fix(replay): Ensure replay_id is not captured when session is expired (#9109)

Closes #9106

Author: mydea

packages/replay/src/coreHandlers/handleGlobalEvent.ts

@@ -35,6 +35,12 @@ export function handleGlobalEventListener(
         return event;
       }
 
+      // Ensure we do not add replay_id if the session is expired
+      const isSessionActive = replay.checkAndHandleExpiredSession();
+      if (!isSessionActive) {
+        return event;
+      }
+
       // Unless `captureExceptions` is enabled, we want to ignore errors coming from rrweb
       // As there can be a bunch of stuff going wrong in internals there, that we don't want to bubble up to users
       if (isRrwebError(event, hint) && !replay.getOptions()._experiments.captureExceptions) {

packages/replay/test/integration/coreHandlers/handleGlobalEvent.test.ts

@@ -1,9 +1,10 @@
 import type { Event } from '@sentry/types';
 
 import type { Replay as ReplayIntegration } from '../../../src';
-import { REPLAY_EVENT_NAME } from '../../../src/constants';
+import { REPLAY_EVENT_NAME, SESSION_IDLE_EXPIRE_DURATION } from '../../../src/constants';
 import { handleGlobalEventListener } from '../../../src/coreHandlers/handleGlobalEvent';
 import type { ReplayContainer } from '../../../src/replay';
+import { makeSession } from '../../../src/session/Session';
 import { Error } from '../../fixtures/error';
 import { Transaction } from '../../fixtures/transaction';
 import { resetSdkMock } from '../../mocks/resetSdkMock';
@@ -102,6 +103,32 @@ describe('Integration | coreHandlers | handleGlobalEvent', () => {
     );
   });
 
+  it('does not add replayId if replay session is expired', async () => {
+    const transaction = Transaction();
+    const error = Error();
+
+    const now = Date.now();
+
+    replay.session = makeSession({
+      id: 'test-session-id',
+      segmentId: 0,
+      lastActivity: now - SESSION_IDLE_EXPIRE_DURATION - 1,
+      started: now - SESSION_IDLE_EXPIRE_DURATION - 1,
+      sampled: 'session',
+    });
+
+    expect(handleGlobalEventListener(replay)(transaction, {})).toEqual(
+      expect.objectContaining({
+        tags: expect.not.objectContaining({ replayId: expect.anything() }),
+      }),
+    );
+    expect(handleGlobalEventListener(replay)(error, {})).toEqual(
+      expect.objectContaining({
+        tags: expect.not.objectContaining({ replayId: expect.anything() }),
+      }),
+    );
+  });
+
   it('tags errors and transactions with replay id for session samples', async () => {
     let integration: ReplayIntegration;
     ({ replay, integration } = await resetSdkMock({}));