django-microsys 2.2.4__tar.gz → 2.2.5__tar.gz

{django_microsys-2.2.4 → django_microsys-2.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django_microsys
-Version: 2.2.4
+Version: 2.2.5
 Summary: Django microSYS (System Integration Service) - Multilingual Django Starter Pack, Packed with Features.
 Author-email: DeBeski <debeski1@gmail.com>
 License: NON-COMMERCIAL

{django_microsys-2.2.4 → django_microsys-2.2.5}/django_microsys.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-microsys
-Version: 2.2.4
+Version: 2.2.5
 Summary: Django microSYS (System Integration Service) - Multilingual Django Starter Pack, Packed with Features.
 Author-email: DeBeski <debeski1@gmail.com>
 License: NON-COMMERCIAL

{django_microsys-2.2.4 → django_microsys-2.2.5}/django_microsys.egg-info/SOURCES.txt

@@ -34,6 +34,7 @@ microsys/signals.py
 microsys/tables.py
 microsys/themes.py
 microsys/translations.py
+microsys/trust.py
 microsys/urls.py
 microsys/utils.py
 microsys/widgets.py
@@ -54,6 +55,7 @@ microsys/migrations/0003_public_root_split.py
 microsys/migrations/0004_client_ip_and_trusted_devices.py
 microsys/migrations/0005_systemsettings_allow_user_font_override_and_more.py
 microsys/migrations/0006_systemsettings_navbar_config.py
+microsys/migrations/0007_systemsettings_prevent_multiple_active_sessions.py
 microsys/migrations/__init__.py
 microsys/scaffold_templates/app/README.md.tmpl
 microsys/scaffold_templates/app/__init__.py.tmpl

django_microsys-2.2.5/microsys/VERSION

@@ -0,0 +1 @@
+2.2.5

{django_microsys-2.2.4 → django_microsys-2.2.5}/microsys/forms.py

@@ -1616,6 +1616,10 @@ class SystemSettingsForm(forms.ModelForm):
         required=False,
         initial=False,
     )
+    prevent_multiple_active_sessions = forms.BooleanField(
+        required=False,
+        initial=False,
+    )
     client_ip_config = forms.CharField(
         widget=forms.HiddenInput(),
         required=False,
@@ -1675,6 +1679,7 @@ class SystemSettingsForm(forms.ModelForm):
             'allow_user_language_override',
             'default_table_density',
             'email_2fa',
+            'prevent_multiple_active_sessions',
             'client_ip_config',
             'public_root',
             'public_root_split_enabled',
@@ -1955,6 +1960,8 @@ class SystemSettingsForm(forms.ModelForm):
             'help_sys_email_2fa',
             'Allow users to enable two-factor authentication via email. Requires Microsys email delivery to be ready.',
         )
+        self.fields['prevent_multiple_active_sessions'].label = s.get('form_sys_prevent_multiple_active_sessions')
+        self.fields['prevent_multiple_active_sessions'].help_text = s.get('help_sys_prevent_multiple_active_sessions')
         self.fields['client_ip_mode'].label = s.get('form_sys_client_ip_mode')
         self.fields['client_ip_mode'].help_text = s.get('help_sys_client_ip_mode')
         self.fields['client_ip_mode'].choices = (
@@ -2326,6 +2333,10 @@ class SystemSettingsForm(forms.ModelForm):
             getattr(self.instance, 'email_2fa', False)
             or config.get('email_2fa', False)
         )
+        self.initial['prevent_multiple_active_sessions'] = bool(
+            getattr(self.instance, 'prevent_multiple_active_sessions', False)
+            or config.get('prevent_multiple_active_sessions', False)
+        )
         initial_client_ip_config = normalize_client_ip_config(
             (
                 getattr(self.instance, 'client_ip_config', None)
@@ -2721,6 +2732,7 @@ class SystemSettingsForm(forms.ModelForm):
                 Row(
                     build_settings_toggle_field(self, 'public_root', css_class='col-lg-6'),
                     build_settings_toggle_field(self, 'email_2fa', css_class='col-lg-6'),
+                    build_settings_toggle_field(self, 'prevent_multiple_active_sessions', css_class='col-lg-12'),
                     css_class='g-3 mb-3',
                 ),
                 HTML(f"<h6 class='fw-bold my-3'>{s.get('client_ip_settings_title')}</h6>"),
@@ -3071,6 +3083,17 @@ class SystemSettingsForm(forms.ModelForm):
             raise ValidationError("Invalid table density choice.")
         return value
 
