strapi-plugin-magic-sessionmanager 4.4.7 → 4.5.1

package/dist/_chunks/{Analytics-mFarhu5A.js → Analytics-Cp-WjeV3.js}

@@ -6,8 +6,8 @@ const admin = require("@strapi/strapi/admin");
 const styled = require("styled-components");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
-const index = require("./index-BEh2DizI.js");
-const useLicense = require("./useLicense-DFdVp_qI.js");
+const index = require("./index-BRESWp1b.js");
+const useLicense = require("./useLicense-D_wQcoMn.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);
 const theme = {

package/dist/_chunks/{Analytics-CFlATYIp.mjs → Analytics-DQyamHg6.mjs}

@@ -4,8 +4,8 @@ import { useFetchClient } from "@strapi/strapi/admin";
 import styled, { css, keyframes } from "styled-components";
 import { Loader, Typography, Box, Flex, Badge } from "@strapi/design-system";
 import { ChartBubble, Crown, User, Clock, Monitor } from "@strapi/icons";
-import { a as pluginId } from "./index-B0wQeSSu.mjs";
-import { u as useLicense } from "./useLicense-RxDUbCoU.mjs";
+import { a as pluginId } from "./index-BbbrBv3t.mjs";
+import { u as useLicense } from "./useLicense-Bszkymz3.mjs";
 const theme = {
   shadows: {
     sm: "0 1px 3px 0 rgba(0, 0, 0, 0.1)",

package/dist/_chunks/{App-CrdNlRlL.js → App-BvYLeEbF.js}

@@ -5,10 +5,10 @@ const react = require("react");
 const reactIntl = require("react-intl");
 const admin = require("@strapi/strapi/admin");
 const styled = require("styled-components");
-const index = require("./index-BEh2DizI.js");
+const index = require("./index-BRESWp1b.js");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
-const useLicense = require("./useLicense-DFdVp_qI.js");
+const useLicense = require("./useLicense-D_wQcoMn.js");
 const StyledButtons = require("./StyledButtons-DDuxnYz8.js");
 const reactRouterDom = require("react-router-dom");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
@@ -2025,7 +2025,11 @@ const LicenseGuard = ({ children }) => {
   }
   return /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children });
 };
+const pluginId = "magic-sessionmanager";
+const pluginPermissions = {
+  access: [{ action: `plugin::${pluginId}.access`, subject: null }]
+};
 const App = () => {
-  return /* @__PURE__ */ jsxRuntime.jsx(LicenseGuard, { children: /* @__PURE__ */ jsxRuntime.jsx(HomePage, {}) });
+  return /* @__PURE__ */ jsxRuntime.jsx(admin.Page.Protect, { permissions: pluginPermissions.access, children: /* @__PURE__ */ jsxRuntime.jsx(LicenseGuard, { children: /* @__PURE__ */ jsxRuntime.jsx(HomePage, {}) }) });
 };
 exports.default = App;

