Throttle SSO session activity touch to cut write load - #4257
Open
madurangasiriwardena wants to merge 1 commit into
Open
Throttle SSO session activity touch to cut write load#4257madurangasiriwardena wants to merge 1 commit into
madurangasiriwardena wants to merge 1 commit into
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (9)
📝 WalkthroughWalkthroughSession timeout configuration now includes an activity refresh interval. Initialization passes the configured value into timeout construction, validation and merging handle it, and checkpoint loading throttles activity persistence while retaining participant recording behavior. ChangesSession activity refresh
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant LoadCheckpoint
participant SessionTimeouts
participant SessionStore
LoadCheckpoint->>SessionTimeouts: Read ActivityRefresh
LoadCheckpoint->>LoadCheckpoint: Compare elapsed time since LastActiveAt
alt Refresh window elapsed
LoadCheckpoint->>SessionStore: Persist LastActiveAt and IdleExpiresAt
else Within refresh window
LoadCheckpoint->>SessionStore: Record joining participant best-effort
end
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
madurangasiriwardena
force-pushed
the
session-activity-touch-throttling
branch
from
July 22, 2026 13:19
19e4b9d to
1934037
Compare
madurangasiriwardena
force-pushed
the
session-activity-touch-throttling
branch
3 times, most recently
from
July 23, 2026 04:45
248a10e to
ee1d378
Compare
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
madurangasiriwardena
force-pushed
the
session-activity-touch-throttling
branch
from
July 24, 2026 09:26
ee1d378 to
8efe0b9
Compare
madurangasiriwardena
marked this pull request as ready for review
July 24, 2026 09:28
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/internal/flow/session/config.go`:
- Around line 32-37: Update the session configuration documentation in
docs/content/apis.mdx to document session.activityRefreshIntervalSeconds,
including its 60-second default, requirement to remain below idleTimeoutSeconds,
and throttled activity-refresh behavior. Update or create the relevant session
configuration guide under docs/content/guides/ to explain reduced database
writes and how the setting affects idle expiry.
In `@backend/internal/flow/session/state.go`:
- Around line 54-58: Validate ActivityRefreshIntervalSeconds against the maximum
representable time.Duration before NewTimeouts invokes activityRefreshInterval,
rejecting positive values whose seconds-to-duration conversion would overflow.
Update the relevant Config.Validate or NewTimeouts validation path while
preserving the default behavior for non-positive values and normal positive
intervals.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 8860d4ef-f4f9-4211-ac2e-760be3f7e149
📒 Files selected for processing (8)
backend/cmd/server/servicemanager.gobackend/internal/flow/flowexec/init.gobackend/internal/flow/session/config.gobackend/internal/flow/session/config_test.gobackend/internal/flow/session/service.gobackend/internal/flow/session/service_test.gobackend/internal/flow/session/state.gobackend/internal/flow/session/state_test.go
Comment on lines
+32
to
+37
| // ActivityRefreshIntervalSeconds is the minimum spacing between persisted activity refreshes: a | ||
| // session reuse within this window of the last persisted activity refresh skips the idle-slide | ||
| // write, cutting write load on the hot path. It is honored as configured and must be less than | ||
| // idleTimeoutSeconds (enforced by Validate), so an active session is never skipped past its idle | ||
| // deadline. | ||
| ActivityRefreshIntervalSeconds int64 `json:"activityRefreshIntervalSeconds" yaml:"activityRefreshIntervalSeconds"` |
Contributor
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
🔴 Documentation Required
This PR introduces user-facing changes that are not covered by documentation updates under docs/.
Please update the relevant documentation before merging.
Missing documentation:
session.activityRefreshIntervalSeconds: Document the default of 60 seconds, its requirement to remain belowidleTimeoutSeconds, and its throttled session activity behavior in the server-config API reference atdocs/content/apis.mdx.- Session activity refresh behavior: Update or create the relevant session configuration guide under
docs/content/guides/to explain the database-write throttling and idle-expiry effect.
