npm - strapi-plugin-magic-sessionmanager - Versions diffs - 4.3.2 → 4.3.4 - Mend

strapi-plugin-magic-sessionmanager 4.3.2 → 4.3.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/server/index.js CHANGED Viewed

@@ -319,6 +319,8 @@ var lastSeen = ({ strapi: strapi2, sessionService }) => {
           userDocId2 = await getDocumentIdFromNumericId(strapi2, ctx.state.user.id);
         }
         if (userDocId2) {
+          const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
+          const strictMode = config2.strictSessionEnforcement === true;
           const activeSessions = await strapi2.documents(SESSION_UID$4).findMany({
             filters: {
               user: { documentId: userDocId2 },
@@ -327,8 +329,21 @@ var lastSeen = ({ strapi: strapi2, sessionService }) => {
             limit: 1
           });
           if (!activeSessions || activeSessions.length === 0) {
-            strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Request blocked - session terminated or invalid (user: ${userDocId2.substring(0, 8)}...)`);
-            return ctx.unauthorized("All sessions have been terminated. Please login again.");
+            const allSessions = await strapi2.documents(SESSION_UID$4).findMany({
+              filters: { user: { documentId: userDocId2 } },
+              limit: 1,
+              fields: ["isActive"]
+            });
+            const hasInactiveSessions = allSessions?.some((s3) => s3.isActive === false);
+            if (hasInactiveSessions) {
+              strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Session terminated (user: ${userDocId2.substring(0, 8)}...)`);
+              return ctx.unauthorized("Session has been terminated. Please login again.");
+            }
+            if (strictMode) {
+              strapi2.log.info(`[magic-sessionmanager] [BLOCKED] No session exists (user: ${userDocId2.substring(0, 8)}..., strictMode)`);
+              return ctx.unauthorized("No valid session. Please login again.");
+            }
+            strapi2.log.warn(`[magic-sessionmanager] [WARN] No session for user ${userDocId2.substring(0, 8)}... (allowing)`);
           }
           ctx.state.userDocumentId = userDocId2;
         }
@@ -775,6 +790,8 @@ async function registerSessionAwareAuthStrategy(strapi2, log) {
       if (!decoded || !decoded.id) {
         return decoded;
       }
+      const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
+      const strictMode = config2.strictSessionEnforcement === true;
       try {
         let userDocId = null;
         const user = await strapi2.entityService.findOne(
@@ -784,31 +801,50 @@ async function registerSessionAwareAuthStrategy(strapi2, log) {
         );
         userDocId = user?.documentId;
         if (!userDocId) {
+          strapi2.log.debug("[magic-sessionmanager] [JWT] No documentId found, allowing through");
           return decoded;
         }
-        strapi2.log.debug(`[magic-sessionmanager] [JWT] Checking sessions for user: ${userDocId}`);
         const activeSessions = await strapi2.documents(SESSION_UID$3).findMany({
           filters: {
             user: { documentId: userDocId },
             isActive: true
           },
-          limit: 1,
-          populate: { user: { fields: ["documentId"] } }
+          limit: 1
         });
-        strapi2.log.debug(`[magic-sessionmanager] [JWT] Found ${activeSessions?.length || 0} active sessions`);
-        if (!activeSessions || activeSessions.length === 0) {
-          const allSessions = await strapi2.documents(SESSION_UID$3).findMany({
-            filters: { user: { documentId: userDocId } },
-            limit: 5
-          });
+        if (activeSessions && activeSessions.length > 0) {
+          return decoded;
+        }
+        const allSessions = await strapi2.documents(SESSION_UID$3).findMany({
+          filters: { user: { documentId: userDocId } },
+          limit: 5,
+          fields: ["isActive", "lastActive"]
+        });
+        const totalSessions = allSessions?.length || 0;
+        const hasInactiveSessions = allSessions?.some((s3) => s3.isActive === false);
+        if (hasInactiveSessions) {
           strapi2.log.info(
-            `[magic-sessionmanager] [JWT-BLOCKED] Valid JWT but no active session (user: ${userDocId.substring(0, 8)}..., total sessions: ${allSessions?.length || 0})`
+            `[magic-sessionmanager] [JWT-BLOCKED] User ${userDocId.substring(0, 8)}... was logged out (${totalSessions} inactive sessions)`
           );
           return null;
         }
+        if (totalSessions === 0) {
+          if (strictMode) {
+            strapi2.log.info(
+              `[magic-sessionmanager] [JWT-BLOCKED] No sessions exist for user ${userDocId.substring(0, 8)}... (strictMode enabled)`
+            );
+            return null;
+          }
+          strapi2.log.warn(
+            `[magic-sessionmanager] [JWT-WARN] No session found for user ${userDocId.substring(0, 8)}... (allowing - session may not have been created)`
+          );
+          return decoded;
+        }
+        strapi2.log.warn(
+          `[magic-sessionmanager] [JWT-ALLOW] Unexpected session state for user ${userDocId.substring(0, 8)}... (allowing)`
+        );
         return decoded;
       } catch (err) {
-        strapi2.log.debug("[magic-sessionmanager] [AUTH] Session check error:", err.message);
+        strapi2.log.warn("[magic-sessionmanager] [JWT] Session check error (allowing):", err.message);
         return decoded;
       }
     };
@@ -2607,7 +2643,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
-const version$1 = "4.3.1";
+const version$1 = "4.3.3";
 const require$$2 = {
   version: version$1
 };
@@ -38931,6 +38967,8 @@ var sessionRequired$1 = async (policyContext, config2, { strapi: strapi2 }) => {
     if (!userDocId) {
       return true;
     }
+    const config3 = strapi2.config.get("plugin::magic-sessionmanager") || {};
+    const strictMode = config3.strictSessionEnforcement === true;
     const activeSessions = await strapi2.documents(SESSION_UID).findMany({
       filters: {
         user: { documentId: userDocId },
@@ -38938,12 +38976,30 @@ var sessionRequired$1 = async (policyContext, config2, { strapi: strapi2 }) => {
       },
       limit: 1
     });
-    if (!activeSessions || activeSessions.length === 0) {
+    if (activeSessions && activeSessions.length > 0) {
+      return true;
+    }
+    const allSessions = await strapi2.documents(SESSION_UID).findMany({
+      filters: { user: { documentId: userDocId } },
+      limit: 1,
+      fields: ["isActive"]
+    });
+    const hasInactiveSessions = allSessions?.some((s3) => s3.isActive === false);
+    if (hasInactiveSessions) {
       strapi2.log.info(
-        `[magic-sessionmanager] [POLICY-BLOCKED] JWT valid but no active session (user: ${userDocId.substring(0, 8)}...)`
+        `[magic-sessionmanager] [POLICY-BLOCKED] Session terminated (user: ${userDocId.substring(0, 8)}...)`
       );
       throw new errors.UnauthorizedError("Session terminated. Please login again.");
     }
+    if (strictMode) {
+      strapi2.log.info(
+        `[magic-sessionmanager] [POLICY-BLOCKED] No session exists (user: ${userDocId.substring(0, 8)}..., strictMode)`
+      );
+      throw new errors.UnauthorizedError("No valid session. Please login again.");
+    }
+    strapi2.log.warn(
+      `[magic-sessionmanager] [POLICY-WARN] No session for user ${userDocId.substring(0, 8)}... (allowing)`
+    );
     return true;
   } catch (err) {
     if (err instanceof errors.UnauthorizedError) {

