strapi-plugin-magic-sessionmanager 4.4.7 → 4.5.0

package/dist/_chunks/{Analytics-mFarhu5A.js → Analytics-B7t0WvG7.js}

@@ -6,8 +6,8 @@ const admin = require("@strapi/strapi/admin");
 const styled = require("styled-components");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
-const index = require("./index-BEh2DizI.js");
-const useLicense = require("./useLicense-DFdVp_qI.js");
+const index = require("./index-CKrO7KSQ.js");
+const useLicense = require("./useLicense-DHAFqFSZ.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);
 const theme = {

package/dist/_chunks/{Analytics-CFlATYIp.mjs → Analytics-DmlZwyVu.mjs}

@@ -4,8 +4,8 @@ import { useFetchClient } from "@strapi/strapi/admin";
 import styled, { css, keyframes } from "styled-components";
 import { Loader, Typography, Box, Flex, Badge } from "@strapi/design-system";
 import { ChartBubble, Crown, User, Clock, Monitor } from "@strapi/icons";
-import { a as pluginId } from "./index-B0wQeSSu.mjs";
-import { u as useLicense } from "./useLicense-RxDUbCoU.mjs";
+import { a as pluginId } from "./index-DuVZXuJh.mjs";
+import { u as useLicense } from "./useLicense-Xzo6nyh3.mjs";
 const theme = {
   shadows: {
     sm: "0 1px 3px 0 rgba(0, 0, 0, 0.1)",

package/dist/_chunks/{App-CrdNlRlL.js → App-Bir8yK_r.js}

@@ -5,10 +5,10 @@ const react = require("react");
 const reactIntl = require("react-intl");
 const admin = require("@strapi/strapi/admin");
 const styled = require("styled-components");
-const index = require("./index-BEh2DizI.js");
+const index = require("./index-CKrO7KSQ.js");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
-const useLicense = require("./useLicense-DFdVp_qI.js");
+const useLicense = require("./useLicense-DHAFqFSZ.js");
 const StyledButtons = require("./StyledButtons-DDuxnYz8.js");
 const reactRouterDom = require("react-router-dom");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
@@ -2025,7 +2025,11 @@ const LicenseGuard = ({ children }) => {
   }
   return /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children });
 };
+const pluginId = "magic-sessionmanager";
+const pluginPermissions = {
+  access: [{ action: `plugin::${pluginId}.access`, subject: null }]
+};
 const App = () => {
-  return /* @__PURE__ */ jsxRuntime.jsx(LicenseGuard, { children: /* @__PURE__ */ jsxRuntime.jsx(HomePage, {}) });
+  return /* @__PURE__ */ jsxRuntime.jsx(admin.Page.Protect, { permissions: pluginPermissions.access, children: /* @__PURE__ */ jsxRuntime.jsx(LicenseGuard, { children: /* @__PURE__ */ jsxRuntime.jsx(HomePage, {}) }) });
 };
 exports.default = App;

