strapi-plugin-magic-sessionmanager 3.7.0 → 4.0.1

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.7.0",
+  "version": "4.0.1",
   "keywords": [
     "strapi",
     "strapi-plugin",

package/server/src/bootstrap.js

@@ -4,14 +4,19 @@
  * Bootstrap: Mount middleware for session tracking
  * Sessions are managed via plugin::magic-sessionmanager.session content type
  *
+ * [SUCCESS] Migrated to strapi.documents() API (Strapi v5 Best Practice)
+ *
  * NOTE: For multi-instance deployments, consider Redis locks or session store
  */
 
 const getClientIp = require('./utils/getClientIp');
 const { encryptToken, decryptToken } = require('./utils/encryption');
 
+const SESSION_UID = 'plugin::magic-sessionmanager.session';
+const USER_UID = 'plugin::users-permissions.user';
+
 module.exports = async ({ strapi }) => {
-  strapi.log.info('[magic-sessionmanager] 🚀 Bootstrap starting...');
+  strapi.log.info('[magic-sessionmanager] [START] Bootstrap starting...');
 
   try {
     // Initialize License Guard
@@ -23,7 +28,7 @@ module.exports = async ({ strapi }) => {
       
       if (!licenseStatus.valid) {
         strapi.log.error('╔════════════════════════════════════════════════════════════════╗');
-        strapi.log.error('║  ❌ SESSION MANAGER - NO VALID LICENSE                         ║');
+        strapi.log.error('║  [ERROR] SESSION MANAGER - NO VALID LICENSE                         ║');
         strapi.log.error('║                                                                ║');
         strapi.log.error('║  This plugin requires a valid license to operate.             ║');
         strapi.log.error('║  Please activate your license via Admin UI:                   ║');
@@ -40,7 +45,7 @@ module.exports = async ({ strapi }) => {
         const storedKey = await pluginStore.get({ key: 'licenseKey' });
         
         strapi.log.info('╔════════════════════════════════════════════════════════════════╗');
-        strapi.log.info('║  ✅ SESSION MANAGER LICENSE ACTIVE                             ║');
+        strapi.log.info('║  [SUCCESS] SESSION MANAGER LICENSE ACTIVE                             ║');
         strapi.log.info('║                                                                ║');
         
         if (licenseStatus.data) {
@@ -53,7 +58,7 @@ module.exports = async ({ strapi }) => {
         }
         
         strapi.log.info('║                                                                ║');
-        strapi.log.info('║  🔄 Auto-pinging every 15 minutes                              ║');
+        strapi.log.info('║  [RELOAD] Auto-pinging every 15 minutes                              ║');
         strapi.log.info('╚════════════════════════════════════════════════════════════════╝');
       }
     }, 3000); // Wait 3 seconds for API to be ready
@@ -80,7 +85,7 @@ module.exports = async ({ strapi }) => {
       }
     }, cleanupInterval);
     
-    strapi.log.info('[magic-sessionmanager] ⏰ Periodic cleanup scheduled (every 30 minutes)');
+    strapi.log.info('[magic-sessionmanager] [TIME] Periodic cleanup scheduled (every 30 minutes)');
     
     // Store interval handle for cleanup on shutdown
     if (!strapi.sessionManagerIntervals) {
@@ -104,7 +109,7 @@ module.exports = async ({ strapi }) => {
 
           // Find session by decrypting tokens and matching
           // Since tokens are encrypted, we need to get all active sessions and check each one
-          const allSessions = await strapi.entityService.findMany('plugin::magic-sessionmanager.session', {
+          const allSessions = await strapi.documents(SESSION_UID).findMany( {
             filters: {
               isActive: true,
             },
@@ -122,8 +127,8 @@ module.exports = async ({ strapi }) => {
           });
 
           if (matchingSession) {
-            await sessionService.terminateSession({ sessionId: matchingSession.id });
-            strapi.log.info(`[magic-sessionmanager] 🚪 Logout via /api/auth/logout - Session ${matchingSession.id} terminated`);
+            await sessionService.terminateSession({ sessionId: matchingSession.documentId });
+            strapi.log.info(`[magic-sessionmanager] [LOGOUT] Logout via /api/auth/logout - Session ${matchingSession.documentId} terminated`);
           }
 
           ctx.status = 200;
@@ -139,7 +144,7 @@ module.exports = async ({ strapi }) => {
       },
     }]);
 
