phorge-phorge/resources/sql/autopatches/20140115.auth.2.expires.sql

ALTER TABLE {$NAMESPACE}_user.phabricator_session
  ADD sessionExpires INT UNSIGNED NOT NULL;

UPDATE {$NAMESPACE}_user.phabricator_session
  SET sessionExpires = UNIX_TIMESTAMP() + (60 * 60 * 24 * 30);

ALTER TABLE {$NAMESPACE}_user.phabricator_session
  ADD KEY `key_expires` (sessionExpires);
Expire and garbage collect unused sessions Summary: Ref T3720. Ref T4310. Currently, we limit the maximum number of concurrent sessions of each type. This is primarily because sessions predate garbage collection and we had no way to prevent the session table from growing fairly quickly and without bound unless we did this. Now that we have GC (and it's modular!) we can just expire unused sessions after a while and throw them away: - Add a `sessionExpires` column to the table, with a key. - Add a GC for old sessions. - When we establish a session, set `sessionExpires` to the current time plus the session TTL. - When a user uses a session and has used up more than 20% of the time on it, extend the session. In addition to this, we could also rotate sessions, but I think that provides very little value. If we do want to implement it, we should hold it until after T3720 / T4310. Test Plan: - Ran schema changes. - Looked at database. - Tested GC: - Started GC. - Set expires on one row to the past. - Restarted GC. - Verified GC nuked the session. - Logged in. - Logged out. - Ran Conduit method. - Tested refresh: - Set threshold to 0.0001% instead of 20%. - Loaded page. - Saw a session extension ever few page loads. Reviewers: btrahan Reviewed By: btrahan CC: aran Maniphest Tasks: T4310, T3720 Differential Revision: https://secure.phabricator.com/D7976 2014-01-15 22:56:16 +01:00			`ALTER TABLE {$NAMESPACE}_user.phabricator_session`
			`ADD sessionExpires INT UNSIGNED NOT NULL;`

			`UPDATE {$NAMESPACE}_user.phabricator_session`
			`SET sessionExpires = UNIX_TIMESTAMP() + (60 * 60 * 24 * 30);`

			`ALTER TABLE {$NAMESPACE}_user.phabricator_session`
			ADD KEY `key_expires` (sessionExpires);