@strapi/plugin-users-permissions 5.49.0 → 5.50.0

package/dist/admin/translations/ja.json.mjs

@@ -1,46 +1,85 @@
 var ja = {
-    "BoundRoute.title": "Bound route to",
+    "BoundRoute.title": "バインドされたルート",
+    "components.Input.error.validation.email": "有効なメールアドレスではありません",
+    "components.Input.error.validation.json": "JSON形式と一致しません",
+    "components.Input.error.validation.max": "値が大きすぎます。",
+    "components.Input.error.validation.maxLength": "値が長すぎます。",
+    "components.Input.error.validation.min": "値が小さすぎます。",
+    "components.Input.error.validation.minLength": "値が短すぎます。",
+    "components.Input.error.validation.minSupMax": "最大値を超えることはできません。",
+    "components.Input.error.validation.regex": "値が正規表現と一致しません。",
+    "components.Input.error.validation.required": "この値は必須です。",
+    "components.Input.error.validation.unique": "この値はすでに使用されています。",
     "EditForm.inputSelect.description.role": "新しい認証されたユーザーが選択された役割にアタッチされます。",
     "EditForm.inputSelect.label.role": "認証されたユーザーのデフォルトの役割",
     "EditForm.inputToggle.description.email": "ユーザーが異なる認証プロバイダで同じ電子メールアドレスを使用して複数のアカウントを作成できないようにします。",
     "EditForm.inputToggle.description.email-confirmation": "有効（ON）にすると、新しい登録ユーザーに確認メールが送信されます。",
     "EditForm.inputToggle.description.email-confirmation-redirection": "あなたのEメールを確認したら、リダイレクト先を選択してください。",
+    "EditForm.inputToggle.description.email-reset-password": "アプリケーションのパスワードリセットページのURL",
     "EditForm.inputToggle.description.sign-up": "あなたの電子メールを確認した後、リダイレクト先を選択しました。",
     "EditForm.inputToggle.label.email": "メールアドレスごとに1つのアカウント",
     "EditForm.inputToggle.label.email-confirmation": "Eメールの確認を有効にする",
     "EditForm.inputToggle.label.email-confirmation-redirection": "リダイレクトURL",
+    "EditForm.inputToggle.label.email-reset-password": "パスワードリセットページ",
     "EditForm.inputToggle.label.sign-up": "申し込みを有効にする",
+    "EditForm.inputToggle.placeholder.email-confirmation-redirection": "例: https://yourfrontend.com/email-confirmation-redirection",
+    "EditForm.inputToggle.placeholder.email-reset-password": "例: https://yourfrontend.com/reset-password",
+    "EditPage.form.roles": "ロールの詳細",
+    "Email.template.data.loaded": "メールテンプレートを読み込みました",
+    "Email.template.email_confirmation": "メールアドレスの確認",
+    "Email.template.form.edit.label": "テンプレートを編集",
+    "Email.template.reset_password": "パスワードリセット",
+    "Email.template.table.action.label": "操作",
+    "Email.template.table.icon.label": "アイコン",
+    "Email.template.table.name.label": "名前",
+    "Form.advancedSettings.data.loaded": "高度な設定データを読み込みました",
     "HeaderNav.link.advancedSettings": "高度な設定",
     "HeaderNav.link.emailTemplates": "メールテンプレート",
     "HeaderNav.link.providers": "プロバイダー",
+    "notification.success.submit": "設定が更新されました",
+    "page.title": "設定 - ロール",
+    "plugin.description.long": "JWTに基づいた完全な認証プロセスでAPIを保護します。このプラグインには、ユーザーのグループ間で権限を管理できるACL戦略もあります。",
+    "plugin.description.short": "JWTに基づく完全な認証プロセスでAPIを保護する",
+    "plugin.name": "ロールと権限",
     "Plugin.permissions.plugins.description": "{name} 個のプラグインに対して許可されたすべてのアクションを定義する",
     "Plugins.header.description": "ルートにバインドされたアクションのみが以下にリストされています",
     "Plugins.header.title": "権限",
     "Policies.header.hint": "アプリケーションのアクションまたはプラグインのアクションを選択し、コグアイコンをクリックしてバインドされたルートを表示します",
     "Policies.header.title": "高度な設定",
     "PopUpForm.Email.email_templates.inputDescription": "変数の使用方法がわからない場合は、{link}",
+    "PopUpForm.Email.link.documentation": "ドキュメントをご覧ください。",
     "PopUpForm.Email.options.from.email.label": "送信者Eメール",
     "PopUpForm.Email.options.from.email.placeholder": "kai@doe.com",
     "PopUpForm.Email.options.from.name.label": "送信者名",
     "PopUpForm.Email.options.from.name.placeholder": "Kai Doe",
     "PopUpForm.Email.options.message.label": "メッセージ",
     "PopUpForm.Email.options.object.label": "件名",
+    "PopUpForm.Email.options.object.placeholder": "%APP_NAME% のメールアドレスを確認してください",
     "PopUpForm.Email.options.response_email.label": "応答メール",
     "PopUpForm.Email.options.response_email.placeholder": "kai@doe.com",
+    "PopUpForm.header.edit.email-templates": "メールテンプレートの編集",
+    "PopUpForm.header.edit.providers": "プロバイダーの編集",
     "PopUpForm.Providers.enabled.description": "無効にすると、ユーザーはこのプロバイダを使用できなくなります。",
