feat: add terminatedManually field for session reactivation

Schero94 · Schero94 · commit 88875009ff00 · 2026-01-29T13:59:31.000+01:00
New behavior:
- Session timeout (cleanup job) sets terminatedManually: false
- Manual logout sets terminatedManually: true
- On request with inactive session:
  - If terminatedManually: true → BLOCK (user logged out intentionally)
  - If terminatedManually: false → REACTIVATE session + update lastActive

This allows users to resume their session after timeout without
needing to login again, while still enforcing manual logouts.

Changes:
- Add terminatedManually field to session schema (default: false)
- Update cleanup job to set terminatedManually: false
- Update terminateSession to set terminatedManually: true
- Update JWT verify, middleware, policy with reactivation logic
diff --git a/server/src/bootstrap.js b/server/src/bootstrap.js
@@ -631,7 +631,7 @@ async function registerSessionAwareAuthStrategy(strapi, log) {
           return decoded;
         }
         
-        // Check for active sessions
+        // Check for active sessions first
         const activeSessions = await strapi.documents(SESSION_UID).findMany({
           filters: {
             user: { documentId: userDocId },
@@ -645,48 +645,55 @@ async function registerSessionAwareAuthStrategy(strapi, log) {
           return decoded;
         }
         
-        // No active session found - check if ANY sessions exist (including inactive)
-        const allSessions = await strapi.documents(SESSION_UID).findMany({
-          filters: { user: { documentId: userDocId } },
+        // No active session - check for inactive sessions
+        const inactiveSessions = await strapi.documents(SESSION_UID).findMany({
+          filters: { 
+            user: { documentId: userDocId },
+            isActive: false,
+          },
           limit: 5,
-          fields: ['isActive', 'lastActive'],
+          fields: ['documentId', 'terminatedManually', 'lastActive'],
+          sort: [{ lastActive: 'desc' }],
         });
         
-        const totalSessions = allSessions?.length || 0;
-        const hasInactiveSessions = allSessions?.some(s => s.isActive === false);
-        
-        // DECISION LOGIC:
-        // 1. User has inactive sessions = explicitly logged out → ALWAYS BLOCK
-        // 2. No sessions exist at all = session never created (bug/race condition) → ALLOW
-        // 3. strictMode controls whether missing sessions block or just warn
-        
-        if (hasInactiveSessions) {
-          // User was explicitly logged out → ALWAYS BLOCK (this is intentional!)
-          strapi.log.info(
-            `[magic-sessionmanager] [JWT-BLOCKED] User ${userDocId.substring(0, 8)}... was logged out (${totalSessions} inactive sessions)`
-          );
-          return null; // Block - user was explicitly logged out
-        }
-        
-        // No sessions exist at all - session was never created (bug/race condition)
-        if (totalSessions === 0) {
-          if (strictMode) {
-            // Strict mode: Block even if no sessions (could be security risk)
+        if (inactiveSessions && inactiveSessions.length > 0) {
+          // Check if ANY session was manually terminated
+          const manuallyTerminated = inactiveSessions.find(s => s.terminatedManually === true);
+          
+          if (manuallyTerminated) {
+            // User was explicitly logged out → BLOCK
             strapi.log.info(
-              `[magic-sessionmanager] [JWT-BLOCKED] No sessions exist for user ${userDocId.substring(0, 8)}... (strictMode enabled)`
+              `[magic-sessionmanager] [JWT-BLOCKED] User ${userDocId.substring(0, 8)}... was manually logged out`
             );
             return null;
           }
-          // Non-strict mode: Allow through but warn
-          strapi.log.warn(
-            `[magic-sessionmanager] [JWT-WARN] No session found for user ${userDocId.substring(0, 8)}... (allowing - session may not have been created)`
+          
+          // Session was deactivated by timeout → REACTIVATE most recent one
+          const sessionToReactivate = inactiveSessions[0];
+          await strapi.documents(SESSION_UID).update({
+            documentId: sessionToReactivate.documentId,
+            data: {
+              isActive: true,
+              lastActive: new Date(),
+            },
+          });
+          strapi.log.info(
+            `[magic-sessionmanager] [JWT-REACTIVATED] Session reactivated for user ${userDocId.substring(0, 8)}...`
           );
           return decoded;
         }
         
