From f914290198bb63b55bbcea2dfcb3ff3eb8bb1d11 Mon Sep 17 00:00:00 2001
From: Chirag Aggarwal <chiragaggarwal5k@gmail.com>
Date: Mon, 6 Apr 2026 18:40:01 +0530
Subject: [PATCH] Make session cleanup best effort

---
 app/controllers/shared/api.php | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/app/controllers/shared/api.php b/app/controllers/shared/api.php
index 5166429e32..c6539cb58e 100644
--- a/app/controllers/shared/api.php
+++ b/app/controllers/shared/api.php
@@ -742,12 +742,23 @@ Http::shutdown()
             return;
         }
 
-        for ($i = 0; $i < ($count - $sessionLimit); $i++) {
-            $session = array_shift($sessions);
-            $dbForProject->deleteDocument('sessions', $session->getId());
-        }
+        try {
+            for ($i = 0; $i < ($count - $sessionLimit); $i++) {
+                $session = array_shift($sessions);
 
-        $dbForProject->purgeCachedDocument('users', $userId);
+                if (!$session instanceof Document) {
+                    continue;
+                }
+
+                $dbForProject->deleteDocument('sessions', $session->getId());
+            }
+        } catch (\Throwable) {
+            // Session-limit cleanup is best-effort. Concurrent session creation can race with
+            // older-session deletion, but that should not fail the request that just created a
+            // valid session for the user.
+        } finally {
+            $dbForProject->purgeCachedDocument('users', $userId);
+        }
     });
 
 Http::shutdown()