strapi-security-suite 0.2.4 → 0.3.1

package/dist/server/index.mjs

@@ -1,178 +1,214 @@
 import jwt from "jsonwebtoken";
 const revokedTokenSet = /* @__PURE__ */ new Set();
-const revokedConnectionTokens = /* @__PURE__ */ new Set();
+const revokedConnectionTokens = /* @__PURE__ */ new Map();
+const TOKEN_TTL = 30 * 60 * 1e3;
+function pruneExpiredTokens() {
+  const cutoff = Date.now() - TOKEN_TTL;
+  for (const [token, revokedAt] of revokedConnectionTokens) {
+    if (revokedAt < cutoff) {
+      revokedConnectionTokens.delete(token);
+    }
+  }
+}
+const sessionActivityMap = /* @__PURE__ */ new Map();
+const PLUGIN_ID = "strapi-security-suite";
+const CONTENT_TYPES = {
+  SECURITY_SETTINGS: `plugin::${PLUGIN_ID}.security-settings`
+};
+const SERVICES = {
+  AUTO_LOGOUT_CHECKER: "autoLogoutChecker"
+};
+const CTX_ADMIN_USER = Symbol.for("security-suite:adminUser");
 const CHECK_INTERVAL = 5e3;
+const DEFAULT_AUTOLOGOUT_TIME = 30;
+const MS_PER_MINUTE = 6e4;
+const MS_PER_SECOND = 1e3;
 const LOGIN_PATH = "/admin/login";
 const LOGOUT_PATH = "/admin/logout";
-const sessionActivityMap = /* @__PURE__ */ new Map();
+const ACCESS_TOKEN_PATH = "/access-token";
+const CONTENT_PATH = "/content";
+const HTTP_STATUS = {
+  BAD_REQUEST: 400,
+  FORBIDDEN: 403,
+  CONFLICT: 409
+};
+const COOKIES = {
+  SESSION: "koa.sess",
+  SESSION_SIG: "koa.sess.sig",
+  /** Strapi v5 admin refresh-token cookie (managed by session manager). */
+  REFRESH_TOKEN: "strapi_admin_refresh"
+};
+const HEADERS = {
+  /** Header that signals the frontend to force-reload (session revoked). */
+  ADMIN_TOKEN_SIGNAL: "app.admin.tk",
+  /** Required so the browser exposes custom headers in fetch responses. */
+  EXPOSE_HEADERS: "Access-Control-Expose-Headers"
+};
+const ERROR_MESSAGES = {
+  SETTINGS_NOT_FOUND: "Security settings not found.",
+  INSUFFICIENT_PERMISSIONS: "Insufficient permissions.",
+  NOT_AUTHENTICATED: "User is not authenticated.",
+  UNKNOWN_ERROR: "An unexpected error occurred.",
+  MULTIPLE_SESSIONS: "Multiple sessions are not allowed. You are already logged in elsewhere.",
+  TOKEN_REVOKED: "Forbidden. Your token has been revoked.",
+  PERMISSION_CHECK_FAILED: "Failed to verify permissions.",
+  INVALID_SETTINGS: "Invalid settings payload."
+};
+const PERMISSIONS = {
+  VIEW_CONFIGS: `plugin::${PLUGIN_ID}.view-configs`,
+  MANAGE_CONFIGS: `plugin::${PLUGIN_ID}.manage-configs`
+};
+const DEFAULT_SETTINGS = {
+  autoLogoutTime: 30,
+  multipleSessionsControl: true,
+  passwordExpiryDays: 30,
+  nonReusablePassword: true,
+  enablePasswordManagement: true
+};
+const VALID_SETTINGS_KEYS = new Set(Object.keys(DEFAULT_SETTINGS));
 async function trackActivity(ctx, next) {
-  const adminUser = ctx.session?.user;
+  const adminUser = ctx.state[CTX_ADMIN_USER];
   let key = adminUser?.id ? `${adminUser.id}:${adminUser.email}` : null;
-  const auth = ctx.request.headers?.authorization;
-  if (auth && revokedConnectionTokens.has(auth.split(" ")[1]) || revokedConnectionTokens.has(ctx.cookies.get("jwtToken"))) {
-    ctx.cookies.set("jwtToken", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
-    ctx.status = 403;
+  const bearerToken = ctx.get("authorization")?.split("Bearer ")[1];
+  if (bearerToken && revokedConnectionTokens.has(bearerToken)) {
+    ctx.status = HTTP_STATUS.FORBIDDEN;
     ctx.body = {
       error: {
-        status: 403,
+        status: HTTP_STATUS.FORBIDDEN,
         title: "Forbidden",
-        message: "Forbidden. Your token has been revoked."
