strapi-plugin-magic-sessionmanager 4.2.12 → 4.2.14

package/dist/server/index.js

@@ -219,6 +219,18 @@ var encryption = {
 const SESSION_UID$3 = "plugin::magic-sessionmanager.session";
 const { hashToken: hashToken$3 } = encryption;
 const lastTouchCache = /* @__PURE__ */ new Map();
+const CACHE_MAX_SIZE = 1e4;
+const CACHE_CLEANUP_AGE = 60 * 60 * 1e3;
+function cleanupOldCacheEntries() {
+  if (lastTouchCache.size < CACHE_MAX_SIZE) return;
+  const now = Date.now();
+  const cutoff = now - CACHE_CLEANUP_AGE;
+  for (const [key, timestamp] of lastTouchCache.entries()) {
+    if (timestamp < cutoff) {
+      lastTouchCache.delete(key);
+    }
+  }
+}
 var lastSeen = ({ strapi: strapi2 }) => {
   return async (ctx, next) => {
     const currentToken = ctx.request.headers.authorization?.replace("Bearer ", "");
@@ -226,11 +238,50 @@ var lastSeen = ({ strapi: strapi2 }) => {
       await next();
       return;
     }
-    const skipPaths = ["/admin", "/_health", "/favicon.ico"];
+    const skipPaths = [
+      "/admin",
+      // Admin panel UI
+      "/content-manager",
+      // Content Manager
+      "/content-type-builder",
+      // Content-Type Builder
+      "/upload",
+      // Media Library
+      "/i18n",
+      // Internationalization
+      "/users-permissions",
+      // Users & Permissions settings
+      "/email",
+      // Email plugin
+      "/_health",
+      // Health check
+      "/favicon.ico",
+      // Static assets
+      "/api/auth/local",
+      // Login endpoint
+      "/api/auth/register",
+      // Registration endpoint
+      "/api/auth/forgot-password",
+      // Password reset
+      "/api/auth/reset-password",
+      // Password reset
+      "/api/auth/logout",
+      // Logout endpoint (handled separately)
+      "/api/auth/refresh",
+      // Refresh token (has own validation in bootstrap.js)
+      "/api/connect",
+      // OAuth providers
+      "/api/magic-link"
+      // Magic link auth (if using magic-link plugin)
+    ];
     if (skipPaths.some((p) => ctx.path.startsWith(p))) {
       await next();
       return;
     }
+    if (!ctx.path.startsWith("/api/")) {
+      await next();
+      return;
+    }
     let matchingSession = null;
     try {
       const currentTokenHash = hashToken$3(currentToken);
@@ -248,10 +299,8 @@ var lastSeen = ({ strapi: strapi2 }) => {
           ctx.state.sessionUserId = matchingSession.user.documentId;
         }
       } else {
-        if (ctx.state.user && ctx.state.user.documentId) {
-          strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Session terminated for user ${ctx.state.user.documentId}`);
-          return ctx.unauthorized("This session has been terminated. Please login again.");
-        }
+        strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Request blocked - session terminated or invalid (token hash: ${currentTokenHash.substring(0, 8)}...)`);
+        return ctx.unauthorized("This session has been terminated. Please login again.");
       }
     } catch (err) {
       strapi2.log.debug("[magic-sessionmanager] Error checking session:", err.message);
@@ -265,6 +314,7 @@ var lastSeen = ({ strapi: strapi2 }) => {
         const lastTouch = lastTouchCache.get(matchingSession.documentId) || 0;
         if (now - lastTouch > rateLimit) {
           lastTouchCache.set(matchingSession.documentId, now);
+          cleanupOldCacheEntries();
           await strapi2.documents(SESSION_UID$3).update({
             documentId: matchingSession.documentId,
             data: { lastActive: /* @__PURE__ */ new Date() }
@@ -351,20 +401,13 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
             ctx.body = { message: "Logged out successfully" };
             return;
           }
-          const allSessions = await strapi2.documents(SESSION_UID$2).findMany({
+          const tokenHashValue = hashToken$2(token);
+          const matchingSession = await strapi2.documents(SESSION_UID$2).findFirst({
             filters: {
+              tokenHash: tokenHashValue,
               isActive: true
             }
           });
-          const matchingSession = allSessions.find((session2) => {
-            if (!session2.token) return false;
-            try {
-              const decrypted = decryptToken$2(session2.token);
-              return decrypted === token;
-            } catch (err) {
-              return false;
-            }
-          });
           if (matchingSession) {
             await sessionService.terminateSession({ sessionId: matchingSession.documentId });
             log.info(`[LOGOUT] Logout via /api/auth/logout - Session ${matchingSession.documentId} terminated`);
@@ -509,20 +552,13 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
         try {
           const refreshToken = ctx.request.body?.refreshToken;
           if (refreshToken) {
