strapi-plugin-magic-sessionmanager 4.4.4 → 4.4.6

package/dist/server/index.js

@@ -172,11 +172,19 @@ const getClientIp$1 = (ctx) => {
 };
 const cleanIp = (ip) => {
   if (!ip) return "unknown";
-  ip = ip.split(":")[0];
+  ip = ip.trim();
+  if (ip.startsWith("[")) {
+    const bracketEnd = ip.indexOf("]");
+    if (bracketEnd !== -1) {
+      ip = ip.substring(1, bracketEnd);
+    }
+  }
   if (ip.startsWith("::ffff:")) {
     ip = ip.substring(7);
   }
-  ip = ip.trim();
+  if (ip.includes(".") && ip.includes(":") && ip.indexOf(":") === ip.lastIndexOf(":")) {
+    ip = ip.split(":")[0];
+  }
   return ip || "unknown";
 };
 const isPrivateIp = (ip) => {
@@ -199,14 +207,15 @@ const IV_LENGTH = 16;
 function getEncryptionKey() {
   const envKey = process.env.SESSION_ENCRYPTION_KEY;
   if (envKey) {
-    const key2 = crypto$1.createHash("sha256").update(envKey).digest();
-    return key2;
+    return crypto$1.createHash("sha256").update(envKey).digest();
+  }
+  const strapiKeys = process.env.APP_KEYS || process.env.API_TOKEN_SALT;
+  if (!strapiKeys) {
+    throw new Error(
+      "[magic-sessionmanager] No encryption key available. Set SESSION_ENCRYPTION_KEY in your .env file, or ensure APP_KEYS is configured."
+    );
   }
-  const strapiKeys = process.env.APP_KEYS || process.env.API_TOKEN_SALT || "default-insecure-key";
-  const key = crypto$1.createHash("sha256").update(strapiKeys).digest();
-  console.warn("[magic-sessionmanager/encryption] [WARNING]  No SESSION_ENCRYPTION_KEY found. Using fallback (not recommended for production).");
-  console.warn("[magic-sessionmanager/encryption] Set SESSION_ENCRYPTION_KEY in .env for better security.");
-  return key;
+  return crypto$1.createHash("sha256").update(strapiKeys).digest();
 }
 function encryptToken$2(token) {
   if (!token) return null;
@@ -219,11 +228,12 @@ function encryptToken$2(token) {
     const authTag = cipher.getAuthTag();
     return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted}`;
   } catch (err) {
-    console.error("[magic-sessionmanager/encryption] Encryption failed:", err);
+    const errMsg = err instanceof Error ? err.message : "Unknown encryption error";
+    console.error("[magic-sessionmanager/encryption] Encryption failed:", errMsg);
     throw new Error("Failed to encrypt token");
   }
 }
-function decryptToken$3(encryptedToken) {
+function decryptToken$2(encryptedToken) {
   if (!encryptedToken) return null;
   try {
     const key = getEncryptionKey();
@@ -240,7 +250,8 @@ function decryptToken$3(encryptedToken) {
     decrypted += decipher.final("utf8");
     return decrypted;
   } catch (err) {
-    console.error("[magic-sessionmanager/encryption] Decryption failed:", err);
+    const errMsg = err instanceof Error ? err.message : "Unknown decryption error";
+    console.error("[magic-sessionmanager/encryption] Decryption failed:", errMsg);
     return null;
   }
 }
@@ -256,7 +267,7 @@ function hashToken$3(token) {
 }
 var encryption = {
   encryptToken: encryptToken$2,
-  decryptToken: decryptToken$3,
+  decryptToken: decryptToken$2,
   generateSessionId: generateSessionId$1,
   hashToken: hashToken$3
 };
@@ -287,12 +298,25 @@ function isAuthEndpoint(path2) {
 }
 const userIdCache = /* @__PURE__ */ new Map();
 const CACHE_TTL = 5 * 60 * 1e3;
+const CACHE_MAX_SIZE = 1e3;
 async function getDocumentIdFromNumericId(strapi2, numericId) {
   const cacheKey = `user_${numericId}`;
   const cached2 = userIdCache.get(cacheKey);
   if (cached2 && Date.now() - cached2.timestamp < CACHE_TTL) {
     return cached2.documentId;
   }
+  if (userIdCache.size >= CACHE_MAX_SIZE) {
+    const now = Date.now();
+    for (const [key, value] of userIdCache) {
+      if (now - value.timestamp >= CACHE_TTL) {
+        userIdCache.delete(key);
+      }
+    }
+    if (userIdCache.size >= CACHE_MAX_SIZE) {
+      const keysToDelete = [...userIdCache.keys()].slice(0, Math.floor(CACHE_MAX_SIZE / 4));
+      keysToDelete.forEach((key) => userIdCache.delete(key));
+    }
+  }
   try {
     const user = await strapi2.entityService.findOne(USER_UID$3, numericId, {
       fields: ["documentId"]
@@ -335,7 +359,7 @@ var lastSeen = ({ strapi: strapi2, sessionService }) => {
                 isActive: false
               },
               limit: 5,
-              fields: ["documentId", "terminatedManually", "lastActive"],
+              fields: ["documentId", "terminatedManually", "lastActive", "loginTime"],
               sort: [{ lastActive: "desc" }]
             });
             if (inactiveSessions && inactiveSessions.length > 0) {