+        message: ERROR_MESSAGES.TOKEN_REVOKED
       }
     };
     return;
   }
   if (ctx.path.includes(LOGOUT_PATH)) {
-    ctx.session = null;
+    if (ctx.session !== void 0) {
+      ctx.session = null;
+    }
     key = null;
   }
-  if (key && key !== null) {
+  if (key) {
     sessionActivityMap.set(key, Date.now());
-    strapi.log.debug(`🟢 Activity updated: ${key}`);
+    strapi.log.debug(`[${PLUGIN_ID}] Activity updated: ${key}`);
   }
   await next();
 }
 const loginLocks = /* @__PURE__ */ new Set();
+function cleanupLoginState(ctx) {
+  const email = ctx.request.body?.email;
+  loginLocks.delete(email);
+  if (email && ctx.status < 400) {
+    revokedTokenSet.delete(email);
+  }
+}
 async function preventMultipleSessions(ctx, next) {
   const isLoginPost = ctx.path === LOGIN_PATH && ctx.method === "POST";
-  const alreadyAdmin = ctx.session?.user;
   if (!isLoginPost) {
     return await next();
   }
-  if (alreadyAdmin) {
-    strapi.log.debug(`Skipping session lock. ${JSON.stringify(alreadyAdmin)}`);
+  if (ctx.state[CTX_ADMIN_USER]) {
+    strapi.log.debug(
+      `[${PLUGIN_ID}] Skipping session lock. ${JSON.stringify(ctx.state[CTX_ADMIN_USER])}`
+    );
     return await next();
   }
   try {
     const { email } = ctx.request.body ?? {};
     if (!email) {
-      strapi.log.warn("⚠️ Email missing in login request. Skipping session lock.");
+      strapi.log.warn(`[${PLUGIN_ID}] Email missing in login request. Skipping session lock.`);
       return await next();
     }
-    const settings = await strapi.entityService.findMany("plugin::strapi-security-suite.security-settings", {});
+    const settings = await strapi.documents(CONTENT_TYPES.SECURITY_SETTINGS).findFirst({});
     if (!settings?.multipleSessionsControl) return await next();
     const hasActiveSession = Array.from(sessionActivityMap.keys()).some(
       (key) => key.endsWith(`:${email}`)
     );
     if (hasActiveSession || loginLocks.has(email)) {
-      strapi.log.warn(`⛔ Login blocked for ${email}: already logged in or logging in.`);
-      ctx.status = 409;
+      strapi.log.warn(
+        `[${PLUGIN_ID}] Login blocked for ${email}: already logged in or logging in.`
+      );
+      ctx.status = HTTP_STATUS.CONFLICT;
       ctx.body = {
         error: {
-          status: 409,
-          message: "Multiple sessions are not allowed. You are already logged in elsewhere."