-            const allSessions = await strapi2.documents(SESSION_UID$2).findMany({
+            const refreshTokenHashValue = hashToken$2(refreshToken);
+            const matchingSession = await strapi2.documents(SESSION_UID$2).findFirst({
               filters: {
+                refreshTokenHash: refreshTokenHashValue,
                 isActive: true
               }
             });
-            const matchingSession = allSessions.find((session2) => {
-              if (!session2.refreshToken) return false;
-              try {
-                const decrypted = decryptToken$2(session2.refreshToken);
-                return decrypted === refreshToken;
-              } catch (err) {
-                return false;
-              }
-            });
             if (!matchingSession) {
               log.warn("[BLOCKED] Blocked refresh token request - no active session");
               ctx.status = 401;
@@ -548,20 +584,13 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
           const newAccessToken = ctx.body.jwt;
           const newRefreshToken = ctx.body.refreshToken;
           if (oldRefreshToken) {
-            const allSessions = await strapi2.documents(SESSION_UID$2).findMany({
+            const oldRefreshTokenHash = hashToken$2(oldRefreshToken);
+            const matchingSession = await strapi2.documents(SESSION_UID$2).findFirst({
               filters: {
+                refreshTokenHash: oldRefreshTokenHash,
                 isActive: true
               }
             });
-            const matchingSession = allSessions.find((session2) => {
-              if (!session2.refreshToken) return false;
-              try {
-                const decrypted = decryptToken$2(session2.refreshToken);
-                return decrypted === oldRefreshToken;
-              } catch (err) {
-                return false;
-              }
-            });
             if (matchingSession) {
               const encryptedToken = newAccessToken ? encryptToken$1(newAccessToken) : matchingSession.token;
               const encryptedRefreshToken = newRefreshToken ? encryptToken$1(newRefreshToken) : matchingSession.refreshToken;
@@ -690,11 +719,11 @@ var destroy$1 = async ({ strapi: strapi2 }) => {
   const log = createLogger$2(strapi2);
   if (strapi2.licenseGuard && strapi2.licenseGuard.pingInterval) {
     clearInterval(strapi2.licenseGuard.pingInterval);
-    log.info("🛑 License pinging stopped");
+    log.info("[STOP] License pinging stopped");
   }
   if (strapi2.sessionManagerIntervals && strapi2.sessionManagerIntervals.cleanup) {
     clearInterval(strapi2.sessionManagerIntervals.cleanup);
-    log.info("🛑 Session cleanup interval stopped");
+    log.info("[STOP] Session cleanup interval stopped");
   }
   log.info("[SUCCESS] Plugin cleanup completed");
 };
@@ -1175,6 +1204,7 @@ var session$3 = {
    * GET /api/magic-sessionmanager/my-sessions
    * Automatically uses the authenticated user's documentId
    * Marks which session is the current one (based on JWT token hash)
+   * Fetches geolocation data on-demand if not already stored
    */
   async getOwnSessions(ctx) {
     try {
@@ -1191,7 +1221,8 @@ var session$3 = {
       const config2 = strapi.config.get("plugin::magic-sessionmanager") || {};
       const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
       const now = /* @__PURE__ */ new Date();
-      const sessionsWithCurrent = allSessions.map((session2) => {
+      const geolocationService = strapi.plugin("magic-sessionmanager").service("geolocation");
+      const sessionsWithCurrent = await Promise.all(allSessions.map(async (session2) => {
         const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
         const timeSinceActive = now - lastActiveTime;
         const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
@@ -1208,6 +1239,31 @@ var session$3 = {
             geoLocation = null;
           }
         }
+        if (!geoLocation && session2.ipAddress) {
+          try {
+            const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+            if (geoData && geoData.country !== "Unknown") {
+              geoLocation = {
+                country: geoData.country,
+                country_code: geoData.country_code,
+                country_flag: geoData.country_flag,
+                city: geoData.city,
+                region: geoData.region,
+                timezone: geoData.timezone
+              };
+              strapi.documents(SESSION_UID$1).update({
+                documentId: session2.documentId,
+                data: {
+                  geoLocation: JSON.stringify(geoLocation),
+                  securityScore: geoData.securityScore || null
+                }
+              }).catch(() => {
+              });
+            }
+          } catch (geoErr) {