@@ -345,6 +369,14 @@ var lastSeen = ({ strapi: strapi2, sessionService }) => {
                 return ctx.unauthorized("Session has been terminated. Please login again.");
               }
               const sessionToReactivate = inactiveSessions[0];
+              const maxAgeDays = config2.maxSessionAgeDays || 30;
+              const loginTime = sessionToReactivate.loginTime ? new Date(sessionToReactivate.loginTime).getTime() : sessionToReactivate.lastActive ? new Date(sessionToReactivate.lastActive).getTime() : 0;
+              const maxAgeMs = maxAgeDays * 24 * 60 * 60 * 1e3;
+              const isExpired = loginTime > 0 && Date.now() - loginTime > maxAgeMs;
+              if (isExpired) {
+                strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Session exceeded max age of ${maxAgeDays} days (user: ${userDocId2.substring(0, 8)}...)`);
+                return ctx.unauthorized("Session expired. Please login again.");
+              }
               await strapi2.documents(SESSION_UID$4).update({
                 documentId: sessionToReactivate.documentId,
                 data: {
@@ -385,7 +417,7 @@ var lastSeen = ({ strapi: strapi2, sessionService }) => {
   };
 };
 const getClientIp = getClientIp_1;
-const { encryptToken: encryptToken$1, decryptToken: decryptToken$2, hashToken: hashToken$2 } = encryption;
+const { encryptToken: encryptToken$1, decryptToken: decryptToken$1, hashToken: hashToken$2 } = encryption;
 const { createLogger: createLogger$3 } = logger;
 const SESSION_UID$3 = "plugin::magic-sessionmanager.session";
 const USER_UID$2 = "plugin::users-permissions.user";
@@ -419,11 +451,11 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
         log.info("║  [SUCCESS] SESSION MANAGER LICENSE ACTIVE                             ║");
         log.info("║                                                                ║");
         if (licenseStatus.data) {
-          log.info(`║  License: ${licenseStatus.data.licenseKey}`.padEnd(66) + "║");
+          const maskedKey = licenseStatus.data.licenseKey ? `${licenseStatus.data.licenseKey.substring(0, 8)}...` : "N/A";
+          log.info(`║  License: ${maskedKey}`.padEnd(66) + "║");
           log.info(`║  User: ${licenseStatus.data.firstName} ${licenseStatus.data.lastName}`.padEnd(66) + "║");
-          log.info(`║  Email: ${licenseStatus.data.email}`.padEnd(66) + "║");
         } else if (storedKey) {
-          log.info(`║  License: ${storedKey} (Offline Mode)`.padEnd(66) + "║");
+          log.info(`║  License: ${storedKey.substring(0, 8)}... (Offline Mode)`.padEnd(66) + "║");
           log.info(`║  Status: Grace Period Active`.padEnd(66) + "║");
         }
         log.info("║                                                                ║");
@@ -455,10 +487,21 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
         try {
           const token = ctx.request.headers?.authorization?.replace("Bearer ", "");
           if (!token) {
-            ctx.status = 200;
-            ctx.body = { message: "Logged out successfully" };
+            ctx.status = 401;
+            ctx.body = { error: { status: 401, message: "Authorization token required" } };
             return;
           }
+          try {
+            const jwtService = strapi2.plugin("users-permissions").service("jwt");
+            const decoded = await jwtService.verify(token);
+            if (!decoded || !decoded.id) {
+              ctx.status = 401;
+              ctx.body = { error: { status: 401, message: "Invalid token" } };
+              return;
+            }
+          } catch (jwtErr) {
+            log.debug("JWT verify failed during logout (cleaning up anyway):", jwtErr.message);
+          }
           const tokenHashValue = hashToken$2(token);
           const matchingSession = await strapi2.documents(SESSION_UID$3).findFirst({
             filters: {
@@ -480,6 +523,7 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
       },
       config: {
         auth: false
+        // We handle auth manually above to support expired-but-valid tokens
       }
     }]);
     log.info("[SUCCESS] /api/auth/logout route registered");
@@ -539,8 +583,7 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
             ctx.body = {
               error: {
                 status: 403,
-                message: "Login blocked for security reasons",
-                details: { reason: blockReason }
+                message: "Login blocked for security reasons. Please contact support."