+          status: HTTP_STATUS.CONFLICT,
+          message: ERROR_MESSAGES.MULTIPLE_SESSIONS
         }
       };
       return;
     }
     loginLocks.add(email);
   } catch (err) {
-    strapi.log.error("🛑 Error in preventMultipleSessions:", err);
+    strapi.log.error(`[${PLUGIN_ID}] Error in preventMultipleSessions:`, err);
   }
   try {
     await next();
   } finally {
-    if (ctx.path === LOGIN_PATH && ctx.method === "POST") {
-      const email = ctx.request.body?.email;
-      loginLocks.delete(email);
-    }
+    cleanupLoginState(ctx);
   }
 }
-const checkAdminPermission = (requiredPermission) => async (ctx, next) => {
-  try {
-    const adminUser = ctx.session.user;
-    if (!adminUser) {
-      return ctx.unauthorized("User is not authenticated.");
-    }
-    const [roleId] = adminUser.roles.map((role) => role.id);
-    const adminPermissions = await strapi.admin.services.permission.findMany({
-      where: {
-        role: roleId,
-        action: requiredPermission
-      }
-    });
-    if (adminPermissions.length === 0) {
-      return ctx.forbidden(`Access denied. Missing permission: ${requiredPermission}`);
-    }
-    await next();
-  } catch (error) {
-    strapi.log.error("🔴 Error checking admin permission:", error);
-    return ctx.internalServerError("Failed to verify permissions.");
-  }
-};
-const forceExpireAdmin = async (ctx, userId) => {
-  const ADMIN_SECRET = strapi.config.get("admin.auth.secret");
-  const token = jwt.sign(
-    {
-      id: userId,
-      iat: Math.floor(Date.now() / 1e3),
-      exp: Math.floor(Date.now() / 1e3) + 1
-      // Expires in 1s
-    },
-    ADMIN_SECRET
-  );
-  ctx.cookies.set("jwtToken", token, {
-    httpOnly: true,
-    path: "/",
-    expires: new Date(Date.now() + 1e3)
-  });
-  strapi.log.info(`💣 Force-expired token for admin ${userId}`);
-};
 async function rejectRevokedTokens(ctx, next) {
-  const sessionCookie = ctx.cookies.get("koa.sess");
-  if (!sessionCookie) return await next();
+  const adminUser = ctx.state[CTX_ADMIN_USER];
+  if (!adminUser?.email) return await next();
+  const { id, email: adminEmail } = adminUser;
+  const key = id && adminEmail ? `${id}:${adminEmail}` : null;
   try {
-    const decoded = Buffer.from(sessionCookie, "base64").toString("utf8");
-    const sessionData = JSON.parse(decoded);
-    const { id, email: adminEmail } = sessionData?.user || {};
-    const key = id && adminEmail ? `${id}:${adminEmail}` : null;
     if (adminEmail && revokedTokenSet.has(adminEmail)) {
-      ctx.set("app.admin.tk", adminEmail);
-      ctx.set("Access-Control-Expose-Headers", "app.admin.tk");
-      ctx.cookies.set("koa.sess", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
-      ctx.cookies.set("koa.sess.sig", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
+      ctx.set(HEADERS.ADMIN_TOKEN_SIGNAL, adminEmail);
+      ctx.set(HEADERS.EXPOSE_HEADERS, HEADERS.ADMIN_TOKEN_SIGNAL);
+      if (ctx.session !== void 0) {
+        ctx.session = null;
+      }
+      ctx.cookies.set(COOKIES.REFRESH_TOKEN, "", {
+        expires: /* @__PURE__ */ new Date(0),
+        path: "/admin",
+        httpOnly: true
+      });
+      const bearerToken = ctx.get("authorization")?.split("Bearer ")[1];
+      if (bearerToken) {
+        revokedConnectionTokens.set(bearerToken, Date.now());
+      }
       sessionActivityMap.delete(key);
       revokedTokenSet.delete(adminEmail);
-      const userToken = ctx.cookies.get("jwtToken");
-      if (userToken) {
-        revokedConnectionTokens.add(ctx.cookies.get("jwtToken"));
+      strapi.plugin(PLUGIN_ID).service(SERVICES.AUTO_LOGOUT_CHECKER).clearSessionActivity(id, adminEmail);
+      try {
+        if (strapi.sessionManager) {
+          await strapi.sessionManager("admin").invalidateRefreshToken(String(id));
+        }
+      } catch (err) {
+        strapi.log.error(`[${PLUGIN_ID}] Failed to invalidate DB session for ${adminEmail}:`, err);
       }
-      strapi.service("plugin::strapi-security-suite.autoLogoutChecker").clearSessionActivity(id, adminEmail);
