MM-25394 session expired push notifications (#14732)

* new job type created that checks for expired mobile sessions and pushes notifications.

* only send session expired notifications if ExtendSessionLengthWithActivity is enabled.

* includes schema change:  field added to Sessions table

app/app.go

@@ -136,6 +136,10 @@ func (a *App) initJobs() {
 	if jobsPluginsInterface != nil {
 		a.srv.Jobs.Plugins = jobsPluginsInterface(a)
 	}
+	if jobsExpiryNotifyInterface != nil {
+		a.srv.Jobs.ExpiryNotify = jobsExpiryNotifyInterface(a)
+	}
+
 	a.srv.Jobs.Workers = a.srv.Jobs.InitWorkers()
 	a.srv.Jobs.Schedulers = a.srv.Jobs.InitSchedulers()
 }

app/app_iface.go

@@ -226,6 +226,8 @@ type AppIface interface {
 	NewWebConn(ws *websocket.Conn, session model.Session, t goi18n.TranslateFunc, locale string) *WebConn
 	// NewWebHub creates a new Hub.
 	NewWebHub() *Hub
+	// NotifySessionsExpired is called periodically from the job server to notify any mobile sessions that have expired.
+	NotifySessionsExpired() *model.AppError
 	// OverrideIconURLIfEmoji changes the post icon override URL prop, if it has an emoji icon,
 	// so that it points to the URL (relative) of the emoji - static if emoji is default, /api if custom.
 	OverrideIconURLIfEmoji(post *model.Post)

app/enterprise.go

@@ -90,6 +90,12 @@ func RegisterJobsBleveIndexerInterface(f func(*Server) tjobs.IndexerJobInterface
 	jobsBleveIndexerInterface = f
 }
 
+var jobsExpiryNotifyInterface func(*App) tjobs.ExpiryNotifyJobInterface
+
+func RegisterJobsExpiryNotifyJobInterface(f func(*App) tjobs.ExpiryNotifyJobInterface) {
+	jobsExpiryNotifyInterface = f
+}
+
 var ldapInterface func(*App) einterfaces.LdapInterface
 
 func RegisterLdapInterface(f func(*App) einterfaces.LdapInterface) {

app/expirynotify.go

@@ -0,0 +1,87 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package app
+
+import (
+	"github.com/mattermost/mattermost-server/v5/mlog"
+	"github.com/mattermost/mattermost-server/v5/model"
+	"github.com/mattermost/mattermost-server/v5/utils"
+)
+
+const (
+	OneHourMillis = 60 * 60 * 1000
+)
+
+// NotifySessionsExpired is called periodically from the job server to notify any mobile sessions that have expired.
+func (a *App) NotifySessionsExpired() *model.AppError {
+	if *a.Config().EmailSettings.SendPushNotifications {
+		pushServer := *a.Config().EmailSettings.PushNotificationServer
+		if license := a.srv.License(); pushServer == model.MHPNS && (license == nil || !*license.Features.MHPNS) {
+			mlog.Warn("Push notifications are disabled. Go to System Console > Notifications > Mobile Push to enable them.")
+			return nil
+		}
+	}
+
+	// Get all mobile sessions that expired within the last hour.
+	sessions, err := a.srv.Store.Session().GetSessionsExpired(OneHourMillis, true, true)
+	if err != nil {
+		return err
+	}
+
+	msg := &model.PushNotification{
+		Version: model.PUSH_MESSAGE_V2,
+		Type:    model.PUSH_TYPE_SESSION,
+	}
+
+	for _, session := range sessions {
+		tmpMessage := msg.DeepCopy()
+		tmpMessage.SetDeviceIdAndPlatform(session.DeviceId)
+		tmpMessage.AckId = model.NewId()
+		tmpMessage.Message = a.getSessionExpiredPushMessage(session)
+
+		errPush := a.sendToPushProxy(tmpMessage, session)
+		if errPush != nil {
+			a.NotificationsLog().Error("Notification error",
+				mlog.String("ackId", tmpMessage.AckId),
+				mlog.String("type", tmpMessage.Type),
+				mlog.String("userId", session.UserId),
+				mlog.String("deviceId", tmpMessage.DeviceId),
+				mlog.String("status", errPush.Error()),
+			)
+			continue
+		}
+
+		a.NotificationsLog().Info("Notification sent",
+			mlog.String("ackId", tmpMessage.AckId),
+			mlog.String("type", tmpMessage.Type),
+			mlog.String("userId", session.UserId),
+			mlog.String("deviceId", tmpMessage.DeviceId),
+			mlog.String("status", model.PUSH_SEND_SUCCESS),
+		)
+
+		if a.Metrics() != nil {
+			a.Metrics().IncrementPostSentPush()
+		}
+
+		err = a.srv.Store.Session().UpdateExpiredNotify(session.Id, true)
+		if err != nil {
+			mlog.Error("Failed to update ExpiredNotify flag", mlog.String("sessionid", session.Id), mlog.Err(err))
+		}
+	}
+	return nil
+}
+
+func (a *App) getSessionExpiredPushMessage(session *model.Session) string {
+	locale := model.DEFAULT_LOCALE
+	user, err := a.GetUser(session.UserId)
+	if err == nil {
+		locale = user.Locale
+	}
+	T := utils.GetUserTranslations(locale)
+
+	siteName := *a.Config().TeamSettings.SiteName
+	props := map[string]interface{}{"siteName": siteName, "daysCount": *a.Config().ServiceSettings.SessionLengthMobileInDays}
+
+	return T("api.push_notifications.session.expired", props)
+}

