added limits and cleanup for sessions

src/main/resources/application.yml

@@ -35,6 +35,17 @@ spring:
 telegram:
   bot-token: ${TELEGRAM_BOT_TOKEN}
 
+app:
+  session:
+    # Maximum number of active sessions per user (multi-device support)
+    max-active-per-user: ${APP_SESSION_MAX_ACTIVE_PER_USER:5}
+    # Batch cleanup configuration
+    cleanup:
+      # Number of expired sessions to delete per batch
+      batch-size: ${APP_SESSION_CLEANUP_BATCH_SIZE:5000}
+      # Maximum number of batches to process per cleanup run
+      max-batches-per-run: ${APP_SESSION_CLEANUP_MAX_BATCHES:20}
+
 logging:
   level:
     root: INFO

src/main/resources/db/migration/V2__create_sessions_table.sql

@@ -8,6 +8,7 @@ CREATE TABLE IF NOT EXISTS sessions (
     INDEX idx_session_hash (session_id_hash),
     INDEX idx_expires_at (expires_at),
     INDEX idx_user_id (user_id),
+    INDEX idx_user_created (user_id, created_at),
     FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;