strapi-plugin-magic-sessionmanager 4.5.0 → 4.5.2

package/dist/_chunks/{Analytics-DmlZwyVu.mjs → Analytics--qB2cKuD.mjs}

@@ -4,8 +4,8 @@ import { useFetchClient } from "@strapi/strapi/admin";
 import styled, { css, keyframes } from "styled-components";
 import { Loader, Typography, Box, Flex, Badge } from "@strapi/design-system";
 import { ChartBubble, Crown, User, Clock, Monitor } from "@strapi/icons";
-import { a as pluginId } from "./index-DuVZXuJh.mjs";
-import { u as useLicense } from "./useLicense-Xzo6nyh3.mjs";
+import { a as pluginId } from "./index-CwxKazpc.mjs";
+import { u as useLicense } from "./useLicense-B9WW9s_d.mjs";
 const theme = {
   shadows: {
     sm: "0 1px 3px 0 rgba(0, 0, 0, 0.1)",

package/dist/_chunks/{Analytics-B7t0WvG7.js → Analytics-DM4_UffY.js}

@@ -6,8 +6,8 @@ const admin = require("@strapi/strapi/admin");
 const styled = require("styled-components");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
-const index = require("./index-CKrO7KSQ.js");
-const useLicense = require("./useLicense-DHAFqFSZ.js");
+const index = require("./index-CTxGMDHr.js");
+const useLicense = require("./useLicense-BEbtA_Zo.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);
 const theme = {

package/dist/_chunks/{App-LfsjcXXp.mjs → App-CL5q29Mi.mjs}

@@ -3,10 +3,10 @@ import { useState, useEffect } from "react";
 import { useIntl } from "react-intl";
 import { useFetchClient, useNotification, Page } from "@strapi/strapi/admin";
 import styled, { css, keyframes } from "styled-components";
-import { p as parseUserAgent, a as pluginId$1, g as getTranslation } from "./index-DuVZXuJh.mjs";
+import { p as parseUserAgent, a as pluginId$1, g as getTranslation } from "./index-CwxKazpc.mjs";
 import { Modal, Flex, Box, Typography, Divider, Button, Loader, SingleSelect, SingleSelectOption, Thead, Tr, Th, Tbody, Td, Table, TextInput } from "@strapi/design-system";
 import { Check, Information, Monitor, Server, Clock, Cross, Earth, Shield, Crown, Phone, Download, User, Eye, Trash, Search, Key } from "@strapi/icons";
-import { u as useLicense } from "./useLicense-Xzo6nyh3.mjs";
+import { u as useLicense } from "./useLicense-B9WW9s_d.mjs";
 import { S as ShowHideButton, T as TertiaryButton, D as DangerButton, I as IconButtonPrimary, a as IconButtonWarning, b as IconButtonDanger } from "./StyledButtons-Cz8oYhmc.mjs";
 import { useNavigate } from "react-router-dom";
 const theme = {

package/dist/_chunks/{App-Bir8yK_r.js → App-DF-VsbDW.js}

@@ -5,10 +5,10 @@ const react = require("react");
 const reactIntl = require("react-intl");
 const admin = require("@strapi/strapi/admin");
 const styled = require("styled-components");
-const index = require("./index-CKrO7KSQ.js");
+const index = require("./index-CTxGMDHr.js");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
-const useLicense = require("./useLicense-DHAFqFSZ.js");
+const useLicense = require("./useLicense-BEbtA_Zo.js");
 const StyledButtons = require("./StyledButtons-DDuxnYz8.js");
 const reactRouterDom = require("react-router-dom");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };

package/dist/_chunks/{License-OToijT0s.mjs → License-D9piCp34.mjs}

@@ -4,7 +4,7 @@ import { Loader, Box, Alert, Flex, Typography, Button, Badge, Accordion } from "
 import { useFetchClient, useNotification } from "@strapi/strapi/admin";
 import { ArrowClockwise, Duplicate, Download, User, Shield, Sparkle, ChartBubble } from "@strapi/icons";
 import styled, { css, keyframes } from "styled-components";
-import { a as pluginId } from "./index-DuVZXuJh.mjs";
+import { a as pluginId } from "./index-CwxKazpc.mjs";
 const theme = {
   borderRadius: { lg: "12px" }
 };