+            strapi.log.debug("[magic-sessionmanager] Geolocation lookup failed:", geoErr.message);
+          }
+        }
         const {
           token,
           tokenHash,
@@ -1231,7 +1287,7 @@ var session$3 = {
           isTrulyActive,
           minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
         };
-      });
+      }));
       sessionsWithCurrent.sort((a, b) => {
         if (a.isCurrentSession) return -1;
         if (b.isCurrentSession) return 1;
@@ -1333,6 +1389,7 @@ var session$3 = {
    * Get current session info based on JWT token hash
    * GET /api/magic-sessionmanager/current-session
    * Returns the session associated with the current JWT token
+   * Fetches geolocation on-demand if not already stored
    */
   async getCurrentSession(ctx) {
     try {
@@ -1369,6 +1426,32 @@ var session$3 = {
           geoLocation = null;
         }
       }
+      if (!geoLocation && currentSession.ipAddress) {
+        try {
+          const geolocationService = strapi.plugin("magic-sessionmanager").service("geolocation");
+          const geoData = await geolocationService.getIpInfo(currentSession.ipAddress);
+          if (geoData && geoData.country !== "Unknown") {
+            geoLocation = {
+              country: geoData.country,
+              country_code: geoData.country_code,
+              country_flag: geoData.country_flag,
+              city: geoData.city,
+              region: geoData.region,
+              timezone: geoData.timezone
+            };
+            strapi.documents(SESSION_UID$1).update({
+              documentId: currentSession.documentId,
+              data: {
+                geoLocation: JSON.stringify(geoLocation),
+                securityScore: geoData.securityScore || null
+              }
+            }).catch(() => {
+            });
+          }
+        } catch (geoErr) {
+          strapi.log.debug("[magic-sessionmanager] Geolocation lookup failed:", geoErr.message);
+        }
+      }
       const {
         token: _,
         tokenHash: _th,
@@ -2035,6 +2118,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     },
     /**
      * Get ALL sessions (active + inactive) with accurate online status
+     * Fetches geolocation on-demand for sessions without it (limited to prevent API abuse)
      * @returns {Promise<Array>} All sessions with enhanced data
      */
     async getAllSessions() {
@@ -2047,8 +2131,10 @@ var session$1 = ({ strapi: strapi2 }) => {
         });
         const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
         const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
+        const geolocationService = strapi2.plugin("magic-sessionmanager").service("geolocation");
+        let geoLookupsRemaining = 20;
         const now = /* @__PURE__ */ new Date();
-        const enhancedSessions = sessions.map((session2) => {
+        const enhancedSessions = await Promise.all(sessions.map(async (session2) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
@@ -2064,6 +2150,32 @@ var session$1 = ({ strapi: strapi2 }) => {
               geoLocation = null;
             }
           }
+          if (!geoLocation && session2.ipAddress && geoLookupsRemaining > 0) {
+            geoLookupsRemaining--;
+            try {
+              const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+              if (geoData && geoData.country !== "Unknown") {
+                geoLocation = {
+                  country: geoData.country,
+                  country_code: geoData.country_code,
+                  country_flag: geoData.country_flag,
+                  city: geoData.city,
+                  region: geoData.region,
+                  timezone: geoData.timezone
+                };
+                strapi2.documents(SESSION_UID).update({
+                  documentId: session2.documentId,
+                  data: {
+                    geoLocation: JSON.stringify(geoLocation),
+                    securityScore: geoData.securityScore || null
+                  }
+                }).catch(() => {
+                });
+              }
+            } catch (geoErr) {
+              log.debug("Geolocation lookup failed:", geoErr.message);
+            }
+          }
           const {
             token,
             tokenHash,
@@ -2085,7 +2197,7 @@ var session$1 = ({ strapi: strapi2 }) => {
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
-        });
+        }));
         return enhancedSessions;
       } catch (err) {
         log.error("Error getting all sessions:", err);
@@ -2094,6 +2206,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     },
     /**
      * Get all active sessions with accurate online status
+     * Fetches geolocation on-demand for sessions without it
      * @returns {Promise<Array>} Active sessions with user data and online status