+    def clean_prevent_multiple_active_sessions(self):
+        if (
+            self.is_bound
+            and self.mode != 'setup'
+            and self.single_step_mode
+            and self.single_step_index != 2
+            and 'prevent_multiple_active_sessions' not in self.data
+        ):
+            return bool(getattr(self.instance, 'prevent_multiple_active_sessions', False))
+        return bool(self.cleaned_data.get('prevent_multiple_active_sessions', False))
+
     def clean_sidebar_density(self):
         value = self.cleaned_data.get('sidebar_density') or DEFAULT_SIDEBAR_DENSITY
         if value not in SIDEBAR_DENSITY_VALUES:
@@ -3247,6 +3270,7 @@ class SystemSettingsForm(forms.ModelForm):
             'allow_user_language_override',
             'default_table_density',
             'email_2fa',
+            'prevent_multiple_active_sessions',
             'client_ip_config',
             'public_root',
             'public_root_split_enabled',
@@ -3495,6 +3519,7 @@ class SystemSettingsForm(forms.ModelForm):
             'allow_user_language_override': bool(self.cleaned_data.get('allow_user_language_override', True)),
             'default_table_density': self.cleaned_data.get('default_table_density', DEFAULT_TABLE_DENSITY),
             'email_2fa': bool(self.cleaned_data.get('email_2fa', False)),
+            'prevent_multiple_active_sessions': bool(self.cleaned_data.get('prevent_multiple_active_sessions', False)),
             'client_ip_config': self.cleaned_data.get('client_ip_config', default_client_ip_config()),
             'public_root': bool(self.cleaned_data.get('public_root', False)),
             'public_root_split_enabled': bool(self.cleaned_data.get('public_root_split_enabled', False)),

{django_microsys-2.2.4 → django_microsys-2.2.5}/microsys/management/commands/microsys_settings.py

@@ -61,6 +61,7 @@ class Command(BaseCommand):
         self.stdout.write(f"home_url: {instance.home_url or ''}")
         self.stdout.write(f"default_language: {instance.default_language or ''}")
         self.stdout.write(f"default_theme: {instance.default_theme or ''}")
+        self.stdout.write(f"prevent_multiple_active_sessions: {bool(getattr(instance, 'prevent_multiple_active_sessions', False))}")
         self.stdout.write(f"sidebar_enabled: {bool((instance.sidebar_config or {}).get('enabled', True))}")
         self.stdout.write(f"navbar_enabled: {bool((instance.navbar_config or {}).get('enabled', False))}")
 

django_microsys-2.2.5/microsys/migrations/0007_systemsettings_prevent_multiple_active_sessions.py

@@ -0,0 +1,18 @@
+# Generated by Django on 2026-05-24
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('microsys', '0006_systemsettings_navbar_config'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='systemsettings',
+            name='prevent_multiple_active_sessions',
+            field=models.BooleanField(default=False, verbose_name='Prevent Multiple Active Sessions'),
+        ),
+    ]