     "PopUpForm.Providers.enabled.label": "有効にする",
     "PopUpForm.Providers.key.label": "クライアントID",
     "PopUpForm.Providers.key.placeholder": "TEXT",
     "PopUpForm.Providers.redirectURL.front-end.label": "フロントエンドアプリへのリダイレクトURL",
+    "PopUpForm.Providers.redirectURL.label": "{provider}アプリケーションの設定に追加するリダイレクトURL",
     "PopUpForm.Providers.secret.label": "クライアントの秘密",
     "PopUpForm.Providers.secret.placeholder": "TEXT",
-    "PopUpForm.Providers.subdomain.label": "Host URI (Subdomain)",
+    "PopUpForm.Providers.subdomain.label": "ホストURI（サブドメイン）",
     "PopUpForm.Providers.subdomain.placeholder": "my.subdomain.com",
-    "PopUpForm.header.edit.email-templates": "メールテンプレートの編集",
-    "notification.success.submit": "設定が更新されました",
-    "plugin.description.long": "JWTに基づいた完全な認証プロセスでAPIを保護します。このプラグインには、ユーザーのグループ間で権限を管理できるACL戦略もあります。",
-    "plugin.description.short": "JWTに基づく完全な認証プロセスでAPIを保護する",
-    "plugin.name": "ロールと権限"
+    "popUpWarning.button.cancel": "キャンセル",
+    "popUpWarning.button.confirm": "確認",
+    "popUpWarning.title": "確認してください",
+    "popUpWarning.warning.cancel": "変更をキャンセルしてもよろしいですか？",
+    "Providers.data.loaded": "プロバイダーを読み込みました",
+    "Providers.status": "ステータス",
+    "Roles.empty": "ロールがまだありません。",
+    "Roles.empty.search": "検索に一致するロールがありません。",
+    "Settings.roles.deleted": "ロールを削除しました",
+    "Settings.roles.edited": "ロールを編集しました",
+    "Settings.section-label": "ユーザーと権限プラグイン"
 };
 
 export { ja as default };

package/dist/admin/translations/ja.json.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ja.json.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"ja.json.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/server/controllers/auth.js

@@ -5,8 +5,9 @@ var require$$0$1 = require('lodash');
 var require$$0 = require('lodash/fp');
 var require$$1 = require('@strapi/utils');
 var index = require('../utils/index.js');
+var refreshCookieOptions = require('../utils/refresh-cookie-options.js');
 var auth$1 = require('./validation/auth.js');
-var require$$6 = require('grant');
+var require$$7 = require('grant');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
@@ -14,7 +15,7 @@ var require$$0__default$2 = /*#__PURE__*/_interopDefault(require$$0$2);
 var require$$0__default$1 = /*#__PURE__*/_interopDefault(require$$0$1);
 var require$$0__default = /*#__PURE__*/_interopDefault(require$$0);
 var require$$1__default = /*#__PURE__*/_interopDefault(require$$1);
-var require$$6__default = /*#__PURE__*/_interopDefault(require$$6);
+var require$$7__default = /*#__PURE__*/_interopDefault(require$$7);
 
 var auth;
 var hasRequiredAuth;
@@ -30,8 +31,10 @@ function requireAuth() {
     const { concat, compact, isArray } = require$$0__default.default;
     const utils = require$$1__default.default;
     const { getService } = index.__require();
+    const { buildRefreshCookieOptions } = refreshCookieOptions.__require();
     const { validateCallbackBody, validateRegisterBody, validateSendEmailConfirmationBody, validateForgotPasswordBody, validateResetPasswordBody, validateEmailConfirmationBody, validateChangePasswordBody } = auth$1.__require();
     const { ApplicationError, ValidationError, ForbiddenError } = utils.errors;
+    const { buildSessionMetadata, sanitizeSessionEntry, sortSessionsForDisplay } = utils;
     const sanitizeUser = (user, ctx)=>{
         const { auth } = ctx.state;
         const userSchema = strapi.getModel('plugin::users-permissions.user');
@@ -43,6 +46,82 @@ function requireAuth() {
         const { deviceId } = requestBody || {};
         return typeof deviceId === 'string' && deviceId.length > 0 ? deviceId : undefined;
     };
+    const buildSessionMetadataFromContext = (ctx)=>buildSessionMetadata({
+            userAgent: ctx.request.headers['user-agent']
+        });
+    const sendRefreshAuthResponse = async (strapi1, ctx, user, { metadata } = {})=>{
+        const deviceId = extractDeviceId(ctx.request.body);
+        const tokenOptions = {
+            type: 'refresh',
+            ...metadata ? {
+                metadata
+            } : {}
+        };
