native autoRemove mode can delete sessions too early

[snakamura]

• I'm submitting a ...
  [*] bug report
  [ ] feature request
  [ ] question about the decisions made in the repository
  [ ] question about how to use this project

• Summary

I found I sometimes saw Unable to find the session to touch error while using connect-mongo 4.6.0. After some investigations, I found that the session was deleted after it was gotten, but before being touched.

1. session was gotten from a mongodb collection (it's not expired yet)
2. It expired and the mongodb ttl index deleted it (autoRemove was set to 'native')
3. express-session touched it and caused Unable to find the session to touch error because the session has already been deleted

• Other information (e.g. detailed explanation, stack traces, related issues, suggestions how to fix, links for us to have context, eg. StackOverflow, personal fork, etc.)

I found that it use 0 for expireAfterSeconds when creating a ttl index, but I think it'd make sense to set some margins (possibly another option?). There is still a chance that a session was deleted before touched, but it won't happen in normal situations.

While I was writing this, I found this can happen with interval autoRemove mode as well. It might be an idea to add some margins to a query generated by removeQuery in setAutoRemove.

[JavaScriptBach]

I'm also getting this error when upgrading from 3.2.0 to 4.6.0 and I'm not sure why. It's theoretically possible for a session to expire after it's been read but before it's been touched, but that's very unlikely and I haven't seen that happen on 3.2.0.

[Jennyykn]

I am also still having this error on 4.6.0. Very hard to recreate and debug though, since it is happening very randomly.
Do we have any progress on this issue?