-      forceExpireAdmin(ctx, id);
-      strapi.log.info(`🔒 Session revoked: ${adminEmail} app.admin.logout`);
+      strapi.log.info(`[${PLUGIN_ID}] Session revoked: ${adminEmail}`);
       await next();
       return;
     }
   } catch (err) {
-    strapi.log.error("🛑 Error in rejectRevokedTokens middleware:", err);
+    strapi.log.error(`[${PLUGIN_ID}] Error in rejectRevokedTokens middleware:`, err);
   }
   await next();
 }
 async function interceptRenewToken(ctx, next) {
   if (ctx.path.includes(LOGOUT_PATH)) {
-    const adminUser = ctx.session?.user;
-    strapi.log.debug(`🟢 Logout captured updated: ${JSON.stringify(adminUser)}`);
-    ctx.cookies.set("koa.sess", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
-    ctx.cookies.set("koa.sess.sig", "", { expires: /* @__PURE__ */ new Date(0), path: "/" });
+    const adminUser = ctx.state[CTX_ADMIN_USER];
+    strapi.log.debug(`[${PLUGIN_ID}] Logout captured: ${JSON.stringify(adminUser)}`);
     if (adminUser?.id) {
-      strapi.service("plugin::strapi-security-suite.autoLogoutChecker").clearSessionActivity(adminUser?.id, adminUser?.email);
-      const userToken = ctx.cookies.get("jwtToken");
-      if (userToken) {
-        revokedConnectionTokens.add(ctx.cookies.get("jwtToken"));
+      strapi.plugin(PLUGIN_ID).service(SERVICES.AUTO_LOGOUT_CHECKER).clearSessionActivity(adminUser.id, adminUser.email);
+      const bearerToken = ctx.get("authorization")?.split("Bearer ")[1];
+      if (bearerToken) {
+        revokedConnectionTokens.set(bearerToken, Date.now());
       }
-      ctx.session = null;
-      sessionActivityMap.delete(`${adminUser?.id}:${adminUser?.email}`);
-      return;
+      if (ctx.session !== void 0) {
+        ctx.session = null;
+      }
+      sessionActivityMap.delete(`${adminUser.id}:${adminUser.email}`);
     }
+    await next();
+    return;
   }
-  if (ctx.path.includes("/renew-token") || ctx.path.includes("/content")) {
-    const { email } = ctx.session?.user || {};
-    if (!email) {
-      ctx.set("app.admin.tk", "email.admin");
-      ctx.set("Access-Control-Expose-Headers", "app.admin.tk");
-      await next();
-      return;
+  if (ctx.path.includes(ACCESS_TOKEN_PATH) || ctx.path.includes(CONTENT_PATH)) {
+    const adminUser = ctx.state[CTX_ADMIN_USER];
+    if (adminUser?.email) {
+      strapi.log.debug(`[${PLUGIN_ID}] Token renewal intercepted for ${adminUser.email}`);
     }
-    strapi.log.debug(`🟢 Renew token intercepted for ${email}`);
   }
   await next();
 }
@@ -185,33 +221,33 @@ async function seedUserInfos(ctx, next) {
     const token = authHeader.split("Bearer ")[1];
     if (!token) return await next();
     const decodedToken = jwt.decode(token);
-    const session = ctx.session?.user ?? null;
-    const adminId = decodedToken?.id;
-    if (!adminId || session?.id) {
-      strapi.log.debug("🔍 No actions needed.");
+    const adminId = decodedToken?.userId;
+    if (!adminId || ctx.state[CTX_ADMIN_USER]?.id) {
       return await next();
     }
-    const adminUser = await strapi.query("admin::user").findOne({ where: { id: adminId } });
+    const adminUser = await strapi.db.query("admin::user").findOne({
+      where: { id: adminId },
+      populate: ["roles"]
+    });
     if (!adminUser) {
-      strapi.log.debug(`👻 No admin user found with ID ${adminId}`);
-      return await next();
-    }
-    if (!sessionActivityMap.has(adminUser.email)) {
-      strapi.log.debug(`👻 Admin ${adminUser.email} has a revoked token`);
+      strapi.log.debug(`[${PLUGIN_ID}] No admin user found with ID ${adminId}`);
       return await next();
     }
-    const userInfos = {
+    ctx.state[CTX_ADMIN_USER] = {
       id: adminUser.id,
       email: adminUser.email,
       firstname: adminUser.firstname,
       lastname: adminUser.lastname,
       roles: adminUser.roles
     };
-    ctx.session.user = userInfos;
-    strapi.log.debug(`🧠 Session hydrated for admin ${adminUser.email}`);
+    const key = `${adminUser.id}:${adminUser.email}`;
