## Description First PR of user_sessions feature - enforcement, impersonation and mfa will be handled separately. Adds an Active Sessions section under Profile where users can see every device currently logged in and revoke any session they don't recognize. Helps users lock down stale or unrecognized logins on their own without needing support. **Behavior at the limit, by client:** - **Browser:** returns 409 with a picker overlay; user picks a session to revoke or chooses "End all sessions" to clear them. - **Mobile / API client:** silently evicts the oldest session and proceeds with login (no picker UI to render). - **Pre-tracking users** (token rows without `user_sessions`, i.e. anyone already logged in before this ships): silent-evict any untracked token first, so freshly tracked sessions are never killed in favor of legacy ones. Sessions are stored in a new `user_sessions` table keyed on `(user_id, client_id)` with browser, platform, IP, last activity and (when configured) geo. Kept in sync with `user.tokens` via an after_save callback so revoking a token from any path cleans up the row. Fixes https://linear.app/chatwoot/issue/CW-7169 ## Type of change - [x] New feature (non-breaking change which adds functionality) ## How Has This Been Tested? - Added specs. - Manual local testing: browser picker fires at limit; pre-tracking user silent-evicts; mixed tracked/untracked correctly drops the untracked one first; profile page revoke succeeds; current session cannot be revoked from profile. ## Checklist - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [x] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] Any dependent changes have been merged and published in downstream modules
116 lines
3.0 KiB
JavaScript
116 lines
3.0 KiB
JavaScript
/* global axios */
|
|
|
|
import Cookies from 'js-cookie';
|
|
import endPoints from './endPoints';
|
|
import {
|
|
clearCookiesOnLogout,
|
|
deleteIndexedDBOnLogout,
|
|
} from '../store/utils/api';
|
|
|
|
export default {
|
|
validityCheck() {
|
|
const urlData = endPoints('validityCheck');
|
|
return axios.get(urlData.url);
|
|
},
|
|
logout() {
|
|
const urlData = endPoints('logout');
|
|
const fetchPromise = new Promise((resolve, reject) => {
|
|
axios
|
|
.delete(urlData.url)
|
|
.then(response => {
|
|
deleteIndexedDBOnLogout();
|
|
clearCookiesOnLogout();
|
|
resolve(response);
|
|
})
|
|
.catch(error => {
|
|
reject(error);
|
|
});
|
|
});
|
|
return fetchPromise;
|
|
},
|
|
hasAuthCookie() {
|
|
return !!Cookies.get('cw_d_session_info');
|
|
},
|
|
getAuthData() {
|
|
if (this.hasAuthCookie()) {
|
|
const savedAuthInfo = Cookies.get('cw_d_session_info');
|
|
return JSON.parse(savedAuthInfo || '{}');
|
|
}
|
|
return false;
|
|
},
|
|
profileUpdate({ displayName, avatar, ...profileAttributes }) {
|
|
const formData = new FormData();
|
|
Object.keys(profileAttributes).forEach(key => {
|
|
const hasValue = profileAttributes[key] === undefined;
|
|
if (!hasValue) {
|
|
formData.append(`profile[${key}]`, profileAttributes[key]);
|
|
}
|
|
});
|
|
formData.append('profile[display_name]', displayName || '');
|
|
if (avatar) {
|
|
formData.append('profile[avatar]', avatar);
|
|
}
|
|
return axios.put(endPoints('profileUpdate').url, formData);
|
|
},
|
|
|
|
profilePasswordUpdate({ currentPassword, password, passwordConfirmation }) {
|
|
return axios.put(endPoints('profileUpdate').url, {
|
|
profile: {
|
|
current_password: currentPassword,
|
|
password,
|
|
password_confirmation: passwordConfirmation,
|
|
},
|
|
});
|
|
},
|
|
|
|
updateUISettings({ uiSettings }) {
|
|
return axios.put(endPoints('profileUpdate').url, {
|
|
profile: { ui_settings: uiSettings },
|
|
});
|
|
},
|
|
|
|
updateAvailability(availabilityData) {
|
|
return axios.post(endPoints('availabilityUpdate').url, {
|
|
profile: { ...availabilityData },
|
|
});
|
|
},
|
|
|
|
updateAutoOffline(accountId, autoOffline = false) {
|
|
return axios.post(endPoints('autoOffline').url, {
|
|
profile: { account_id: accountId, auto_offline: autoOffline },
|
|
});
|
|
},
|
|
|
|
deleteAvatar() {
|
|
return axios.delete(endPoints('deleteAvatar').url);
|
|
},
|
|
|
|
resetPassword({ email }) {
|
|
const urlData = endPoints('resetPassword');
|
|
return axios.post(urlData.url, { email });
|
|
},
|
|
|
|
setActiveAccount({ accountId }) {
|
|
const urlData = endPoints('setActiveAccount');
|
|
return axios.put(urlData.url, {
|
|
profile: {
|
|
account_id: accountId,
|
|
},
|
|
});
|
|
},
|
|
resendConfirmation() {
|
|
const urlData = endPoints('resendConfirmation');
|
|
return axios.post(urlData.url);
|
|
},
|
|
resetAccessToken() {
|
|
const urlData = endPoints('resetAccessToken');
|
|
return axios.post(urlData.url);
|
|
},
|
|
getSessions() {
|
|
return axios.get('/api/v1/profile/sessions');
|
|
},
|
|
revokeSession(id) {
|
|
return axios.delete(`/api/v1/profile/sessions/${id}`);
|
|
},
|
|
};
|