mirror of
https://github.com/n8n-io/n8n.git
synced 2026-10-21 20:20:03 +02:00
2177fe1d89
Some checks failed
CI: Python / Checks (push) Has been cancelled
Add a per-login session registry so users can see the browsers and devices signed in to their account and revoke individual sessions or all other sessions from their personal settings. Backend: - New user_login_session entity, migration and repository, keyed by a session id embedded as the JWT jti claim. - LoginSessionService owns the session lifecycle (create on login, touch on refresh, list, revoke, revoke-all-others) and prunes expired rows on read. - The session check is enforced in validateToken, so every auth path (interactive, webhook cookie auth, dynamic credentials) rejects a revoked or logged-out session. Tokens issued before this change carry no jti and fall back to the existing checks until they expire, so no one is logged out on upgrade. - Password change, email change and MFA enable/disable revoke the user's other sessions. - /me/login-sessions endpoints (list, revoke one, revoke all others). Frontend: - Login sessions section in personal settings listing device, IP, last active and sign-in time, with the current session flagged and per-row revoke plus a revoke-all-others action. |
||
|---|---|---|
| .. | ||
| bin | ||
| scripts | ||
| src | ||
| templates | ||
| test | ||
| BREAKING-CHANGES.md | ||
| eslint.config.mjs | ||
| nodemon.json | ||
| package.json | ||
| tsconfig.build.json | ||
| tsconfig.json | ||
| vitest.config.base.ts | ||
| vitest.config.integration.testcontainers.ts | ||
| vitest.config.integration.ts | ||
| vitest.config.migration.testcontainers.ts | ||
| vitest.config.migration.ts | ||
| vitest.config.ts | ||
| vitest.tsc-entity-transform.ts | ||
| vitest.workspace-externals.ts | ||