MM-55320 - Limit length of browser user agent version; ratelimit the /sessions endpoint (#25900)

* add ratelimit to /sessions; cap userAgent version length; tests

* add MaxSessionsLimit; remove oldest session first; tests

* can't use slices in 1.20; improve test

* nits

* add GetLRUSessions; move limiting to CreateSession; remove rate limiting

* use queryBuilder

* mysql needs a limit when using offset

* update i18n

* refactor into limitNumberOfSessions; protect createSessionForUserAccessToken

* add comment to GetLRUSessions

* add limit to oauth path; PR comments

server/channels/store/opentracinglayer/opentracinglayer.go

@@ -8648,6 +8648,24 @@ func (s *OpenTracingLayerSessionStore) Get(c request.CTX, sessionIDOrToken strin
 	return result, err
 }
 
+func (s *OpenTracingLayerSessionStore) GetLRUSessions(c request.CTX, userID string, limit uint64, offset uint64) ([]*model.Session, error) {
+	origCtx := s.Root.Store.Context()
+	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "SessionStore.GetLRUSessions")
+	s.Root.Store.SetContext(newCtx)
+	defer func() {
+		s.Root.Store.SetContext(origCtx)
+	}()
+
+	defer span.Finish()
+	result, err := s.SessionStore.GetLRUSessions(c, userID, limit, offset)
+	if err != nil {
+		span.LogFields(spanlog.Error(err))
+		ext.Error.Set(span, true)
+	}
+
+	return result, err
+}
+
 func (s *OpenTracingLayerSessionStore) GetSessions(c request.CTX, userID string) ([]*model.Session, error) {
 	origCtx := s.Root.Store.Context()
 	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "SessionStore.GetSessions")

server/channels/store/retrylayer/retrylayer.go

@@ -9864,6 +9864,27 @@ func (s *RetryLayerSessionStore) Get(c request.CTX, sessionIDOrToken string) (*m
 
 }
 
+func (s *RetryLayerSessionStore) GetLRUSessions(c request.CTX, userID string, limit uint64, offset uint64) ([]*model.Session, error) {
+
+	tries := 0
+	for {
+		result, err := s.SessionStore.GetLRUSessions(c, userID, limit, offset)
+		if err == nil {
+			return result, nil
+		}
+		if !isRepeatableError(err) {
+			return result, err
+		}
+		tries++
+		if tries >= 3 {
+			err = errors.Wrap(err, "giving up after 3 consecutive repeatable transaction failures")
+			return result, err
+		}
+		timepkg.Sleep(100 * timepkg.Millisecond)
+	}
+
+}
+
 func (s *RetryLayerSessionStore) GetSessions(c request.CTX, userID string) ([]*model.Session, error) {
 
 	tries := 0

server/channels/store/sqlstore/session_store.go

@@ -123,6 +123,28 @@ func (me SqlSessionStore) GetSessions(c request.CTX, userId string) ([]*model.Se
 	return sessions, nil
 }
 
+// GetLRUSessions gets the Least Recently Used sessions from the store. Note: the use of limit and offset
+// are intentional; they are hardcoded from the app layer (i.e., will not result in a non-performant query).
+func (me SqlSessionStore) GetLRUSessions(c request.CTX, userId string, limit uint64, offset uint64) ([]*model.Session, error) {
+	builder := me.getQueryBuilder().
+		Select("*").
+		From("Sessions").
+		Where(sq.Eq{"UserId": userId}).
+		OrderBy("LastActivityAt DESC").
+		Limit(limit).
+		Offset(offset)
+	query, args, err := builder.ToSql()
+	if err != nil {
+		return nil, errors.Wrap(err, "get_lru_sessions_tosql")
+	}
+
+	var sessions []*model.Session
+	if err := me.GetReplicaX().Select(&sessions, query, args...); err != nil {
+		return nil, errors.Wrapf(err, "failed to find Sessions with userId=%s", userId)
+	}
+	return sessions, nil
+}
+
 func (me SqlSessionStore) GetSessionsWithActiveDeviceIds(userId string) ([]*model.Session, error) {
 	query :=
 		`SELECT *

server/channels/store/store.go

@@ -497,6 +497,7 @@ type SessionStore interface {
 	Get(c request.CTX, sessionIDOrToken string) (*model.Session, error)
 	Save(c request.CTX, session *model.Session) (*model.Session, error)
 	GetSessions(c request.CTX, userID string) ([]*model.Session, error)
+	GetLRUSessions(c request.CTX, userID string, limit uint64, offset uint64) ([]*model.Session, error)
 	GetSessionsWithActiveDeviceIds(userID string) ([]*model.Session, error)
 	GetSessionsExpired(thresholdMillis int64, mobileOnly bool, unnotifiedOnly bool) ([]*model.Session, error)
 	UpdateExpiredNotify(sessionid string, notified bool) error

server/channels/store/storetest/mocks/SessionStore.go

@@ -79,6 +79,32 @@ func (_m *SessionStore) Get(c request.CTX, sessionIDOrToken string) (*model.Sess
 	return r0, r1
 }
 