               }
             };
             return;
@@ -602,11 +645,22 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
                   geoData
                 });
                 if (config2.discordWebhookUrl) {
-                  await notificationService.sendWebhook({
-                    event: "session.login",
-                    data: webhookData,
-                    webhookUrl: config2.discordWebhookUrl
-                  });
+                  const webhookUrl = config2.discordWebhookUrl;
+                  try {
+                    const parsed = new URL(webhookUrl);
+                    const isValidDomain = parsed.protocol === "https:" && (parsed.hostname === "discord.com" || parsed.hostname === "discordapp.com" || parsed.hostname.endsWith(".discord.com") || parsed.hostname === "hooks.slack.com");
+                    if (isValidDomain) {
+                      await notificationService.sendWebhook({
+                        event: "session.login",
+                        data: webhookData,
+                        webhookUrl
+                      });
+                    } else {
+                      log.warn(`[SECURITY] Blocked webhook to untrusted domain: ${parsed.hostname}`);
+                    }
+                  } catch {
+                    log.warn("[SECURITY] Invalid webhook URL in plugin config");
+                  }
                 }
               }
             } catch (notifErr) {
@@ -787,6 +841,30 @@ async function ensureTokenHashIndex(strapi2, log) {
     log.debug("[INDEX] Could not create tokenHash index (will retry on next startup):", err.message);
   }
 }
+const sessionCheckErrors = { count: 0, lastReset: Date.now() };
+const MAX_CONSECUTIVE_ERRORS = 10;
+const ERROR_RESET_INTERVAL = 60 * 1e3;
+function shouldFailOpen() {
+  const now = Date.now();
+  if (now - sessionCheckErrors.lastReset > ERROR_RESET_INTERVAL) {
+    sessionCheckErrors.count = 0;
+    sessionCheckErrors.lastReset = now;
+  }
+  sessionCheckErrors.count++;
+  if (sessionCheckErrors.count > MAX_CONSECUTIVE_ERRORS) {
+    return false;
+  }
+  return true;
+}
+function resetErrorCounter() {
+  sessionCheckErrors.count = 0;
+}
+function isSessionExpired(session2, maxAgeDays = 30) {
+  if (!session2.loginTime) return false;
+  const loginTime = new Date(session2.loginTime).getTime();
+  const maxAgeMs = maxAgeDays * 24 * 60 * 60 * 1e3;
+  return Date.now() - loginTime > maxAgeMs;
+}
 async function registerSessionAwareAuthStrategy(strapi2, log) {
   try {
     const usersPermissionsPlugin = strapi2.plugin("users-permissions");
@@ -808,15 +886,15 @@ async function registerSessionAwareAuthStrategy(strapi2, log) {
       }
       const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
       const strictMode = config2.strictSessionEnforcement === true;
+      const maxSessionAgeDays = config2.maxSessionAgeDays || 30;
       try {
         const tokenHashValue = hashToken$2(token);
-        let userDocId = null;
         const user = await strapi2.entityService.findOne(
           "plugin::users-permissions.user",
           decoded.id,
           { fields: ["documentId"] }
         );
-        userDocId = user?.documentId;
+        const userDocId = user?.documentId;
         if (!userDocId) {
           strapi2.log.debug("[magic-sessionmanager] [JWT] No documentId found, allowing through");
           return decoded;
@@ -826,9 +904,19 @@ async function registerSessionAwareAuthStrategy(strapi2, log) {
             user: { documentId: userDocId },
             tokenHash: tokenHashValue
           },
-          fields: ["documentId", "isActive", "terminatedManually", "lastActive"]
+          fields: ["documentId", "isActive", "terminatedManually", "lastActive", "loginTime"]
         });
         if (thisSession) {
+          if (isSessionExpired(thisSession, maxSessionAgeDays)) {
+            strapi2.log.info(
+              `[magic-sessionmanager] [JWT-EXPIRED] Session exceeded max age of ${maxSessionAgeDays} days (user: ${userDocId.substring(0, 8)}...)`
+            );
+            await strapi2.documents(SESSION_UID$3).update({
+              documentId: thisSession.documentId,
+              data: { isActive: false, terminatedManually: true, logoutTime: /* @__PURE__ */ new Date() }
+            });
+            return null;
+          }
           if (thisSession.terminatedManually === true) {
             strapi2.log.info(
               `[magic-sessionmanager] [JWT-BLOCKED] Session was manually terminated (user: ${userDocId.substring(0, 8)}...)`
@@ -836,38 +924,32 @@ async function registerSessionAwareAuthStrategy(strapi2, log) {
             return null;
           }
           if (thisSession.isActive) {
+            resetErrorCounter();
             return decoded;
           }
           await strapi2.documents(SESSION_UID$3).update({
             documentId: thisSession.documentId,