package/dist/server/index.mjs CHANGED Viewed

@@ -306,6 +306,8 @@ var lastSeen = ({ strapi: strapi2, sessionService }) => {
           userDocId2 = await getDocumentIdFromNumericId(strapi2, ctx.state.user.id);
         }
         if (userDocId2) {
+          const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
+          const strictMode = config2.strictSessionEnforcement === true;
           const activeSessions = await strapi2.documents(SESSION_UID$4).findMany({
             filters: {
               user: { documentId: userDocId2 },
@@ -314,8 +316,21 @@ var lastSeen = ({ strapi: strapi2, sessionService }) => {
             limit: 1
           });
           if (!activeSessions || activeSessions.length === 0) {
-            strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Request blocked - session terminated or invalid (user: ${userDocId2.substring(0, 8)}...)`);
-            return ctx.unauthorized("All sessions have been terminated. Please login again.");
+            const allSessions = await strapi2.documents(SESSION_UID$4).findMany({
+              filters: { user: { documentId: userDocId2 } },
+              limit: 1,
+              fields: ["isActive"]
+            });
+            const hasInactiveSessions = allSessions?.some((s3) => s3.isActive === false);
+            if (hasInactiveSessions) {
+              strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Session terminated (user: ${userDocId2.substring(0, 8)}...)`);
+              return ctx.unauthorized("Session has been terminated. Please login again.");
+            }
+            if (strictMode) {
+              strapi2.log.info(`[magic-sessionmanager] [BLOCKED] No session exists (user: ${userDocId2.substring(0, 8)}..., strictMode)`);
+              return ctx.unauthorized("No valid session. Please login again.");
+            }
+            strapi2.log.warn(`[magic-sessionmanager] [WARN] No session for user ${userDocId2.substring(0, 8)}... (allowing)`);
           }
           ctx.state.userDocumentId = userDocId2;
         }
@@ -762,6 +777,8 @@ async function registerSessionAwareAuthStrategy(strapi2, log) {
       if (!decoded || !decoded.id) {
         return decoded;
       }
+      const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
+      const strictMode = config2.strictSessionEnforcement === true;
       try {
         let userDocId = null;
         const user = await strapi2.entityService.findOne(
@@ -771,31 +788,50 @@ async function registerSessionAwareAuthStrategy(strapi2, log) {
         );
         userDocId = user?.documentId;
         if (!userDocId) {
+          strapi2.log.debug("[magic-sessionmanager] [JWT] No documentId found, allowing through");
           return decoded;
         }
-        strapi2.log.debug(`[magic-sessionmanager] [JWT] Checking sessions for user: ${userDocId}`);
         const activeSessions = await strapi2.documents(SESSION_UID$3).findMany({
           filters: {
             user: { documentId: userDocId },
             isActive: true
           },
-          limit: 1,
-          populate: { user: { fields: ["documentId"] } }
+          limit: 1
         });
-        strapi2.log.debug(`[magic-sessionmanager] [JWT] Found ${activeSessions?.length || 0} active sessions`);
-        if (!activeSessions || activeSessions.length === 0) {
-          const allSessions = await strapi2.documents(SESSION_UID$3).findMany({
-            filters: { user: { documentId: userDocId } },
-            limit: 5
-          });
+        if (activeSessions && activeSessions.length > 0) {
+          return decoded;
+        }
+        const allSessions = await strapi2.documents(SESSION_UID$3).findMany({
+          filters: { user: { documentId: userDocId } },
+          limit: 5,
+          fields: ["isActive", "lastActive"]