{django_microsys-2.2.4 → django_microsys-2.2.5}/microsys/models.py

@@ -148,6 +148,8 @@ class SingletonModel(models.Model):
                     obj.navbar_config = config.get('navbar')
                 if hasattr(obj, 'email_2fa') and 'email_2fa' in config:
                     obj.email_2fa = bool(config.get('email_2fa'))
+                if hasattr(obj, 'prevent_multiple_active_sessions') and 'prevent_multiple_active_sessions' in config:
+                    obj.prevent_multiple_active_sessions = bool(config.get('prevent_multiple_active_sessions'))
                 if hasattr(obj, 'public_root') and 'public_root' in config:
                     obj.public_root = bool(config.get('public_root'))
                 if hasattr(obj, 'public_root_split_enabled') and 'public_root_split_enabled' in config:
@@ -213,6 +215,7 @@ class SystemSettings(SingletonModel):
     sidebar_config = models.JSONField(default=dict, blank=True, verbose_name="Sidebar Configuration")
     navbar_config = models.JSONField(default=default_navbar_config, blank=True, verbose_name="Nav Bar Configuration")
     titlebar_config = models.JSONField(default=default_titlebar_config, blank=True, verbose_name="Titlebar Configuration")
+    prevent_multiple_active_sessions = models.BooleanField(default=False, verbose_name="Prevent Multiple Active Sessions")
 
     class Meta:
         verbose_name = "System Settings"

{django_microsys-2.2.4 → django_microsys-2.2.5}/microsys/static/microsys/main/js/system_setup.js

@@ -3209,7 +3209,7 @@
             }
         });
 
-        ['allow_user_theme_override', 'allow_user_font_override', 'allow_user_language_override', 'email_2fa', 'public_root', 'public_root_split_enabled', 'public_registration_enabled', 'registration_throttle_enabled'].forEach((name) => {
+        ['allow_user_theme_override', 'allow_user_font_override', 'allow_user_language_override', 'email_2fa', 'prevent_multiple_active_sessions', 'public_root', 'public_root_split_enabled', 'public_registration_enabled', 'registration_throttle_enabled'].forEach((name) => {
             if (Object.prototype.hasOwnProperty.call(settings, name)) {
                 setCheckboxField(form, name, settings[name]);
             }

{django_microsys-2.2.4 → django_microsys-2.2.5}/microsys/static/microsys/users/js/profile_2fa.js

@@ -29,9 +29,17 @@ document.addEventListener('DOMContentLoaded', function() {
 
     document.body.addEventListener('submit', function(e) {
         const revokeForm = e.target.closest('.profile-session-revoke-form');
-        if (!revokeForm) return;
-        e.preventDefault();
-        confirmSessionRevoke(revokeForm);
+        if (revokeForm) {
+            e.preventDefault();
+            confirmSessionRevoke(revokeForm);
+            return;
+        }
+
+        const trustForm = e.target.closest('.profile-session-trust-form');
+        if (trustForm) {
+            e.preventDefault();
+            confirmSessionTrust(trustForm);
+        }
     });
 
     if (otpSetupForm) {
@@ -631,6 +639,41 @@ function confirmSessionRevoke(form) {
     });
 }
 
+function confirmSessionTrust(form) {
+    const confirmMsg = form.dataset.confirmMsg || '';
+    const csrfToken = form.querySelector('[name=csrfmiddlewaretoken]')?.value || '';
+    const submitButton = form.querySelector('button[type="submit"]');
+
+    showConfirmation({
+        message: confirmMsg,
+        requirePassword: true,
+        onConfirm: function(currentPassword) {
+            const body = new URLSearchParams(new FormData(form));
+            body.set('current_password', currentPassword);
+            setButtonLoading(submitButton, true);
+
+            return fetch(form.action, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'X-CSRFToken': csrfToken,
+                    'X-Requested-With': 'XMLHttpRequest'
+                },
+                body: body.toString()
+            })
+            .then(parseJsonResponse)
+            .then(data => {
+                if (data.status !== 'success') {
+                    throw new Error(data.message || 'Request failed.');
+                }
+                window.location.assign(data.redirect_url || window.location.href);
+                return true;
+            })
+            .finally(() => setButtonLoading(submitButton, false));
+        }
+    });
+}
+
 function downloadBackupCodes() {
     const container = document.getElementById('backupCodesContainer');
     // Get text content effectively

{django_microsys-2.2.4 → django_microsys-2.2.5}/microsys/templates/microsys/users/profile.html