app/expirynotify_test.go

@@ -0,0 +1,80 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package app
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/mattermost/mattermost-server/v5/model"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNotifySessionsExpired(t *testing.T) {
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	handler := &testPushNotificationHandler{t: t}
+	pushServer := httptest.NewServer(
+		http.HandlerFunc(handler.handleReq),
+	)
+	defer pushServer.Close()
+
+	th.App.UpdateConfig(func(cfg *model.Config) {
+		*cfg.EmailSettings.PushNotificationServer = pushServer.URL
+	})
+
+	t.Run("push notifications disabled", func(t *testing.T) {
+		th.App.UpdateConfig(func(cfg *model.Config) {
+			*cfg.EmailSettings.SendPushNotifications = false
+		})
+
+		err := th.App.NotifySessionsExpired()
+		// no error, but also no requests sent
+		require.Nil(t, err)
+		require.Equal(t, 0, handler.numReqs())
+	})
+
+	t.Run("two sessions expired", func(t *testing.T) {
+		th.App.UpdateConfig(func(cfg *model.Config) {
+			*cfg.EmailSettings.SendPushNotifications = true
+		})
+
+		data := []struct {
+			deviceId  string
+			expiresAt int64
+			notified  bool
+		}{
+			{deviceId: "android:11111", expiresAt: model.GetMillis() + 100000, notified: false},
+			{deviceId: "android:22222", expiresAt: model.GetMillis() - 1000, notified: false},
+			{deviceId: "android:33333", expiresAt: model.GetMillis() - 2000, notified: false},
+			{deviceId: "android:44444", expiresAt: model.GetMillis() - 3000, notified: true},
+		}
+
+		for _, d := range data {
+			_, err := th.App.CreateSession(&model.Session{
+				UserId:        th.BasicUser.Id,
+				DeviceId:      d.deviceId,
+				ExpiresAt:     d.expiresAt,
+				ExpiredNotify: d.notified,
+			})
+			require.Nil(t, err)
+		}
+
+		err := th.App.NotifySessionsExpired()
+
+		require.Nil(t, err)
+		require.Equal(t, 2, handler.numReqs())
+
+		expected := []string{"22222", "33333"}
+		require.Equal(t, model.PUSH_TYPE_SESSION, handler.notifications()[0].Type)
+		require.Contains(t, expected, handler.notifications()[0].DeviceId)
+		require.Contains(t, handler.notifications()[0].Message, "Session Expired")
+
+		require.Equal(t, model.PUSH_TYPE_SESSION, handler.notifications()[1].Type)
+		require.Contains(t, expected, handler.notifications()[1].DeviceId)
+		require.Contains(t, handler.notifications()[1].Message, "Session Expired")
+	})
+}

app/opentracing_layer.go

@@ -10078,6 +10078,28 @@ func (a *OpenTracingAppLayer) NewWebHub() *Hub {
 	return resultVar0
 }
 
+func (a *OpenTracingAppLayer) NotifySessionsExpired() *model.AppError {
+	origCtx := a.ctx
+	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.NotifySessionsExpired")
+
+	a.ctx = newCtx
+	a.app.Srv().Store.SetContext(newCtx)
+	defer func() {
+		a.app.Srv().Store.SetContext(origCtx)
+		a.ctx = origCtx
+	}()
+
+	defer span.Finish()
+	resultVar0 := a.app.NotifySessionsExpired()
+
+	if resultVar0 != nil {
+		span.LogFields(spanlog.Error(resultVar0))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0
+}
+
 func (a *OpenTracingAppLayer) OpenInteractiveDialog(request model.OpenDialogRequest) *model.AppError {
 	origCtx := a.ctx
 	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.OpenInteractiveDialog")

einterfaces/mocks/LdapInterface.go

@@ -289,3 +289,8 @@ func (_m *LdapInterface) SwitchToLdap(userId string, ldapId string, ldapPassword
 
 	return r0
 }
+
+// UpdateProfilePictureIfNecessary provides a mock function with given fields: _a0, _a1
+func (_m *LdapInterface) UpdateProfilePictureIfNecessary(_a0 *model.User, _a1 *model.Session) {
+	_m.Called(_a0, _a1)
+}

i18n/en.json

@@ -1822,6 +1822,10 @@
     "id": "api.push_notifications.message.parse.app_error",
     "translation": "An error occurred building the push notification message."
   },
+  {
+    "id": "api.push_notifications.session.expired",
+    "translation": "Session Expired: Please log in to continue receiving notifications. Sessions for {{.siteName}} are configured by your System Administrator to expire every {{.daysCount}} day(s)."
+  },
   {
     "id": "api.push_notifications_ack.forward.app_error",
     "translation": "An error occurred sending the receipt delivery to the push notification service."
@@ -7042,6 +7046,10 @@
     "id": "store.sql_session.update_device_id.app_error",
     "translation": "Unable to update the device id."
   },
+  {
+    "id": "store.sql_session.update_expired_notify.app_error",
+    "translation": "Unable to update expired_notify."
+  },
   {
     "id": "store.sql_session.update_expires_at.app_error",
     "translation": "Unable to update expires_at."