+    if (!sessionActivityMap.has(key)) {
+      sessionActivityMap.set(key, Date.now());
+    }
+    strapi.log.debug(`[${PLUGIN_ID}] Admin identified: ${adminUser.email}`);
     return await next();
   } catch (error) {
-    strapi.log.error("🛑 Failed to decode or hydrate admin token:", error);
+    strapi.log.error(`[${PLUGIN_ID}] Failed to decode or hydrate admin token:`, error);
   }
   await next();
 }
@@ -220,8 +256,7 @@ const middlewares = {
   trackActivity,
   rejectRevokedTokens,
   preventMultipleSessions,
-  interceptRenewToken,
-  checkAdminPermission
+  interceptRenewToken
 };
 const bootstrap = async ({ strapi: strapi2 }) => {
   try {
@@ -230,66 +265,65 @@ const bootstrap = async ({ strapi: strapi2 }) => {
         section: "plugins",
         displayName: "Access Security Suite Plugin",
         uid: "access",
-        pluginName: "strapi-security-suite"
+        pluginName: PLUGIN_ID
       },
       {
         section: "plugins",
         displayName: "View Configs",
         uid: "view-configs",
-        pluginName: "strapi-security-suite"
+        pluginName: PLUGIN_ID
       },
       {
         section: "plugins",
         displayName: "Manage Configs",
         uid: "manage-configs",
-        pluginName: "strapi-security-suite"
+        pluginName: PLUGIN_ID
       }
     ];
     await strapi2.admin.services.permission.actionProvider.registerMany(actions);
   } catch (error) {
-    strapi2.log.error("❌ Failed to register SecSuite Plugin permissions:", error);
+    strapi2.log.error(`[${PLUGIN_ID}] Failed to register permissions:`, error);
   }
   await ensureDefaultSecuritySettings(strapi2);
   strapi2.server.use(middlewares.preventMultipleSessions);
-  strapi2.service("plugin::strapi-security-suite.autoLogoutChecker").startAutoLogoutWatcher();
+  strapi2.plugin(PLUGIN_ID).service(SERVICES.AUTO_LOGOUT_CHECKER).startAutoLogoutWatcher();
 };
 async function ensureDefaultSecuritySettings(strapi2) {
   try {
-    const existing = await strapi2.entityService.findMany("plugin::strapi-security-suite.security-settings");
-    if (Array.isArray(existing) && existing.length > 0) {
-      strapi2.log.info("✅ Default security settings already exist.");
+    const existing = await strapi2.documents(CONTENT_TYPES.SECURITY_SETTINGS).findFirst({});
+    if (existing) {
+      strapi2.log.info(`[${PLUGIN_ID}] Default security settings already exist.`);
       return;
     }
-    const DEFAULT_SETTINGS = {
-      autoLogoutTime: 30,
-      multipleSessionsControl: true,
-      passwordExpiryDays: 30,
-      nonReusablePassword: true,
-      enablePasswordManagement: true
-    };
-    await strapi2.db.query("plugin::strapi-security-suite.security-settings").create({ data: DEFAULT_SETTINGS });
-    strapi2.log.info("✅ Default security settings created successfully.");
+    await strapi2.documents(CONTENT_TYPES.SECURITY_SETTINGS).create({ data: DEFAULT_SETTINGS });
+    strapi2.log.info(`[${PLUGIN_ID}] Default security settings created successfully.`);
   } catch (error) {
-    console.log(error);
-    strapi2.log.error("❌ Failed to ensure default security settings:", error);
+    strapi2.log.error(`[${PLUGIN_ID}] Failed to ensure default security settings:`, error);
   }
 }
 const destroy = ({ strapi: strapi2 }) => {
-  strapi2.service("plugin::strapi-security-suite.autoLogoutChecker").stopAutoLogoutWatcher();
+  strapi2.plugin(PLUGIN_ID).service(SERVICES.AUTO_LOGOUT_CHECKER).stopAutoLogoutWatcher();
 };
 const register = ({ strapi: strapi2 }) => {
   strapi2.server.use(middlewares.seedUserInfos);
   strapi2.server.use(middlewares.interceptRenewToken);
   strapi2.server.use(middlewares.trackActivity);
   strapi2.server.use(middlewares.rejectRevokedTokens);
+  strapi2.log.info(`[${PLUGIN_ID}] Plugin registered successfully`);
 };
 const config = {
+  /** @type {object} Default plugin configuration (empty — all config lives in the DB). */
   default: {},
-  validator() {
+  /**
+   * Validates the plugin configuration object at startup.