package/dist/_chunks/{License-B56Xklj2.js → License-Dmm1d3fQ.js}

@@ -6,7 +6,7 @@ const designSystem = require("@strapi/design-system");
 const admin = require("@strapi/strapi/admin");
 const icons = require("@strapi/icons");
 const styled = require("styled-components");
-const index = require("./index-CKrO7KSQ.js");
+const index = require("./index-CTxGMDHr.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);
 const theme = {

package/dist/_chunks/{OnlineUsersWidget-Fpc0aH2z.mjs → OnlineUsersWidget-DHsthkt0.mjs}

@@ -4,7 +4,7 @@ import { useIntl } from "react-intl";
 import { Box, Typography, Flex, Grid } from "@strapi/design-system";
 import { Check, Cross, Clock, User } from "@strapi/icons";
 import { useFetchClient } from "@strapi/strapi/admin";
-import { g as getTranslation } from "./index-DuVZXuJh.mjs";
+import { g as getTranslation } from "./index-CwxKazpc.mjs";
 const OnlineUsersWidget = () => {
   const { formatMessage } = useIntl();
   const { get } = useFetchClient();

package/dist/_chunks/{OnlineUsersWidget-DTEzguhS.js → OnlineUsersWidget-KchZ_ScS.js}

@@ -6,7 +6,7 @@ const reactIntl = require("react-intl");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
 const admin = require("@strapi/strapi/admin");
-const index = require("./index-CKrO7KSQ.js");
+const index = require("./index-CTxGMDHr.js");
 const OnlineUsersWidget = () => {
   const { formatMessage } = reactIntl.useIntl();
   const { get } = admin.useFetchClient();

