strapi-plugin-magic-sessionmanager 3.0.2 → 3.2.0

package/dist/_chunks/{Settings-JixgQiB_.js → Settings-Lkmxisuv.js}

@@ -6,16 +6,16 @@ const designSystem = require("@strapi/design-system");
 const admin = require("@strapi/strapi/admin");
 const icons = require("@strapi/icons");
 const styled = require("styled-components");
-const index = require("./index-DqtQaEBL.js");
-const useLicense = require("./useLicense-DA-averf.js");
+const index = require("./index-W_QbTAYU.js");
+const useLicense = require("./useLicense-C_Rneohy.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);
 const theme = {
   colors: {
-    primary: { 600: "#0284C7", 700: "#075985" },
+    primary: { 600: "#0284C7", 700: "#075985", 100: "#E0F2FE", 50: "#F0F9FF" },
     success: { 600: "#16A34A", 700: "#15803D" },
     danger: { 600: "#DC2626" },
-    neutral: { 200: "#E5E7EB", 400: "#9CA3AF", 700: "#374151" }
+    neutral: { 0: "#FFFFFF", 200: "#E5E7EB", 400: "#9CA3AF", 700: "#374151" }
   },
   shadows: { sm: "0 1px 3px rgba(0,0,0,0.1)" },
   borderRadius: { md: "8px", lg: "12px" }
@@ -326,6 +326,16 @@ Login Details:
 - VPN: {{reason.isVpn}}, Proxy: {{reason.isProxy}}`
   }
 });
+const generateSecureKey = () => {
+  const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()_+-=[]{}|;:,.<>?";
+  let key = "";
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  for (let i = 0; i < 32; i++) {
+    key += chars[array[i] % chars.length];
+  }
+  return key;
+};
 const SettingsPage = () => {
   const { get, post, put } = admin.useFetchClient();
   const { toggleNotification } = admin.useNotification();
@@ -335,6 +345,8 @@ const SettingsPage = () => {
   const [hasChanges, setHasChanges] = react.useState(false);
   const [cleaning, setCleaning] = react.useState(false);
   const [activeTemplateTab, setActiveTemplateTab] = react.useState("suspiciousLogin");
+  const [encryptionKey, setEncryptionKey] = react.useState("");
+  const [showEncryptionKey, setShowEncryptionKey] = react.useState(false);
   const [settings, setSettings] = react.useState({
     inactivityTimeout: 15,
     cleanupInterval: 30,
@@ -662,6 +674,142 @@ const SettingsPage = () => {
           ) }),
           /* @__PURE__ */ jsxRuntime.jsx(designSystem.Accordion.Content, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { padding: 6, children: [
             /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "sigma", fontWeight: "bold", style: { marginBottom: "16px", display: "block", color: theme.colors.neutral[700] }, children: "🔒 SECURITY OPTIONS" }),
+            /* @__PURE__ */ jsxRuntime.jsx(
+              designSystem.Box,
+              {
+                background: "neutral0",
+                padding: 6,
+                style: {
+                  borderRadius: theme.borderRadius.lg,
+                  marginBottom: "32px",
+                  border: `2px solid ${theme.colors.primary[100]}`,
+                  background: `linear-gradient(135deg, ${theme.colors.neutral[0]} 0%, ${theme.colors.primary[50]} 100%)`
+                },
+                children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 4, children: [
+                  /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { alignItems: "center", gap: 3, children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(icons.Shield, { style: { width: 24, height: 24, color: theme.colors.primary[600] } }),
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "delta", fontWeight: "bold", children: "JWT Encryption Key Generator" })
+                  ] }),
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", textColor: "neutral600", style: { lineHeight: 1.6 }, children: "Generate a secure 32-character encryption key for JWT token storage. This key is used to encrypt tokens before saving them to the database." }),
+                  /* @__PURE__ */ jsxRuntime.jsxs(
+                    designSystem.Alert,
+                    {
+                      variant: "default",
+                      title: "Important",
+                      style: { marginTop: 8 },
+                      children: [
+                        "Add this key to your ",
+                        /* @__PURE__ */ jsxRuntime.jsx("code", { children: ".env" }),
+                        " file as ",
+                        /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "SESSION_ENCRYPTION_KEY" }),
+                        " for production."
+                      ]
+                    }
+                  ),
+                  /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 3, alignItems: "flex-end", children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { style: { flex: 1 }, children: /* @__PURE__ */ jsxRuntime.jsx(
+                      designSystem.TextInput,
+                      {
+                        label: "Generated Encryption Key",
+                        value: encryptionKey,
+                        onChange: (e) => setEncryptionKey(e.target.value),