-    strapi.log.info('[magic-sessionmanager] ✅ /api/auth/logout route registered');
+    strapi.log.info('[magic-sessionmanager] [SUCCESS] /api/auth/logout route registered');
 
     // Middleware to intercept logins
     strapi.server.use(async (ctx, next) => {
@@ -158,7 +163,8 @@ module.exports = async ({ strapi }) => {
           const ip = getClientIp(ctx);
           const userAgent = ctx.request.headers?.['user-agent'] || ctx.request.header?.['user-agent'] || 'unknown';
           
-          strapi.log.info(`[magic-sessionmanager] 🔍 Login detected! User: ${user.id} (${user.email || user.username}) from IP: ${ip}`);
+          // Strapi v5: Use documentId for session creation
+          strapi.log.info(`[magic-sessionmanager] [CHECK] Login detected! User: ${user.documentId || user.id} (${user.email || user.username}) from IP: ${ip}`);
           
           // Get config
           const config = strapi.config.get('plugin::magic-sessionmanager') || {};
@@ -216,7 +222,7 @@ module.exports = async ({ strapi }) => {
           
           // Block if needed
           if (shouldBlock) {
-            strapi.log.warn(`[magic-sessionmanager] 🚫 Blocking login: ${blockReason}`);
+            strapi.log.warn(`[magic-sessionmanager] [BLOCKED] Blocking login: ${blockReason}`);
             
             // Don't create session, return error
             ctx.status = 403;
@@ -230,16 +236,23 @@ module.exports = async ({ strapi }) => {
             return; // Stop here
           }
           
-          // Create a new session
+          // Create a new session (Strapi v5: Use documentId instead of numeric id)
+          // If login response doesn't include documentId, fetch it from DB
+          let userDocId = user.documentId;
+          if (!userDocId && user.id) {
+            const fullUser = await strapi.entityService.findOne(USER_UID, user.id);
+            userDocId = fullUser?.documentId || user.id;
+          }
+          
           const newSession = await sessionService.createSession({
-            userId: user.id,
+            userId: userDocId,
             ip,
             userAgent,
             token: ctx.body.jwt,              // Store Access Token (encrypted)
             refreshToken: ctx.body.refreshToken, // Store Refresh Token (encrypted) if exists
           });
           
-          strapi.log.info(`[magic-sessionmanager] ✅ Session created for user ${user.id} (IP: ${ip})`);
+          strapi.log.info(`[magic-sessionmanager] [SUCCESS] Session created for user ${userDocId} (IP: ${ip})`);
           
           // Advanced: Send notifications
           if (geoData && (config.enableEmailAlerts || config.enableWebhooks)) {
@@ -286,13 +299,13 @@ module.exports = async ({ strapi }) => {
             }
           }
         } catch (err) {
-          strapi.log.error('[magic-sessionmanager] ❌ Error creating session:', err);
+          strapi.log.error('[magic-sessionmanager] [ERROR] Error creating session:', err);
           // Don't throw - login should still succeed even if session creation fails
         }
       }
     });
 
-    strapi.log.info('[magic-sessionmanager] ✅ Login/Logout interceptor middleware mounted');
+    strapi.log.info('[magic-sessionmanager] [SUCCESS] Login/Logout interceptor middleware mounted');
 