package/dist/_chunks/{App-BkFz8R3I.mjs → App-LfsjcXXp.mjs}

@@ -1,12 +1,12 @@
 import { jsx, jsxs, Fragment } from "react/jsx-runtime";
 import { useState, useEffect } from "react";
 import { useIntl } from "react-intl";
-import { useFetchClient, useNotification } from "@strapi/strapi/admin";
+import { useFetchClient, useNotification, Page } from "@strapi/strapi/admin";
 import styled, { css, keyframes } from "styled-components";
-import { p as parseUserAgent, a as pluginId, g as getTranslation } from "./index-B0wQeSSu.mjs";
+import { p as parseUserAgent, a as pluginId$1, g as getTranslation } from "./index-DuVZXuJh.mjs";
 import { Modal, Flex, Box, Typography, Divider, Button, Loader, SingleSelect, SingleSelectOption, Thead, Tr, Th, Tbody, Td, Table, TextInput } from "@strapi/design-system";
 import { Check, Information, Monitor, Server, Clock, Cross, Earth, Shield, Crown, Phone, Download, User, Eye, Trash, Search, Key } from "@strapi/icons";
-import { u as useLicense } from "./useLicense-RxDUbCoU.mjs";
+import { u as useLicense } from "./useLicense-Xzo6nyh3.mjs";
 import { S as ShowHideButton, T as TertiaryButton, D as DangerButton, I as IconButtonPrimary, a as IconButtonWarning, b as IconButtonDanger } from "./StyledButtons-Cz8oYhmc.mjs";
 import { useNavigate } from "react-router-dom";
 const theme = {
@@ -145,7 +145,7 @@ const SessionDetailModal = ({ session, onClose, onSessionTerminated }) => {
   const fetchGeolocationData = async () => {
     setGeoLoading(true);
     try {
-      const { data } = await get(`/${pluginId}/geolocation/${session.ipAddress}`);
+      const { data } = await get(`/${pluginId$1}/geolocation/${session.ipAddress}`);
       setGeoData(data.data);
     } catch (err) {
       console.error("[SessionDetailModal] Error fetching geolocation:", err);
@@ -185,7 +185,7 @@ const SessionDetailModal = ({ session, onClose, onSessionTerminated }) => {
     }
     setTerminating(true);
     try {
-      await post(`/${pluginId}/sessions/${session.id}/terminate`);
+      await post(`/${pluginId$1}/sessions/${session.id}/terminate`);
       toggleNotification({
         type: "success",
         message: t("notifications.success.terminated", "Session terminated successfully")
@@ -889,7 +889,7 @@ const HomePage = () => {
   const fetchSessions = async () => {
     setLoading(true);
     try {
-      const { data } = await get(`/${pluginId}/sessions`);
+      const { data } = await get(`/${pluginId$1}/sessions`);
       setSessions(data.data || []);
     } catch (err) {
       console.error("[SessionManager] Error fetching sessions:", err);
@@ -902,7 +902,7 @@ const HomePage = () => {
       return;
     }
     try {
-      await post(`/${pluginId}/sessions/${sessionId}/terminate`);
+      await post(`/${pluginId$1}/sessions/${sessionId}/terminate`);
       fetchSessions();
     } catch (err) {
       console.error("[SessionManager] Error terminating session:", err);
@@ -913,7 +913,7 @@ const HomePage = () => {
       return;
     }
     try {
-      await del(`/${pluginId}/sessions/${sessionId}`);
+      await del(`/${pluginId$1}/sessions/${sessionId}`);
       fetchSessions();
       toggleNotification({
         type: "success",
@@ -1645,7 +1645,7 @@ const LicenseGuard = ({ children }) => {
   const checkLicenseStatus = async () => {
     setIsChecking(true);
     try {
-      const response = await get(`/${pluginId}/license/status`);
+      const response = await get(`/${pluginId$1}/license/status`);
       if (response.data.valid) {
         setNeedsLicense(false);
       } else {
@@ -1662,7 +1662,7 @@ const LicenseGuard = ({ children }) => {
     e.preventDefault();
     setIsCreating(true);
     try {
-      const response = await post(`/${pluginId}/license/auto-create`, {});
+      const response = await post(`/${pluginId$1}/license/auto-create`, {});
       if (response.data && response.data.success) {
         toggleNotification({
           type: "success",
@@ -1696,7 +1696,7 @@ const LicenseGuard = ({ children }) => {
     }
     setIsCreating(true);
     try {
-      const response = await post(`/${pluginId}/license/create`, formData);
+      const response = await post(`/${pluginId$1}/license/create`, formData);
       if (response.data && response.data.success) {
         toggleNotification({
           type: "success",
@@ -1729,7 +1729,7 @@ const LicenseGuard = ({ children }) => {
     }
     setIsCreating(true);
     try {
-      const response = await post(`/${pluginId}/license/store-key`, {
+      const response = await post(`/${pluginId$1}/license/store-key`, {
         licenseKey: existingLicenseKey.trim(),
         email: existingEmail.trim()
       });
@@ -2021,8 +2021,12 @@ const LicenseGuard = ({ children }) => {
   }
   return /* @__PURE__ */ jsx(Fragment, { children });
 };
+const pluginId = "magic-sessionmanager";
+const pluginPermissions = {
+  access: [{ action: `plugin::${pluginId}.access`, subject: null }]
+};
 const App = () => {
-  return /* @__PURE__ */ jsx(LicenseGuard, { children: /* @__PURE__ */ jsx(HomePage, {}) });
+  return /* @__PURE__ */ jsx(Page.Protect, { permissions: pluginPermissions.access, children: /* @__PURE__ */ jsx(LicenseGuard, { children: /* @__PURE__ */ jsx(HomePage, {}) }) });
 };
 export {
   App as default

