strapi-security-suite 0.3.0 → 0.3.2

package/dist/_chunks/{App-t96Cfein.mjs → App-CBOxzfqu.mjs}

@@ -3,7 +3,7 @@ import { useFetchClient, Page } from "@strapi/strapi/admin";
 import { Routes, Route } from "react-router-dom";
 import { useState, useEffect } from "react";
 import { Box, Typography, Alert, Flex, Divider, NumberInput, Switch, Button } from "@strapi/design-system";
-import { A as API_BASE_PATH, S as SUCCESS_ALERT_DURATION } from "./index-CAEB836L.mjs";
+import { A as API_BASE_PATH, S as SUCCESS_ALERT_DURATION } from "./index-ZKJuPZEH.mjs";
 const HomePage = () => {
   const client = useFetchClient();
   const [config, setConfig] = useState({

package/dist/_chunks/{App-CfPg1Thn.js → App-ConqHB2Q.js}

@@ -5,7 +5,7 @@ const admin = require("@strapi/strapi/admin");
 const reactRouterDom = require("react-router-dom");
 const react = require("react");
 const designSystem = require("@strapi/design-system");
-const index = require("./index-ub4Bl9QF.js");
+const index = require("./index-BGBd43He.js");
 const HomePage = () => {
   const client = admin.useFetchClient();
   const [config, setConfig] = react.useState({

package/dist/_chunks/{index-ub4Bl9QF.js → index-BGBd43He.js}

@@ -49,9 +49,8 @@ const index = {
         const response = await originalFetch(...args);
         const captured = response.headers.get(ADMIN_TOKEN_HEADER);
         if (captured) {
-          window.stop();
           window.location.reload();
-          return;
+          return new Response(null, { status: 401 });
         }
         return response;
       };
@@ -71,7 +70,7 @@ const index = {
         id: getTrad("settings.title"),
         defaultMessage: "Security Suite"
       },
-      Component: () => Promise.resolve().then(() => require("./App-CfPg1Thn.js")),
+      Component: () => Promise.resolve().then(() => require("./App-ConqHB2Q.js")),
       permissions: [
         {
           action: "plugin::strapi-security-suite.access",

package/dist/_chunks/{index-CAEB836L.mjs → index-ZKJuPZEH.mjs}

@@ -48,9 +48,8 @@ const index = {
         const response = await originalFetch(...args);
         const captured = response.headers.get(ADMIN_TOKEN_HEADER);
         if (captured) {
-          window.stop();
           window.location.reload();
-          return;
+          return new Response(null, { status: 401 });
         }
         return response;
       };
@@ -70,7 +69,7 @@ const index = {
         id: getTrad("settings.title"),
         defaultMessage: "Security Suite"
       },
-      Component: () => import("./App-t96Cfein.mjs"),
+      Component: () => import("./App-CBOxzfqu.mjs"),
       permissions: [
         {
           action: "plugin::strapi-security-suite.access",

package/dist/admin/index.js

@@ -1,3 +1,3 @@
 "use strict";
-const index = require("../_chunks/index-ub4Bl9QF.js");
+const index = require("../_chunks/index-BGBd43He.js");
 module.exports = index.index;

package/dist/admin/index.mjs

@@ -1,4 +1,4 @@
-import { i } from "../_chunks/index-CAEB836L.mjs";
+import { i } from "../_chunks/index-ZKJuPZEH.mjs";
 export {
   i as default
 };