-        // Edge case: sessions exist but none are active or inactive (shouldn't happen)
+        // No sessions exist at all - session was never created (bug/race condition)
+        if (strictMode) {
+          strapi.log.info(
+            `[magic-sessionmanager] [JWT-BLOCKED] No sessions exist for user ${userDocId.substring(0, 8)}... (strictMode)`
+          );
+          return null;
+        }
+        
+        // Non-strict mode: Allow through but warn
         strapi.log.warn(
-          `[magic-sessionmanager] [JWT-ALLOW] Unexpected session state for user ${userDocId.substring(0, 8)}... (allowing)`
+          `[magic-sessionmanager] [JWT-WARN] No session for user ${userDocId.substring(0, 8)}... (allowing)`
         );
         return decoded;
         
diff --git a/server/src/content-types/session/schema.json b/server/src/content-types/session/schema.json
@@ -71,6 +71,11 @@
       "default": true,
       "required": true
     },
+    "terminatedManually": {
+      "type": "boolean",
+      "default": false,
+      "required": false
+    },
     "geoLocation": {
       "type": "json"
     },
diff --git a/server/src/middlewares/last-seen.js b/server/src/middlewares/last-seen.js
@@ -113,29 +113,48 @@ module.exports = ({ strapi, sessionService }) => {
 
           // If user has NO active sessions
           if (!activeSessions || activeSessions.length === 0) {
-            // Check if user has ANY sessions at all
-            const allSessions = await strapi.documents(SESSION_UID).findMany({
-              filters: { user: { documentId: userDocId } },
-              limit: 1,
-              fields: ['isActive'],
+            // Check for inactive sessions
+            const inactiveSessions = await strapi.documents(SESSION_UID).findMany({
+              filters: { 
+                user: { documentId: userDocId },
+                isActive: false,
+              },
+              limit: 5,
+              fields: ['documentId', 'terminatedManually', 'lastActive'],
+              sort: [{ lastActive: 'desc' }],
             });
             
-            const hasInactiveSessions = allSessions?.some(s => s.isActive === false);
-            
-            if (hasInactiveSessions) {
-              // User was explicitly logged out → ALWAYS BLOCK
-              strapi.log.info(`[magic-sessionmanager] [BLOCKED] Session terminated (user: ${userDocId.substring(0, 8)}...)`);
-              return ctx.unauthorized('Session has been terminated. Please login again.');
-            }
-            
-            // No sessions exist at all - session was never created
-            if (strictMode) {
-              strapi.log.info(`[magic-sessionmanager] [BLOCKED] No session exists (user: ${userDocId.substring(0, 8)}..., strictMode)`);
-              return ctx.unauthorized('No valid session. Please login again.');
+            if (inactiveSessions && inactiveSessions.length > 0) {
+              // Check if ANY session was manually terminated
+              const manuallyTerminated = inactiveSessions.find(s => s.terminatedManually === true);
+              
+              if (manuallyTerminated) {
+                // User was explicitly logged out → BLOCK
+                strapi.log.info(`[magic-sessionmanager] [BLOCKED] User ${userDocId.substring(0, 8)}... was manually logged out`);
+                return ctx.unauthorized('Session has been terminated. Please login again.');
+              }
+              
+              // Session was deactivated by timeout → REACTIVATE most recent one
+              const sessionToReactivate = inactiveSessions[0];
+              await strapi.documents(SESSION_UID).update({
+                documentId: sessionToReactivate.documentId,
+                data: {
+                  isActive: true,
+                  lastActive: new Date(),
+                },
+              });
+              strapi.log.info(`[magic-sessionmanager] [REACTIVATED] Session reactivated for user ${userDocId.substring(0, 8)}...`);
+              // Continue - session is now active
+            } else {
+              // No sessions exist at all - session was never created
+              if (strictMode) {
+                strapi.log.info(`[magic-sessionmanager] [BLOCKED] No session exists (user: ${userDocId.substring(0, 8)}..., strictMode)`);
+                return ctx.unauthorized('No valid session. Please login again.');
+              }
+              
+              // Non-strict mode: Allow but log warning
+              strapi.log.warn(`[magic-sessionmanager] [WARN] No session for user ${userDocId.substring(0, 8)}... (allowing)`);
             }
-            
-            // Non-strict mode: Allow but log warning
-            strapi.log.warn(`[magic-sessionmanager] [WARN] No session for user ${userDocId.substring(0, 8)}... (allowing)`);
           }
           