package/dist/_chunks/{License-BI04KWfw.js → License-B56Xklj2.js}

@@ -6,7 +6,7 @@ const designSystem = require("@strapi/design-system");
 const admin = require("@strapi/strapi/admin");
 const icons = require("@strapi/icons");
 const styled = require("styled-components");
-const index = require("./index-BEh2DizI.js");
+const index = require("./index-CKrO7KSQ.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);
 const theme = {

package/dist/_chunks/{License-BnbIePhc.mjs → License-OToijT0s.mjs}

@@ -4,7 +4,7 @@ import { Loader, Box, Alert, Flex, Typography, Button, Badge, Accordion } from "
 import { useFetchClient, useNotification } from "@strapi/strapi/admin";
 import { ArrowClockwise, Duplicate, Download, User, Shield, Sparkle, ChartBubble } from "@strapi/icons";
 import styled, { css, keyframes } from "styled-components";
-import { a as pluginId } from "./index-B0wQeSSu.mjs";
+import { a as pluginId } from "./index-DuVZXuJh.mjs";
 const theme = {
   borderRadius: { lg: "12px" }
 };

package/dist/_chunks/{OnlineUsersWidget-D1B_2ge5.js → OnlineUsersWidget-DTEzguhS.js}

@@ -6,7 +6,7 @@ const reactIntl = require("react-intl");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
 const admin = require("@strapi/strapi/admin");
-const index = require("./index-BEh2DizI.js");
+const index = require("./index-CKrO7KSQ.js");
 const OnlineUsersWidget = () => {
   const { formatMessage } = reactIntl.useIntl();
   const { get } = admin.useFetchClient();

package/dist/_chunks/{OnlineUsersWidget-eBwttUiU.mjs → OnlineUsersWidget-Fpc0aH2z.mjs}

@@ -4,7 +4,7 @@ import { useIntl } from "react-intl";
 import { Box, Typography, Flex, Grid } from "@strapi/design-system";
 import { Check, Cross, Clock, User } from "@strapi/icons";
 import { useFetchClient } from "@strapi/strapi/admin";
-import { g as getTranslation } from "./index-B0wQeSSu.mjs";
+import { g as getTranslation } from "./index-DuVZXuJh.mjs";
 const OnlineUsersWidget = () => {
   const { formatMessage } = useIntl();
   const { get } = useFetchClient();