+                        placeholder: "Click 'Generate Key' to create a secure key",
+                        type: showEncryptionKey ? "text" : "password"
+                      }
+                    ) }),
+                    /* @__PURE__ */ jsxRuntime.jsx(
+                      designSystem.Button,
+                      {
+                        variant: "secondary",
+                        onClick: () => setShowEncryptionKey(!showEncryptionKey),
+                        size: "L",
+                        children: showEncryptionKey ? "Hide" : "Show"
+                      }
+                    )
+                  ] }),
+                  /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 3, children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(
+                      designSystem.Button,
+                      {
+                        variant: "default",
+                        startIcon: /* @__PURE__ */ jsxRuntime.jsx(icons.Code, {}),
+                        onClick: () => {
+                          const key = generateSecureKey();
+                          setEncryptionKey(key);
+                          setShowEncryptionKey(true);
+                          toggleNotification({
+                            type: "success",
+                            message: "32-character encryption key generated!"
+                          });
+                        },
+                        size: "L",
+                        children: "Generate Key"
+                      }
+                    ),
+                    /* @__PURE__ */ jsxRuntime.jsx(
+                      designSystem.Button,
+                      {
+                        variant: "tertiary",
+                        startIcon: /* @__PURE__ */ jsxRuntime.jsx(icons.Duplicate, {}),
+                        onClick: () => {
+                          if (encryptionKey) {
+                            navigator.clipboard.writeText(encryptionKey);
+                            toggleNotification({
+                              type: "success",
+                              message: "Encryption key copied to clipboard!"
+                            });
+                          }
+                        },
+                        disabled: !encryptionKey,
+                        size: "L",
+                        children: "Copy to Clipboard"
+                      }
+                    ),
+                    /* @__PURE__ */ jsxRuntime.jsx(
+                      designSystem.Button,
+                      {
+                        variant: "tertiary",
+                        startIcon: /* @__PURE__ */ jsxRuntime.jsx(icons.Duplicate, {}),
+                        onClick: () => {
+                          if (encryptionKey) {
+                            const envLine = `SESSION_ENCRYPTION_KEY=${encryptionKey}`;
+                            navigator.clipboard.writeText(envLine);
+                            toggleNotification({
+                              type: "success",
+                              message: "Copied as .env format!"
+                            });
+                          }
+                        },
+                        disabled: !encryptionKey,
+                        size: "L",
+                        children: "Copy for .env"
+                      }
+                    )
+                  ] }),
+                  encryptionKey && /* @__PURE__ */ jsxRuntime.jsxs(
+                    designSystem.Box,
+                    {
+                      padding: 4,
+                      background: "neutral100",
+                      style: {
+                        borderRadius: theme.borderRadius.md,
+                        border: "1px solid " + theme.colors.neutral[200],
+                        fontFamily: "monospace",
+                        fontSize: "12px",
+                        wordBreak: "break-all"
+                      },
+                      children: [
+                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", fontWeight: "bold", style: { marginBottom: 8, display: "block" }, children: "Add to .env file:" }),
+                        /* @__PURE__ */ jsxRuntime.jsxs("code", { style: { color: theme.colors.primary[700] }, children: [
+                          "SESSION_ENCRYPTION_KEY=",
+                          encryptionKey
+                        ] })
+                      ]
+                    }
+                  )
+                ] })
+              }
+            ),
             /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { background: "neutral100", padding: 5, style: { borderRadius: theme.borderRadius.md, marginBottom: "32px" }, children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Grid.Root, { gap: 4, children: [
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsxRuntime.jsx(
                 ToggleCard,

