strapi-plugin-magic-link-v5 5.5.4 → 5.5.6

package/dist/server/index.js

@@ -1,9 +1,9 @@
 "use strict";
+const require$$0$3 = require("crypto");
 const require$$0$6 = require("lodash");
 const require$$1$2 = require("nanoid");
-const require$$0$3 = require("fs");
+const require$$0$4 = require("fs");
 const require$$1 = require("path");
-const require$$0$4 = require("crypto");
 const require$$0$5 = require("zod");
 const require$$1$1 = require("@strapi/utils");
 const require$$1$3 = require("os");
@@ -11,11 +11,11 @@ const require$$0$7 = require("rate-limiter-flexible");
 const require$$1$4 = require("speakeasy");
 const require$$2 = require("qrcode");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
+const require$$0__default = /* @__PURE__ */ _interopDefault(require$$0$3);
 const require$$0__default$3 = /* @__PURE__ */ _interopDefault(require$$0$6);
 const require$$1__default$2 = /* @__PURE__ */ _interopDefault(require$$1$2);
-const require$$0__default = /* @__PURE__ */ _interopDefault(require$$0$3);
-const require$$1__default = /* @__PURE__ */ _interopDefault(require$$1);
 const require$$0__default$1 = /* @__PURE__ */ _interopDefault(require$$0$4);
+const require$$1__default = /* @__PURE__ */ _interopDefault(require$$1);
 const require$$0__default$2 = /* @__PURE__ */ _interopDefault(require$$0$5);
 const require$$1__default$1 = /* @__PURE__ */ _interopDefault(require$$1$1);
 const require$$1__default$3 = /* @__PURE__ */ _interopDefault(require$$1$3);
@@ -26,6 +26,143 @@ var commonjsGlobal = typeof globalThis !== "undefined" ? globalThis : typeof win
 function getDefaultExportFromCjs(x) {
   return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, "default") ? x["default"] : x;
 }
+const crypto$3 = require$$0__default.default;
+let warnedMissingKey = false;
+let warnedMissingPepper = false;
+const isProduction = () => process.env.NODE_ENV === "production";
+const devFallbackMaterial = () => process.env.ADMIN_JWT_SECRET || (Array.isArray(process.env.APP_KEYS) ? process.env.APP_KEYS[0] : process.env.APP_KEYS) || "magic-link-dev-fallback-DO-NOT-USE-IN-PRODUCTION";
+const getEncryptionKey = () => {
+  const raw = process.env.MAGIC_LINK_ENCRYPTION_KEY;
+  if (raw && raw.length > 0) {
+    return crypto$3.createHash("sha256").update(raw).digest();
+  }
+  if (isProduction()) {
+    throw new Error(
+      `[magic-link] MAGIC_LINK_ENCRYPTION_KEY env var is required in production. Generate one with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`
+    );
+  }
+  if (!warnedMissingKey) {
+    warnedMissingKey = true;
+    console.warn(
+      "[magic-link] MAGIC_LINK_ENCRYPTION_KEY not set — using dev fallback. Set this env var before going to production (it is NOT rotatable)."
+    );
+  }
+  return crypto$3.createHash("sha256").update(devFallbackMaterial()).digest();
+};
+const getOtpPepper = () => {
+  const raw = process.env.MAGIC_LINK_OTP_PEPPER || process.env.OTP_PEPPER;
+  if (raw && raw.length >= 16) {
+    return raw;
+  }
+  if (isProduction()) {
+    throw new Error(
+      `[magic-link] MAGIC_LINK_OTP_PEPPER env var is required in production (min 16 characters). Generate one with: node -e "console.log(require('crypto').randomBytes(24).toString('hex'))"`
+    );
+  }
+  if (!warnedMissingPepper) {
+    warnedMissingPepper = true;
+    console.warn(
+      "[magic-link] MAGIC_LINK_OTP_PEPPER not set — using dev fallback. Set this before deploying to production."
