strapi-plugin-magic-sessionmanager 4.2.7 → 4.2.9

package/dist/server/index.js

@@ -179,7 +179,7 @@ function encryptToken$2(token) {
     throw new Error("Failed to encrypt token");
   }
 }
-function decryptToken$4(encryptedToken) {
+function decryptToken$3(encryptedToken) {
   if (!encryptedToken) return null;
   try {
     const key = getEncryptionKey();
@@ -206,62 +206,71 @@ function generateSessionId$1(userId) {
   const userHash = crypto$1.createHash("sha256").update(userId.toString()).digest("hex").substring(0, 8);
   return `sess_${timestamp}_${userHash}_${randomBytes}`;
 }
+function hashToken$3(token) {
+  if (!token) return null;
+  return crypto$1.createHash("sha256").update(token).digest("hex");
+}
 var encryption = {
   encryptToken: encryptToken$2,
-  decryptToken: decryptToken$4,
-  generateSessionId: generateSessionId$1
+  decryptToken: decryptToken$3,
+  generateSessionId: generateSessionId$1,
+  hashToken: hashToken$3
 };
 const SESSION_UID$3 = "plugin::magic-sessionmanager.session";
-const { decryptToken: decryptToken$3 } = encryption;
-var lastSeen = ({ strapi: strapi2, sessionService }) => {
+const { hashToken: hashToken$2 } = encryption;
+const lastTouchCache = /* @__PURE__ */ new Map();
+var lastSeen = ({ strapi: strapi2 }) => {
   return async (ctx, next) => {
-    if (ctx.state.user && ctx.state.user.documentId) {
-      try {
-        const userId = ctx.state.user.documentId;
-        const currentToken = ctx.request.headers.authorization?.replace("Bearer ", "");
-        if (!currentToken) {
-          await next();
-          return;
-        }
-        const activeSessions = await strapi2.documents(SESSION_UID$3).findMany({
-          filters: {
-            user: { documentId: userId },
-            isActive: true
-          }
-        });
-        if (!activeSessions || activeSessions.length === 0) {
-          strapi2.log.info(`[magic-sessionmanager] [BLOCKED] User ${userId} has no active sessions`);
-          return ctx.unauthorized("All sessions have been terminated. Please login again.");
-        }
-        let matchingSession = null;
-        for (const session2 of activeSessions) {
-          if (!session2.token) continue;
-          try {
-            const decrypted = decryptToken$3(session2.token);
-            if (decrypted === currentToken) {
-              matchingSession = session2;
-              break;
-            }
-          } catch (err) {
-          }
+    const currentToken = ctx.request.headers.authorization?.replace("Bearer ", "");
+    if (!currentToken) {
+      await next();
+      return;
+    }
+    const skipPaths = ["/admin", "/_health", "/favicon.ico"];
+    if (skipPaths.some((p) => ctx.path.startsWith(p))) {
+      await next();
+      return;
+    }
+    let matchingSession = null;
+    try {
+      const currentTokenHash = hashToken$2(currentToken);
+      matchingSession = await strapi2.documents(SESSION_UID$3).findFirst({
+        filters: {
+          tokenHash: currentTokenHash,
+          isActive: true
+        },
+        populate: { user: { fields: ["documentId"] } }
+      });
+      if (matchingSession) {
+        ctx.state.sessionId = matchingSession.documentId;
+        ctx.state.currentSession = matchingSession;
+        if (matchingSession.user?.documentId) {
+          ctx.state.sessionUserId = matchingSession.user.documentId;
         }
-        if (!matchingSession) {
-          strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Session for user ${userId} has been terminated`);
+      } else {
+        if (ctx.state.user && ctx.state.user.documentId) {
+          strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Session terminated for user ${ctx.state.user.documentId}`);
           return ctx.unauthorized("This session has been terminated. Please login again.");
         }
-        ctx.state.sessionId = matchingSession.documentId;
-        ctx.state.currentSession = matchingSession;
-      } catch (err) {
-        strapi2.log.debug("[magic-sessionmanager] Error checking session:", err.message);
       }
+    } catch (err) {
+      strapi2.log.debug("[magic-sessionmanager] Error checking session:", err.message);
     }
     await next();
-    if (ctx.state.user && ctx.state.user.documentId && ctx.state.sessionId) {