package/dist/_chunks/{index--JzOiQNw.mjs → index-B-0VPfeF.mjs}

@@ -403,7 +403,7 @@ const index = {
         id: `${pluginId}.plugin.name`,
         defaultMessage: pluginPkg.strapi.displayName
       },
-      Component: () => import("./App-DONYhluL.mjs")
+      Component: () => import("./App-Zhs_vt59.mjs")
     });
     app.createSettingSection(
       {
@@ -419,7 +419,7 @@ const index = {
           },
           id: "general",
           to: `/settings/${pluginId}/general`,
-          Component: () => import("./Settings-JaiqQ_7r.mjs")
+          Component: () => import("./Settings-CL2im8M3.mjs")
         },
         {
           intlLabel: {
@@ -428,7 +428,7 @@ const index = {
           },
           id: "analytics",
           to: `/settings/${pluginId}/analytics`,
-          Component: () => import("./Analytics-Bp1cPJx1.mjs")
+          Component: () => import("./Analytics-CwyLwdOZ.mjs")
         },
         {
           intlLabel: {
@@ -437,7 +437,7 @@ const index = {
           },
           id: "license",
           to: `/settings/${pluginId}/license`,
-          Component: () => import("./License-lcVK7rtT.mjs")
+          Component: () => import("./License-CPI0p_W8.mjs")
         }
       ]
     );

package/dist/_chunks/{index-DqtQaEBL.js → index-W_QbTAYU.js}

@@ -404,7 +404,7 @@ const index = {
         id: `${pluginId}.plugin.name`,
         defaultMessage: pluginPkg.strapi.displayName
       },
-      Component: () => Promise.resolve().then(() => require("./App-DtfZMVae.js"))
+      Component: () => Promise.resolve().then(() => require("./App-nGu2Eb87.js"))
     });
     app.createSettingSection(
       {
@@ -420,7 +420,7 @@ const index = {
           },
           id: "general",
           to: `/settings/${pluginId}/general`,
-          Component: () => Promise.resolve().then(() => require("./Settings-JixgQiB_.js"))
+          Component: () => Promise.resolve().then(() => require("./Settings-Lkmxisuv.js"))
         },
         {
           intlLabel: {
@@ -429,7 +429,7 @@ const index = {
           },
           id: "analytics",
           to: `/settings/${pluginId}/analytics`,
-          Component: () => Promise.resolve().then(() => require("./Analytics-CjqdGXnQ.js"))
+          Component: () => Promise.resolve().then(() => require("./Analytics-DRzCKaDF.js"))
         },
         {
           intlLabel: {
@@ -438,7 +438,7 @@ const index = {
           },
           id: "license",
           to: `/settings/${pluginId}/license`,
-          Component: () => Promise.resolve().then(() => require("./License-IWH6ClOx.js"))
+          Component: () => Promise.resolve().then(() => require("./License-k5vvhgKr.js"))
         }
       ]
     );

package/dist/_chunks/{useLicense-DA-averf.js → useLicense-C_Rneohy.js}

@@ -1,7 +1,7 @@
 "use strict";
 const react = require("react");
 const admin = require("@strapi/strapi/admin");
-const index = require("./index-DqtQaEBL.js");
+const index = require("./index-W_QbTAYU.js");
 const useLicense = () => {
   const { get } = admin.useFetchClient();
   const [isPremium, setIsPremium] = react.useState(false);

package/dist/_chunks/{useLicense-W1cxUaca.mjs → useLicense-DUGjNbQ9.mjs}

@@ -1,6 +1,6 @@
 import { useState, useEffect } from "react";
 import { useFetchClient } from "@strapi/strapi/admin";
-import { a as pluginId } from "./index--JzOiQNw.mjs";
+import { a as pluginId } from "./index-B-0VPfeF.mjs";
 const useLicense = () => {
   const { get } = useFetchClient();
   const [isPremium, setIsPremium] = useState(false);