package/dist/_chunks/{App-BkFz8R3I.mjs → App-CN4bKWV9.mjs}

@@ -1,12 +1,12 @@
 import { jsx, jsxs, Fragment } from "react/jsx-runtime";
 import { useState, useEffect } from "react";
 import { useIntl } from "react-intl";
-import { useFetchClient, useNotification } from "@strapi/strapi/admin";
+import { useFetchClient, useNotification, Page } from "@strapi/strapi/admin";
 import styled, { css, keyframes } from "styled-components";
-import { p as parseUserAgent, a as pluginId, g as getTranslation } from "./index-B0wQeSSu.mjs";
+import { p as parseUserAgent, a as pluginId$1, g as getTranslation } from "./index-BbbrBv3t.mjs";
 import { Modal, Flex, Box, Typography, Divider, Button, Loader, SingleSelect, SingleSelectOption, Thead, Tr, Th, Tbody, Td, Table, TextInput } from "@strapi/design-system";
 import { Check, Information, Monitor, Server, Clock, Cross, Earth, Shield, Crown, Phone, Download, User, Eye, Trash, Search, Key } from "@strapi/icons";
-import { u as useLicense } from "./useLicense-RxDUbCoU.mjs";
+import { u as useLicense } from "./useLicense-Bszkymz3.mjs";
 import { S as ShowHideButton, T as TertiaryButton, D as DangerButton, I as IconButtonPrimary, a as IconButtonWarning, b as IconButtonDanger } from "./StyledButtons-Cz8oYhmc.mjs";
 import { useNavigate } from "react-router-dom";
 const theme = {
@@ -145,7 +145,7 @@ const SessionDetailModal = ({ session, onClose, onSessionTerminated }) => {
   const fetchGeolocationData = async () => {
     setGeoLoading(true);
     try {
-      const { data } = await get(`/${pluginId}/geolocation/${session.ipAddress}`);
+      const { data } = await get(`/${pluginId$1}/geolocation/${session.ipAddress}`);
       setGeoData(data.data);
     } catch (err) {
       console.error("[SessionDetailModal] Error fetching geolocation:", err);
@@ -185,7 +185,7 @@ const SessionDetailModal = ({ session, onClose, onSessionTerminated }) => {
     }
     setTerminating(true);
     try {
-      await post(`/${pluginId}/sessions/${session.id}/terminate`);
+      await post(`/${pluginId$1}/sessions/${session.id}/terminate`);
       toggleNotification({
         type: "success",
         message: t("notifications.success.terminated", "Session terminated successfully")
@@ -889,7 +889,7 @@ const HomePage = () => {
   const fetchSessions = async () => {
     setLoading(true);
     try {
-      const { data } = await get(`/${pluginId}/sessions`);
+      const { data } = await get(`/${pluginId$1}/sessions`);
       setSessions(data.data || []);
     } catch (err) {
       console.error("[SessionManager] Error fetching sessions:", err);
@@ -902,7 +902,7 @@ const HomePage = () => {
       return;
     }
     try {
-      await post(`/${pluginId}/sessions/${sessionId}/terminate`);
+      await post(`/${pluginId$1}/sessions/${sessionId}/terminate`);
       fetchSessions();
     } catch (err) {
       console.error("[SessionManager] Error terminating session:", err);
@@ -913,7 +913,7 @@ const HomePage = () => {
       return;
     }
     try {
-      await del(`/${pluginId}/sessions/${sessionId}`);
+      await del(`/${pluginId$1}/sessions/${sessionId}`);
       fetchSessions();
       toggleNotification({
         type: "success",
@@ -1645,7 +1645,7 @@ const LicenseGuard = ({ children }) => {
   const checkLicenseStatus = async () => {
     setIsChecking(true);
     try {
-      const response = await get(`/${pluginId}/license/status`);
+      const response = await get(`/${pluginId$1}/license/status`);
       if (response.data.valid) {
         setNeedsLicense(false);
       } else {
@@ -1662,7 +1662,7 @@ const LicenseGuard = ({ children }) => {
     e.preventDefault();
     setIsCreating(true);
     try {
-      const response = await post(`/${pluginId}/license/auto-create`, {});
+      const response = await post(`/${pluginId$1}/license/auto-create`, {});
       if (response.data && response.data.success) {
         toggleNotification({
           type: "success",
@@ -1696,7 +1696,7 @@ const LicenseGuard = ({ children }) => {
     }
     setIsCreating(true);
     try {
-      const response = await post(`/${pluginId}/license/create`, formData);
+      const response = await post(`/${pluginId$1}/license/create`, formData);
       if (response.data && response.data.success) {
         toggleNotification({
           type: "success",
@@ -1729,7 +1729,7 @@ const LicenseGuard = ({ children }) => {
     }
     setIsCreating(true);
     try {
-      const response = await post(`/${pluginId}/license/store-key`, {
+      const response = await post(`/${pluginId$1}/license/store-key`, {
         licenseKey: existingLicenseKey.trim(),
         email: existingEmail.trim()
       });
@@ -2021,8 +2021,12 @@ const LicenseGuard = ({ children }) => {
   }
   return /* @__PURE__ */ jsx(Fragment, { children });
 };
+const pluginId = "magic-sessionmanager";
+const pluginPermissions = {
+  access: [{ action: `plugin::${pluginId}.access`, subject: null }]
+};
 const App = () => {
-  return /* @__PURE__ */ jsx(LicenseGuard, { children: /* @__PURE__ */ jsx(HomePage, {}) });
+  return /* @__PURE__ */ jsx(Page.Protect, { permissions: pluginPermissions.access, children: /* @__PURE__ */ jsx(LicenseGuard, { children: /* @__PURE__ */ jsx(HomePage, {}) }) });
 };
 export {
   App as default

package/dist/_chunks/{License-BnbIePhc.mjs → License-Bgcm630d.mjs}

@@ -4,7 +4,7 @@ import { Loader, Box, Alert, Flex, Typography, Button, Badge, Accordion } from "
 import { useFetchClient, useNotification } from "@strapi/strapi/admin";
 import { ArrowClockwise, Duplicate, Download, User, Shield, Sparkle, ChartBubble } from "@strapi/icons";
 import styled, { css, keyframes } from "styled-components";
-import { a as pluginId } from "./index-B0wQeSSu.mjs";
+import { a as pluginId } from "./index-BbbrBv3t.mjs";
 const theme = {
   borderRadius: { lg: "12px" }
 };

package/dist/_chunks/{License-BI04KWfw.js → License-DPyeZQWz.js}

@@ -6,7 +6,7 @@ const designSystem = require("@strapi/design-system");
 const admin = require("@strapi/strapi/admin");
 const icons = require("@strapi/icons");
 const styled = require("styled-components");
-const index = require("./index-BEh2DizI.js");
+const index = require("./index-BRESWp1b.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);
 const theme = {

package/dist/_chunks/{OnlineUsersWidget-D1B_2ge5.js → OnlineUsersWidget-BYnqhN3O.js}