imports/placeholder.go

@@ -12,4 +12,7 @@ import (
 
 	// This is a placeholder so this package can be imported in Team Edition when it will be otherwise empty.
 	_ "github.com/mattermost/mattermost-server/v5/services/searchengine/bleveengine/indexer"
+
+	// This is a placeholder so this package can be imported in Team Edition when it will be otherwise empty.
+	_ "github.com/mattermost/mattermost-server/v5/jobs/expirynotify"
 )

jobs/expirynotify/expirynotify.go

@@ -0,0 +1,19 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package expirynotify
+
+import (
+	"github.com/mattermost/mattermost-server/v5/app"
+	tjobs "github.com/mattermost/mattermost-server/v5/jobs/interfaces"
+)
+
+type ExpiryNotifyJobInterfaceImpl struct {
+	App *app.App
+}
+
+func init() {
+	app.RegisterJobsExpiryNotifyJobInterface(func(a *app.App) tjobs.ExpiryNotifyJobInterface {
+		return &ExpiryNotifyJobInterfaceImpl{a}
+	})
+}

jobs/expirynotify/scheduler.go

@@ -0,0 +1,51 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package expirynotify
+
+import (
+	"time"
+
+	"github.com/mattermost/mattermost-server/v5/app"
+	"github.com/mattermost/mattermost-server/v5/model"
+)
+
+const (
+	SchedFreqMinutes = 10
+)
+
+type Scheduler struct {
+	App *app.App
+}
+
+func (m *ExpiryNotifyJobInterfaceImpl) MakeScheduler() model.Scheduler {
+	return &Scheduler{m.App}
+}
+
+func (scheduler *Scheduler) Name() string {
+	return JobName + "Scheduler"
+}
+
+func (scheduler *Scheduler) JobType() string {
+	return model.JOB_TYPE_EXPIRY_NOTIFY
+}
+
+func (scheduler *Scheduler) Enabled(cfg *model.Config) bool {
+	// Only enabled when ExtendSessionLengthWithActivity is enabled.
+	return *cfg.ServiceSettings.ExtendSessionLengthWithActivity
+}
+
+func (scheduler *Scheduler) NextScheduleTime(cfg *model.Config, now time.Time, pendingJobs bool, lastSuccessfulJob *model.Job) *time.Time {
+	nextTime := time.Now().Add(SchedFreqMinutes * time.Minute)
+	return &nextTime
+}
+
+func (scheduler *Scheduler) ScheduleJob(cfg *model.Config, pendingJobs bool, lastSuccessfulJob *model.Job) (*model.Job, *model.AppError) {
+	data := map[string]string{}
+
+	if job, err := scheduler.App.Srv().Jobs.CreateJob(model.JOB_TYPE_EXPIRY_NOTIFY, data); err != nil {
+		return nil, err
+	} else {
+		return job, nil
+	}
+}

jobs/expirynotify/worker.go

@@ -0,0 +1,100 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package expirynotify
+
+import (
+	"github.com/mattermost/mattermost-server/v5/app"
+	"github.com/mattermost/mattermost-server/v5/jobs"
+	"github.com/mattermost/mattermost-server/v5/mlog"
+	"github.com/mattermost/mattermost-server/v5/model"
+)
+
+const (
+	JobName = "ExpiryNotify"
+)
+
+type Worker struct {
+	name      string
+	stop      chan bool
+	stopped   chan bool
+	jobs      chan model.Job
+	jobServer *jobs.JobServer
+	app       *app.App
+}
+
+func (m *ExpiryNotifyJobInterfaceImpl) MakeWorker() model.Worker {
+	worker := Worker{
+		name:      JobName,
+		stop:      make(chan bool, 1),
+		stopped:   make(chan bool, 1),
+		jobs:      make(chan model.Job),
+		jobServer: m.App.Srv().Jobs,
+		app:       m.App,
+	}
+	return &worker
+}
+
+func (worker *Worker) Run() {
+	mlog.Debug("Worker started", mlog.String("worker", worker.name))
+
+	defer func() {
+		mlog.Debug("Worker finished", mlog.String("worker", worker.name))
+		worker.stopped <- true
+	}()
+
+	for {
+		select {
+		case <-worker.stop:
+			mlog.Debug("Worker received stop signal", mlog.String("worker", worker.name))
+			return
+		case job := <-worker.jobs:
+			mlog.Debug("Worker received a new candidate job.", mlog.String("worker", worker.name))
+			worker.DoJob(&job)
+		}
+	}
+}
+
+func (worker *Worker) Stop() {
+	mlog.Debug("Worker stopping", mlog.String("worker", worker.name))
+	worker.stop <- true
+	<-worker.stopped
+}
+
+func (worker *Worker) JobChannel() chan<- model.Job {
+	return worker.jobs
+}
+
+func (worker *Worker) DoJob(job *model.Job) {
+	if claimed, err := worker.jobServer.ClaimJob(job); err != nil {
+		mlog.Warn("Worker experienced an error while trying to claim job",
+			mlog.String("worker", worker.name),
+			mlog.String("job_id", job.Id),
+			mlog.String("error", err.Error()))
+		return
+	} else if !claimed {
+		return
+	}
+
+	if err := worker.app.NotifySessionsExpired(); err != nil {
+		mlog.Error("Worker: Failed to notify clients of expired session", mlog.String("worker", worker.name), mlog.String("job_id", job.Id), mlog.String("error", err.Error()))
+		worker.setJobError(job, err)
+		return
+	}
+
+	mlog.Info("Worker: Job is complete", mlog.String("worker", worker.name), mlog.String("job_id", job.Id))
+	worker.setJobSuccess(job)
+}
+
+func (worker *Worker) setJobSuccess(job *model.Job) {
+	if err := worker.app.Srv().Jobs.SetJobSuccess(job); err != nil {
+		mlog.Error("Worker: Failed to set success for job", mlog.String("worker", worker.name), mlog.String("job_id", job.Id), mlog.String("error", err.Error()))
+		worker.setJobError(job, err)
+	}
+}
+
+func (worker *Worker) setJobError(job *model.Job, appError *model.AppError) {
+	if err := worker.app.Srv().Jobs.SetJobError(job, appError); err != nil {
+		mlog.Error("Worker: Failed to set job error", mlog.String("worker", worker.name), mlog.String("job_id", job.Id), mlog.String("error", err.Error()))
+	}
+}

