Expire idle Streamable HTTP sessions by default and cap concurrent sessions (#3395)

tests/docs_src/test_legacy_clients.py

@@ -53,6 +53,8 @@ def test_streamable_http_app_has_no_era_knob() -> None:
         "event_store",
         "retry_interval",
         "max_request_body_size",
+        "session_idle_timeout",
+        "max_sessions",
         "transport_security",
         "host",
     }
@@ -76,6 +78,20 @@ async def test_a_legacy_session_is_minted_in_process_and_a_stray_session_id_is_a
         assert stray.status_code == 404
 
 
+def test_legacy_sessions_expire_and_are_capped_by_default() -> None:
+    """The session lifetime section: a session is closed after 30 idle minutes and each worker process
+    holds at most 10 000 of them, unless `run()` / `streamable_http_app()` say otherwise."""
+    server = MCPServer("Bookshop")
+    server.streamable_http_app()
+    assert server.session_manager.session_idle_timeout == 30 * 60
+    assert server.session_manager.max_sessions == 10_000
+
+    server = MCPServer("Bookshop")
+    server.streamable_http_app(session_idle_timeout=None, max_sessions=None)
+    assert server.session_manager.session_idle_timeout is None
+    assert server.session_manager.max_sessions is None
+
+
 async def test_stateless_http_never_mints_a_session() -> None:
     """The `stateless_http=True` section: the same legacy `initialize` no longer gets an `Mcp-Session-Id`."""
     app = MCPServer("Bookshop").streamable_http_app(stateless_http=True)