@strapi/plugin-users-permissions 5.23.5 → 5.24.0

package/dist/server/bootstrap/index.js

@@ -4,6 +4,7 @@ var require$$0 = require('crypto');
 var require$$0$1 = require('lodash');
 var index = require('../utils/index.js');
 var usersPermissionsActions = require('./users-permissions-actions.js');
+var constants = require('../services/constants.js');
 
 var bootstrap;
 var hasRequiredBootstrap;
@@ -20,6 +21,11 @@ function requireBootstrap() {
     const _ = require$$0$1;
     const { getService } = index.__require();
     const usersPermissionsActions$1 = usersPermissionsActions.__require();
+    const { DEFAULT_ACCESS_TOKEN_LIFESPAN, DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN, DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN, DEFAULT_MAX_SESSION_LIFESPAN, DEFAULT_IDLE_SESSION_LIFESPAN } = constants.__require();
+    const getSessionManager = ()=>{
+        const manager = strapi.sessionManager;
+        return manager ?? null;
+    };
     const initGrant = async (pluginStore)=>{
         const allProviders = getService('providers-registry').getAll();
         const grantConfig = Object.entries(allProviders).reduce((acc, [name, provider])=>{
@@ -114,27 +120,40 @@ function requireBootstrap() {
             });
         }
     };
-    bootstrap = async ({ strapi })=>{
-        const pluginStore = strapi.store({
+    bootstrap = async ({ strapi: strapi1 })=>{
+        const pluginStore = strapi1.store({
             type: 'plugin',
             name: 'users-permissions'
         });
         await initGrant(pluginStore);
         await initEmails(pluginStore);
         await initAdvancedOptions(pluginStore);
-        await strapi.service('admin::permission').actionProvider.registerMany(usersPermissionsActions$1.actions);
+        await strapi1.service('admin::permission').actionProvider.registerMany(usersPermissionsActions$1.actions);
         await getService('users-permissions').initialize();
-        if (!strapi.config.get('plugin::users-permissions.jwtSecret')) {
+        // Define users-permissions origin configuration for sessionManager
+        const upConfig = strapi1.config.get('plugin::users-permissions');
+        const sessionManager = getSessionManager();
+        if (sessionManager) {
+            sessionManager.defineOrigin('users-permissions', {
+                jwtSecret: upConfig.jwtSecret || strapi1.config.get('admin.auth.secret'),
+                accessTokenLifespan: upConfig.sessions?.accessTokenLifespan || DEFAULT_ACCESS_TOKEN_LIFESPAN,
+                maxRefreshTokenLifespan: upConfig.sessions?.maxRefreshTokenLifespan || DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,
+                idleRefreshTokenLifespan: upConfig.sessions?.idleRefreshTokenLifespan || DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,
+                maxSessionLifespan: upConfig.sessions?.maxSessionLifespan || DEFAULT_MAX_SESSION_LIFESPAN,
+                idleSessionLifespan: upConfig.sessions?.idleSessionLifespan || DEFAULT_IDLE_SESSION_LIFESPAN
+            });
+        }
+        if (!strapi1.config.get('plugin::users-permissions.jwtSecret')) {
             if (process.env.NODE_ENV !== 'development') {
                 throw new Error(`Missing jwtSecret. Please, set configuration variable "jwtSecret" for the users-permissions plugin in config/plugins.js (ex: you can generate one using Node with \`crypto.randomBytes(16).toString('base64')\`).
 For security reasons, prefer storing the secret in an environment variable and read it in config/plugins.js. See https://docs.strapi.io/developer-docs/latest/setup-deployment-guides/configurations/optional/environment.html#configuration-using-environment-variables.`);
             }
             const jwtSecret = crypto.randomBytes(16).toString('base64');
-            strapi.config.set('plugin::users-permissions.jwtSecret', jwtSecret);
+            strapi1.config.set('plugin::users-permissions.jwtSecret', jwtSecret);
             if (!process.env.JWT_SECRET) {
                 const envPath = process.env.ENV_PATH || '.env';
-                strapi.fs.appendFile(envPath, `JWT_SECRET=${jwtSecret}\n`);
-                strapi.log.info(`The Users & Permissions plugin automatically generated a jwt secret and stored it in ${envPath} under the name JWT_SECRET.`);
+                strapi1.fs.appendFile(envPath, `JWT_SECRET=${jwtSecret}\n`);
+                strapi1.log.info(`The Users & Permissions plugin automatically generated a jwt secret and stored it in ${envPath} under the name JWT_SECRET.`);
             }
         }
     };