      */
     async getActiveSessions() {
@@ -2105,8 +2218,9 @@ var session$1 = ({ strapi: strapi2 }) => {
         });
         const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
         const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
+        const geolocationService = strapi2.plugin("magic-sessionmanager").service("geolocation");
         const now = /* @__PURE__ */ new Date();
-        const enhancedSessions = sessions.map((session2) => {
+        const enhancedSessions = await Promise.all(sessions.map(async (session2) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = timeSinceActive < inactivityTimeout;
@@ -2122,6 +2236,31 @@ var session$1 = ({ strapi: strapi2 }) => {
               geoLocation = null;
             }
           }
+          if (!geoLocation && session2.ipAddress) {
+            try {
+              const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+              if (geoData && geoData.country !== "Unknown") {
+                geoLocation = {
+                  country: geoData.country,
+                  country_code: geoData.country_code,
+                  country_flag: geoData.country_flag,
+                  city: geoData.city,
+                  region: geoData.region,
+                  timezone: geoData.timezone
+                };
+                strapi2.documents(SESSION_UID).update({
+                  documentId: session2.documentId,
+                  data: {
+                    geoLocation: JSON.stringify(geoLocation),
+                    securityScore: geoData.securityScore || null
+                  }
+                }).catch(() => {
+                });
+              }
+            } catch (geoErr) {
+              log.debug("Geolocation lookup failed:", geoErr.message);
+            }
+          }
           const {
             token,
             tokenHash,
@@ -2141,7 +2280,7 @@ var session$1 = ({ strapi: strapi2 }) => {
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
-        });
+        }));
         return enhancedSessions.filter((s) => s.isTrulyActive);
       } catch (err) {
         log.error("Error getting active sessions:", err);
@@ -2151,6 +2290,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     /**
      * Get all sessions for a specific user
      * Supports both numeric id (legacy) and documentId (Strapi v5)
+     * Fetches geolocation on-demand for sessions without it
      * @param {string|number} userId - User documentId or numeric id
      * @returns {Promise<Array>} User's sessions with accurate online status
      */
@@ -2169,8 +2309,9 @@ var session$1 = ({ strapi: strapi2 }) => {
         });
         const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
         const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
+        const geolocationService = strapi2.plugin("magic-sessionmanager").service("geolocation");
         const now = /* @__PURE__ */ new Date();
-        const enhancedSessions = sessions.map((session2) => {
+        const enhancedSessions = await Promise.all(sessions.map(async (session2) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
@@ -2186,6 +2327,31 @@ var session$1 = ({ strapi: strapi2 }) => {
               geoLocation = null;
             }
           }
+          if (!geoLocation && session2.ipAddress) {
+            try {
+              const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+              if (geoData && geoData.country !== "Unknown") {
+                geoLocation = {
+                  country: geoData.country,
+                  country_code: geoData.country_code,
+                  country_flag: geoData.country_flag,
+                  city: geoData.city,
+                  region: geoData.region,
+                  timezone: geoData.timezone
+                };
+                strapi2.documents(SESSION_UID).update({
+                  documentId: session2.documentId,
+                  data: {
+                    geoLocation: JSON.stringify(geoLocation),
+                    securityScore: geoData.securityScore || null
+                  }
+                }).catch(() => {
+                });
+              }
+            } catch (geoErr) {
+              log.debug("Geolocation lookup failed:", geoErr.message);
+            }
+          }
           const {
             token,
             tokenHash,
@@ -2205,7 +2371,7 @@ var session$1 = ({ strapi: strapi2 }) => {
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
-        });
+        }));
         return enhancedSessions;
       } catch (err) {
         log.error("Error getting user sessions:", err);
@@ -2318,7 +2484,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
-const version = "4.2.11";
+const version = "4.2.13";
 const require$$2 = {
   version
 };

package/dist/server/index.mjs