@@ -6,7 +6,7 @@ const reactIntl = require("react-intl");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
 const admin = require("@strapi/strapi/admin");
-const index = require("./index-BEh2DizI.js");
+const index = require("./index-BRESWp1b.js");
 const OnlineUsersWidget = () => {
   const { formatMessage } = reactIntl.useIntl();
   const { get } = admin.useFetchClient();

package/dist/_chunks/{OnlineUsersWidget-eBwttUiU.mjs → OnlineUsersWidget-E2FA7rGi.mjs}

@@ -4,7 +4,7 @@ import { useIntl } from "react-intl";
 import { Box, Typography, Flex, Grid } from "@strapi/design-system";
 import { Check, Cross, Clock, User } from "@strapi/icons";
 import { useFetchClient } from "@strapi/strapi/admin";
-import { g as getTranslation } from "./index-B0wQeSSu.mjs";
+import { g as getTranslation } from "./index-BbbrBv3t.mjs";
 const OnlineUsersWidget = () => {
   const { formatMessage } = useIntl();
   const { get } = useFetchClient();

package/dist/_chunks/{Settings-Cy-6vah_.js → Settings-Bt6wy131.js}

@@ -7,8 +7,8 @@ const designSystem = require("@strapi/design-system");
 const admin = require("@strapi/strapi/admin");
 const icons = require("@strapi/icons");
 const styled = require("styled-components");
-const index = require("./index-BEh2DizI.js");
-const useLicense = require("./useLicense-DFdVp_qI.js");
+const index = require("./index-BRESWp1b.js");
+const useLicense = require("./useLicense-D_wQcoMn.js");
 const StyledButtons = require("./StyledButtons-DDuxnYz8.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);
@@ -349,6 +349,17 @@ const SettingsPage = () => {
     cleanupInterval: 30,
     lastSeenRateLimit: 30,
     retentionDays: 90,
+    maxSessionAgeDays: 30,
+    // Grace window (ms) during which a freshly-issued JWT is accepted
+    // without a matching session row. Prevents strict-session enforcement
+    // from blocking the very first request after login. 0 disables.
+    sessionCreationGraceMs: 5e3,
+    // Opt-in fast path for the periodic idle-session cleanup: single
+    // SQL UPDATE instead of batched Document-Service writes. Bypasses
+    // lifecycle hooks; required for very large installations.
+    cleanupUseDbDirect: false,
+    strictSessionEnforcement: false,
+    trustedProxies: false,
     enableGeolocation: true,
     enableSecurityScoring: true,
     blockSuspiciousSessions: false,
@@ -394,7 +405,7 @@ const SettingsPage = () => {
             }
           });
         }
-        setSettings(loadedSettings);
+        setSettings((prev) => ({ ...prev, ...loadedSettings }));
       } else {
         setSettings((prev) => ({ ...prev, emailTemplates: getDefaultTemplates() }));
       }
@@ -629,6 +640,45 @@ const SettingsPage = () => {
                 ),
                 /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "11px", marginTop: "8px" }, children: settings.retentionDays === -1 ? t("settings.general.retention.hintNever", "Old sessions deleted after never") : t("settings.general.retention.hint", "Old sessions deleted after {days}", { days: `${settings.retentionDays} days` }) })
               ] }) }),
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { children: [
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", fontWeight: "bold", style: { marginBottom: "8px", display: "block" }, children: t("settings.general.grace.title", "Post-Login Grace Period") }),
+                /* @__PURE__ */ jsxRuntime.jsxs(
+                  designSystem.SingleSelect,
+                  {
+                    value: String(settings.sessionCreationGraceMs ?? 5e3),
+                    onChange: (value) => handleChange("sessionCreationGraceMs", parseInt(value)),
+                    children: [
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "0", children: t("settings.general.grace.off", "Off (strict from first request)") }),
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "2000", children: t("settings.general.grace.2s", "2 seconds") }),
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "5000", children: t("settings.general.grace.5s", "5 seconds (Recommended)") }),
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "10000", children: t("settings.general.grace.10s", "10 seconds") }),
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "30000", children: t("settings.general.grace.30s", "30 seconds") })
+                    ]
+                  }
+                ),
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "11px", marginTop: "8px" }, children: t(
+                  "settings.general.grace.hint",
+                  "Accepts a freshly-issued JWT without a matching session row for this window, preventing strict-enforcement races right after login."
+                ) })
+              ] }) }),
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { children: [
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", fontWeight: "bold", style: { marginBottom: "8px", display: "block" }, children: t("settings.general.cleanupMode.title", "Cleanup Strategy") }),
+                /* @__PURE__ */ jsxRuntime.jsxs(
+                  designSystem.SingleSelect,
+                  {
+                    value: settings.cleanupUseDbDirect ? "db" : "document-service",
+                    onChange: (value) => handleChange("cleanupUseDbDirect", value === "db"),
+                    children: [
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "document-service", children: t("settings.general.cleanupMode.ds", "Document Service (Recommended, safe)") }),