package/dist/server/bootstrap/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../server/bootstrap/index.js"],"sourcesContent":["'use strict';\n\n/**\n * An asynchronous bootstrap function that runs before\n * your application gets started.\n *\n * This gives you an opportunity to set up your data model,\n * run jobs, or perform some special logic.\n */\nconst crypto = require('crypto');\nconst _ = require('lodash');\nconst { getService } = require('../utils');\nconst usersPermissionsActions = require('./users-permissions-actions');\n\nconst initGrant = async (pluginStore) => {\n  const allProviders = getService('providers-registry').getAll();\n\n  const grantConfig = Object.entries(allProviders).reduce((acc, [name, provider]) => {\n    const { icon, enabled, grantConfig } = provider;\n\n    acc[name] = {\n      icon,\n      enabled,\n      ...grantConfig,\n    };\n    return acc;\n  }, {});\n\n  const prevGrantConfig = (await pluginStore.get({ key: 'grant' })) || {};\n\n  if (!prevGrantConfig || !_.isEqual(prevGrantConfig, grantConfig)) {\n    // merge with the previous provider config.\n    _.keys(grantConfig).forEach((key) => {\n      if (key in prevGrantConfig) {\n        grantConfig[key] = _.merge(grantConfig[key], prevGrantConfig[key]);\n      }\n    });\n    await pluginStore.set({ key: 'grant', value: grantConfig });\n  }\n};\n\nconst initEmails = async (pluginStore) => {\n  if (!(await pluginStore.get({ key: 'email' }))) {\n    const value = {\n      reset_password: {\n        display: 'Email.template.reset_password',\n        icon: 'sync',\n        options: {\n          from: {\n            name: 'Administration Panel',\n            email: 'no-reply@strapi.io',\n          },\n          response_email: '',\n          object: 'Reset password',\n          message: `<p>We heard that you lost your password. Sorry about that!</p>\n\n<p>But don’t worry! You can use the following link to reset your password:</p>\n<p><%= URL %>?code=<%= TOKEN %></p>\n\n<p>Thanks.</p>`,\n        },\n      },\n      email_confirmation: {\n        display: 'Email.template.email_confirmation',\n        icon: 'check-square',\n        options: {\n          from: {\n            name: 'Administration Panel',\n            email: 'no-reply@strapi.io',\n          },\n          response_email: '',\n          object: 'Account confirmation',\n          message: `<p>Thank you for registering!</p>\n\n<p>You have to confirm your email address. Please click on the link below.</p>\n\n<p><%= URL %>?confirmation=<%= CODE %></p>\n\n<p>Thanks.</p>`,\n        },\n      },\n    };\n\n    await pluginStore.set({ key: 'email', value });\n  }\n};\n\nconst initAdvancedOptions = async (pluginStore) => {\n  if (!(await pluginStore.get({ key: 'advanced' }))) {\n    const value = {\n      unique_email: true,\n      allow_register: true,\n      email_confirmation: false,\n      email_reset_password: null,\n      email_confirmation_redirection: null,\n      default_role: 'authenticated',\n    };\n\n    await pluginStore.set({ key: 'advanced', value });\n  }\n};\n\nmodule.exports = async ({ strapi }) => {\n  const pluginStore = strapi.store({ type: 'plugin', name: 'users-permissions' });\n\n  await initGrant(pluginStore);\n  await initEmails(pluginStore);\n  await initAdvancedOptions(pluginStore);\n\n  await strapi\n    .service('admin::permission')\n    .actionProvider.registerMany(usersPermissionsActions.actions);\n\n  await getService('users-permissions').initialize();\n\n  if (!strapi.config.get('plugin::users-permissions.jwtSecret')) {\n    if (process.env.NODE_ENV !== 'development') {\n      throw new Error(\n        `Missing jwtSecret. Please, set configuration variable \"jwtSecret\" for the users-permissions plugin in config/plugins.js (ex: you can generate one using Node with \\`crypto.randomBytes(16).toString('base64')\\`).\nFor security reasons, prefer storing the secret in an environment variable and read it in config/plugins.js. See https://docs.strapi.io/developer-docs/latest/setup-deployment-guides/configurations/optional/environment.html#configuration-using-environment-variables.`\n      );\n    }\n\n    const jwtSecret = crypto.randomBytes(16).toString('base64');\n\n    strapi.config.set('plugin::users-permissions.jwtSecret', jwtSecret);\n\n    if (!process.env.JWT_SECRET) {\n      const envPath = process.env.ENV_PATH || '.env';\n      strapi.fs.appendFile(envPath, `JWT_SECRET=${jwtSecret}\\n`);\n      strapi.log.info(\n        `The Users & Permissions plugin automatically generated a jwt secret and stored it in ${envPath} under the name JWT_SECRET.`\n      );\n    }\n  }\n};\n"],"names":["crypto","require$$0","_","require$$1","getService","require$$2","usersPermissionsActions","require$$3","initGrant","pluginStore","allProviders","getAll","grantConfig","Object","entries","reduce","acc","name","provider","icon","enabled","prevGrantConfig","get","key","isEqual","keys","forEach","merge","set","value","initEmails","reset_password","display","options","from","email","response_email","object","message","email_confirmation","initAdvancedOptions","unique_email","allow_register","email_reset_password","email_confirmation_redirection","default_role","bootstrap","strapi","store","type","service","actionProvider","registerMany","actions","initialize","config","process","env","NODE_ENV","Error","jwtSecret","randomBytes","toString","JWT_SECRET","envPath","ENV_PATH","fs","appendFile","log","info"],"mappings":";;;;;;;;;;;;AAEA;;;;;;AAMA,KACA,MAAMA,MAASC,GAAAA,UAAAA;AACf,IAAA,MAAMC,CAAIC,GAAAA,YAAAA;IACV,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AACvB,IAAA,MAAMC,yBAA0BC,GAAAA,iCAAAA,EAAAA;AAEhC,IAAA,MAAMC,YAAY,OAAOC,WAAAA,GAAAA;QACvB,MAAMC,YAAAA,GAAeN,UAAW,CAAA,oBAAA,CAAA,CAAsBO,MAAM,EAAA;QAE5D,MAAMC,WAAAA,GAAcC,MAAOC,CAAAA,OAAO,CAACJ,YAAAA,CAAAA,CAAcK,MAAM,CAAC,CAACC,GAAAA,EAAK,CAACC,IAAAA,EAAMC,QAAS,CAAA,GAAA;AAC5E,YAAA,MAAM,EAAEC,IAAI,EAAEC,OAAO,EAAER,WAAW,EAAE,GAAGM,QAAAA;YAEvCF,GAAG,CAACC,KAAK,GAAG;AACVE,gBAAAA,IAAAA;AACAC,gBAAAA,OAAAA;AACA,gBAAA,GAAGR;AACT,aAAA;YACI,OAAOI,GAAAA;AACR,SAAA,EAAE,EAAE,CAAA;AAEL,QAAA,MAAMK,eAAkB,GAAC,MAAMZ,WAAAA,CAAYa,GAAG,CAAC;YAAEC,GAAK,EAAA;cAAe;AAErE,QAAA,IAAI,CAACF,eAAmB,IAAA,CAACnB,EAAEsB,OAAO,CAACH,iBAAiBT,WAAc,CAAA,EAAA;;AAEhEV,YAAAA,CAAAA,CAAEuB,IAAI,CAACb,WAAac,CAAAA,CAAAA,OAAO,CAAC,CAACH,GAAAA,GAAAA;AAC3B,gBAAA,IAAIA,OAAOF,eAAiB,EAAA;AAC1BT,oBAAAA,WAAW,CAACW,GAAAA,CAAI,GAAGrB,CAAAA,CAAEyB,KAAK,CAACf,WAAW,CAACW,GAAI,CAAA,EAAEF,eAAe,CAACE,GAAI,CAAA,CAAA;AAClE;AACP,aAAA,CAAA;YACI,MAAMd,WAAAA,CAAYmB,GAAG,CAAC;gBAAEL,GAAK,EAAA,OAAA;gBAASM,KAAOjB,EAAAA;AAAW,aAAA,CAAA;AACzD;AACH,KAAA;AAEA,IAAA,MAAMkB,aAAa,OAAOrB,WAAAA,GAAAA;AACxB,QAAA,IAAI,CAAE,MAAMA,WAAYa,CAAAA,GAAG,CAAC;YAAEC,GAAK,EAAA;SAAa,CAAA,EAAA;AAC9C,YAAA,MAAMM,KAAQ,GAAA;gBACZE,cAAgB,EAAA;oBACdC,OAAS,EAAA,+BAAA;oBACTb,IAAM,EAAA,MAAA;oBACNc,OAAS,EAAA;wBACPC,IAAM,EAAA;4BACJjB,IAAM,EAAA,sBAAA;4BACNkB,KAAO,EAAA;AACR,yBAAA;wBACDC,cAAgB,EAAA,EAAA;wBAChBC,MAAQ,EAAA,gBAAA;AACRC,wBAAAA,OAAAA,EAAS,CAAC;;;;;cAKN;AACL;AACF,iBAAA;gBACDC,kBAAoB,EAAA;oBAClBP,OAAS,EAAA,mCAAA;oBACTb,IAAM,EAAA,cAAA;oBACNc,OAAS,EAAA;wBACPC,IAAM,EAAA;4BACJjB,IAAM,EAAA,sBAAA;4BACNkB,KAAO,EAAA;AACR,yBAAA;wBACDC,cAAgB,EAAA,EAAA;wBAChBC,MAAQ,EAAA,sBAAA;AACRC,wBAAAA,OAAAA,EAAS,CAAC;;;;;;cAMN;AACL;AACF;AACP,aAAA;YAEI,MAAM7B,WAAAA,CAAYmB,GAAG,CAAC;gBAAEL,GAAK,EAAA,OAAA;AAASM,gBAAAA;AAAK,aAAA,CAAA;AAC5C;AACH,KAAA;AAEA,IAAA,MAAMW,sBAAsB,OAAO/B,WAAAA,GAAAA;AACjC,QAAA,IAAI,CAAE,MAAMA,WAAYa,CAAAA,GAAG,CAAC;YAAEC,GAAK,EAAA;SAAgB,CAAA,EAAA;AACjD,YAAA,MAAMM,KAAQ,GAAA;gBACZY,YAAc,EAAA,IAAA;gBACdC,cAAgB,EAAA,IAAA;gBAChBH,kBAAoB,EAAA,KAAA;gBACpBI,oBAAsB,EAAA,IAAA;gBACtBC,8BAAgC,EAAA,IAAA;gBAChCC,YAAc,EAAA;AACpB,aAAA;YAEI,MAAMpC,WAAAA,CAAYmB,GAAG,CAAC;gBAAEL,GAAK,EAAA,UAAA;AAAYM,gBAAAA;AAAK,aAAA,CAAA;AAC/C;AACH,KAAA;IAEAiB,SAAiB,GAAA,OAAO,EAAEC,MAAM,EAAE,GAAA;QAChC,MAAMtC,WAAAA,GAAcsC,MAAOC,CAAAA,KAAK,CAAC;YAAEC,IAAM,EAAA,QAAA;YAAUhC,IAAM,EAAA;AAAmB,SAAA,CAAA;AAE5E,QAAA,MAAMT,SAAUC,CAAAA,WAAAA,CAAAA;AAChB,QAAA,MAAMqB,UAAWrB,CAAAA,WAAAA,CAAAA;AACjB,QAAA,MAAM+B,mBAAoB/B,CAAAA,WAAAA,CAAAA;QAE1B,MAAMsC,MAAAA,CACHG,OAAO,CAAC,mBAAA,CAAA,CACRC,cAAc,CAACC,YAAY,CAAC9C,yBAAAA,CAAwB+C,OAAO,CAAA;QAE9D,MAAMjD,UAAAA,CAAW,qBAAqBkD,UAAU,EAAA;AAEhD,QAAA,IAAI,CAACP,MAAOQ,CAAAA,MAAM,CAACjC,GAAG,CAAC,qCAAwC,CAAA,EAAA;AAC7D,YAAA,IAAIkC,OAAQC,CAAAA,GAAG,CAACC,QAAQ,KAAK,aAAe,EAAA;gBAC1C,MAAM,IAAIC,MACR,CAAC;yQACgQ,CAAC,CAAA;AAErQ;AAED,YAAA,MAAMC,YAAY5D,MAAO6D,CAAAA,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,QAAA,CAAA;AAElDf,YAAAA,MAAAA,CAAOQ,MAAM,CAAC3B,GAAG,CAAC,qCAAuCgC,EAAAA,SAAAA,CAAAA;AAEzD,YAAA,IAAI,CAACJ,OAAAA,CAAQC,GAAG,CAACM,UAAU,EAAE;AAC3B,gBAAA,MAAMC,OAAUR,GAAAA,OAAAA,CAAQC,GAAG,CAACQ,QAAQ,IAAI,MAAA;gBACxClB,MAAOmB,CAAAA,EAAE,CAACC,UAAU,CAACH,OAAAA,EAAS,CAAC,WAAW,EAAEJ,SAAU,CAAA,EAAE,CAAC,CAAA;gBACzDb,MAAOqB,CAAAA,GAAG,CAACC,IAAI,CACb,CAAC,qFAAqF,EAAEL,OAAQ,CAAA,2BAA2B,CAAC,CAAA;AAE/H;AACF;AACH,KAAA;;;;;;"}
+{"version":3,"file":"index.js","sources":["../../../server/bootstrap/index.js"],"sourcesContent":["'use strict';\n\n/**\n * An asynchronous bootstrap function that runs before\n * your application gets started.\n *\n * This gives you an opportunity to set up your data model,\n * run jobs, or perform some special logic.\n */\nconst crypto = require('crypto');\nconst _ = require('lodash');\nconst { getService } = require('../utils');\nconst usersPermissionsActions = require('./users-permissions-actions');\nconst {\n  DEFAULT_ACCESS_TOKEN_LIFESPAN,\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} = require('../services/constants');\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\nconst initGrant = async (pluginStore) => {\n  const allProviders = getService('providers-registry').getAll();\n\n  const grantConfig = Object.entries(allProviders).reduce((acc, [name, provider]) => {\n    const { icon, enabled, grantConfig } = provider;\n\n    acc[name] = {\n      icon,\n      enabled,\n      ...grantConfig,\n    };\n    return acc;\n  }, {});\n\n  const prevGrantConfig = (await pluginStore.get({ key: 'grant' })) || {};\n\n  if (!prevGrantConfig || !_.isEqual(prevGrantConfig, grantConfig)) {\n    // merge with the previous provider config.\n    _.keys(grantConfig).forEach((key) => {\n      if (key in prevGrantConfig) {\n        grantConfig[key] = _.merge(grantConfig[key], prevGrantConfig[key]);\n      }\n    });\n    await pluginStore.set({ key: 'grant', value: grantConfig });\n  }\n};\n\nconst initEmails = async (pluginStore) => {\n  if (!(await pluginStore.get({ key: 'email' }))) {\n    const value = {\n      reset_password: {\n        display: 'Email.template.reset_password',\n        icon: 'sync',\n        options: {\n          from: {\n            name: 'Administration Panel',\n            email: 'no-reply@strapi.io',\n          },\n          response_email: '',\n          object: 'Reset password',\n          message: `<p>We heard that you lost your password. Sorry about that!</p>\n\n<p>But don’t worry! You can use the following link to reset your password:</p>\n<p><%= URL %>?code=<%= TOKEN %></p>\n\n<p>Thanks.</p>`,\n        },\n      },\n      email_confirmation: {\n        display: 'Email.template.email_confirmation',\n        icon: 'check-square',\n        options: {\n          from: {\n            name: 'Administration Panel',\n            email: 'no-reply@strapi.io',\n          },\n          response_email: '',\n          object: 'Account confirmation',\n          message: `<p>Thank you for registering!</p>\n\n<p>You have to confirm your email address. Please click on the link below.</p>\n\n<p><%= URL %>?confirmation=<%= CODE %></p>\n\n<p>Thanks.</p>`,\n        },\n      },\n    };\n\n    await pluginStore.set({ key: 'email', value });\n  }\n};\n\nconst initAdvancedOptions = async (pluginStore) => {\n  if (!(await pluginStore.get({ key: 'advanced' }))) {\n    const value = {\n      unique_email: true,\n      allow_register: true,\n      email_confirmation: false,\n      email_reset_password: null,\n      email_confirmation_redirection: null,\n      default_role: 'authenticated',\n    };\n\n    await pluginStore.set({ key: 'advanced', value });\n  }\n};\n\nmodule.exports = async ({ strapi }) => {\n  const pluginStore = strapi.store({ type: 'plugin', name: 'users-permissions' });\n\n  await initGrant(pluginStore);\n  await initEmails(pluginStore);\n  await initAdvancedOptions(pluginStore);\n\n  await strapi\n    .service('admin::permission')\n    .actionProvider.registerMany(usersPermissionsActions.actions);\n\n  await getService('users-permissions').initialize();\n\n  // Define users-permissions origin configuration for sessionManager\n  const upConfig = strapi.config.get('plugin::users-permissions');\n  const sessionManager = getSessionManager();\n\n  if (sessionManager) {\n    sessionManager.defineOrigin('users-permissions', {\n      jwtSecret: upConfig.jwtSecret || strapi.config.get('admin.auth.secret'),\n      accessTokenLifespan: upConfig.sessions?.accessTokenLifespan || DEFAULT_ACCESS_TOKEN_LIFESPAN,\n      maxRefreshTokenLifespan:\n        upConfig.sessions?.maxRefreshTokenLifespan || DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n      idleRefreshTokenLifespan:\n        upConfig.sessions?.idleRefreshTokenLifespan || DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n      maxSessionLifespan: upConfig.sessions?.maxSessionLifespan || DEFAULT_MAX_SESSION_LIFESPAN,\n      idleSessionLifespan: upConfig.sessions?.idleSessionLifespan || DEFAULT_IDLE_SESSION_LIFESPAN,\n    });\n  }\n\n  if (!strapi.config.get('plugin::users-permissions.jwtSecret')) {\n    if (process.env.NODE_ENV !== 'development') {\n      throw new Error(\n        `Missing jwtSecret. Please, set configuration variable \"jwtSecret\" for the users-permissions plugin in config/plugins.js (ex: you can generate one using Node with \\`crypto.randomBytes(16).toString('base64')\\`).\nFor security reasons, prefer storing the secret in an environment variable and read it in config/plugins.js. See https://docs.strapi.io/developer-docs/latest/setup-deployment-guides/configurations/optional/environment.html#configuration-using-environment-variables.`\n      );\n    }\n\n    const jwtSecret = crypto.randomBytes(16).toString('base64');\n\n    strapi.config.set('plugin::users-permissions.jwtSecret', jwtSecret);\n\n    if (!process.env.JWT_SECRET) {\n      const envPath = process.env.ENV_PATH || '.env';\n      strapi.fs.appendFile(envPath, `JWT_SECRET=${jwtSecret}\\n`);\n      strapi.log.info(\n        `The Users & Permissions plugin automatically generated a jwt secret and stored it in ${envPath} under the name JWT_SECRET.`\n      );\n    }\n  }\n};\n"],"names":["crypto","require$$0","_","require$$1","getService","require$$2","usersPermissionsActions","require$$3","DEFAULT_ACCESS_TOKEN_LIFESPAN","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","require$$4","getSessionManager","manager","strapi","sessionManager","initGrant","pluginStore","allProviders","getAll","grantConfig","Object","entries","reduce","acc","name","provider","icon","enabled","prevGrantConfig","get","key","isEqual","keys","forEach","merge","set","value","initEmails","reset_password","display","options","from","email","response_email","object","message","email_confirmation","initAdvancedOptions","unique_email","allow_register","email_reset_password","email_confirmation_redirection","default_role","bootstrap","store","type","service","actionProvider","registerMany","actions","initialize","upConfig","config","defineOrigin","jwtSecret","accessTokenLifespan","sessions","maxRefreshTokenLifespan","idleRefreshTokenLifespan","maxSessionLifespan","idleSessionLifespan","process","env","NODE_ENV","Error","randomBytes","toString","JWT_SECRET","envPath","ENV_PATH","fs","appendFile","log","info"],"mappings":";;;;;;;;;;;;;AAEA;;;;;;AAMA,KACA,MAAMA,MAASC,GAAAA,UAAAA;AACf,IAAA,MAAMC,CAAIC,GAAAA,YAAAA;IACV,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AACvB,IAAA,MAAMC,yBAA0BC,GAAAA,iCAAAA,EAAAA;IAChC,MAAM,EACJC,6BAA6B,EAC7BC,kCAAkC,EAClCC,mCAAmC,EACnCC,4BAA4B,EAC5BC,6BAA6B,EAC9B,GAAGC,mBAAAA,EAAAA;AAEJ,IAAA,MAAMC,iBAAoB,GAAA,IAAA;QACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,QAAA,OAAOF,OAAW,IAAA,IAAA;AACpB,KAAA;AAEA,IAAA,MAAMG,YAAY,OAAOC,WAAAA,GAAAA;QACvB,MAAMC,YAAAA,GAAehB,UAAW,CAAA,oBAAA,CAAA,CAAsBiB,MAAM,EAAA;QAE5D,MAAMC,WAAAA,GAAcC,MAAOC,CAAAA,OAAO,CAACJ,YAAAA,CAAAA,CAAcK,MAAM,CAAC,CAACC,GAAAA,EAAK,CAACC,IAAAA,EAAMC,QAAS,CAAA,GAAA;AAC5E,YAAA,MAAM,EAAEC,IAAI,EAAEC,OAAO,EAAER,WAAW,EAAE,GAAGM,QAAAA;YAEvCF,GAAG,CAACC,KAAK,GAAG;AACVE,gBAAAA,IAAAA;AACAC,gBAAAA,OAAAA;AACA,gBAAA,GAAGR;AACT,aAAA;YACI,OAAOI,GAAAA;AACR,SAAA,EAAE,EAAE,CAAA;AAEL,QAAA,MAAMK,eAAkB,GAAC,MAAMZ,WAAAA,CAAYa,GAAG,CAAC;YAAEC,GAAK,EAAA;cAAe;AAErE,QAAA,IAAI,CAACF,eAAmB,IAAA,CAAC7B,EAAEgC,OAAO,CAACH,iBAAiBT,WAAc,CAAA,EAAA;;AAEhEpB,YAAAA,CAAAA,CAAEiC,IAAI,CAACb,WAAac,CAAAA,CAAAA,OAAO,CAAC,CAACH,GAAAA,GAAAA;AAC3B,gBAAA,IAAIA,OAAOF,eAAiB,EAAA;AAC1BT,oBAAAA,WAAW,CAACW,GAAAA,CAAI,GAAG/B,CAAAA,CAAEmC,KAAK,CAACf,WAAW,CAACW,GAAI,CAAA,EAAEF,eAAe,CAACE,GAAI,CAAA,CAAA;AAClE;AACP,aAAA,CAAA;YACI,MAAMd,WAAAA,CAAYmB,GAAG,CAAC;gBAAEL,GAAK,EAAA,OAAA;gBAASM,KAAOjB,EAAAA;AAAW,aAAA,CAAA;AACzD;AACH,KAAA;AAEA,IAAA,MAAMkB,aAAa,OAAOrB,WAAAA,GAAAA;AACxB,QAAA,IAAI,CAAE,MAAMA,WAAYa,CAAAA,GAAG,CAAC;YAAEC,GAAK,EAAA;SAAa,CAAA,EAAA;AAC9C,YAAA,MAAMM,KAAQ,GAAA;gBACZE,cAAgB,EAAA;oBACdC,OAAS,EAAA,+BAAA;oBACTb,IAAM,EAAA,MAAA;oBACNc,OAAS,EAAA;wBACPC,IAAM,EAAA;4BACJjB,IAAM,EAAA,sBAAA;4BACNkB,KAAO,EAAA;AACR,yBAAA;wBACDC,cAAgB,EAAA,EAAA;wBAChBC,MAAQ,EAAA,gBAAA;AACRC,wBAAAA,OAAAA,EAAS,CAAC;;;;;cAKN;AACL;AACF,iBAAA;gBACDC,kBAAoB,EAAA;oBAClBP,OAAS,EAAA,mCAAA;oBACTb,IAAM,EAAA,cAAA;oBACNc,OAAS,EAAA;wBACPC,IAAM,EAAA;4BACJjB,IAAM,EAAA,sBAAA;4BACNkB,KAAO,EAAA;AACR,yBAAA;wBACDC,cAAgB,EAAA,EAAA;wBAChBC,MAAQ,EAAA,sBAAA;AACRC,wBAAAA,OAAAA,EAAS,CAAC;;;;;;cAMN;AACL;AACF;AACP,aAAA;YAEI,MAAM7B,WAAAA,CAAYmB,GAAG,CAAC;gBAAEL,GAAK,EAAA,OAAA;AAASM,gBAAAA;AAAK,aAAA,CAAA;AAC5C;AACH,KAAA;AAEA,IAAA,MAAMW,sBAAsB,OAAO/B,WAAAA,GAAAA;AACjC,QAAA,IAAI,CAAE,MAAMA,WAAYa,CAAAA,GAAG,CAAC;YAAEC,GAAK,EAAA;SAAgB,CAAA,EAAA;AACjD,YAAA,MAAMM,KAAQ,GAAA;gBACZY,YAAc,EAAA,IAAA;gBACdC,cAAgB,EAAA,IAAA;gBAChBH,kBAAoB,EAAA,KAAA;gBACpBI,oBAAsB,EAAA,IAAA;gBACtBC,8BAAgC,EAAA,IAAA;gBAChCC,YAAc,EAAA;AACpB,aAAA;YAEI,MAAMpC,WAAAA,CAAYmB,GAAG,CAAC;gBAAEL,GAAK,EAAA,UAAA;AAAYM,gBAAAA;AAAK,aAAA,CAAA;AAC/C;AACH,KAAA;AAEAiB,IAAAA,SAAAA,GAAiB,OAAO,EAAExC,MAAAA,EAAAA,OAAM,EAAE,GAAA;QAChC,MAAMG,WAAAA,GAAcH,OAAOyC,CAAAA,KAAK,CAAC;YAAEC,IAAM,EAAA,QAAA;YAAU/B,IAAM,EAAA;AAAmB,SAAA,CAAA;AAE5E,QAAA,MAAMT,SAAUC,CAAAA,WAAAA,CAAAA;AAChB,QAAA,MAAMqB,UAAWrB,CAAAA,WAAAA,CAAAA;AACjB,QAAA,MAAM+B,mBAAoB/B,CAAAA,WAAAA,CAAAA;QAE1B,MAAMH,OAAAA,CACH2C,OAAO,CAAC,mBAAA,CAAA,CACRC,cAAc,CAACC,YAAY,CAACvD,yBAAAA,CAAwBwD,OAAO,CAAA;QAE9D,MAAM1D,UAAAA,CAAW,qBAAqB2D,UAAU,EAAA;;AAGhD,QAAA,MAAMC,QAAWhD,GAAAA,OAAAA,CAAOiD,MAAM,CAACjC,GAAG,CAAC,2BAAA,CAAA;AACnC,QAAA,MAAMf,cAAiBH,GAAAA,iBAAAA,EAAAA;AAEvB,QAAA,IAAIG,cAAgB,EAAA;YAClBA,cAAeiD,CAAAA,YAAY,CAAC,mBAAqB,EAAA;AAC/CC,gBAAAA,SAAAA,EAAWH,SAASG,SAAS,IAAInD,QAAOiD,MAAM,CAACjC,GAAG,CAAC,mBAAA,CAAA;gBACnDoC,mBAAqBJ,EAAAA,QAAAA,CAASK,QAAQ,EAAED,mBAAuB5D,IAAAA,6BAAAA;gBAC/D8D,uBACEN,EAAAA,QAAAA,CAASK,QAAQ,EAAEC,uBAA2B7D,IAAAA,kCAAAA;gBAChD8D,wBACEP,EAAAA,QAAAA,CAASK,QAAQ,EAAEE,wBAA4B7D,IAAAA,mCAAAA;gBACjD8D,kBAAoBR,EAAAA,QAAAA,CAASK,QAAQ,EAAEG,kBAAsB7D,IAAAA,4BAAAA;gBAC7D8D,mBAAqBT,EAAAA,QAAAA,CAASK,QAAQ,EAAEI,mBAAuB7D,IAAAA;AACrE,aAAA,CAAA;AACG;AAED,QAAA,IAAI,CAACI,OAAOiD,CAAAA,MAAM,CAACjC,GAAG,CAAC,qCAAwC,CAAA,EAAA;AAC7D,YAAA,IAAI0C,OAAQC,CAAAA,GAAG,CAACC,QAAQ,KAAK,aAAe,EAAA;gBAC1C,MAAM,IAAIC,MACR,CAAC;yQACgQ,CAAC,CAAA;AAErQ;AAED,YAAA,MAAMV,YAAYnE,MAAO8E,CAAAA,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,QAAA,CAAA;AAElD/D,YAAAA,OAAAA,CAAOiD,MAAM,CAAC3B,GAAG,CAAC,qCAAuC6B,EAAAA,SAAAA,CAAAA;AAEzD,YAAA,IAAI,CAACO,OAAAA,CAAQC,GAAG,CAACK,UAAU,EAAE;AAC3B,gBAAA,MAAMC,OAAUP,GAAAA,OAAAA,CAAQC,GAAG,CAACO,QAAQ,IAAI,MAAA;gBACxClE,OAAOmE,CAAAA,EAAE,CAACC,UAAU,CAACH,OAAAA,EAAS,CAAC,WAAW,EAAEd,SAAU,CAAA,EAAE,CAAC,CAAA;gBACzDnD,OAAOqE,CAAAA,GAAG,CAACC,IAAI,CACb,CAAC,qFAAqF,EAAEL,OAAQ,CAAA,2BAA2B,CAAC,CAAA;AAE/H;AACF;AACH,KAAA;;;;;;"}