package/dist/_chunks/{Settings-BfKDErt5.mjs → Settings-Bz3lPBJ6.mjs}

@@ -3,10 +3,10 @@ import { useState, useEffect } from "react";
 import { useIntl } from "react-intl";
 import { Flex, Loader, Typography, Button, Box, Badge, Accordion, Grid, SingleSelect, SingleSelectOption, Divider, Alert, TextInput, Toggle, NumberInput, Checkbox, Tabs } from "@strapi/design-system";
 import { useFetchClient, useNotification } from "@strapi/strapi/admin";
-import { Check, Information, Cog, Trash, Shield, Code, Duplicate, Mail } from "@strapi/icons";
+import { Check, Information, Cog, Trash, Shield, Code, Duplicate, Clock, Mail } from "@strapi/icons";
 import styled, { css, keyframes } from "styled-components";
-import { a as pluginId, g as getTranslation } from "./index-B0wQeSSu.mjs";
-import { u as useLicense } from "./useLicense-RxDUbCoU.mjs";
+import { a as pluginId, g as getTranslation } from "./index-DuVZXuJh.mjs";
+import { u as useLicense } from "./useLicense-Xzo6nyh3.mjs";
 import { D as DangerButton, S as ShowHideButton, G as GradientButton, C as CopyButton, T as TertiaryButton, c as SecondaryButton } from "./StyledButtons-Cz8oYhmc.mjs";
 const theme = {
   borderRadius: { md: "8px", lg: "12px" }
@@ -345,6 +345,9 @@ const SettingsPage = () => {
     cleanupInterval: 30,
     lastSeenRateLimit: 30,
     retentionDays: 90,
+    maxSessionAgeDays: 30,
+    strictSessionEnforcement: false,
+    trustedProxies: false,
     enableGeolocation: true,
     enableSecurityScoring: true,
     blockSuspiciousSessions: false,
@@ -783,6 +786,119 @@ const SettingsPage = () => {
                 ] })
               }
             ),
+            /* @__PURE__ */ jsx(
+              Box,
+              {
+                background: "neutral0",
+                padding: 6,
+                style: {
+                  borderRadius: theme.borderRadius.lg,
+                  marginBottom: "32px",
+                  border: `2px solid ${settings.strictSessionEnforcement ? "rgba(220, 38, 38, 0.25)" : "rgba(2, 132, 199, 0.12)"}`,
+                  background: settings.strictSessionEnforcement ? "rgba(220, 38, 38, 0.04)" : "rgba(2, 132, 199, 0.04)"
+                },
+                children: /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 4, children: [
+                  /* @__PURE__ */ jsxs(Flex, { alignItems: "center", gap: 3, children: [
+                    /* @__PURE__ */ jsx(Shield, { style: { width: 24, height: 24, color: settings.strictSessionEnforcement ? "var(--colors-danger600, #DC2626)" : "var(--colors-primary600, #0284C7)" } }),
+                    /* @__PURE__ */ jsx(Typography, { variant: "delta", fontWeight: "bold", children: t("settings.security.enforcement.title", "Session Enforcement Policy") }),
+                    /* @__PURE__ */ jsx(Badge, { backgroundColor: settings.strictSessionEnforcement ? "danger100" : "neutral100", textColor: settings.strictSessionEnforcement ? "danger700" : "neutral700", children: settings.strictSessionEnforcement ? t("settings.security.enforcement.badgeStrict", "STRICT") : t("settings.security.enforcement.badgeRelaxed", "RELAXED") })
+                  ] }),
+                  /* @__PURE__ */ jsx(Typography, { variant: "omega", textColor: "neutral600", style: { lineHeight: 1.6 }, children: t("settings.security.enforcement.description", "Controls how aggressively JWT tokens are tied to an active session record. Strict mode rejects any token without a matching session, which is more secure but breaks tokens issued before this plugin was installed.") }),
+                  /* @__PURE__ */ jsxs(Grid.Root, { gap: 6, children: [
+                    /* @__PURE__ */ jsx(Grid.Item, { col: 12, s: 12, children: /* @__PURE__ */ jsx(
+                      ToggleCard,
+                      {
+                        $active: settings.strictSessionEnforcement,
+                        onClick: () => handleChange("strictSessionEnforcement", !settings.strictSessionEnforcement),
+                        children: /* @__PURE__ */ jsxs(Flex, { direction: "row", gap: 4, style: { width: "100%" }, alignItems: "center", children: [
+                          /* @__PURE__ */ jsx(GreenToggle, { $isActive: settings.strictSessionEnforcement, children: /* @__PURE__ */ jsx(
+                            Toggle,
+                            {
+                              checked: settings.strictSessionEnforcement,
+                              onChange: () => handleChange("strictSessionEnforcement", !settings.strictSessionEnforcement)
+                            }
+                          ) }),
+                          /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 1, style: { flex: 1 }, children: [
+                            /* @__PURE__ */ jsx(
+                              Typography,
+                              {
+                                variant: "delta",
+                                fontWeight: "bold",
+                                textColor: settings.strictSessionEnforcement ? "success700" : "neutral800",
+                                style: { fontSize: "15px" },
+                                children: t("settings.security.enforcement.strict.title", "Strict Session Enforcement")
+                              }
+                            ),
+                            /* @__PURE__ */ jsx(Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "12px", lineHeight: "1.5" }, children: t("settings.security.enforcement.strict.description", "Reject every authenticated request that does not have a matching session record. Recommended for production.") })
