@strapi/plugin-users-permissions 5.48.1 → 5.50.0

package/server/controllers/auth.js

@@ -12,6 +12,7 @@ const _ = require('lodash');
 const { concat, compact, isArray } = require('lodash/fp');
 const utils = require('@strapi/utils');
 const { getService } = require('../utils');
+const { buildRefreshCookieOptions } = require('../utils/refresh-cookie-options');
 const {
   validateCallbackBody,
   validateRegisterBody,
@@ -23,6 +24,7 @@ const {
 } = require('./validation/auth');
 
 const { ApplicationError, ValidationError, ForbiddenError } = utils.errors;
+const { buildSessionMetadata, sanitizeSessionEntry, sortSessionsForDisplay } = utils;
 
 const sanitizeUser = (user, ctx) => {
   const { auth } = ctx.state;
@@ -37,6 +39,102 @@ const extractDeviceId = (requestBody) => {
   return typeof deviceId === 'string' && deviceId.length > 0 ? deviceId : undefined;
 };
 
+const buildSessionMetadataFromContext = (ctx) =>
+  buildSessionMetadata({
+    userAgent: ctx.request.headers['user-agent'],
+  });
+
+const sendRefreshAuthResponse = async (strapi, ctx, user, { metadata } = {}) => {
+  const deviceId = extractDeviceId(ctx.request.body);
+  const tokenOptions = { type: 'refresh', ...(metadata ? { metadata } : {}) };
+
+  const refresh = await strapi
+    .sessionManager('users-permissions')
+    .generateRefreshToken(String(user.id), deviceId, tokenOptions);
+
+  const access = await strapi
+    .sessionManager('users-permissions')
+    .generateAccessToken(refresh.token);
+  if ('error' in access) {
+    throw new ApplicationError('Invalid credentials');
+  }
+
+  const upSessions = strapi.config.get('plugin::users-permissions.sessions');
+  const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
+
+  if (upSessions?.httpOnly || requestHttpOnly) {
+    const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
+    const isProduction = process.env.NODE_ENV === 'production';
+    ctx.cookies.set(cookieName, refresh.token, buildRefreshCookieOptions(upSessions, isProduction));
+    return ctx.send({ jwt: access.token, user: await sanitizeUser(user, ctx) });
+  }
+
+  return ctx.send({
+    jwt: access.token,
+    refreshToken: refresh.token,
+    user: await sanitizeUser(user, ctx),
+  });
+};
+
+const reissueTokensAfterPasswordChange = async (strapi, ctx, user) => {
+  const deviceId = extractDeviceId(ctx.request.body);
+
+  await strapi.sessionManager('users-permissions').invalidateRefreshToken(String(user.id));
+
+  const newDeviceId = deviceId || crypto.randomUUID();
+  const refresh = await strapi
+    .sessionManager('users-permissions')
+    .generateRefreshToken(String(user.id), newDeviceId, { type: 'refresh' });
+
+  const access = await strapi
+    .sessionManager('users-permissions')
+    .generateAccessToken(refresh.token);
+  if ('error' in access) {
+    throw new ApplicationError('Invalid credentials');
+  }
+
+  return ctx.send({
+    jwt: access.token,
+    refreshToken: refresh.token,
+    user: await sanitizeUser(user, ctx),
+  });
+};
+
+const revokeLogoutSessions = async (strapi, ctx, userId, { scope, deviceId, body }) => {
+  const sessionManager = strapi.sessionManager('users-permissions');
+  const upSessions = strapi.config.get('plugin::users-permissions.sessions');
+
+  if (scope === 'all') {
+    await sessionManager.invalidateRefreshToken(userId);
+    return;
+  }
+
+  if (deviceId) {
+    await sessionManager.invalidateRefreshToken(userId, deviceId);
+    return;
+  }
+
+  let currentSessionId = ctx.state.session?.id;
+  const cookieName = upSessions?.cookie?.name || 'strapi_up_refresh';
+  const refreshToken =
+    ctx.cookies.get(cookieName) ||
+    (typeof body.refreshToken === 'string' ? body.refreshToken : undefined);
+
+  if (refreshToken) {
+    const validation = await sessionManager.validateRefreshToken(refreshToken);
+    if (validation.isValid) {
+      currentSessionId = validation.sessionId;
+    }
+  }
+
+  if (currentSessionId) {
+    await sessionManager.revokeSessionById(userId, currentSessionId);
+    return;
+  }
+
+  await sessionManager.invalidateRefreshToken(userId);
+};
+
 module.exports = ({ strapi }) => ({
   async callback(ctx) {
     const provider = ctx.params.provider || 'local';
@@ -94,46 +192,8 @@ module.exports = ({ strapi }) => ({
 