+   * Currently a no-op; add schema checks here if external config is introduced.
+   *
+   * @param {object} _config - The configuration object to validate
+   */
+  validator(_config) {
   }
 };
 const kind = "singleType";
-const uid = "plugin::strapi-security-suite.security_settings";
 const info = {
   singularName: "security-settings",
   pluralName: "security-settings",
@@ -299,6 +333,14 @@ const info = {
 const options = {
   draftAndPublish: false
 };
+const pluginOptions = {
+  "content-manager": {
+    visible: false
+  },
+  "content-type-builder": {
+    visible: false
+  }
+};
 const attributes = {
   autoLogoutTime: {
     type: "integer",
@@ -325,9 +367,9 @@ const attributes = {
 };
 const schema = {
   kind,
-  uid,
   info,
   options,
+  pluginOptions,
   attributes
 };
 const securitySettings = {
@@ -336,37 +378,137 @@ const securitySettings = {
 const contentTypes = {
   "security-settings": securitySettings
 };
+class PluginError extends Error {
+  /**
+   * @param {string} message - Internal message (for logs)
+   * @param {string} sanitizedMessage - Safe message for the client
+   * @param {number} [statusCode=400] - HTTP status code
+   */
+  constructor(message, sanitizedMessage, statusCode = HTTP_STATUS.BAD_REQUEST) {
+    super(message);
+    this.name = "PluginError";
+    this.sanitizedMessage = sanitizedMessage;
+    this.statusCode = statusCode;
+  }
+}
+class ValidationError extends PluginError {
+  /**
+   * @param {string} message - Internal message
+   * @param {string} [sanitizedMessage='Validation failed.'] - Client-safe message
+   */
+  constructor(message, sanitizedMessage = "Validation failed.") {
+    super(message, sanitizedMessage, HTTP_STATUS.BAD_REQUEST);
+    this.name = "ValidationError";
+  }
+}
+const validateSettingsPayload = (body) => {
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    throw new ValidationError(
+      `Invalid payload type: ${typeof body}`,
+      ERROR_MESSAGES.INVALID_SETTINGS
+    );
+  }
+  const TYPE_RULES = {
+    autoLogoutTime: "number",
+    multipleSessionsControl: "boolean",
+    passwordExpiryDays: "number",
+    nonReusablePassword: "boolean",
+    enablePasswordManagement: "boolean"
+  };
+  const sanitized = {};
+  for (const key of VALID_SETTINGS_KEYS) {
+    if (!(key in body)) continue;
+    const value = body[key];
+    const expected = TYPE_RULES[key];
+    if (expected && typeof value !== expected) {
+      throw new ValidationError(
+        `Invalid type for "${key}": expected ${expected}, got ${typeof value}`,
+        ERROR_MESSAGES.INVALID_SETTINGS
+      );
+    }
+    sanitized[key] = value;
+  }
+  return sanitized;
+};
 const adminSecurityController = ({ strapi: strapi2 }) => ({
+  /**
+   * Returns the current security settings.
+   *
+   * @param {import('koa').Context} ctx - Koa context
+   */
   async getSettings(ctx) {
-    const settings = await strapi2.entityService.findMany("plugin::strapi-security-suite.security-settings");
-    ctx.send(settings);
+    try {
+      const doc = await strapi2.documents(CONTENT_TYPES.SECURITY_SETTINGS).findFirst({});
+      const settings = {};
+      for (const key of VALID_SETTINGS_KEYS) {
+        if (doc && key in doc) settings[key] = doc[key];
+      }
+      ctx.body = { data: settings };
+    } catch (err) {
+      strapi2.log.error(`[${PLUGIN_ID}] getSettings error:`, err);
+      ctx.throw(
+        err.statusCode || HTTP_STATUS.BAD_REQUEST,
+        err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR
+      );
+    }
   },
+  /**
+   * Validates and persists updated security settings.
