From 7013612a4375ec550bf4977f8819f788d2dd7b01 Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Fri, 19 Dec 2025 15:45:05 +0100
Subject: [PATCH] Fix assume session on expire root session

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 pkg/iam/session_service.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkg/iam/session_service.go b/pkg/iam/session_service.go
index 10ff57403..73dd1aef4 100644
--- a/pkg/iam/session_service.go
+++ b/pkg/iam/session_service.go
@@ -285,6 +285,10 @@ func (s SessionService) GetActiveSessionForMembership(ctx context.Context, rootS
 				return fmt.Errorf("session %q is not a root session", rootSessionID)
 			}
 
+			if rootSession.ExpireReason != nil || time.Now().After(rootSession.ExpiredAt) {
+				return NewSessionExpiredError(rootSessionID)
+			}
+
 			membership := &coredata.Membership{}
 			err = membership.LoadByID(ctx, tx, coredata.NewScopeFromObjectID(membershipID), membershipID)
 			if err != nil {