+    );
+  }
+  return "magic-link-otp-dev-pepper-DO-NOT-USE-IN-PRODUCTION";
+};
+const hash = (value) => {
+  if (!value) return null;
+  return crypto$3.createHash("sha256").update(String(value)).digest("hex");
+};
+const hashToken = (token2, salt = null) => {
+  if (!token2) return { hash: null, salt: null };
+  const tokenSalt = salt || crypto$3.randomBytes(16).toString("hex");
+  const hashedToken = crypto$3.createHash("sha256").update(token2 + tokenSalt).digest("hex");
+  return { hash: hashedToken, salt: tokenSalt };
+};
+const verifyToken = (token2, storedHash, salt) => {
+  if (!token2 || !storedHash) return false;
+  const { hash: computedHash } = hashToken(token2, salt);
+  return crypto$3.timingSafeEqual(
+    Buffer.from(computedHash, "hex"),
+    Buffer.from(storedHash, "hex")
+  );
+};
+const encrypt = (value) => {
+  if (!value) return null;
+  const key = getEncryptionKey();
+  const iv = crypto$3.randomBytes(16);
+  const cipher = crypto$3.createCipheriv("aes-256-gcm", key, iv);
+  let encrypted = cipher.update(String(value), "utf8", "hex");
+  encrypted += cipher.final("hex");
+  const authTag = cipher.getAuthTag();
+  return Buffer.from(
+    iv.toString("hex") + ":" + authTag.toString("hex") + ":" + encrypted
+  ).toString("base64");
+};
+const decrypt = (encryptedValue) => {
+  if (!encryptedValue) return null;
+  const key = getEncryptionKey();
+  const data = Buffer.from(encryptedValue, "base64").toString("utf8");
+  const parts = data.split(":");
+  if (parts.length !== 3) {
+    throw new Error("[Crypto] decrypt: malformed ciphertext (expected iv:tag:ct)");
+  }
+  const [ivHex, authTagHex, encryptedHex] = parts;
+  if (!ivHex || !authTagHex || !encryptedHex) {
+    throw new Error("[Crypto] decrypt: missing ciphertext components");
+  }
+  const iv = Buffer.from(ivHex, "hex");
+  const authTag = Buffer.from(authTagHex, "hex");
+  const decipher = crypto$3.createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(authTag);
+  let decrypted = decipher.update(encryptedHex, "hex", "utf8");
+  decrypted += decipher.final("utf8");
+  return decrypted;
+};
+const generateSecureRandom = (length = 32) => {
+  return crypto$3.randomBytes(Math.ceil(length / 2)).toString("hex").slice(0, length);
+};
+const hashOTP = (code) => {
+  if (!code) return null;
+  const pepper = getOtpPepper();
+  return crypto$3.createHash("sha256").update(code + pepper).digest("hex");
+};
+const verifyOTP = (code, storedHash) => {
+  if (!code || !storedHash) return false;
+  const computedHash = hashOTP(code);
+  try {
+    return crypto$3.timingSafeEqual(
+      Buffer.from(computedHash, "hex"),
+      Buffer.from(storedHash, "hex")
+    );
+  } catch {
+    return false;
+  }
+};
+const isEncrypted = (value) => {
+  if (!value) return false;
+  try {
+    const decoded = Buffer.from(value, "base64").toString("utf8");
+    const parts = decoded.split(":");
+    return parts.length === 3 && parts[0].length === 32 && parts[1].length === 32;
+  } catch {
+    return false;
+  }
+};
+const hashJwt = (jwt2) => {
+  if (!jwt2) return null;
+  return crypto$3.createHash("sha256").update(jwt2).digest("hex");
+};
+var crypto_1 = {
+  hash,
+  hashToken,
+  verifyToken,
+  encrypt,
+  decrypt,
+  generateSecureRandom,
+  hashOTP,
+  verifyOTP,
+  isEncrypted,
+  hashJwt
+};
 const magicLinkActions = {
   actions: [
     {
@@ -51,11 +188,11 @@ const magicLinkActions = {
     }
   ]
 };
+const cryptoUtilsSelfTest = crypto_1;
 var bootstrap$1 = async ({ strapi: strapi2 }) => {
   try {
-    const cryptoUtils2 = require("../utils/crypto");
-    cryptoUtils2.encrypt("self-test");
-    cryptoUtils2.hashOTP("000000");
+    cryptoUtilsSelfTest.encrypt("self-test");
+    cryptoUtilsSelfTest.hashOTP("000000");
   } catch (e) {
     strapi2.log.error(`[magic-link] ${e.message}`);
     throw e;
@@ -793,7 +930,7 @@ This link will expire in 1 hour.`,
     }
   }
 };
-const fs$1 = require$$0__default.default;
+const fs$1 = require$$0__default$1.default;
 const path$1 = require$$1__default.default;
 class I18n {
   constructor() {
@@ -935,143 +1072,6 @@ class I18n {
 }
 const i18n$1 = new I18n();
 var i18n_1 = i18n$1;
-const crypto$3 = require$$0__default$1.default;
-let warnedMissingKey = false;
-let warnedMissingPepper = false;
-const isProduction = () => process.env.NODE_ENV === "production";
-const devFallbackMaterial = () => process.env.ADMIN_JWT_SECRET || (Array.isArray(process.env.APP_KEYS) ? process.env.APP_KEYS[0] : process.env.APP_KEYS) || "magic-link-dev-fallback-DO-NOT-USE-IN-PRODUCTION";
-const getEncryptionKey = () => {
-  const raw = process.env.MAGIC_LINK_ENCRYPTION_KEY;
-  if (raw && raw.length > 0) {
-    return crypto$3.createHash("sha256").update(raw).digest();
-  }
-  if (isProduction()) {
-    throw new Error(
-      `[magic-link] MAGIC_LINK_ENCRYPTION_KEY env var is required in production. Generate one with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`
-    );
-  }
-  if (!warnedMissingKey) {
-    warnedMissingKey = true;
-    console.warn(
-      "[magic-link] MAGIC_LINK_ENCRYPTION_KEY not set — using dev fallback. Set this env var before going to production (it is NOT rotatable)."