@@ -215,6 +215,18 @@ var encryption = {
 const SESSION_UID$3 = "plugin::magic-sessionmanager.session";
 const { hashToken: hashToken$3 } = encryption;
 const lastTouchCache = /* @__PURE__ */ new Map();
+const CACHE_MAX_SIZE = 1e4;
+const CACHE_CLEANUP_AGE = 60 * 60 * 1e3;
+function cleanupOldCacheEntries() {
+  if (lastTouchCache.size < CACHE_MAX_SIZE) return;
+  const now = Date.now();
+  const cutoff = now - CACHE_CLEANUP_AGE;
+  for (const [key, timestamp] of lastTouchCache.entries()) {
+    if (timestamp < cutoff) {
+      lastTouchCache.delete(key);
+    }
+  }
+}
 var lastSeen = ({ strapi: strapi2 }) => {
   return async (ctx, next) => {
     const currentToken = ctx.request.headers.authorization?.replace("Bearer ", "");
@@ -222,11 +234,50 @@ var lastSeen = ({ strapi: strapi2 }) => {
       await next();
       return;
     }
-    const skipPaths = ["/admin", "/_health", "/favicon.ico"];
+    const skipPaths = [
+      "/admin",
+      // Admin panel UI
+      "/content-manager",
+      // Content Manager
+      "/content-type-builder",
+      // Content-Type Builder
+      "/upload",
+      // Media Library
+      "/i18n",
+      // Internationalization
+      "/users-permissions",
+      // Users & Permissions settings
+      "/email",
+      // Email plugin
+      "/_health",
+      // Health check
+      "/favicon.ico",
+      // Static assets
+      "/api/auth/local",
+      // Login endpoint
+      "/api/auth/register",
+      // Registration endpoint
+      "/api/auth/forgot-password",
+      // Password reset
+      "/api/auth/reset-password",
+      // Password reset
+      "/api/auth/logout",
+      // Logout endpoint (handled separately)
+      "/api/auth/refresh",
+      // Refresh token (has own validation in bootstrap.js)
+      "/api/connect",
+      // OAuth providers
+      "/api/magic-link"
+      // Magic link auth (if using magic-link plugin)
+    ];
     if (skipPaths.some((p) => ctx.path.startsWith(p))) {
       await next();
       return;
     }
+    if (!ctx.path.startsWith("/api/")) {
+      await next();
+      return;
+    }
     let matchingSession = null;
     try {
       const currentTokenHash = hashToken$3(currentToken);
@@ -244,10 +295,8 @@ var lastSeen = ({ strapi: strapi2 }) => {
           ctx.state.sessionUserId = matchingSession.user.documentId;
         }
       } else {
-        if (ctx.state.user && ctx.state.user.documentId) {
-          strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Session terminated for user ${ctx.state.user.documentId}`);
-          return ctx.unauthorized("This session has been terminated. Please login again.");
-        }
+        strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Request blocked - session terminated or invalid (token hash: ${currentTokenHash.substring(0, 8)}...)`);
+        return ctx.unauthorized("This session has been terminated. Please login again.");
       }
     } catch (err) {
       strapi2.log.debug("[magic-sessionmanager] Error checking session:", err.message);
@@ -261,6 +310,7 @@ var lastSeen = ({ strapi: strapi2 }) => {
         const lastTouch = lastTouchCache.get(matchingSession.documentId) || 0;
         if (now - lastTouch > rateLimit) {
           lastTouchCache.set(matchingSession.documentId, now);
+          cleanupOldCacheEntries();
           await strapi2.documents(SESSION_UID$3).update({
             documentId: matchingSession.documentId,
             data: { lastActive: /* @__PURE__ */ new Date() }
@@ -347,20 +397,13 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
             ctx.body = { message: "Logged out successfully" };
             return;
           }
-          const allSessions = await strapi2.documents(SESSION_UID$2).findMany({
+          const tokenHashValue = hashToken$2(token);
+          const matchingSession = await strapi2.documents(SESSION_UID$2).findFirst({
             filters: {
+              tokenHash: tokenHashValue,
               isActive: true
             }
           });
-          const matchingSession = allSessions.find((session2) => {
-            if (!session2.token) return false;
-            try {
-              const decrypted = decryptToken$2(session2.token);
-              return decrypted === token;
-            } catch (err) {
-              return false;
-            }
-          });
           if (matchingSession) {
             await sessionService.terminateSession({ sessionId: matchingSession.documentId });
             log.info(`[LOGOUT] Logout via /api/auth/logout - Session ${matchingSession.documentId} terminated`);
@@ -505,20 +548,13 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
         try {
           const refreshToken = ctx.request.body?.refreshToken;
           if (refreshToken) {
-            const allSessions = await strapi2.documents(SESSION_UID$2).findMany({