     // Middleware to block refresh token requests for terminated sessions
     strapi.server.use(async (ctx, next) => {
@@ -305,7 +318,7 @@ module.exports = async ({ strapi }) => {
           
           if (refreshToken) {
             // Find session with this refresh token
-            const allSessions = await strapi.entityService.findMany('plugin::magic-sessionmanager.session', {
+            const allSessions = await strapi.documents(SESSION_UID).findMany( {
               filters: {
                 isActive: true,
               },
@@ -323,8 +336,8 @@ module.exports = async ({ strapi }) => {
             });
 
             if (!matchingSession) {
-              // No active session with this refresh token → Block!
-              strapi.log.warn('[magic-sessionmanager] 🚫 Blocked refresh token request - no active session');
+              // No active session with this refresh token - Block!
+              strapi.log.warn('[magic-sessionmanager] [BLOCKED] Blocked refresh token request - no active session');
               ctx.status = 401;
               ctx.body = {
                 error: {
@@ -336,7 +349,7 @@ module.exports = async ({ strapi }) => {
               return; // Don't continue
             }
             
-            strapi.log.info(`[magic-sessionmanager] ✅ Refresh token allowed for session ${matchingSession.id}`);
+            strapi.log.info(`[magic-sessionmanager] [SUCCESS] Refresh token allowed for session ${matchingSession.documentId}`);
           }
         } catch (err) {
           strapi.log.error('[magic-sessionmanager] Error checking refresh token:', err);
@@ -356,7 +369,7 @@ module.exports = async ({ strapi }) => {
           
           if (oldRefreshToken) {
             // Find session and update with new tokens
-            const allSessions = await strapi.entityService.findMany('plugin::magic-sessionmanager.session', {
+            const allSessions = await strapi.documents(SESSION_UID).findMany( {
               filters: {
                 isActive: true,
               },
@@ -376,7 +389,8 @@ module.exports = async ({ strapi }) => {
               const encryptedToken = newAccessToken ? encryptToken(newAccessToken) : matchingSession.token;
               const encryptedRefreshToken = newRefreshToken ? encryptToken(newRefreshToken) : matchingSession.refreshToken;
               
-              await strapi.entityService.update('plugin::magic-sessionmanager.session', matchingSession.id, {
+              await strapi.documents(SESSION_UID).update({
+                documentId: matchingSession.documentId,
                 data: {
                   token: encryptedToken,
                   refreshToken: encryptedRefreshToken,
@@ -384,7 +398,7 @@ module.exports = async ({ strapi }) => {
                 },
               });
               
-              strapi.log.info(`[magic-sessionmanager] 🔄 Tokens refreshed for session ${matchingSession.id}`);
+              strapi.log.info(`[magic-sessionmanager] [REFRESH] Tokens refreshed for session ${matchingSession.documentId}`);
             }
           }
         } catch (err) {
@@ -393,18 +407,82 @@ module.exports = async ({ strapi }) => {
       }
     });
 
-    strapi.log.info('[magic-sessionmanager] ✅ Refresh Token interceptor middleware mounted');
+    strapi.log.info('[magic-sessionmanager] [SUCCESS] Refresh Token interceptor middleware mounted');
 
     // Mount lastSeen update middleware
     strapi.server.use(
       require('./middlewares/last-seen')({ strapi, sessionService })
     );
 
-    strapi.log.info('[magic-sessionmanager] ✅ LastSeen middleware mounted');
-    strapi.log.info('[magic-sessionmanager] ✅ Bootstrap complete');
-    strapi.log.info('[magic-sessionmanager] 🎉 Session Manager ready! Sessions stored in plugin::magic-sessionmanager.session');
+    strapi.log.info('[magic-sessionmanager] [SUCCESS] LastSeen middleware mounted');
+
+    // Auto-enable Content-API permissions for authenticated users
+    await ensureContentApiPermissions(strapi);
+
+    strapi.log.info('[magic-sessionmanager] [SUCCESS] Bootstrap complete');
+    strapi.log.info('[magic-sessionmanager] [READY] Session Manager ready! Sessions stored in plugin::magic-sessionmanager.session');
     