-    );
-  }
-  return crypto$3.createHash("sha256").update(devFallbackMaterial()).digest();
-};
-const getOtpPepper = () => {
-  const raw = process.env.MAGIC_LINK_OTP_PEPPER || process.env.OTP_PEPPER;
-  if (raw && raw.length >= 16) {
-    return raw;
-  }
-  if (isProduction()) {
-    throw new Error(
-      `[magic-link] MAGIC_LINK_OTP_PEPPER env var is required in production (min 16 characters). Generate one with: node -e "console.log(require('crypto').randomBytes(24).toString('hex'))"`
-    );
-  }
-  if (!warnedMissingPepper) {
-    warnedMissingPepper = true;
-    console.warn(
-      "[magic-link] MAGIC_LINK_OTP_PEPPER not set — using dev fallback. Set this before deploying to production."
-    );
-  }
-  return "magic-link-otp-dev-pepper-DO-NOT-USE-IN-PRODUCTION";
-};
-const hash = (value) => {
-  if (!value) return null;
-  return crypto$3.createHash("sha256").update(String(value)).digest("hex");
-};
-const hashToken = (token2, salt = null) => {
-  if (!token2) return { hash: null, salt: null };
-  const tokenSalt = salt || crypto$3.randomBytes(16).toString("hex");
-  const hashedToken = crypto$3.createHash("sha256").update(token2 + tokenSalt).digest("hex");
-  return { hash: hashedToken, salt: tokenSalt };
-};
-const verifyToken = (token2, storedHash, salt) => {
-  if (!token2 || !storedHash) return false;
-  const { hash: computedHash } = hashToken(token2, salt);
-  return crypto$3.timingSafeEqual(
-    Buffer.from(computedHash, "hex"),
-    Buffer.from(storedHash, "hex")
-  );
-};
-const encrypt = (value) => {
-  if (!value) return null;
-  const key = getEncryptionKey();
-  const iv = crypto$3.randomBytes(16);
-  const cipher = crypto$3.createCipheriv("aes-256-gcm", key, iv);
-  let encrypted = cipher.update(String(value), "utf8", "hex");
-  encrypted += cipher.final("hex");
-  const authTag = cipher.getAuthTag();
-  return Buffer.from(
-    iv.toString("hex") + ":" + authTag.toString("hex") + ":" + encrypted
-  ).toString("base64");
-};
-const decrypt = (encryptedValue) => {
-  if (!encryptedValue) return null;
-  const key = getEncryptionKey();
-  const data = Buffer.from(encryptedValue, "base64").toString("utf8");
-  const parts = data.split(":");
-  if (parts.length !== 3) {
-    throw new Error("[Crypto] decrypt: malformed ciphertext (expected iv:tag:ct)");
-  }
-  const [ivHex, authTagHex, encryptedHex] = parts;
-  if (!ivHex || !authTagHex || !encryptedHex) {
-    throw new Error("[Crypto] decrypt: missing ciphertext components");
-  }
-  const iv = Buffer.from(ivHex, "hex");
-  const authTag = Buffer.from(authTagHex, "hex");
-  const decipher = crypto$3.createDecipheriv("aes-256-gcm", key, iv);
-  decipher.setAuthTag(authTag);
-  let decrypted = decipher.update(encryptedHex, "hex", "utf8");
-  decrypted += decipher.final("utf8");
-  return decrypted;
-};
-const generateSecureRandom = (length = 32) => {
-  return crypto$3.randomBytes(Math.ceil(length / 2)).toString("hex").slice(0, length);
-};
-const hashOTP = (code) => {
-  if (!code) return null;
-  const pepper = getOtpPepper();
-  return crypto$3.createHash("sha256").update(code + pepper).digest("hex");
-};
-const verifyOTP = (code, storedHash) => {
-  if (!code || !storedHash) return false;
-  const computedHash = hashOTP(code);
-  try {
-    return crypto$3.timingSafeEqual(
-      Buffer.from(computedHash, "hex"),
-      Buffer.from(storedHash, "hex")
-    );
-  } catch {
-    return false;
-  }
-};
-const isEncrypted = (value) => {
-  if (!value) return false;
-  try {
-    const decoded = Buffer.from(value, "base64").toString("utf8");
-    const parts = decoded.split(":");
-    return parts.length === 3 && parts[0].length === 32 && parts[1].length === 32;
-  } catch {
-    return false;
-  }
-};
-const hashJwt = (jwt2) => {
-  if (!jwt2) return null;
-  return crypto$3.createHash("sha256").update(jwt2).digest("hex");
-};
-var crypto_1 = {
-  hash,
-  hashToken,
-  verifyToken,
-  encrypt,
-  decrypt,
-  generateSecureRandom,
-  hashOTP,
-  verifyOTP,
-  isEncrypted,
-  hashJwt
-};
 const normalizeEmail$2 = (raw) => {
   if (typeof raw !== "string") return null;
   const trimmed = raw.trim();
@@ -1968,7 +1968,7 @@ var emailHelpers$3 = {
   validateEmailConfig
 };
 const { nanoid: nanoid$1 } = require$$1__default$2.default;
-const crypto$2 = require$$0__default$1.default;
+const crypto$2 = require$$0__default.default;