jobs/interfaces/expirynotify_interface.go

@@ -0,0 +1,11 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package interfaces
+
+import "github.com/mattermost/mattermost-server/v5/model"
+
+type ExpiryNotifyJobInterface interface {
+	MakeWorker() model.Worker
+	MakeScheduler() model.Scheduler
+}

jobs/jobs_watcher.go

@@ -128,6 +128,13 @@ func (watcher *Watcher) PollAndNotify() {
 				default:
 				}
 			}
+		} else if job.Type == model.JOB_TYPE_EXPIRY_NOTIFY {
+			if watcher.workers.ExpiryNotify != nil {
+				select {
+				case watcher.workers.ExpiryNotify.JobChannel() <- *job:
+				default:
+				}
+			}
 		}
 	}
 }

jobs/schedulers.go

@@ -62,6 +62,10 @@ func (srv *JobServer) InitSchedulers() *Schedulers {
 		schedulers.schedulers = append(schedulers.schedulers, pluginsInterface.MakeScheduler())
 	}
 
+	if expiryNotifyInterface := srv.ExpiryNotify; expiryNotifyInterface != nil {
+		schedulers.schedulers = append(schedulers.schedulers, expiryNotifyInterface.MakeScheduler())
+	}
+
 	schedulers.nextRunTimes = make([]*time.Time, len(schedulers.schedulers))
 	return schedulers
 }

jobs/server.go

@@ -25,6 +25,7 @@ type JobServer struct {
 	Migrations              tjobs.MigrationsJobInterface
 	Plugins                 tjobs.PluginsJobInterface
 	BleveIndexer            tjobs.IndexerJobInterface
+	ExpiryNotify            tjobs.ExpiryNotifyJobInterface
 }
 
 func NewJobServer(configService configservice.ConfigService, store store.Store) *JobServer {

jobs/workers.go

@@ -24,6 +24,7 @@ type Workers struct {
 	Migrations               model.Worker
 	Plugins                  model.Worker
 	BleveIndexing            model.Worker
+	ExpiryNotify             model.Worker
 
 	listenerId string
 }
@@ -66,6 +67,9 @@ func (srv *JobServer) InitWorkers() *Workers {
 		workers.BleveIndexing = bleveIndexerInterface.MakeWorker()
 	}
 
+	if expiryNotifyInterface := srv.ExpiryNotify; expiryNotifyInterface != nil {
+		workers.ExpiryNotify = expiryNotifyInterface.MakeWorker()
+	}
 	return workers
 }
 
@@ -105,6 +109,10 @@ func (workers *Workers) Start() *Workers {
 			go workers.BleveIndexing.Run()
 		}
 
+		if workers.ExpiryNotify != nil {
+			go workers.ExpiryNotify.Run()
+		}
+
 		go workers.Watcher.Start()
 	})
 
@@ -202,6 +210,10 @@ func (workers *Workers) Stop() *Workers {
 		workers.BleveIndexing.Stop()
 	}
 
+	if workers.ExpiryNotify != nil {
+		workers.ExpiryNotify.Stop()
+	}
+
 	mlog.Info("Stopped workers")
 
 	return workers

model/job.go

@@ -19,6 +19,7 @@ const (
 	JOB_TYPE_LDAP_SYNC                      = "ldap_sync"
 	JOB_TYPE_MIGRATIONS                     = "migrations"
 	JOB_TYPE_PLUGINS                        = "plugins"
+	JOB_TYPE_EXPIRY_NOTIFY                  = "expiry_notify"
 
