fix: always block explicitly logged out users

Corrected blocking logic:
- User explicitly logged out (inactive sessions) → ALWAYS BLOCK
- No session exists (bug/race condition) → depends on strictMode
  - strictMode: true → block
  - strictMode: false → allow with warning (default)

This ensures logout actually works while protecting against
session creation bugs blocking legitimate users.

Author: Schero94

server/src/bootstrap.js

@@ -656,41 +656,34 @@ async function registerSessionAwareAuthStrategy(strapi, log) {
         const hasInactiveSessions = allSessions?.some(s => s.isActive === false);
 
         // DECISION LOGIC:
-        // 1. If user has inactive sessions = they were explicitly logged out → BLOCK (if strict)
-        // 2. If user has NO sessions at all = session never created (bug/race condition) → ALLOW
-        // 3. If strictMode is off → always ALLOW but log warning
+        // 1. User has inactive sessions = explicitly logged out → ALWAYS BLOCK
+        // 2. No sessions exist at all = session never created (bug/race condition) → ALLOW
+        // 3. strictMode controls whether missing sessions block or just warn
 
-        if (!strictMode) {
-          // Non-strict mode: Log warning but allow through
-          if (totalSessions === 0) {
-            strapi.log.warn(
-              `[magic-sessionmanager] [JWT-WARN] No session found for user ${userDocId.substring(0, 8)}... (allowing - session may not have been created)`
-            );
-          } else if (hasInactiveSessions) {
-            strapi.log.warn(
-              `[magic-sessionmanager] [JWT-WARN] User ${userDocId.substring(0, 8)}... has ${totalSessions} inactive sessions but no active ones (allowing - strictMode off)`
-            );
-          }
-          return decoded; // Allow through in non-strict mode
+        if (hasInactiveSessions) {
+          // User was explicitly logged out → ALWAYS BLOCK (this is intentional!)
+          strapi.log.info(
+            `[magic-sessionmanager] [JWT-BLOCKED] User ${userDocId.substring(0, 8)}... was logged out (${totalSessions} inactive sessions)`
+          );
+          return null; // Block - user was explicitly logged out
         }
 
-        // Strict mode enabled - more careful about blocking
+        // No sessions exist at all - session was never created (bug/race condition)
         if (totalSessions === 0) {
-          // No sessions at all - likely a bug or race condition, allow through
+          if (strictMode) {
+            // Strict mode: Block even if no sessions (could be security risk)
+            strapi.log.info(
+              `[magic-sessionmanager] [JWT-BLOCKED] No sessions exist for user ${userDocId.substring(0, 8)}... (strictMode enabled)`
+            );
+            return null;
+          }
+          // Non-strict mode: Allow through but warn
           strapi.log.warn(
-            `[magic-sessionmanager] [JWT-ALLOW] No sessions exist for user ${userDocId.substring(0, 8)}... (allowing - possible race condition)`
+            `[magic-sessionmanager] [JWT-WARN] No session found for user ${userDocId.substring(0, 8)}... (allowing - session may not have been created)`
           );
           return decoded;
         }
 
-        if (hasInactiveSessions) {
-          // User has inactive sessions = explicitly logged out → BLOCK
-          strapi.log.info(
-            `[magic-sessionmanager] [JWT-BLOCKED] User ${userDocId.substring(0, 8)}... was logged out (${totalSessions} inactive sessions)`
-          );
-          return null; // Block - user was explicitly logged out
-        }
-        
         // Edge case: sessions exist but none are active or inactive (shouldn't happen)
         strapi.log.warn(
           `[magic-sessionmanager] [JWT-ALLOW] Unexpected session state for user ${userDocId.substring(0, 8)}... (allowing)`

server/src/middlewares/last-seen.js

@@ -122,14 +122,20 @@ module.exports = ({ strapi, sessionService }) => {
 
             const hasInactiveSessions = allSessions?.some(s => s.isActive === false);
 
-            if (strictMode && hasInactiveSessions) {
-              // Strict mode + user was explicitly logged out → BLOCK
+            if (hasInactiveSessions) {
+              // User was explicitly logged out → ALWAYS BLOCK
               strapi.log.info(`[magic-sessionmanager] [BLOCKED] Session terminated (user: ${userDocId.substring(0, 8)}...)`);
               return ctx.unauthorized('Session has been terminated. Please login again.');
             }
 
-            // Non-strict mode or no sessions exist → Allow but log
-            strapi.log.debug(`[magic-sessionmanager] [WARN] No active session for user ${userDocId.substring(0, 8)}... (allowing)`);
+            // No sessions exist at all - session was never created
+            if (strictMode) {
+              strapi.log.info(`[magic-sessionmanager] [BLOCKED] No session exists (user: ${userDocId.substring(0, 8)}..., strictMode)`);
+              return ctx.unauthorized('No valid session. Please login again.');
+            }
+            
+            // Non-strict mode: Allow but log warning
+            strapi.log.warn(`[magic-sessionmanager] [WARN] No session for user ${userDocId.substring(0, 8)}... (allowing)`);
           }
 
           // Store documentId for later use

server/src/policies/session-required.js

@@ -66,17 +66,25 @@ module.exports = async (policyContext, config, { strapi }) => {
 
     const hasInactiveSessions = allSessions?.some(s => s.isActive === false);
 
-    // Only block if strict mode AND user was explicitly logged out
-    if (strictMode && hasInactiveSessions) {
+    if (hasInactiveSessions) {
+      // User was explicitly logged out → ALWAYS BLOCK
       strapi.log.info(
         `[magic-sessionmanager] [POLICY-BLOCKED] Session terminated (user: ${userDocId.substring(0, 8)}...)`
       );
       throw new errors.UnauthorizedError('Session terminated. Please login again.');
     }
 
-    // Non-strict mode or no sessions exist → Allow but log
-    strapi.log.debug(
-      `[magic-sessionmanager] [POLICY-WARN] No active session for user ${userDocId.substring(0, 8)}... (allowing)`
+    // No sessions exist at all - session was never created
+    if (strictMode) {
+      strapi.log.info(
+        `[magic-sessionmanager] [POLICY-BLOCKED] No session exists (user: ${userDocId.substring(0, 8)}..., strictMode)`
+      );
+      throw new errors.UnauthorizedError('No valid session. Please login again.');
+    }
+    
+    // Non-strict mode: Allow but log warning
+    strapi.log.warn(
+      `[magic-sessionmanager] [POLICY-WARN] No session for user ${userDocId.substring(0, 8)}... (allowing)`
     );
     return true;