package/dist/_chunks/{Settings-CO3-iggu.js → Settings-CUNaxDWk.js}

@@ -7,11 +7,85 @@ const designSystem = require("@strapi/design-system");
 const admin = require("@strapi/strapi/admin");
 const icons = require("@strapi/icons");
 const styled = require("styled-components");
-const index = require("./index-CKrO7KSQ.js");
-const useLicense = require("./useLicense-DHAFqFSZ.js");
+const index = require("./index-CTxGMDHr.js");
+const useLicense = require("./useLicense-BEbtA_Zo.js");
 const StyledButtons = require("./StyledButtons-DDuxnYz8.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);
+const COUNTRIES = [
+  { code: "DE", name: "Germany", flag: "🇩🇪" },
+  { code: "AT", name: "Austria", flag: "🇦🇹" },
+  { code: "CH", name: "Switzerland", flag: "🇨🇭" },
+  { code: "US", name: "United States", flag: "🇺🇸" },
+  { code: "CA", name: "Canada", flag: "🇨🇦" },
+  { code: "MX", name: "Mexico", flag: "🇲🇽" },
+  { code: "GB", name: "United Kingdom", flag: "🇬🇧" },
+  { code: "IE", name: "Ireland", flag: "🇮🇪" },
+  { code: "FR", name: "France", flag: "🇫🇷" },
+  { code: "IT", name: "Italy", flag: "🇮🇹" },
+  { code: "ES", name: "Spain", flag: "🇪🇸" },
+  { code: "PT", name: "Portugal", flag: "🇵🇹" },
+  { code: "NL", name: "Netherlands", flag: "🇳🇱" },
+  { code: "BE", name: "Belgium", flag: "🇧🇪" },
+  { code: "LU", name: "Luxembourg", flag: "🇱🇺" },
+  { code: "SE", name: "Sweden", flag: "🇸🇪" },
+  { code: "NO", name: "Norway", flag: "🇳🇴" },
+  { code: "DK", name: "Denmark", flag: "🇩🇰" },
+  { code: "FI", name: "Finland", flag: "🇫🇮" },
+  { code: "PL", name: "Poland", flag: "🇵🇱" },
+  { code: "CZ", name: "Czech Republic", flag: "🇨🇿" },
+  { code: "SK", name: "Slovakia", flag: "🇸🇰" },
+  { code: "HU", name: "Hungary", flag: "🇭🇺" },
+  { code: "RO", name: "Romania", flag: "🇷🇴" },
+  { code: "BG", name: "Bulgaria", flag: "🇧🇬" },
+  { code: "GR", name: "Greece", flag: "🇬🇷" },
+  { code: "HR", name: "Croatia", flag: "🇭🇷" },
+  { code: "SI", name: "Slovenia", flag: "🇸🇮" },
+  { code: "EE", name: "Estonia", flag: "🇪🇪" },
+  { code: "LV", name: "Latvia", flag: "🇱🇻" },
+  { code: "LT", name: "Lithuania", flag: "🇱🇹" },
+  { code: "IS", name: "Iceland", flag: "🇮🇸" },
+  { code: "TR", name: "Turkey", flag: "🇹🇷" },
+  { code: "RU", name: "Russia", flag: "🇷🇺" },
+  { code: "UA", name: "Ukraine", flag: "🇺🇦" },
+  { code: "BR", name: "Brazil", flag: "🇧🇷" },
+  { code: "AR", name: "Argentina", flag: "🇦🇷" },
+  { code: "CL", name: "Chile", flag: "🇨🇱" },
+  { code: "CO", name: "Colombia", flag: "🇨🇴" },
+  { code: "AU", name: "Australia", flag: "🇦🇺" },
+  { code: "NZ", name: "New Zealand", flag: "🇳🇿" },
+  { code: "JP", name: "Japan", flag: "🇯🇵" },
+  { code: "KR", name: "South Korea", flag: "🇰🇷" },
+  { code: "CN", name: "China", flag: "🇨🇳" },
+  { code: "HK", name: "Hong Kong", flag: "🇭🇰" },
+  { code: "TW", name: "Taiwan", flag: "🇹🇼" },
+  { code: "SG", name: "Singapore", flag: "🇸🇬" },
+  { code: "IN", name: "India", flag: "🇮🇳" },
+  { code: "ID", name: "Indonesia", flag: "🇮🇩" },
+  { code: "TH", name: "Thailand", flag: "🇹🇭" },
+  { code: "VN", name: "Vietnam", flag: "🇻🇳" },
+  { code: "PH", name: "Philippines", flag: "🇵🇭" },
+  { code: "MY", name: "Malaysia", flag: "🇲🇾" },
+  { code: "AE", name: "United Arab Emirates", flag: "🇦🇪" },
+  { code: "SA", name: "Saudi Arabia", flag: "🇸🇦" },
+  { code: "IL", name: "Israel", flag: "🇮🇱" },
+  { code: "EG", name: "Egypt", flag: "🇪🇬" },
+  { code: "ZA", name: "South Africa", flag: "🇿🇦" },
+  { code: "NG", name: "Nigeria", flag: "🇳🇬" },
+  { code: "KE", name: "Kenya", flag: "🇰🇪" },
+  { code: "MA", name: "Morocco", flag: "🇲🇦" }
+];
+const normalizeCountryCode = (raw) => {
+  if (typeof raw !== "string") return null;
+  const up = raw.trim().toUpperCase();
+  if (!/^[A-Z]{2}$/.test(up)) return null;
+  return up;
+};
+const formatCountry = (code) => {
+  if (!code) return "";
+  const match = COUNTRIES.find((c) => c.code === code);
+  return match ? `${match.flag} ${match.name} (${match.code})` : code;
+};
 const theme = {
   borderRadius: { md: "8px", lg: "12px" }
 };
@@ -331,6 +405,167 @@ const generateSecureKey = () => {
   }
   return key;
 };
+const GeofencingPanel = ({ settings, handleChange, t }) => {
+  const [pendingCode, setPendingCode] = react.useState("");
+  const mode = (() => {
+    if (Array.isArray(settings.allowedCountries) && settings.allowedCountries.length > 0) {
+      return "allowlist";
+    }
+    if (Array.isArray(settings.blockedCountries) && settings.blockedCountries.length > 0) {
+      return "blocklist";
+    }
+    return "allowlist";
+  })();
+  const activeField = mode === "allowlist" ? "allowedCountries" : "blockedCountries";
+  const activeList = Array.isArray(settings[activeField]) ? settings[activeField] : [];