 	JOB_STATUS_PENDING          = "pending"
 	JOB_STATUS_IN_PROGRESS      = "in_progress"
@@ -59,6 +60,7 @@ func (j *Job) IsValid() *AppError {
 	case JOB_TYPE_MESSAGE_EXPORT:
 	case JOB_TYPE_MIGRATIONS:
 	case JOB_TYPE_PLUGINS:
+	case JOB_TYPE_EXPIRY_NOTIFY:
 	default:
 		return NewAppError("Job.IsValid", "model.job.is_valid.type.app_error", nil, "id="+j.Id, http.StatusBadRequest)
 	}

model/push_notification.go

@@ -19,6 +19,7 @@ const (
 	PUSH_TYPE_MESSAGE      = "message"
 	PUSH_TYPE_CLEAR        = "clear"
 	PUSH_TYPE_UPDATE_BADGE = "update_badge"
+	PUSH_TYPE_SESSION      = "session"
 	PUSH_MESSAGE_V2        = "v2"
 
 	PUSH_SOUND_NONE = "none"

model/session.go

@@ -37,6 +37,7 @@ type Session struct {
 	DeviceId       string        `json:"device_id"`
 	Roles          string        `json:"roles"`
 	IsOAuth        bool          `json:"is_oauth"`
+	ExpiredNotify  bool          `json:"expired_notify"`
 	Props          StringMap     `json:"props"`
 	TeamMembers    []*TeamMember `json:"team_members" db:"-"`
 	Local          bool          `json:"local" db:"-"`

scripts/mattermost-mysql-5.0.sql

@@ -789,6 +789,7 @@ CREATE TABLE `Sessions` (
   `DeviceId` text,
   `Roles` varchar(64) DEFAULT NULL,
   `IsOAuth` tinyint(1) DEFAULT NULL,
+  `ExpiredNotify` tinyint(1) DEFAULT NULL,
   `Props` text,
   PRIMARY KEY (`Id`),
   KEY `idx_sessions_user_id` (`UserId`),

scripts/mattermost-postgresql-5.0.sql

@@ -489,7 +489,8 @@ CREATE TABLE public.sessions (
     deviceid character varying(512),
     roles character varying(64),
     isoauth boolean,
-    props character varying(1000)
+    expirednotify boolean,
+    props character varying(1000),
 );
 
 
@@ -825,7 +826,7 @@ COPY public.schemes (id, name, displayname, description, createat, updateat, del
 -- Data for Name: sessions; Type: TABLE DATA; Schema: public; Owner: mmuser
 --
 
-COPY public.sessions (id, token, createat, expiresat, lastactivityat, userid, deviceid, roles, isoauth, props) FROM stdin;
+COPY public.sessions (id, token, createat, expiresat, lastactivityat, userid, deviceid, roles, isoauth, expirednotify, props) FROM stdin;
 \.
 
 

store/opentracing_layer.go

@@ -5755,6 +5755,24 @@ func (s *OpenTracingLayerSessionStore) GetSessions(userId string) ([]*model.Sess
 	return resultVar0, resultVar1
 }
 
+func (s *OpenTracingLayerSessionStore) GetSessionsExpired(thresholdMillis int64, mobileOnly bool, unnotifiedOnly bool) ([]*model.Session, *model.AppError) {
+	origCtx := s.Root.Store.Context()
+	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "SessionStore.GetSessionsExpired")
+	s.Root.Store.SetContext(newCtx)
+	defer func() {
+		s.Root.Store.SetContext(origCtx)
+	}()
+
+	defer span.Finish()
+	resultVar0, resultVar1 := s.SessionStore.GetSessionsExpired(thresholdMillis, mobileOnly, unnotifiedOnly)
+	if resultVar1 != nil {
+		span.LogFields(spanlog.Error(resultVar1))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0, resultVar1
+}
+
 func (s *OpenTracingLayerSessionStore) GetSessionsWithActiveDeviceIds(userId string) ([]*model.Session, *model.AppError) {
 	origCtx := s.Root.Store.Context()
 	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "SessionStore.GetSessionsWithActiveDeviceIds")
@@ -5863,6 +5881,24 @@ func (s *OpenTracingLayerSessionStore) UpdateDeviceId(id string, deviceId string
 	return resultVar0, resultVar1
 }
 
+func (s *OpenTracingLayerSessionStore) UpdateExpiredNotify(sessionid string, notified bool) *model.AppError {
+	origCtx := s.Root.Store.Context()
+	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "SessionStore.UpdateExpiredNotify")
+	s.Root.Store.SetContext(newCtx)
+	defer func() {
+		s.Root.Store.SetContext(origCtx)
+	}()
+
+	defer span.Finish()
+	resultVar0 := s.SessionStore.UpdateExpiredNotify(sessionid, notified)
+	if resultVar0 != nil {
+		span.LogFields(spanlog.Error(resultVar0))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0
+}
+
 func (s *OpenTracingLayerSessionStore) UpdateExpiresAt(sessionId string, time int64) *model.AppError {
 	origCtx := s.Root.Store.Context()
 	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "SessionStore.UpdateExpiresAt")

store/sqlstore/session_store.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"time"
 
+	sq "github.com/Masterminds/squirrel"
 	"github.com/mattermost/mattermost-server/v5/mlog"
 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/mattermost/mattermost-server/v5/store"
@@ -135,6 +136,52 @@ func (me SqlSessionStore) GetSessionsWithActiveDeviceIds(userId string) ([]*mode
 	return sessions, nil
 }
 