@@ -305,10 +305,23 @@
                                     </div>
                                     <div class="profile-session-action">
                                         {% if session.is_current %}
-                                            <button type="button" class="btn btn-sm btn-outline-secondary rounded-pill" disabled>
-                                                {{ MS_TRANS.current }}
-                                            </button>
-                                        {% else %}
+                                            {% if session.is_trusted %}
+                                                <button type="button" class="btn btn-sm btn-outline-secondary rounded-pill" disabled>
+                                                    {{ MS_TRANS.current }}
+                                                </button>
+                                            {% else %}
+                                                <form method="post"
+                                                      action="{% url 'trust_current_device' %}"
+                                                      class="profile-session-trust-form"
+                                                      data-confirm-msg="{{ MS_TRANS.msg_confirm_trust_current_device }}">
+                                                    {% csrf_token %}
+                                                    <input type="hidden" name="current_password" value="">
+                                                    <button type="submit" class="btn btn-sm btn-outline-primary rounded-pill">
+                                                        <i class="bi bi-shield-plus me-1"></i>{{ MS_TRANS.trust_this_device }}
+                                                    </button>
+                                                </form>
+                                            {% endif %}
+                                        {% elif session.can_revoke %}
                                             <form method="post"
                                                   action="{% url 'revoke_profile_session' session.session_key %}"
                                                   class="profile-session-revoke-form"
@@ -319,6 +332,13 @@
                                                     <i class="bi bi-box-arrow-right me-1"></i>{{ MS_TRANS.sign_out }}
                                                 </button>
                                             </form>
+                                        {% else %}
+                                            <button type="button"
+                                                    class="btn btn-sm btn-outline-secondary rounded-pill"
+                                                    data-ms-tooltip="{{ MS_TRANS.session_revoke_trusted_denied }}"
+                                                    disabled>
+                                                <i class="bi bi-shield-lock me-1"></i>{{ MS_TRANS.protected }}
+                                            </button>
                                         {% endif %}
                                     </div>
                                 </div>
@@ -635,5 +655,5 @@
 {% endblock %}
 
 {% block scripts %}
-    <script src="{% static 'microsys/users/js/profile_2fa.js' %}?v=20260522b" nonce="{{ request.csp_nonce }}"></script>
+    <script src="{% static 'microsys/users/js/profile_2fa.js' %}?v=20260524a" nonce="{{ request.csp_nonce }}"></script>
 {% endblock %}

{django_microsys-2.2.4 → django_microsys-2.2.5}/microsys/translations.py

@@ -253,6 +253,8 @@ MICROSYS_STRINGS = {
         'titlebar_surface_glass_desc': 'سطح زجاجي مع ضبابية خفيفة.',
         'form_sys_email_2fa': 'تفعيل التحقق الثنائي عبر البريد الإلكتروني',
         'help_sys_email_2fa': 'السماح للمستخدمين بتفعيل التحقق الثنائي عبر البريد الإلكتروني. يتطلب جاهزية إعدادات توصيل البريد في Microsys.',
+        'form_sys_prevent_multiple_active_sessions': 'منع تعدد الجلسات النشطة',
+        'help_sys_prevent_multiple_active_sessions': 'عند التفعيل، تصبح الجلسة الموثوقة الجديدة هي الجلسة النشطة الوحيدة لهذا المستخدم. تسجيل الدخول غير الموثوق يبقى مسموحاً لكنه لا يطرد الجلسات الموثوقة.',
         'form_sys_client_ip_mode': 'مصدر عنوان IP للعميل',
         'help_sys_client_ip_mode': 'اختر رأس الطلب الذي يجب أن يثق به Microsys عند تسجيل عناوين IP الخاصة بتسجيل الدخول والجلسات والأمان.',
         'client_ip_mode_x_forwarded_for': 'X-Forwarded-For',
@@ -662,8 +664,15 @@ MICROSYS_STRINGS = {
         'current_session': 'الجلسة الحالية',
         'trusted_device_badge': 'جهاز موثوق',
         'trusted_until': 'موثوق حتى',
+        'trust_this_device': 'ثق بهذا الجهاز',
+        'trusted_device_added_success': 'تم اعتبار هذا الجهاز موثوقاً.',
+        'session_revoke_trusted_denied': 'لا يمكن لجلسة غير موثوقة إنهاء جلسة موثوقة.',
+        'session_revoked_success': 'تم إنهاء الجلسة.',
+        'session_revoke_denied': 'هذه الجلسة لا تنتمي إلى حسابك.',
         'session_expires': 'تنتهي في',
         'current': 'الحالي',
+        'protected': 'محمي',
+        'sign_out': 'تسجيل الخروج',
         'no_active_sessions': 'لم يتم العثور على جلسات نشطة.',
         