+    if (matchingSession) {
       try {
-        await sessionService.touch({
-          userId: ctx.state.user.documentId,
-          sessionId: ctx.state.sessionId
-        });
+        const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
+        const rateLimit = config2.lastSeenRateLimit || 3e4;
+        const now = Date.now();
+        const lastTouch = lastTouchCache.get(matchingSession.documentId) || 0;
+        if (now - lastTouch > rateLimit) {
+          lastTouchCache.set(matchingSession.documentId, now);
+          await strapi2.documents(SESSION_UID$3).update({
+            documentId: matchingSession.documentId,
+            data: { lastActive: /* @__PURE__ */ new Date() }
+          });
+          strapi2.log.debug(`[magic-sessionmanager] [TOUCH] Session ${matchingSession.documentId} activity updated`);
+        }
       } catch (err) {
         strapi2.log.debug("[magic-sessionmanager] Error updating lastSeen:", err.message);
       }
@@ -269,7 +278,7 @@ var lastSeen = ({ strapi: strapi2, sessionService }) => {
   };
 };
 const getClientIp = getClientIp_1;
-const { encryptToken: encryptToken$1, decryptToken: decryptToken$2 } = encryption;
+const { encryptToken: encryptToken$1, decryptToken: decryptToken$2, hashToken: hashToken$1 } = encryption;
 const { createLogger: createLogger$3 } = logger;
 const SESSION_UID$2 = "plugin::magic-sessionmanager.session";
 const USER_UID$2 = "plugin::users-permissions.user";
@@ -553,11 +562,15 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
             if (matchingSession) {
               const encryptedToken = newAccessToken ? encryptToken$1(newAccessToken) : matchingSession.token;
               const encryptedRefreshToken = newRefreshToken ? encryptToken$1(newRefreshToken) : matchingSession.refreshToken;
+              const newTokenHash = newAccessToken ? hashToken$1(newAccessToken) : matchingSession.tokenHash;
+              const newRefreshTokenHash = newRefreshToken ? hashToken$1(newRefreshToken) : matchingSession.refreshTokenHash;
               await strapi2.documents(SESSION_UID$2).update({
                 documentId: matchingSession.documentId,
                 data: {
                   token: encryptedToken,
+                  tokenHash: newTokenHash,
                   refreshToken: encryptedRefreshToken,
+                  refreshTokenHash: newRefreshTokenHash,
                   lastActive: /* @__PURE__ */ new Date()
                 }
               });
@@ -571,7 +584,7 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
     });
     log.info("[SUCCESS] Refresh Token interceptor middleware mounted");
     strapi2.server.use(
-      lastSeen({ strapi: strapi2, sessionService })
+      lastSeen({ strapi: strapi2 })
     );
     log.info("[SUCCESS] LastSeen middleware mounted");
     await ensureContentApiPermissions(strapi2, log);
@@ -707,10 +720,18 @@ const attributes = {
     type: "text",
     "private": true
   },
+  tokenHash: {
+    type: "string",
+    configurable: false
+  },
   refreshToken: {
     type: "text",
     "private": true
   },
+  refreshTokenHash: {
+    type: "string",
+    configurable: false
+  },
   loginTime: {
     type: "datetime",
     required: true
@@ -1742,7 +1763,7 @@ var controllers$1 = {
   license,
   settings
 };
-const { encryptToken, decryptToken, generateSessionId } = encryption;
+const { encryptToken, decryptToken, generateSessionId, hashToken } = encryption;
 const { createLogger: createLogger$1 } = logger;
 const SESSION_UID = "plugin::magic-sessionmanager.session";
 const USER_UID = "plugin::users-permissions.user";
@@ -1760,6 +1781,8 @@ var session$1 = ({ strapi: strapi2 }) => {
         const sessionId = generateSessionId(userId);
         const encryptedToken = token ? encryptToken(token) : null;
         const encryptedRefreshToken = refreshToken ? encryptToken(refreshToken) : null;
+        const tokenHashValue = token ? hashToken(token) : null;
+        const refreshTokenHashValue = refreshToken ? hashToken(refreshToken) : null;
         const session2 = await strapi2.documents(SESSION_UID).create({
           data: {
             user: userId,
@@ -1770,11 +1793,15 @@ var session$1 = ({ strapi: strapi2 }) => {
             lastActive: now,
             isActive: true,
             token: encryptedToken,