package/dist/server/bootstrap/index.mjs

@@ -2,6 +2,7 @@ import require$$0 from 'crypto';
 import require$$0$1 from 'lodash';
 import { __require as requireUtils } from '../utils/index.mjs';
 import { __require as requireUsersPermissionsActions } from './users-permissions-actions.mjs';
+import { __require as requireConstants } from '../services/constants.mjs';
 
 var bootstrap;
 var hasRequiredBootstrap;
@@ -18,6 +19,11 @@ function requireBootstrap() {
     const _ = require$$0$1;
     const { getService } = requireUtils();
     const usersPermissionsActions = requireUsersPermissionsActions();
+    const { DEFAULT_ACCESS_TOKEN_LIFESPAN, DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN, DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN, DEFAULT_MAX_SESSION_LIFESPAN, DEFAULT_IDLE_SESSION_LIFESPAN } = requireConstants();
+    const getSessionManager = ()=>{
+        const manager = strapi.sessionManager;
+        return manager ?? null;
+    };
     const initGrant = async (pluginStore)=>{
         const allProviders = getService('providers-registry').getAll();
         const grantConfig = Object.entries(allProviders).reduce((acc, [name, provider])=>{
@@ -112,27 +118,40 @@ function requireBootstrap() {
             });
         }
     };
-    bootstrap = async ({ strapi })=>{
-        const pluginStore = strapi.store({
+    bootstrap = async ({ strapi: strapi1 })=>{
+        const pluginStore = strapi1.store({
             type: 'plugin',
             name: 'users-permissions'
         });
         await initGrant(pluginStore);
         await initEmails(pluginStore);
         await initAdvancedOptions(pluginStore);
-        await strapi.service('admin::permission').actionProvider.registerMany(usersPermissionsActions.actions);
+        await strapi1.service('admin::permission').actionProvider.registerMany(usersPermissionsActions.actions);
         await getService('users-permissions').initialize();
-        if (!strapi.config.get('plugin::users-permissions.jwtSecret')) {
+        // Define users-permissions origin configuration for sessionManager
+        const upConfig = strapi1.config.get('plugin::users-permissions');
+        const sessionManager = getSessionManager();
+        if (sessionManager) {
+            sessionManager.defineOrigin('users-permissions', {
+                jwtSecret: upConfig.jwtSecret || strapi1.config.get('admin.auth.secret'),
+                accessTokenLifespan: upConfig.sessions?.accessTokenLifespan || DEFAULT_ACCESS_TOKEN_LIFESPAN,
+                maxRefreshTokenLifespan: upConfig.sessions?.maxRefreshTokenLifespan || DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,
+                idleRefreshTokenLifespan: upConfig.sessions?.idleRefreshTokenLifespan || DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,
+                maxSessionLifespan: upConfig.sessions?.maxSessionLifespan || DEFAULT_MAX_SESSION_LIFESPAN,
+                idleSessionLifespan: upConfig.sessions?.idleSessionLifespan || DEFAULT_IDLE_SESSION_LIFESPAN
+            });
+        }
+        if (!strapi1.config.get('plugin::users-permissions.jwtSecret')) {
             if (process.env.NODE_ENV !== 'development') {
                 throw new Error(`Missing jwtSecret. Please, set configuration variable "jwtSecret" for the users-permissions plugin in config/plugins.js (ex: you can generate one using Node with \`crypto.randomBytes(16).toString('base64')\`).
 For security reasons, prefer storing the secret in an environment variable and read it in config/plugins.js. See https://docs.strapi.io/developer-docs/latest/setup-deployment-guides/configurations/optional/environment.html#configuration-using-environment-variables.`);
             }
             const jwtSecret = crypto.randomBytes(16).toString('base64');
-            strapi.config.set('plugin::users-permissions.jwtSecret', jwtSecret);
+            strapi1.config.set('plugin::users-permissions.jwtSecret', jwtSecret);
             if (!process.env.JWT_SECRET) {
                 const envPath = process.env.ENV_PATH || '.env';
-                strapi.fs.appendFile(envPath, `JWT_SECRET=${jwtSecret}\n`);
-                strapi.log.info(`The Users & Permissions plugin automatically generated a jwt secret and stored it in ${envPath} under the name JWT_SECRET.`);
+                strapi1.fs.appendFile(envPath, `JWT_SECRET=${jwtSecret}\n`);
+                strapi1.log.info(`The Users & Permissions plugin automatically generated a jwt secret and stored it in ${envPath} under the name JWT_SECRET.`);
             }
         }
     };