+  const setMode = (newMode) => {
+    if (newMode === mode) return;
+    if (newMode === "allowlist") {
+      handleChange("blockedCountries", []);
+    } else {
+      handleChange("allowedCountries", []);
+    }
+  };
+  const addCode = (raw) => {
+    const code = normalizeCountryCode(raw);
+    if (!code) return;
+    if (activeList.includes(code)) return;
+    handleChange(activeField, [...activeList, code]);
+    setPendingCode("");
+  };
+  const removeCode = (code) => {
+    handleChange(activeField, activeList.filter((c) => c !== code));
+  };
+  return /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Grid.Root, { gap: 5, children: [
+    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 12, children: /* @__PURE__ */ jsxRuntime.jsx(
+      designSystem.Box,
+      {
+        padding: 3,
+        background: settings.enableGeofencing ? "success100" : "neutral100",
+        hasRadius: true,
+        style: { borderLeft: `4px solid ${settings.enableGeofencing ? "#16A34A" : "#9CA3AF"}` },
+        children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { justifyContent: "space-between", alignItems: "center", children: [
+          /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { children: [
+            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "delta", style: { display: "block", marginBottom: "4px" }, children: t("settings.geofencing.enable.title", "Enable Geofencing") }),
+            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "12px" }, children: t(
+              "settings.geofencing.enable.description",
+              "When enabled, the pre-login guard compares the caller's country against the configured list and rejects logins that do not match."
+            ) })
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            designSystem.Toggle,
+            {
+              onLabel: "On",
+              offLabel: "Off",
+              checked: !!settings.enableGeofencing,
+              onChange: () => handleChange("enableGeofencing", !settings.enableGeofencing)
+            }
+          )
+        ] })
+      }
+    ) }),
+    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 12, children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { children: [
+      /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", fontWeight: "bold", style: { marginBottom: "8px", display: "block" }, children: t("settings.geofencing.mode.title", "Mode") }),
+      /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 2, children: [
+        /* @__PURE__ */ jsxRuntime.jsx(
+          designSystem.Button,
+          {
+            variant: mode === "allowlist" ? "default" : "tertiary",
+            onClick: () => setMode("allowlist"),
+            disabled: !settings.enableGeofencing,
+            children: t("settings.geofencing.mode.allowlist", "Allowlist (only selected countries)")
+          }
+        ),
+        /* @__PURE__ */ jsxRuntime.jsx(
+          designSystem.Button,
+          {
+            variant: mode === "blocklist" ? "default" : "tertiary",
+            onClick: () => setMode("blocklist"),
+            disabled: !settings.enableGeofencing,
+            children: t("settings.geofencing.mode.blocklist", "Blocklist (block selected countries)")
+          }
+        )
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "11px", marginTop: "8px" }, children: mode === "allowlist" ? t(
+        "settings.geofencing.mode.allowlist.hint",
+        "Only countries in the list may authenticate. Empty list = no geo restriction."
+      ) : t(
+        "settings.geofencing.mode.blocklist.hint",
+        "Every country EXCEPT those in the list may authenticate."
+      ) })
+    ] }) }),
+    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 12, children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { children: [
+      /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", fontWeight: "bold", style: { marginBottom: "8px", display: "block" }, children: mode === "allowlist" ? t("settings.geofencing.allowed.title", "Allowed Countries") : t("settings.geofencing.blocked.title", "Blocked Countries") }),
+      /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { gap: 2, wrap: "wrap", style: { marginBottom: "12px", minHeight: "36px" }, children: activeList.length === 0 ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: t("settings.geofencing.empty", "No countries configured.") }) : activeList.map((code) => /* @__PURE__ */ jsxRuntime.jsxs(
+        designSystem.Badge,
+        {
+          onClick: settings.enableGeofencing ? () => removeCode(code) : void 0,
+          style: {
+            cursor: settings.enableGeofencing ? "pointer" : "not-allowed",