package/dist/server/index.js

@@ -3,7 +3,16 @@ const jwt = require("jsonwebtoken");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const jwt__default = /* @__PURE__ */ _interopDefault(jwt);
 const revokedTokenSet = /* @__PURE__ */ new Set();
-const revokedConnectionTokens = /* @__PURE__ */ new Set();
+const revokedConnectionTokens = /* @__PURE__ */ new Map();
+const TOKEN_TTL = 30 * 60 * 1e3;
+function pruneExpiredTokens() {
+  const cutoff = Date.now() - TOKEN_TTL;
+  for (const [token, revokedAt] of revokedConnectionTokens) {
+    if (revokedAt < cutoff) {
+      revokedConnectionTokens.delete(token);
+    }
+  }
+}
 const sessionActivityMap = /* @__PURE__ */ new Map();
 const PLUGIN_ID = "strapi-security-suite";
 const CONTENT_TYPES = {
@@ -12,6 +21,7 @@ const CONTENT_TYPES = {
 const SERVICES = {
   AUTO_LOGOUT_CHECKER: "autoLogoutChecker"
 };
+const CTX_ADMIN_USER = Symbol.for("security-suite:adminUser");
 const CHECK_INTERVAL = 5e3;
 const DEFAULT_AUTOLOGOUT_TIME = 30;
 const MS_PER_MINUTE = 6e4;
@@ -29,7 +39,9 @@ const COOKIES = {
   SESSION: "koa.sess",
   SESSION_SIG: "koa.sess.sig",
   /** Strapi v5 admin refresh-token cookie (managed by session manager). */
-  REFRESH_TOKEN: "strapi_admin_refresh"
+  REFRESH_TOKEN: "strapi_admin_refresh",
+  /** JWT access-token cookie set by Strapi EE SSO authentication flow. */
+  JWT_TOKEN: "jwtToken"
 };
 const HEADERS = {
   /** Header that signals the frontend to force-reload (session revoked). */
@@ -37,7 +49,6 @@ const HEADERS = {
   /** Required so the browser exposes custom headers in fetch responses. */
   EXPOSE_HEADERS: "Access-Control-Expose-Headers"
 };
-const ADMIN_TOKEN_FALLBACK = "email.admin";
 const ERROR_MESSAGES = {
   SETTINGS_NOT_FOUND: "Security settings not found.",
   INSUFFICIENT_PERMISSIONS: "Insufficient permissions.",
@@ -60,8 +71,49 @@ const DEFAULT_SETTINGS = {
   enablePasswordManagement: true
 };
 const VALID_SETTINGS_KEYS = new Set(Object.keys(DEFAULT_SETTINGS));
+class PluginError extends Error {
+  /**
+   * @param {string} message - Internal message (for logs)
+   * @param {string} sanitizedMessage - Safe message for the client
+   * @param {number} [statusCode=400] - HTTP status code
+   */
+  constructor(message, sanitizedMessage, statusCode = HTTP_STATUS.BAD_REQUEST) {
+    super(message);
+    this.name = "PluginError";
+    this.sanitizedMessage = sanitizedMessage;
+    this.statusCode = statusCode;
+  }
+}
+class ValidationError extends PluginError {
+  /**
+   * @param {string} message - Internal message
+   * @param {string} [sanitizedMessage='Validation failed.'] - Client-safe message
+   */
+  constructor(message, sanitizedMessage = "Validation failed.") {
+    super(message, sanitizedMessage, HTTP_STATUS.BAD_REQUEST);
+    this.name = "ValidationError";
+  }
+}
+function clearSessionCookies(ctx) {
+  if (ctx.session !== void 0) {
+    ctx.session = null;
+  }
+  const expireOpts = { expires: /* @__PURE__ */ new Date(0), path: "/", httpOnly: true };
+  ctx.cookies.set(COOKIES.SESSION, "", expireOpts);
+  ctx.cookies.set(COOKIES.SESSION_SIG, "", expireOpts);
+  ctx.cookies.set(COOKIES.REFRESH_TOKEN, "", {
+    expires: /* @__PURE__ */ new Date(0),
+    path: "/admin",
+    httpOnly: true
+  });
+  ctx.cookies.set(COOKIES.JWT_TOKEN, "", {
+    expires: /* @__PURE__ */ new Date(0),
+    path: "/",
+    httpOnly: false
+  });
+}
 async function trackActivity(ctx, next) {
-  const adminUser = ctx.session?.user;
+  const adminUser = ctx.state[CTX_ADMIN_USER];
   let key = adminUser?.id ? `${adminUser.id}:${adminUser.email}` : null;