package/dist/admin/index.js

@@ -1,3 +1,3 @@
 "use strict";
-const index = require("../_chunks/index-DqtQaEBL.js");
+const index = require("../_chunks/index-W_QbTAYU.js");
 module.exports = index.index;

package/dist/admin/index.mjs

@@ -1,4 +1,4 @@
-import { i } from "../_chunks/index--JzOiQNw.mjs";
+import { i } from "../_chunks/index-B-0VPfeF.mjs";
 export {
   i as default
 };

package/dist/server/index.js

@@ -87,6 +87,68 @@ const isPrivateIp = (ip) => {
   return false;
 };
 var getClientIp_1 = getClientIp$1;
+const crypto$1 = require$$0__default.default;
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 16;
+function getEncryptionKey() {
+  const envKey = process.env.SESSION_ENCRYPTION_KEY;
+  if (envKey) {
+    const key2 = crypto$1.createHash("sha256").update(envKey).digest();
+    return key2;
+  }
+  const strapiKeys = process.env.APP_KEYS || process.env.API_TOKEN_SALT || "default-insecure-key";
+  const key = crypto$1.createHash("sha256").update(strapiKeys).digest();
+  console.warn("[magic-sessionmanager/encryption] ⚠️  No SESSION_ENCRYPTION_KEY found. Using fallback (not recommended for production).");
+  console.warn("[magic-sessionmanager/encryption] Set SESSION_ENCRYPTION_KEY in .env for better security.");
+  return key;
+}
+function encryptToken$2(token) {
+  if (!token) return null;
+  try {
+    const key = getEncryptionKey();
+    const iv = crypto$1.randomBytes(IV_LENGTH);
+    const cipher = crypto$1.createCipheriv(ALGORITHM, key, iv);
+    let encrypted = cipher.update(token, "utf8", "hex");
+    encrypted += cipher.final("hex");
+    const authTag = cipher.getAuthTag();
+    return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted}`;
+  } catch (err) {
+    console.error("[magic-sessionmanager/encryption] Encryption failed:", err);
+    throw new Error("Failed to encrypt token");
+  }
+}
+function decryptToken$3(encryptedToken) {
+  if (!encryptedToken) return null;
+  try {
+    const key = getEncryptionKey();
+    const parts = encryptedToken.split(":");
+    if (parts.length !== 3) {
+      throw new Error("Invalid encrypted token format");
+    }
+    const iv = Buffer.from(parts[0], "hex");
+    const authTag = Buffer.from(parts[1], "hex");
+    const encrypted = parts[2];
+    const decipher = crypto$1.createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(encrypted, "hex", "utf8");
+    decrypted += decipher.final("utf8");
+    return decrypted;
+  } catch (err) {
+    console.error("[magic-sessionmanager/encryption] Decryption failed:", err);
+    return null;
+  }
+}
+function generateSessionId$1(userId) {
+  const timestamp = Date.now().toString(36);
+  const randomBytes = crypto$1.randomBytes(8).toString("hex");
+  const userHash = crypto$1.createHash("sha256").update(userId.toString()).digest("hex").substring(0, 8);
+  return `sess_${timestamp}_${userHash}_${randomBytes}`;
+}
+var encryption = {
+  encryptToken: encryptToken$2,
+  decryptToken: decryptToken$3,
+  generateSessionId: generateSessionId$1
+};
 var lastSeen = ({ strapi: strapi2, sessionService }) => {
   return async (ctx, next) => {
     if (ctx.state.user && ctx.state.user.id) {
@@ -123,6 +185,7 @@ var lastSeen = ({ strapi: strapi2, sessionService }) => {
   };
 };
 const getClientIp = getClientIp_1;
+const { encryptToken: encryptToken$1, decryptToken: decryptToken$2 } = encryption;
 var bootstrap$1 = async ({ strapi: strapi2 }) => {
   strapi2.log.info("[magic-sessionmanager] 🚀 Bootstrap starting...");
   try {
@@ -190,16 +253,23 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
             ctx.body = { message: "Logged out successfully" };
             return;
           }
-          const sessions = await strapi2.entityService.findMany("plugin::magic-sessionmanager.session", {
+          const allSessions = await strapi2.entityService.findMany("plugin::magic-sessionmanager.session", {
             filters: {
-              token,