+// GetLRUSessions provides a mock function with given fields: c, userID, limit, offset
+func (_m *SessionStore) GetLRUSessions(c request.CTX, userID string, limit uint64, offset uint64) ([]*model.Session, error) {
+	ret := _m.Called(c, userID, limit, offset)
+
+	var r0 []*model.Session
+	var r1 error
+	if rf, ok := ret.Get(0).(func(request.CTX, string, uint64, uint64) ([]*model.Session, error)); ok {
+		return rf(c, userID, limit, offset)
+	}
+	if rf, ok := ret.Get(0).(func(request.CTX, string, uint64, uint64) []*model.Session); ok {
+		r0 = rf(c, userID, limit, offset)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]*model.Session)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(request.CTX, string, uint64, uint64) error); ok {
+		r1 = rf(c, userID, limit, offset)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // GetSessions provides a mock function with given fields: c, userID
 func (_m *SessionStore) GetSessions(c request.CTX, userID string) ([]*model.Session, error) {
 	ret := _m.Called(c, userID)

server/channels/store/storetest/session_store.go

@@ -5,6 +5,7 @@ package storetest
 
 import (
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -36,6 +37,7 @@ func TestSessionStore(t *testing.T, rctx request.CTX, ss store.Store) {
 	t.Run("SessionCount", func(t *testing.T) { testSessionCount(t, rctx, ss) })
 	t.Run("GetSessionsExpired", func(t *testing.T) { testGetSessionsExpired(t, rctx, ss) })
 	t.Run("UpdateExpiredNotify", func(t *testing.T) { testUpdateExpiredNotify(t, rctx, ss) })
+	t.Run("GetLRUSessions", func(t *testing.T) { testGetLRUSessions(t, rctx, ss) })
 }
 
 func testSessionStoreSave(t *testing.T, rctx request.CTX, ss store.Store) {
@@ -404,3 +406,53 @@ func testUpdateExpiredNotify(t *testing.T, rctx request.CTX, ss store.Store) {
 	require.NoError(t, err)
 	require.False(t, session.ExpiredNotify)
 }
+
+func testGetLRUSessions(t *testing.T, rctx request.CTX, ss store.Store) {
+	userId := model.NewId()
+
+	// Clear existing sessions.
+	err := ss.Session().RemoveAllSessions()
+	require.NoError(t, err)
+
+	s1 := &model.Session{}
+	s1.UserId = userId
+	s1.DeviceId = model.NewId()
+	_, err = ss.Session().Save(rctx, s1)
+	require.NoError(t, err)
+	time.Sleep(1 * time.Millisecond)
+
+	s2 := &model.Session{}
+	s2.UserId = userId
+	s2.DeviceId = model.NewId()
+	s2, err = ss.Session().Save(rctx, s2)
+	require.NoError(t, err)
+	time.Sleep(1 * time.Millisecond)
+
+	s3 := &model.Session{}
+	s3.UserId = userId
+	s3.DeviceId = model.NewId()
+	s3, err = ss.Session().Save(rctx, s3)
+	require.NoError(t, err)
+
+	sessions, err := ss.Session().GetLRUSessions(rctx, userId, 3, 3)
+	require.NoError(t, err)
+	require.Len(t, sessions, 0)
+
+	sessions, err = ss.Session().GetLRUSessions(rctx, userId, 3, 2)
+	require.NoError(t, err)
+	require.Len(t, sessions, 1)
+	require.Equal(t, s1.Id, sessions[0].Id)
+
+	sessions, err = ss.Session().GetLRUSessions(rctx, userId, 3, 1)
+	require.NoError(t, err)
+	require.Len(t, sessions, 2)
+	require.Equal(t, s2.Id, sessions[0].Id)
+	require.Equal(t, s1.Id, sessions[1].Id)
+
+	sessions, err = ss.Session().GetLRUSessions(rctx, userId, 3, 0)
+	require.NoError(t, err)
+	require.Len(t, sessions, 3)
+	require.Equal(t, s3.Id, sessions[0].Id)
+	require.Equal(t, s2.Id, sessions[1].Id)
+	require.Equal(t, s1.Id, sessions[2].Id)
+}

server/channels/store/timerlayer/timerlayer.go

@@ -7795,6 +7795,22 @@ func (s *TimerLayerSessionStore) Get(c request.CTX, sessionIDOrToken string) (*m
 	return result, err
 }
 
+func (s *TimerLayerSessionStore) GetLRUSessions(c request.CTX, userID string, limit uint64, offset uint64) ([]*model.Session, error) {
+	start := time.Now()
+
+	result, err := s.SessionStore.GetLRUSessions(c, userID, limit, offset)
+
+	elapsed := float64(time.Since(start)) / float64(time.Second)
+	if s.Root.Metrics != nil {
+		success := "false"
+		if err == nil {
+			success = "true"
+		}
+		s.Root.Metrics.ObserveStoreMethodDuration("SessionStore.GetLRUSessions", success, elapsed)
+	}
+	return result, err
+}
+
 func (s *TimerLayerSessionStore) GetSessions(c request.CTX, userID string) ([]*model.Session, error) {
 	start := time.Now()