+                          ] })
+                        ] })
+                      }
+                    ) }),
+                    /* @__PURE__ */ jsx(Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsxs(Box, { children: [
+                      /* @__PURE__ */ jsxs(Typography, { variant: "pi", fontWeight: "bold", style: { marginBottom: "8px", display: "block" }, children: [
+                        /* @__PURE__ */ jsx(Clock, { style: { width: 14, height: 14, verticalAlign: "middle", marginRight: 6 } }),
+                        t("settings.security.enforcement.maxAge.title", "Max Session Age")
+                      ] }),
+                      /* @__PURE__ */ jsxs(
+                        SingleSelect,
+                        {
+                          value: String(settings.maxSessionAgeDays),
+                          onChange: (value) => handleChange("maxSessionAgeDays", parseInt(value)),
+                          children: [
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "1", children: t("settings.security.enforcement.maxAge.1day", "1 day (Very Strict)") }),
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "7", children: t("settings.security.enforcement.maxAge.7days", "7 days") }),
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "14", children: t("settings.security.enforcement.maxAge.14days", "14 days") }),
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "30", children: t("settings.security.enforcement.maxAge.30days", "30 days (Recommended)") }),
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "60", children: t("settings.security.enforcement.maxAge.60days", "60 days") }),
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "90", children: t("settings.security.enforcement.maxAge.90days", "90 days") }),
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "180", children: t("settings.security.enforcement.maxAge.180days", "180 days") }),
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "365", children: t("settings.security.enforcement.maxAge.365days", "1 year") })
+                          ]
+                        }
+                      ),
+                      /* @__PURE__ */ jsx(Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "11px", marginTop: "8px" }, children: t("settings.security.enforcement.maxAge.hint", "Sessions older than {days} days are automatically terminated, even if still active", { days: settings.maxSessionAgeDays }) })
+                    ] }) }),
+                    /* @__PURE__ */ jsx(Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsx(
+                      ToggleCard,
+                      {
+                        $active: settings.trustedProxies,
+                        onClick: () => handleChange("trustedProxies", !settings.trustedProxies),
+                        children: /* @__PURE__ */ jsxs(Flex, { direction: "row", gap: 4, style: { width: "100%" }, alignItems: "center", children: [
+                          /* @__PURE__ */ jsx(GreenToggle, { $isActive: settings.trustedProxies, children: /* @__PURE__ */ jsx(
+                            Toggle,
+                            {
+                              checked: settings.trustedProxies,
+                              onChange: () => handleChange("trustedProxies", !settings.trustedProxies)
+                            }
+                          ) }),
+                          /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 1, style: { flex: 1 }, children: [
+                            /* @__PURE__ */ jsx(
+                              Typography,
+                              {
+                                variant: "delta",
+                                fontWeight: "bold",
+                                textColor: settings.trustedProxies ? "success700" : "neutral800",
+                                style: { fontSize: "15px" },
+                                children: t("settings.security.enforcement.trustedProxies.title", "Trust Upstream Proxy")
+                              }
+                            ),
+                            /* @__PURE__ */ jsx(Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "12px", lineHeight: "1.5" }, children: t("settings.security.enforcement.trustedProxies.description", "Only enable when Strapi sits behind a trusted reverse proxy (nginx, Cloudflare). Otherwise clients can spoof X-Forwarded-For.") })
+                          ] })
+                        ] })
+                      }
+                    ) })
+                  ] }),
+                  !settings.strictSessionEnforcement && /* @__PURE__ */ jsx(
+                    Alert,
+                    {
+                      variant: "warning",
+                      title: t("settings.security.enforcement.warning.title", "Running in Relaxed Mode"),
+                      children: t("settings.security.enforcement.warning.body", "Tokens without a matching session record are allowed through. Manual session termination is still enforced via the token hash, but we strongly recommend enabling strict mode in production.")
+                    }
+                  )
+                ] })
+              }
+            ),
             /* @__PURE__ */ jsx(Box, { background: "neutral100", padding: 5, style: { borderRadius: theme.borderRadius.md, marginBottom: "32px" }, children: /* @__PURE__ */ jsxs(Grid.Root, { gap: 4, children: [
               /* @__PURE__ */ jsx(Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsx(
                 ToggleCard,