package/dist/server/bootstrap/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sources":["../../../server/bootstrap/index.js"],"sourcesContent":["'use strict';\n\n/**\n * An asynchronous bootstrap function that runs before\n * your application gets started.\n *\n * This gives you an opportunity to set up your data model,\n * run jobs, or perform some special logic.\n */\nconst crypto = require('crypto');\nconst _ = require('lodash');\nconst { getService } = require('../utils');\nconst usersPermissionsActions = require('./users-permissions-actions');\n\nconst initGrant = async (pluginStore) => {\n  const allProviders = getService('providers-registry').getAll();\n\n  const grantConfig = Object.entries(allProviders).reduce((acc, [name, provider]) => {\n    const { icon, enabled, grantConfig } = provider;\n\n    acc[name] = {\n      icon,\n      enabled,\n      ...grantConfig,\n    };\n    return acc;\n  }, {});\n\n  const prevGrantConfig = (await pluginStore.get({ key: 'grant' })) || {};\n\n  if (!prevGrantConfig || !_.isEqual(prevGrantConfig, grantConfig)) {\n    // merge with the previous provider config.\n    _.keys(grantConfig).forEach((key) => {\n      if (key in prevGrantConfig) {\n        grantConfig[key] = _.merge(grantConfig[key], prevGrantConfig[key]);\n      }\n    });\n    await pluginStore.set({ key: 'grant', value: grantConfig });\n  }\n};\n\nconst initEmails = async (pluginStore) => {\n  if (!(await pluginStore.get({ key: 'email' }))) {\n    const value = {\n      reset_password: {\n        display: 'Email.template.reset_password',\n        icon: 'sync',\n        options: {\n          from: {\n            name: 'Administration Panel',\n            email: 'no-reply@strapi.io',\n          },\n          response_email: '',\n          object: 'Reset password',\n          message: `<p>We heard that you lost your password. Sorry about that!</p>\n\n<p>But don’t worry! You can use the following link to reset your password:</p>\n<p><%= URL %>?code=<%= TOKEN %></p>\n\n<p>Thanks.</p>`,\n        },\n      },\n      email_confirmation: {\n        display: 'Email.template.email_confirmation',\n        icon: 'check-square',\n        options: {\n          from: {\n            name: 'Administration Panel',\n            email: 'no-reply@strapi.io',\n          },\n          response_email: '',\n          object: 'Account confirmation',\n          message: `<p>Thank you for registering!</p>\n\n<p>You have to confirm your email address. Please click on the link below.</p>\n\n<p><%= URL %>?confirmation=<%= CODE %></p>\n\n<p>Thanks.</p>`,\n        },\n      },\n    };\n\n    await pluginStore.set({ key: 'email', value });\n  }\n};\n\nconst initAdvancedOptions = async (pluginStore) => {\n  if (!(await pluginStore.get({ key: 'advanced' }))) {\n    const value = {\n      unique_email: true,\n      allow_register: true,\n      email_confirmation: false,\n      email_reset_password: null,\n      email_confirmation_redirection: null,\n      default_role: 'authenticated',\n    };\n\n    await pluginStore.set({ key: 'advanced', value });\n  }\n};\n\nmodule.exports = async ({ strapi }) => {\n  const pluginStore = strapi.store({ type: 'plugin', name: 'users-permissions' });\n\n  await initGrant(pluginStore);\n  await initEmails(pluginStore);\n  await initAdvancedOptions(pluginStore);\n\n  await strapi\n    .service('admin::permission')\n    .actionProvider.registerMany(usersPermissionsActions.actions);\n\n  await getService('users-permissions').initialize();\n\n  if (!strapi.config.get('plugin::users-permissions.jwtSecret')) {\n    if (process.env.NODE_ENV !== 'development') {\n      throw new Error(\n        `Missing jwtSecret. Please, set configuration variable \"jwtSecret\" for the users-permissions plugin in config/plugins.js (ex: you can generate one using Node with \\`crypto.randomBytes(16).toString('base64')\\`).\nFor security reasons, prefer storing the secret in an environment variable and read it in config/plugins.js. See https://docs.strapi.io/developer-docs/latest/setup-deployment-guides/configurations/optional/environment.html#configuration-using-environment-variables.`\n      );\n    }\n\n    const jwtSecret = crypto.randomBytes(16).toString('base64');\n\n    strapi.config.set('plugin::users-permissions.jwtSecret', jwtSecret);\n\n    if (!process.env.JWT_SECRET) {\n      const envPath = process.env.ENV_PATH || '.env';\n      strapi.fs.appendFile(envPath, `JWT_SECRET=${jwtSecret}\\n`);\n      strapi.log.info(\n        `The Users & Permissions plugin automatically generated a jwt secret and stored it in ${envPath} under the name JWT_SECRET.`\n      );\n    }\n  }\n};\n"],"names":["crypto","require$$0","_","require$$1","getService","require$$2","usersPermissionsActions","require$$3","initGrant","pluginStore","allProviders","getAll","grantConfig","Object","entries","reduce","acc","name","provider","icon","enabled","prevGrantConfig","get","key","isEqual","keys","forEach","merge","set","value","initEmails","reset_password","display","options","from","email","response_email","object","message","email_confirmation","initAdvancedOptions","unique_email","allow_register","email_reset_password","email_confirmation_redirection","default_role","bootstrap","strapi","store","type","service","actionProvider","registerMany","actions","initialize","config","process","env","NODE_ENV","Error","jwtSecret","randomBytes","toString","JWT_SECRET","envPath","ENV_PATH","fs","appendFile","log","info"],"mappings":";;;;;;;;;;AAEA;;;;;;AAMA,KACA,MAAMA,MAASC,GAAAA,UAAAA;AACf,IAAA,MAAMC,CAAIC,GAAAA,YAAAA;IACV,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AACvB,IAAA,MAAMC,uBAA0BC,GAAAA,8BAAAA,EAAAA;AAEhC,IAAA,MAAMC,YAAY,OAAOC,WAAAA,GAAAA;QACvB,MAAMC,YAAAA,GAAeN,UAAW,CAAA,oBAAA,CAAA,CAAsBO,MAAM,EAAA;QAE5D,MAAMC,WAAAA,GAAcC,MAAOC,CAAAA,OAAO,CAACJ,YAAAA,CAAAA,CAAcK,MAAM,CAAC,CAACC,GAAAA,EAAK,CAACC,IAAAA,EAAMC,QAAS,CAAA,GAAA;AAC5E,YAAA,MAAM,EAAEC,IAAI,EAAEC,OAAO,EAAER,WAAW,EAAE,GAAGM,QAAAA;YAEvCF,GAAG,CAACC,KAAK,GAAG;AACVE,gBAAAA,IAAAA;AACAC,gBAAAA,OAAAA;AACA,gBAAA,GAAGR;AACT,aAAA;YACI,OAAOI,GAAAA;AACR,SAAA,EAAE,EAAE,CAAA;AAEL,QAAA,MAAMK,eAAkB,GAAC,MAAMZ,WAAAA,CAAYa,GAAG,CAAC;YAAEC,GAAK,EAAA;cAAe;AAErE,QAAA,IAAI,CAACF,eAAmB,IAAA,CAACnB,EAAEsB,OAAO,CAACH,iBAAiBT,WAAc,CAAA,EAAA;;AAEhEV,YAAAA,CAAAA,CAAEuB,IAAI,CAACb,WAAac,CAAAA,CAAAA,OAAO,CAAC,CAACH,GAAAA,GAAAA;AAC3B,gBAAA,IAAIA,OAAOF,eAAiB,EAAA;AAC1BT,oBAAAA,WAAW,CAACW,GAAAA,CAAI,GAAGrB,CAAAA,CAAEyB,KAAK,CAACf,WAAW,CAACW,GAAI,CAAA,EAAEF,eAAe,CAACE,GAAI,CAAA,CAAA;AAClE;AACP,aAAA,CAAA;YACI,MAAMd,WAAAA,CAAYmB,GAAG,CAAC;gBAAEL,GAAK,EAAA,OAAA;gBAASM,KAAOjB,EAAAA;AAAW,aAAA,CAAA;AACzD;AACH,KAAA;AAEA,IAAA,MAAMkB,aAAa,OAAOrB,WAAAA,GAAAA;AACxB,QAAA,IAAI,CAAE,MAAMA,WAAYa,CAAAA,GAAG,CAAC;YAAEC,GAAK,EAAA;SAAa,CAAA,EAAA;AAC9C,YAAA,MAAMM,KAAQ,GAAA;gBACZE,cAAgB,EAAA;oBACdC,OAAS,EAAA,+BAAA;oBACTb,IAAM,EAAA,MAAA;oBACNc,OAAS,EAAA;wBACPC,IAAM,EAAA;4BACJjB,IAAM,EAAA,sBAAA;4BACNkB,KAAO,EAAA;AACR,yBAAA;wBACDC,cAAgB,EAAA,EAAA;wBAChBC,MAAQ,EAAA,gBAAA;AACRC,wBAAAA,OAAAA,EAAS,CAAC;;;;;cAKN;AACL;AACF,iBAAA;gBACDC,kBAAoB,EAAA;oBAClBP,OAAS,EAAA,mCAAA;oBACTb,IAAM,EAAA,cAAA;oBACNc,OAAS,EAAA;wBACPC,IAAM,EAAA;4BACJjB,IAAM,EAAA,sBAAA;4BACNkB,KAAO,EAAA;AACR,yBAAA;wBACDC,cAAgB,EAAA,EAAA;wBAChBC,MAAQ,EAAA,sBAAA;AACRC,wBAAAA,OAAAA,EAAS,CAAC;;;;;;cAMN;AACL;AACF;AACP,aAAA;YAEI,MAAM7B,WAAAA,CAAYmB,GAAG,CAAC;gBAAEL,GAAK,EAAA,OAAA;AAASM,gBAAAA;AAAK,aAAA,CAAA;AAC5C;AACH,KAAA;AAEA,IAAA,MAAMW,sBAAsB,OAAO/B,WAAAA,GAAAA;AACjC,QAAA,IAAI,CAAE,MAAMA,WAAYa,CAAAA,GAAG,CAAC;YAAEC,GAAK,EAAA;SAAgB,CAAA,EAAA;AACjD,YAAA,MAAMM,KAAQ,GAAA;gBACZY,YAAc,EAAA,IAAA;gBACdC,cAAgB,EAAA,IAAA;gBAChBH,kBAAoB,EAAA,KAAA;gBACpBI,oBAAsB,EAAA,IAAA;gBACtBC,8BAAgC,EAAA,IAAA;gBAChCC,YAAc,EAAA;AACpB,aAAA;YAEI,MAAMpC,WAAAA,CAAYmB,GAAG,CAAC;gBAAEL,GAAK,EAAA,UAAA;AAAYM,gBAAAA;AAAK,aAAA,CAAA;AAC/C;AACH,KAAA;IAEAiB,SAAiB,GAAA,OAAO,EAAEC,MAAM,EAAE,GAAA;QAChC,MAAMtC,WAAAA,GAAcsC,MAAOC,CAAAA,KAAK,CAAC;YAAEC,IAAM,EAAA,QAAA;YAAUhC,IAAM,EAAA;AAAmB,SAAA,CAAA;AAE5E,QAAA,MAAMT,SAAUC,CAAAA,WAAAA,CAAAA;AAChB,QAAA,MAAMqB,UAAWrB,CAAAA,WAAAA,CAAAA;AACjB,QAAA,MAAM+B,mBAAoB/B,CAAAA,WAAAA,CAAAA;QAE1B,MAAMsC,MAAAA,CACHG,OAAO,CAAC,mBAAA,CAAA,CACRC,cAAc,CAACC,YAAY,CAAC9C,uBAAAA,CAAwB+C,OAAO,CAAA;QAE9D,MAAMjD,UAAAA,CAAW,qBAAqBkD,UAAU,EAAA;AAEhD,QAAA,IAAI,CAACP,MAAOQ,CAAAA,MAAM,CAACjC,GAAG,CAAC,qCAAwC,CAAA,EAAA;AAC7D,YAAA,IAAIkC,OAAQC,CAAAA,GAAG,CAACC,QAAQ,KAAK,aAAe,EAAA;gBAC1C,MAAM,IAAIC,MACR,CAAC;yQACgQ,CAAC,CAAA;AAErQ;AAED,YAAA,MAAMC,YAAY5D,MAAO6D,CAAAA,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,QAAA,CAAA;AAElDf,YAAAA,MAAAA,CAAOQ,MAAM,CAAC3B,GAAG,CAAC,qCAAuCgC,EAAAA,SAAAA,CAAAA;AAEzD,YAAA,IAAI,CAACJ,OAAAA,CAAQC,GAAG,CAACM,UAAU,EAAE;AAC3B,gBAAA,MAAMC,OAAUR,GAAAA,OAAAA,CAAQC,GAAG,CAACQ,QAAQ,IAAI,MAAA;gBACxClB,MAAOmB,CAAAA,EAAE,CAACC,UAAU,CAACH,OAAAA,EAAS,CAAC,WAAW,EAAEJ,SAAU,CAAA,EAAE,CAAC,CAAA;gBACzDb,MAAOqB,CAAAA,GAAG,CAACC,IAAI,CACb,CAAC,qFAAqF,EAAEL,OAAQ,CAAA,2BAA2B,CAAC,CAAA;AAE/H;AACF;AACH,KAAA;;;;;;"}