         # Messages
@@ -743,6 +752,7 @@ MICROSYS_STRINGS = {
         'msg_confirm_generate_backup': 'سيؤدي إنشاء رموز احتياطية جديدة إلى إلغاء صلاحية أي رموز سابقة. هل أنت متأكد من رغبتك في الاستمرار؟',
         'msg_confirm_disable_2fa': 'هل أنت متأكد من رغبتك في تعطيل المصادقة الثنائية لهذه الطريقة؟',
         'msg_confirm_sign_out_session': 'هل أنت متأكد من رغبتك في إنهاء جلسة هذا الجهاز؟',
+        'msg_confirm_trust_current_device': 'هل تريد اعتبار هذا الجهاز موثوقاً لمدة 30 يوماً؟',
         'current_password_prompt': 'يرجى إدخال كلمة المرور الحالية للمتابعة.',
         'current_password_required': 'يرجى إدخال كلمة المرور الحالية.',
         'current_password_incorrect': 'كلمة المرور الحالية غير صحيحة.',
@@ -1172,6 +1182,8 @@ MICROSYS_STRINGS = {
         'titlebar_surface_glass_desc': 'Blurred glass-style titlebar surface.',
         'form_sys_email_2fa': 'Enable Email 2FA',
         'help_sys_email_2fa': 'Allow users to enable two-factor authentication via email. Requires Microsys email delivery to be ready.',
+        'form_sys_prevent_multiple_active_sessions': 'Prevent multiple active sessions',
+        'help_sys_prevent_multiple_active_sessions': 'When enabled, a newly trusted session becomes this user’s only active session. Untrusted logins remain allowed but cannot force out trusted sessions.',
         'form_sys_client_ip_mode': 'Client IP Source',
         'help_sys_client_ip_mode': 'Choose which request header Microsys should trust when recording login, session, and security IP addresses.',
         'client_ip_mode_x_forwarded_for': 'X-Forwarded-For',
@@ -1578,8 +1590,15 @@ MICROSYS_STRINGS = {
         'current_session': 'Current Session',
         'trusted_device_badge': 'Trusted Device',
         'trusted_until': 'Trusted Until',
+        'trust_this_device': 'Trust This Device',
+        'trusted_device_added_success': 'This device is now trusted.',
+        'session_revoke_trusted_denied': 'An untrusted session cannot sign out a trusted session.',
+        'session_revoked_success': 'Session signed out.',
+        'session_revoke_denied': 'That session does not belong to your account.',
         'session_expires': 'Expires',
         'current': 'Current',
+        'protected': 'Protected',
+        'sign_out': 'Sign Out',
         'no_active_sessions': 'No active sessions were found.',
         