+func (me SqlSessionStore) GetSessionsExpired(thresholdMillis int64, mobileOnly bool, unnotifiedOnly bool) ([]*model.Session, *model.AppError) {
+	now := model.GetMillis()
+	builder := me.getQueryBuilder().
+		Select("*").
+		From("Sessions").
+		Where(sq.NotEq{"ExpiresAt": 0}).
+		Where(sq.Lt{"ExpiresAt": now}).
+		Where(sq.Gt{"ExpiresAt": now - thresholdMillis})
+	if mobileOnly {
+		builder = builder.Where(sq.NotEq{"DeviceId": ""})
+	}
+	if unnotifiedOnly {
+		builder = builder.Where(sq.NotEq{"ExpiredNotify": true})
+	}
+
+	query, args, err := builder.ToSql()
+	if err != nil {
+		return nil, model.NewAppError("SqlSessionStore.GetSessionsExpired", "store.sql.build_query.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	var sessions []*model.Session
+
+	_, err = me.GetReplica().Select(&sessions, query, args...)
+	if err != nil {
+		return nil, model.NewAppError("SqlSessionStore.GetSessionsExpired", "store.sql_session.get_sessions.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+	return sessions, nil
+}
+
+func (me SqlSessionStore) UpdateExpiredNotify(sessionId string, notified bool) *model.AppError {
+	query, args, err := me.getQueryBuilder().
+		Update("Sessions").
+		Set("ExpiredNotify", notified).
+		Where(sq.Eq{"Id": sessionId}).
+		ToSql()
+	if err != nil {
+		return model.NewAppError("SqlSessionStore.UpdateExpiredNotifyAt", "store.sql.build_query.app_error", nil, "sessionId="+sessionId, http.StatusInternalServerError)
+	}
+
+	_, err = me.GetMaster().Exec(query, args...)
+	if err != nil {
+		return model.NewAppError("SqlSessionStore.UpdateExpiredNotifyAt", "store.sql_session.update_expired_notify.app_error", nil, "sessionId="+sessionId, http.StatusInternalServerError)
+	}
+	return nil
+}
+
 func (me SqlSessionStore) Remove(sessionIdOrToken string) *model.AppError {
 	_, err := me.GetMaster().Exec("DELETE FROM Sessions WHERE Id = :Id Or Token = :Token", map[string]interface{}{"Id": sessionIdOrToken, "Token": sessionIdOrToken})
 	if err != nil {
@@ -161,7 +208,7 @@ func (me SqlSessionStore) PermanentDeleteSessionsByUser(userId string) *model.Ap
 }
 
 func (me SqlSessionStore) UpdateExpiresAt(sessionId string, time int64) *model.AppError {
-	_, err := me.GetMaster().Exec("UPDATE Sessions SET ExpiresAt = :ExpiresAt WHERE Id = :Id", map[string]interface{}{"ExpiresAt": time, "Id": sessionId})
+	_, err := me.GetMaster().Exec("UPDATE Sessions SET ExpiresAt = :ExpiresAt, ExpiredNotify = false WHERE Id = :Id", map[string]interface{}{"ExpiresAt": time, "Id": sessionId})
 	if err != nil {
 		return model.NewAppError("SqlSessionStore.UpdateExpiresAt", "store.sql_session.update_expires_at.app_error", nil, "sessionId="+sessionId, http.StatusInternalServerError)
 	}
@@ -187,7 +234,7 @@ func (me SqlSessionStore) UpdateRoles(userId, roles string) (string, *model.AppE
 }
 
 func (me SqlSessionStore) UpdateDeviceId(id string, deviceId string, expiresAt int64) (string, *model.AppError) {
-	query := "UPDATE Sessions SET DeviceId = :DeviceId, ExpiresAt = :ExpiresAt WHERE Id = :Id"
+	query := "UPDATE Sessions SET DeviceId = :DeviceId, ExpiresAt = :ExpiresAt, ExpiredNotify = false WHERE Id = :Id"
 
 	_, err := me.GetMaster().Exec(query, map[string]interface{}{"DeviceId": deviceId, "Id": id, "ExpiresAt": expiresAt})
 	if err != nil {

store/sqlstore/upgrade.go

@@ -19,6 +19,8 @@ import (
 
 const (
 	CURRENT_SCHEMA_VERSION   = VERSION_5_24_0
+	VERSION_5_26_0           = "5.26.0"
+	VERSION_5_25_0           = "5.25.0"
 	VERSION_5_24_0           = "5.24.0"
 	VERSION_5_23_0           = "5.23.0"
 	VERSION_5_22_0           = "5.22.0"
@@ -179,6 +181,8 @@ func upgradeDatabase(sqlStore SqlStore, currentModelVersionString string) error
 	upgradeDatabaseToVersion522(sqlStore)
 	upgradeDatabaseToVersion523(sqlStore)
 	upgradeDatabaseToVersion524(sqlStore)
+	upgradeDatabaseToVersion525(sqlStore)
+	upgradeDatabaseToVersion526(sqlStore)
 	return nil
 }
 