   } catch (err) {
-    strapi.log.error('[magic-sessionmanager] ❌ Bootstrap error:', err);
+    strapi.log.error('[magic-sessionmanager] [ERROR] Bootstrap error:', err);
   }
 };
+
+/**
+ * Auto-enable Content-API permissions for authenticated users
+ * This ensures plugin endpoints are accessible after installation
+ * @param {object} strapi - Strapi instance
+ */
+async function ensureContentApiPermissions(strapi) {
+  try {
+    // Get the authenticated role
+    const authenticatedRole = await strapi.query('plugin::users-permissions.role').findOne({
+      where: { type: 'authenticated' },
+    });
+
+    if (!authenticatedRole) {
+      strapi.log.warn('[magic-sessionmanager] Authenticated role not found - skipping permission setup');
+      return;
+    }
+
+    // Content-API actions that should be enabled for authenticated users
+    const requiredActions = [
+      'plugin::magic-sessionmanager.session.logout',
+      'plugin::magic-sessionmanager.session.logoutAll',
+      'plugin::magic-sessionmanager.session.getOwnSessions',
+      'plugin::magic-sessionmanager.session.getUserSessions',
+    ];
+
+    // Get existing permissions for this role
+    const existingPermissions = await strapi.query('plugin::users-permissions.permission').findMany({
+      where: {
+        role: authenticatedRole.id,
+        action: { $in: requiredActions },
+      },
+    });
+
+    // Find which actions are missing
+    const existingActions = existingPermissions.map(p => p.action);
+    const missingActions = requiredActions.filter(action => !existingActions.includes(action));
+
+    if (missingActions.length === 0) {
+      strapi.log.debug('[magic-sessionmanager] Content-API permissions already configured');
+      return;
+    }
+
+    // Create missing permissions
+    for (const action of missingActions) {
+      await strapi.query('plugin::users-permissions.permission').create({
+        data: {
+          action,
+          role: authenticatedRole.id,
+        },
+      });
+      strapi.log.info(`[magic-sessionmanager] [PERMISSION] Enabled ${action} for authenticated users`);
+    }
+
+    strapi.log.info('[magic-sessionmanager] [SUCCESS] Content-API permissions configured for authenticated users');
+  } catch (err) {
+    strapi.log.warn('[magic-sessionmanager] Could not auto-configure permissions:', err.message);
+    strapi.log.warn('[magic-sessionmanager] Please manually enable plugin permissions in Settings > Users & Permissions > Roles > Authenticated');
+  }
+}

package/server/src/controllers/license.js

@@ -219,7 +219,7 @@ module.exports = ({ strapi }) => ({
       const verification = await licenseGuard.verifyLicense(trimmedKey);
 
       if (!verification.valid) {
-        strapi.log.warn(`[magic-sessionmanager] ⚠️ Invalid license key attempted: ${trimmedKey.substring(0, 8)}...`);
+        strapi.log.warn(`[magic-sessionmanager] [WARNING] Invalid license key attempted: ${trimmedKey.substring(0, 8)}...`);
         return ctx.badRequest('Invalid or expired license key');
       }
 
@@ -227,13 +227,13 @@ module.exports = ({ strapi }) => ({
       const license = await licenseGuard.getLicenseByKey(trimmedKey);
       
       if (!license) {
-        strapi.log.warn(`[magic-sessionmanager] ⚠️ License not found in database: ${trimmedKey.substring(0, 8)}...`);
+        strapi.log.warn(`[magic-sessionmanager] [WARNING] License not found in database: ${trimmedKey.substring(0, 8)}...`);
         return ctx.badRequest('License not found');
       }
 
       // Verify email matches
       if (license.email.toLowerCase() !== trimmedEmail) {
-        strapi.log.warn(`[magic-sessionmanager] ⚠️ Email mismatch for license key: ${trimmedKey.substring(0, 8)}... (Attempted: ${trimmedEmail})`);
+        strapi.log.warn(`[magic-sessionmanager] [WARNING] Email mismatch for license key: ${trimmedKey.substring(0, 8)}... (Attempted: ${trimmedEmail})`);
         return ctx.badRequest('Email address does not match this license key');
       }
 
