feat(be): cap sessions per identity

[sea-snake]

Design: #4224. Overview: #4230. #4266 stores sessions; this bounds them.

Sessions are per (identity, application, account, browser), so without a bound an identity's stored set grows with every app it ever signs in to.

Five hundred stored records per identity, expired ones included. Counting what is stored rather than what is live is what makes the cap enforceable: a session expires with no write anywhere, so no counter can follow the live set — something would have to decrement at the moment of expiry, and nothing runs then. An expired record holds its slot until something reclaims it, and because it is the first thing reclaimed, a held slot is never taken from a session in use.

Reaching the cap reclaims rather than refusing. The user is trying to sign in, and the only thing that could refuse them is internal bookkeeping. Reclaiming walks the identity's lists and takes dead sessions first, then live ones by last_used + (last_used - created_at): how recently the session was used, extended by how long it stayed in service. The extension is the point, because recency alone gets the common case backwards — an app opened once and abandoned yesterday was touched more recently than an app in weekly use last opened three days ago. It needs no constant of its own, since the span it adds is bounded by the session's own 30-day lifetime.

What the cap does not do. It puts no bound on a flood of sign-ins: standing rises with use, so a party that can provoke sign-ins and keep refreshing them can outrank sessions an identity has left idle. What stands in the way is the ceremony — creating a session needs an access method, so a flood costs one authenticated sign-in per session. A stronger bound is deliberately not decided here.

Enforced against a recount, not a counter. A session_count on the anchor decides whether to run at all, so a sign-in below the cap reads nothing extra. At the cap, the pass counts what the lists actually hold and admits the sign-in against that number. Every path that removes a session decrements the counter, but it is one number maintained by seven call sites, and the recount is what makes a missed decrement cost an extra pass rather than a slot past the cap. It reads every list rather than a bounded prefix, because a truncated scan would undercount and the undercount would become the counter.

Tests: session_creation_tests (5), including 620 consecutive sign-ins never exceeding the cap, a drifted counter being corrected rather than denying a sign-in, and reclaiming across two lists taking only the sessions it selected and never their namesakes in another list.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 246e75e.

Security Overview

• 🔎 Scanned files: 5 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6d3e3b61-710b-4b2b-9c0b-43458b6314b6?scanId=906f301d-a8b0-4bb2-a1a8-63249156e82f&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type

Relevant files

Enhancement

► src/internet_identity/src/account_management.rs     Add now parameter to several functions and propagate timestamp through account operations ► src/internet_identity/src/main.rs     Pass ic_cdk::api::time() to account management and update flows ► src/internet_identity/src/storage.rs     Introduce TEST_NOW constant for tests and propagate timestamp through storage operations; extensive changes to session/account counting and eviction logic ► src/internet_identity/src/storage/account/tests.rs     Update tests to use TEST_NOW where needed ► src/internet_identity/src/storage/tests.rs     Update tests to use TEST_NOW and adapt key/generation types ► (Multiple) tests: account creation/read/update flows updated to pass timestamp during operations ► (General) Storage layer: add session cap handling, per-origin session management, and related delta calculations ► (General) Tests: ensure consistent use of TEST_NOW in various create/write scenarios

[Copilot]

🟡 Changes recommended

The new session-count update logic can silently clamp on counter underflow (writing an incorrect session_count), and one newly added test is currently duplicated/misaligned with its stated intent.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Implements a per-identity cap on stored session records (including expired records) to prevent unbounded growth of session data across many apps/browsers. The cap is enforced by reclaiming (expired first, then least-demonstrated-use) down to a watermark rather than refusing new sign-ins, and by validating against a recount when the stored counter indicates the cap is reached.

Changes:

• Add MAX_SESSIONS_PER_ANCHOR (500) and SESSIONS_WATERMARK_PER_ANCHOR (450), plus a reclaim pass that prunes expired and then reclaims to the watermark.
• Update write validation to compute session deltas from list diffs and only recount stored sessions when needed at/over the cap, updating anchor.session_count accordingly.
• Expand storage tests to cover cap behavior under many sign-ins, counter drift correction, and cross-list reclaim semantics (also widening test “generation” to u16 for longer sequences).

File summaries

File	Description
src/internet_identity/src/storage.rs	Adds session cap constants, reclaim logic, and session-count validation/update during account-state writes.
src/internet_identity/src/storage/tests.rs	Updates session test helpers (u16 generation) and adds/adjusts tests for session-cap enforcement and reclaim behavior.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.