-            // [SUCCESS] Encrypted Access Token
+            // Encrypted Access Token
+            tokenHash: tokenHashValue,
+            // SHA-256 hash for fast lookup
             refreshToken: encryptedRefreshToken,
-            // [SUCCESS] Encrypted Refresh Token
+            // Encrypted Refresh Token
+            refreshTokenHash: refreshTokenHashValue,
+            // SHA-256 hash for fast lookup
             sessionId
-            // [SUCCESS] Unique identifier
+            // Unique identifier
           }
         });
         log.info(`[SUCCESS] Session ${session2.documentId} (${sessionId}) created for user ${userId}`);
@@ -1852,9 +1879,9 @@ var session$1 = ({ strapi: strapi2 }) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
-          const { token, ...sessionWithoutToken } = session2;
+          const { token, tokenHash, refreshToken, refreshTokenHash, ...safeSession } = session2;
           return {
-            ...sessionWithoutToken,
+            ...safeSession,
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
@@ -1883,9 +1910,9 @@ var session$1 = ({ strapi: strapi2 }) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = timeSinceActive < inactivityTimeout;
-          const { token, ...sessionWithoutToken } = session2;
+          const { token, tokenHash, refreshToken, refreshTokenHash, ...safeSession } = session2;
           return {
-            ...sessionWithoutToken,
+            ...safeSession,
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
@@ -1922,9 +1949,9 @@ var session$1 = ({ strapi: strapi2 }) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
-          const { token, ...sessionWithoutToken } = session2;
+          const { token, tokenHash, refreshToken, refreshTokenHash, ...safeSession } = session2;
           return {
-            ...sessionWithoutToken,
+            ...safeSession,
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
@@ -2041,7 +2068,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
-const version = "4.2.7";
+const version = "4.2.8";
 const require$$2 = {
   version
 };

package/dist/server/index.mjs

@@ -175,7 +175,7 @@ function encryptToken$2(token) {
     throw new Error("Failed to encrypt token");
   }
 }
-function decryptToken$4(encryptedToken) {
+function decryptToken$3(encryptedToken) {
   if (!encryptedToken) return null;
   try {
     const key = getEncryptionKey();
@@ -202,62 +202,71 @@ function generateSessionId$1(userId) {
   const userHash = crypto$1.createHash("sha256").update(userId.toString()).digest("hex").substring(0, 8);
   return `sess_${timestamp}_${userHash}_${randomBytes}`;
 }
+function hashToken$3(token) {
+  if (!token) return null;
+  return crypto$1.createHash("sha256").update(token).digest("hex");
+}
 var encryption = {
   encryptToken: encryptToken$2,
-  decryptToken: decryptToken$4,
-  generateSessionId: generateSessionId$1
+  decryptToken: decryptToken$3,
+  generateSessionId: generateSessionId$1,
+  hashToken: hashToken$3
 };
 const SESSION_UID$3 = "plugin::magic-sessionmanager.session";
-const { decryptToken: decryptToken$3 } = encryption;
-var lastSeen = ({ strapi: strapi2, sessionService }) => {
+const { hashToken: hashToken$2 } = encryption;
+const lastTouchCache = /* @__PURE__ */ new Map();
+var lastSeen = ({ strapi: strapi2 }) => {
   return async (ctx, next) => {
-    if (ctx.state.user && ctx.state.user.documentId) {
-      try {
-        const userId = ctx.state.user.documentId;
-        const currentToken = ctx.request.headers.authorization?.replace("Bearer ", "");
-        if (!currentToken) {
-          await next();
-          return;
-        }
-        const activeSessions = await strapi2.documents(SESSION_UID$3).findMany({
-          filters: {
-            user: { documentId: userId },
-            isActive: true
-          }
-        });
-        if (!activeSessions || activeSessions.length === 0) {
-          strapi2.log.info(`[magic-sessionmanager] [BLOCKED] User ${userId} has no active sessions`);
-          return ctx.unauthorized("All sessions have been terminated. Please login again.");
-        }
-        let matchingSession = null;
-        for (const session2 of activeSessions) {
-          if (!session2.token) continue;
-          try {