   const bearerToken = ctx.get("authorization")?.split("Bearer ")[1];
   if (bearerToken && revokedConnectionTokens.has(bearerToken)) {
@@ -76,7 +128,7 @@ async function trackActivity(ctx, next) {
     return;
   }
   if (ctx.path.includes(LOGOUT_PATH)) {
-    ctx.session = null;
+    clearSessionCookies(ctx);
     key = null;
   }
   if (key) {
@@ -86,14 +138,22 @@ async function trackActivity(ctx, next) {
   await next();
 }
 const loginLocks = /* @__PURE__ */ new Set();
+function cleanupLoginState(ctx) {
+  const email = ctx.request.body?.email;
+  loginLocks.delete(email);
+  if (email && ctx.status < 400) {
+    revokedTokenSet.delete(email);
+  }
+}
 async function preventMultipleSessions(ctx, next) {
   const isLoginPost = ctx.path === LOGIN_PATH && ctx.method === "POST";
-  const alreadyAdmin = ctx.session?.user;
   if (!isLoginPost) {
     return await next();
   }
-  if (alreadyAdmin) {
-    strapi.log.debug(`[${PLUGIN_ID}] Skipping session lock. ${JSON.stringify(alreadyAdmin)}`);
+  if (ctx.state[CTX_ADMIN_USER]) {
+    strapi.log.debug(
+      `[${PLUGIN_ID}] Skipping session lock. ${JSON.stringify(ctx.state[CTX_ADMIN_USER])}`
+    );
     return await next();
   }
   try {
@@ -127,30 +187,22 @@ async function preventMultipleSessions(ctx, next) {
   try {
     await next();
   } finally {
-    if (ctx.path === LOGIN_PATH && ctx.method === "POST") {
-      const email = ctx.request.body?.email;
-      loginLocks.delete(email);
-    }
+    cleanupLoginState(ctx);
   }
 }
 async function rejectRevokedTokens(ctx, next) {
-  const sessionUser = ctx.session?.user;
-  if (!sessionUser?.email) return await next();
-  const { id, email: adminEmail } = sessionUser;
+  const adminUser = ctx.state[CTX_ADMIN_USER];
+  if (!adminUser?.email) return await next();
+  const { id, email: adminEmail } = adminUser;
   const key = id && adminEmail ? `${id}:${adminEmail}` : null;
   try {
     if (adminEmail && revokedTokenSet.has(adminEmail)) {
       ctx.set(HEADERS.ADMIN_TOKEN_SIGNAL, adminEmail);
       ctx.set(HEADERS.EXPOSE_HEADERS, HEADERS.ADMIN_TOKEN_SIGNAL);
-      ctx.session = null;
-      ctx.cookies.set(COOKIES.REFRESH_TOKEN, "", {
-        expires: /* @__PURE__ */ new Date(0),
-        path: "/admin",
-        httpOnly: true
-      });
+      clearSessionCookies(ctx);
       const bearerToken = ctx.get("authorization")?.split("Bearer ")[1];
       if (bearerToken) {
-        revokedConnectionTokens.add(bearerToken);
+        revokedConnectionTokens.set(bearerToken, Date.now());
       }
       sessionActivityMap.delete(key);
       revokedTokenSet.delete(adminEmail);
@@ -173,29 +225,25 @@ async function rejectRevokedTokens(ctx, next) {
 }
 async function interceptRenewToken(ctx, next) {
   if (ctx.path.includes(LOGOUT_PATH)) {
-    const adminUser = ctx.session?.user;
+    const adminUser = ctx.state[CTX_ADMIN_USER];
     strapi.log.debug(`[${PLUGIN_ID}] Logout captured: ${JSON.stringify(adminUser)}`);
     if (adminUser?.id) {
       strapi.plugin(PLUGIN_ID).service(SERVICES.AUTO_LOGOUT_CHECKER).clearSessionActivity(adminUser.id, adminUser.email);
       const bearerToken = ctx.get("authorization")?.split("Bearer ")[1];
       if (bearerToken) {
-        revokedConnectionTokens.add(bearerToken);
+        revokedConnectionTokens.set(bearerToken, Date.now());
       }
-      ctx.session = null;
+      clearSessionCookies(ctx);
       sessionActivityMap.delete(`${adminUser.id}:${adminUser.email}`);
     }
     await next();
     return;
   }
   if (ctx.path.includes(ACCESS_TOKEN_PATH) || ctx.path.includes(CONTENT_PATH)) {