As per path instructions, configuration options require consolidated documentation coverage.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/internal/flow/session/config.go` around lines 32 - 37, Update the
session configuration documentation in docs/content/apis.mdx to document
session.activityRefreshIntervalSeconds, including its 60-second default,
requirement to remain below idleTimeoutSeconds, and throttled activity-refresh
behavior. Update or create the relevant session configuration guide under
docs/content/guides/ to explain reduced database writes and how the setting
affects idle expiry.
Source: Path instructions
| // used when the deployment does not configure session.activityRefreshIntervalSeconds. Within this | ||
| // window after the last persisted activity refresh, the activity refresh (the idle-slide UPDATE) is | ||
| // skipped to cut write amplification on the hot session-reuse path. | ||
| const DefaultActivityRefreshInterval = 60 * time.Second |
Member
There was a problem hiding this comment.
Shall we make this private if not required to be accessed outside session package?
madurangasiriwardena
force-pushed
the
session-activity-touch-throttling
branch
2 times, most recently
from
July 27, 2026 05:57
5fa6bec to
3bdf80e
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/internal/flow/session/state.go`:
- Around line 45-55: Update session.Initialize in init.go to apply the default
ActivityRefresh whenever timeouts.ActivityRefresh is <= 0, alongside the
existing Idle and Absolute fallbacks. Use the established default timeout
configuration so zero-valued and legacy keyed Timeouts receive the intended
refresh interval.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 034a5340-406a-49f9-8e20-0b2ba8c3fcd9
📒 Files selected for processing (8)
backend/cmd/server/servicemanager.gobackend/internal/flow/flowexec/init.gobackend/internal/flow/session/config.gobackend/internal/flow/session/config_test.gobackend/internal/flow/session/service.gobackend/internal/flow/session/service_test.gobackend/internal/flow/session/state.gobackend/internal/flow/session/state_test.go
🚧 Files skipped from review as they are similar to previous changes (7)
- backend/internal/flow/flowexec/init.go
- backend/internal/flow/session/config_test.go
- backend/internal/flow/session/service.go
- backend/cmd/server/servicemanager.go
- backend/internal/flow/session/state_test.go
- backend/internal/flow/session/config.go
- backend/internal/flow/session/service_test.go
madurangasiriwardena
force-pushed
the
session-activity-touch-throttling
branch
from
July 27, 2026 06:07
3bdf80e to
8ee4944
Compare
Every SSO session reuse ran an unconditional UPDATE to slide the idle deadline and refresh last-active on SSO_SESSION. On the hot reuse path this was the dominant write load and, on PostgreSQL, the main source of dead tuples on the session table. Throttle it in LoadCheckpoint: skip the idle-slide UPDATE when the last persisted activity refresh is within the activity-refresh window. The persisted idle deadline then lags real activity by at most that interval. The participant upsert is left unthrottled because it also registers an application joining the session for the first time. The interval is operator-configurable via the new session.activityRefreshIntervalSeconds server-config key (seconds), falling back to a built-in 60s default. It is honored as configured; Validate requires it to be less than idleTimeoutSeconds so an active session is never skipped past its idle deadline.
madurangasiriwardena
force-pushed
the
session-activity-touch-throttling
branch
from
July 30, 2026 04:07
8ee4944 to
0287b54
Compare
madurangasiriwardena
added
the
trigger-pr-builder
ThaminduDilshan
approved these changes
Jul 30, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to a conflict with the base branch
Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Every SSO session reuse ran an unconditional UPDATE on SSO_SESSION to slide the idle deadline and refresh LAST_ACTIVE_AT. On the hot reuse path this was the dominant write load, and on PostgreSQL the main source of dead tuples (MVCC bloat) on the session table.
This PR throttles that activity refresh so a burst of reuses within a short window costs a single write instead of one per request, and makes the throttle window operator-configurable.
Approach
Configuring the activity-refresh interval
session.activityRefreshIntervalSeconds (seconds) lives in the existing session server-config section, alongside idleTimeoutSeconds and absoluteTimeoutSeconds. It can be overridden two ways:
resource_type: server_config
name: session
value:
idleTimeoutSeconds: 1800
absoluteTimeoutSeconds: 28800
activityRefreshIntervalSeconds: 60
Related Issues
Related PRs
Checklist
breaking changelabel added.Security checks
Summary by CodeRabbit
activityRefreshIntervalSeconds) for SSO session timeouts.