From fcf660b7d9e1d39628aaf7f5afd75571d6c2c3d3 Mon Sep 17 00:00:00 2001 From: Vishnu Narayanan Date: Sat, 23 May 2026 15:06:18 +0530 Subject: [PATCH] fix: evict untracked legacy tokens before tracked sessions During the rollout window, tracked sessions are newer than any pre-existing legacy tokens. The previous logic walked user_sessions first and would kill the only tracked session while leaving older legacy tokens alive. Drop untracked tokens first when there is a gap between user_sessions count and user.tokens size. --- app/controllers/devise_overrides/sessions_controller.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/app/controllers/devise_overrides/sessions_controller.rb b/app/controllers/devise_overrides/sessions_controller.rb index 76c3bbac5..f962e7ffd 100644 --- a/app/controllers/devise_overrides/sessions_controller.rb +++ b/app/controllers/devise_overrides/sessions_controller.rb @@ -172,6 +172,10 @@ class DeviseOverrides::SessionsController < DeviseTokenAuth::SessionsController end def evict_oldest_session(user) + # Untracked tokens are pre-rollout leftovers and almost always older than any + # tracked session; drop those first so freshly tracked logins aren't evicted. + return evict_oldest_token(user) if user.user_sessions.count < user.tokens.size + oldest_session = user.user_sessions.order(Arel.sql('COALESCE(last_activity_at, created_at) ASC')).first return evict_oldest_token(user) unless oldest_session