-            data: {
-              isActive: true,
-              lastActive: /* @__PURE__ */ new Date()
-            }
+            data: { isActive: true, lastActive: /* @__PURE__ */ new Date() }
           });
           strapi2.log.info(
             `[magic-sessionmanager] [JWT-REACTIVATED] Session reactivated for user ${userDocId.substring(0, 8)}...`
           );
+          resetErrorCounter();
           return decoded;
         }
         const anyActiveSessions = await strapi2.documents(SESSION_UID$3).findMany({
-          filters: {
-            user: { documentId: userDocId },
-            isActive: true
-          },
+          filters: { user: { documentId: userDocId }, isActive: true },
           limit: 1
         });
         if (anyActiveSessions && anyActiveSessions.length > 0) {
           strapi2.log.debug(
             `[magic-sessionmanager] [JWT] No session for token but user has other active sessions (allowing)`
           );
+          resetErrorCounter();
           return decoded;
         }
         const terminatedSessions = await strapi2.documents(SESSION_UID$3).findMany({
-          filters: {
-            user: { documentId: userDocId },
-            terminatedManually: true
-          },
+          filters: { user: { documentId: userDocId }, terminatedManually: true },
           limit: 1
         });
         if (terminatedSessions && terminatedSessions.length > 0) {
@@ -885,10 +967,15 @@ async function registerSessionAwareAuthStrategy(strapi2, log) {
         strapi2.log.warn(
           `[magic-sessionmanager] [JWT-WARN] No session for user ${userDocId.substring(0, 8)}... (allowing)`
         );
+        resetErrorCounter();
         return decoded;
       } catch (err) {
-        strapi2.log.warn("[magic-sessionmanager] [JWT] Session check error (allowing):", err.message);
-        return decoded;
+        if (shouldFailOpen()) {
+          strapi2.log.warn("[magic-sessionmanager] [JWT] Session check error (allowing):", err.message);
+          return decoded;
+        }
+        strapi2.log.error("[magic-sessionmanager] [JWT] Too many consecutive errors, blocking request:", err.message);
+        return null;
       }
     };
     strapi2.log.info("[magic-sessionmanager] [AUTH] [SUCCESS] JWT verify wrapped with session validation");
@@ -1198,7 +1285,7 @@ var admin$1 = {
       path: "/license/status",
       handler: "license.getStatus",
       config: {
-        policies: []
+        policies: ["admin::isAuthenticatedAdmin"]
       }
     },
     {
@@ -1206,7 +1293,7 @@ var admin$1 = {
       path: "/license/auto-create",
       handler: "license.autoCreate",
       config: {
-        policies: []
+        policies: ["admin::isAuthenticatedAdmin"]
       }
     },
     {
@@ -1214,7 +1301,7 @@ var admin$1 = {
       path: "/license/create",
       handler: "license.createAndActivate",
       config: {
-        policies: []
+        policies: ["admin::isAuthenticatedAdmin"]
       }
     },
     {
@@ -1222,7 +1309,7 @@ var admin$1 = {
       path: "/license/ping",
       handler: "license.ping",
       config: {
-        policies: []
+        policies: ["admin::isAuthenticatedAdmin"]
       }
     },
     {
@@ -1230,7 +1317,7 @@ var admin$1 = {
       path: "/license/store-key",
       handler: "license.storeKey",
       config: {
-        policies: []
+        policies: ["admin::isAuthenticatedAdmin"]
       }
     },
     // Geolocation (Premium Feature)
@@ -1353,7 +1440,7 @@ function extractVersion(userAgent, regex) {
 var userAgentParser = {
   parseUserAgent: parseUserAgent$2
 };
-const { decryptToken: decryptToken$1, hashToken: hashToken$1 } = encryption;
+const { hashToken: hashToken$1 } = encryption;
 const { parseUserAgent: parseUserAgent$1 } = userAgentParser;
 const SESSION_UID$2 = "plugin::magic-sessionmanager.session";
 const USER_UID$1 = "plugin::users-permissions.user";
@@ -1413,7 +1500,8 @@ var session$3 = {
       }
       const allSessions = await strapi.documents(SESSION_UID$2).findMany({
         filters: { user: { documentId: userId } },
-        sort: { loginTime: "desc" }
+        sort: { loginTime: "desc" },
+        limit: 200
       });
       const config2 = strapi.config.get("plugin::magic-sessionmanager") || {};
       const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
@@ -1451,7 +1539,7 @@ var session$3 = {
               strapi.documents(SESSION_UID$2).update({
                 documentId: session2.documentId,
                 data: {
-                  geoLocation: JSON.stringify(geoLocation),
+                  geoLocation,
                   securityScore: geoData.securityScore || null
                 }
               }).catch(() => {
@@ -1513,9 +1601,15 @@ var session$3 = {
       const { userId } = ctx.params;
       const isAdminRequest = ctx.state.userAbility || ctx.state.admin;
       const requestingUserDocId = ctx.state.user?.documentId;
