feat: integrate Strapi-native end-user sessions

.agents/skills/strapi-plugin-maintenance/SKILL.md

@@ -5,8 +5,18 @@ description: Maintain Magic-Sessionmanager as a standalone Strapi 5 plugin, incl
 
 # Magic-Sessionmanager maintenance
 
-Use Node 22. Check local rules, current Strapi 5 docs through Context7 and latest compatible 5.x against the pinned workbench before changing auth/session hooks. Do not embed credentials, encryption keys or browser auth state in skills, source or Git; do not push without an explicit request.
+Use Node 22. Read the always-applied Strapi plugin rule and check current Strapi 5 docs through Context7 before using admin or Design System APIs. Compare with installed types and the pinned workbench version. If Context7 is quota-limited, tell the user and verify official docs plus the installed implementation. Do not embed credentials, encryption keys or browser auth state in skills, source or Git; do not push without an explicit request.
 
 Trace `server/src/routes/admin.js`, `content-api.js`, bootstrap JWT wrapper, session services and `admin/src/permissions.js`. Make a route matrix for anonymous, unauthorised admin, allowed admin, own session and other user's session. Check revocation, session listing, settings and analytics on the server; hiding a menu is not access control. Public hooks or compatibility routes require a documented signature/token and rate limit. Verify encryption key fallback is development-only, no token/PII logging, retention and GeoIP consent/availability; do not call external GeoIP services in a smoke test.
 
-For the admin UI, use Strapi 5 Design System components, permission-backed navigation, accessible table actions, focus and responsive settings forms. Run `npm test`, `npm run build`, `npm run verify:runtime`; then shared app build, boot and Playwright CLI checks. Report independent unit, integration and negative-permission evidence separately.
+For the admin UI, first read the workbench root `references/ui-ux-standards.md`. Use current Strapi 5 Design System components. Register a new Settings section with `app.addSettingsLink({ id, intlLabel }, links)` and add links to an existing section with `app.addSettingsLink(sectionId, linkOrLinks)`. Use permission-backed navigation, accessible controls and responsive forms. Use the Design System Switch for binary settings; in installed v2.2.4, Toggle displays Off/On choices vertically and is not the compact control. Keep the horizontal switch beside its title and description in one row. Do not stack the switch above centered copy. Use shrink-safe layouts (`width: 100%`, `min-width: 0`, responsive grid columns) and verify 320/390/1024/1440 CSS px plus the full breakpoint-adjacent matrix through Playwright CLI. Use Playwright CLI exclusively; never use CUA, Computer Use, or desktop-control tools. Preserve existing Settings routes and RBAC. If a link is missing, verify registration and the admin role before changing permissions. Run `npm test`, `npm run test:ts:front`, `npm run build`, `npm run verify`, and `npm run verify:runtime`; then shared app build, boot and authenticated Playwright CLI checks. If authentication or screenshot capture is unavailable, leave visual acceptance open. Report unit, integration, negative-permission and responsive-browser evidence separately.
+
+For the Users & Permissions end-user panel, use the documented Content Manager API `addEditViewSidePanel` for contextual session information. Use `addDocumentAction` or `addDocumentHeaderAction` when the task is a document action. Do not depend on `editView.informations`; Strapi marks that injection zone internal. Verify the mobile ActionsDrawer after opening it, including its constrained inner scroll area and reachability of the final action. The official API references are [Content Manager APIs](https://docs.strapi.io/cms/plugins-development/content-manager-apis) and [Admin injection zones](https://docs.strapi.io/cms/plugins-development/admin-injection-zones) (checked 2026-10-16; confirm installed package types on future upgrades).
+
+Keep Playwright CLI evidence private and value-free. Its accessibility snapshots may include values from password inputs. Check sensitive fields before snapshotting, enter fake credentials only in memory, and navigate away or clear the field before capturing another snapshot. Never reuse a test credential that appeared in CLI output or an artifact.
+
+## Shared product quality contract
+
+Use spec-first development: define acceptance criteria and API response/error contracts before implementation.
+
+Every behavior change starts with a written current-state and target-state analysis covering screens, controls, routes, roles, data, known gaps and non-goals. Define acceptance criteria and API response/error contracts before implementation, then add a failing regression test first. A primary task should take no more than four meaningful user interactions from the plugin entry page; exclude login and mandatory security confirmations, and measure and document any justified exception. Use the Strapi Design System, responsive layouts, keyboard accessibility and explicit loading, empty, success and error states. Enforce authentication, plugin permissions, validation and owner boundaries server-side. Keep API error contracts consistent within each Strapi surface and never return stack traces or internal details. Do not log secrets, tokens, cookies, request bodies, email, IP or stable user/session identifiers. Use fakes for providers and record unverified behavior accurately. Magic Session Manager remains limited to Users & Permissions end-user sessions; Strapi Admin sessions are outside scope.

