From 1af8334ea8e229f09f17dcab50d5e3a7201c3718 Mon Sep 17 00:00:00 2001 From: Vishnu Narayanan Date: Sat, 23 May 2026 14:58:06 +0530 Subject: [PATCH] fix: silent-evict legacy tokens when picker would show partial sessions --- app/controllers/devise_overrides/sessions_controller.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/controllers/devise_overrides/sessions_controller.rb b/app/controllers/devise_overrides/sessions_controller.rb index bb93c060c..76c3bbac5 100644 --- a/app/controllers/devise_overrides/sessions_controller.rb +++ b/app/controllers/devise_overrides/sessions_controller.rb @@ -137,7 +137,9 @@ class DeviseOverrides::SessionsController < DeviseTokenAuth::SessionsController return false unless sessions_limit_reached?(user) - if browser_request? + # Picker only when every token has a tracked session; partial tracking would + # show a misleading count, so fall through to silent eviction instead. + if browser_request? && user.user_sessions.count >= user.tokens.size handle_sessions_limit_for_login(user) true else