+            const refreshTokenHashValue = hashToken$2(refreshToken);
+            const matchingSession = await strapi2.documents(SESSION_UID$2).findFirst({
               filters: {
+                refreshTokenHash: refreshTokenHashValue,
                 isActive: true
               }
             });
-            const matchingSession = allSessions.find((session2) => {
-              if (!session2.refreshToken) return false;
-              try {
-                const decrypted = decryptToken$2(session2.refreshToken);
-                return decrypted === refreshToken;
-              } catch (err) {
-                return false;
-              }
-            });
             if (!matchingSession) {
               log.warn("[BLOCKED] Blocked refresh token request - no active session");
               ctx.status = 401;
@@ -544,20 +580,13 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
           const newAccessToken = ctx.body.jwt;
           const newRefreshToken = ctx.body.refreshToken;
           if (oldRefreshToken) {
-            const allSessions = await strapi2.documents(SESSION_UID$2).findMany({
+            const oldRefreshTokenHash = hashToken$2(oldRefreshToken);
+            const matchingSession = await strapi2.documents(SESSION_UID$2).findFirst({
               filters: {
+                refreshTokenHash: oldRefreshTokenHash,
                 isActive: true
               }
             });
-            const matchingSession = allSessions.find((session2) => {
-              if (!session2.refreshToken) return false;
-              try {
-                const decrypted = decryptToken$2(session2.refreshToken);
-                return decrypted === oldRefreshToken;
-              } catch (err) {
-                return false;
-              }
-            });
             if (matchingSession) {
               const encryptedToken = newAccessToken ? encryptToken$1(newAccessToken) : matchingSession.token;
               const encryptedRefreshToken = newRefreshToken ? encryptToken$1(newRefreshToken) : matchingSession.refreshToken;
@@ -686,11 +715,11 @@ var destroy$1 = async ({ strapi: strapi2 }) => {
   const log = createLogger$2(strapi2);
   if (strapi2.licenseGuard && strapi2.licenseGuard.pingInterval) {
     clearInterval(strapi2.licenseGuard.pingInterval);
-    log.info("🛑 License pinging stopped");
+    log.info("[STOP] License pinging stopped");
   }
   if (strapi2.sessionManagerIntervals && strapi2.sessionManagerIntervals.cleanup) {
     clearInterval(strapi2.sessionManagerIntervals.cleanup);
-    log.info("🛑 Session cleanup interval stopped");
+    log.info("[STOP] Session cleanup interval stopped");
   }
   log.info("[SUCCESS] Plugin cleanup completed");
 };
@@ -1171,6 +1200,7 @@ var session$3 = {
    * GET /api/magic-sessionmanager/my-sessions
    * Automatically uses the authenticated user's documentId
    * Marks which session is the current one (based on JWT token hash)
+   * Fetches geolocation data on-demand if not already stored
    */
   async getOwnSessions(ctx) {
     try {
@@ -1187,7 +1217,8 @@ var session$3 = {
       const config2 = strapi.config.get("plugin::magic-sessionmanager") || {};
       const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
       const now = /* @__PURE__ */ new Date();
-      const sessionsWithCurrent = allSessions.map((session2) => {
+      const geolocationService = strapi.plugin("magic-sessionmanager").service("geolocation");
+      const sessionsWithCurrent = await Promise.all(allSessions.map(async (session2) => {
         const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
         const timeSinceActive = now - lastActiveTime;
         const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
@@ -1204,6 +1235,31 @@ var session$3 = {
             geoLocation = null;
           }
         }
+        if (!geoLocation && session2.ipAddress) {
+          try {
+            const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+            if (geoData && geoData.country !== "Unknown") {
+              geoLocation = {
+                country: geoData.country,
+                country_code: geoData.country_code,
+                country_flag: geoData.country_flag,
+                city: geoData.city,
+                region: geoData.region,
+                timezone: geoData.timezone
+              };
+              strapi.documents(SESSION_UID$1).update({
+                documentId: session2.documentId,
+                data: {
+                  geoLocation: JSON.stringify(geoLocation),
+                  securityScore: geoData.securityScore || null
+                }
+              }).catch(() => {
+              });
+            }
+          } catch (geoErr) {
+            strapi.log.debug("[magic-sessionmanager] Geolocation lookup failed:", geoErr.message);