+            padding: "6px 10px",
+            background: mode === "allowlist" ? "#DCFCE7" : "#FEE2E2",
+            color: mode === "allowlist" ? "#15803D" : "#B91C1C"
+          },
+          children: [
+            formatCountry(code),
+            settings.enableGeofencing ? "  ✕" : ""
+          ]
+        },
+        code
+      )) }),
+      /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 2, children: [
+        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { style: { flex: 1 }, children: /* @__PURE__ */ jsxRuntime.jsx(
+          designSystem.SingleSelect,
+          {
+            disabled: !settings.enableGeofencing,
+            value: pendingCode || "",
+            onChange: (value) => {
+              setPendingCode(value);
+              if (value) addCode(value);
+            },
+            placeholder: t("settings.geofencing.pick", "Pick a country to add…"),
+            children: COUNTRIES.filter((c) => !activeList.includes(c.code)).map((c) => /* @__PURE__ */ jsxRuntime.jsxs(designSystem.SingleSelectOption, { value: c.code, children: [
+              c.flag,
+              " ",
+              c.name,
+              " (",
+              c.code,
+              ")"
+            ] }, c.code))
+          }
+        ) }),
+        /* @__PURE__ */ jsxRuntime.jsx(
+          designSystem.TextInput,
+          {
+            disabled: !settings.enableGeofencing,
+            placeholder: t("settings.geofencing.manual", "Or type ISO-2 (e.g. JP)"),
+            value: pendingCode.length <= 2 ? pendingCode : "",
+            onChange: (e) => setPendingCode(e.target.value.toUpperCase().slice(0, 2)),
+            style: { width: "180px" }
+          }
+        ),
+        /* @__PURE__ */ jsxRuntime.jsx(
+          designSystem.Button,
+          {
+            disabled: !settings.enableGeofencing || !normalizeCountryCode(pendingCode),
+            onClick: () => addCode(pendingCode),
+            children: t("settings.geofencing.add", "Add")
+          }
+        )
+      ] })
+    ] }) }),
+    !settings.enableGeofencing && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 12, children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Alert, { variant: "default", closeLabel: "", title: "", onClose: () => {
+    }, children: t(
+      "settings.geofencing.disabled",
+      "Geofencing is currently disabled. Enable it above to enforce the configured country list."
+    ) }) }),
+    settings.enableGeofencing && !settings.enableGeolocation && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 12, children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Alert, { variant: "warning", closeLabel: "", title: "", onClose: () => {
+    }, children: t(
+      "settings.geofencing.needsGeolocation",
+      "Geofencing requires Geolocation to be enabled (Security tab)."
+    ) }) })
+  ] });
+};
 const SettingsPage = () => {
   const { formatMessage } = reactIntl.useIntl();
   const { get, post, put } = admin.useFetchClient();
@@ -350,6 +585,14 @@ const SettingsPage = () => {
     lastSeenRateLimit: 30,
     retentionDays: 90,
     maxSessionAgeDays: 30,
+    // Grace window (ms) during which a freshly-issued JWT is accepted
+    // without a matching session row. Prevents strict-session enforcement
+    // from blocking the very first request after login. 0 disables.
+    sessionCreationGraceMs: 5e3,
+    // Opt-in fast path for the periodic idle-session cleanup: single
+    // SQL UPDATE instead of batched Document-Service writes. Bypasses
+    // lifecycle hooks; required for very large installations.
+    cleanupUseDbDirect: false,
     strictSessionEnforcement: false,
     trustedProxies: false,
     enableGeolocation: true,
@@ -397,7 +640,7 @@ const SettingsPage = () => {
             }
           });
         }
-        setSettings(loadedSettings);
+        setSettings((prev) => ({ ...prev, ...loadedSettings }));
       } else {
         setSettings((prev) => ({ ...prev, emailTemplates: getDefaultTemplates() }));
       }
@@ -632,6 +875,45 @@ const SettingsPage = () => {
                 ),
                 /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "11px", marginTop: "8px" }, children: settings.retentionDays === -1 ? t("settings.general.retention.hintNever", "Old sessions deleted after never") : t("settings.general.retention.hint", "Old sessions deleted after {days}", { days: `${settings.retentionDays} days` }) })
               ] }) }),
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { children: [
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", fontWeight: "bold", style: { marginBottom: "8px", display: "block" }, children: t("settings.general.grace.title", "Post-Login Grace Period") }),