-      if (!isAdminRequest && requestingUserDocId && String(requestingUserDocId) !== String(userId)) {
-        strapi.log.warn(`[magic-sessionmanager] Security: User ${requestingUserDocId} tried to access sessions of user ${userId}`);
-        return ctx.forbidden("You can only access your own sessions");
+      if (!isAdminRequest) {
+        if (!requestingUserDocId) {
+          strapi.log.warn(`[magic-sessionmanager] Security: Request without documentId tried to access sessions of user ${userId}`);
+          return ctx.forbidden("Cannot verify user identity");
+        }
+        if (String(requestingUserDocId) !== String(userId)) {
+          strapi.log.warn(`[magic-sessionmanager] Security: User ${requestingUserDocId} tried to access sessions of user ${userId}`);
+          return ctx.forbidden("You can only access your own sessions");
+        }
       }
       const sessionService = strapi.plugin("magic-sessionmanager").service("session");
       const sessions = await sessionService.getUserSessions(userId);
@@ -1639,7 +1733,7 @@ var session$3 = {
             strapi.documents(SESSION_UID$2).update({
               documentId: currentSession.documentId,
               data: {
-                geoLocation: JSON.stringify(geoLocation),
+                geoLocation,
                 securityScore: geoData.securityScore || null
               }
             }).catch(() => {
@@ -1721,22 +1815,6 @@ var session$3 = {
       ctx.throw(500, "Error terminating session");
     }
   },
-  /**
-   * Terminate specific session
-   * DELETE /magic-sessionmanager/sessions/:sessionId
-   */
-  async terminateSession(ctx) {
-    try {
-      const { sessionId } = ctx.params;
-      const sessionService = strapi.plugin("magic-sessionmanager").service("session");
-      await sessionService.terminateSession({ sessionId });
-      ctx.body = {
-        message: `Session ${sessionId} terminated`
-      };
-    } catch (err) {
-      ctx.throw(500, "Error terminating session");
-    }
-  },
   /**
    * Simulate session timeout for testing (Admin action)
    * POST /magic-sessionmanager/sessions/:sessionId/simulate-timeout
@@ -1745,6 +1823,10 @@ var session$3 = {
    */
   async simulateTimeout(ctx) {
     try {
+      const nodeEnv = process.env.NODE_ENV || "development";
+      if (nodeEnv === "production") {
+        return ctx.forbidden("simulate-timeout is disabled in production");
+      }
       const { sessionId } = ctx.params;
       const session2 = await strapi.documents(SESSION_UID$2).findOne({
         documentId: sessionId
@@ -1817,6 +1899,17 @@ var session$3 = {
       if (!ipAddress) {
         return ctx.badRequest("IP address is required");
       }
+      const IPV4_REGEX = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+      const ipv4Match = ipAddress.match(IPV4_REGEX);
+      const isValidIpv4 = ipv4Match && ipv4Match.slice(1).every((octet) => {
+        const n = parseInt(octet, 10);
+        return n >= 0 && n <= 255;
+      });
+      const IPV6_REGEX = /^[0-9a-fA-F:]{3,45}$/;
+      const isValidIpv6 = !isValidIpv4 && IPV6_REGEX.test(ipAddress) && (ipAddress.match(/:/g) || []).length >= 2;
+      if (!isValidIpv4 && !isValidIpv6) {
+        return ctx.badRequest("Invalid IP address format");
+      }
       const licenseGuard2 = strapi.plugin("magic-sessionmanager").service("license-guard");
       const pluginStore = strapi.store({
         type: "plugin",
@@ -1976,12 +2069,11 @@ var license$1 = ({ strapi: strapi2 }) => ({
           message: "No license found. Running in demo mode."
         });
       }
-      strapi2.log.info(`[magic-sessionmanager/license-controller] Checking stored license: ${licenseKey}`);
+      strapi2.log.info(`[magic-sessionmanager/license-controller] Checking stored license: ${licenseKey.substring(0, 8)}...`);
       const verification = await licenseGuard2.verifyLicense(licenseKey);
       const license2 = await licenseGuard2.getLicenseByKey(licenseKey);
       strapi2.log.info("[magic-sessionmanager/license-controller] License data from MagicAPI:", {
-        licenseKey: license2?.licenseKey,
-        email: license2?.email,
+        licenseKey: license2?.licenseKey ? `${license2.licenseKey.substring(0, 8)}...` : "N/A",
         featurePremium: license2?.featurePremium,
         isActive: license2?.isActive,
         pluginName: license2?.pluginName
@@ -2125,6 +2217,55 @@ var license$1 = ({ strapi: strapi2 }) => ({
     }
   }
 });
+const ALLOWED_WEBHOOK_DOMAINS = {
+  discord: ["discord.com", "discordapp.com"],
+  slack: ["hooks.slack.com"]
+};
+function sanitizeWebhookUrl(url, type2) {
+  if (!url || typeof url !== "string") return "";
+  const trimmed = url.trim();
+  if (!trimmed) return "";
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol !== "https:") return "";
+    const allowedDomains = ALLOWED_WEBHOOK_DOMAINS[type2] || [];
