strapi-security-suite 0.1.6 → 0.1.9

package/dist/server/index.js

@@ -2,6 +2,8 @@
 const jwt = require("jsonwebtoken");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const jwt__default = /* @__PURE__ */ _interopDefault(jwt);
+const revokedTokenSet = /* @__PURE__ */ new Set();
+const revokedConnectionTokens = /* @__PURE__ */ new Set();
 const CHECK_INTERVAL = 5e3;
 const LOGIN_PATH = "/admin/login";
 const LOGOUT_PATH = "/admin/logout";
@@ -9,6 +11,19 @@ const sessionActivityMap = /* @__PURE__ */ new Map();
 async function trackActivity(ctx, next) {
   const adminUser = ctx.session?.user;
   let key = adminUser?.id ? `${adminUser.id}:${adminUser.email}` : null;
+  const auth = ctx.request.headers?.authorization;
+  if (auth && revokedConnectionTokens.has(auth.split(" ")[1]) || revokedConnectionTokens.has(ctx.cookies.get("jwtToken"))) {
+    ctx.cookies.set("jwtToken", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
+    ctx.status = 403;
+    ctx.body = {
+      error: {
+        status: 403,
+        title: "Forbidden",
+        message: "Forbidden. Your token has been revoked."
+      }
+    };
+    return;
+  }
   if (ctx.path.includes(LOGOUT_PATH)) {
     ctx.session = null;
     key = null;
@@ -87,7 +102,6 @@ const checkAdminPermission = (requiredPermission) => async (ctx, next) => {
     return ctx.internalServerError("Failed to verify permissions.");
   }
 };
-const revokedTokenSet = /* @__PURE__ */ new Set();
 const forceExpireAdmin = async (ctx, userId) => {
   const ADMIN_SECRET = strapi.config.get("admin.auth.secret");
   const token = jwt__default.default.sign(
@@ -121,6 +135,7 @@ async function rejectRevokedTokens(ctx, next) {
       ctx.cookies.set("koa.sess.sig", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
       sessionActivityMap.delete(key);
       revokedTokenSet.delete(adminEmail);
+      revokedConnectionTokens.add(ctx.cookies.get("jwtToken"));
       strapi.service("plugin::strapi-security-suite.autoLogoutChecker").clearSessionActivity(id, adminEmail);
       forceExpireAdmin(ctx, id);
       strapi.log.info(`🔒 Session revoked: ${adminEmail} app.admin.logout`);
@@ -140,12 +155,13 @@ async function interceptRenewToken(ctx, next) {
     ctx.cookies.set("koa.sess.sig", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
     if (adminUser?.id) {
       strapi.service("plugin::strapi-security-suite.autoLogoutChecker").clearSessionActivity(adminUser?.id, adminUser?.email);
+      revokedConnectionTokens.add(ctx.cookies.get("jwtToken"));
       ctx.session = null;
       sessionActivityMap.delete(`${adminUser?.id}:${adminUser?.email}`);
       return;
     }
   }
-  if (ctx.path === "/admin/renew-token" || ctx.path.includes("/content")) {
+  if (ctx.path.includes("/renew-token") || ctx.path.includes("/content")) {
     const { email } = ctx.session?.user || {};
     if (!email) {
       ctx.set("app.admin.tk", "email.admin");

package/dist/server/index.mjs

@@ -1,4 +1,6 @@
 import jwt from "jsonwebtoken";
+const revokedTokenSet = /* @__PURE__ */ new Set();
+const revokedConnectionTokens = /* @__PURE__ */ new Set();
 const CHECK_INTERVAL = 5e3;
 const LOGIN_PATH = "/admin/login";
 const LOGOUT_PATH = "/admin/logout";
@@ -6,6 +8,19 @@ const sessionActivityMap = /* @__PURE__ */ new Map();
 async function trackActivity(ctx, next) {
   const adminUser = ctx.session?.user;
   let key = adminUser?.id ? `${adminUser.id}:${adminUser.email}` : null;
+  const auth = ctx.request.headers?.authorization;
+  if (auth && revokedConnectionTokens.has(auth.split(" ")[1]) || revokedConnectionTokens.has(ctx.cookies.get("jwtToken"))) {
+    ctx.cookies.set("jwtToken", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
+    ctx.status = 403;
+    ctx.body = {
+      error: {
+        status: 403,
+        title: "Forbidden",
+        message: "Forbidden. Your token has been revoked."
+      }
+    };
+    return;
+  }
   if (ctx.path.includes(LOGOUT_PATH)) {
     ctx.session = null;
     key = null;
@@ -84,7 +99,6 @@ const checkAdminPermission = (requiredPermission) => async (ctx, next) => {
     return ctx.internalServerError("Failed to verify permissions.");
   }
 };
-const revokedTokenSet = /* @__PURE__ */ new Set();
 const forceExpireAdmin = async (ctx, userId) => {
   const ADMIN_SECRET = strapi.config.get("admin.auth.secret");
   const token = jwt.sign(
@@ -118,6 +132,7 @@ async function rejectRevokedTokens(ctx, next) {
       ctx.cookies.set("koa.sess.sig", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
       sessionActivityMap.delete(key);
       revokedTokenSet.delete(adminEmail);
+      revokedConnectionTokens.add(ctx.cookies.get("jwtToken"));
       strapi.service("plugin::strapi-security-suite.autoLogoutChecker").clearSessionActivity(id, adminEmail);
       forceExpireAdmin(ctx, id);
       strapi.log.info(`🔒 Session revoked: ${adminEmail} app.admin.logout`);
@@ -137,12 +152,13 @@ async function interceptRenewToken(ctx, next) {
     ctx.cookies.set("koa.sess.sig", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
     if (adminUser?.id) {
       strapi.service("plugin::strapi-security-suite.autoLogoutChecker").clearSessionActivity(adminUser?.id, adminUser?.email);
+      revokedConnectionTokens.add(ctx.cookies.get("jwtToken"));
       ctx.session = null;
       sessionActivityMap.delete(`${adminUser?.id}:${adminUser?.email}`);
       return;
     }
   }
-  if (ctx.path === "/admin/renew-token" || ctx.path.includes("/content")) {
+  if (ctx.path.includes("/renew-token") || ctx.path.includes("/content")) {
     const { email } = ctx.session?.user || {};
     if (!email) {
       ctx.set("app.admin.tk", "email.admin");

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.6",
+  "version": "0.1.9",
   "keywords": [
     "strapi",
     "plugin",