 const emailHelpers$2 = emailHelpers$3;
 const cryptoUtils$3 = crypto_1;
 const formatExpiryText$1 = (minutes) => {
@@ -4823,271 +4823,265 @@ var store$1 = ({ strapi: strapi2 }) => ({
     return pluginStore.set({ key: "settings", value: settings });
   }
 });
-var features$1;
-var hasRequiredFeatures;
-function requireFeatures() {
-  if (hasRequiredFeatures) return features$1;
-  hasRequiredFeatures = 1;
-  features$1 = {
-    // FREE/DEMO Features
-    free: {
-      maxTokens: 100,
-      // 100 aktive Tokens gleichzeitig
-      maxSessions: 50,
-      // 50 aktive JWT Sessions
-      maxIPBans: 10,
-      // 10 gebannte IPs
-      features: [
-        "basic-magic-link",
-        // Basis Magic Link Auth
-        "email-templates",
-        // Basis Email Templates
-        "jwt-sessions",
-        // JWT Session Management
-        "ip-tracking",
-        // IP Tracking für Security
-        "rate-limiting",
-        // Basis Rate Limiting
-        "auto-user-creation",
-        // Auto User Creation
-        "token-management",
-        // Token Dashboard
-        "ip-bans"
-        // IP Ban Management
-      ]
-    },
-    // PREMIUM Features
-    premium: {
-      maxTokens: 1e3,
-      // 1000 aktive Tokens
-      maxSessions: 500,
-      // 500 aktive Sessions
-      maxIPBans: 100,
-      // 100 gebannte IPs
-      features: [
-        "basic-magic-link",
-        "email-templates",
-        "jwt-sessions",
-        "ip-tracking",
-        "rate-limiting",
-        "auto-user-creation",
-        "token-management",
-        "ip-bans",
-        "otp-email",
-        // Email OTP (6-digit code)
-        "mfa-totp",
-        // MFA: Magic Link + TOTP (Szenario 1)
-        "custom-email-templates",
-        // Custom HTML/Text Templates
-        "email-designer-integration",
-        // Email Designer 5 Support
-        "magic-mail-integration",
-        // MagicMail Integration
-        "advanced-rate-limiting",
-        // Custom Rate Limits
-        "session-management",
-        // Erweiterte Session Verwaltung
-        "bulk-operations",
-        // Bulk Token/Session Operations
-        "extended-logging",
-        // Erweiterte Login-Info Logs
-        "custom-redirect-urls"
-        // Custom Redirect URLs per Token
-      ]
-    },
-    // ADVANCED Features
-    advanced: {
-      maxTokens: -1,
-      // Unlimited
-      maxSessions: -1,
-      // Unlimited
-      maxIPBans: -1,
-      // Unlimited
-      features: [
-        "basic-magic-link",
-        "email-templates",
-        "jwt-sessions",
-        "ip-tracking",
-        "rate-limiting",
-        "auto-user-creation",
-        "token-management",
-        "ip-bans",
-        "otp-email",
-        "mfa-totp",
-        // MFA: Magic Link + TOTP (Szenario 1)
-        "otp-sms",
-        // SMS OTP via Twilio/Vonage
-        "otp-totp",
-        // TOTP (Authenticator Apps)
-        "totp-primary-login",
-        // Login with Email + TOTP only (Szenario 2)
-        "custom-email-templates",
-        "email-designer-integration",
-        "magic-mail-integration",
-        "advanced-rate-limiting",
-        "session-management",
-        "bulk-operations",
-        "extended-logging",
-        "custom-redirect-urls",
-        "webhook-notifications",
-        // Webhooks für Events
-        "api-access-tokens",
-        // API Tokens für Programmatic Access
-        "advanced-analytics",
-        // Analytics Dashboard
-        "custom-token-context",
-        // Custom Context Data in Tokens
-        "geolocation-tracking",
-        // GeoIP Tracking
-        "device-fingerprinting",
-        // Device Fingerprinting
-        "suspicious-login-alerts"
-        // Alerts für verdächtige Logins
-      ]
-    },
-    // ENTERPRISE Features
-    enterprise: {
-      maxTokens: -1,
-      maxSessions: -1,
-      maxIPBans: -1,
-      features: [
-        "basic-magic-link",
-        "email-templates",
-        "jwt-sessions",
-        "ip-tracking",
-        "rate-limiting",
-        "auto-user-creation",
-        "token-management",
-        "ip-bans",
-        "otp-email",
-        "mfa-totp",
-        // MFA: Magic Link + TOTP (Szenario 1)
-        "otp-sms",
-        "otp-totp",
-        "totp-primary-login",
-        // Login with Email + TOTP only (Szenario 2)
-        "otp-backup-codes",
-        // Backup Recovery Codes
-        "biometric-support",