+{"version":3,"file":"index.mjs","sources":["../../../server/bootstrap/index.js"],"sourcesContent":["'use strict';\n\n/**\n * An asynchronous bootstrap function that runs before\n * your application gets started.\n *\n * This gives you an opportunity to set up your data model,\n * run jobs, or perform some special logic.\n */\nconst crypto = require('crypto');\nconst _ = require('lodash');\nconst { getService } = require('../utils');\nconst usersPermissionsActions = require('./users-permissions-actions');\nconst {\n  DEFAULT_ACCESS_TOKEN_LIFESPAN,\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} = require('../services/constants');\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\nconst initGrant = async (pluginStore) => {\n  const allProviders = getService('providers-registry').getAll();\n\n  const grantConfig = Object.entries(allProviders).reduce((acc, [name, provider]) => {\n    const { icon, enabled, grantConfig } = provider;\n\n    acc[name] = {\n      icon,\n      enabled,\n      ...grantConfig,\n    };\n    return acc;\n  }, {});\n\n  const prevGrantConfig = (await pluginStore.get({ key: 'grant' })) || {};\n\n  if (!prevGrantConfig || !_.isEqual(prevGrantConfig, grantConfig)) {\n    // merge with the previous provider config.\n    _.keys(grantConfig).forEach((key) => {\n      if (key in prevGrantConfig) {\n        grantConfig[key] = _.merge(grantConfig[key], prevGrantConfig[key]);\n      }\n    });\n    await pluginStore.set({ key: 'grant', value: grantConfig });\n  }\n};\n\nconst initEmails = async (pluginStore) => {\n  if (!(await pluginStore.get({ key: 'email' }))) {\n    const value = {\n      reset_password: {\n        display: 'Email.template.reset_password',\n        icon: 'sync',\n        options: {\n          from: {\n            name: 'Administration Panel',\n            email: 'no-reply@strapi.io',\n          },\n          response_email: '',\n          object: 'Reset password',\n          message: `<p>We heard that you lost your password. Sorry about that!</p>\n\n<p>But don’t worry! You can use the following link to reset your password:</p>\n<p><%= URL %>?code=<%= TOKEN %></p>\n\n<p>Thanks.</p>`,\n        },\n      },\n      email_confirmation: {\n        display: 'Email.template.email_confirmation',\n        icon: 'check-square',\n        options: {\n          from: {\n            name: 'Administration Panel',\n            email: 'no-reply@strapi.io',\n          },\n          response_email: '',\n          object: 'Account confirmation',\n          message: `<p>Thank you for registering!</p>\n\n<p>You have to confirm your email address. Please click on the link below.</p>\n\n<p><%= URL %>?confirmation=<%= CODE %></p>\n\n<p>Thanks.</p>`,\n        },\n      },\n    };\n\n    await pluginStore.set({ key: 'email', value });\n  }\n};\n\nconst initAdvancedOptions = async (pluginStore) => {\n  if (!(await pluginStore.get({ key: 'advanced' }))) {\n    const value = {\n      unique_email: true,\n      allow_register: true,\n      email_confirmation: false,\n      email_reset_password: null,\n      email_confirmation_redirection: null,\n      default_role: 'authenticated',\n    };\n\n    await pluginStore.set({ key: 'advanced', value });\n  }\n};\n\nmodule.exports = async ({ strapi }) => {\n  const pluginStore = strapi.store({ type: 'plugin', name: 'users-permissions' });\n\n  await initGrant(pluginStore);\n  await initEmails(pluginStore);\n  await initAdvancedOptions(pluginStore);\n\n  await strapi\n    .service('admin::permission')\n    .actionProvider.registerMany(usersPermissionsActions.actions);\n\n  await getService('users-permissions').initialize();\n\n  // Define users-permissions origin configuration for sessionManager\n  const upConfig = strapi.config.get('plugin::users-permissions');\n  const sessionManager = getSessionManager();\n\n  if (sessionManager) {\n    sessionManager.defineOrigin('users-permissions', {\n      jwtSecret: upConfig.jwtSecret || strapi.config.get('admin.auth.secret'),\n      accessTokenLifespan: upConfig.sessions?.accessTokenLifespan || DEFAULT_ACCESS_TOKEN_LIFESPAN,\n      maxRefreshTokenLifespan:\n        upConfig.sessions?.maxRefreshTokenLifespan || DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n      idleRefreshTokenLifespan:\n        upConfig.sessions?.idleRefreshTokenLifespan || DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n      maxSessionLifespan: upConfig.sessions?.maxSessionLifespan || DEFAULT_MAX_SESSION_LIFESPAN,\n      idleSessionLifespan: upConfig.sessions?.idleSessionLifespan || DEFAULT_IDLE_SESSION_LIFESPAN,\n    });\n  }\n\n  if (!strapi.config.get('plugin::users-permissions.jwtSecret')) {\n    if (process.env.NODE_ENV !== 'development') {\n      throw new Error(\n        `Missing jwtSecret. Please, set configuration variable \"jwtSecret\" for the users-permissions plugin in config/plugins.js (ex: you can generate one using Node with \\`crypto.randomBytes(16).toString('base64')\\`).\nFor security reasons, prefer storing the secret in an environment variable and read it in config/plugins.js. See https://docs.strapi.io/developer-docs/latest/setup-deployment-guides/configurations/optional/environment.html#configuration-using-environment-variables.`\n      );\n    }\n\n    const jwtSecret = crypto.randomBytes(16).toString('base64');\n\n    strapi.config.set('plugin::users-permissions.jwtSecret', jwtSecret);\n\n    if (!process.env.JWT_SECRET) {\n      const envPath = process.env.ENV_PATH || '.env';\n      strapi.fs.appendFile(envPath, `JWT_SECRET=${jwtSecret}\\n`);\n      strapi.log.info(\n        `The Users & Permissions plugin automatically generated a jwt secret and stored it in ${envPath} under the name JWT_SECRET.`\n      );\n    }\n  }\n};\n"],"names":["crypto","require$$0","_","require$$1","getService","require$$2","usersPermissionsActions","require$$3","DEFAULT_ACCESS_TOKEN_LIFESPAN","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","require$$4","getSessionManager","manager","strapi","sessionManager","initGrant","pluginStore","allProviders","getAll","grantConfig","Object","entries","reduce","acc","name","provider","icon","enabled","prevGrantConfig","get","key","isEqual","keys","forEach","merge","set","value","initEmails","reset_password","display","options","from","email","response_email","object","message","email_confirmation","initAdvancedOptions","unique_email","allow_register","email_reset_password","email_confirmation_redirection","default_role","bootstrap","store","type","service","actionProvider","registerMany","actions","initialize","upConfig","config","defineOrigin","jwtSecret","accessTokenLifespan","sessions","maxRefreshTokenLifespan","idleRefreshTokenLifespan","maxSessionLifespan","idleSessionLifespan","process","env","NODE_ENV","Error","randomBytes","toString","JWT_SECRET","envPath","ENV_PATH","fs","appendFile","log","info"],"mappings":";;;;;;;;;;;AAEA;;;;;;AAMA,KACA,MAAMA,MAASC,GAAAA,UAAAA;AACf,IAAA,MAAMC,CAAIC,GAAAA,YAAAA;IACV,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AACvB,IAAA,MAAMC,uBAA0BC,GAAAA,8BAAAA,EAAAA;IAChC,MAAM,EACJC,6BAA6B,EAC7BC,kCAAkC,EAClCC,mCAAmC,EACnCC,4BAA4B,EAC5BC,6BAA6B,EAC9B,GAAGC,gBAAAA,EAAAA;AAEJ,IAAA,MAAMC,iBAAoB,GAAA,IAAA;QACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,QAAA,OAAOF,OAAW,IAAA,IAAA;AACpB,KAAA;AAEA,IAAA,MAAMG,YAAY,OAAOC,WAAAA,GAAAA;QACvB,MAAMC,YAAAA,GAAehB,UAAW,CAAA,oBAAA,CAAA,CAAsBiB,MAAM,EAAA;QAE5D,MAAMC,WAAAA,GAAcC,MAAOC,CAAAA,OAAO,CAACJ,YAAAA,CAAAA,CAAcK,MAAM,CAAC,CAACC,GAAAA,EAAK,CAACC,IAAAA,EAAMC,QAAS,CAAA,GAAA;AAC5E,YAAA,MAAM,EAAEC,IAAI,EAAEC,OAAO,EAAER,WAAW,EAAE,GAAGM,QAAAA;YAEvCF,GAAG,CAACC,KAAK,GAAG;AACVE,gBAAAA,IAAAA;AACAC,gBAAAA,OAAAA;AACA,gBAAA,GAAGR;AACT,aAAA;YACI,OAAOI,GAAAA;AACR,SAAA,EAAE,EAAE,CAAA;AAEL,QAAA,MAAMK,eAAkB,GAAC,MAAMZ,WAAAA,CAAYa,GAAG,CAAC;YAAEC,GAAK,EAAA;cAAe;AAErE,QAAA,IAAI,CAACF,eAAmB,IAAA,CAAC7B,EAAEgC,OAAO,CAACH,iBAAiBT,WAAc,CAAA,EAAA;;AAEhEpB,YAAAA,CAAAA,CAAEiC,IAAI,CAACb,WAAac,CAAAA,CAAAA,OAAO,CAAC,CAACH,GAAAA,GAAAA;AAC3B,gBAAA,IAAIA,OAAOF,eAAiB,EAAA;AAC1BT,oBAAAA,WAAW,CAACW,GAAAA,CAAI,GAAG/B,CAAAA,CAAEmC,KAAK,CAACf,WAAW,CAACW,GAAI,CAAA,EAAEF,eAAe,CAACE,GAAI,CAAA,CAAA;AAClE;AACP,aAAA,CAAA;YACI,MAAMd,WAAAA,CAAYmB,GAAG,CAAC;gBAAEL,GAAK,EAAA,OAAA;gBAASM,KAAOjB,EAAAA;AAAW,aAAA,CAAA;AACzD;AACH,KAAA;AAEA,IAAA,MAAMkB,aAAa,OAAOrB,WAAAA,GAAAA;AACxB,QAAA,IAAI,CAAE,MAAMA,WAAYa,CAAAA,GAAG,CAAC;YAAEC,GAAK,EAAA;SAAa,CAAA,EAAA;AAC9C,YAAA,MAAMM,KAAQ,GAAA;gBACZE,cAAgB,EAAA;oBACdC,OAAS,EAAA,+BAAA;oBACTb,IAAM,EAAA,MAAA;oBACNc,OAAS,EAAA;wBACPC,IAAM,EAAA;4BACJjB,IAAM,EAAA,sBAAA;4BACNkB,KAAO,EAAA;AACR,yBAAA;wBACDC,cAAgB,EAAA,EAAA;wBAChBC,MAAQ,EAAA,gBAAA;AACRC,wBAAAA,OAAAA,EAAS,CAAC;;;;;cAKN;AACL;AACF,iBAAA;gBACDC,kBAAoB,EAAA;oBAClBP,OAAS,EAAA,mCAAA;oBACTb,IAAM,EAAA,cAAA;oBACNc,OAAS,EAAA;wBACPC,IAAM,EAAA;4BACJjB,IAAM,EAAA,sBAAA;4BACNkB,KAAO,EAAA;AACR,yBAAA;wBACDC,cAAgB,EAAA,EAAA;wBAChBC,MAAQ,EAAA,sBAAA;AACRC,wBAAAA,OAAAA,EAAS,CAAC;;;;;;cAMN;AACL;AACF;AACP,aAAA;YAEI,MAAM7B,WAAAA,CAAYmB,GAAG,CAAC;gBAAEL,GAAK,EAAA,OAAA;AAASM,gBAAAA;AAAK,aAAA,CAAA;AAC5C;AACH,KAAA;AAEA,IAAA,MAAMW,sBAAsB,OAAO/B,WAAAA,GAAAA;AACjC,QAAA,IAAI,CAAE,MAAMA,WAAYa,CAAAA,GAAG,CAAC;YAAEC,GAAK,EAAA;SAAgB,CAAA,EAAA;AACjD,YAAA,MAAMM,KAAQ,GAAA;gBACZY,YAAc,EAAA,IAAA;gBACdC,cAAgB,EAAA,IAAA;gBAChBH,kBAAoB,EAAA,KAAA;gBACpBI,oBAAsB,EAAA,IAAA;gBACtBC,8BAAgC,EAAA,IAAA;gBAChCC,YAAc,EAAA;AACpB,aAAA;YAEI,MAAMpC,WAAAA,CAAYmB,GAAG,CAAC;gBAAEL,GAAK,EAAA,UAAA;AAAYM,gBAAAA;AAAK,aAAA,CAAA;AAC/C;AACH,KAAA;AAEAiB,IAAAA,SAAAA,GAAiB,OAAO,EAAExC,MAAAA,EAAAA,OAAM,EAAE,GAAA;QAChC,MAAMG,WAAAA,GAAcH,OAAOyC,CAAAA,KAAK,CAAC;YAAEC,IAAM,EAAA,QAAA;YAAU/B,IAAM,EAAA;AAAmB,SAAA,CAAA;AAE5E,QAAA,MAAMT,SAAUC,CAAAA,WAAAA,CAAAA;AAChB,QAAA,MAAMqB,UAAWrB,CAAAA,WAAAA,CAAAA;AACjB,QAAA,MAAM+B,mBAAoB/B,CAAAA,WAAAA,CAAAA;QAE1B,MAAMH,OAAAA,CACH2C,OAAO,CAAC,mBAAA,CAAA,CACRC,cAAc,CAACC,YAAY,CAACvD,uBAAAA,CAAwBwD,OAAO,CAAA;QAE9D,MAAM1D,UAAAA,CAAW,qBAAqB2D,UAAU,EAAA;;AAGhD,QAAA,MAAMC,QAAWhD,GAAAA,OAAAA,CAAOiD,MAAM,CAACjC,GAAG,CAAC,2BAAA,CAAA;AACnC,QAAA,MAAMf,cAAiBH,GAAAA,iBAAAA,EAAAA;AAEvB,QAAA,IAAIG,cAAgB,EAAA;YAClBA,cAAeiD,CAAAA,YAAY,CAAC,mBAAqB,EAAA;AAC/CC,gBAAAA,SAAAA,EAAWH,SAASG,SAAS,IAAInD,QAAOiD,MAAM,CAACjC,GAAG,CAAC,mBAAA,CAAA;gBACnDoC,mBAAqBJ,EAAAA,QAAAA,CAASK,QAAQ,EAAED,mBAAuB5D,IAAAA,6BAAAA;gBAC/D8D,uBACEN,EAAAA,QAAAA,CAASK,QAAQ,EAAEC,uBAA2B7D,IAAAA,kCAAAA;gBAChD8D,wBACEP,EAAAA,QAAAA,CAASK,QAAQ,EAAEE,wBAA4B7D,IAAAA,mCAAAA;gBACjD8D,kBAAoBR,EAAAA,QAAAA,CAASK,QAAQ,EAAEG,kBAAsB7D,IAAAA,4BAAAA;gBAC7D8D,mBAAqBT,EAAAA,QAAAA,CAASK,QAAQ,EAAEI,mBAAuB7D,IAAAA;AACrE,aAAA,CAAA;AACG;AAED,QAAA,IAAI,CAACI,OAAOiD,CAAAA,MAAM,CAACjC,GAAG,CAAC,qCAAwC,CAAA,EAAA;AAC7D,YAAA,IAAI0C,OAAQC,CAAAA,GAAG,CAACC,QAAQ,KAAK,aAAe,EAAA;gBAC1C,MAAM,IAAIC,MACR,CAAC;yQACgQ,CAAC,CAAA;AAErQ;AAED,YAAA,MAAMV,YAAYnE,MAAO8E,CAAAA,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,QAAA,CAAA;AAElD/D,YAAAA,OAAAA,CAAOiD,MAAM,CAAC3B,GAAG,CAAC,qCAAuC6B,EAAAA,SAAAA,CAAAA;AAEzD,YAAA,IAAI,CAACO,OAAAA,CAAQC,GAAG,CAACK,UAAU,EAAE;AAC3B,gBAAA,MAAMC,OAAUP,GAAAA,OAAAA,CAAQC,GAAG,CAACO,QAAQ,IAAI,MAAA;gBACxClE,OAAOmE,CAAAA,EAAE,CAACC,UAAU,CAACH,OAAAA,EAAS,CAAC,WAAW,EAAEd,SAAU,CAAA,EAAE,CAAC,CAAA;gBACzDnD,OAAOqE,CAAAA,GAAG,CAACC,IAAI,CACb,CAAC,qFAAqF,EAAEL,OAAQ,CAAA,2BAA2B,CAAC,CAAA;AAE/H;AACF;AACH,KAAA;;;;;;"}