+        });
+        const totalSessions = allSessions?.length || 0;
+        const hasInactiveSessions = allSessions?.some((s3) => s3.isActive === false);
+        if (hasInactiveSessions) {
           strapi2.log.info(
-            `[magic-sessionmanager] [JWT-BLOCKED] Valid JWT but no active session (user: ${userDocId.substring(0, 8)}..., total sessions: ${allSessions?.length || 0})`
+            `[magic-sessionmanager] [JWT-BLOCKED] User ${userDocId.substring(0, 8)}... was logged out (${totalSessions} inactive sessions)`
           );
           return null;
         }
+        if (totalSessions === 0) {
+          if (strictMode) {
+            strapi2.log.info(
+              `[magic-sessionmanager] [JWT-BLOCKED] No sessions exist for user ${userDocId.substring(0, 8)}... (strictMode enabled)`
+            );
+            return null;
+          }
+          strapi2.log.warn(
+            `[magic-sessionmanager] [JWT-WARN] No session found for user ${userDocId.substring(0, 8)}... (allowing - session may not have been created)`
+          );
+          return decoded;
+        }
+        strapi2.log.warn(
+          `[magic-sessionmanager] [JWT-ALLOW] Unexpected session state for user ${userDocId.substring(0, 8)}... (allowing)`
+        );
         return decoded;
       } catch (err) {
-        strapi2.log.debug("[magic-sessionmanager] [AUTH] Session check error:", err.message);
+        strapi2.log.warn("[magic-sessionmanager] [JWT] Session check error (allowing):", err.message);
         return decoded;
       }
     };
@@ -2594,7 +2630,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
-const version$1 = "4.3.1";
+const version$1 = "4.3.3";
 const require$$2 = {
   version: version$1
 };
@@ -38918,6 +38954,8 @@ var sessionRequired$1 = async (policyContext, config2, { strapi: strapi2 }) => {
     if (!userDocId) {
       return true;
     }
+    const config3 = strapi2.config.get("plugin::magic-sessionmanager") || {};
+    const strictMode = config3.strictSessionEnforcement === true;
     const activeSessions = await strapi2.documents(SESSION_UID).findMany({
       filters: {
         user: { documentId: userDocId },
@@ -38925,12 +38963,30 @@ var sessionRequired$1 = async (policyContext, config2, { strapi: strapi2 }) => {
       },
       limit: 1
     });
-    if (!activeSessions || activeSessions.length === 0) {
+    if (activeSessions && activeSessions.length > 0) {
+      return true;
+    }
+    const allSessions = await strapi2.documents(SESSION_UID).findMany({
+      filters: { user: { documentId: userDocId } },
+      limit: 1,
+      fields: ["isActive"]
+    });
+    const hasInactiveSessions = allSessions?.some((s3) => s3.isActive === false);
+    if (hasInactiveSessions) {
       strapi2.log.info(
-        `[magic-sessionmanager] [POLICY-BLOCKED] JWT valid but no active session (user: ${userDocId.substring(0, 8)}...)`
+        `[magic-sessionmanager] [POLICY-BLOCKED] Session terminated (user: ${userDocId.substring(0, 8)}...)`
       );
       throw new errors.UnauthorizedError("Session terminated. Please login again.");
     }
+    if (strictMode) {
+      strapi2.log.info(
+        `[magic-sessionmanager] [POLICY-BLOCKED] No session exists (user: ${userDocId.substring(0, 8)}..., strictMode)`
+      );
+      throw new errors.UnauthorizedError("No valid session. Please login again.");
+    }
+    strapi2.log.warn(
+      `[magic-sessionmanager] [POLICY-WARN] No session for user ${userDocId.substring(0, 8)}... (allowing)`
+    );
     return true;
   } catch (err) {
     if (err instanceof errors.UnauthorizedError) {

package/package.json CHANGED Viewed

@@ -1,5 +1,5 @@
 {
-  "version": "4.3.2",
+  "version": "4.3.4",
   "keywords": [
     "strapi",
     "strapi-plugin",