fix(cleanup): delete sessions older than the session lifetime

Closes #7394

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Console/Commands/CleanupDatabase.php

@@ -33,7 +33,8 @@ class CleanupDatabase extends Command
         $this->line("Keep days: $keep_days");
         $this->cleanupTable('failed_jobs', 'failed_at', now()->subDays(1));
 
-        $this->cleanupTable('sessions', 'last_activity', now()->subDays($keep_days)->timestamp);
+        // A session older than its lifetime can no longer be used, so do not keep it for the retention days.
+        $this->cleanupTable('sessions', 'last_activity', now()->subMinutes((int) config('session.lifetime'))->timestamp);
 
         $this->cleanupTable('activity_log', 'created_at', now()->subDays($keep_days));
 

tests/Feature/CleanupDatabaseCommandTest.php

@@ -1,6 +1,7 @@
 <?php
 
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
 use Spatie\Activitylog\Models\Activity;
 
 uses(RefreshDatabase::class);
@@ -34,3 +35,20 @@ it('deletes all activities older than the retention and keeps newer ones', funct
     expect(Activity::query()->pluck('id')->sort()->values()->all())
         ->toBe($this->recent->pluck('id')->sort()->values()->all());
 });
+
+it('deletes sessions older than the session lifetime', function () {
+    config(['session.lifetime' => 10080]);
+    $insertSession = fn (string $id, int $ageInMinutes) => DB::table('sessions')->insert([
+        'id' => $id,
+        'payload' => '',
+        'last_activity' => now()->subMinutes($ageInMinutes)->timestamp,
+    ]);
+    $insertSession('expired', 10080 + 60);
+    $insertSession('active', 10080 - 60);
+
+    $this->artisan('cleanup:database --yes')
+        ->expectsOutputToContain('Delete 1 entries from sessions.')
+        ->assertSuccessful();
+
+    expect(DB::table('sessions')->pluck('id')->all())->toBe(['active']);
+});