@@ -250,7 +250,7 @@ module.exports = ({ strapi }) => ({
         data: verification.data,
       };
 
-      strapi.log.info(`[magic-sessionmanager] ✅ Existing license key validated and stored: ${trimmedKey.substring(0, 8)}... (Email: ${trimmedEmail})`);
+      strapi.log.info(`[magic-sessionmanager] [SUCCESS] Existing license key validated and stored: ${trimmedKey.substring(0, 8)}... (Email: ${trimmedEmail})`);
 
       return ctx.send({
         success: true,

package/server/src/controllers/session.js

@@ -2,6 +2,9 @@
 
 const { decryptToken } = require('../utils/encryption');
 
+const SESSION_UID = 'plugin::magic-sessionmanager.session';
+const USER_UID = 'plugin::users-permissions.user';
+
 /**
  * Session Controller
  * Handles HTTP requests for session management
@@ -55,6 +58,38 @@ module.exports = {
     }
   },
 
+  /**
+   * Get own sessions (authenticated user)
+   * GET /api/magic-sessionmanager/my-sessions
+   * Automatically uses the authenticated user's documentId
+   */
+  async getOwnSessions(ctx) {
+    try {
+      // Strapi v5: Use documentId from authenticated user
+      const userId = ctx.state.user?.documentId;
+
+      if (!userId) {
+        return ctx.throw(401, 'Unauthorized');
+      }
+
+      const sessionService = strapi
+        .plugin('magic-sessionmanager')
+        .service('session');
+
+      const sessions = await sessionService.getUserSessions(userId);
+
+      ctx.body = {
+        data: sessions,
+        meta: {
+          count: sessions.length,
+        },
+      };
+    } catch (err) {
+      strapi.log.error('[magic-sessionmanager] Error fetching own sessions:', err);
+      ctx.throw(500, 'Error fetching sessions');
+    }
+  },
+
   /**
    * Get user's sessions
    * GET /magic-sessionmanager/user/:userId/sessions (Admin API)
@@ -67,12 +102,13 @@ module.exports = {
       
       // Check if this is an admin request
       const isAdminRequest = ctx.state.userAbility || ctx.state.admin;
-      const requestingUserId = ctx.state.user?.id;
+      // Strapi v5: Use documentId instead of numeric id
+      const requestingUserDocId = ctx.state.user?.documentId;
 
       // SECURITY CHECK: Content API users can only see their own sessions
       // Admins can see any user's sessions
-      if (!isAdminRequest && requestingUserId && String(requestingUserId) !== String(userId)) {
-        strapi.log.warn(`[magic-sessionmanager] Security: User ${requestingUserId} tried to access sessions of user ${userId}`);
+      if (!isAdminRequest && requestingUserDocId && String(requestingUserDocId) !== String(userId)) {
+        strapi.log.warn(`[magic-sessionmanager] Security: User ${requestingUserDocId} tried to access sessions of user ${userId}`);
         return ctx.forbidden('You can only access your own sessions');
       }
 
@@ -99,7 +135,8 @@ module.exports = {
    */
   async logout(ctx) {
     try {
-      const userId = ctx.state.user?.id;
+      // Strapi v5: Use documentId instead of numeric id
+      const userId = ctx.state.user?.documentId;
       const token = ctx.request.headers.authorization?.replace('Bearer ', '');
 
       if (!userId) {
@@ -111,9 +148,9 @@ module.exports = {
         .service('session');
 
       // Find current session by decrypting and comparing tokens
-      const sessions = await strapi.entityService.findMany('plugin::magic-sessionmanager.session', {
+      const sessions = await strapi.documents(SESSION_UID).findMany({
         filters: {
-          user: { id: userId },
+          user: { documentId: userId },
           isActive: true,
         },
       });
@@ -131,8 +168,8 @@ module.exports = {
 
