@strapi/plugin-users-permissions 5.49.0 → 5.50.0

package/server/controllers/validation/user.js

@@ -6,6 +6,17 @@ const deleteRoleSchema = yup.object().shape({
   role: yup.strapiID().required(),
 });
 
+// A role relation entry may be referenced by numeric `id` (legacy) or by
+// `documentId` (the v5 default), but must carry at least one of them.
+const roleRelationEntrySchema = yup
+  .object()
+  .shape({ id: yup.strapiID(), documentId: yup.strapiID() })
+  .test(
+    'id-or-documentId',
+    'Relation entry must include an id or documentId',
+    (entry) => !!entry && (entry.id != null || entry.documentId != null)
+  );
+
 const createUserBodySchema = yup.object().shape({
   email: yup.string().email().required(),
   username: yup.string().min(1).required(),
@@ -17,7 +28,7 @@ const createUserBodySchema = yup.object().shape({
           .shape({
             connect: yup
               .array()
-              .of(yup.object().shape({ id: yup.strapiID().required() }))
+              .of(roleRelationEntrySchema)
               .min(1, 'Users must have a role')
               .required(),
           })
@@ -44,20 +55,22 @@ const updateUserBodySchema = yup.object().shape({
   role: yup.lazy((value) =>
     typeof value === 'object'
       ? yup.object().shape({
-          connect: yup
-            .array()
-            .of(yup.object().shape({ id: yup.strapiID().required() }))
-            .required(),
+          // connect/disconnect are each optional (matching core relation inputs),
+          // but a role must remain: reject disconnecting every role without
+          // connecting a replacement.
+          connect: yup.array().of(roleRelationEntrySchema),
           disconnect: yup
             .array()
-            .test('CheckDisconnect', 'Cannot remove role', function test(disconnectValue) {
-              if (value.connect.length === 0 && disconnectValue.length > 0) {
+            .of(roleRelationEntrySchema)
+            .test('CheckDisconnect', 'Cannot remove role', function test(disconnect) {
+              const connectValue = value.connect || [];
+              const disconnectValue = disconnect || [];
+              if (connectValue.length === 0 && disconnectValue.length > 0) {
                 return false;
               }
 
               return true;
-            })
-            .required(),
+            }),
         })
       : yup.strapiID()
   ),

package/server/routes/content-api/auth.js

@@ -127,5 +127,17 @@ module.exports = (strapi) => {
       handler: 'auth.logout',
       config: { prefix: '' },
     },
+    {
+      method: 'GET',
+      path: '/auth/sessions',
+      handler: 'auth.getSessions',
+      config: { prefix: '' },
+    },
+    {
+      method: 'DELETE',
+      path: '/auth/sessions/:sessionId',
+      handler: 'auth.revokeSession',
+      config: { prefix: '' },
+    },
   ];
 };

package/server/routes/content-api/validation.js

@@ -3,6 +3,36 @@
 const { AbstractRouteValidator } = require('@strapi/utils');
 const z = require('zod/v4');
 
+// A single role relation entry, referenced by numeric `id` (legacy) or by
+// `documentId` (the v5 default), but must carry at least one of them. The
+// detailed rules (min one role on create, cannot remove the last role on
+// update) stay in the Yup controller validator.
+const roleRelationEntry = z
+  .object({
+    id: z.union([z.number(), z.string()]).optional(),
+    documentId: z.string().optional(),
+  })
+  .refine((entry) => entry.id != null || entry.documentId != null, {
+    message: 'Relation entry must include an id or documentId',
+  });
+
+// The `role` relation input: shorthand scalar (numeric id or documentId) or the
+// longhand connect/disconnect object, matching every other v5 relation. The
+// object form must carry at least one of connect/disconnect (an empty object is
+// a no-op and almost certainly a mistake).
+const roleRelationInput = z.union([
+  z.number(),
+  z.string(),
+  z
+    .object({
+      connect: z.array(roleRelationEntry).optional(),
+      disconnect: z.array(roleRelationEntry).optional(),
+    })
+    .refine((input) => input.connect != null || input.disconnect != null, {
+      message: 'Relation input must include connect or disconnect',
+    }),
+]);
+
 class UsersPermissionsRouteValidator extends AbstractRouteValidator {
   constructor(strapi) {
     super();
@@ -201,7 +231,7 @@ class UsersPermissionsRouteValidator extends AbstractRouteValidator {
       username: z.string(),
       email: z.email(),
       password: z.string(),
-      role: z.number().optional(),
+      role: roleRelationInput.optional(),
     });
   }
 