         # Messages
@@ -1657,6 +1676,7 @@ MICROSYS_STRINGS = {
         'msg_confirm_generate_backup': 'Generating new backup codes will invalidate any existing codes. Are you sure you want to proceed?',
         'msg_confirm_disable_2fa': 'Are you sure you want to disable 2FA for this method?',
         'msg_confirm_sign_out_session': 'Are you sure you want to sign out this device session?',
+        'msg_confirm_trust_current_device': 'Trust this device for 30 days?',
         'current_password_prompt': 'Please enter your current password to continue.',
         'current_password_required': 'Please enter your current password.',
         'current_password_incorrect': 'Current password is incorrect.',

django_microsys-2.2.5/microsys/trust.py

@@ -0,0 +1,227 @@
+import hashlib
+import secrets
+from datetime import timedelta
+
+from django.apps import apps
+from django.contrib.sessions.models import Session
+from django.core.signing import BadSignature
+from django.db.models import Q
+from django.utils import timezone
+
+from .translations import get_strings
+from .utils import get_client_ip, get_system_config
+
+
+TRUSTED_DEVICE_COOKIE_NAME = 'microsys_trusted_device'
+TRUSTED_DEVICE_COOKIE_SALT = 'microsys.trusted_device'
+TRUSTED_DEVICE_MAX_AGE = 30 * 24 * 60 * 60
+
+
+def trusted_device_model():
+    return apps.get_model('microsys', 'TrustedDevice')
+
+
+def trusted_device_token_hash(raw_token):
+    return hashlib.sha256(str(raw_token or '').encode('utf-8')).hexdigest()
+
+
+def device_label(user_agent):
+    s = get_strings()
+    user_agent = str(user_agent or '').strip()
+    lowered = user_agent.lower()
+    if not user_agent:
+        return s.get('device_unknown')
+    if 'edg/' in lowered or 'edge/' in lowered:
+        browser = 'Edge'
+    elif 'firefox/' in lowered:
+        browser = 'Firefox'
+    elif 'chrome/' in lowered or 'chromium/' in lowered:
+        browser = 'Chrome'
+    elif 'safari/' in lowered:
+        browser = 'Safari'
+    else:
+        browser = 'Browser'
+    if 'android' in lowered:
+        platform = 'Android'
+    elif 'iphone' in lowered or 'ipad' in lowered:
+        platform = 'iOS'
+    elif 'windows' in lowered:
+        platform = 'Windows'
+    elif 'mac os' in lowered or 'macintosh' in lowered:
+        platform = 'macOS'
+    elif 'linux' in lowered:
+        platform = 'Linux'
+    else:
+        platform = s.get('device_platform_generic')
+    return s.get('device_label_pattern').format(browser=browser, platform=platform)
+
+
+def get_trusted_device_for_login(request, user):
+    if not request or not user:
+        return None
+    try:
+        raw_token = request.get_signed_cookie(
+            TRUSTED_DEVICE_COOKIE_NAME,
+            salt=TRUSTED_DEVICE_COOKIE_SALT,
+        )
+    except (KeyError, BadSignature):
+        return None
+    if not raw_token:
+        return None
+    return trusted_device_model().objects.filter(
+        user=user,
+        token_hash=trusted_device_token_hash(raw_token),
+        revoked_at__isnull=True,
+        trusted_until__gt=timezone.now(),
+    ).first()
+
+
+def sync_session_device_metadata(request, trusted_device=None):
+    session = getattr(request, 'session', None)
+    if session is None:
+        return {}
+    if not getattr(session, 'session_key', None):
+        session.save()
+    now = timezone.now().isoformat()
+    existing = session.get('microsys_device')
+    if not isinstance(existing, dict):
+        existing = {}
+    metadata = {
+        'user_agent': str(request.META.get('HTTP_USER_AGENT') or existing.get('user_agent') or '')[:500],
+        'ip_address': str(get_client_ip(request) or existing.get('ip_address') or '').strip(),
+        'first_seen': existing.get('first_seen') or now,
+        'last_seen': now,
+    }
+    if trusted_device is not None:
+        metadata['trusted_device_id'] = trusted_device.pk
+        metadata['trusted_until'] = trusted_device.trusted_until.isoformat()
+    elif existing.get('trusted_device_id'):
+        metadata['trusted_device_id'] = existing.get('trusted_device_id')
+        metadata['trusted_until'] = existing.get('trusted_until')
+    session['microsys_device'] = metadata
+    session.modified = True
+    if trusted_device is not None:
+        trusted_device.session_key = getattr(session, 'session_key', '') or ''
+        trusted_device.device_label = device_label(metadata.get('user_agent'))
+        trusted_device.ip_address = metadata.get('ip_address') or None
+        trusted_device.user_agent = metadata.get('user_agent') or ''
+        trusted_device.last_used_at = timezone.now()