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "db", children: t("settings.general.cleanupMode.db", "Direct SQL UPDATE (large-scale)") })
+                    ]
+                  }
+                ),
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "11px", marginTop: "8px" }, children: t(
+                  "settings.general.cleanupMode.hint",
+                  "Direct SQL drains the entire idle-session backlog in one statement but bypasses lifecycle hooks. Only switch if you run >50 k active sessions."
+                ) })
+              ] }) }),
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 12, children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { padding: 4, background: "danger100", style: { borderRadius: theme.borderRadius.md, border: `2px solid rgba(220, 38, 38, 0.2)` }, children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 3, alignItems: "flex-start", children: [
                 /* @__PURE__ */ jsxRuntime.jsx(icons.Trash, { style: { width: "18px", height: "18px", color: "var(--colors-danger600, #DC2626)", flexShrink: 0, marginTop: "2px" } }),
                 /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { style: { flex: 1 }, children: [
@@ -787,6 +837,119 @@ const SettingsPage = () => {
                 ] })
               }
             ),
+            /* @__PURE__ */ jsxRuntime.jsx(
+              designSystem.Box,
+              {
+                background: "neutral0",
+                padding: 6,
+                style: {
+                  borderRadius: theme.borderRadius.lg,
+                  marginBottom: "32px",
+                  border: `2px solid ${settings.strictSessionEnforcement ? "rgba(220, 38, 38, 0.25)" : "rgba(2, 132, 199, 0.12)"}`,
+                  background: settings.strictSessionEnforcement ? "rgba(220, 38, 38, 0.04)" : "rgba(2, 132, 199, 0.04)"
+                },
+                children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 4, children: [
+                  /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { alignItems: "center", gap: 3, children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(icons.Shield, { style: { width: 24, height: 24, color: settings.strictSessionEnforcement ? "var(--colors-danger600, #DC2626)" : "var(--colors-primary600, #0284C7)" } }),
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "delta", fontWeight: "bold", children: t("settings.security.enforcement.title", "Session Enforcement Policy") }),
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Badge, { backgroundColor: settings.strictSessionEnforcement ? "danger100" : "neutral100", textColor: settings.strictSessionEnforcement ? "danger700" : "neutral700", children: settings.strictSessionEnforcement ? t("settings.security.enforcement.badgeStrict", "STRICT") : t("settings.security.enforcement.badgeRelaxed", "RELAXED") })
+                  ] }),
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", textColor: "neutral600", style: { lineHeight: 1.6 }, children: t("settings.security.enforcement.description", "Controls how aggressively JWT tokens are tied to an active session record. Strict mode rejects any token without a matching session, which is more secure but breaks tokens issued before this plugin was installed.") }),
+                  /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Grid.Root, { gap: 6, children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 12, s: 12, children: /* @__PURE__ */ jsxRuntime.jsx(
+                      ToggleCard,
+                      {
+                        $active: settings.strictSessionEnforcement,
+                        onClick: () => handleChange("strictSessionEnforcement", !settings.strictSessionEnforcement),
+                        children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "row", gap: 4, style: { width: "100%" }, alignItems: "center", children: [
+                          /* @__PURE__ */ jsxRuntime.jsx(GreenToggle, { $isActive: settings.strictSessionEnforcement, children: /* @__PURE__ */ jsxRuntime.jsx(
+                            designSystem.Toggle,
+                            {
+                              checked: settings.strictSessionEnforcement,
+                              onChange: () => handleChange("strictSessionEnforcement", !settings.strictSessionEnforcement)
+                            }
+                          ) }),
+                          /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 1, style: { flex: 1 }, children: [
+                            /* @__PURE__ */ jsxRuntime.jsx(
+                              designSystem.Typography,
+                              {
+                                variant: "delta",
+                                fontWeight: "bold",
+                                textColor: settings.strictSessionEnforcement ? "success700" : "neutral800",
+                                style: { fontSize: "15px" },
+                                children: t("settings.security.enforcement.strict.title", "Strict Session Enforcement")
+                              }
+                            ),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "12px", lineHeight: "1.5" }, children: t("settings.security.enforcement.strict.description", "Reject every authenticated request that does not have a matching session record. Recommended for production.") })
+                          ] })
+                        ] })
