Cleanup for session tables doesn't run

[jwhits]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

When a user deletes the browser local storage session, new sessions are created in auth.sessions table for that users even if one already exists.
This PR #875 was added to cleanup the session tables.

I can see the cleanup SQL runs on every request. This is the SQL for the session table (there is similar SQL for the other tables) cleanup in this code

fmt.Sprintf("delete from %q where id in (select id from %q where not_after < now() - interval '72 hours' limit 10 for update skip locked);", tableSessions, tableSessions)

However the column not_after allows nulls and has nulls for the session data in the session table and I can't see in the code where it ever gets a value? So the cleanup will never happens?

This is where the column not_after was added which also said its not used PR #810

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Login using Supabase auth
2. Check session is created in auth.sessions table
3. Delete session data from browser local storage. This forces browser logout
4. Login again using same user
5. Check auth.sessions. There is 2 sessions for the same user.

Expected behavior

All related unused session/token data to be cleaned up/deleted from supabase. This also counts towards database storage.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

• OS: Mac
• Browser: Safari
• Version of supabase-js: 2.25.0
• Version of Node.js: 18.16.0

Additional context

I came across this because I was looking into how you could see what active sessions there is. Is there another way to do this?

[hf]

The not_after column is used only when using SSO and the identity provider has specified an absolute time.

Please enable the new single session per user or inactivity timeout / timeboxing features to get the cleanup of sessions.

https://supabase.com/docs/guides/auth/sessions#limiting-session-lifetime-and-number-of-allowed-sessions-per-user