-            const decrypted = decryptToken$3(session2.token);
-            if (decrypted === currentToken) {
-              matchingSession = session2;
-              break;
-            }
-          } catch (err) {
-          }
+    const currentToken = ctx.request.headers.authorization?.replace("Bearer ", "");
+    if (!currentToken) {
+      await next();
+      return;
+    }
+    const skipPaths = ["/admin", "/_health", "/favicon.ico"];
+    if (skipPaths.some((p) => ctx.path.startsWith(p))) {
+      await next();
+      return;
+    }
+    let matchingSession = null;
+    try {
+      const currentTokenHash = hashToken$2(currentToken);
+      matchingSession = await strapi2.documents(SESSION_UID$3).findFirst({
+        filters: {
+          tokenHash: currentTokenHash,
+          isActive: true
+        },
+        populate: { user: { fields: ["documentId"] } }
+      });
+      if (matchingSession) {
+        ctx.state.sessionId = matchingSession.documentId;
+        ctx.state.currentSession = matchingSession;
+        if (matchingSession.user?.documentId) {
+          ctx.state.sessionUserId = matchingSession.user.documentId;
         }
-        if (!matchingSession) {
-          strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Session for user ${userId} has been terminated`);
+      } else {
+        if (ctx.state.user && ctx.state.user.documentId) {
+          strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Session terminated for user ${ctx.state.user.documentId}`);
           return ctx.unauthorized("This session has been terminated. Please login again.");
         }
-        ctx.state.sessionId = matchingSession.documentId;
-        ctx.state.currentSession = matchingSession;
-      } catch (err) {
-        strapi2.log.debug("[magic-sessionmanager] Error checking session:", err.message);
       }
+    } catch (err) {
+      strapi2.log.debug("[magic-sessionmanager] Error checking session:", err.message);
     }
     await next();
-    if (ctx.state.user && ctx.state.user.documentId && ctx.state.sessionId) {
+    if (matchingSession) {
       try {
-        await sessionService.touch({
-          userId: ctx.state.user.documentId,
-          sessionId: ctx.state.sessionId
-        });
+        const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
+        const rateLimit = config2.lastSeenRateLimit || 3e4;
+        const now = Date.now();
+        const lastTouch = lastTouchCache.get(matchingSession.documentId) || 0;
+        if (now - lastTouch > rateLimit) {
+          lastTouchCache.set(matchingSession.documentId, now);
+          await strapi2.documents(SESSION_UID$3).update({
+            documentId: matchingSession.documentId,
+            data: { lastActive: /* @__PURE__ */ new Date() }
+          });
+          strapi2.log.debug(`[magic-sessionmanager] [TOUCH] Session ${matchingSession.documentId} activity updated`);
+        }
       } catch (err) {
         strapi2.log.debug("[magic-sessionmanager] Error updating lastSeen:", err.message);
       }
@@ -265,7 +274,7 @@ var lastSeen = ({ strapi: strapi2, sessionService }) => {
   };
 };
 const getClientIp = getClientIp_1;
-const { encryptToken: encryptToken$1, decryptToken: decryptToken$2 } = encryption;
+const { encryptToken: encryptToken$1, decryptToken: decryptToken$2, hashToken: hashToken$1 } = encryption;
 const { createLogger: createLogger$3 } = logger;
 const SESSION_UID$2 = "plugin::magic-sessionmanager.session";
 const USER_UID$2 = "plugin::users-permissions.user";
@@ -549,11 +558,15 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
             if (matchingSession) {
               const encryptedToken = newAccessToken ? encryptToken$1(newAccessToken) : matchingSession.token;
               const encryptedRefreshToken = newRefreshToken ? encryptToken$1(newRefreshToken) : matchingSession.refreshToken;
+              const newTokenHash = newAccessToken ? hashToken$1(newAccessToken) : matchingSession.tokenHash;
+              const newRefreshTokenHash = newRefreshToken ? hashToken$1(newRefreshToken) : matchingSession.refreshTokenHash;
               await strapi2.documents(SESSION_UID$2).update({
                 documentId: matchingSession.documentId,
                 data: {
                   token: encryptedToken,