+        trusted_device.save(update_fields=['session_key', 'device_label', 'ip_address', 'user_agent', 'last_used_at'])
+    return metadata
+
+
+def trusted_device_for_session(user, session_key, session_data=None):
+    if not user or not session_key:
+        return None
+    now = timezone.now()
+    metadata = {}
+    if isinstance(session_data, dict):
+        metadata = session_data.get('microsys_device') if isinstance(session_data.get('microsys_device'), dict) else {}
+    devices = trusted_device_model().objects.filter(
+        user=user,
+        revoked_at__isnull=True,
+        trusted_until__gt=now,
+    )
+    trusted_device_id = metadata.get('trusted_device_id')
+    if trusted_device_id is not None:
+        try:
+            by_id = devices.filter(pk=int(trusted_device_id)).first()
+        except (TypeError, ValueError):
+            by_id = None
+        if by_id is not None:
+            return by_id
+    return devices.filter(session_key=session_key).first()
+
+
+def current_session_trusted_device(request):
+    user = getattr(request, 'user', None)
+    if not user or not getattr(user, 'is_authenticated', False):
+        return None
+    session = getattr(request, 'session', None)
+    if session is None:
+        return None
+    return trusted_device_for_session(user, getattr(session, 'session_key', None), dict(session.items()))
+
+
+def revoke_linked_session_trust(user, session_keys, trusted_device_ids=None, exclude_trusted_device_id=None):
+    session_keys = [key for key in (session_keys or []) if key]
+    trusted_device_ids = [pk for pk in (trusted_device_ids or []) if pk]
+    devices = trusted_device_model().objects.filter(user=user, revoked_at__isnull=True)
+    if exclude_trusted_device_id:
+        devices = devices.exclude(pk=exclude_trusted_device_id)
+    criteria = Q()
+    if trusted_device_ids and session_keys:
+        criteria = Q(pk__in=trusted_device_ids) | Q(session_key__in=session_keys)
+    elif trusted_device_ids:
+        criteria = Q(pk__in=trusted_device_ids)
+    elif session_keys:
+        criteria = Q(session_key__in=session_keys)
+    else:
+        return 0
+    return devices.filter(criteria).update(revoked_at=timezone.now())
+
+
+def revoke_other_user_sessions(user, keep_session_key=None, keep_trusted_device_id=None):
+    now = timezone.now()
+    target_keys = []
+    trusted_ids = []
+    user_id = str(user.pk)
+    for session in Session.objects.filter(expire_date__gt=now):
+        if keep_session_key and session.session_key == keep_session_key:
+            continue
+        try:
+            data = session.get_decoded()
+        except Exception:
+            continue
+        if str(data.get('_auth_user_id') or '') != user_id:
+            continue
+        target_keys.append(session.session_key)
+        metadata = data.get('microsys_device') if isinstance(data.get('microsys_device'), dict) else {}
+        trusted_device_id = metadata.get('trusted_device_id')
+        if trusted_device_id is not None:
+            try:
+                trusted_ids.append(int(trusted_device_id))
+            except (TypeError, ValueError):
+                pass
+    if target_keys:
+        Session.objects.filter(session_key__in=target_keys).delete()
+    revoke_linked_session_trust(
+        user,
+        target_keys,
+        trusted_device_ids=trusted_ids,
+        exclude_trusted_device_id=keep_trusted_device_id,
+    )
+    return len(target_keys)
+
+
+def enforce_single_active_trusted_session(request, user, trusted_device):
+    if not trusted_device:
+        return 0
+    if not bool(get_system_config().get('prevent_multiple_active_sessions', False)):
+        return 0
+    return revoke_other_user_sessions(
+        user,
+        keep_session_key=getattr(getattr(request, 'session', None), 'session_key', None),
+        keep_trusted_device_id=trusted_device.pk,
+    )
+
+
+def issue_trusted_device(request, response, user):
+    raw_token = secrets.token_urlsafe(32)
+    trusted_device = trusted_device_model().objects.create(
+        user=user,
+        token_hash=trusted_device_token_hash(raw_token),
+        trusted_until=timezone.now() + timedelta(days=30),
+    )
+    sync_session_device_metadata(request, trusted_device=trusted_device)
+    response.set_signed_cookie(
+        TRUSTED_DEVICE_COOKIE_NAME,
+        raw_token,
+        salt=TRUSTED_DEVICE_COOKIE_SALT,
+        max_age=TRUSTED_DEVICE_MAX_AGE,
+        httponly=True,
+        secure=request.is_secure(),
+        samesite='Lax',
+    )
+    enforce_single_active_trusted_session(request, user, trusted_device)
+    return trusted_device