+                      }
+                    ) }),
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { children: [
+                      /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Typography, { variant: "pi", fontWeight: "bold", style: { marginBottom: "8px", display: "block" }, children: [
+                        /* @__PURE__ */ jsxRuntime.jsx(icons.Clock, { style: { width: 14, height: 14, verticalAlign: "middle", marginRight: 6 } }),
+                        t("settings.security.enforcement.maxAge.title", "Max Session Age")
+                      ] }),
+                      /* @__PURE__ */ jsxRuntime.jsxs(
+                        designSystem.SingleSelect,
+                        {
+                          value: String(settings.maxSessionAgeDays),
+                          onChange: (value) => handleChange("maxSessionAgeDays", parseInt(value)),
+                          children: [
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "1", children: t("settings.security.enforcement.maxAge.1day", "1 day (Very Strict)") }),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "7", children: t("settings.security.enforcement.maxAge.7days", "7 days") }),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "14", children: t("settings.security.enforcement.maxAge.14days", "14 days") }),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "30", children: t("settings.security.enforcement.maxAge.30days", "30 days (Recommended)") }),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "60", children: t("settings.security.enforcement.maxAge.60days", "60 days") }),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "90", children: t("settings.security.enforcement.maxAge.90days", "90 days") }),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "180", children: t("settings.security.enforcement.maxAge.180days", "180 days") }),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "365", children: t("settings.security.enforcement.maxAge.365days", "1 year") })
+                          ]
+                        }
+                      ),
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "11px", marginTop: "8px" }, children: t("settings.security.enforcement.maxAge.hint", "Sessions older than {days} days are automatically terminated, even if still active", { days: settings.maxSessionAgeDays }) })
+                    ] }) }),
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsxRuntime.jsx(
+                      ToggleCard,
+                      {
+                        $active: settings.trustedProxies,
+                        onClick: () => handleChange("trustedProxies", !settings.trustedProxies),
+                        children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "row", gap: 4, style: { width: "100%" }, alignItems: "center", children: [
+                          /* @__PURE__ */ jsxRuntime.jsx(GreenToggle, { $isActive: settings.trustedProxies, children: /* @__PURE__ */ jsxRuntime.jsx(
+                            designSystem.Toggle,
+                            {
+                              checked: settings.trustedProxies,
+                              onChange: () => handleChange("trustedProxies", !settings.trustedProxies)
+                            }
+                          ) }),
+                          /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 1, style: { flex: 1 }, children: [
+                            /* @__PURE__ */ jsxRuntime.jsx(
+                              designSystem.Typography,
+                              {
+                                variant: "delta",
+                                fontWeight: "bold",
+                                textColor: settings.trustedProxies ? "success700" : "neutral800",
+                                style: { fontSize: "15px" },
+                                children: t("settings.security.enforcement.trustedProxies.title", "Trust Upstream Proxy")
+                              }
+                            ),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "12px", lineHeight: "1.5" }, children: t("settings.security.enforcement.trustedProxies.description", "Only enable when Strapi sits behind a trusted reverse proxy (nginx, Cloudflare). Otherwise clients can spoof X-Forwarded-For.") })
+                          ] })
+                        ] })
+                      }
+                    ) })
+                  ] }),
+                  !settings.strictSessionEnforcement && /* @__PURE__ */ jsxRuntime.jsx(
+                    designSystem.Alert,
+                    {
+                      variant: "warning",
+                      title: t("settings.security.enforcement.warning.title", "Running in Relaxed Mode"),
+                      children: t("settings.security.enforcement.warning.body", "Tokens without a matching session record are allowed through. Manual session termination is still enforced via the token hash, but we strongly recommend enabling strict mode in production.")
+                    }
+                  )
+                ] })
+              }
+            ),
             /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { background: "neutral100", padding: 5, style: { borderRadius: theme.borderRadius.md, marginBottom: "32px" }, children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Grid.Root, { gap: 4, children: [
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsxRuntime.jsx(
                 ToggleCard,

