@strapi/plugin-users-permissions 0.0.0-next.d9724d67b33363354d7171a9f2265e1c42485e13 → 0.0.0-next.da19c0501ff87d14fb664b55b8e0630d3c548485

package/server/services/jwt.js

@@ -29,6 +29,32 @@ module.exports = ({ strapi }) => ({
   },
 
   issue(payload, jwtOptions = {}) {
+    const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+
+    if (mode === 'refresh') {
+      const userId = String(payload.id ?? payload.userId ?? '');
+      if (!userId) {
+        throw new Error('Cannot issue token: missing user id');
+      }
+
+      const issueRefreshToken = async () => {
+        const refresh = await strapi
+          .sessionManager('users-permissions')
+          .generateRefreshToken(userId, undefined, { type: 'refresh' });
+
+        const access = await strapi
+          .sessionManager('users-permissions')
+          .generateAccessToken(refresh.token);
+        if ('error' in access) {
+          throw new Error('Failed to generate access token');
+        }
+
+        return access.token;
+      };
+
+      return issueRefreshToken();
+    }
+
     _.defaults(jwtOptions, strapi.config.get('plugin::users-permissions.jwt'));
     return jwt.sign(
       _.clone(payload.toJSON ? payload.toJSON() : payload),
@@ -37,12 +63,34 @@ module.exports = ({ strapi }) => ({
     );
   },
 
-  verify(token) {
+  async verify(token) {
+    const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+
+    if (mode === 'refresh') {
+      // Accept only access tokens minted by the SessionManager for UP
+      const result = strapi.sessionManager('users-permissions').validateAccessToken(token);
+      if (!result.isValid || result.payload.type !== 'access') {
+        throw new Error('Invalid token.');
+      }
+
+      const user = await strapi.db
+        .query('plugin::users-permissions.user')
+        .findOne({ where: { id: Number(result.payload.userId) || result.payload.userId } });
+      if (!user) {
+        throw new Error('Invalid token.');
+      }
+
+      return { id: user.id };
+    }
+
     return new Promise((resolve, reject) => {
+      const jwtConfig = strapi.config.get('plugin::users-permissions.jwt', {});
+      const algorithms = jwtConfig && jwtConfig.algorithm ? [jwtConfig.algorithm] : undefined;
+
       jwt.verify(
         token,
         strapi.config.get('plugin::users-permissions.jwtSecret'),
-        {},
+        algorithms ? { algorithms } : {},
         (err, tokenPayload = {}) => {
           if (err) {
             return reject(new Error('Invalid token.'));

package/server/services/user.js

@@ -16,6 +16,11 @@ const { getService } = require('../utils');
 
 const USER_MODEL_UID = 'plugin::users-permissions.user';
 
+const getSessionManager = () => {
+  const manager = strapi.sessionManager;
+  return manager ?? null;
+};
+
 module.exports = ({ strapi }) => ({
   /**
    * Promise to count users
@@ -112,6 +117,12 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   async remove(params) {
+    // Invalidate sessions for all affected users
+    const sessionManager = getSessionManager();
+    if (sessionManager && sessionManager.hasOrigin('users-permissions') && params.id) {
+      await sessionManager('users-permissions').invalidateRefreshToken(String(params.id));
+    }
+
     return strapi.db.query(USER_MODEL_UID).delete({ where: params });
   },