       const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
       if (mode === 'refresh') {
-        const deviceId = extractDeviceId(ctx.request.body);
-
-        const refresh = await strapi
-          .sessionManager('users-permissions')
-          .generateRefreshToken(String(user.id), deviceId, { type: 'refresh' });
-
-        const access = await strapi
-          .sessionManager('users-permissions')
-          .generateAccessToken(refresh.token);
-        if ('error' in access) {
-          throw new ApplicationError('Invalid credentials');
-        }
-
-        const upSessions = strapi.config.get('plugin::users-permissions.sessions');
-        const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
-        if (upSessions?.httpOnly || requestHttpOnly) {
-          const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
-          const isProduction = process.env.NODE_ENV === 'production';
-          const isSecure =
-            typeof upSessions.cookie?.secure === 'boolean'
-              ? upSessions.cookie?.secure
-              : isProduction;
-
-          const cookieOptions = {
-            httpOnly: true,
-            secure: isSecure,
-            sameSite: upSessions.cookie?.sameSite ?? 'lax',
-            path: upSessions.cookie?.path ?? '/',
-            domain: upSessions.cookie?.domain,
-            overwrite: true,
-          };
-
-          ctx.cookies.set(cookieName, refresh.token, cookieOptions);
-          return ctx.send({ jwt: access.token, user: await sanitizeUser(user, ctx) });
-        }
-
-        return ctx.send({
-          jwt: access.token,
-          refreshToken: refresh.token,
-          user: await sanitizeUser(user, ctx),
+        return sendRefreshAuthResponse(strapi, ctx, user, {
+          metadata: buildSessionMetadataFromContext(ctx),
         });
       }
 
@@ -153,44 +213,8 @@ module.exports = ({ strapi }) => ({
 
       const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
       if (mode === 'refresh') {
-        const deviceId = extractDeviceId(ctx.request.body);
-
-        const refresh = await strapi
-          .sessionManager('users-permissions')
-          .generateRefreshToken(String(user.id), deviceId, { type: 'refresh' });
-
-        const access = await strapi
-          .sessionManager('users-permissions')
-          .generateAccessToken(refresh.token);
-        if ('error' in access) {
-          throw new ApplicationError('Invalid credentials');
-        }
-
-        const upSessions = strapi.config.get('plugin::users-permissions.sessions');
-        const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
-        if (upSessions?.httpOnly || requestHttpOnly) {
-          const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
-          const isProduction = process.env.NODE_ENV === 'production';
-          const isSecure =
-            typeof upSessions.cookie?.secure === 'boolean'
-              ? upSessions.cookie?.secure
-              : isProduction;
-
-          const cookieOptions = {
-            httpOnly: true,
-            secure: isSecure,
-            sameSite: upSessions.cookie?.sameSite ?? 'lax',
-            path: upSessions.cookie?.path ?? '/',
-            domain: upSessions.cookie?.domain,
-            overwrite: true,
-          };
-          ctx.cookies.set(cookieName, refresh.token, cookieOptions);
-          return ctx.send({ jwt: access.token, user: await sanitizeUser(user, ctx) });
-        }
-        return ctx.send({
-          jwt: access.token,
-          refreshToken: refresh.token,
-          user: await sanitizeUser(user, ctx),
+        return sendRefreshAuthResponse(strapi, ctx, user, {
+          metadata: buildSessionMetadataFromContext(ctx),
         });
       }
 
@@ -233,28 +257,7 @@ module.exports = ({ strapi }) => ({
 
     const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
     if (mode === 'refresh') {
-      const deviceId = extractDeviceId(ctx.request.body);
-
-      // Invalidate all sessions when password changes for security
-      await strapi.sessionManager('users-permissions').invalidateRefreshToken(String(user.id));
-
-      const newDeviceId = deviceId || crypto.randomUUID();
-      const refresh = await strapi
-        .sessionManager('users-permissions')
-        .generateRefreshToken(String(user.id), newDeviceId, { type: 'refresh' });
-
-      const access = await strapi
-        .sessionManager('users-permissions')
-        .generateAccessToken(refresh.token);
-      if ('error' in access) {
-        throw new ApplicationError('Invalid credentials');
-      }
-
-      return ctx.send({
-        jwt: access.token,
-        refreshToken: refresh.token,
-        user: await sanitizeUser(user, ctx),
-      });
+      return reissueTokensAfterPasswordChange(strapi, ctx, user);
     }
 