-        // WebAuthn/FIDO2
-        "custom-email-templates",
-        "email-designer-integration",
-        "magic-mail-integration",
-        "advanced-rate-limiting",
-        "session-management",
-        "bulk-operations",
-        "extended-logging",
-        "custom-redirect-urls",
-        "webhook-notifications",
-        "api-access-tokens",
-        "advanced-analytics",
-        "custom-token-context",
-        "geolocation-tracking",
-        "device-fingerprinting",
-        "suspicious-login-alerts",
-        "sso-integration",
-        // SSO/SAML Integration
-        "ldap-sync",
-        // LDAP/AD Sync
-        "audit-logs",
-        // Vollständige Audit Logs
-        "compliance-reports",
-        // GDPR/SOC2 Reports
-        "priority-support",
-        // 24/7 Priority Support
-        "custom-security-rules",
-        // Custom Security Rules
-        "multi-tenant",
-        // Multi-Tenant Support
-        "white-label"
-        // White-Label Branding
-      ]
-    },
-    /**
-     * Check if a feature is available for given license tier
-     */
-    hasFeature(licenseData, featureName) {
-      if (!licenseData) {
-        return this.free.features.includes(featureName);
-      }
-      let isEnterprise = false;
-      let isAdvanced = false;
-      let isPremium = false;
-      if (licenseData.tier) {
-        isEnterprise = licenseData.tier === "enterprise";
-        isAdvanced = licenseData.tier === "advanced";
-        isPremium = licenseData.tier === "premium";
-      }
-      if (licenseData.features) {
-        isEnterprise = isEnterprise || licenseData.features.enterprise === true;
-        isAdvanced = isAdvanced || licenseData.features.advanced === true;
-        isPremium = isPremium || licenseData.features.premium === true;
-      }
-      if (licenseData.featureEnterprise === true) {
-        isEnterprise = true;
-      }
-      if (licenseData.featureAdvanced === true) {
-        isAdvanced = true;
-      }
-      if (licenseData.featurePremium === true) {
-        isPremium = true;
-      }
-      if (isEnterprise && this.enterprise.features.includes(featureName)) {
-        return true;
-      }
-      if (isAdvanced && this.advanced.features.includes(featureName)) {
-        return true;
-      }
-      if (isPremium && this.premium.features.includes(featureName)) {
-        return true;
-      }
+var features$1 = {
+  // FREE/DEMO Features
+  free: {
+    maxTokens: 100,
+    // 100 aktive Tokens gleichzeitig
+    maxSessions: 50,
+    // 50 aktive JWT Sessions
+    maxIPBans: 10,
+    // 10 gebannte IPs
+    features: [
+      "basic-magic-link",
+      // Basis Magic Link Auth
+      "email-templates",
+      // Basis Email Templates
+      "jwt-sessions",
+      // JWT Session Management
+      "ip-tracking",
+      // IP Tracking für Security
+      "rate-limiting",
+      // Basis Rate Limiting
+      "auto-user-creation",
+      // Auto User Creation
+      "token-management",
+      // Token Dashboard
+      "ip-bans"
+      // IP Ban Management
+    ]
+  },
+  // PREMIUM Features
+  premium: {
+    maxTokens: 1e3,
+    // 1000 aktive Tokens
+    maxSessions: 500,
+    // 500 aktive Sessions
+    maxIPBans: 100,
+    // 100 gebannte IPs
+    features: [
+      "basic-magic-link",
+      "email-templates",
+      "jwt-sessions",
+      "ip-tracking",
+      "rate-limiting",
+      "auto-user-creation",
+      "token-management",
+      "ip-bans",
+      "otp-email",
+      // Email OTP (6-digit code)
+      "mfa-totp",
+      // MFA: Magic Link + TOTP (Szenario 1)
+      "custom-email-templates",
+      // Custom HTML/Text Templates
+      "email-designer-integration",
+      // Email Designer 5 Support
+      "magic-mail-integration",
+      // MagicMail Integration
+      "advanced-rate-limiting",
+      // Custom Rate Limits
+      "session-management",
+      // Erweiterte Session Verwaltung
+      "bulk-operations",
+      // Bulk Token/Session Operations
+      "extended-logging",
+      // Erweiterte Login-Info Logs
+      "custom-redirect-urls"
+      // Custom Redirect URLs per Token
+    ]
+  },
+  // ADVANCED Features
+  advanced: {
+    maxTokens: -1,
+    // Unlimited
+    maxSessions: -1,
+    // Unlimited
+    maxIPBans: -1,
+    // Unlimited
+    features: [
+      "basic-magic-link",
+      "email-templates",
+      "jwt-sessions",
