_version
+      t.string :city
+      t.string :country
+      t.string :country_code
+      t.datetime :last_activity_at
+
+      t.timestamps
+    end
+
+    add_index :user_sessions, [:user_id, :client_id], unique: true
+  end
+end

db/schema.rb

@@ -1252,6 +1252,26 @@ ActiveRecord::Schema[7.1].define(version: 2026_05_25_093000) do
     t.index ["name", "account_id"], name: "index_teams_on_name_and_account_id", unique: true
   end
 
+  create_table "user_sessions", force: :cascade do |t|
+    t.bigint "user_id", null: false
+    t.string "client_id", null: false
+    t.string "ip_address"
+    t.string "user_agent"
+    t.string "browser_name"
+    t.string "browser_version"
+    t.string "device_name"
+    t.string "platform_name"
+    t.string "platform_version"
+    t.string "city"
+    t.string "country"
+    t.string "country_code"
+    t.datetime "last_activity_at"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["user_id", "client_id"], name: "index_user_sessions_on_user_id_and_client_id", unique: true
+    t.index ["user_id"], name: "index_user_sessions_on_user_id"
+  end
+
   create_table "users", id: :serial, force: :cascade do |t|
     t.string "provider", default: "email", null: false
     t.string "uid", default: "", null: false
@@ -1324,6 +1344,7 @@ ActiveRecord::Schema[7.1].define(version: 2026_05_25_093000) do
   add_foreign_key "active_storage_attachments", "active_storage_blobs", column: "blob_id"
   add_foreign_key "active_storage_variant_records", "active_storage_blobs", column: "blob_id"
   add_foreign_key "inboxes", "portals"
+  add_foreign_key "user_sessions", "users"
   create_trigger("accounts_after_insert_row_tr", :generated => true, :compatibility => 1).
       on("accounts").
       after(:insert).