     return ctx.send({
@@ -290,28 +293,7 @@ module.exports = ({ strapi }) => ({
 
     const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
     if (mode === 'refresh') {
-      const deviceId = extractDeviceId(ctx.request.body);
-
-      // Invalidate all sessions when password is reset for security
-      await strapi.sessionManager('users-permissions').invalidateRefreshToken(String(user.id));
-
-      const newDeviceId = deviceId || crypto.randomUUID();
-      const refresh = await strapi
-        .sessionManager('users-permissions')
-        .generateRefreshToken(String(user.id), newDeviceId, { type: 'refresh' });
-
-      const access = await strapi
-        .sessionManager('users-permissions')
-        .generateAccessToken(refresh.token);
-      if ('error' in access) {
-        throw new ApplicationError('Invalid credentials');
-      }
-
-      return ctx.send({
-        jwt: access.token,
-        refreshToken: refresh.token,
-        user: await sanitizeUser(user, ctx),
-      });
+      return reissueTokensAfterPasswordChange(strapi, ctx, user);
     }
 
     return ctx.send({
@@ -355,18 +337,11 @@ module.exports = ({ strapi }) => ({
     const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
     if (upSessions?.httpOnly || requestHttpOnly) {
       const isProduction = process.env.NODE_ENV === 'production';
-      const isSecure =
-        typeof upSessions.cookie?.secure === 'boolean' ? upSessions.cookie?.secure : isProduction;
-
-      const cookieOptions = {
-        httpOnly: true,
-        secure: isSecure,
-        sameSite: upSessions.cookie?.sameSite ?? 'lax',
-        path: upSessions.cookie?.path ?? '/',
-        domain: upSessions.cookie?.domain,
-        overwrite: true,
-      };
-      ctx.cookies.set(cookieName, rotation.token, cookieOptions);
+      ctx.cookies.set(
+        cookieName,
+        rotation.token,
+        buildRefreshCookieOptions(upSessions, isProduction)
+      );
       return ctx.send({ jwt: result.token });
     }
     return ctx.send({ jwt: result.token, refreshToken: rotation.token });
@@ -377,21 +352,22 @@ module.exports = ({ strapi }) => ({
       return ctx.notFound();
     }
 
-    // Invalidate all sessions for the authenticated user, or by deviceId if provided
     if (!ctx.state.user) {
       return ctx.unauthorized('Missing authentication');
     }
 
-    const deviceId = extractDeviceId(ctx.request.body);
+    const userId = String(ctx.state.user.id);
+    const upSessions = strapi.config.get('plugin::users-permissions.sessions');
+    const body = ctx.request.body || {};
+    const scope = typeof body.scope === 'string' ? body.scope : undefined;
+    const deviceId = extractDeviceId(body);
+
     try {
-      await strapi
-        .sessionManager('users-permissions')
-        .invalidateRefreshToken(String(ctx.state.user.id), deviceId);
+      await revokeLogoutSessions(strapi, ctx, userId, { scope, deviceId, body });
     } catch (err) {
       strapi.log.error('UP logout failed', err);
     }
 
-    const upSessions = strapi.config.get('plugin::users-permissions.sessions');
     const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
     if (upSessions?.httpOnly || requestHttpOnly) {
       const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
@@ -399,6 +375,48 @@ module.exports = ({ strapi }) => ({
     }
     return ctx.send({ ok: true });
   },
+  async getSessions(ctx) {
+    const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+    if (mode !== 'refresh') {
+      return ctx.notFound();
+    }
+
+    if (!ctx.state.user) {
+      return ctx.unauthorized('Missing authentication');
+    }
+
+    const currentSessionId = ctx.state.session?.id;
+    const sessions = await strapi
+      .sessionManager('users-permissions')
+      .listSessions(String(ctx.state.user.id));
+
+    const data = sortSessionsForDisplay(
+      sessions.map((session) => sanitizeSessionEntry(session, currentSessionId))
+    );
+
+    return ctx.send({ data });
+  },
+  async revokeSession(ctx) {
+    const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+    if (mode !== 'refresh') {
+      return ctx.notFound();
+    }
+
+    if (!ctx.state.user) {
+      return ctx.unauthorized('Missing authentication');
+    }
+
+    const { sessionId } = ctx.params;
+    const revoked = await strapi
+      .sessionManager('users-permissions')
+      .revokeSessionById(String(ctx.state.user.id), sessionId);
+
+    if (!revoked) {
+      return ctx.notFound('Session not found');
+    }
+
+    return ctx.send({ data: {} });
+  },
   async connect(ctx, next) {
     const grant = require('grant').koa();
 