+   *
+   * If a settings record already exists it is updated; otherwise a new record
+   * is created. The request body is validated against allowed keys and types
+   * before any database write.
+   *
+   * @param {import('koa').Context} ctx - Koa context
+   */
   async saveSettings(ctx) {
-    const data = ctx.request.body;
-    const existing = await strapi2.entityService.findMany("plugin::strapi-security-suite.security-settings");
-    if (existing?.id) {
-      await strapi2.entityService.update("plugin::strapi-security-suite.security-settings", existing.id, { data });
-    } else {
-      await strapi2.entityService.create("plugin::strapi-security-suite.security-settings", { data });
+    try {
+      const data = validateSettingsPayload(ctx.request.body);
+      const existing = await strapi2.documents(CONTENT_TYPES.SECURITY_SETTINGS).findFirst({});
+      if (existing?.documentId) {
+        await strapi2.documents(CONTENT_TYPES.SECURITY_SETTINGS).update({ documentId: existing.documentId, data });
+      } else {
+        await strapi2.documents(CONTENT_TYPES.SECURITY_SETTINGS).create({ data });
+      }
+      ctx.body = { data: { message: "Settings saved successfully" } };
+    } catch (err) {
+      strapi2.log.error(`[${PLUGIN_ID}] saveSettings error:`, err);
+      ctx.throw(
+        err.statusCode || HTTP_STATUS.BAD_REQUEST,
+        err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR
+      );
     }
-    ctx.send({ message: "Settings saved successfully" });
   }
 });
 const controllers = {
   adminSecurityController
 };
-const policies = {};
-const routes = [
+const hasAdminPermission = async (policyContext, config2, { strapi: strapi2 }) => {
+  const user = policyContext.state.user;
+  if (!user) {
+    return false;
+  }
+  const requiredPermission = config2?.permission;
+  if (!requiredPermission) {
+    return true;
+  }
+  const [roleId] = user.roles.map((role) => role.id);
+  const permissions = await strapi2.admin.services.permission.findMany({
+    where: {
+      role: roleId,
+      action: requiredPermission
+    }
+  });
+  return permissions.length > 0;
+};
+const policies = {
+  "has-admin-permission": hasAdminPermission
+};
+const admin = [
   {
     method: "GET",
     path: "/health",
-    handler: async (ctx) => {
-      ctx.send({
-        status: "ok",
-        uptime: process.uptime(),
-        timestamp: Date.now()
-      });
-    },
+    handler: "adminSecurityController.getSettings",
     config: {
       auth: false
     }
@@ -376,9 +518,12 @@ const routes = [
     path: "/admin/settings",
     handler: "adminSecurityController.getSettings",
     config: {
-      policies: [],
-      auth: false,
-      middlewares: [middlewares.checkAdminPermission("plugin::strapi-security-suite.view-configs")]
+      policies: [
+        {
+          name: "plugin::strapi-security-suite.has-admin-permission",
+          config: { permission: PERMISSIONS.VIEW_CONFIGS }
+        }
+      ]
     }
   },
   {
@@ -386,68 +531,87 @@ const routes = [
     path: "/admin/settings",
     handler: "adminSecurityController.saveSettings",
     config: {
-      policies: [],
-      auth: false,
-      middlewares: [middlewares.checkAdminPermission("plugin::strapi-security-suite.manage-configs")]
+      policies: [
+        {
+          name: "plugin::strapi-security-suite.has-admin-permission",
+          config: { permission: PERMISSIONS.MANAGE_CONFIGS }
+        }
+      ]
     }
   }
 ];
+const routes = {
+  admin: {
+    type: "admin",
+    routes: admin
+  }
+};
 let interval = null;
 const autoLogoutChecker = ({ strapi: strapi2 }) => ({
   /**
-   * Starts the auto-logout watcher that checks session activity every X ms.