-    const { email } = ctx.session?.user || {};
-    if (!email) {
-      ctx.set(HEADERS.ADMIN_TOKEN_SIGNAL, ADMIN_TOKEN_FALLBACK);
-      ctx.set(HEADERS.EXPOSE_HEADERS, HEADERS.ADMIN_TOKEN_SIGNAL);
-      await next();
-      return;
+    const adminUser = ctx.state[CTX_ADMIN_USER];
+    if (adminUser?.email) {
+      strapi.log.debug(`[${PLUGIN_ID}] Token renewal intercepted for ${adminUser.email}`);
     }
-    strapi.log.debug(`[${PLUGIN_ID}] Token renewal intercepted for ${email}`);
   }
   await next();
 }
@@ -208,9 +256,8 @@ async function seedUserInfos(ctx, next) {
     const token = authHeader.split("Bearer ")[1];
     if (!token) return await next();
     const decodedToken = jwt__default.default.decode(token);
-    const session = ctx.session?.user ?? null;
     const adminId = decodedToken?.userId;
-    if (!adminId || session?.id) {
+    if (!adminId || ctx.state[CTX_ADMIN_USER]?.id) {
       return await next();
     }
     const adminUser = await strapi.db.query("admin::user").findOne({
@@ -221,25 +268,18 @@ async function seedUserInfos(ctx, next) {
       strapi.log.debug(`[${PLUGIN_ID}] No admin user found with ID ${adminId}`);
       return await next();
     }
-    if (revokedTokenSet.has(adminUser.email)) {
-      strapi.log.debug(
-        `[${PLUGIN_ID}] Admin ${adminUser.email} is in revoked set — skipping hydration`
-      );
-      return await next();
-    }
-    const userInfos = {
+    ctx.state[CTX_ADMIN_USER] = {
       id: adminUser.id,
       email: adminUser.email,
       firstname: adminUser.firstname,
       lastname: adminUser.lastname,
       roles: adminUser.roles
     };
-    ctx.session.user = userInfos;
     const key = `${adminUser.id}:${adminUser.email}`;
     if (!sessionActivityMap.has(key)) {
       sessionActivityMap.set(key, Date.now());
     }
-    strapi.log.debug(`[${PLUGIN_ID}] Session hydrated for admin ${adminUser.email}`);
+    strapi.log.debug(`[${PLUGIN_ID}] Admin identified: ${adminUser.email}`);
     return await next();
   } catch (error) {
     strapi.log.error(`[${PLUGIN_ID}] Failed to decode or hydrate admin token:`, error);
@@ -373,29 +413,6 @@ const securitySettings = {
 const contentTypes = {
   "security-settings": securitySettings
 };
-class PluginError extends Error {
-  /**
-   * @param {string} message - Internal message (for logs)
-   * @param {string} sanitizedMessage - Safe message for the client
-   * @param {number} [statusCode=400] - HTTP status code
-   */
-  constructor(message, sanitizedMessage, statusCode = HTTP_STATUS.BAD_REQUEST) {
-    super(message);
-    this.name = "PluginError";
-    this.sanitizedMessage = sanitizedMessage;
-    this.statusCode = statusCode;
-  }
-}
-class ValidationError extends PluginError {
-  /**
-   * @param {string} message - Internal message
-   * @param {string} [sanitizedMessage='Validation failed.'] - Client-safe message
-   */
-  constructor(message, sanitizedMessage = "Validation failed.") {
-    super(message, sanitizedMessage, HTTP_STATUS.BAD_REQUEST);
-    this.name = "ValidationError";
-  }
-}
 const validateSettingsPayload = (body) => {
   if (!body || typeof body !== "object" || Array.isArray(body)) {
     throw new ValidationError(
@@ -557,6 +574,7 @@ const autoLogoutChecker = ({ strapi: strapi2 }) => ({
     }
     interval = setInterval(async () => {
       try {
+        pruneExpiredTokens();
         const settings = await strapi2.documents(CONTENT_TYPES.SECURITY_SETTINGS).findFirst({});
         const autoLogoutTime = (settings?.autoLogoutTime ?? DEFAULT_AUTOLOGOUT_TIME) * MS_PER_MINUTE;
         const now = Date.now();