+    const isAllowed = allowedDomains.some(
+      (domain) => parsed.hostname === domain || parsed.hostname.endsWith(`.${domain}`)
+    );
+    if (!isAllowed) return "";
+    return trimmed;
+  } catch {
+    return "";
+  }
+}
+function sanitizeCountryList(list) {
+  if (!Array.isArray(list)) return [];
+  return list.filter((code) => typeof code === "string" && /^[A-Z]{2}$/.test(code.trim().toUpperCase())).map((code) => code.trim().toUpperCase());
+}
+function sanitizeEmailTemplates(templates) {
+  const defaults = {
+    suspiciousLogin: { subject: "", html: "", text: "" },
+    newLocation: { subject: "", html: "", text: "" },
+    vpnProxy: { subject: "", html: "", text: "" }
+  };
+  if (!templates || typeof templates !== "object") return defaults;
+  const dangerousTags = /<\s*\/?\s*(script|iframe|object|embed|form|input|button|link|meta|base)\b[^>]*>/gi;
+  const dangerousAttrs = /\s(on\w+|javascript\s*:)[^=]*=/gi;
+  const result = {};
+  for (const [key, defaultVal] of Object.entries(defaults)) {
+    const tpl = templates[key];
+    if (!tpl || typeof tpl !== "object") {
+      result[key] = defaultVal;
+      continue;
+    }
+    result[key] = {
+      subject: typeof tpl.subject === "string" ? tpl.subject.substring(0, 200) : "",
+      html: typeof tpl.html === "string" ? tpl.html.replace(dangerousTags, "").replace(dangerousAttrs, " ").substring(0, 1e4) : "",
+      text: typeof tpl.text === "string" ? tpl.text.substring(0, 5e3) : ""
+    };
+  }
+  return result;
+}
 var settings$1 = {
   /**
    * Get plugin settings
@@ -2186,29 +2327,26 @@ var settings$1 = {
         name: "magic-sessionmanager"
       });
       const sanitizedSettings = {
-        inactivityTimeout: parseInt(body.inactivityTimeout) || 15,
-        cleanupInterval: parseInt(body.cleanupInterval) || 30,
-        lastSeenRateLimit: parseInt(body.lastSeenRateLimit) || 30,
-        retentionDays: parseInt(body.retentionDays) || 90,
+        inactivityTimeout: Math.max(1, Math.min(parseInt(body.inactivityTimeout) || 15, 1440)),
+        cleanupInterval: Math.max(5, Math.min(parseInt(body.cleanupInterval) || 30, 1440)),
+        lastSeenRateLimit: Math.max(5, Math.min(parseInt(body.lastSeenRateLimit) || 30, 300)),
+        retentionDays: Math.max(1, Math.min(parseInt(body.retentionDays) || 90, 365)),
+        maxSessionAgeDays: Math.max(1, Math.min(parseInt(body.maxSessionAgeDays) || 30, 365)),
         enableGeolocation: !!body.enableGeolocation,
         enableSecurityScoring: !!body.enableSecurityScoring,
         blockSuspiciousSessions: !!body.blockSuspiciousSessions,
-        maxFailedLogins: parseInt(body.maxFailedLogins) || 5,
+        maxFailedLogins: Math.max(1, Math.min(parseInt(body.maxFailedLogins) || 5, 100)),
         enableEmailAlerts: !!body.enableEmailAlerts,
         alertOnSuspiciousLogin: !!body.alertOnSuspiciousLogin,
         alertOnNewLocation: !!body.alertOnNewLocation,
         alertOnVpnProxy: !!body.alertOnVpnProxy,
         enableWebhooks: !!body.enableWebhooks,
-        discordWebhookUrl: String(body.discordWebhookUrl || ""),
-        slackWebhookUrl: String(body.slackWebhookUrl || ""),
+        discordWebhookUrl: sanitizeWebhookUrl(body.discordWebhookUrl, "discord"),
+        slackWebhookUrl: sanitizeWebhookUrl(body.slackWebhookUrl, "slack"),
         enableGeofencing: !!body.enableGeofencing,
-        allowedCountries: Array.isArray(body.allowedCountries) ? body.allowedCountries : [],
-        blockedCountries: Array.isArray(body.blockedCountries) ? body.blockedCountries : [],
-        emailTemplates: body.emailTemplates || {
-          suspiciousLogin: { subject: "", html: "", text: "" },
-          newLocation: { subject: "", html: "", text: "" },
-          vpnProxy: { subject: "", html: "", text: "" }
-        }
+        allowedCountries: sanitizeCountryList(body.allowedCountries),
+        blockedCountries: sanitizeCountryList(body.blockedCountries),
+        emailTemplates: sanitizeEmailTemplates(body.emailTemplates)
       };
       await pluginStore.set({
         key: "settings",
@@ -2279,15 +2417,15 @@ var session$1 = ({ strapi: strapi2 }) => {
             deviceType: parsedUA.deviceType,
             browserName: parsedUA.browserVersion ? `${parsedUA.browserName} ${parsedUA.browserVersion}` : parsedUA.browserName,
             osName: parsedUA.osVersion ? `${parsedUA.osName} ${parsedUA.osVersion}` : parsedUA.osName,
-            // Geolocation data (if available from Premium features)
-            geoLocation: geoData ? JSON.stringify({
+            // Geolocation data (stored as JSON object, schema type: json)
+            geoLocation: geoData ? {
               country: geoData.country,
               country_code: geoData.country_code,
               country_flag: geoData.country_flag,
               city: geoData.city,
               region: geoData.region,
               timezone: geoData.timezone