{django_microsys-2.2.4 → django_microsys-2.2.5}/microsys/urls.py

@@ -15,6 +15,7 @@ urlpatterns = [
     path('accounts/register/verify/<str:token>/', views.register_verify_view, name='register_verify'),
     path('accounts/profile/', views.user_profile, name='user_profile'),
     path('accounts/profile/sessions/<str:session_key>/revoke/', views.revoke_profile_session, name='revoke_profile_session'),
+    path('accounts/profile/device/trust/', views.trust_current_device, name='trust_current_device'),
     path('accounts/profile/edit/<str:pk>/modal/', views.DynamicModalManagerView.as_view(
         model=views.User,
         form_class=views.UserProfileEditForm,

{django_microsys-2.2.4 → django_microsys-2.2.5}/microsys/utils.py

@@ -1722,6 +1722,7 @@ SYSTEM_SETTINGS_EXPORT_FIELDS = (
     'allow_user_language_override',
     'default_table_density',
     'email_2fa',
+    'prevent_multiple_active_sessions',
     'client_ip_config',
     'public_root',
     'public_root_split_enabled',
@@ -1862,6 +1863,7 @@ def normalize_system_settings_import_payload(payload):
         'allow_user_font_override',
         'allow_user_language_override',
         'email_2fa',
+        'prevent_multiple_active_sessions',
         'public_root',
         'public_root_split_enabled',
         'public_registration_enabled',
@@ -1982,6 +1984,7 @@ def get_system_config():
         'allow_user_language_override': True,
         'default_table_density': DEFAULT_TABLE_DENSITY,
         'email_2fa': False,
+        'prevent_multiple_active_sessions': False,
         'client_ip': default_client_ip_config(),
         'public_root': False,
         'public_root_split_enabled': False,
@@ -2105,6 +2108,14 @@ def get_system_config():
             and _should_apply_db_override(bool(sys_settings.email_2fa), default_config['email_2fa'])
         ):
             db_config['email_2fa'] = bool(sys_settings.email_2fa)
+        if (
+            hasattr(sys_settings, 'prevent_multiple_active_sessions')
+            and _should_apply_db_override(
+                bool(sys_settings.prevent_multiple_active_sessions),
+                default_config['prevent_multiple_active_sessions'],
+            )
+        ):
+            db_config['prevent_multiple_active_sessions'] = bool(sys_settings.prevent_multiple_active_sessions)
         client_ip_config = normalize_client_ip_config(getattr(sys_settings, 'client_ip_config', {}))
         if _should_apply_db_override(client_ip_config, default_config['client_ip']):
             db_config['client_ip'] = client_ip_config

{django_microsys-2.2.4 → django_microsys-2.2.5}/microsys/views/__init__.py

@@ -62,7 +62,7 @@ from .activitylog import (
 )
 
 # Profile
-from .profile import revoke_profile_session, user_profile
+from .profile import revoke_profile_session, trust_current_device, user_profile
 
 # Public registration
 from .registration import (