package/dist/_chunks/{Settings-Cy-6vah_.js → Settings-CO3-iggu.js}

@@ -7,8 +7,8 @@ const designSystem = require("@strapi/design-system");
 const admin = require("@strapi/strapi/admin");
 const icons = require("@strapi/icons");
 const styled = require("styled-components");
-const index = require("./index-BEh2DizI.js");
-const useLicense = require("./useLicense-DFdVp_qI.js");
+const index = require("./index-CKrO7KSQ.js");
+const useLicense = require("./useLicense-DHAFqFSZ.js");
 const StyledButtons = require("./StyledButtons-DDuxnYz8.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);
@@ -349,6 +349,9 @@ const SettingsPage = () => {
     cleanupInterval: 30,
     lastSeenRateLimit: 30,
     retentionDays: 90,
+    maxSessionAgeDays: 30,
+    strictSessionEnforcement: false,
+    trustedProxies: false,
     enableGeolocation: true,
     enableSecurityScoring: true,
     blockSuspiciousSessions: false,
@@ -787,6 +790,119 @@ const SettingsPage = () => {
                 ] })
               }
             ),
+            /* @__PURE__ */ jsxRuntime.jsx(
+              designSystem.Box,
+              {
+                background: "neutral0",
+                padding: 6,
+                style: {
+                  borderRadius: theme.borderRadius.lg,
+                  marginBottom: "32px",
+                  border: `2px solid ${settings.strictSessionEnforcement ? "rgba(220, 38, 38, 0.25)" : "rgba(2, 132, 199, 0.12)"}`,
+                  background: settings.strictSessionEnforcement ? "rgba(220, 38, 38, 0.04)" : "rgba(2, 132, 199, 0.04)"
+                },
+                children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 4, children: [
+                  /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { alignItems: "center", gap: 3, children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(icons.Shield, { style: { width: 24, height: 24, color: settings.strictSessionEnforcement ? "var(--colors-danger600, #DC2626)" : "var(--colors-primary600, #0284C7)" } }),
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "delta", fontWeight: "bold", children: t("settings.security.enforcement.title", "Session Enforcement Policy") }),
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Badge, { backgroundColor: settings.strictSessionEnforcement ? "danger100" : "neutral100", textColor: settings.strictSessionEnforcement ? "danger700" : "neutral700", children: settings.strictSessionEnforcement ? t("settings.security.enforcement.badgeStrict", "STRICT") : t("settings.security.enforcement.badgeRelaxed", "RELAXED") })
+                  ] }),
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", textColor: "neutral600", style: { lineHeight: 1.6 }, children: t("settings.security.enforcement.description", "Controls how aggressively JWT tokens are tied to an active session record. Strict mode rejects any token without a matching session, which is more secure but breaks tokens issued before this plugin was installed.") }),
+                  /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Grid.Root, { gap: 6, children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 12, s: 12, children: /* @__PURE__ */ jsxRuntime.jsx(
+                      ToggleCard,
+                      {
+                        $active: settings.strictSessionEnforcement,
+                        onClick: () => handleChange("strictSessionEnforcement", !settings.strictSessionEnforcement),
+                        children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "row", gap: 4, style: { width: "100%" }, alignItems: "center", children: [
+                          /* @__PURE__ */ jsxRuntime.jsx(GreenToggle, { $isActive: settings.strictSessionEnforcement, children: /* @__PURE__ */ jsxRuntime.jsx(
+                            designSystem.Toggle,
+                            {
+                              checked: settings.strictSessionEnforcement,
+                              onChange: () => handleChange("strictSessionEnforcement", !settings.strictSessionEnforcement)
+                            }
+                          ) }),
+                          /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 1, style: { flex: 1 }, children: [
+                            /* @__PURE__ */ jsxRuntime.jsx(
+                              designSystem.Typography,
+                              {
+                                variant: "delta",
+                                fontWeight: "bold",
+                                textColor: settings.strictSessionEnforcement ? "success700" : "neutral800",
+                                style: { fontSize: "15px" },
+                                children: t("settings.security.enforcement.strict.title", "Strict Session Enforcement")
+                              }
+                            ),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "12px", lineHeight: "1.5" }, children: t("settings.security.enforcement.strict.description", "Reject every authenticated request that does not have a matching session record. Recommended for production.") })
+                          ] })
+                        ] })
+                      }
+                    ) }),
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { children: [