-            }) : null,
+            } : null,
             securityScore: geoData?.securityScore || null
           }
         });
@@ -2308,6 +2446,14 @@ var session$1 = ({ strapi: strapi2 }) => {
       try {
         const now = /* @__PURE__ */ new Date();
         if (sessionId) {
+          const existing = await strapi2.documents(SESSION_UID$1).findOne({
+            documentId: sessionId,
+            fields: ["documentId"]
+          });
+          if (!existing) {
+            log.warn(`Session ${sessionId} not found for termination`);
+            return;
+          }
           await strapi2.documents(SESSION_UID$1).update({
             documentId: sessionId,
             data: {
@@ -2399,7 +2545,7 @@ var session$1 = ({ strapi: strapi2 }) => {
                 strapi2.documents(SESSION_UID$1).update({
                   documentId: session2.documentId,
                   data: {
-                    geoLocation: JSON.stringify(geoLocation),
+                    geoLocation,
                     securityScore: geoData.securityScore || null
                   }
                 }).catch(() => {
@@ -2449,7 +2595,8 @@ var session$1 = ({ strapi: strapi2 }) => {
         const sessions = await strapi2.documents(SESSION_UID$1).findMany({
           filters: { isActive: true },
           populate: { user: { fields: ["documentId", "email", "username"] } },
-          sort: { loginTime: "desc" }
+          sort: { loginTime: "desc" },
+          limit: 1e3
         });
         const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
         const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
@@ -2486,7 +2633,7 @@ var session$1 = ({ strapi: strapi2 }) => {
                 strapi2.documents(SESSION_UID$1).update({
                   documentId: session2.documentId,
                   data: {
-                    geoLocation: JSON.stringify(geoLocation),
+                    geoLocation,
                     securityScore: geoData.securityScore || null
                   }
                 }).catch(() => {
@@ -2579,7 +2726,7 @@ var session$1 = ({ strapi: strapi2 }) => {
                 strapi2.documents(SESSION_UID$1).update({
                   documentId: session2.documentId,
                   data: {
-                    geoLocation: JSON.stringify(geoLocation),
+                    geoLocation,
                     securityScore: geoData.securityScore || null
                   }
                 }).catch(() => {
@@ -2716,20 +2863,36 @@ var session$1 = ({ strapi: strapi2 }) => {
       }
     },
     /**
-     * Delete all inactive sessions from database
+     * Delete all inactive sessions from database in batches
      * WARNING: This permanently deletes records!
      * @returns {Promise<number>} Number of deleted sessions
      */
     async deleteInactiveSessions() {
       try {
         log.info("[DELETE] Deleting all inactive sessions...");
-        const inactiveSessions = await strapi2.documents(SESSION_UID$1).findMany({
-          filters: { isActive: false }
-        });
         let deletedCount = 0;
-        for (const session2 of inactiveSessions) {
-          await strapi2.documents(SESSION_UID$1).delete({ documentId: session2.documentId });
-          deletedCount++;
+        const BATCH_SIZE = 100;
+        let hasMore = true;
+        while (hasMore) {
+          const batch = await strapi2.documents(SESSION_UID$1).findMany({
+            filters: { isActive: false },
+            fields: ["documentId"],
+            limit: BATCH_SIZE
+          });
+          if (!batch || batch.length === 0) {
+            hasMore = false;
+            break;
+          }
+          const deleteResults = await Promise.allSettled(
+            batch.map(
+              (session2) => strapi2.documents(SESSION_UID$1).delete({ documentId: session2.documentId })
+            )
+          );
+          const batchDeleted = deleteResults.filter((r) => r.status === "fulfilled").length;
+          deletedCount += batchDeleted;
+          if (batch.length < BATCH_SIZE) {
+            hasMore = false;
+          }
         }
         log.info(`[SUCCESS] Deleted ${deletedCount} inactive sessions`);
         return deletedCount;
@@ -2740,7 +2903,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
-const version$1 = "4.4.3";
+const version$1 = "4.4.5";
 const require$$2 = {
   version: version$1
 };
@@ -3014,7 +3177,7 @@ var geolocation$1 = ({ strapi: strapi2 }) => ({
    */
   async getIpInfo(ipAddress) {
     try {
-      if (!ipAddress || ipAddress === "127.0.0.1" || ipAddress === "::1" || ipAddress.startsWith("192.168.") || ipAddress.startsWith("10.")) {
+      if (!ipAddress || this.isPrivateIp(ipAddress)) {
         return {
           ip: ipAddress,
           country: "Local Network",
@@ -3117,6 +3280,26 @@ var geolocation$1 = ({ strapi: strapi2 }) => ({