package/dist/server/config.js

@@ -1,16 +1,32 @@
 'use strict';
 
+var constants = require('./services/constants.js');
+
 var config;
 var hasRequiredConfig;
 function requireConfig() {
     if (hasRequiredConfig) return config;
     hasRequiredConfig = 1;
+    const { DEFAULT_ACCESS_TOKEN_LIFESPAN, DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN, DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN, DEFAULT_MAX_SESSION_LIFESPAN, DEFAULT_IDLE_SESSION_LIFESPAN } = constants.__require();
     config = {
         default: ({ env })=>({
                 jwtSecret: env('JWT_SECRET'),
                 jwt: {
                     expiresIn: '30d'
                 },
+                /**
+	     * JWT management mode for the Content API authentication
+	     * - "legacy-support": use plugin JWTs (backward compatible)
+	     * - "refresh": use SessionManager (access/refresh tokens)
+	     */ jwtManagement: 'legacy-support',
+                sessions: {
+                    accessTokenLifespan: DEFAULT_ACCESS_TOKEN_LIFESPAN,
+                    maxRefreshTokenLifespan: DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,
+                    idleRefreshTokenLifespan: DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,
+                    maxSessionLifespan: DEFAULT_MAX_SESSION_LIFESPAN,
+                    idleSessionLifespan: DEFAULT_IDLE_SESSION_LIFESPAN,
+                    httpOnly: false
+                },
                 ratelimit: {
                     interval: 60000,
                     max: 10

package/dist/server/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sources":["../../server/config.js"],"sourcesContent":["'use strict';\n\nmodule.exports = {\n  default: ({ env }) => ({\n    jwtSecret: env('JWT_SECRET'),\n    jwt: {\n      expiresIn: '30d',\n    },\n    ratelimit: {\n      interval: 60000,\n      max: 10,\n    },\n    layout: {\n      user: {\n        actions: {\n          create: 'contentManagerUser.create', // Use the User plugin's controller.\n          update: 'contentManagerUser.update',\n        },\n      },\n    },\n    callback: {\n      validate(callback, provider) {\n        let uCallback;\n        let uProviderCallback;\n\n        try {\n          uCallback = new URL(callback);\n          uProviderCallback = new URL(provider.callback);\n        } catch {\n          throw new Error('The callback is not a valid URL');\n        }\n\n        // Make sure the different origin matches\n        if (uCallback.origin !== uProviderCallback.origin) {\n          throw new Error(\n            `Forbidden callback provided: origins don't match. Please verify your config.`\n          );\n        }\n\n        // Make sure the different pathname matches\n        if (uCallback.pathname !== uProviderCallback.pathname) {\n          throw new Error(\n            `Forbidden callback provided: pathname don't match. Please verify your config.`\n          );\n        }\n\n        // NOTE: We're not checking the search parameters on purpose to allow passing different states\n      },\n    },\n  }),\n  validator() {},\n};\n"],"names":["config","default","env","jwtSecret","jwt","expiresIn","ratelimit","interval","max","layout","user","actions","create","update","callback","validate","provider","uCallback","uProviderCallback","URL","Error","origin","pathname","validator"],"mappings":";;;;;;;IAEAA,MAAiB,GAAA;AACfC,QAAAA,OAAAA,EAAS,CAAC,EAAEC,GAAG,EAAE,IAAM;AACrBC,gBAAAA,SAAAA,EAAWD,GAAI,CAAA,YAAA,CAAA;gBACfE,GAAK,EAAA;oBACHC,SAAW,EAAA;AACZ,iBAAA;gBACDC,SAAW,EAAA;oBACTC,QAAU,EAAA,KAAA;oBACVC,GAAK,EAAA;AACN,iBAAA;gBACDC,MAAQ,EAAA;oBACNC,IAAM,EAAA;wBACJC,OAAS,EAAA;4BACPC,MAAQ,EAAA,2BAAA;4BACRC,MAAQ,EAAA;AACT;AACF;AACF,iBAAA;gBACDC,QAAU,EAAA;oBACRC,QAASD,CAAAA,CAAAA,QAAQ,EAAEE,QAAQ,EAAA;wBACzB,IAAIC,SAAAA;wBACJ,IAAIC,iBAAAA;wBAEJ,IAAI;AACFD,4BAAAA,SAAAA,GAAY,IAAIE,GAAIL,CAAAA,QAAAA,CAAAA;4BACpBI,iBAAoB,GAAA,IAAIC,GAAIH,CAAAA,QAAAA,CAASF,QAAQ,CAAA;AACvD,yBAAA,CAAU,OAAM;AACN,4BAAA,MAAM,IAAIM,KAAM,CAAA,iCAAA,CAAA;AACjB;;AAGD,wBAAA,IAAIH,SAAUI,CAAAA,MAAM,KAAKH,iBAAAA,CAAkBG,MAAM,EAAE;AACjD,4BAAA,MAAM,IAAID,KAAAA,CACR,CAAC,4EAA4E,CAAC,CAAA;AAEjF;;AAGD,wBAAA,IAAIH,SAAUK,CAAAA,QAAQ,KAAKJ,iBAAAA,CAAkBI,QAAQ,EAAE;AACrD,4BAAA,MAAM,IAAIF,KAAAA,CACR,CAAC,6EAA6E,CAAC,CAAA;AAElF;;AAGF;AACF;aACL,CAAA;QACEG,SAAc,CAAA,GAAA;AAChB,KAAA;;;;;;"}
+{"version":3,"file":"config.js","sources":["../../server/config.js"],"sourcesContent":["'use strict';\n\nconst {\n  DEFAULT_ACCESS_TOKEN_LIFESPAN,\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} = require('./services/constants');\n\nmodule.exports = {\n  default: ({ env }) => ({\n    jwtSecret: env('JWT_SECRET'),\n    jwt: {\n      expiresIn: '30d',\n    },\n    /**\n     * JWT management mode for the Content API authentication\n     * - \"legacy-support\": use plugin JWTs (backward compatible)\n     * - \"refresh\": use SessionManager (access/refresh tokens)\n     */\n    jwtManagement: 'legacy-support',\n    sessions: {\n      accessTokenLifespan: DEFAULT_ACCESS_TOKEN_LIFESPAN,\n      maxRefreshTokenLifespan: DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n      idleRefreshTokenLifespan: DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n      maxSessionLifespan: DEFAULT_MAX_SESSION_LIFESPAN,\n      idleSessionLifespan: DEFAULT_IDLE_SESSION_LIFESPAN,\n      httpOnly: false,\n    },\n    ratelimit: {\n      interval: 60000,\n      max: 10,\n    },\n    layout: {\n      user: {\n        actions: {\n          create: 'contentManagerUser.create', // Use the User plugin's controller.\n          update: 'contentManagerUser.update',\n        },\n      },\n    },\n    callback: {\n      validate(callback, provider) {\n        let uCallback;\n        let uProviderCallback;\n\n        try {\n          uCallback = new URL(callback);\n          uProviderCallback = new URL(provider.callback);\n        } catch {\n          throw new Error('The callback is not a valid URL');\n        }\n\n        // Make sure the different origin matches\n        if (uCallback.origin !== uProviderCallback.origin) {\n          throw new Error(\n            `Forbidden callback provided: origins don't match. Please verify your config.`\n          );\n        }\n\n        // Make sure the different pathname matches\n        if (uCallback.pathname !== uProviderCallback.pathname) {\n          throw new Error(\n            `Forbidden callback provided: pathname don't match. Please verify your config.`\n          );\n        }\n\n        // NOTE: We're not checking the search parameters on purpose to allow passing different states\n      },\n    },\n  }),\n  validator() {},\n};\n"],"names":["DEFAULT_ACCESS_TOKEN_LIFESPAN","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","require$$0","config","default","env","jwtSecret","jwt","expiresIn","jwtManagement","sessions","accessTokenLifespan","maxRefreshTokenLifespan","idleRefreshTokenLifespan","maxSessionLifespan","idleSessionLifespan","httpOnly","ratelimit","interval","max","layout","user","actions","create","update","callback","validate","provider","uCallback","uProviderCallback","URL","Error","origin","pathname","validator"],"mappings":";;;;;;;;;IAEA,MAAM,EACJA,6BAA6B,EAC7BC,kCAAkC,EAClCC,mCAAmC,EACnCC,4BAA4B,EAC5BC,6BAA6B,EAC9B,GAAGC,mBAAAA,EAAAA;IAEJC,MAAiB,GAAA;AACfC,QAAAA,OAAAA,EAAS,CAAC,EAAEC,GAAG,EAAE,IAAM;AACrBC,gBAAAA,SAAAA,EAAWD,GAAI,CAAA,YAAA,CAAA;gBACfE,GAAK,EAAA;oBACHC,SAAW,EAAA;AACZ,iBAAA;AACL;;;;AAIA,SACIC,aAAe,EAAA,gBAAA;gBACfC,QAAU,EAAA;oBACRC,mBAAqBd,EAAAA,6BAAAA;oBACrBe,uBAAyBd,EAAAA,kCAAAA;oBACzBe,wBAA0Bd,EAAAA,mCAAAA;oBAC1Be,kBAAoBd,EAAAA,4BAAAA;oBACpBe,mBAAqBd,EAAAA,6BAAAA;oBACrBe,QAAU,EAAA;AACX,iBAAA;gBACDC,SAAW,EAAA;oBACTC,QAAU,EAAA,KAAA;oBACVC,GAAK,EAAA;AACN,iBAAA;gBACDC,MAAQ,EAAA;oBACNC,IAAM,EAAA;wBACJC,OAAS,EAAA;4BACPC,MAAQ,EAAA,2BAAA;4BACRC,MAAQ,EAAA;AACT;AACF;AACF,iBAAA;gBACDC,QAAU,EAAA;oBACRC,QAASD,CAAAA,CAAAA,QAAQ,EAAEE,QAAQ,EAAA;wBACzB,IAAIC,SAAAA;wBACJ,IAAIC,iBAAAA;wBAEJ,IAAI;AACFD,4BAAAA,SAAAA,GAAY,IAAIE,GAAIL,CAAAA,QAAAA,CAAAA;4BACpBI,iBAAoB,GAAA,IAAIC,GAAIH,CAAAA,QAAAA,CAASF,QAAQ,CAAA;AACvD,yBAAA,CAAU,OAAM;AACN,4BAAA,MAAM,IAAIM,KAAM,CAAA,iCAAA,CAAA;AACjB;;AAGD,wBAAA,IAAIH,SAAUI,CAAAA,MAAM,KAAKH,iBAAAA,CAAkBG,MAAM,EAAE;AACjD,4BAAA,MAAM,IAAID,KAAAA,CACR,CAAC,4EAA4E,CAAC,CAAA;AAEjF;;AAGD,wBAAA,IAAIH,SAAUK,CAAAA,QAAQ,KAAKJ,iBAAAA,CAAkBI,QAAQ,EAAE;AACrD,4BAAA,MAAM,IAAIF,KAAAA,CACR,CAAC,6EAA6E,CAAC,CAAA;AAElF;;AAGF;AACF;aACL,CAAA;QACEG,SAAc,CAAA,GAAA;AAChB,KAAA;;;;;;"}

