fix(session,security): close 11 correctness and hardening gaps

CRITICAL
- Grace period for first request after login: JWT-verify wrapper now
  accepts a freshly-issued JWT within a configurable `sessionCreationGraceMs`
  window (default 5s) even if the session-create DB write has not yet
  propagated. Closes the race where strictSessionEnforcement blocked the
  very first authenticated request.
- Cleanup no longer leaves sessions reactivatable. Inactivity cleanup now
  sets terminatedManually=true, and the JWT-verify wrapper refuses to
  reactivate sessions that have been idle longer than inactivityTimeout.
  The idle-logout feature actually works now.
- SESSION_ENCRYPTION_KEY is mandatory in production (boot self-test in
  bootstrap). Fallback to APP_KEYS is kept only for non-production, with
  a one-time WARN; this prevents APP_KEYS rotation from silently bricking
  every stored session.

HIGH
- mountRefreshTokenInterceptor now documents that users-permissions ships
  no /api/auth/refresh by default and the middleware is a passthrough
  until a refresh plugin is installed.
- ensureContentApiPermissions migrated from the deprecated
  strapi.entityService to strapi.documents (Strapi v5 API).
- extractBearerToken token-length range widened from 10..4096 to 40..8192
  to accommodate modern JWTs carrying user-context claims (magic-link).
- session.touch() now coalesces concurrent callers through an in-memory
  per-session stamp so two parallel requests cannot both skip the
  rate-limit and issue duplicate UPDATEs.

MEDIUM
- Missing JWT service is now logged at ERROR (not WARN) because session
  revocation silently stops enforcing — ops needs to see it.
- register.js afterUpdate hook checks params.data.blocked to only scan
  sessions when THIS update set blocked=true, not on every unrelated
  user update.
- Per-caller rate-limit middleware (plugin::magic-sessionmanager.rate-limit)
  mounted on all content-api routes: 10/min for writes (logout, terminate),
  120/min for reads.
- cleanupInactiveSessions gained a useDbDirect option (exposed via the
  cleanupUseDbDirect setting) for a single-statement SQL UPDATE path on
  installations that outgrow the 50k Document-Service scan cap.

Author: Schero94

server/src/bootstrap.js

@@ -53,6 +53,17 @@ module.exports = async ({ strapi }) => {
 
   log.info('[START] Bootstrap starting...');
 
+  // Fail fast on missing production secrets. getEncryptionKey() throws
+  // when NODE_ENV=production and SESSION_ENCRYPTION_KEY is missing, so a
+  // bad deploy dies here with a clear error instead of silently failing
+  // later when the first encrypted-token read/write happens.
+  try {
+    encryptToken('self-test');
+  } catch (e) {
+    log.error(`[BOOTSTRAP] ${e.message}`);
+    throw e;
+  }
+
   try {
     await ensureTokenHashIndex(strapi, log);
 
@@ -109,13 +120,23 @@ module.exports = async ({ strapi }) => {
     const sessionService = strapi.plugin('magic-sessionmanager').service('session');
 
     log.info('Running initial session cleanup...');
-    await sessionService.cleanupInactiveSessions();
+    try {
+      const settings = await getPluginSettings(strapi);
+      await sessionService.cleanupInactiveSessions({
+        useDbDirect: settings.cleanupUseDbDirect === true,
+      });
+    } catch (cleanupErr) {
+      log.warn('Initial cleanup failed:', cleanupErr.message);
+    }
 
     const cleanupInterval = 30 * 60 * 1000;
     const cleanupIntervalHandle = setInterval(async () => {
       try {
         const service = strapi.plugin('magic-sessionmanager').service('session');
-        await service.cleanupInactiveSessions();
+        const settings = await getPluginSettings(strapi).catch(() => ({}));
+        await service.cleanupInactiveSessions({
+          useDbDirect: settings.cleanupUseDbDirect === true,
+        });
       } catch (err) {
         log.error('Periodic cleanup error:', err);
       }
@@ -649,8 +670,23 @@ function mountLoginInterceptor({ strapi, log, sessionService }) {
 }
 