@@ -803,3 +807,19 @@ func upgradeDatabaseToVersion524(sqlStore SqlStore) {
 		saveSchemaVersion(sqlStore, VERSION_5_24_0)
 	}
 }
+
+func upgradeDatabaseToVersion525(sqlStore SqlStore) {
+	// TODO: uncomment when the time arrive to upgrade the DB for 5.25
+	//if shouldPerformUpgrade(sqlStore, VERSION_5_24_0, VERSION_5_25_0) {
+	//saveSchemaVersion(sqlStore, VERSION_5_25_0)
+	//}
+}
+
+func upgradeDatabaseToVersion526(sqlStore SqlStore) {
+	// TODO: uncomment when the time arrive to upgrade the DB for 5.26
+	//if shouldPerformUpgrade(sqlStore, VERSION_5_25_0, VERSION_5_26_0) {
+	sqlStore.CreateColumnIfNotExists("Sessions", "ExpiredNotify", "boolean", "boolean", "0")
+
+	//saveSchemaVersion(sqlStore, VERSION_5_26_0)
+	//}
+}

store/store.go

@@ -353,6 +353,8 @@ type SessionStore interface {
 	Save(session *model.Session) (*model.Session, *model.AppError)
 	GetSessions(userId string) ([]*model.Session, *model.AppError)
 	GetSessionsWithActiveDeviceIds(userId string) ([]*model.Session, *model.AppError)
+	GetSessionsExpired(thresholdMillis int64, mobileOnly bool, unnotifiedOnly bool) ([]*model.Session, *model.AppError)
+	UpdateExpiredNotify(sessionid string, notified bool) *model.AppError
 	Remove(sessionIdOrToken string) *model.AppError
 	RemoveAllSessions() *model.AppError
 	PermanentDeleteSessionsByUser(teamId string) *model.AppError

store/storetest/mocks/SessionStore.go

@@ -92,6 +92,31 @@ func (_m *SessionStore) GetSessions(userId string) ([]*model.Session, *model.App
 	return r0, r1
 }
 
+// GetSessionsExpired provides a mock function with given fields: thresholdMillis, mobileOnly, unnotifiedOnly
+func (_m *SessionStore) GetSessionsExpired(thresholdMillis int64, mobileOnly bool, unnotifiedOnly bool) ([]*model.Session, *model.AppError) {
+	ret := _m.Called(thresholdMillis, mobileOnly, unnotifiedOnly)
+
+	var r0 []*model.Session
+	if rf, ok := ret.Get(0).(func(int64, bool, bool) []*model.Session); ok {
+		r0 = rf(thresholdMillis, mobileOnly, unnotifiedOnly)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]*model.Session)
+		}
+	}
+
+	var r1 *model.AppError
+	if rf, ok := ret.Get(1).(func(int64, bool, bool) *model.AppError); ok {
+		r1 = rf(thresholdMillis, mobileOnly, unnotifiedOnly)
+	} else {
+		if ret.Get(1) != nil {
+			r1 = ret.Get(1).(*model.AppError)
+		}
+	}
+
+	return r0, r1
+}
+
 // GetSessionsWithActiveDeviceIds provides a mock function with given fields: userId
 func (_m *SessionStore) GetSessionsWithActiveDeviceIds(userId string) ([]*model.Session, *model.AppError) {
 	ret := _m.Called(userId)
@@ -213,6 +238,22 @@ func (_m *SessionStore) UpdateDeviceId(id string, deviceId string, expiresAt int
 	return r0, r1
 }
 
+// UpdateExpiredNotify provides a mock function with given fields: sessionid, notified
+func (_m *SessionStore) UpdateExpiredNotify(sessionid string, notified bool) *model.AppError {
+	ret := _m.Called(sessionid, notified)
+
+	var r0 *model.AppError
+	if rf, ok := ret.Get(0).(func(string, bool) *model.AppError); ok {
+		r0 = rf(sessionid, notified)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*model.AppError)
+		}
+	}
+
+	return r0
+}
+
 // UpdateExpiresAt provides a mock function with given fields: sessionId, time
 func (_m *SessionStore) UpdateExpiresAt(sessionId string, time int64) *model.AppError {
 	ret := _m.Called(sessionId, time)

store/storetest/session_store.go

@@ -13,6 +13,10 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+const (
+	TenMinutes = 600000
+)
+
 func TestSessionStore(t *testing.T, ss store.Store) {
 	// Run serially to prevent interfering with other tests
 	testSessionCleanup(t, ss)
@@ -29,6 +33,8 @@ func TestSessionStore(t *testing.T, ss store.Store) {
 	t.Run("UpdateExpiresAt", func(t *testing.T) { testSessionStoreUpdateExpiresAt(t, ss) })
 	t.Run("UpdateLastActivityAt", func(t *testing.T) { testSessionStoreUpdateLastActivityAt(t, ss) })
 	t.Run("SessionCount", func(t *testing.T) { testSessionCount(t, ss) })
+	t.Run("GetSessionsExpired", func(t *testing.T) { testGetSessionsExpired(t, ss) })
+	t.Run("UpdateExpiredNotify", func(t *testing.T) { testUpdateExpiredNotify(t, ss) })
 }
 