package/dist/_chunks/{Settings-BfKDErt5.mjs → Settings-D9N7m11p.mjs}

@@ -3,10 +3,10 @@ import { useState, useEffect } from "react";
 import { useIntl } from "react-intl";
 import { Flex, Loader, Typography, Button, Box, Badge, Accordion, Grid, SingleSelect, SingleSelectOption, Divider, Alert, TextInput, Toggle, NumberInput, Checkbox, Tabs } from "@strapi/design-system";
 import { useFetchClient, useNotification } from "@strapi/strapi/admin";
-import { Check, Information, Cog, Trash, Shield, Code, Duplicate, Mail } from "@strapi/icons";
+import { Check, Information, Cog, Trash, Shield, Code, Duplicate, Clock, Mail } from "@strapi/icons";
 import styled, { css, keyframes } from "styled-components";
-import { a as pluginId, g as getTranslation } from "./index-B0wQeSSu.mjs";
-import { u as useLicense } from "./useLicense-RxDUbCoU.mjs";
+import { a as pluginId, g as getTranslation } from "./index-BbbrBv3t.mjs";
+import { u as useLicense } from "./useLicense-Bszkymz3.mjs";
 import { D as DangerButton, S as ShowHideButton, G as GradientButton, C as CopyButton, T as TertiaryButton, c as SecondaryButton } from "./StyledButtons-Cz8oYhmc.mjs";
 const theme = {
   borderRadius: { md: "8px", lg: "12px" }
@@ -345,6 +345,17 @@ const SettingsPage = () => {
     cleanupInterval: 30,
     lastSeenRateLimit: 30,
     retentionDays: 90,
+    maxSessionAgeDays: 30,
+    // Grace window (ms) during which a freshly-issued JWT is accepted
+    // without a matching session row. Prevents strict-session enforcement
+    // from blocking the very first request after login. 0 disables.
+    sessionCreationGraceMs: 5e3,
+    // Opt-in fast path for the periodic idle-session cleanup: single
+    // SQL UPDATE instead of batched Document-Service writes. Bypasses
+    // lifecycle hooks; required for very large installations.
+    cleanupUseDbDirect: false,
+    strictSessionEnforcement: false,
+    trustedProxies: false,
     enableGeolocation: true,
     enableSecurityScoring: true,
     blockSuspiciousSessions: false,
@@ -390,7 +401,7 @@ const SettingsPage = () => {
             }
           });
         }
-        setSettings(loadedSettings);
+        setSettings((prev) => ({ ...prev, ...loadedSettings }));
       } else {
         setSettings((prev) => ({ ...prev, emailTemplates: getDefaultTemplates() }));
       }
@@ -625,6 +636,45 @@ const SettingsPage = () => {
                 ),
                 /* @__PURE__ */ jsx(Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "11px", marginTop: "8px" }, children: settings.retentionDays === -1 ? t("settings.general.retention.hintNever", "Old sessions deleted after never") : t("settings.general.retention.hint", "Old sessions deleted after {days}", { days: `${settings.retentionDays} days` }) })
               ] }) }),
+              /* @__PURE__ */ jsx(Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsxs(Box, { children: [
+                /* @__PURE__ */ jsx(Typography, { variant: "pi", fontWeight: "bold", style: { marginBottom: "8px", display: "block" }, children: t("settings.general.grace.title", "Post-Login Grace Period") }),
+                /* @__PURE__ */ jsxs(
+                  SingleSelect,
+                  {
+                    value: String(settings.sessionCreationGraceMs ?? 5e3),
+                    onChange: (value) => handleChange("sessionCreationGraceMs", parseInt(value)),
+                    children: [
+                      /* @__PURE__ */ jsx(SingleSelectOption, { value: "0", children: t("settings.general.grace.off", "Off (strict from first request)") }),
+                      /* @__PURE__ */ jsx(SingleSelectOption, { value: "2000", children: t("settings.general.grace.2s", "2 seconds") }),
+                      /* @__PURE__ */ jsx(SingleSelectOption, { value: "5000", children: t("settings.general.grace.5s", "5 seconds (Recommended)") }),
+                      /* @__PURE__ */ jsx(SingleSelectOption, { value: "10000", children: t("settings.general.grace.10s", "10 seconds") }),
+                      /* @__PURE__ */ jsx(SingleSelectOption, { value: "30000", children: t("settings.general.grace.30s", "30 seconds") })
+                    ]
+                  }
+                ),
+                /* @__PURE__ */ jsx(Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "11px", marginTop: "8px" }, children: t(
+                  "settings.general.grace.hint",
+                  "Accepts a freshly-issued JWT without a matching session row for this window, preventing strict-enforcement races right after login."
+                ) })
+              ] }) }),
+              /* @__PURE__ */ jsx(Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsxs(Box, { children: [
+                /* @__PURE__ */ jsx(Typography, { variant: "pi", fontWeight: "bold", style: { marginBottom: "8px", display: "block" }, children: t("settings.general.cleanupMode.title", "Cleanup Strategy") }),
+                /* @__PURE__ */ jsxs(
+                  SingleSelect,
+                  {
+                    value: settings.cleanupUseDbDirect ? "db" : "document-service",
+                    onChange: (value) => handleChange("cleanupUseDbDirect", value === "db"),
+                    children: [
+                      /* @__PURE__ */ jsx(SingleSelectOption, { value: "document-service", children: t("settings.general.cleanupMode.ds", "Document Service (Recommended, safe)") }),
+                      /* @__PURE__ */ jsx(SingleSelectOption, { value: "db", children: t("settings.general.cleanupMode.db", "Direct SQL UPDATE (large-scale)") })