+        const refresh = await strapi1.sessionManager('users-permissions').generateRefreshToken(String(user.id), deviceId, tokenOptions);
+        const access = await strapi1.sessionManager('users-permissions').generateAccessToken(refresh.token);
+        if ('error' in access) {
+            throw new ApplicationError('Invalid credentials');
+        }
+        const upSessions = strapi1.config.get('plugin::users-permissions.sessions');
+        const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
+        if (upSessions?.httpOnly || requestHttpOnly) {
+            const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
+            const isProduction = process.env.NODE_ENV === 'production';
+            ctx.cookies.set(cookieName, refresh.token, buildRefreshCookieOptions(upSessions, isProduction));
+            return ctx.send({
+                jwt: access.token,
+                user: await sanitizeUser(user, ctx)
+            });
+        }
+        return ctx.send({
+            jwt: access.token,
+            refreshToken: refresh.token,
+            user: await sanitizeUser(user, ctx)
+        });
+    };
+    const reissueTokensAfterPasswordChange = async (strapi1, ctx, user)=>{
+        const deviceId = extractDeviceId(ctx.request.body);
+        await strapi1.sessionManager('users-permissions').invalidateRefreshToken(String(user.id));
+        const newDeviceId = deviceId || crypto.randomUUID();
+        const refresh = await strapi1.sessionManager('users-permissions').generateRefreshToken(String(user.id), newDeviceId, {
+            type: 'refresh'
+        });
+        const access = await strapi1.sessionManager('users-permissions').generateAccessToken(refresh.token);
+        if ('error' in access) {
+            throw new ApplicationError('Invalid credentials');
+        }
+        return ctx.send({
+            jwt: access.token,
+            refreshToken: refresh.token,
+            user: await sanitizeUser(user, ctx)
+        });
+    };
+    const revokeLogoutSessions = async (strapi1, ctx, userId, { scope, deviceId, body })=>{
+        const sessionManager = strapi1.sessionManager('users-permissions');
+        const upSessions = strapi1.config.get('plugin::users-permissions.sessions');
+        if (scope === 'all') {
+            await sessionManager.invalidateRefreshToken(userId);
+            return;
+        }
+        if (deviceId) {
+            await sessionManager.invalidateRefreshToken(userId, deviceId);
+            return;
+        }
+        let currentSessionId = ctx.state.session?.id;
+        const cookieName = upSessions?.cookie?.name || 'strapi_up_refresh';
+        const refreshToken = ctx.cookies.get(cookieName) || (typeof body.refreshToken === 'string' ? body.refreshToken : undefined);
+        if (refreshToken) {
+            const validation = await sessionManager.validateRefreshToken(refreshToken);
+            if (validation.isValid) {
+                currentSessionId = validation.sessionId;
+            }
+        }
+        if (currentSessionId) {
+            await sessionManager.revokeSessionById(userId, currentSessionId);
+            return;
+        }
+        await sessionManager.invalidateRefreshToken(userId);
+    };
     auth = ({ strapi: strapi1 })=>({
             async callback (ctx) {
                 const provider = ctx.params.provider || 'local';
@@ -100,38 +179,8 @@ function requireAuth() {
                     }
                     const mode = strapi1.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
                     if (mode === 'refresh') {
-                        const deviceId = extractDeviceId(ctx.request.body);
-                        const refresh = await strapi1.sessionManager('users-permissions').generateRefreshToken(String(user.id), deviceId, {
-                            type: 'refresh'
-                        });
-                        const access = await strapi1.sessionManager('users-permissions').generateAccessToken(refresh.token);
-                        if ('error' in access) {
-                            throw new ApplicationError('Invalid credentials');
-                        }
-                        const upSessions = strapi1.config.get('plugin::users-permissions.sessions');