 /**
- * Blocks refresh-token requests that no longer correspond to an active
- * session, and rotates the tokens atomically after a successful refresh.
+ * Refresh-token interceptor.
+ *
+ * NOTE ON APPLICABILITY:
+ *   Strapi's default users-permissions plugin does NOT ship a
+ *   POST /api/auth/refresh endpoint. This middleware only does something
+ *   when a refresh-token plugin (e.g. strapi-plugin-jwt-refresh) or a
+ *   custom controller is installed that exposes that route. Otherwise
+ *   the middleware is a pure passthrough — mounting it unconditionally
+ *   is safe and prepares the installation for future refresh-token
+ *   support without requiring a second plugin install/restart cycle.
+ *
+ * Responsibilities when a refresh endpoint IS present:
+ *   1. Block incoming requests whose refreshToken does not match an
+ *      active session (defence against stale/stolen refresh tokens).
+ *   2. After a successful refresh, atomically rotate the stored token +
+ *      refreshToken hashes on the session so the new JWT can be
+ *      validated by magicSessionAwareVerify.
  *
  * @param {{strapi: object, log: object}} deps
  */
@@ -761,8 +797,13 @@ async function ensureContentApiPermissions(strapi, log) {
     const ROLE_UID = 'plugin::users-permissions.role';
     const PERMISSION_UID = 'plugin::users-permissions.permission';
 
-    const roles = await strapi.entityService.findMany(ROLE_UID, {
+    // Document Service replaces the deprecated entityService (Strapi v5).
+    // We still need the numeric `id` of the role for the permission's
+    // `role` relation because users-permissions Permission stores the
+    // foreign key by numeric id, not documentId.
+    const roles = await strapi.documents(ROLE_UID).findMany({
       filters: { type: 'authenticated' },
+      fields: ['id'],
       limit: 1,
     });
 
@@ -782,11 +823,13 @@ async function ensureContentApiPermissions(strapi, log) {
       'plugin::magic-sessionmanager.session.terminateOwnSession',
     ];
 
-    const existingPermissions = await strapi.entityService.findMany(PERMISSION_UID, {
+    const existingPermissions = await strapi.documents(PERMISSION_UID).findMany({
       filters: {
         role: authenticatedRole.id,
         action: { $in: requiredActions },
       },
+      fields: ['action'],
+      limit: requiredActions.length,
     });
 
     const existingActions = existingPermissions.map(p => p.action);
@@ -799,7 +842,7 @@ async function ensureContentApiPermissions(strapi, log) {
     }
 
     for (const action of missingActions) {
-      await strapi.entityService.create(PERMISSION_UID, {
+      await strapi.documents(PERMISSION_UID).create({
         data: { action, role: authenticatedRole.id },
       });
       log.info(`[PERMISSION] Enabled ${action} for authenticated users`);
@@ -935,15 +978,25 @@ async function registerSessionAwareAuthStrategy(strapi, log) {
   try {
     const usersPermissionsPlugin = strapi.plugin('users-permissions');
 
+    // These two conditions are both FATAL for the plugin's purpose: without a
+    // wrappable JWT verify, we cannot enforce server-side session revocation.
+    // We still return instead of throwing so the rest of the plugin (admin
+    // UI, settings) keeps working, but we log at ERROR so ops notices.
     if (!usersPermissionsPlugin) {
-      strapi.log.warn('[magic-sessionmanager] [AUTH] users-permissions plugin not found');
+      strapi.log.error(
+        '[magic-sessionmanager] [AUTH] users-permissions plugin not found — ' +
+        'session revocation will NOT be enforced. Install @strapi/plugin-users-permissions.'
+      );
       return;
     }
 
     const jwtService = usersPermissionsPlugin.service('jwt');
 
     if (!jwtService || !jwtService.verify) {
-      strapi.log.warn('[magic-sessionmanager] [AUTH] JWT service not found or no verify method');
+      strapi.log.error(
+        '[magic-sessionmanager] [AUTH] users-permissions JWT service has no .verify method — ' +
+        'API surface changed. Session revocation will NOT be enforced until the plugin is updated.'
+      );
       return;
     }
 