               isActive: true
-            },
-            limit: 1
+            }
+          });
+          const matchingSession = allSessions.find((session2) => {
+            if (!session2.token) return false;
+            try {
+              const decrypted = decryptToken$2(session2.token);
+              return decrypted === token;
+            } catch (err) {
+              return false;
+            }
           });
-          if (sessions.length > 0) {
-            await sessionService.terminateSession({ sessionId: sessions[0].id });
-            strapi2.log.info(`[magic-sessionmanager] 🚪 Logout via /api/auth/logout - Session ${sessions[0].id} terminated`);
+          if (matchingSession) {
+            await sessionService.terminateSession({ sessionId: matchingSession.id });
+            strapi2.log.info(`[magic-sessionmanager] 🚪 Logout via /api/auth/logout - Session ${matchingSession.id} terminated`);
           }
           ctx.status = 200;
           ctx.body = { message: "Logged out successfully" };
@@ -387,6 +457,11 @@ const pluginOptions = {
   }
 };
 const attributes = {
+  sessionId: {
+    type: "string",
+    unique: true,
+    required: true
+  },
   user: {
     type: "relation",
     relation: "manyToOne",
@@ -643,6 +718,7 @@ var routes$1 = {
   admin,
   "content-api": contentApi
 };
+const { decryptToken: decryptToken$1 } = encryption;
 var session$3 = {
   /**
    * Get ALL sessions (active + inactive) - Admin only
@@ -722,13 +798,21 @@ var session$3 = {
       const sessions = await strapi.entityService.findMany("plugin::magic-sessionmanager.session", {
         filters: {
           user: { id: userId },
-          token,
           isActive: true
         }
       });
-      if (sessions.length > 0) {
-        await sessionService.terminateSession({ sessionId: sessions[0].id });
-        strapi.log.info(`[magic-sessionmanager] User ${userId} logged out (session ${sessions[0].id})`);
+      const matchingSession = sessions.find((session2) => {
+        if (!session2.token) return false;
+        try {
+          const decrypted = decryptToken$1(session2.token);
+          return decrypted === token;
+        } catch (err) {
+          return false;
+        }
+      });
+      if (matchingSession) {
+        await sessionService.terminateSession({ sessionId: matchingSession.id });
+        strapi.log.info(`[magic-sessionmanager] User ${userId} logged out (session ${matchingSession.id})`);
       }
       ctx.body = {
         message: "Logged out successfully"
@@ -1227,6 +1311,7 @@ var controllers$1 = {
   license,
   settings
 };
+const { encryptToken, decryptToken, generateSessionId } = encryption;
 var session$1 = ({ strapi: strapi2 }) => ({
   /**
    * Create a new session record
@@ -1236,6 +1321,8 @@ var session$1 = ({ strapi: strapi2 }) => ({
   async createSession({ userId, ip = "unknown", userAgent = "unknown", token }) {
     try {
       const now = /* @__PURE__ */ new Date();
+      const sessionId = generateSessionId(userId);
+      const encryptedToken = token ? encryptToken(token) : null;
       const session2 = await strapi2.entityService.create("plugin::magic-sessionmanager.session", {
         data: {
           user: userId,
@@ -1244,11 +1331,13 @@ var session$1 = ({ strapi: strapi2 }) => ({
           loginTime: now,
           lastActive: now,
           isActive: true,
-          token
-          // Store JWT for logout matching
+          token: encryptedToken,
+          // ✅ Encrypted JWT for security
+          sessionId
+          // ✅ Unique identifier
         }
       });
-      strapi2.log.info(`[magic-sessionmanager] ✅ Session ${session2.id} created for user ${userId}`);
+      strapi2.log.info(`[magic-sessionmanager] ✅ Session ${session2.id} (${sessionId}) created for user ${userId}`);
       return session2;
     } catch (err) {
       strapi2.log.error("[magic-sessionmanager] Error creating session:", err);