package/dist/server/index.mjs

@@ -1,6 +1,15 @@
 import jwt from "jsonwebtoken";
 const revokedTokenSet = /* @__PURE__ */ new Set();
-const revokedConnectionTokens = /* @__PURE__ */ new Set();
+const revokedConnectionTokens = /* @__PURE__ */ new Map();
+const TOKEN_TTL = 30 * 60 * 1e3;
+function pruneExpiredTokens() {
+  const cutoff = Date.now() - TOKEN_TTL;
+  for (const [token, revokedAt] of revokedConnectionTokens) {
+    if (revokedAt < cutoff) {
+      revokedConnectionTokens.delete(token);
+    }
+  }
+}
 const sessionActivityMap = /* @__PURE__ */ new Map();
 const PLUGIN_ID = "strapi-security-suite";
 const CONTENT_TYPES = {
@@ -9,6 +18,7 @@ const CONTENT_TYPES = {
 const SERVICES = {
   AUTO_LOGOUT_CHECKER: "autoLogoutChecker"
 };
+const CTX_ADMIN_USER = Symbol.for("security-suite:adminUser");
 const CHECK_INTERVAL = 5e3;
 const DEFAULT_AUTOLOGOUT_TIME = 30;
 const MS_PER_MINUTE = 6e4;
@@ -26,7 +36,9 @@ const COOKIES = {
   SESSION: "koa.sess",
   SESSION_SIG: "koa.sess.sig",
   /** Strapi v5 admin refresh-token cookie (managed by session manager). */
-  REFRESH_TOKEN: "strapi_admin_refresh"
+  REFRESH_TOKEN: "strapi_admin_refresh",
+  /** JWT access-token cookie set by Strapi EE SSO authentication flow. */
+  JWT_TOKEN: "jwtToken"
 };
 const HEADERS = {
   /** Header that signals the frontend to force-reload (session revoked). */
@@ -34,7 +46,6 @@ const HEADERS = {
   /** Required so the browser exposes custom headers in fetch responses. */
   EXPOSE_HEADERS: "Access-Control-Expose-Headers"
 };
-const ADMIN_TOKEN_FALLBACK = "email.admin";
 const ERROR_MESSAGES = {
   SETTINGS_NOT_FOUND: "Security settings not found.",
   INSUFFICIENT_PERMISSIONS: "Insufficient permissions.",
@@ -57,8 +68,49 @@ const DEFAULT_SETTINGS = {
   enablePasswordManagement: true
 };
 const VALID_SETTINGS_KEYS = new Set(Object.keys(DEFAULT_SETTINGS));
+class PluginError extends Error {
+  /**
+   * @param {string} message - Internal message (for logs)
+   * @param {string} sanitizedMessage - Safe message for the client
+   * @param {number} [statusCode=400] - HTTP status code
+   */
+  constructor(message, sanitizedMessage, statusCode = HTTP_STATUS.BAD_REQUEST) {
+    super(message);
+    this.name = "PluginError";
+    this.sanitizedMessage = sanitizedMessage;
+    this.statusCode = statusCode;
+  }
+}
+class ValidationError extends PluginError {
+  /**
+   * @param {string} message - Internal message
+   * @param {string} [sanitizedMessage='Validation failed.'] - Client-safe message
+   */
+  constructor(message, sanitizedMessage = "Validation failed.") {
+    super(message, sanitizedMessage, HTTP_STATUS.BAD_REQUEST);
+    this.name = "ValidationError";
+  }
+}
+function clearSessionCookies(ctx) {
+  if (ctx.session !== void 0) {
+    ctx.session = null;
+  }
+  const expireOpts = { expires: /* @__PURE__ */ new Date(0), path: "/", httpOnly: true };
+  ctx.cookies.set(COOKIES.SESSION, "", expireOpts);
+  ctx.cookies.set(COOKIES.SESSION_SIG, "", expireOpts);
+  ctx.cookies.set(COOKIES.REFRESH_TOKEN, "", {
+    expires: /* @__PURE__ */ new Date(0),
+    path: "/admin",
+    httpOnly: true
+  });
+  ctx.cookies.set(COOKIES.JWT_TOKEN, "", {
+    expires: /* @__PURE__ */ new Date(0),
+    path: "/",
+    httpOnly: false
+  });
+}
 async function trackActivity(ctx, next) {
-  const adminUser = ctx.session?.user;
+  const adminUser = ctx.state[CTX_ADMIN_USER];
   let key = adminUser?.id ? `${adminUser.id}:${adminUser.email}` : null;
   const bearerToken = ctx.get("authorization")?.split("Bearer ")[1];
   if (bearerToken && revokedConnectionTokens.has(bearerToken)) {
@@ -73,7 +125,7 @@ async function trackActivity(ctx, next) {