-                        const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
-                        if (upSessions?.httpOnly || requestHttpOnly) {
-                            const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
-                            const isProduction = process.env.NODE_ENV === 'production';
-                            const isSecure = typeof upSessions.cookie?.secure === 'boolean' ? upSessions.cookie?.secure : isProduction;
-                            const cookieOptions = {
-                                httpOnly: true,
-                                secure: isSecure,
-                                sameSite: upSessions.cookie?.sameSite ?? 'lax',
-                                path: upSessions.cookie?.path ?? '/',
-                                domain: upSessions.cookie?.domain,
-                                overwrite: true
-                            };
-                            ctx.cookies.set(cookieName, refresh.token, cookieOptions);
-                            return ctx.send({
-                                jwt: access.token,
-                                user: await sanitizeUser(user, ctx)
-                            });
-                        }
-                        return ctx.send({
-                            jwt: access.token,
-                            refreshToken: refresh.token,
-                            user: await sanitizeUser(user, ctx)
+                        return sendRefreshAuthResponse(strapi1, ctx, user, {
+                            metadata: buildSessionMetadataFromContext(ctx)
                         });
                     }
                     return ctx.send({
@@ -149,38 +198,8 @@ function requireAuth() {
                     }
                     const mode = strapi1.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
                     if (mode === 'refresh') {
-                        const deviceId = extractDeviceId(ctx.request.body);
-                        const refresh = await strapi1.sessionManager('users-permissions').generateRefreshToken(String(user.id), deviceId, {
-                            type: 'refresh'
-                        });
-                        const access = await strapi1.sessionManager('users-permissions').generateAccessToken(refresh.token);
-                        if ('error' in access) {
-                            throw new ApplicationError('Invalid credentials');
-                        }
-                        const upSessions = strapi1.config.get('plugin::users-permissions.sessions');
-                        const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
-                        if (upSessions?.httpOnly || requestHttpOnly) {
-                            const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
-                            const isProduction = process.env.NODE_ENV === 'production';
-                            const isSecure = typeof upSessions.cookie?.secure === 'boolean' ? upSessions.cookie?.secure : isProduction;
-                            const cookieOptions = {
-                                httpOnly: true,
-                                secure: isSecure,
-                                sameSite: upSessions.cookie?.sameSite ?? 'lax',
-                                path: upSessions.cookie?.path ?? '/',
-                                domain: upSessions.cookie?.domain,
-                                overwrite: true
-                            };
-                            ctx.cookies.set(cookieName, refresh.token, cookieOptions);
-                            return ctx.send({
-                                jwt: access.token,
-                                user: await sanitizeUser(user, ctx)
-                            });
-                        }
-                        return ctx.send({
-                            jwt: access.token,
-                            refreshToken: refresh.token,
-                            user: await sanitizeUser(user, ctx)
+                        return sendRefreshAuthResponse(strapi1, ctx, user, {
