Add configurable maximum concurrent sessions per user

[RUKAYAT-CODER]

Overview

src/session/session.service.ts allows unlimited concurrent sessions per user. An attacker with a stolen credential can maintain parallel sessions indefinitely without the legitimate user being notified or existing sessions being invalidated.

Specifications

Features:

• Limit concurrent active sessions per user to a configurable maximum (default 5).
• Evict the oldest session when the limit is exceeded (LRU policy).

Tasks:

• Track user sessions in a Redis Sorted Set keyed by user:sessions:{userId}, scored by createdAt.
• In createSession(), after saving the new session, trim the sorted set to the max size and delete evicted sessions.
• Read MAX_SESSIONS_PER_USER from ConfigService (default 5).
• Add unit tests for eviction behavior.

Impacted Files:

• src/session/session.service.ts

Acceptance Criteria

• Creating session N+1 evicts the oldest session.
• Evicted session cannot be used for authentication.
• Max session count is configurable without code changes.

[Adeyemi-cmd]

@Adeyemi-cmd has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Can I please work on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Adeyemi-cmd to this issue.

[iamkingvalor]

@iamkingvalor has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

i would like to work on this issue, please.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @iamkingvalor to this issue.

[dot-enny]

@dot-enny has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hey there, i think i can handle this. ETA - within the hour to 4 hours max. Thank you 😁👍.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @dot-enny to this issue.

[dominiccreates]

@dominiccreates has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would like to work on this issue because i am confident i can resolve the issue, having worked on and resolved similar issues. my eta is 4 hours

ℹ️ Repo Maintainers: To accept this application, review their application or assign @dominiccreates to this issue.

[Chrisland58]

@Chrisland58 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi Rina please assign me just one issue please

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Chrisland58 to this issue.

[drips-wave]

Congratulations, @dominiccreates! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @dominiccreates: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