strapi-security-suite 0.1.6 → 0.1.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/server/index.js +10 -2
  2. package/dist/server/index.mjs +10 -2
  3. package/package.json +1 -1
package/dist/server/index.js CHANGED
@@ -2,6 +2,8 @@
2
2
  const jwt = require("jsonwebtoken");
3
3
  const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
4
4
  const jwt__default = /* @__PURE__ */ _interopDefault(jwt);
5
+ const revokedTokenSet = /* @__PURE__ */ new Set();
6
+ const revokedConnectionTokens = /* @__PURE__ */ new Set();
5
7
  const CHECK_INTERVAL = 5e3;
6
8
  const LOGIN_PATH = "/admin/login";
7
9
  const LOGOUT_PATH = "/admin/logout";
@@ -9,6 +11,11 @@ const sessionActivityMap = /* @__PURE__ */ new Map();
9
11
  async function trackActivity(ctx, next) {
10
12
  const adminUser = ctx.session?.user;
11
13
  let key = adminUser?.id ? `${adminUser.id}:${adminUser.email}` : null;
14
+ const auth = ctx.request.headers?.authorization;
15
+ if (auth && revokedConnectionTokens.has(auth.split(" ")[1]) || revokedConnectionTokens.has(ctx.cookies.get("jwtToken"))) {
16
+ ctx.cookies.set("jwtToken", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
17
+ ctx.status = 403;
18
+ }
12
19
  if (ctx.path.includes(LOGOUT_PATH)) {
13
20
  ctx.session = null;
14
21
  key = null;
@@ -87,7 +94,6 @@ const checkAdminPermission = (requiredPermission) => async (ctx, next) => {
87
94
  return ctx.internalServerError("Failed to verify permissions.");
88
95
  }
89
96
  };
90
- const revokedTokenSet = /* @__PURE__ */ new Set();
91
97
  const forceExpireAdmin = async (ctx, userId) => {
92
98
  const ADMIN_SECRET = strapi.config.get("admin.auth.secret");
93
99
  const token = jwt__default.default.sign(
@@ -121,6 +127,7 @@ async function rejectRevokedTokens(ctx, next) {
121
127
  ctx.cookies.set("koa.sess.sig", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
122
128
  sessionActivityMap.delete(key);
123
129
  revokedTokenSet.delete(adminEmail);
130
+ revokedConnectionTokens.add(ctx.cookies.get("jwtToken"));
124
131
  strapi.service("plugin::strapi-security-suite.autoLogoutChecker").clearSessionActivity(id, adminEmail);
125
132
  forceExpireAdmin(ctx, id);
126
133
  strapi.log.info(`🔒 Session revoked: ${adminEmail} app.admin.logout`);
@@ -140,12 +147,13 @@ async function interceptRenewToken(ctx, next) {
140
147
  ctx.cookies.set("koa.sess.sig", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
141
148
  if (adminUser?.id) {
142
149
  strapi.service("plugin::strapi-security-suite.autoLogoutChecker").clearSessionActivity(adminUser?.id, adminUser?.email);
150
+ revokedConnectionTokens.add(ctx.cookies.get("jwtToken"));
143
151
  ctx.session = null;
144
152
  sessionActivityMap.delete(`${adminUser?.id}:${adminUser?.email}`);
145
153
  return;
146
154
  }
147
155
  }
148
- if (ctx.path === "/admin/renew-token" || ctx.path.includes("/content")) {
156
+ if (ctx.path.includes("/renew-token") || ctx.path.includes("/content")) {
149
157
  const { email } = ctx.session?.user || {};
150
158
  if (!email) {
151
159
  ctx.set("app.admin.tk", "email.admin");
package/dist/server/index.mjs CHANGED
@@ -1,4 +1,6 @@
1
1
  import jwt from "jsonwebtoken";
2
+ const revokedTokenSet = /* @__PURE__ */ new Set();
3
+ const revokedConnectionTokens = /* @__PURE__ */ new Set();
2
4
  const CHECK_INTERVAL = 5e3;
3
5
  const LOGIN_PATH = "/admin/login";
4
6
  const LOGOUT_PATH = "/admin/logout";
@@ -6,6 +8,11 @@ const sessionActivityMap = /* @__PURE__ */ new Map();
6
8
  async function trackActivity(ctx, next) {
7
9
  const adminUser = ctx.session?.user;
8
10
  let key = adminUser?.id ? `${adminUser.id}:${adminUser.email}` : null;
11
+ const auth = ctx.request.headers?.authorization;
12
+ if (auth && revokedConnectionTokens.has(auth.split(" ")[1]) || revokedConnectionTokens.has(ctx.cookies.get("jwtToken"))) {
13
+ ctx.cookies.set("jwtToken", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
14
+ ctx.status = 403;
15
+ }
9
16
  if (ctx.path.includes(LOGOUT_PATH)) {
10
17
  ctx.session = null;
11
18
  key = null;
@@ -84,7 +91,6 @@ const checkAdminPermission = (requiredPermission) => async (ctx, next) => {
84
91
  return ctx.internalServerError("Failed to verify permissions.");
85
92
  }
86
93
  };
87
- const revokedTokenSet = /* @__PURE__ */ new Set();
88
94
  const forceExpireAdmin = async (ctx, userId) => {
89
95
  const ADMIN_SECRET = strapi.config.get("admin.auth.secret");
90
96
  const token = jwt.sign(
@@ -118,6 +124,7 @@ async function rejectRevokedTokens(ctx, next) {
118
124
  ctx.cookies.set("koa.sess.sig", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
119
125
  sessionActivityMap.delete(key);
120
126
  revokedTokenSet.delete(adminEmail);
127
+ revokedConnectionTokens.add(ctx.cookies.get("jwtToken"));
121
128
  strapi.service("plugin::strapi-security-suite.autoLogoutChecker").clearSessionActivity(id, adminEmail);
122
129
  forceExpireAdmin(ctx, id);
123
130
  strapi.log.info(`🔒 Session revoked: ${adminEmail} app.admin.logout`);
@@ -137,12 +144,13 @@ async function interceptRenewToken(ctx, next) {
137
144
  ctx.cookies.set("koa.sess.sig", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
138
145
  if (adminUser?.id) {
139
146
  strapi.service("plugin::strapi-security-suite.autoLogoutChecker").clearSessionActivity(adminUser?.id, adminUser?.email);
147
+ revokedConnectionTokens.add(ctx.cookies.get("jwtToken"));
140
148
  ctx.session = null;
141
149
  sessionActivityMap.delete(`${adminUser?.id}:${adminUser?.email}`);
142
150
  return;
143
151
  }
144
152
  }
145
- if (ctx.path === "/admin/renew-token" || ctx.path.includes("/content")) {
153
+ if (ctx.path.includes("/renew-token") || ctx.path.includes("/content")) {
146
154
  const { email } = ctx.session?.user || {};
147
155
  if (!email) {
148
156
  ctx.set("app.admin.tk", "email.admin");
package/package.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "version": "0.1.6",
2
+ "version": "0.1.8",
3
3
  "keywords": [
4
4
  "strapi",
5
5
  "plugin",