+                            metadata: buildSessionMetadataFromContext(ctx)
                         });
                     }
                     return ctx.send({
@@ -216,22 +235,7 @@ function requireAuth() {
                 });
                 const mode = strapi1.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
                 if (mode === 'refresh') {
-                    const deviceId = extractDeviceId(ctx.request.body);
-                    // Invalidate all sessions when password changes for security
-                    await strapi1.sessionManager('users-permissions').invalidateRefreshToken(String(user.id));
-                    const newDeviceId = deviceId || crypto.randomUUID();
-                    const refresh = await strapi1.sessionManager('users-permissions').generateRefreshToken(String(user.id), newDeviceId, {
-                        type: 'refresh'
-                    });
-                    const access = await strapi1.sessionManager('users-permissions').generateAccessToken(refresh.token);
-                    if ('error' in access) {
-                        throw new ApplicationError('Invalid credentials');
-                    }
-                    return ctx.send({
-                        jwt: access.token,
-                        refreshToken: refresh.token,
-                        user: await sanitizeUser(user, ctx)
-                    });
+                    return reissueTokensAfterPasswordChange(strapi1, ctx, user);
                 }
                 return ctx.send({
                     jwt: getService('jwt').issue({
@@ -260,22 +264,7 @@ function requireAuth() {
                 });
                 const mode = strapi1.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
                 if (mode === 'refresh') {
-                    const deviceId = extractDeviceId(ctx.request.body);
-                    // Invalidate all sessions when password is reset for security
-                    await strapi1.sessionManager('users-permissions').invalidateRefreshToken(String(user.id));
-                    const newDeviceId = deviceId || crypto.randomUUID();
-                    const refresh = await strapi1.sessionManager('users-permissions').generateRefreshToken(String(user.id), newDeviceId, {
-                        type: 'refresh'
-                    });
-                    const access = await strapi1.sessionManager('users-permissions').generateAccessToken(refresh.token);
-                    if ('error' in access) {
-                        throw new ApplicationError('Invalid credentials');
-                    }
-                    return ctx.send({
-                        jwt: access.token,
-                        refreshToken: refresh.token,
-                        user: await sanitizeUser(user, ctx)
-                    });
+                    return reissueTokensAfterPasswordChange(strapi1, ctx, user);
                 }
                 return ctx.send({
                     jwt: getService('jwt').issue({
@@ -310,16 +299,7 @@ function requireAuth() {
                 const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
                 if (upSessions?.httpOnly || requestHttpOnly) {
                     const isProduction = process.env.NODE_ENV === 'production';
-                    const isSecure = typeof upSessions.cookie?.secure === 'boolean' ? upSessions.cookie?.secure : isProduction;
-                    const cookieOptions = {
-                        httpOnly: true,
-                        secure: isSecure,
-                        sameSite: upSessions.cookie?.sameSite ?? 'lax',
-                        path: upSessions.cookie?.path ?? '/',
-                        domain: upSessions.cookie?.domain,
-                        overwrite: true
-                    };
-                    ctx.cookies.set(cookieName, rotation.token, cookieOptions);
+                    ctx.cookies.set(cookieName, rotation.token, buildRefreshCookieOptions(upSessions, isProduction));
                     return ctx.send({
                         jwt: result.token
                     });
@@ -334,17 +314,23 @@ function requireAuth() {
                 if (mode !== 'refresh') {