+                      /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Typography, { variant: "pi", fontWeight: "bold", style: { marginBottom: "8px", display: "block" }, children: [
+                        /* @__PURE__ */ jsxRuntime.jsx(icons.Clock, { style: { width: 14, height: 14, verticalAlign: "middle", marginRight: 6 } }),
+                        t("settings.security.enforcement.maxAge.title", "Max Session Age")
+                      ] }),
+                      /* @__PURE__ */ jsxRuntime.jsxs(
+                        designSystem.SingleSelect,
+                        {
+                          value: String(settings.maxSessionAgeDays),
+                          onChange: (value) => handleChange("maxSessionAgeDays", parseInt(value)),
+                          children: [
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "1", children: t("settings.security.enforcement.maxAge.1day", "1 day (Very Strict)") }),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "7", children: t("settings.security.enforcement.maxAge.7days", "7 days") }),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "14", children: t("settings.security.enforcement.maxAge.14days", "14 days") }),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "30", children: t("settings.security.enforcement.maxAge.30days", "30 days (Recommended)") }),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "60", children: t("settings.security.enforcement.maxAge.60days", "60 days") }),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "90", children: t("settings.security.enforcement.maxAge.90days", "90 days") }),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "180", children: t("settings.security.enforcement.maxAge.180days", "180 days") }),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "365", children: t("settings.security.enforcement.maxAge.365days", "1 year") })
+                          ]
+                        }
+                      ),
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "11px", marginTop: "8px" }, children: t("settings.security.enforcement.maxAge.hint", "Sessions older than {days} days are automatically terminated, even if still active", { days: settings.maxSessionAgeDays }) })
+                    ] }) }),
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsxRuntime.jsx(
+                      ToggleCard,
+                      {
+                        $active: settings.trustedProxies,
+                        onClick: () => handleChange("trustedProxies", !settings.trustedProxies),
+                        children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "row", gap: 4, style: { width: "100%" }, alignItems: "center", children: [
+                          /* @__PURE__ */ jsxRuntime.jsx(GreenToggle, { $isActive: settings.trustedProxies, children: /* @__PURE__ */ jsxRuntime.jsx(
+                            designSystem.Toggle,
+                            {
+                              checked: settings.trustedProxies,
+                              onChange: () => handleChange("trustedProxies", !settings.trustedProxies)
+                            }
+                          ) }),
+                          /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 1, style: { flex: 1 }, children: [
+                            /* @__PURE__ */ jsxRuntime.jsx(
+                              designSystem.Typography,
+                              {
+                                variant: "delta",
+                                fontWeight: "bold",
+                                textColor: settings.trustedProxies ? "success700" : "neutral800",
+                                style: { fontSize: "15px" },
+                                children: t("settings.security.enforcement.trustedProxies.title", "Trust Upstream Proxy")
+                              }
+                            ),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "12px", lineHeight: "1.5" }, children: t("settings.security.enforcement.trustedProxies.description", "Only enable when Strapi sits behind a trusted reverse proxy (nginx, Cloudflare). Otherwise clients can spoof X-Forwarded-For.") })
+                          ] })
+                        ] })
+                      }
+                    ) })
+                  ] }),
+                  !settings.strictSessionEnforcement && /* @__PURE__ */ jsxRuntime.jsx(
+                    designSystem.Alert,
+                    {
+                      variant: "warning",
+                      title: t("settings.security.enforcement.warning.title", "Running in Relaxed Mode"),
+                      children: t("settings.security.enforcement.warning.body", "Tokens without a matching session record are allowed through. Manual session termination is still enforced via the token hash, but we strongly recommend enabling strict mode in production.")
+                    }
+                  )
+                ] })
+              }
+            ),
             /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { background: "neutral100", padding: 5, style: { borderRadius: theme.borderRadius.md, marginBottom: "32px" }, children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Grid.Root, { gap: 4, children: [
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsxRuntime.jsx(
                 ToggleCard,