+          }
+        }
         const {
           token,
           tokenHash,
@@ -1227,7 +1283,7 @@ var session$3 = {
           isTrulyActive,
           minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
         };
-      });
+      }));
       sessionsWithCurrent.sort((a, b) => {
         if (a.isCurrentSession) return -1;
         if (b.isCurrentSession) return 1;
@@ -1329,6 +1385,7 @@ var session$3 = {
    * Get current session info based on JWT token hash
    * GET /api/magic-sessionmanager/current-session
    * Returns the session associated with the current JWT token
+   * Fetches geolocation on-demand if not already stored
    */
   async getCurrentSession(ctx) {
     try {
@@ -1365,6 +1422,32 @@ var session$3 = {
           geoLocation = null;
         }
       }
+      if (!geoLocation && currentSession.ipAddress) {
+        try {
+          const geolocationService = strapi.plugin("magic-sessionmanager").service("geolocation");
+          const geoData = await geolocationService.getIpInfo(currentSession.ipAddress);
+          if (geoData && geoData.country !== "Unknown") {
+            geoLocation = {
+              country: geoData.country,
+              country_code: geoData.country_code,
+              country_flag: geoData.country_flag,
+              city: geoData.city,
+              region: geoData.region,
+              timezone: geoData.timezone
+            };
+            strapi.documents(SESSION_UID$1).update({
+              documentId: currentSession.documentId,
+              data: {
+                geoLocation: JSON.stringify(geoLocation),
+                securityScore: geoData.securityScore || null
+              }
+            }).catch(() => {
+            });
+          }
+        } catch (geoErr) {
+          strapi.log.debug("[magic-sessionmanager] Geolocation lookup failed:", geoErr.message);
+        }
+      }
       const {
         token: _,
         tokenHash: _th,
@@ -2031,6 +2114,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     },
     /**
      * Get ALL sessions (active + inactive) with accurate online status
+     * Fetches geolocation on-demand for sessions without it (limited to prevent API abuse)
      * @returns {Promise<Array>} All sessions with enhanced data
      */
     async getAllSessions() {
@@ -2043,8 +2127,10 @@ var session$1 = ({ strapi: strapi2 }) => {
         });
         const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
         const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
+        const geolocationService = strapi2.plugin("magic-sessionmanager").service("geolocation");
+        let geoLookupsRemaining = 20;
         const now = /* @__PURE__ */ new Date();
-        const enhancedSessions = sessions.map((session2) => {
+        const enhancedSessions = await Promise.all(sessions.map(async (session2) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
@@ -2060,6 +2146,32 @@ var session$1 = ({ strapi: strapi2 }) => {
               geoLocation = null;
             }
           }
+          if (!geoLocation && session2.ipAddress && geoLookupsRemaining > 0) {
+            geoLookupsRemaining--;
+            try {
+              const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+              if (geoData && geoData.country !== "Unknown") {
+                geoLocation = {
+                  country: geoData.country,
+                  country_code: geoData.country_code,
+                  country_flag: geoData.country_flag,
+                  city: geoData.city,
+                  region: geoData.region,
+                  timezone: geoData.timezone
+                };
+                strapi2.documents(SESSION_UID).update({
+                  documentId: session2.documentId,
+                  data: {
+                    geoLocation: JSON.stringify(geoLocation),
+                    securityScore: geoData.securityScore || null
+                  }
+                }).catch(() => {
+                });
+              }
+            } catch (geoErr) {
+              log.debug("Geolocation lookup failed:", geoErr.message);
+            }
+          }
           const {
             token,
             tokenHash,
@@ -2081,7 +2193,7 @@ var session$1 = ({ strapi: strapi2 }) => {
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
-        });
+        }));
         return enhancedSessions;
       } catch (err) {
         log.error("Error getting all sessions:", err);
@@ -2090,6 +2202,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     },
     /**
      * Get all active sessions with accurate online status
+     * Fetches geolocation on-demand for sessions without it
      * @returns {Promise<Array>} Active sessions with user data and online status
      */
     async getActiveSessions() {
@@ -2101,8 +2214,9 @@ var session$1 = ({ strapi: strapi2 }) => {