     const codePoints = countryCode.toUpperCase().split("").map((char) => 127397 + char.charCodeAt());
     return String.fromCodePoint(...codePoints);
   },
+  /**
+   * Checks if an IP address is private/local (RFC 1918, RFC 4193, loopback, link-local)
+   * @param {string} ip - IP address to check
+   * @returns {boolean} True if IP is private/local
+   */
+  isPrivateIp(ip) {
+    if (!ip || ip === "unknown") return true;
+    if (ip === "127.0.0.1" || ip === "localhost" || ip === "::1") return true;
+    if (ip.startsWith("192.168.")) return true;
+    if (ip.startsWith("10.")) return true;
+    if (ip.startsWith("172.")) {
+      const second = parseInt(ip.split(".")[1], 10);
+      if (second >= 16 && second <= 31) return true;
+    }
+    if (ip.startsWith("169.254.")) return true;
+    if (ip.startsWith("fc00:") || ip.startsWith("fd00:")) return true;
+    if (ip.startsWith("fe80:")) return true;
+    if (ip === "::1") return true;
+    return false;
+  },
   /**
    * Fallback data when API fails
    */
@@ -3252,25 +3435,36 @@ VPN: {{reason.isVpn}}, Proxy: {{reason.isProxy}}`
     };
   },
   /**
-   * Replace template variables with actual values
+   * Escapes HTML special characters to prevent XSS in email templates
+   * @param {string} str - String to escape
+   * @returns {string} HTML-safe string
+   */
+  escapeHtml(str2) {
+    if (!str2 || typeof str2 !== "string") return str2 || "";
+    return str2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+  },
+  /**
+   * Replace template variables with HTML-escaped actual values
+   * SECURITY: All dynamic values are HTML-escaped to prevent XSS via email
    */
   replaceVariables(template2, data) {
     let result = template2;
-    result = result.replace(/\{\{user\.email\}\}/g, data.user?.email || "N/A");
-    result = result.replace(/\{\{user\.username\}\}/g, data.user?.username || "N/A");
+    const esc2 = this.escapeHtml.bind(this);
+    result = result.replace(/\{\{user\.email\}\}/g, esc2(data.user?.email || "N/A"));
+    result = result.replace(/\{\{user\.username\}\}/g, esc2(data.user?.username || "N/A"));
     result = result.replace(
       /\{\{session\.loginTime\}\}/g,
-      data.session?.loginTime ? new Date(data.session.loginTime).toLocaleString() : "N/A"
+      esc2(data.session?.loginTime ? new Date(data.session.loginTime).toLocaleString() : "N/A")
     );
-    result = result.replace(/\{\{session\.ipAddress\}\}/g, data.session?.ipAddress || "N/A");
-    result = result.replace(/\{\{session\.userAgent\}\}/g, data.session?.userAgent || "N/A");
-    result = result.replace(/\{\{geo\.city\}\}/g, data.geoData?.city || "Unknown");
-    result = result.replace(/\{\{geo\.country\}\}/g, data.geoData?.country || "Unknown");
-    result = result.replace(/\{\{geo\.timezone\}\}/g, data.geoData?.timezone || "Unknown");
+    result = result.replace(/\{\{session\.ipAddress\}\}/g, esc2(data.session?.ipAddress || "N/A"));
+    result = result.replace(/\{\{session\.userAgent\}\}/g, esc2(data.session?.userAgent || "N/A"));
+    result = result.replace(/\{\{geo\.city\}\}/g, esc2(data.geoData?.city || "Unknown"));
+    result = result.replace(/\{\{geo\.country\}\}/g, esc2(data.geoData?.country || "Unknown"));
+    result = result.replace(/\{\{geo\.timezone\}\}/g, esc2(data.geoData?.timezone || "Unknown"));
     result = result.replace(/\{\{reason\.isVpn\}\}/g, data.reason?.isVpn ? "Yes" : "No");
     result = result.replace(/\{\{reason\.isProxy\}\}/g, data.reason?.isProxy ? "Yes" : "No");
     result = result.replace(/\{\{reason\.isThreat\}\}/g, data.reason?.isThreat ? "Yes" : "No");
-    result = result.replace(/\{\{reason\.securityScore\}\}/g, data.reason?.securityScore || "0");
+    result = result.replace(/\{\{reason\.securityScore\}\}/g, esc2(String(data.reason?.securityScore || "0")));
     return result;
   },
   /**
@@ -39046,7 +39240,7 @@ const dist = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty
 const require$$0 = /* @__PURE__ */ getAugmentedNamespace(dist);
 const SESSION_UID = "plugin::magic-sessionmanager.session";
 const { errors } = require$$0;
-var sessionRequired$1 = async (policyContext, config2, { strapi: strapi2 }) => {
+var sessionRequired$1 = async (policyContext, _policyConfig, { strapi: strapi2 }) => {
   if (!policyContext.state.user) {
     return true;
   }
@@ -39064,8 +39258,8 @@ var sessionRequired$1 = async (policyContext, config2, { strapi: strapi2 }) => {
     if (!userDocId) {
       return true;
     }
-    const config3 = strapi2.config.get("plugin::magic-sessionmanager") || {};
-    const strictMode = config3.strictSessionEnforcement === true;
+    const pluginConfig = strapi2.config.get("plugin::magic-sessionmanager") || {};
+    const strictMode = pluginConfig.strictSessionEnforcement === true;
     const activeSessions = await strapi2.documents(SESSION_UID).findMany({
       filters: {
         user: { documentId: userDocId },