+      "ip-tracking",
+      "rate-limiting",
+      "auto-user-creation",
+      "token-management",
+      "ip-bans",
+      "otp-email",
+      "mfa-totp",
+      // MFA: Magic Link + TOTP (Szenario 1)
+      "otp-sms",
+      // SMS OTP via Twilio/Vonage
+      "otp-totp",
+      // TOTP (Authenticator Apps)
+      "totp-primary-login",
+      // Login with Email + TOTP only (Szenario 2)
+      "custom-email-templates",
+      "email-designer-integration",
+      "magic-mail-integration",
+      "advanced-rate-limiting",
+      "session-management",
+      "bulk-operations",
+      "extended-logging",
+      "custom-redirect-urls",
+      "webhook-notifications",
+      // Webhooks für Events
+      "api-access-tokens",
+      // API Tokens für Programmatic Access
+      "advanced-analytics",
+      // Analytics Dashboard
+      "custom-token-context",
+      // Custom Context Data in Tokens
+      "geolocation-tracking",
+      // GeoIP Tracking
+      "device-fingerprinting",
+      // Device Fingerprinting
+      "suspicious-login-alerts"
+      // Alerts für verdächtige Logins
+    ]
+  },
+  // ENTERPRISE Features
+  enterprise: {
+    maxTokens: -1,
+    maxSessions: -1,
+    maxIPBans: -1,
+    features: [
+      "basic-magic-link",
+      "email-templates",
+      "jwt-sessions",
+      "ip-tracking",
+      "rate-limiting",
+      "auto-user-creation",
+      "token-management",
+      "ip-bans",
+      "otp-email",
+      "mfa-totp",
+      // MFA: Magic Link + TOTP (Szenario 1)
+      "otp-sms",
+      "otp-totp",
+      "totp-primary-login",
+      // Login with Email + TOTP only (Szenario 2)
+      "otp-backup-codes",
+      // Backup Recovery Codes
+      "biometric-support",
+      // WebAuthn/FIDO2
+      "custom-email-templates",
+      "email-designer-integration",
+      "magic-mail-integration",
+      "advanced-rate-limiting",
+      "session-management",
+      "bulk-operations",
+      "extended-logging",
+      "custom-redirect-urls",
+      "webhook-notifications",
+      "api-access-tokens",
+      "advanced-analytics",
+      "custom-token-context",
+      "geolocation-tracking",
+      "device-fingerprinting",
+      "suspicious-login-alerts",
+      "sso-integration",
+      // SSO/SAML Integration
+      "ldap-sync",
+      // LDAP/AD Sync
+      "audit-logs",
+      // Vollständige Audit Logs
+      "compliance-reports",
+      // GDPR/SOC2 Reports
+      "priority-support",
+      // 24/7 Priority Support
+      "custom-security-rules",
+      // Custom Security Rules
+      "multi-tenant",
+      // Multi-Tenant Support
+      "white-label"
+      // White-Label Branding
+    ]
+  },
+  /**
+   * Check if a feature is available for given license tier
+   */
+  hasFeature(licenseData, featureName) {
+    if (!licenseData) {
       return this.free.features.includes(featureName);
-    },
-    /**
-     * Get max allowed tokens for license tier
-     */
-    getMaxTokens(licenseData) {
-      if (!licenseData) return this.free.maxTokens;
-      if (licenseData.featureEnterprise === true || licenseData.features?.enterprise === true) return this.enterprise.maxTokens;
-      if (licenseData.featureAdvanced === true || licenseData.features?.advanced === true) return this.advanced.maxTokens;
-      if (licenseData.featurePremium === true || licenseData.features?.premium === true) return this.premium.maxTokens;
-      return this.free.maxTokens;
-    },
-    /**
-     * Get max allowed sessions for license tier
-     */
-    getMaxSessions(licenseData) {
-      if (!licenseData) return this.free.maxSessions;
-      if (licenseData.featureEnterprise === true || licenseData.features?.enterprise === true) return this.enterprise.maxSessions;
-      if (licenseData.featureAdvanced === true || licenseData.features?.advanced === true) return this.advanced.maxSessions;
-      if (licenseData.featurePremium === true || licenseData.features?.premium === true) return this.premium.maxSessions;
-      return this.free.maxSessions;
-    },
-    /**
-     * Get max allowed IP bans for license tier
-     */
-    getMaxIPBans(licenseData) {
-      if (!licenseData) return this.free.maxIPBans;
-      if (licenseData.featureEnterprise === true || licenseData.features?.enterprise === true) return this.enterprise.maxIPBans;
-      if (licenseData.featureAdvanced === true || licenseData.features?.advanced === true) return this.advanced.maxIPBans;
