Unload expired sessions from store

[lisbet-alvarez]

Description

Expired sessions get cleaned up after a while and the ember data store might still have them cached (unless there was a hard refresh) which will lead to inaccurate display of "Active sessions" on a target list page because we use peekAll to display active sessions. This is only an issue with the ember data store, the sqlite db correctly removes terminated sessions using removed_ids field from the API when those sessions get cleaned up. Therefore, this PR unloads sessions in the targets route model hook before making API queries so that any removed/terminated sessions get cleaned up from our ember data cache.

Screenshots (if appropriate)

Issue seen in Admin UI:

Screen.Recording.2025-10-20.at.1.24.49.PM.mov

Issue seen in Desktop UI:

Screen.Recording.2025-10-17.at.3.12.40.PM.mov

How to Test

1. Start a short sessions (quick expiration) by connecting to a target.
2. Navigate to targets list page, validate that "Active Sessions" correctly shows on the target.
3. Navigate to sessions list page, and wait until "No Sessions Available" because then we know the session got removed & terminated through expiration.
4. Navigate to targets list page, validate that "Active Sessions" column shows nothing.

Checklist

• I have added before and after screenshots for UI changes
• I have added JSON response output for API changes
• I have added steps to reproduce and test for bug fixes in the description
• I have commented on my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• I have added a11y-tests label to run a11y audit tests if needed

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.
• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
• If applicable, I've documented the impact of any changes to security controls.
  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
boundary-ui	Ready	Preview	Comment	Oct 30, 2025 11:20pm
boundary-ui-desktop	Ready	Preview	Comment	Oct 30, 2025 11:20pm

[ZedLi]

I want to make sure I understand this, it sounds like if sessions are terminated and we wait until the backend job clears them, the API will still return the removed_ids for these removed terminated sessions.

We previously weren't using include_terminated which wouldn't have returned those IDs but even if we do set it to true, it sounds like it still won't fix the issue because we don't actually have a mechanism to actually remove them from ember data store since we actually only push new records or updated records here

boundary-ui/addons/api/addon/handlers/sqlite-handler.js

Line 149 in 25f015b

? store.push({ data: results })

Is this accurate? If so, I wonder if the actual issue/bug is in the handler because we aren't properly removing them from the ember data store 🤔

[lisbet-alvarez]

Yup that is correct, we don't properly clean up the data store. I imagine ur right in this being an issue for all resources where it doesn't get directly removed using destroyRecord. Ill update to perform the cleanup in the handler instead.

[hashicc]

We don't actually have a mechanism to actually remove them from ember data store since we actually only push new records or updated records here

Isn't the store empty of all sessions already though by:

this.store.unloadAll('session');

If the db is accurate couldn't we just refresh all the session models associated with the targets being displayed instead of clearing all sessions?

[ZedLi]

My thought was it seems like we shouldn't need to do the unloadAll since if we're pushing to store, I would also expect deleted records to be pushed. I think otherwise this is a surprising "gotcha" since you now have to be aware to also unload records.

[hashicc]

Right, I was thinking the same but I think I was missing the second part: include_terminated removed_ids should be enough to refresh clear models from the store

[ZedLi]

Works as expected, thanks for this fix!

[priya-patel04]

Thanks for the fix!