@@ -972,6 +1025,17 @@ async function registerSessionAwareAuthStrategy(strapi, log) {
 
       const strictMode = settings.strictSessionEnforcement === true;
       const maxSessionAgeDays = settings.maxSessionAgeDays || 30;
+      // Grace period: the login interceptor writes the Session record AFTER
+      // ctx.body has already left the server. A client that fires its next
+      // authenticated request within a few hundred ms may beat the write.
+      // Without this window, strictSessionEnforcement would reject the JWT
+      // as "no matching session" even though a session is being created.
+      // Configurable; defaults to 5s which comfortably covers DB commit +
+      // network RTT on most stacks.
+      const gracePeriodMs = Math.max(
+        0,
+        Number(settings.sessionCreationGraceMs) || 5000
+      );
 
       try {
         const userDocId = await resolveUserDocumentId(strapi, decoded.id);
@@ -1030,6 +1094,29 @@ async function registerSessionAwareAuthStrategy(strapi, log) {
             return decoded;
           }
 
+          // Inactive-but-not-manually-terminated sessions can be reactivated,
+          // but ONLY if the inactivity window has not elapsed. Otherwise the
+          // cleanup-job's purpose (idle logout) would be silently defeated
+          // every time a stale JWT is reused.
+          const inactivityTimeout = settings.inactivityTimeout || 15 * 60 * 1000;
+          const lastActiveMs = thisSession.lastActive
+            ? new Date(thisSession.lastActive).getTime()
+            : thisSession.loginTime
+              ? new Date(thisSession.loginTime).getTime()
+              : 0;
+          const idleFor = Date.now() - lastActiveMs;
+
+          if (idleFor > inactivityTimeout) {
+            strapi.log.info(
+              `[magic-sessionmanager] [JWT-IDLE] Session too idle to reactivate (${Math.round(idleFor / 1000)}s > ${inactivityTimeout / 1000}s) for user ${userDocId.substring(0, 8)}...`
+            );
+            await strapi.documents(SESSION_UID).update({
+              documentId: thisSession.documentId,
+              data: { terminatedManually: true, logoutTime: new Date() },
+            });
+            return null;
+          }
+
           await strapi.documents(SESSION_UID).update({
             documentId: thisSession.documentId,
             data: { isActive: true, lastActive: new Date() },
@@ -1041,6 +1128,22 @@ async function registerSessionAwareAuthStrategy(strapi, log) {
           return decoded;
         }
 
+        // JWT has no matching session record. Before blocking, honor the
+        // grace period: if the JWT was issued within the last `gracePeriodMs`
+        // the login interceptor's DB write may simply not be visible yet.
+        // `iat` is seconds-since-epoch per RFC 7519.
+        if (gracePeriodMs > 0 && typeof decoded.iat === 'number') {
+          const issuedMs = decoded.iat * 1000;
+          const ageMs = Date.now() - issuedMs;
+          if (ageMs >= 0 && ageMs < gracePeriodMs) {
+            strapi.log.debug(
+              `[magic-sessionmanager] [JWT-GRACE] New JWT (age ${ageMs}ms) inside grace window — allowing`
+            );
+            resetErrorCounter();
+            return decoded;
+          }
+        }
+
         if (strictMode) {
           strapi.log.info(
             `[magic-sessionmanager] [JWT-BLOCKED] No session matches this token (user: ${userDocId.substring(0, 8)}..., strictMode)`

server/src/middlewares/index.js

@@ -2,4 +2,5 @@
 
 module.exports = {
   'last-seen': require('./last-seen'),
+  'rate-limit': require('./rate-limit'),
 };