@@ -210,7 +240,7 @@ class UsersPermissionsRouteValidator extends AbstractRouteValidator {
       username: z.string().optional(),
       email: z.email().optional(),
       password: z.string().optional(),
-      role: z.number().optional(),
+      role: roleRelationInput.optional(),
     });
   }
 

package/server/services/jwt.js

@@ -80,17 +80,18 @@ module.exports = ({ strapi }) => ({
         throw new Error('Invalid token.');
       }
 
-      return { id: user.id };
+      // Surface the sessionId so the strategy can flag the "current" session.
+      return { id: user.id, sessionId: result.payload.sessionId };
     }
 
     return new Promise((resolve, reject) => {
       const jwtConfig = strapi.config.get('plugin::users-permissions.jwt', {});
-      const algorithms = jwtConfig && jwtConfig.algorithm ? [jwtConfig.algorithm] : undefined;
+      const algorithms = [jwtConfig?.algorithm || 'HS256'];
 
       jwt.verify(
         token,
         strapi.config.get('plugin::users-permissions.jwtSecret'),
-        algorithms ? { algorithms } : {},
+        { algorithms },
         (err, tokenPayload = {}) => {
           if (err) {
             return reject(new Error('Invalid token.'));

package/server/services/users-permissions.js

@@ -22,6 +22,8 @@ const DEFAULT_PERMISSIONS = [
   { action: 'plugin::users-permissions.auth.sendEmailConfirmation', roleType: 'public' },
   { action: 'plugin::users-permissions.auth.refresh', roleType: 'public' },
   { action: 'plugin::users-permissions.auth.logout', roleType: 'authenticated' },
+  { action: 'plugin::users-permissions.auth.getSessions', roleType: 'authenticated' },
+  { action: 'plugin::users-permissions.auth.revokeSession', roleType: 'authenticated' },
   { action: 'plugin::users-permissions.user.me', roleType: 'authenticated' },
   { action: 'plugin::users-permissions.auth.changePassword', roleType: 'authenticated' },
 ];

package/server/strategies/users-permissions.js

@@ -14,7 +14,7 @@ const authenticate = async (ctx) => {
     const token = await getService('jwt').getToken(ctx);
 
     if (token) {
-      const { id } = token;
+      const { id, sessionId } = token;
 
       // Invalid token
       if (id === undefined) {
@@ -49,6 +49,11 @@ const authenticate = async (ctx) => {
       const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);
 
       ctx.state.user = user;
+      // Expose the session backing this request (refresh mode only) so endpoints
+      // can flag the "current" session when listing active sessions.
+      if (sessionId) {
+        ctx.state.session = { id: sessionId };
+      }
 
       return {
         authenticated: true,

package/server/utils/refresh-cookie-options.js

@@ -0,0 +1,20 @@
+'use strict';
+
+const buildRefreshCookieOptions = (upSessions, isProduction) => {
+  const isSecure =
+    typeof upSessions.cookie?.secure === 'boolean' ? upSessions.cookie?.secure : isProduction;
+
+  return {
+    httpOnly: true,
+    secure: isSecure,
+    sameSite: upSessions.cookie?.sameSite ?? 'lax',
+    path: upSessions.cookie?.path ?? '/',
+    domain: upSessions.cookie?.domain,
+    maxAge: upSessions.cookie?.maxAge,
+    overwrite: true,
+  };
+};
+
+module.exports = {
+  buildRefreshCookieOptions,
+};