-      if (licenseData.featurePremium === true || licenseData.features?.premium === true) return this.premium.maxIPBans;
-      return this.free.maxIPBans;
-    },
-    /**
-     * Get tier name from license data
-     */
-    getTierName(licenseData) {
-      if (!licenseData) return "free";
-      if (licenseData.featureEnterprise === true || licenseData.features?.enterprise === true) return "enterprise";
-      if (licenseData.featureAdvanced === true || licenseData.features?.advanced === true) return "advanced";
-      if (licenseData.featurePremium === true || licenseData.features?.premium === true) return "premium";
-      return "free";
     }
-  };
-  return features$1;
-}
-const crypto$1 = require$$0__default$1.default;
+    let isEnterprise = false;
+    let isAdvanced = false;
+    let isPremium = false;
+    if (licenseData.tier) {
+      isEnterprise = licenseData.tier === "enterprise";
+      isAdvanced = licenseData.tier === "advanced";
+      isPremium = licenseData.tier === "premium";
+    }
+    if (licenseData.features) {
+      isEnterprise = isEnterprise || licenseData.features.enterprise === true;
+      isAdvanced = isAdvanced || licenseData.features.advanced === true;
+      isPremium = isPremium || licenseData.features.premium === true;
+    }
+    if (licenseData.featureEnterprise === true) {
+      isEnterprise = true;
+    }
+    if (licenseData.featureAdvanced === true) {
+      isAdvanced = true;
+    }
+    if (licenseData.featurePremium === true) {
+      isPremium = true;
+    }
+    if (isEnterprise && this.enterprise.features.includes(featureName)) {
+      return true;
+    }
+    if (isAdvanced && this.advanced.features.includes(featureName)) {
+      return true;
+    }
+    if (isPremium && this.premium.features.includes(featureName)) {
+      return true;
+    }
+    return this.free.features.includes(featureName);
+  },
+  /**
+   * Get max allowed tokens for license tier
+   */
+  getMaxTokens(licenseData) {
+    if (!licenseData) return this.free.maxTokens;
+    if (licenseData.featureEnterprise === true || licenseData.features?.enterprise === true) return this.enterprise.maxTokens;
+    if (licenseData.featureAdvanced === true || licenseData.features?.advanced === true) return this.advanced.maxTokens;
+    if (licenseData.featurePremium === true || licenseData.features?.premium === true) return this.premium.maxTokens;
+    return this.free.maxTokens;
+  },
+  /**
+   * Get max allowed sessions for license tier
+   */
+  getMaxSessions(licenseData) {
+    if (!licenseData) return this.free.maxSessions;
+    if (licenseData.featureEnterprise === true || licenseData.features?.enterprise === true) return this.enterprise.maxSessions;
+    if (licenseData.featureAdvanced === true || licenseData.features?.advanced === true) return this.advanced.maxSessions;
+    if (licenseData.featurePremium === true || licenseData.features?.premium === true) return this.premium.maxSessions;
+    return this.free.maxSessions;
+  },
+  /**
+   * Get max allowed IP bans for license tier
+   */
+  getMaxIPBans(licenseData) {
+    if (!licenseData) return this.free.maxIPBans;
+    if (licenseData.featureEnterprise === true || licenseData.features?.enterprise === true) return this.enterprise.maxIPBans;
+    if (licenseData.featureAdvanced === true || licenseData.features?.advanced === true) return this.advanced.maxIPBans;
+    if (licenseData.featurePremium === true || licenseData.features?.premium === true) return this.premium.maxIPBans;
+    return this.free.maxIPBans;
+  },
+  /**
+   * Get tier name from license data
+   */
+  getTierName(licenseData) {
+    if (!licenseData) return "free";
+    if (licenseData.featureEnterprise === true || licenseData.features?.enterprise === true) return "enterprise";
+    if (licenseData.featureAdvanced === true || licenseData.features?.advanced === true) return "advanced";
+    if (licenseData.featurePremium === true || licenseData.features?.premium === true) return "premium";
+    return "free";
+  }
+};
+const crypto$1 = require$$0__default.default;
 const os = require$$1__default$3.default;
+const features = features$1;
 const LICENSE_SERVER_URL = "https://magicapi.fitlex.me";
 const envTimeout = Number(process.env.MAGIC_LICENSE_TIMEOUT_MS);
 const DEFAULT_FETCH_TIMEOUT_MS = Number.isFinite(envTimeout) && envTimeout > 0 ? envTimeout : 12e3;
