feat: enforce concurrent session limit with login picker (CW-7169) (#14621)

## Description

Cap active sessions at `MAX_USER_SESSIONS` which defaults to existing
value of `25` per user. This ensure existing user login behavior is not
affected for self-hosted installations. Browser users at the cap see a
session picker (409 response) to choose which session to end.
Non-browser clients and partially-tracked users get silent
oldest-session eviction.

Depends on #14556.

## Type of change

- [x] New feature (non-breaking change which adds functionality)

## How Has This Been Tested?

Specs cover: under limit, at limit (browser picker, non-browser
eviction), partial tracking fallback, revoke single/all sessions during
login, session row creation on successful login.

---------

Co-authored-by: Sony Mathew <sony@chatwoot.com>

This commit is contained in:

Vishnu Narayanan

2026-06-15 17:28:13 +05:30

committed by

GitHub

co-authored by

Sony Mathew

parent ba0ba46c9c

commit 396631ad7d

8 changed files with 476 additions and 3 deletions

									
										app/javascript/dashboard/helper/AnalyticsHelper/events.js
									
		+1
		
												View File
												
				@@ -155,6 +155,7 @@ export const YEAR_IN_REVIEW_EVENTS = Object.freeze({

				});

				export const SESSION_EVENTS = Object.freeze({

				  LIMIT_HIT: 'Session limit reached at login',

				  REVOKED_FROM_PROFILE: 'Revoked an active session',

				});