Freegle / Iznik / 23472

71%

master: 72%

Pull #900

circleci

fix(session): use LastInsertId for new session/export ids, not SELECT max-id

Same class as the message-create fix: session creation read the new id back with
"SELECT id FROM sessions WHERE userid=? ORDER BY id DESC LIMIT 1". With the
read/write split (MYSQL_HOST_READ set) that SELECT goes to a replica which, under
Galera's cross-node apply window, can return the user's PREVIOUS session - so the
persistent token / JWT is issued with the wrong session id (CreateSessionAndJWT
in auth.go and the draft-signup path in user.go).

export.go is filtered by a unique random tag, so a stale read returns id=0 rather
than a wrong row - softer, fixed the same way.

Read the id from the INSERT's LastInsertId on the write connection (db.DB()
returns the source even with dbresolver registered), as in CreateGroup.

A wider class of sites filter by a unique key and just return id=0 under a stale
read; wsrep_sync_wait=1 (causal reads) on the replica fixes the whole class.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SwyetpbkbQV4AWWdqkBcvv

11281 of 14999 branches covered (75.21%)

Branch coverage included in aggregate %.

34 of 42 new or added lines in 3 files covered. (80.95%)

123766 of 174156 relevant lines covered (71.07%)

37.26 hits per line