server/src/middlewares/rate-limit.js

@@ -0,0 +1,88 @@
+'use strict';
+
+/**
+ * In-memory per-caller rate limiter for session-manager Content-API endpoints.
+ *
+ * The primary purpose is to contain abuse of /logout and /logout-all from
+ * a compromised JWT: while those endpoints are "soft" (they mark the DB
+ * row) they still do a write per call and an attacker could otherwise
+ * drown the DB by spamming them.
+ *
+ * Single-process only — see middlewares/last-seen.js comment for the
+ * multi-instance trade-off and the preferred Redis-backed upgrade path.
+ *
+ * Route-level config shape:
+ *   { name: 'plugin::magic-sessionmanager.rate-limit',
+ *     config: { max: 20, window: 60000 } }
+ */
+
+const buckets = new Map();
+
+const prune = (now) => {
+  for (const [key, entry] of buckets) {
+    if (entry.expiresAt <= now) buckets.delete(key);
+  }
+};
+
+/**
+ * Returns a stable key identifying the caller: user id when authenticated,
+ * API-token id otherwise, then the socket IP as last resort.
+ * @param {object} ctx
+ * @returns {string}
+ */
+const callerKey = (ctx) => {
+  const userId = ctx.state?.user?.id;
+  if (userId) return `u:${userId}`;
+  const tokenId =
+    ctx.state?.auth?.credentials?.id ??
+    ctx.state?.auth?.credentials?.token ??
+    null;
+  if (tokenId) return `t:${String(tokenId).slice(-16)}`;
+  return `ip:${ctx.request.ip || ctx.ip || 'unknown'}`;
+};
+
+/**
+ * @param {{ max?: number, window?: number }} cfg
+ */
+const rateLimit = (cfg = {}, { strapi }) => {
+  const max = Number.isFinite(cfg.max) ? cfg.max : 30;
+  const windowMs = Number.isFinite(cfg.window) ? cfg.window : 60_000;
+
+  return async (ctx, next) => {
+    const key = `${ctx.path}::${callerKey(ctx)}`;
+    const now = Date.now();
+
+    if (buckets.size > 5000) prune(now);
+
+    let entry = buckets.get(key);
+    if (!entry || entry.expiresAt <= now) {
+      entry = { count: 0, expiresAt: now + windowMs };
+      buckets.set(key, entry);
+    }
+
+    entry.count += 1;
+
+    if (entry.count > max) {
+      const retryAfterSec = Math.ceil((entry.expiresAt - now) / 1000);
+      ctx.set('Retry-After', String(retryAfterSec));
+      strapi.log.warn(
+        `[magic-sessionmanager] Rate limit exceeded on ${ctx.path} for ${callerKey(ctx)} (${entry.count}/${max})`
+      );
+      ctx.status = 429;
+      ctx.body = {
+        data: null,
+        error: {
+          status: 429,
+          name: 'TooManyRequestsError',
+          message: 'Too many requests. Please slow down.',
+          details: { retryAfter: retryAfterSec },
+        },
+      };
+      return;
+    }
+
+    await next();
+  };
+};
+
+module.exports = rateLimit;

server/src/register.js

@@ -48,20 +48,26 @@ module.exports = async ({ strapi }) => {
       models: [USER_UID],
 
       /**
-       * Terminates the user's active sessions when they are blocked.
+       * Terminates the user's active sessions the MOMENT they are blocked.
        *
-       * This runs on EVERY update of a blocked user, but session termination
-       * is idempotent — already-terminated sessions are skipped by the
-       * filter `isActive: true`. We also only act when `blocked === true`,
-       * so unblocking never re-terminates anything.
+       * We only fire on the transition to `blocked: true` — i.e. when the
+       * update's params.data actually flips the field. This avoids running
+       * a session-scan query on every unrelated user update (email change,
+       * profile picture, …) which at scale would be a real load problem.
        *
        * @param {object} event
        */
       async afterUpdate(event) {
         try {
-          const { result } = event;
+          const { result, params } = event;
           if (!result || result.blocked !== true) return;
 
+          // Only act when THIS update actually set blocked=true. Without
+          // this check, every update of an already-blocked user would
+          // re-run the session scan for no gain.
+          const data = params && params.data ? params.data : null;
+          if (!data || data.blocked !== true) return;
+
           const userDocId = result.documentId;
           if (!userDocId) return;