package/dist/server/config.mjs

@@ -1,14 +1,30 @@
+import { __require as requireConstants } from './services/constants.mjs';
+
 var config;
 var hasRequiredConfig;
 function requireConfig() {
     if (hasRequiredConfig) return config;
     hasRequiredConfig = 1;
+    const { DEFAULT_ACCESS_TOKEN_LIFESPAN, DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN, DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN, DEFAULT_MAX_SESSION_LIFESPAN, DEFAULT_IDLE_SESSION_LIFESPAN } = requireConstants();
     config = {
         default: ({ env })=>({
                 jwtSecret: env('JWT_SECRET'),
                 jwt: {
                     expiresIn: '30d'
                 },
+                /**
+	     * JWT management mode for the Content API authentication
+	     * - "legacy-support": use plugin JWTs (backward compatible)
+	     * - "refresh": use SessionManager (access/refresh tokens)
+	     */ jwtManagement: 'legacy-support',
+                sessions: {
+                    accessTokenLifespan: DEFAULT_ACCESS_TOKEN_LIFESPAN,
+                    maxRefreshTokenLifespan: DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,
+                    idleRefreshTokenLifespan: DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,
+                    maxSessionLifespan: DEFAULT_MAX_SESSION_LIFESPAN,
+                    idleSessionLifespan: DEFAULT_IDLE_SESSION_LIFESPAN,
+                    httpOnly: false
+                },
                 ratelimit: {
                     interval: 60000,
                     max: 10

package/dist/server/config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.mjs","sources":["../../server/config.js"],"sourcesContent":["'use strict';\n\nmodule.exports = {\n  default: ({ env }) => ({\n    jwtSecret: env('JWT_SECRET'),\n    jwt: {\n      expiresIn: '30d',\n    },\n    ratelimit: {\n      interval: 60000,\n      max: 10,\n    },\n    layout: {\n      user: {\n        actions: {\n          create: 'contentManagerUser.create', // Use the User plugin's controller.\n          update: 'contentManagerUser.update',\n        },\n      },\n    },\n    callback: {\n      validate(callback, provider) {\n        let uCallback;\n        let uProviderCallback;\n\n        try {\n          uCallback = new URL(callback);\n          uProviderCallback = new URL(provider.callback);\n        } catch {\n          throw new Error('The callback is not a valid URL');\n        }\n\n        // Make sure the different origin matches\n        if (uCallback.origin !== uProviderCallback.origin) {\n          throw new Error(\n            `Forbidden callback provided: origins don't match. Please verify your config.`\n          );\n        }\n\n        // Make sure the different pathname matches\n        if (uCallback.pathname !== uProviderCallback.pathname) {\n          throw new Error(\n            `Forbidden callback provided: pathname don't match. Please verify your config.`\n          );\n        }\n\n        // NOTE: We're not checking the search parameters on purpose to allow passing different states\n      },\n    },\n  }),\n  validator() {},\n};\n"],"names":["config","default","env","jwtSecret","jwt","expiresIn","ratelimit","interval","max","layout","user","actions","create","update","callback","validate","provider","uCallback","uProviderCallback","URL","Error","origin","pathname","validator"],"mappings":";;;;;IAEAA,MAAiB,GAAA;AACfC,QAAAA,OAAAA,EAAS,CAAC,EAAEC,GAAG,EAAE,IAAM;AACrBC,gBAAAA,SAAAA,EAAWD,GAAI,CAAA,YAAA,CAAA;gBACfE,GAAK,EAAA;oBACHC,SAAW,EAAA;AACZ,iBAAA;gBACDC,SAAW,EAAA;oBACTC,QAAU,EAAA,KAAA;oBACVC,GAAK,EAAA;AACN,iBAAA;gBACDC,MAAQ,EAAA;oBACNC,IAAM,EAAA;wBACJC,OAAS,EAAA;4BACPC,MAAQ,EAAA,2BAAA;4BACRC,MAAQ,EAAA;AACT;AACF;AACF,iBAAA;gBACDC,QAAU,EAAA;oBACRC,QAASD,CAAAA,CAAAA,QAAQ,EAAEE,QAAQ,EAAA;wBACzB,IAAIC,SAAAA;wBACJ,IAAIC,iBAAAA;wBAEJ,IAAI;AACFD,4BAAAA,SAAAA,GAAY,IAAIE,GAAIL,CAAAA,QAAAA,CAAAA;4BACpBI,iBAAoB,GAAA,IAAIC,GAAIH,CAAAA,QAAAA,CAASF,QAAQ,CAAA;AACvD,yBAAA,CAAU,OAAM;AACN,4BAAA,MAAM,IAAIM,KAAM,CAAA,iCAAA,CAAA;AACjB;;AAGD,wBAAA,IAAIH,SAAUI,CAAAA,MAAM,KAAKH,iBAAAA,CAAkBG,MAAM,EAAE;AACjD,4BAAA,MAAM,IAAID,KAAAA,CACR,CAAC,4EAA4E,CAAC,CAAA;AAEjF;;AAGD,wBAAA,IAAIH,SAAUK,CAAAA,QAAQ,KAAKJ,iBAAAA,CAAkBI,QAAQ,EAAE;AACrD,4BAAA,MAAM,IAAIF,KAAAA,CACR,CAAC,6EAA6E,CAAC,CAAA;AAElF;;AAGF;AACF;aACL,CAAA;QACEG,SAAc,CAAA,GAAA;AAChB,KAAA;;;;;;"}
+{"version":3,"file":"config.mjs","sources":["../../server/config.js"],"sourcesContent":["'use strict';\n\nconst {\n  DEFAULT_ACCESS_TOKEN_LIFESPAN,\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} = require('./services/constants');\n\nmodule.exports = {\n  default: ({ env }) => ({\n    jwtSecret: env('JWT_SECRET'),\n    jwt: {\n      expiresIn: '30d',\n    },\n    /**\n     * JWT management mode for the Content API authentication\n     * - \"legacy-support\": use plugin JWTs (backward compatible)\n     * - \"refresh\": use SessionManager (access/refresh tokens)\n     */\n    jwtManagement: 'legacy-support',\n    sessions: {\n      accessTokenLifespan: DEFAULT_ACCESS_TOKEN_LIFESPAN,\n      maxRefreshTokenLifespan: DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n      idleRefreshTokenLifespan: DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n      maxSessionLifespan: DEFAULT_MAX_SESSION_LIFESPAN,\n      idleSessionLifespan: DEFAULT_IDLE_SESSION_LIFESPAN,\n      httpOnly: false,\n    },\n    ratelimit: {\n      interval: 60000,\n      max: 10,\n    },\n    layout: {\n      user: {\n        actions: {\n          create: 'contentManagerUser.create', // Use the User plugin's controller.\n          update: 'contentManagerUser.update',\n        },\n      },\n    },\n    callback: {\n      validate(callback, provider) {\n        let uCallback;\n        let uProviderCallback;\n\n        try {\n          uCallback = new URL(callback);\n          uProviderCallback = new URL(provider.callback);\n        } catch {\n          throw new Error('The callback is not a valid URL');\n        }\n\n        // Make sure the different origin matches\n        if (uCallback.origin !== uProviderCallback.origin) {\n          throw new Error(\n            `Forbidden callback provided: origins don't match. Please verify your config.`\n          );\n        }\n\n        // Make sure the different pathname matches\n        if (uCallback.pathname !== uProviderCallback.pathname) {\n          throw new Error(\n            `Forbidden callback provided: pathname don't match. Please verify your config.`\n          );\n        }\n\n        // NOTE: We're not checking the search parameters on purpose to allow passing different states\n      },\n    },\n  }),\n  validator() {},\n};\n"],"names":["DEFAULT_ACCESS_TOKEN_LIFESPAN","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","require$$0","config","default","env","jwtSecret","jwt","expiresIn","jwtManagement","sessions","accessTokenLifespan","maxRefreshTokenLifespan","idleRefreshTokenLifespan","maxSessionLifespan","idleSessionLifespan","httpOnly","ratelimit","interval","max","layout","user","actions","create","update","callback","validate","provider","uCallback","uProviderCallback","URL","Error","origin","pathname","validator"],"mappings":";;;;;;;IAEA,MAAM,EACJA,6BAA6B,EAC7BC,kCAAkC,EAClCC,mCAAmC,EACnCC,4BAA4B,EAC5BC,6BAA6B,EAC9B,GAAGC,gBAAAA,EAAAA;IAEJC,MAAiB,GAAA;AACfC,QAAAA,OAAAA,EAAS,CAAC,EAAEC,GAAG,EAAE,IAAM;AACrBC,gBAAAA,SAAAA,EAAWD,GAAI,CAAA,YAAA,CAAA;gBACfE,GAAK,EAAA;oBACHC,SAAW,EAAA;AACZ,iBAAA;AACL;;;;AAIA,SACIC,aAAe,EAAA,gBAAA;gBACfC,QAAU,EAAA;oBACRC,mBAAqBd,EAAAA,6BAAAA;oBACrBe,uBAAyBd,EAAAA,kCAAAA;oBACzBe,wBAA0Bd,EAAAA,mCAAAA;oBAC1Be,kBAAoBd,EAAAA,4BAAAA;oBACpBe,mBAAqBd,EAAAA,6BAAAA;oBACrBe,QAAU,EAAA;AACX,iBAAA;gBACDC,SAAW,EAAA;oBACTC,QAAU,EAAA,KAAA;oBACVC,GAAK,EAAA;AACN,iBAAA;gBACDC,MAAQ,EAAA;oBACNC,IAAM,EAAA;wBACJC,OAAS,EAAA;4BACPC,MAAQ,EAAA,2BAAA;4BACRC,MAAQ,EAAA;AACT;AACF;AACF,iBAAA;gBACDC,QAAU,EAAA;oBACRC,QAASD,CAAAA,CAAAA,QAAQ,EAAEE,QAAQ,EAAA;wBACzB,IAAIC,SAAAA;wBACJ,IAAIC,iBAAAA;wBAEJ,IAAI;AACFD,4BAAAA,SAAAA,GAAY,IAAIE,GAAIL,CAAAA,QAAAA,CAAAA;4BACpBI,iBAAoB,GAAA,IAAIC,GAAIH,CAAAA,QAAAA,CAASF,QAAQ,CAAA;AACvD,yBAAA,CAAU,OAAM;AACN,4BAAA,MAAM,IAAIM,KAAM,CAAA,iCAAA,CAAA;AACjB;;AAGD,wBAAA,IAAIH,SAAUI,CAAAA,MAAM,KAAKH,iBAAAA,CAAkBG,MAAM,EAAE;AACjD,4BAAA,MAAM,IAAID,KAAAA,CACR,CAAC,4EAA4E,CAAC,CAAA;AAEjF;;AAGD,wBAAA,IAAIH,SAAUK,CAAAA,QAAQ,KAAKJ,iBAAAA,CAAkBI,QAAQ,EAAE;AACrD,4BAAA,MAAM,IAAIF,KAAAA,CACR,CAAC,6EAA6E,CAAC,CAAA;AAElF;;AAGF;AACF;aACL,CAAA;QACEG,SAAc,CAAA,GAAA;AAChB,KAAA;;;;;;"}

