test: add tests for terminatedManually session reactivation

- Add SECURITY TEST 4: Session reactivation after timeout
- Add SECURITY TEST 5: Manual logout blocks access
- Add simulate-timeout admin endpoint for testing
- Update test numbering (now 6 security tests)

Tests verify:
- Sessions with terminatedManually: false can be reactivated
- Sessions with terminatedManually: true are blocked permanently

Author: Schero94

server/src/controllers/session.js

@@ -493,6 +493,47 @@ module.exports = {
     }
   },
 
+  /**
+   * Simulate session timeout for testing (Admin action)
+   * POST /magic-sessionmanager/sessions/:sessionId/simulate-timeout
+   * Sets isActive: false, terminatedManually: false (as if cleanup job ran)
+   * This allows testing session reactivation behavior
+   */
+  async simulateTimeout(ctx) {
+    try {
+      const { sessionId } = ctx.params;
+      
+      // Find the session first
+      const session = await strapi.documents(SESSION_UID).findOne({
+        documentId: sessionId,
+      });
+      
+      if (!session) {
+        return ctx.notFound('Session not found');
+      }
+      
+      // Simulate timeout: set isActive false but terminatedManually false
+      await strapi.documents(SESSION_UID).update({
+        documentId: sessionId,
+        data: {
+          isActive: false,
+          terminatedManually: false, // This allows reactivation!
+        },
+      });
+      
+      strapi.log.info(`[magic-sessionmanager] [TEST] Session ${sessionId} simulated timeout (terminatedManually: false)`);
+
+      ctx.body = {
+        message: `Session ${sessionId} marked as timed out (reactivatable)`,
+        success: true,
+        terminatedManually: false,
+      };
+    } catch (err) {
+      strapi.log.error('[magic-sessionmanager] Error simulating timeout:', err);
+      ctx.throw(500, 'Error simulating session timeout');
+    }
+  },
+
   /**
    * Terminate a single session (Admin action)
    * POST /magic-sessionmanager/sessions/:sessionId/terminate

server/src/routes/admin.js

@@ -39,6 +39,15 @@ module.exports = {
         description: 'Terminate a specific session (admin)',
       },
     },
+    {
+      method: 'POST',
+      path: '/sessions/:sessionId/simulate-timeout',
+      handler: 'session.simulateTimeout',
+      config: {
+        policies: ['admin::isAuthenticatedAdmin'],
+        description: 'Simulate session timeout for testing (sets isActive: false, terminatedManually: false)',
+      },
+    },
     {
       method: 'DELETE',
       path: '/sessions/:sessionId',