       if (matchingSession) {
         // Terminate only the current session
-        await sessionService.terminateSession({ sessionId: matchingSession.id });
-        strapi.log.info(`[magic-sessionmanager] User ${userId} logged out (session ${matchingSession.id})`);
+        await sessionService.terminateSession({ sessionId: matchingSession.documentId });
+        strapi.log.info(`[magic-sessionmanager] User ${userId} logged out (session ${matchingSession.documentId})`);
       }
 
       ctx.body = {
@@ -150,7 +187,8 @@ module.exports = {
    */
   async logoutAll(ctx) {
     try {
-      const userId = ctx.state.user?.id;
+      // Strapi v5: Use documentId instead of numeric id
+      const userId = ctx.state.user?.documentId;
 
       if (!userId) {
         return ctx.throw(401, 'Unauthorized');
@@ -337,13 +375,28 @@ module.exports = {
   /**
    * Toggle user blocked status
    * POST /magic-sessionmanager/user/:userId/toggle-block
+   * Supports both numeric id (from Content Manager) and documentId
    */
   async toggleUserBlock(ctx) {
     try {
       const { userId } = ctx.params;
       
-      // Get current user status
-      const user = await strapi.entityService.findOne('plugin::users-permissions.user', userId);
+      // Strapi v5: userId from params could be numeric id or documentId
+      // If numeric, look up the documentId first using entityService (fallback)
+      let userDocumentId = userId;
+      let user = null;
+      
+      // Try to find by documentId first (preferred)
+      user = await strapi.documents(USER_UID).findOne({ documentId: userId });
+      
+      // If not found, try numeric id lookup via entityService (fallback for Content Manager)
+      if (!user && !isNaN(userId)) {
+        const numericUser = await strapi.entityService.findOne(USER_UID, parseInt(userId, 10));
+        if (numericUser) {
+          userDocumentId = numericUser.documentId;
+          user = numericUser;
+        }
+      }
       
       if (!user) {
         return ctx.throw(404, 'User not found');
@@ -352,7 +405,8 @@ module.exports = {
       // Toggle blocked status
       const newBlockedStatus = !user.blocked;
       
-      await strapi.entityService.update('plugin::users-permissions.user', userId, {
+      await strapi.documents(USER_UID).update({
+        documentId: userDocumentId,
         data: {
           blocked: newBlockedStatus,
         },
@@ -363,7 +417,7 @@ module.exports = {
         const sessionService = strapi
           .plugin('magic-sessionmanager')
           .service('session');
-        await sessionService.terminateSession({ userId });
+        await sessionService.terminateSession({ userId: userDocumentId });
       }
 
       ctx.body = {

package/server/src/destroy.js

@@ -13,6 +13,6 @@ module.exports = async ({ strapi }) => {
     strapi.log.info('[magic-sessionmanager] 🛑 Session cleanup interval stopped');
   }
 
-  strapi.log.info('[magic-sessionmanager] ✅ Plugin cleanup completed');
+  strapi.log.info('[magic-sessionmanager] [SUCCESS] Plugin cleanup completed');
 };
 

package/server/src/middlewares/last-seen.js

@@ -4,18 +4,24 @@
  * lastSeen Middleware
  * Updates user lastSeen and session lastActive on each authenticated request
  * Rate-limited to prevent DB write noise (default: 30 seconds)
+ * 
+ * [SUCCESS] Migrated to strapi.documents() API (Strapi v5 Best Practice)
  */
+
+const SESSION_UID = 'plugin::magic-sessionmanager.session';
+
 module.exports = ({ strapi, sessionService }) => {
   return async (ctx, next) => {
     // BEFORE processing request: Check if user's sessions are active
-    if (ctx.state.user && ctx.state.user.id) {
+    // Strapi v5: Use documentId instead of numeric id for Document Service API
+    if (ctx.state.user && ctx.state.user.documentId) {
       try {
-        const userId = ctx.state.user.id;
+        const userId = ctx.state.user.documentId;
         
         // Check if user has ANY active sessions
-        const activeSessions = await strapi.entityService.findMany('plugin::magic-sessionmanager.session', {
+        const activeSessions = await strapi.documents(SESSION_UID).findMany( {
           filters: {
-            user: { id: userId },
+            user: { documentId: userId },
             isActive: true,
           },
           limit: 1,
@@ -23,7 +29,7 @@ module.exports = ({ strapi, sessionService }) => {
 