     return;
   }
   if (ctx.path.includes(LOGOUT_PATH)) {
-    ctx.session = null;
+    clearSessionCookies(ctx);
     key = null;
   }
   if (key) {
@@ -83,14 +135,22 @@ async function trackActivity(ctx, next) {
   await next();
 }
 const loginLocks = /* @__PURE__ */ new Set();
+function cleanupLoginState(ctx) {
+  const email = ctx.request.body?.email;
+  loginLocks.delete(email);
+  if (email && ctx.status < 400) {
+    revokedTokenSet.delete(email);
+  }
+}
 async function preventMultipleSessions(ctx, next) {
   const isLoginPost = ctx.path === LOGIN_PATH && ctx.method === "POST";
-  const alreadyAdmin = ctx.session?.user;
   if (!isLoginPost) {
     return await next();
   }
-  if (alreadyAdmin) {
-    strapi.log.debug(`[${PLUGIN_ID}] Skipping session lock. ${JSON.stringify(alreadyAdmin)}`);
+  if (ctx.state[CTX_ADMIN_USER]) {
+    strapi.log.debug(
+      `[${PLUGIN_ID}] Skipping session lock. ${JSON.stringify(ctx.state[CTX_ADMIN_USER])}`
+    );
     return await next();
   }
   try {
@@ -124,30 +184,22 @@ async function preventMultipleSessions(ctx, next) {
   try {
     await next();
   } finally {
-    if (ctx.path === LOGIN_PATH && ctx.method === "POST") {
-      const email = ctx.request.body?.email;
-      loginLocks.delete(email);
-    }
+    cleanupLoginState(ctx);
   }
 }
 async function rejectRevokedTokens(ctx, next) {
-  const sessionUser = ctx.session?.user;
-  if (!sessionUser?.email) return await next();
-  const { id, email: adminEmail } = sessionUser;
+  const adminUser = ctx.state[CTX_ADMIN_USER];
+  if (!adminUser?.email) return await next();
+  const { id, email: adminEmail } = adminUser;
   const key = id && adminEmail ? `${id}:${adminEmail}` : null;
   try {
     if (adminEmail && revokedTokenSet.has(adminEmail)) {
       ctx.set(HEADERS.ADMIN_TOKEN_SIGNAL, adminEmail);
       ctx.set(HEADERS.EXPOSE_HEADERS, HEADERS.ADMIN_TOKEN_SIGNAL);
-      ctx.session = null;
-      ctx.cookies.set(COOKIES.REFRESH_TOKEN, "", {
-        expires: /* @__PURE__ */ new Date(0),
-        path: "/admin",
-        httpOnly: true
-      });
+      clearSessionCookies(ctx);
       const bearerToken = ctx.get("authorization")?.split("Bearer ")[1];
       if (bearerToken) {
-        revokedConnectionTokens.add(bearerToken);
+        revokedConnectionTokens.set(bearerToken, Date.now());
       }
       sessionActivityMap.delete(key);
       revokedTokenSet.delete(adminEmail);
@@ -170,29 +222,25 @@ async function rejectRevokedTokens(ctx, next) {
 }
 async function interceptRenewToken(ctx, next) {
   if (ctx.path.includes(LOGOUT_PATH)) {
-    const adminUser = ctx.session?.user;
+    const adminUser = ctx.state[CTX_ADMIN_USER];
     strapi.log.debug(`[${PLUGIN_ID}] Logout captured: ${JSON.stringify(adminUser)}`);
     if (adminUser?.id) {
       strapi.plugin(PLUGIN_ID).service(SERVICES.AUTO_LOGOUT_CHECKER).clearSessionActivity(adminUser.id, adminUser.email);
       const bearerToken = ctx.get("authorization")?.split("Bearer ")[1];
       if (bearerToken) {
-        revokedConnectionTokens.add(bearerToken);
+        revokedConnectionTokens.set(bearerToken, Date.now());
       }
-      ctx.session = null;
+      clearSessionCookies(ctx);
       sessionActivityMap.delete(`${adminUser.id}:${adminUser.email}`);
     }
     await next();
     return;
   }
   if (ctx.path.includes(ACCESS_TOKEN_PATH) || ctx.path.includes(CONTENT_PATH)) {
-    const { email } = ctx.session?.user || {};
-    if (!email) {
-      ctx.set(HEADERS.ADMIN_TOKEN_SIGNAL, ADMIN_TOKEN_FALLBACK);
-      ctx.set(HEADERS.EXPOSE_HEADERS, HEADERS.ADMIN_TOKEN_SIGNAL);
-      await next();
-      return;