@@ -617,7 +635,10 @@ module.exports = ({ strapi }) => ({
 
       const refresh = await strapi
         .sessionManager('users-permissions')
-        .generateRefreshToken(String(user.id), deviceId, { type: 'refresh' });
+        .generateRefreshToken(String(user.id), deviceId, {
+          type: 'refresh',
+          metadata: buildSessionMetadataFromContext(ctx),
+        });
 
       const access = await strapi
         .sessionManager('users-permissions')

package/server/controllers/validation/user.js

@@ -6,6 +6,17 @@ const deleteRoleSchema = yup.object().shape({
   role: yup.strapiID().required(),
 });
 
+// A role relation entry may be referenced by numeric `id` (legacy) or by
+// `documentId` (the v5 default), but must carry at least one of them.
+const roleRelationEntrySchema = yup
+  .object()
+  .shape({ id: yup.strapiID(), documentId: yup.strapiID() })
+  .test(
+    'id-or-documentId',
+    'Relation entry must include an id or documentId',
+    (entry) => !!entry && (entry.id != null || entry.documentId != null)
+  );
+
 const createUserBodySchema = yup.object().shape({
   email: yup.string().email().required(),
   username: yup.string().min(1).required(),
@@ -17,7 +28,7 @@ const createUserBodySchema = yup.object().shape({
           .shape({
             connect: yup
               .array()
-              .of(yup.object().shape({ id: yup.strapiID().required() }))
+              .of(roleRelationEntrySchema)
               .min(1, 'Users must have a role')
               .required(),
           })
@@ -44,20 +55,22 @@ const updateUserBodySchema = yup.object().shape({
   role: yup.lazy((value) =>
     typeof value === 'object'
       ? yup.object().shape({
-          connect: yup
-            .array()
-            .of(yup.object().shape({ id: yup.strapiID().required() }))
-            .required(),
+          // connect/disconnect are each optional (matching core relation inputs),
+          // but a role must remain: reject disconnecting every role without
+          // connecting a replacement.
+          connect: yup.array().of(roleRelationEntrySchema),
           disconnect: yup
             .array()
-            .test('CheckDisconnect', 'Cannot remove role', function test(disconnectValue) {
-              if (value.connect.length === 0 && disconnectValue.length > 0) {
+            .of(roleRelationEntrySchema)
+            .test('CheckDisconnect', 'Cannot remove role', function test(disconnect) {
+              const connectValue = value.connect || [];
+              const disconnectValue = disconnect || [];
+              if (connectValue.length === 0 && disconnectValue.length > 0) {
                 return false;
               }
 
               return true;
-            })
-            .required(),
+            }),
         })
       : yup.strapiID()
   ),

package/server/routes/content-api/auth.js

@@ -127,5 +127,17 @@ module.exports = (strapi) => {
       handler: 'auth.logout',
       config: { prefix: '' },
     },
+    {
+      method: 'GET',
+      path: '/auth/sessions',
+      handler: 'auth.getSessions',
+      config: { prefix: '' },
+    },
+    {
+      method: 'DELETE',
+      path: '/auth/sessions/:sessionId',
+      handler: 'auth.revokeSession',
+      config: { prefix: '' },
+    },
   ];
 };

package/server/routes/content-api/validation.js

@@ -3,6 +3,36 @@
 const { AbstractRouteValidator } = require('@strapi/utils');
 const z = require('zod/v4');
 
