MM-55320 - Limit length of browser user agent version; ratelimit the /sessions endpoint (#25900)

* add ratelimit to /sessions; cap userAgent version length; tests

* add MaxSessionsLimit; remove oldest session first; tests

* can't use slices in 1.20; improve test

* nits

* add GetLRUSessions; move limiting to CreateSession; remove rate limiting

* use queryBuilder

* mysql needs a limit when using offset

* update i18n

* refactor into limitNumberOfSessions; protect createSessionForUserAccessToken

* add comment to GetLRUSessions

* add limit to oauth path; PR comments

server/channels/store/storetest/mocks/SessionStore.go

@@ -79,6 +79,32 @@ func (_m *SessionStore) Get(c request.CTX, sessionIDOrToken string) (*model.Sess
 	return r0, r1
 }
 
+// GetLRUSessions provides a mock function with given fields: c, userID, limit, offset
+func (_m *SessionStore) GetLRUSessions(c request.CTX, userID string, limit uint64, offset uint64) ([]*model.Session, error) {
+	ret := _m.Called(c, userID, limit, offset)
+
+	var r0 []*model.Session
+	var r1 error
+	if rf, ok := ret.Get(0).(func(request.CTX, string, uint64, uint64) ([]*model.Session, error)); ok {
+		return rf(c, userID, limit, offset)
+	}
+	if rf, ok := ret.Get(0).(func(request.CTX, string, uint64, uint64) []*model.Session); ok {
+		r0 = rf(c, userID, limit, offset)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]*model.Session)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(request.CTX, string, uint64, uint64) error); ok {
+		r1 = rf(c, userID, limit, offset)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // GetSessions provides a mock function with given fields: c, userID
 func (_m *SessionStore) GetSessions(c request.CTX, userID string) ([]*model.Session, error) {
 	ret := _m.Called(c, userID)

server/channels/store/storetest/session_store.go

@@ -5,6 +5,7 @@ package storetest
 
 import (
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -36,6 +37,7 @@ func TestSessionStore(t *testing.T, rctx request.CTX, ss store.Store) {
 	t.Run("SessionCount", func(t *testing.T) { testSessionCount(t, rctx, ss) })
 	t.Run("GetSessionsExpired", func(t *testing.T) { testGetSessionsExpired(t, rctx, ss) })
 	t.Run("UpdateExpiredNotify", func(t *testing.T) { testUpdateExpiredNotify(t, rctx, ss) })
+	t.Run("GetLRUSessions", func(t *testing.T) { testGetLRUSessions(t, rctx, ss) })
 }
 
 func testSessionStoreSave(t *testing.T, rctx request.CTX, ss store.Store) {
@@ -404,3 +406,53 @@ func testUpdateExpiredNotify(t *testing.T, rctx request.CTX, ss store.Store) {
 	require.NoError(t, err)
 	require.False(t, session.ExpiredNotify)
 }
+
+func testGetLRUSessions(t *testing.T, rctx request.CTX, ss store.Store) {
+	userId := model.NewId()
+
+	// Clear existing sessions.
+	err := ss.Session().RemoveAllSessions()
+	require.NoError(t, err)
+
+	s1 := &model.Session{}
+	s1.UserId = userId
+	s1.DeviceId = model.NewId()
+	_, err = ss.Session().Save(rctx, s1)
+	require.NoError(t, err)
+	time.Sleep(1 * time.Millisecond)
+
+	s2 := &model.Session{}
+	s2.UserId = userId
+	s2.DeviceId = model.NewId()
+	s2, err = ss.Session().Save(rctx, s2)
+	require.NoError(t, err)
+	time.Sleep(1 * time.Millisecond)
+
+	s3 := &model.Session{}
+	s3.UserId = userId
+	s3.DeviceId = model.NewId()
+	s3, err = ss.Session().Save(rctx, s3)
+	require.NoError(t, err)
+
+	sessions, err := ss.Session().GetLRUSessions(rctx, userId, 3, 3)
+	require.NoError(t, err)
+	require.Len(t, sessions, 0)
+
+	sessions, err = ss.Session().GetLRUSessions(rctx, userId, 3, 2)
+	require.NoError(t, err)
+	require.Len(t, sessions, 1)
+	require.Equal(t, s1.Id, sessions[0].Id)
+
+	sessions, err = ss.Session().GetLRUSessions(rctx, userId, 3, 1)
+	require.NoError(t, err)
+	require.Len(t, sessions, 2)
+	require.Equal(t, s2.Id, sessions[0].Id)
+	require.Equal(t, s1.Id, sessions[1].Id)
+
+	sessions, err = ss.Session().GetLRUSessions(rctx, userId, 3, 0)
+	require.NoError(t, err)
+	require.Len(t, sessions, 3)
+	require.Equal(t, s3.Id, sessions[0].Id)
+	require.Equal(t, s2.Id, sessions[1].Id)
+	require.Equal(t, s1.Id, sessions[2].Id)
+}