           // Store documentId for later use
diff --git a/server/src/policies/session-required.js b/server/src/policies/session-required.js
@@ -57,21 +57,42 @@ module.exports = async (policyContext, config, { strapi }) => {
       return true;
     }
     
-    // No active session - check if user was explicitly logged out
-    const allSessions = await strapi.documents(SESSION_UID).findMany({
-      filters: { user: { documentId: userDocId } },
-      limit: 1,
-      fields: ['isActive'],
+    // No active session - check for inactive sessions
+    const inactiveSessions = await strapi.documents(SESSION_UID).findMany({
+      filters: { 
+        user: { documentId: userDocId },
+        isActive: false,
+      },
+      limit: 5,
+      fields: ['documentId', 'terminatedManually', 'lastActive'],
+      sort: [{ lastActive: 'desc' }],
     });
     
-    const hasInactiveSessions = allSessions?.some(s => s.isActive === false);
-    
-    if (hasInactiveSessions) {
-      // User was explicitly logged out → ALWAYS BLOCK
+    if (inactiveSessions && inactiveSessions.length > 0) {
+      // Check if ANY session was manually terminated
+      const manuallyTerminated = inactiveSessions.find(s => s.terminatedManually === true);
+      
+      if (manuallyTerminated) {
+        // User was explicitly logged out → BLOCK
+        strapi.log.info(
+          `[magic-sessionmanager] [POLICY-BLOCKED] User ${userDocId.substring(0, 8)}... was manually logged out`
+        );
+        throw new errors.UnauthorizedError('Session terminated. Please login again.');
+      }
+      
+      // Session was deactivated by timeout → REACTIVATE most recent one
+      const sessionToReactivate = inactiveSessions[0];
+      await strapi.documents(SESSION_UID).update({
+        documentId: sessionToReactivate.documentId,
+        data: {
+          isActive: true,
+          lastActive: new Date(),
+        },
+      });
       strapi.log.info(
-        `[magic-sessionmanager] [POLICY-BLOCKED] Session terminated (user: ${userDocId.substring(0, 8)}...)`
+        `[magic-sessionmanager] [POLICY-REACTIVATED] Session reactivated for user ${userDocId.substring(0, 8)}...`
       );
-      throw new errors.UnauthorizedError('Session terminated. Please login again.');
+      return true;
     }
     
     // No sessions exist at all - session was never created
diff --git a/server/src/services/session.js b/server/src/services/session.js
@@ -109,11 +109,12 @@ module.exports = ({ strapi }) => {
           documentId: sessionId,
           data: {
             isActive: false,
+            terminatedManually: true,
             logoutTime: now,
           },
         });
 
-        log.info(`Session ${sessionId} terminated`);
+        log.info(`Session ${sessionId} terminated (manual)`);
       } else if (userId) {
         // Strapi v5: If numeric id provided, look up documentId first
         // NOTE: entityService is deprecated, but required here for numeric ID -> documentId conversion
@@ -133,18 +134,19 @@ module.exports = ({ strapi }) => {
           },
         });
 
-        // Terminate all active sessions
+        // Terminate all active sessions (manual logout)
         for (const session of activeSessions) {
           await strapi.documents(SESSION_UID).update({
             documentId: session.documentId,
             data: {
               isActive: false,
+              terminatedManually: true,
               logoutTime: now,
             },
           });
         }
 
-        log.info(`All sessions terminated for user ${userDocumentId}`);
+        log.info(`All sessions terminated (manual) for user ${userDocumentId}`);
       }
     } catch (err) {
       log.error('Error terminating session:', err);
@@ -568,7 +570,10 @@ module.exports = ({ strapi }) => {
         if (lastActiveTime < cutoffTime) {
           await strapi.documents(SESSION_UID).update({
             documentId: session.documentId,
-            data: { isActive: false },
+            data: { 
+              isActive: false,
+              terminatedManually: false,  // Timeout, not manual - can be reactivated
+            },
           });
           deactivatedCount++;
         }