package/dist/server/index.mjs

@@ -83,6 +83,68 @@ const isPrivateIp = (ip) => {
   return false;
 };
 var getClientIp_1 = getClientIp$1;
+const crypto$1 = require$$0$1;
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 16;
+function getEncryptionKey() {
+  const envKey = process.env.SESSION_ENCRYPTION_KEY;
+  if (envKey) {
+    const key2 = crypto$1.createHash("sha256").update(envKey).digest();
+    return key2;
+  }
+  const strapiKeys = process.env.APP_KEYS || process.env.API_TOKEN_SALT || "default-insecure-key";
+  const key = crypto$1.createHash("sha256").update(strapiKeys).digest();
+  console.warn("[magic-sessionmanager/encryption] ⚠️  No SESSION_ENCRYPTION_KEY found. Using fallback (not recommended for production).");
+  console.warn("[magic-sessionmanager/encryption] Set SESSION_ENCRYPTION_KEY in .env for better security.");
+  return key;
+}
+function encryptToken$2(token) {
+  if (!token) return null;
+  try {
+    const key = getEncryptionKey();
+    const iv = crypto$1.randomBytes(IV_LENGTH);
+    const cipher = crypto$1.createCipheriv(ALGORITHM, key, iv);
+    let encrypted = cipher.update(token, "utf8", "hex");
+    encrypted += cipher.final("hex");
+    const authTag = cipher.getAuthTag();
+    return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted}`;
+  } catch (err) {
+    console.error("[magic-sessionmanager/encryption] Encryption failed:", err);
+    throw new Error("Failed to encrypt token");
+  }
+}
+function decryptToken$3(encryptedToken) {
+  if (!encryptedToken) return null;
+  try {
+    const key = getEncryptionKey();
+    const parts = encryptedToken.split(":");
+    if (parts.length !== 3) {
+      throw new Error("Invalid encrypted token format");
+    }
+    const iv = Buffer.from(parts[0], "hex");
+    const authTag = Buffer.from(parts[1], "hex");
+    const encrypted = parts[2];
+    const decipher = crypto$1.createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(encrypted, "hex", "utf8");
+    decrypted += decipher.final("utf8");
+    return decrypted;
+  } catch (err) {
+    console.error("[magic-sessionmanager/encryption] Decryption failed:", err);
+    return null;
+  }
+}
+function generateSessionId$1(userId) {
+  const timestamp = Date.now().toString(36);
+  const randomBytes = crypto$1.randomBytes(8).toString("hex");
+  const userHash = crypto$1.createHash("sha256").update(userId.toString()).digest("hex").substring(0, 8);
+  return `sess_${timestamp}_${userHash}_${randomBytes}`;
+}
+var encryption = {
+  encryptToken: encryptToken$2,
+  decryptToken: decryptToken$3,
+  generateSessionId: generateSessionId$1
+};
 var lastSeen = ({ strapi: strapi2, sessionService }) => {
   return async (ctx, next) => {
     if (ctx.state.user && ctx.state.user.id) {
@@ -119,6 +181,7 @@ var lastSeen = ({ strapi: strapi2, sessionService }) => {
   };
 };
 const getClientIp = getClientIp_1;
+const { encryptToken: encryptToken$1, decryptToken: decryptToken$2 } = encryption;
 var bootstrap$1 = async ({ strapi: strapi2 }) => {
   strapi2.log.info("[magic-sessionmanager] 🚀 Bootstrap starting...");
   try {
@@ -186,16 +249,23 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
             ctx.body = { message: "Logged out successfully" };
             return;
           }
-          const sessions = await strapi2.entityService.findMany("plugin::magic-sessionmanager.session", {
+          const allSessions = await strapi2.entityService.findMany("plugin::magic-sessionmanager.session", {
             filters: {
-              token,
               isActive: true
-            },
-            limit: 1
+            }
+          });
+          const matchingSession = allSessions.find((session2) => {
+            if (!session2.token) return false;
+            try {
+              const decrypted = decryptToken$2(session2.token);
