From a9ad734cf4d1ee1dced78bf532955cc5212bc432 Mon Sep 17 00:00:00 2001
From: Domagoj Kriskovic <dom.kriskovic@overleaf.com>
Date: Wed, 26 Aug 2026 11:23:09 +0200
Subject: [PATCH] [web] Delete library data when a deleted user expires
 (#36781)

* Delete library data when an expired deleted user is cleaned up

* Refactor MongoDB session handling

* Remove transaction handling from deleteAllLibraryDataForUser function

* use findUserIdsToKeep rather than filterDanglingUserIds

GitOrigin-RevId: 9e82f6bf943809b55a8b042d9240f99dbc635711
---
 services/web/app/src/infrastructure/mongodb.mjs | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/services/web/app/src/infrastructure/mongodb.mjs b/services/web/app/src/infrastructure/mongodb.mjs
index 56ef14e334..a27b1b09dd 100644
--- a/services/web/app/src/infrastructure/mongodb.mjs
+++ b/services/web/app/src/infrastructure/mongodb.mjs
@@ -168,14 +168,24 @@ export async function waitForDb() {
  * MongoClient".
  *
  * @param {{ aux?: boolean }} [options]
+ * @returns {Promise<import('mongodb').ClientSession>}
  */
 export async function startSession({ aux = false } = {}) {
+  let client
   if (aux && auxMongoClient) {
     await auxConnectionPromise
-    return auxMongoClient.startSession()
+    client = auxMongoClient
+  } else {
+    client = await connectionPromise
   }
-  const client = await connectionPromise
-  return client.startSession()
+
+  // The session is a real mongodb ClientSession at runtime, but mongodb-legacy
+  // types its subclass via Omit, which drops ClientSession's private members and
+  // makes it structurally incompatible — hence the single cast here rather than
+  // at every call site.
+  return /** @type {import('mongodb').ClientSession} */ (
+    /** @type {unknown} */ (client.startSession())
+  )
 }
 
 export default {