+    const adminUser = ctx.state[CTX_ADMIN_USER];
+    if (adminUser?.email) {
+      strapi.log.debug(`[${PLUGIN_ID}] Token renewal intercepted for ${adminUser.email}`);
     }
-    strapi.log.debug(`[${PLUGIN_ID}] Token renewal intercepted for ${email}`);
   }
   await next();
 }
@@ -205,9 +253,8 @@ async function seedUserInfos(ctx, next) {
     const token = authHeader.split("Bearer ")[1];
     if (!token) return await next();
     const decodedToken = jwt.decode(token);
-    const session = ctx.session?.user ?? null;
     const adminId = decodedToken?.userId;
-    if (!adminId || session?.id) {
+    if (!adminId || ctx.state[CTX_ADMIN_USER]?.id) {
       return await next();
     }
     const adminUser = await strapi.db.query("admin::user").findOne({
@@ -218,25 +265,18 @@ async function seedUserInfos(ctx, next) {
       strapi.log.debug(`[${PLUGIN_ID}] No admin user found with ID ${adminId}`);
       return await next();
     }
-    if (revokedTokenSet.has(adminUser.email)) {
-      strapi.log.debug(
-        `[${PLUGIN_ID}] Admin ${adminUser.email} is in revoked set — skipping hydration`
-      );
-      return await next();
-    }
-    const userInfos = {
+    ctx.state[CTX_ADMIN_USER] = {
       id: adminUser.id,
       email: adminUser.email,
       firstname: adminUser.firstname,
       lastname: adminUser.lastname,
       roles: adminUser.roles
     };
-    ctx.session.user = userInfos;
     const key = `${adminUser.id}:${adminUser.email}`;
     if (!sessionActivityMap.has(key)) {
       sessionActivityMap.set(key, Date.now());
     }
-    strapi.log.debug(`[${PLUGIN_ID}] Session hydrated for admin ${adminUser.email}`);
+    strapi.log.debug(`[${PLUGIN_ID}] Admin identified: ${adminUser.email}`);
     return await next();
   } catch (error) {
     strapi.log.error(`[${PLUGIN_ID}] Failed to decode or hydrate admin token:`, error);
@@ -370,29 +410,6 @@ const securitySettings = {
 const contentTypes = {
   "security-settings": securitySettings
 };
-class PluginError extends Error {
-  /**
-   * @param {string} message - Internal message (for logs)
-   * @param {string} sanitizedMessage - Safe message for the client
-   * @param {number} [statusCode=400] - HTTP status code
-   */
-  constructor(message, sanitizedMessage, statusCode = HTTP_STATUS.BAD_REQUEST) {
-    super(message);
-    this.name = "PluginError";
-    this.sanitizedMessage = sanitizedMessage;
-    this.statusCode = statusCode;
-  }
-}
-class ValidationError extends PluginError {
-  /**
-   * @param {string} message - Internal message
-   * @param {string} [sanitizedMessage='Validation failed.'] - Client-safe message
-   */
-  constructor(message, sanitizedMessage = "Validation failed.") {
-    super(message, sanitizedMessage, HTTP_STATUS.BAD_REQUEST);
-    this.name = "ValidationError";
-  }
-}
 const validateSettingsPayload = (body) => {
   if (!body || typeof body !== "object" || Array.isArray(body)) {
     throw new ValidationError(
@@ -554,6 +571,7 @@ const autoLogoutChecker = ({ strapi: strapi2 }) => ({
     }
     interval = setInterval(async () => {
       try {
+        pruneExpiredTokens();
         const settings = await strapi2.documents(CONTENT_TYPES.SECURITY_SETTINGS).findFirst({});
         const autoLogoutTime = (settings?.autoLogoutTime ?? DEFAULT_AUTOLOGOUT_TIME) * MS_PER_MINUTE;
         const now = Date.now();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strapi-security-suite",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "All-in-one authentication and session security plugin for Strapi v5",
   "license": "MIT",
   "author": "(LPIX-11) <mohamed.johnson@orange-sonatel.com>",