+                    ]
+                  }
+                ),
+                /* @__PURE__ */ jsx(Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "11px", marginTop: "8px" }, children: t(
+                  "settings.general.cleanupMode.hint",
+                  "Direct SQL drains the entire idle-session backlog in one statement but bypasses lifecycle hooks. Only switch if you run >50 k active sessions."
+                ) })
+              ] }) }),
               /* @__PURE__ */ jsx(Grid.Item, { col: 12, children: /* @__PURE__ */ jsx(Box, { padding: 4, background: "danger100", style: { borderRadius: theme.borderRadius.md, border: `2px solid rgba(220, 38, 38, 0.2)` }, children: /* @__PURE__ */ jsxs(Flex, { gap: 3, alignItems: "flex-start", children: [
                 /* @__PURE__ */ jsx(Trash, { style: { width: "18px", height: "18px", color: "var(--colors-danger600, #DC2626)", flexShrink: 0, marginTop: "2px" } }),
                 /* @__PURE__ */ jsxs(Box, { style: { flex: 1 }, children: [
@@ -783,6 +833,119 @@ const SettingsPage = () => {
                 ] })
               }
             ),
+            /* @__PURE__ */ jsx(
+              Box,
+              {
+                background: "neutral0",
+                padding: 6,
+                style: {
+                  borderRadius: theme.borderRadius.lg,
+                  marginBottom: "32px",
+                  border: `2px solid ${settings.strictSessionEnforcement ? "rgba(220, 38, 38, 0.25)" : "rgba(2, 132, 199, 0.12)"}`,
+                  background: settings.strictSessionEnforcement ? "rgba(220, 38, 38, 0.04)" : "rgba(2, 132, 199, 0.04)"
+                },
+                children: /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 4, children: [
+                  /* @__PURE__ */ jsxs(Flex, { alignItems: "center", gap: 3, children: [
+                    /* @__PURE__ */ jsx(Shield, { style: { width: 24, height: 24, color: settings.strictSessionEnforcement ? "var(--colors-danger600, #DC2626)" : "var(--colors-primary600, #0284C7)" } }),
+                    /* @__PURE__ */ jsx(Typography, { variant: "delta", fontWeight: "bold", children: t("settings.security.enforcement.title", "Session Enforcement Policy") }),
+                    /* @__PURE__ */ jsx(Badge, { backgroundColor: settings.strictSessionEnforcement ? "danger100" : "neutral100", textColor: settings.strictSessionEnforcement ? "danger700" : "neutral700", children: settings.strictSessionEnforcement ? t("settings.security.enforcement.badgeStrict", "STRICT") : t("settings.security.enforcement.badgeRelaxed", "RELAXED") })
+                  ] }),
+                  /* @__PURE__ */ jsx(Typography, { variant: "omega", textColor: "neutral600", style: { lineHeight: 1.6 }, children: t("settings.security.enforcement.description", "Controls how aggressively JWT tokens are tied to an active session record. Strict mode rejects any token without a matching session, which is more secure but breaks tokens issued before this plugin was installed.") }),
+                  /* @__PURE__ */ jsxs(Grid.Root, { gap: 6, children: [
+                    /* @__PURE__ */ jsx(Grid.Item, { col: 12, s: 12, children: /* @__PURE__ */ jsx(
+                      ToggleCard,
+                      {
+                        $active: settings.strictSessionEnforcement,
+                        onClick: () => handleChange("strictSessionEnforcement", !settings.strictSessionEnforcement),
+                        children: /* @__PURE__ */ jsxs(Flex, { direction: "row", gap: 4, style: { width: "100%" }, alignItems: "center", children: [
+                          /* @__PURE__ */ jsx(GreenToggle, { $isActive: settings.strictSessionEnforcement, children: /* @__PURE__ */ jsx(
+                            Toggle,
+                            {
+                              checked: settings.strictSessionEnforcement,
+                              onChange: () => handleChange("strictSessionEnforcement", !settings.strictSessionEnforcement)
+                            }
+                          ) }),
+                          /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 1, style: { flex: 1 }, children: [
+                            /* @__PURE__ */ jsx(
+                              Typography,
+                              {
+                                variant: "delta",
+                                fontWeight: "bold",
+                                textColor: settings.strictSessionEnforcement ? "success700" : "neutral800",
+                                style: { fontSize: "15px" },
+                                children: t("settings.security.enforcement.strict.title", "Strict Session Enforcement")
+                              }
+                            ),
+                            /* @__PURE__ */ jsx(Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "12px", lineHeight: "1.5" }, children: t("settings.security.enforcement.strict.description", "Reject every authenticated request that does not have a matching session record. Recommended for production.") })
+                          ] })
+                        ] })
+                      }
+                    ) }),
+                    /* @__PURE__ */ jsx(Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsxs(Box, { children: [
+                      /* @__PURE__ */ jsxs(Typography, { variant: "pi", fontWeight: "bold", style: { marginBottom: "8px", display: "block" }, children: [