                     return ctx.notFound();
                 }
-                // Invalidate all sessions for the authenticated user, or by deviceId if provided
                 if (!ctx.state.user) {
                     return ctx.unauthorized('Missing authentication');
                 }
-                const deviceId = extractDeviceId(ctx.request.body);
+                const userId = String(ctx.state.user.id);
+                const upSessions = strapi1.config.get('plugin::users-permissions.sessions');
+                const body = ctx.request.body || {};
+                const scope = typeof body.scope === 'string' ? body.scope : undefined;
+                const deviceId = extractDeviceId(body);
                 try {
-                    await strapi1.sessionManager('users-permissions').invalidateRefreshToken(String(ctx.state.user.id), deviceId);
+                    await revokeLogoutSessions(strapi1, ctx, userId, {
+                        scope,
+                        deviceId,
+                        body
+                    });
                 } catch (err) {
                     strapi1.log.error('UP logout failed', err);
                 }
-                const upSessions = strapi1.config.get('plugin::users-permissions.sessions');
                 const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
                 if (upSessions?.httpOnly || requestHttpOnly) {
                     const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
@@ -356,8 +342,40 @@ function requireAuth() {
                     ok: true
                 });
             },
+            async getSessions (ctx) {
+                const mode = strapi1.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+                if (mode !== 'refresh') {
+                    return ctx.notFound();
+                }
+                if (!ctx.state.user) {
+                    return ctx.unauthorized('Missing authentication');
+                }
+                const currentSessionId = ctx.state.session?.id;
+                const sessions = await strapi1.sessionManager('users-permissions').listSessions(String(ctx.state.user.id));
+                const data = sortSessionsForDisplay(sessions.map((session)=>sanitizeSessionEntry(session, currentSessionId)));
+                return ctx.send({
+                    data
+                });
+            },
+            async revokeSession (ctx) {
+                const mode = strapi1.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+                if (mode !== 'refresh') {
+                    return ctx.notFound();
+                }
+                if (!ctx.state.user) {
+                    return ctx.unauthorized('Missing authentication');
+                }
+                const { sessionId } = ctx.params;
+                const revoked = await strapi1.sessionManager('users-permissions').revokeSessionById(String(ctx.state.user.id), sessionId);
+                if (!revoked) {
+                    return ctx.notFound('Session not found');
+                }
+                return ctx.send({
+                    data: {}
+                });
+            },
             async connect (ctx, next) {
-                const grant = require$$6__default.default.koa();
+                const grant = require$$7__default.default.koa();
                 const providers = await strapi1.store({
                     type: 'plugin',
                     name: 'users-permissions',
@@ -553,7 +571,8 @@ function requireAuth() {
                 if (mode === 'refresh') {
                     const deviceId = extractDeviceId(ctx.request.body) || crypto.randomUUID();
                     const refresh = await strapi1.sessionManager('users-permissions').generateRefreshToken(String(user.id), deviceId, {
-                        type: 'refresh'
+                        type: 'refresh',
+                        metadata: buildSessionMetadataFromContext(ctx)
                     });
                     const access = await strapi1.sessionManager('users-permissions').generateAccessToken(refresh.token);
                     if ('error' in access) {