package/dist/_chunks/{UpgradePage-B8kz6Cyz.js → UpgradePage-KqUN7mDh.js}

@@ -6,7 +6,7 @@ const admin = require("@strapi/strapi/admin");
 const styled = require("styled-components");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
-const index = require("./index-BEh2DizI.js");
+const index = require("./index-CKrO7KSQ.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);
 const Container = styled__default.default(designSystem.Box)`

package/dist/_chunks/{UpgradePage-2mV2iqDM.mjs → UpgradePage-TBx1l2mQ.mjs}

@@ -4,7 +4,7 @@ import { useFetchClient, useNotification } from "@strapi/strapi/admin";
 import styled from "styled-components";
 import { Flex, Typography, Box, Badge, Button } from "@strapi/design-system";
 import { Check, Cross, Sparkle, Lightning, Rocket } from "@strapi/icons";
-import { a as pluginId } from "./index-B0wQeSSu.mjs";
+import { a as pluginId } from "./index-DuVZXuJh.mjs";
 const Container = styled(Box)`
   padding: 32px;
   max-width: 1400px;

package/dist/_chunks/{index-BEh2DizI.js → index-CKrO7KSQ.js}

@@ -436,6 +436,7 @@ const prefixPluginTranslations = (data, pluginId2) => {
 const name = pluginPkg.strapi.name;
 const index = {
   register(app) {
+    const pluginPermissions = [{ action: `plugin::${pluginId}.access`, subject: null }];
     app.addMenuLink({
       to: `plugins/${pluginId}`,
       icon: PluginIcon,
@@ -443,7 +444,8 @@ const index = {
         id: `${pluginId}.plugin.name`,
         defaultMessage: pluginPkg.strapi.displayName
       },
-      Component: () => Promise.resolve().then(() => require("./App-CrdNlRlL.js"))
+      Component: () => Promise.resolve().then(() => require("./App-Bir8yK_r.js")),
+      permissions: pluginPermissions
     });
     app.createSettingSection(
       {
@@ -459,7 +461,8 @@ const index = {
           },
           id: "upgrade",
           to: `${pluginId}/upgrade`,
-          Component: () => Promise.resolve().then(() => require("./UpgradePage-B8kz6Cyz.js"))
+          Component: () => Promise.resolve().then(() => require("./UpgradePage-KqUN7mDh.js")),
+          permissions: pluginPermissions
         },
         {
           intlLabel: {
@@ -468,7 +471,8 @@ const index = {
           },
           id: "general",
           to: `${pluginId}/general`,
-          Component: () => Promise.resolve().then(() => require("./Settings-Cy-6vah_.js"))
+          Component: () => Promise.resolve().then(() => require("./Settings-CO3-iggu.js")),
+          permissions: pluginPermissions
         },
         {
           intlLabel: {
@@ -477,7 +481,8 @@ const index = {
           },
           id: "analytics",
           to: `${pluginId}/analytics`,
-          Component: () => Promise.resolve().then(() => require("./Analytics-mFarhu5A.js"))
+          Component: () => Promise.resolve().then(() => require("./Analytics-B7t0WvG7.js")),
+          permissions: pluginPermissions
         },
         {
           intlLabel: {
@@ -486,7 +491,8 @@ const index = {
           },
           id: "license",
           to: `${pluginId}/license`,
-          Component: () => Promise.resolve().then(() => require("./License-BI04KWfw.js"))
+          Component: () => Promise.resolve().then(() => require("./License-B56Xklj2.js")),
+          permissions: pluginPermissions
         }
       ]
     );
@@ -504,7 +510,7 @@ const index = {
           defaultMessage: "Online Users"
         },
         component: async () => {
-          const component = await Promise.resolve().then(() => require("./OnlineUsersWidget-D1B_2ge5.js"));
+          const component = await Promise.resolve().then(() => require("./OnlineUsersWidget-DTEzguhS.js"));
           return component.default;
         },
         id: "online-users-widget",