+   * Starts the auto-logout watcher interval.
+   *
+   * Runs every {@link CHECK_INTERVAL} ms, reads the configured `autoLogoutTime`
+   * from the database, and revokes tokens for sessions that have been idle
+   * beyond the threshold.
    */
   startAutoLogoutWatcher() {
     if (interval) {
-      strapi2.log.warn("⚠️ AutoLogoutWatcher already running.");
+      strapi2.log.warn(`[${PLUGIN_ID}] AutoLogoutWatcher already running.`);
       return;
     }
     interval = setInterval(async () => {
       try {
-        const settings = await strapi2.entityService.findMany("plugin::strapi-security-suite.security-settings", {});
-        const autoLogoutTime = (settings?.autoLogoutTime ?? 30) * 6e4;
+        pruneExpiredTokens();
+        const settings = await strapi2.documents(CONTENT_TYPES.SECURITY_SETTINGS).findFirst({});
+        const autoLogoutTime = (settings?.autoLogoutTime ?? DEFAULT_AUTOLOGOUT_TIME) * MS_PER_MINUTE;
         const now = Date.now();
         for (const [key, lastActive] of sessionActivityMap.entries()) {
           const [adminId, email] = key.split(":");
           const idleDuration = now - lastActive;
-          if (idleDuration > autoLogoutTime) {
-            if (!revokedTokenSet.has(email)) {
-              revokedTokenSet.add(email);
-              sessionActivityMap.delete(key);
-              strapi2.log.info(`🔒 Auto-logged out admin "${email}" after ${Math.floor(idleDuration / 1e3)}s of inactivity.`);
-            }
+          if (idleDuration <= autoLogoutTime || revokedTokenSet.has(email)) continue;
+          revokedTokenSet.add(email);
+          sessionActivityMap.delete(key);
+          if (strapi2.sessionManager) {
+            await strapi2.sessionManager("admin").invalidateRefreshToken(String(adminId)).catch(
+              (e) => strapi2.log.error(`[${PLUGIN_ID}] Failed to invalidate DB session for ${email}:`, e)
+            );
           }
+          strapi2.log.info(
+            `[${PLUGIN_ID}] Auto-logged out admin "${email}" after ${Math.floor(idleDuration / MS_PER_SECOND)}s of inactivity.`
+          );
         }
       } catch (err) {
-        strapi2.log.error("❌ AutoLogoutWatcher failed:", err);
+        strapi2.log.error(`[${PLUGIN_ID}] AutoLogoutWatcher failed:`, err);
       }
     }, CHECK_INTERVAL);
   },
   /**
-   * Stops the auto-logout watcher.
+   * Stops the auto-logout watcher interval and releases the timer reference.
    */
   stopAutoLogoutWatcher() {
     if (interval) {
       clearInterval(interval);
       interval = null;
-      strapi2.log.info("🛑 AutoLogoutWatcher stopped.");
+      strapi2.log.info(`[${PLUGIN_ID}] AutoLogoutWatcher stopped.`);
     }
   },
   /**
-   * Manually clear session activity for a user.
-   * @param {string} adminId
-   * @param {string} email
-   * @param {string} reason
+   * Manually clears session activity and revoked state for a user.
+   *
+   * @param {string} adminId - Admin user ID
+   * @param {string} email - Admin email address
+   * @param {string} [reason='manual'] - Reason for clearing (used in log messages)
    */
   clearSessionActivity(adminId, email, reason = "manual") {
     const key = `${adminId}:${email}`;
     if (sessionActivityMap.has(key)) {
       sessionActivityMap.delete(key);
-      strapi2.log.info(`🧹 Session cleared for ${key} (${reason})`);
+      strapi2.log.info(`[${PLUGIN_ID}] Session cleared for ${key} (${reason})`);
     }
     if (revokedTokenSet.has(email)) {
       revokedTokenSet.delete(email);
-      strapi2.log.info(`✅ Revoked token cleared for ${email}`);
+      strapi2.log.info(`[${PLUGIN_ID}] Revoked token cleared for ${email}`);
     }
   }
 });