Implement Oban worker removing expired user sessions with grace period

config/runtime.exs

@@ -589,6 +589,8 @@ base_cron = [
   # Every day at 1am
   {"0 1 * * *", Plausible.Workers.CleanInvitations},
   # Every 2 hours
+  {"30 */2 * * *", Plausible.Workers.CleanUserSessions},
+  # Every 2 hours
   {"0 */2 * * *", Plausible.Workers.ExpireDomainChangeTransitions},
   # Daily at midnight
   {"0 0 * * *", Plausible.Workers.LocationsSync}
@@ -619,6 +621,7 @@ base_queues = [
   check_stats_emails: 1,
   site_setup_emails: 1,
   clean_invitations: 1,
+  clean_user_sessions: 1,
   analytics_imports: 1,
   analytics_exports: 1,
   notify_exported_analytics: 1,

lib/workers/clean_user_sessions.ex

@@ -0,0 +1,24 @@
+defmodule Plausible.Workers.CleanUserSessions do
+  @moduledoc """
+  Job removing expired user sessions. A grace period is applied.
+  """
+
+  use Plausible.Repo
+  use Oban.Worker, queue: :clean_user_sessions
+
+  @grace_period Duration.new!(day: -7)
+
+  @impl Oban.Worker
+  def perform(_job) do
+    grace_cutoff =
+      NaiveDateTime.utc_now(:second)
+      |> NaiveDateTime.shift(@grace_period)
+
+    Repo.delete_all(
+      from us in Plausible.Auth.UserSession,
+        where: us.timeout_at < ^grace_cutoff
+    )
+
+    :ok
+  end
+end