+                        /* @__PURE__ */ jsx(Clock, { style: { width: 14, height: 14, verticalAlign: "middle", marginRight: 6 } }),
+                        t("settings.security.enforcement.maxAge.title", "Max Session Age")
+                      ] }),
+                      /* @__PURE__ */ jsxs(
+                        SingleSelect,
+                        {
+                          value: String(settings.maxSessionAgeDays),
+                          onChange: (value) => handleChange("maxSessionAgeDays", parseInt(value)),
+                          children: [
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "1", children: t("settings.security.enforcement.maxAge.1day", "1 day (Very Strict)") }),
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "7", children: t("settings.security.enforcement.maxAge.7days", "7 days") }),
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "14", children: t("settings.security.enforcement.maxAge.14days", "14 days") }),
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "30", children: t("settings.security.enforcement.maxAge.30days", "30 days (Recommended)") }),
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "60", children: t("settings.security.enforcement.maxAge.60days", "60 days") }),
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "90", children: t("settings.security.enforcement.maxAge.90days", "90 days") }),
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "180", children: t("settings.security.enforcement.maxAge.180days", "180 days") }),
+                            /* @__PURE__ */ jsx(SingleSelectOption, { value: "365", children: t("settings.security.enforcement.maxAge.365days", "1 year") })
+                          ]
+                        }
+                      ),
+                      /* @__PURE__ */ jsx(Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "11px", marginTop: "8px" }, children: t("settings.security.enforcement.maxAge.hint", "Sessions older than {days} days are automatically terminated, even if still active", { days: settings.maxSessionAgeDays }) })
+                    ] }) }),
+                    /* @__PURE__ */ jsx(Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsx(
+                      ToggleCard,
+                      {
+                        $active: settings.trustedProxies,
+                        onClick: () => handleChange("trustedProxies", !settings.trustedProxies),
+                        children: /* @__PURE__ */ jsxs(Flex, { direction: "row", gap: 4, style: { width: "100%" }, alignItems: "center", children: [
+                          /* @__PURE__ */ jsx(GreenToggle, { $isActive: settings.trustedProxies, children: /* @__PURE__ */ jsx(
+                            Toggle,
+                            {
+                              checked: settings.trustedProxies,
+                              onChange: () => handleChange("trustedProxies", !settings.trustedProxies)
+                            }
+                          ) }),
+                          /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 1, style: { flex: 1 }, children: [
+                            /* @__PURE__ */ jsx(
+                              Typography,
+                              {
+                                variant: "delta",
+                                fontWeight: "bold",
+                                textColor: settings.trustedProxies ? "success700" : "neutral800",
+                                style: { fontSize: "15px" },
+                                children: t("settings.security.enforcement.trustedProxies.title", "Trust Upstream Proxy")
+                              }
+                            ),
+                            /* @__PURE__ */ jsx(Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "12px", lineHeight: "1.5" }, children: t("settings.security.enforcement.trustedProxies.description", "Only enable when Strapi sits behind a trusted reverse proxy (nginx, Cloudflare). Otherwise clients can spoof X-Forwarded-For.") })
+                          ] })
+                        ] })
+                      }
+                    ) })
+                  ] }),
+                  !settings.strictSessionEnforcement && /* @__PURE__ */ jsx(
+                    Alert,
+                    {
+                      variant: "warning",
+                      title: t("settings.security.enforcement.warning.title", "Running in Relaxed Mode"),
+                      children: t("settings.security.enforcement.warning.body", "Tokens without a matching session record are allowed through. Manual session termination is still enforced via the token hash, but we strongly recommend enabling strict mode in production.")
+                    }
+                  )
+                ] })
+              }
+            ),
             /* @__PURE__ */ jsx(Box, { background: "neutral100", padding: 5, style: { borderRadius: theme.borderRadius.md, marginBottom: "32px" }, children: /* @__PURE__ */ jsxs(Grid.Root, { gap: 4, children: [
               /* @__PURE__ */ jsx(Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsx(
                 ToggleCard,

package/dist/_chunks/{UpgradePage-B8kz6Cyz.js → UpgradePage-Bh21Lg-G.js}

@@ -6,7 +6,7 @@ const admin = require("@strapi/strapi/admin");
 const styled = require("styled-components");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
-const index = require("./index-BEh2DizI.js");
+const index = require("./index-BRESWp1b.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);
 const Container = styled__default.default(designSystem.Box)`