 func testSessionStoreSave(t *testing.T, ss store.Store) {
@@ -307,3 +313,81 @@ func testSessionCleanup(t *testing.T, ss store.Store) {
 	removeErr = ss.Session().Remove(s2.Id)
 	require.Nil(t, removeErr)
 }
+
+func testGetSessionsExpired(t *testing.T, ss store.Store) {
+	now := model.GetMillis()
+
+	// Clear existing sessions.
+	err := ss.Session().RemoveAllSessions()
+	require.Nil(t, err)
+
+	s1 := &model.Session{}
+	s1.UserId = model.NewId()
+	s1.DeviceId = model.NewId()
+	s1.ExpiresAt = 0 // never expires
+	s1, err = ss.Session().Save(s1)
+	require.Nil(t, err)
+
+	s2 := &model.Session{}
+	s2.UserId = model.NewId()
+	s2.DeviceId = model.NewId()
+	s2.ExpiresAt = now - TenMinutes // expired within threshold
+	s2, err = ss.Session().Save(s2)
+	require.Nil(t, err)
+
+	s3 := &model.Session{}
+	s3.UserId = model.NewId()
+	s3.DeviceId = model.NewId()
+	s3.ExpiresAt = now - (TenMinutes * 100) // expired outside threshold
+	s3, err = ss.Session().Save(s3)
+	require.Nil(t, err)
+
+	s4 := &model.Session{}
+	s4.UserId = model.NewId()
+	s4.ExpiresAt = now - TenMinutes // expired within threshold, but not mobile
+	s4, err = ss.Session().Save(s4)
+	require.Nil(t, err)
+
+	s5 := &model.Session{}
+	s5.UserId = model.NewId()
+	s5.DeviceId = model.NewId()
+	s5.ExpiresAt = now + (TenMinutes * 100000) // not expired
+	s5, err = ss.Session().Save(s5)
+	require.Nil(t, err)
+
+	sessions, err := ss.Session().GetSessionsExpired(TenMinutes*2, true, true) // mobile only
+	require.Nil(t, err)
+	require.Len(t, sessions, 1)
+	require.Equal(t, s2.Id, sessions[0].Id)
+
+	sessions, err = ss.Session().GetSessionsExpired(TenMinutes*2, false, true) // all client types
+	require.Nil(t, err)
+	require.Len(t, sessions, 2)
+	expected := []string{s2.Id, s4.Id}
+	for _, sess := range sessions {
+		require.Contains(t, expected, sess.Id)
+	}
+}
+
+func testUpdateExpiredNotify(t *testing.T, ss store.Store) {
+	s1 := &model.Session{}
+	s1.UserId = model.NewId()
+	s1.DeviceId = model.NewId()
+	s1.ExpiresAt = model.GetMillis() + TenMinutes
+	s1, err := ss.Session().Save(s1)
+	require.Nil(t, err)
+
+	session, err := ss.Session().Get(s1.Id)
+	require.Nil(t, err)
+	require.False(t, session.ExpiredNotify)
+
+	ss.Session().UpdateExpiredNotify(session.Id, true)
+	session, err = ss.Session().Get(s1.Id)
+	require.Nil(t, err)
+	require.True(t, session.ExpiredNotify)
+
+	ss.Session().UpdateExpiredNotify(session.Id, false)
+	session, err = ss.Session().Get(s1.Id)
+	require.Nil(t, err)
+	require.False(t, session.ExpiredNotify)
+}

store/timer_layer.go

@@ -5211,6 +5211,22 @@ func (s *TimerLayerSessionStore) GetSessions(userId string) ([]*model.Session, *
 	return resultVar0, resultVar1
 }
 
+func (s *TimerLayerSessionStore) GetSessionsExpired(thresholdMillis int64, mobileOnly bool, unnotifiedOnly bool) ([]*model.Session, *model.AppError) {
+	start := timemodule.Now()
+
+	resultVar0, resultVar1 := s.SessionStore.GetSessionsExpired(thresholdMillis, mobileOnly, unnotifiedOnly)
+
+	elapsed := float64(timemodule.Since(start)) / float64(timemodule.Second)
+	if s.Root.Metrics != nil {
+		success := "false"
+		if resultVar1 == nil {
+			success = "true"
+		}
+		s.Root.Metrics.ObserveStoreMethodDuration("SessionStore.GetSessionsExpired", success, elapsed)
+	}
+	return resultVar0, resultVar1
+}
+
 func (s *TimerLayerSessionStore) GetSessionsWithActiveDeviceIds(userId string) ([]*model.Session, *model.AppError) {
 	start := timemodule.Now()
 
@@ -5307,6 +5323,22 @@ func (s *TimerLayerSessionStore) UpdateDeviceId(id string, deviceId string, expi
 	return resultVar0, resultVar1
 }
 
+func (s *TimerLayerSessionStore) UpdateExpiredNotify(sessionid string, notified bool) *model.AppError {
+	start := timemodule.Now()
+
+	resultVar0 := s.SessionStore.UpdateExpiredNotify(sessionid, notified)
+
+	elapsed := float64(timemodule.Since(start)) / float64(timemodule.Second)
+	if s.Root.Metrics != nil {
+		success := "false"
+		if resultVar0 == nil {
+			success = "true"
+		}
+		s.Root.Metrics.ObserveStoreMethodDuration("SessionStore.UpdateExpiredNotify", success, elapsed)
+	}
+	return resultVar0
+}
+
 func (s *TimerLayerSessionStore) UpdateExpiresAt(sessionId string, time int64) *model.AppError {
 	start := timemodule.Now()