+                  tokenHash: newTokenHash,
                   refreshToken: encryptedRefreshToken,
+                  refreshTokenHash: newRefreshTokenHash,
                   lastActive: /* @__PURE__ */ new Date()
                 }
               });
@@ -567,7 +580,7 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
     });
     log.info("[SUCCESS] Refresh Token interceptor middleware mounted");
     strapi2.server.use(
-      lastSeen({ strapi: strapi2, sessionService })
+      lastSeen({ strapi: strapi2 })
     );
     log.info("[SUCCESS] LastSeen middleware mounted");
     await ensureContentApiPermissions(strapi2, log);
@@ -703,10 +716,18 @@ const attributes = {
     type: "text",
     "private": true
   },
+  tokenHash: {
+    type: "string",
+    configurable: false
+  },
   refreshToken: {
     type: "text",
     "private": true
   },
+  refreshTokenHash: {
+    type: "string",
+    configurable: false
+  },
   loginTime: {
     type: "datetime",
     required: true
@@ -1738,7 +1759,7 @@ var controllers$1 = {
   license,
   settings
 };
-const { encryptToken, decryptToken, generateSessionId } = encryption;
+const { encryptToken, decryptToken, generateSessionId, hashToken } = encryption;
 const { createLogger: createLogger$1 } = logger;
 const SESSION_UID = "plugin::magic-sessionmanager.session";
 const USER_UID = "plugin::users-permissions.user";
@@ -1756,6 +1777,8 @@ var session$1 = ({ strapi: strapi2 }) => {
         const sessionId = generateSessionId(userId);
         const encryptedToken = token ? encryptToken(token) : null;
         const encryptedRefreshToken = refreshToken ? encryptToken(refreshToken) : null;
+        const tokenHashValue = token ? hashToken(token) : null;
+        const refreshTokenHashValue = refreshToken ? hashToken(refreshToken) : null;
         const session2 = await strapi2.documents(SESSION_UID).create({
           data: {
             user: userId,
@@ -1766,11 +1789,15 @@ var session$1 = ({ strapi: strapi2 }) => {
             lastActive: now,
             isActive: true,
             token: encryptedToken,
-            // [SUCCESS] Encrypted Access Token
+            // Encrypted Access Token
+            tokenHash: tokenHashValue,
+            // SHA-256 hash for fast lookup
             refreshToken: encryptedRefreshToken,
-            // [SUCCESS] Encrypted Refresh Token
+            // Encrypted Refresh Token
+            refreshTokenHash: refreshTokenHashValue,
+            // SHA-256 hash for fast lookup
             sessionId
-            // [SUCCESS] Unique identifier
+            // Unique identifier
           }
         });
         log.info(`[SUCCESS] Session ${session2.documentId} (${sessionId}) created for user ${userId}`);
@@ -1848,9 +1875,9 @@ var session$1 = ({ strapi: strapi2 }) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
-          const { token, ...sessionWithoutToken } = session2;
+          const { token, tokenHash, refreshToken, refreshTokenHash, ...safeSession } = session2;
           return {
-            ...sessionWithoutToken,
+            ...safeSession,
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
@@ -1879,9 +1906,9 @@ var session$1 = ({ strapi: strapi2 }) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = timeSinceActive < inactivityTimeout;
-          const { token, ...sessionWithoutToken } = session2;
+          const { token, tokenHash, refreshToken, refreshTokenHash, ...safeSession } = session2;
           return {
-            ...sessionWithoutToken,
+            ...safeSession,
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
@@ -1918,9 +1945,9 @@ var session$1 = ({ strapi: strapi2 }) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
-          const { token, ...sessionWithoutToken } = session2;
+          const { token, tokenHash, refreshToken, refreshTokenHash, ...safeSession } = session2;
           return {
-            ...sessionWithoutToken,
+            ...safeSession,
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
@@ -2037,7 +2064,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
-const version = "4.2.7";
+const version = "4.2.8";
 const require$$2 = {
   version
 };

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "4.2.7",
+  "version": "4.2.9",
   "keywords": [
     "strapi",
     "strapi-plugin",