fix(session): avoid touching sessions after logout

Author: Schero94

server/src/middlewares/last-seen.js

@@ -43,6 +43,11 @@ const AUTH_PATH_PREFIXES = [
   '/admin/',
 ];
 
+const SELF_TERMINATING_PATHS = new Set([
+  '/api/magic-sessionmanager/logout',
+  '/api/magic-sessionmanager/logout-all',
+]);
+
 /**
  * @param {string} path
  * @returns {boolean}
@@ -52,6 +57,10 @@ function isAuthEndpoint(path) {
   return AUTH_PATH_PREFIXES.some((prefix) => path.startsWith(prefix));
 }
 
+function isSelfTerminatingEndpoint(path) {
+  return SELF_TERMINATING_PATHS.has(path);
+}
+
 /**
  * Creates the last-seen Koa middleware.
  *
@@ -115,6 +124,10 @@ module.exports = ({ strapi, sessionService }) => {
 
       await next();
 
+      if (isSelfTerminatingEndpoint(ctx.path)) {
+        return;
+      }
+
       try {
         await sessionService.touch({
           userId: userDocId,

tests/last-seen.test.js

@@ -0,0 +1,90 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const test = require('node:test');
+
+const createLastSeenMiddleware = require('../server/src/middlewares/last-seen');
+const { invalidateSettingsCache } = require('../server/src/utils/settings-loader');
+
+const token = 'a'.repeat(80);
+
+function createStrapi(session) {
+  return {
+    config: {
+      get() {
+        return {};
+      },
+    },
+    store: () => ({
+      get: async () => null,
+    }),
+    documents: () => ({
+      findFirst: async () => session,
+    }),
+    log: {
+      debug() {},
+      info() {},
+      warn() {},
+    },
+  };
+}
+
+function createCtx(path) {
+  return {
+    path,
+    state: { user: { documentId: 'user-doc-id' } },
+    request: {
+      headers: { authorization: `Bearer ${token}` },
+    },
+    unauthorized(message) {
+      this.status = 401;
+      this.body = { error: { message } };
+    },
+  };
+}
+
+test('last-seen does not touch a session after self-terminating logout routes', async () => {
+  for (const path of ['/api/magic-sessionmanager/logout', '/api/magic-sessionmanager/logout-all']) {
+    invalidateSettingsCache();
+
+    let touchCalls = 0;
+    const middleware = createLastSeenMiddleware({
+      strapi: createStrapi({ documentId: 'session-doc-id', isActive: true }),
+      sessionService: {
+        touch: async () => {
+          touchCalls++;
+        },
+      },
+    });
+
+    const ctx = createCtx(path);
+    await middleware(ctx, async () => {
+      ctx.body = { terminated: true };
+    });
+
+    assert.equal(touchCalls, 0, path);
+  }
+});
+
+test('last-seen still touches sessions after ordinary authenticated requests', async () => {
+  invalidateSettingsCache();
+
+  const touched = [];
+  const middleware = createLastSeenMiddleware({
+    strapi: createStrapi({ documentId: 'session-doc-id', isActive: true }),
+    sessionService: {
+      touch: async (payload) => {
+        touched.push(payload);
+      },
+    },
+  });
+
+  const ctx = createCtx('/api/articles');
+  await middleware(ctx, async () => {
+    ctx.body = { ok: true };
+  });
+
+  assert.deepEqual(touched, [
+    { userId: 'user-doc-id', sessionId: 'session-doc-id' },
+  ]);
+});