+              return decrypted === token;
+            } catch (err) {
+              return false;
+            }
           });
-          if (sessions.length > 0) {
-            await sessionService.terminateSession({ sessionId: sessions[0].id });
-            strapi2.log.info(`[magic-sessionmanager] 🚪 Logout via /api/auth/logout - Session ${sessions[0].id} terminated`);
+          if (matchingSession) {
+            await sessionService.terminateSession({ sessionId: matchingSession.id });
+            strapi2.log.info(`[magic-sessionmanager] 🚪 Logout via /api/auth/logout - Session ${matchingSession.id} terminated`);
           }
           ctx.status = 200;
           ctx.body = { message: "Logged out successfully" };
@@ -383,6 +453,11 @@ const pluginOptions = {
   }
 };
 const attributes = {
+  sessionId: {
+    type: "string",
+    unique: true,
+    required: true
+  },
   user: {
     type: "relation",
     relation: "manyToOne",
@@ -639,6 +714,7 @@ var routes$1 = {
   admin,
   "content-api": contentApi
 };
+const { decryptToken: decryptToken$1 } = encryption;
 var session$3 = {
   /**
    * Get ALL sessions (active + inactive) - Admin only
@@ -718,13 +794,21 @@ var session$3 = {
       const sessions = await strapi.entityService.findMany("plugin::magic-sessionmanager.session", {
         filters: {
           user: { id: userId },
-          token,
           isActive: true
         }
       });
-      if (sessions.length > 0) {
-        await sessionService.terminateSession({ sessionId: sessions[0].id });
-        strapi.log.info(`[magic-sessionmanager] User ${userId} logged out (session ${sessions[0].id})`);
+      const matchingSession = sessions.find((session2) => {
+        if (!session2.token) return false;
+        try {
+          const decrypted = decryptToken$1(session2.token);
+          return decrypted === token;
+        } catch (err) {
+          return false;
+        }
+      });
+      if (matchingSession) {
+        await sessionService.terminateSession({ sessionId: matchingSession.id });
+        strapi.log.info(`[magic-sessionmanager] User ${userId} logged out (session ${matchingSession.id})`);
       }
       ctx.body = {
         message: "Logged out successfully"
@@ -1223,6 +1307,7 @@ var controllers$1 = {
   license,
   settings
 };
+const { encryptToken, decryptToken, generateSessionId } = encryption;
 var session$1 = ({ strapi: strapi2 }) => ({
   /**
    * Create a new session record
@@ -1232,6 +1317,8 @@ var session$1 = ({ strapi: strapi2 }) => ({
   async createSession({ userId, ip = "unknown", userAgent = "unknown", token }) {
     try {
       const now = /* @__PURE__ */ new Date();
+      const sessionId = generateSessionId(userId);
+      const encryptedToken = token ? encryptToken(token) : null;
       const session2 = await strapi2.entityService.create("plugin::magic-sessionmanager.session", {
         data: {
           user: userId,
@@ -1240,11 +1327,13 @@ var session$1 = ({ strapi: strapi2 }) => ({
           loginTime: now,
           lastActive: now,
           isActive: true,
-          token
-          // Store JWT for logout matching
+          token: encryptedToken,
+          // ✅ Encrypted JWT for security
+          sessionId
+          // ✅ Unique identifier
         }
       });
-      strapi2.log.info(`[magic-sessionmanager] ✅ Session ${session2.id} created for user ${userId}`);
+      strapi2.log.info(`[magic-sessionmanager] ✅ Session ${session2.id} (${sessionId}) created for user ${userId}`);
       return session2;
     } catch (err) {
       strapi2.log.error("[magic-sessionmanager] Error creating session:", err);

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.2",
+  "version": "3.2.0",
   "keywords": [
     "strapi",
     "strapi-plugin",