@@ -5469,14 +5463,13 @@ var licenseGuard$1 = ({ strapi: strapi2 }) => ({
    */
   async hasFeature(featureName) {
     try {
-      const features2 = requireFeatures();
       const pluginStore = strapi2.store({ type: "plugin", name: "magic-link" });
       const licenseKey = await pluginStore.get({ key: "licenseKey" });
       if (!licenseKey) {
-        return features2.hasFeature(null, featureName);
+        return features.hasFeature(null, featureName);
       }
       const licenseData = await this.getLicenseByKey(licenseKey);
-      return features2.hasFeature(licenseData, featureName);
+      return features.hasFeature(licenseData, featureName);
     } catch (error) {
       strapi2.log.error("Error checking feature:", error);
       return false;
@@ -5488,14 +5481,13 @@ var licenseGuard$1 = ({ strapi: strapi2 }) => ({
    */
   async getMaxTokens() {
     try {
-      const features2 = requireFeatures();
       const pluginStore = strapi2.store({ type: "plugin", name: "magic-link" });
       const licenseKey = await pluginStore.get({ key: "licenseKey" });
       if (!licenseKey) {
-        return features2.getMaxTokens(null);
+        return features.getMaxTokens(null);
       }
       const licenseData = await this.getLicenseByKey(licenseKey);
-      return features2.getMaxTokens(licenseData);
+      return features.getMaxTokens(licenseData);
     } catch (error) {
       strapi2.log.error("Error getting max tokens:", error);
       return features.free.maxTokens;
@@ -5507,14 +5499,13 @@ var licenseGuard$1 = ({ strapi: strapi2 }) => ({
    */
   async getMaxSessions() {
     try {
-      const features2 = requireFeatures();
       const pluginStore = strapi2.store({ type: "plugin", name: "magic-link" });
       const licenseKey = await pluginStore.get({ key: "licenseKey" });
       if (!licenseKey) {
-        return features2.getMaxSessions(null);
+        return features.getMaxSessions(null);
       }
       const licenseData = await this.getLicenseByKey(licenseKey);
-      return features2.getMaxSessions(licenseData);
+      return features.getMaxSessions(licenseData);
     } catch (error) {
       strapi2.log.error("Error getting max sessions:", error);
       return features.free.maxSessions;
@@ -5526,14 +5517,13 @@ var licenseGuard$1 = ({ strapi: strapi2 }) => ({
    */
   async getMaxIPBans() {
     try {
-      const features2 = requireFeatures();
       const pluginStore = strapi2.store({ type: "plugin", name: "magic-link" });
       const licenseKey = await pluginStore.get({ key: "licenseKey" });
       if (!licenseKey) {
-        return features2.getMaxIPBans(null);
+        return features.getMaxIPBans(null);
       }
       const licenseData = await this.getLicenseByKey(licenseKey);
-      return features2.getMaxIPBans(licenseData);
+      return features.getMaxIPBans(licenseData);
     } catch (error) {
       strapi2.log.error("Error getting max IP bans:", error);
       return features.free.maxIPBans;
@@ -5545,14 +5535,13 @@ var licenseGuard$1 = ({ strapi: strapi2 }) => ({
    */
   async getAvailableOTPTypes() {
     try {
-      const features2 = requireFeatures();
       const pluginStore = strapi2.store({ type: "plugin", name: "magic-link" });
       const licenseKey = await pluginStore.get({ key: "licenseKey" });
       if (!licenseKey) {
-        return features2.getAvailableOTPTypes(null);
+        return features.getAvailableOTPTypes(null);
       }
       const licenseData = await this.getLicenseByKey(licenseKey);
-      return features2.getAvailableOTPTypes(licenseData);
+      return features.getAvailableOTPTypes(licenseData);
     } catch (error) {
       strapi2.log.error("Error getting available OTP types:", error);
       return [];
@@ -5723,7 +5712,7 @@ var rateLimiter$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
-const crypto = require$$0__default$1.default;
+const crypto = require$$0__default.default;
 const speakeasy = require$$1__default$4.default;
 const QRCode = require$$2__default.default;
 const emailHelpers = emailHelpers$3;
@@ -6367,7 +6356,7 @@ If you didn't request this code, you can safely ignore this email.
   };
 };
 const path = require$$1__default.default;
-const fs = require$$0__default.default;
+const fs = require$$0__default$1.default;
 let baileys = null;
 const getMagicMailWhatsApp = (strapi2) => {
   try {