+                /* @__PURE__ */ jsxRuntime.jsxs(
+                  designSystem.SingleSelect,
+                  {
+                    value: String(settings.sessionCreationGraceMs ?? 5e3),
+                    onChange: (value) => handleChange("sessionCreationGraceMs", parseInt(value)),
+                    children: [
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "0", children: t("settings.general.grace.off", "Off (strict from first request)") }),
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "2000", children: t("settings.general.grace.2s", "2 seconds") }),
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "5000", children: t("settings.general.grace.5s", "5 seconds (Recommended)") }),
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "10000", children: t("settings.general.grace.10s", "10 seconds") }),
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "30000", children: t("settings.general.grace.30s", "30 seconds") })
+                    ]
+                  }
+                ),
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "11px", marginTop: "8px" }, children: t(
+                  "settings.general.grace.hint",
+                  "Accepts a freshly-issued JWT without a matching session row for this window, preventing strict-enforcement races right after login."
+                ) })
+              ] }) }),
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 6, s: 12, children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { children: [
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", fontWeight: "bold", style: { marginBottom: "8px", display: "block" }, children: t("settings.general.cleanupMode.title", "Cleanup Strategy") }),
+                /* @__PURE__ */ jsxRuntime.jsxs(
+                  designSystem.SingleSelect,
+                  {
+                    value: settings.cleanupUseDbDirect ? "db" : "document-service",
+                    onChange: (value) => handleChange("cleanupUseDbDirect", value === "db"),
+                    children: [
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "document-service", children: t("settings.general.cleanupMode.ds", "Document Service (Recommended, safe)") }),
+                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: "db", children: t("settings.general.cleanupMode.db", "Direct SQL UPDATE (large-scale)") })
+                    ]
+                  }
+                ),
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", style: { fontSize: "11px", marginTop: "8px" }, children: t(
+                  "settings.general.cleanupMode.hint",
+                  "Direct SQL drains the entire idle-session backlog in one statement but bypasses lifecycle hooks. Only switch if you run >50 k active sessions."
+                ) })
+              ] }) }),
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 12, children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { padding: 4, background: "danger100", style: { borderRadius: theme.borderRadius.md, border: `2px solid rgba(220, 38, 38, 0.2)` }, children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 3, alignItems: "flex-start", children: [
                 /* @__PURE__ */ jsxRuntime.jsx(icons.Trash, { style: { width: "18px", height: "18px", color: "var(--colors-danger600, #DC2626)", flexShrink: 0, marginTop: "2px" } }),
                 /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { style: { flex: 1 }, children: [
@@ -1012,6 +1294,24 @@ const SettingsPage = () => {
             ] }) }) })
           ] }) })
         ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Accordion.Item, { value: "geofencing", children: [
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Accordion.Header, { children: /* @__PURE__ */ jsxRuntime.jsx(
+            designSystem.Accordion.Trigger,
+            {
+              icon: icons.Shield,
+              description: t("settings.geofencing.description", "Allow or block sign-ins by country"),
+              children: t("settings.geofencing.title", "Geofencing")
+            }
+          ) }),
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Accordion.Content, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { padding: 6, children: /* @__PURE__ */ jsxRuntime.jsx(
+            GeofencingPanel,
+            {
+              settings,
+              handleChange,
+              t
+            }
+          ) }) })
+        ] }),
         isAdvanced && /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Accordion.Item, { value: "email", children: [
           /* @__PURE__ */ jsxRuntime.jsx(designSystem.Accordion.Header, { children: /* @__PURE__ */ jsxRuntime.jsx(
             designSystem.Accordion.Trigger,