         // If user has NO active sessions, reject the request
         if (!activeSessions || activeSessions.length === 0) {
-          strapi.log.info(`[magic-sessionmanager] 🚫 Blocked request - User ${userId} has no active sessions`);
+          strapi.log.info(`[magic-sessionmanager] [BLOCKED] Blocked request - User ${userId} has no active sessions`);
           return ctx.unauthorized('All sessions have been terminated. Please login again.');
         }
       } catch (err) {
@@ -36,9 +42,9 @@ module.exports = ({ strapi, sessionService }) => {
     await next();
 
     // AFTER response: Update activity timestamps if user is authenticated
-    if (ctx.state.user && ctx.state.user.id) {
+    if (ctx.state.user && ctx.state.user.documentId) {
       try {
-        const userId = ctx.state.user.id;
+        const userId = ctx.state.user.documentId;
 
         // Try to find or extract sessionId from context
         const sessionId = ctx.state.sessionId;

package/server/src/register.js

@@ -6,7 +6,7 @@
  * Sessions are accessed via the Session Manager plugin UI components
  */
 module.exports = async ({ strapi }) => {
-  strapi.log.info('[magic-sessionmanager] 🚀 Plugin registration starting...');
+  strapi.log.info('[magic-sessionmanager] [START] Plugin registration starting...');
 
   try {
     // Get the user content type
@@ -21,12 +21,12 @@ module.exports = async ({ strapi }) => {
     // Sessions are managed through SessionInfoPanel sidebar instead
     if (userCT.attributes && userCT.attributes.sessions) {
       delete userCT.attributes.sessions;
-      strapi.log.info('[magic-sessionmanager] ✅ Removed sessions field from User content type');
+      strapi.log.info('[magic-sessionmanager] [SUCCESS] Removed sessions field from User content type');
     }
 
-    strapi.log.info('[magic-sessionmanager] ✅ Plugin registered successfully');
+    strapi.log.info('[magic-sessionmanager] [SUCCESS] Plugin registered successfully');
     
   } catch (err) {
-    strapi.log.error('[magic-sessionmanager] ❌ Registration error:', err);
+    strapi.log.error('[magic-sessionmanager] [ERROR] Registration error:', err);
   }
 };

package/server/src/routes/content-api.js

@@ -38,14 +38,23 @@ module.exports = {
     // SESSION QUERIES
     // ============================================================
     
+    {
+      method: 'GET',
+      path: '/my-sessions',
+      handler: 'session.getOwnSessions',
+      config: {
+        auth: { strategies: ['users-permissions'] },
+        description: 'Get own sessions (automatically uses authenticated user)',
+      },
+    },
     {
       method: 'GET',
       path: '/user/:userId/sessions',
       handler: 'session.getUserSessions',
       config: {
         auth: { strategies: ['users-permissions'] },
-        description: 'Get own sessions (controller validates user can only see own sessions)',
+        description: 'Get sessions by userId (validates user can only see own sessions)',
+      },
     },
-  },
   ],
 };

package/server/src/services/geolocation.js

@@ -132,9 +132,11 @@ module.exports = ({ strapi }) => ({
 
   /**
    * Get country flag emoji
+   * @param {string} countryCode - ISO 2-letter country code
+   * @returns {string} Flag emoji or empty string
    */
   getCountryFlag(countryCode) {
-    if (!countryCode) return '🏳️';
+    if (!countryCode) return '';
     
     // Convert country code to flag emoji
     const codePoints = countryCode
@@ -153,7 +155,7 @@ module.exports = ({ strapi }) => ({
       ip: ipAddress,
       country: 'Unknown',
       country_code: 'XX',
-      country_flag: '🌍',
+      country_flag: '[GEO]',
       city: 'Unknown',
       region: 'Unknown',
       timezone: 'Unknown',