package/dist/server/controllers/auth.js

@@ -31,6 +31,10 @@ function requireAuth() {
             auth
         });
     };
+    const extractDeviceId = (requestBody)=>{
+        const { deviceId } = requestBody || {};
+        return typeof deviceId === 'string' && deviceId.length > 0 ? deviceId : undefined;
+    };
     auth = ({ strapi: strapi1 })=>({
             async callback (ctx) {
                 const provider = ctx.params.provider || 'local';
@@ -86,6 +90,40 @@ function requireAuth() {
                     if (user.blocked === true) {
                         throw new ApplicationError('Your account has been blocked by an administrator');
                     }
+                    const mode = strapi1.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+                    if (mode === 'refresh') {
+                        const deviceId = extractDeviceId(ctx.request.body);
+                        const refresh = await strapi1.sessionManager('users-permissions').generateRefreshToken(String(user.id), deviceId, {
+                            type: 'refresh'
+                        });
+                        const access = await strapi1.sessionManager('users-permissions').generateAccessToken(refresh.token);
+                        if ('error' in access) {
+                            throw new ApplicationError('Invalid credentials');
+                        }
+                        const upSessions = strapi1.config.get('plugin::users-permissions.sessions');
+                        const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
+                        if (upSessions?.httpOnly || requestHttpOnly) {
+                            const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
+                            const cookieOptions = {
+                                httpOnly: true,
+                                secure: Boolean(upSessions.cookie?.secure),
+                                sameSite: upSessions.cookie?.sameSite ?? 'lax',
+                                path: upSessions.cookie?.path ?? '/',
+                                domain: upSessions.cookie?.domain,
+                                overwrite: true
+                            };
+                            ctx.cookies.set(cookieName, refresh.token, cookieOptions);
+                            return ctx.send({
+                                jwt: access.token,
+                                user: await sanitizeUser(user, ctx)
+                            });
+                        }
+                        return ctx.send({
+                            jwt: access.token,
+                            refreshToken: refresh.token,
+                            user: await sanitizeUser(user, ctx)
+                        });
+                    }
                     return ctx.send({
                         jwt: getService('jwt').issue({
                             id: user.id
@@ -99,6 +137,40 @@ function requireAuth() {
                     if (user.blocked) {
                         throw new ForbiddenError('Your account has been blocked by an administrator');
                     }
+                    const mode = strapi1.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+                    if (mode === 'refresh') {
+                        const deviceId = extractDeviceId(ctx.request.body);
+                        const refresh = await strapi1.sessionManager('users-permissions').generateRefreshToken(String(user.id), deviceId, {
+                            type: 'refresh'
+                        });
+                        const access = await strapi1.sessionManager('users-permissions').generateAccessToken(refresh.token);
+                        if ('error' in access) {
+                            throw new ApplicationError('Invalid credentials');
+                        }
+                        const upSessions = strapi1.config.get('plugin::users-permissions.sessions');
+                        const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
+                        if (upSessions?.httpOnly || requestHttpOnly) {
+                            const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
+                            const cookieOptions = {
+                                httpOnly: true,
+                                secure: Boolean(upSessions.cookie?.secure),
+                                sameSite: upSessions.cookie?.sameSite ?? 'lax',
+                                path: upSessions.cookie?.path ?? '/',
+                                domain: upSessions.cookie?.domain,
+                                overwrite: true
+                            };
+                            ctx.cookies.set(cookieName, refresh.token, cookieOptions);
+                            return ctx.send({
+                                jwt: access.token,
+                                user: await sanitizeUser(user, ctx)
+                            });
+                        }
+                        return ctx.send({
+                            jwt: access.token,
+                            refreshToken: refresh.token,
+                            user: await sanitizeUser(user, ctx)
+                        });
+                    }
                     return ctx.send({
                         jwt: getService('jwt').issue({
                             id: user.id
@@ -130,7 +202,28 @@ function requireAuth() {
                 await getService('user').edit(user.id, {
                     password
                 });
-                ctx.send({
+                const mode = strapi1.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+                if (mode === 'refresh') {
+                    const deviceId = extractDeviceId(ctx.request.body);
+                    if (deviceId) {
+                        // Invalidate sessions: specific device if deviceId provided
+                        await strapi1.sessionManager('users-permissions').invalidateRefreshToken(String(user.id), deviceId);
+                    }
+                    const newDeviceId = deviceId || crypto.randomUUID();
+                    const refresh = await strapi1.sessionManager('users-permissions').generateRefreshToken(String(user.id), newDeviceId, {
+                        type: 'refresh'
+                    });
+                    const access = await strapi1.sessionManager('users-permissions').generateAccessToken(refresh.token);
+                    if ('error' in access) {
+                        throw new ApplicationError('Invalid credentials');
+                    }
+                    return ctx.send({
+                        jwt: access.token,
+                        refreshToken: refresh.token,
+                        user: await sanitizeUser(user, ctx)
+                    });
+                }
+                return ctx.send({
                     jwt: getService('jwt').issue({
                         id: user.id
                     }),
@@ -155,14 +248,100 @@ function requireAuth() {
                     resetPasswordToken: null,
                     password
                 });
-                // Update the user.
-                ctx.send({
+                const mode = strapi1.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+                if (mode === 'refresh') {
+                    const deviceId = extractDeviceId(ctx.request.body);
+                    if (deviceId) {
+                        // Invalidate sessions: specific device if deviceId provided
+                        await strapi1.sessionManager('users-permissions').invalidateRefreshToken(String(user.id), deviceId);
+                    }
+                    const newDeviceId = deviceId || crypto.randomUUID();
+                    const refresh = await strapi1.sessionManager('users-permissions').generateRefreshToken(String(user.id), newDeviceId, {
+                        type: 'refresh'
+                    });
+                    const access = await strapi1.sessionManager('users-permissions').generateAccessToken(refresh.token);
+                    if ('error' in access) {
+                        throw new ApplicationError('Invalid credentials');
+                    }
+                    return ctx.send({
+                        jwt: access.token,
+                        refreshToken: refresh.token,
+                        user: await sanitizeUser(user, ctx)
+                    });
+                }
+                return ctx.send({
                     jwt: getService('jwt').issue({
                         id: user.id
                     }),
                     user: await sanitizeUser(user, ctx)
                 });
             },
+            async refresh (ctx) {
+                const mode = strapi1.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+                if (mode !== 'refresh') {
+                    return ctx.notFound();
+                }
+                const { refreshToken } = ctx.request.body || {};
+                if (!refreshToken || typeof refreshToken !== 'string') {
+                    return ctx.badRequest('Missing refresh token');
+                }
+                const rotation = await strapi1.sessionManager('users-permissions').rotateRefreshToken(refreshToken);
+                if ('error' in rotation) {
+                    return ctx.unauthorized('Invalid refresh token');
+                }
+                const result = await strapi1.sessionManager('users-permissions').generateAccessToken(rotation.token);
+                if ('error' in result) {
+                    return ctx.unauthorized('Invalid refresh token');
+                }
+                const upSessions = strapi1.config.get('plugin::users-permissions.sessions');
+                const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
+                if (upSessions?.httpOnly || requestHttpOnly) {
+                    const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
+                    const cookieOptions = {
+                        httpOnly: true,
+                        secure: Boolean(upSessions.cookie?.secure),
+                        sameSite: upSessions.cookie?.sameSite ?? 'lax',
+                        path: upSessions.cookie?.path ?? '/',
+                        domain: upSessions.cookie?.domain,
+                        overwrite: true
+                    };
+                    ctx.cookies.set(cookieName, rotation.token, cookieOptions);
+                    return ctx.send({
+                        jwt: result.token
+                    });
+                }
+                return ctx.send({
+                    jwt: result.token,
+                    refreshToken: rotation.token
+                });
+            },
+            async logout (ctx) {
+                const mode = strapi1.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+                if (mode !== 'refresh') {
+                    return ctx.notFound();
+                }
+                // Invalidate all sessions for the authenticated user, or by deviceId if provided
+                if (!ctx.state.user) {
+                    return ctx.unauthorized('Missing authentication');
+                }
+                const deviceId = extractDeviceId(ctx.request.body);
+                try {
+                    await strapi1.sessionManager('users-permissions').invalidateRefreshToken(String(ctx.state.user.id), deviceId);
+                } catch (err) {
+                    strapi1.log.error('UP logout failed', err);
+                }
+                const upSessions = strapi1.config.get('plugin::users-permissions.sessions');
+                const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
+                if (upSessions?.httpOnly || requestHttpOnly) {
+                    const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
+                    ctx.cookies.set(cookieName, '', {
+                        expires: new Date(0)
+                    });
+                }
+                return ctx.send({
+                    ok: true
+                });
+            },
             async connect (ctx, next) {
                 const grant = require$$6.koa();
                 const providers = await strapi1.store({
@@ -356,6 +535,22 @@ function requireAuth() {
                         user: sanitizedUser
                     });
                 }
+                const mode = strapi1.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+                if (mode === 'refresh') {
+                    const deviceId = extractDeviceId(ctx.request.body) || crypto.randomUUID();
+                    const refresh = await strapi1.sessionManager('users-permissions').generateRefreshToken(String(user.id), deviceId, {
+                        type: 'refresh'
+                    });
+                    const access = await strapi1.sessionManager('users-permissions').generateAccessToken(refresh.token);
+                    if ('error' in access) {
+                        throw new ApplicationError('Invalid credentials');
+                    }
+                    return ctx.send({
+                        jwt: access.token,
+                        refreshToken: refresh.token,
+                        user: sanitizedUser
+                    });
+                }
                 const jwt = getService('jwt').issue(_.pick(user, [
                     'id'
                 ]));