         });
         const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
         const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
+        const geolocationService = strapi2.plugin("magic-sessionmanager").service("geolocation");
         const now = /* @__PURE__ */ new Date();
-        const enhancedSessions = sessions.map((session2) => {
+        const enhancedSessions = await Promise.all(sessions.map(async (session2) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = timeSinceActive < inactivityTimeout;
@@ -2118,6 +2232,31 @@ var session$1 = ({ strapi: strapi2 }) => {
               geoLocation = null;
             }
           }
+          if (!geoLocation && session2.ipAddress) {
+            try {
+              const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+              if (geoData && geoData.country !== "Unknown") {
+                geoLocation = {
+                  country: geoData.country,
+                  country_code: geoData.country_code,
+                  country_flag: geoData.country_flag,
+                  city: geoData.city,
+                  region: geoData.region,
+                  timezone: geoData.timezone
+                };
+                strapi2.documents(SESSION_UID).update({
+                  documentId: session2.documentId,
+                  data: {
+                    geoLocation: JSON.stringify(geoLocation),
+                    securityScore: geoData.securityScore || null
+                  }
+                }).catch(() => {
+                });
+              }
+            } catch (geoErr) {
+              log.debug("Geolocation lookup failed:", geoErr.message);
+            }
+          }
           const {
             token,
             tokenHash,
@@ -2137,7 +2276,7 @@ var session$1 = ({ strapi: strapi2 }) => {
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
-        });
+        }));
         return enhancedSessions.filter((s) => s.isTrulyActive);
       } catch (err) {
         log.error("Error getting active sessions:", err);
@@ -2147,6 +2286,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     /**
      * Get all sessions for a specific user
      * Supports both numeric id (legacy) and documentId (Strapi v5)
+     * Fetches geolocation on-demand for sessions without it
      * @param {string|number} userId - User documentId or numeric id
      * @returns {Promise<Array>} User's sessions with accurate online status
      */
@@ -2165,8 +2305,9 @@ var session$1 = ({ strapi: strapi2 }) => {
         });
         const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
         const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
+        const geolocationService = strapi2.plugin("magic-sessionmanager").service("geolocation");
         const now = /* @__PURE__ */ new Date();
-        const enhancedSessions = sessions.map((session2) => {
+        const enhancedSessions = await Promise.all(sessions.map(async (session2) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
@@ -2182,6 +2323,31 @@ var session$1 = ({ strapi: strapi2 }) => {
               geoLocation = null;
             }
           }
+          if (!geoLocation && session2.ipAddress) {
+            try {
+              const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+              if (geoData && geoData.country !== "Unknown") {
+                geoLocation = {
+                  country: geoData.country,
+                  country_code: geoData.country_code,
+                  country_flag: geoData.country_flag,
+                  city: geoData.city,
+                  region: geoData.region,
+                  timezone: geoData.timezone
+                };
+                strapi2.documents(SESSION_UID).update({
+                  documentId: session2.documentId,
+                  data: {
+                    geoLocation: JSON.stringify(geoLocation),
+                    securityScore: geoData.securityScore || null
+                  }
+                }).catch(() => {
+                });
+              }
+            } catch (geoErr) {
+              log.debug("Geolocation lookup failed:", geoErr.message);
+            }
+          }
           const {
             token,
             tokenHash,
@@ -2201,7 +2367,7 @@ var session$1 = ({ strapi: strapi2 }) => {
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
-        });
+        }));
         return enhancedSessions;
       } catch (err) {
         log.error("Error getting user sessions:", err);
@@ -2314,7 +2480,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
-const version = "4.2.11";
+const version = "4.2.13";
 const require$$2 = {
   version
 };

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "4.2.12",
+  "version": "4.2.14",
   "keywords": [
     "strapi",
     "strapi-plugin",