.cursor/rules/strapi-plugin-quality.mdc

@@ -0,0 +1,40 @@
+---
+description: Always apply the Strapi plugin product, API, UI and privacy contract before changing plugin code or documentation.
+alwaysApply: true
+---
+
+# Strapi plugin quality contract
+
+Before editing, read the applicable `AGENTS.md`, every always-applied Cursor rule, and the local `strapi-plugin-maintenance` skill. Inspect the root and target plugin Git status. Preserve existing changes and work on one plugin at a time.
+
+## Analyze and specify first
+
+- Record the current state: screens, controls, routes, permissions, error behavior, tests and known gaps.
+- Define the target state, affected user roles and data, non-goals, API contract and measurable acceptance criteria before implementation.
+- Use spec-first development. Add a failing regression test before changing behavior. Keep legacy routes and response contracts unless the approved spec explicitly changes them.
+
+## UI and journey
+
+- For any plugin admin UI, responsive, accessibility, form, or navigation change, read the workbench skill's `references/ui-ux-standards.md` before proposing or editing a design.
+- Before using a Strapi admin or Design System API, check current Strapi 5 documentation and installed package types. Prefer Context7; if its quota is unavailable, say so and verify official Strapi documentation and installed code rather than silently relying on memory.
+- Use the installed Strapi Design System and semantic, keyboard-accessible controls. Prefer its layout, form, table, feedback, switch and typography components over one-off styling.
+- Use Playwright CLI exclusively for browser automation and responsive UI checks. Do not use CUA, Computer Use, or desktop-control tools.
+- Make every admin page responsive by construction. Verify 320, 390, 1024 and 1440 CSS-pixel viewports in a real browser. Check document and component overflow, wrapping, focus, labels, contrast, and loading, empty, error and success states. Do not call source-only checks a visual acceptance pass.
+- For flexible content, set `min-width: 0`, use full-width controls, and use `minmax(0, 1fr)` where content must shrink. Let descriptions wrap naturally. Avoid fixed widths/heights for text and nested padding that consumes the mobile viewport.
+- Keep each field label, control and description together. Use equal desktop columns for paired fields and stack them cleanly on narrow screens without clipping or mismatched control widths.
+- Keep Strapi `Toggle` controls horizontal and aligned beside their title/description in one compact row. Do not center a switch above vertically stacked copy. On narrow screens, let the copy wrap while the switch remains horizontal and reachable.
+- Register plugin settings through the current `app.addSettingsLink` API. Verify the section label, expected paths and permission-backed visibility. Do not weaken or remove permissions to make a missing link appear; inspect RBAC and Strapi registration instead.
+- A primary task should take no more than four meaningful user interactions from the plugin entry page to its successful outcome. Exclude authentication and mandatory security confirmations from the count. Measure the path and document any justified exception. Never remove a safety step to meet the limit.
+
+## API and security
+
+- Treat the server as the authority. Validate request shape and values, authenticate every protected route, check plugin permissions and resource ownership on every state-changing operation, and return only allowlisted fields.
+- Document method, path, role, input, success response and error status for each affected route. Keep Strapi's admin and Content API conventions intact, use stable error codes/messages within each surface, and never return stack traces, raw exceptions or internal paths to clients.
+- Do not put secrets in browser code. Do not log tokens, cookies, passwords, keys, full provider URLs, request bodies, IP addresses, email addresses or stable user/session identifiers. Log safe operation context and error class/code only; document and test any narrowly justified exception.
+- Test anonymous and unauthorized access, invalid input, owner and other-user boundaries, provider failures, and privacy redaction. Use fake providers. Do not send messages, call live providers, mutate real user sessions or push changes unless separately authorized.
+
+## Verification and documentation
+
+- Cover the behavior with focused unit, UI, API-contract and security tests. Run the plugin's tests, type checks, verification and build, then the shared Strapi build/boot and authenticated Playwright acceptance where applicable.
+- For UI changes, record Playwright evidence at 320/390/1024/1440 px, including the affected task path, measured overflow, keyboard interaction, and console state. If authenticated access or screenshot capture is unavailable, leave that gate explicitly open.
+- Add or update JSDoc for exported and non-trivial functions whose contracts changed. Record measured evidence and leave unverified external or production behavior explicitly open.

.github/workflows/release.yml

@@ -10,8 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
-      issues: write
-      pull-requests: write
+      id-token: write
 
     steps:
       - name: Checkout
@@ -24,6 +23,10 @@ jobs:
         with:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
+
+      - name: Install OIDC-capable npm CLI
+        run: npm install --global npm@12.2.0 --no-audit --no-fund
 
       - name: Install dependencies
         run: npm ci --legacy-peer-deps
@@ -40,5 +43,4 @@ jobs:
       - name: Run semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npx semantic-release

.releaserc.json

@@ -5,7 +5,7 @@
     "@semantic-release/release-notes-generator",
     "@semantic-release/changelog",
     "@semantic-release/npm",
-    ["@semantic-release/github", { "labels": false, "successComment": false }],
+    ["@semantic-release/github", { "labels": false, "successComment": false, "failCommentCondition": false }],
     [
       "@semantic-release/git",
       {

CHANGELOG.md

@@ -1,3 +1,9 @@
+## [Unreleased]
+
+### Added
+
+* Add native Strapi Users & Permissions end-user session support for `jwtManagement: 'refresh'` while retaining `legacy-support`, Magic session metadata and history, and existing endpoint contracts. The plugin does not change host authentication configuration. Strapi administrator-account sessions remain out of scope.
+
 ## [4.7.2](https://github.com/Schero94/Magic-Sessionmanager/compare/v4.7.1...v4.7.2) (2026-07-11)