+// A single role relation entry, referenced by numeric `id` (legacy) or by
+// `documentId` (the v5 default), but must carry at least one of them. The
+// detailed rules (min one role on create, cannot remove the last role on
+// update) stay in the Yup controller validator.
+const roleRelationEntry = z
+  .object({
+    id: z.union([z.number(), z.string()]).optional(),
+    documentId: z.string().optional(),
+  })
+  .refine((entry) => entry.id != null || entry.documentId != null, {
+    message: 'Relation entry must include an id or documentId',
+  });
+
+// The `role` relation input: shorthand scalar (numeric id or documentId) or the
+// longhand connect/disconnect object, matching every other v5 relation. The
+// object form must carry at least one of connect/disconnect (an empty object is
+// a no-op and almost certainly a mistake).
+const roleRelationInput = z.union([
+  z.number(),
+  z.string(),
+  z
+    .object({
+      connect: z.array(roleRelationEntry).optional(),
+      disconnect: z.array(roleRelationEntry).optional(),
+    })
+    .refine((input) => input.connect != null || input.disconnect != null, {
+      message: 'Relation input must include connect or disconnect',
+    }),
+]);
+
 class UsersPermissionsRouteValidator extends AbstractRouteValidator {
   constructor(strapi) {
     super();
@@ -201,7 +231,7 @@ class UsersPermissionsRouteValidator extends AbstractRouteValidator {
       username: z.string(),
       email: z.email(),
       password: z.string(),
-      role: z.number().optional(),
+      role: roleRelationInput.optional(),
     });
   }
 
@@ -210,7 +240,7 @@ class UsersPermissionsRouteValidator extends AbstractRouteValidator {
       username: z.string().optional(),
       email: z.email().optional(),
       password: z.string().optional(),
-      role: z.number().optional(),
+      role: roleRelationInput.optional(),
     });
   }
 

package/server/services/jwt.js

@@ -80,17 +80,18 @@ module.exports = ({ strapi }) => ({
         throw new Error('Invalid token.');
       }
 
-      return { id: user.id };
+      // Surface the sessionId so the strategy can flag the "current" session.
+      return { id: user.id, sessionId: result.payload.sessionId };
     }
 
     return new Promise((resolve, reject) => {
       const jwtConfig = strapi.config.get('plugin::users-permissions.jwt', {});
-      const algorithms = jwtConfig && jwtConfig.algorithm ? [jwtConfig.algorithm] : undefined;
+      const algorithms = [jwtConfig?.algorithm || 'HS256'];
 
       jwt.verify(
         token,
         strapi.config.get('plugin::users-permissions.jwtSecret'),
-        algorithms ? { algorithms } : {},
+        { algorithms },
         (err, tokenPayload = {}) => {
           if (err) {
             return reject(new Error('Invalid token.'));

package/server/services/users-permissions.js

@@ -22,6 +22,8 @@ const DEFAULT_PERMISSIONS = [
   { action: 'plugin::users-permissions.auth.sendEmailConfirmation', roleType: 'public' },
   { action: 'plugin::users-permissions.auth.refresh', roleType: 'public' },
   { action: 'plugin::users-permissions.auth.logout', roleType: 'authenticated' },
+  { action: 'plugin::users-permissions.auth.getSessions', roleType: 'authenticated' },
+  { action: 'plugin::users-permissions.auth.revokeSession', roleType: 'authenticated' },
   { action: 'plugin::users-permissions.user.me', roleType: 'authenticated' },
   { action: 'plugin::users-permissions.auth.changePassword', roleType: 'authenticated' },
 ];

package/server/strategies/users-permissions.js

@@ -14,7 +14,7 @@ const authenticate = async (ctx) => {
     const token = await getService('jwt').getToken(ctx);
 
     if (token) {
-      const { id } = token;
+      const { id, sessionId } = token;
 
       // Invalid token
       if (id === undefined) {
@@ -49,6 +49,11 @@ const authenticate = async (ctx) => {
       const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);
 
       ctx.state.user = user;
+      // Expose the session backing this request (refresh mode only) so endpoints
+      // can flag the "current" session when listing active sessions.
+      if (sessionId) {
+        ctx.state.session = { id: sessionId };
+      }
 
       return {
         authenticated: true,

package/server/utils/refresh-cookie-options.js

@@ -0,0 +1,20 @@
+'use strict';
+
+const buildRefreshCookieOptions = (upSessions, isProduction) => {
+  const isSecure =
+    typeof upSessions.cookie?.secure === 'boolean' ? upSessions.cookie?.secure : isProduction;
+
+  return {
+    httpOnly: true,
+    secure: isSecure,
+    sameSite: upSessions.cookie?.sameSite ?? 'lax',
+    path: upSessions.cookie?.path ?? '/',
+    domain: upSessions.cookie?.domain,
+    maxAge: upSessions.cookie?.maxAge,
+    overwrite: true,
+  };
+};
+
+module.exports = {
+  buildRefreshCookieOptions,
+};