Ghost/ghost/core
Simon Backx 75bb53f065
🔒 Added support for logging out members on all devices (#18935)
fixes https://github.com/TryGhost/Product/issues/3738
https://www.notion.so/ghost/Member-Session-Invalidation-13254316f2244c34bcbc65c101eb5cc4

- Adds the transient_id column to the members table. This defaults to
email, to keep it backwards compatible (not logging out all existing
sessions)
- Instead of using the email in the cookies, we now use the transient_id
- Updating the transient_id means invalidating all sessions of a member
- Adds an endpoint to the admin api to log out a member from all devices
- Added the `all` body property to the DELETE session endpoint in the
members API. Setting it to true will sign a member out from all devices.
- Adds a UI button in Admin to sign a member out from all devices
- Portal 'sign out of all devices' will not be added for now

Related changes (added because these areas were affected by the code
changes):
- Adds a serializer to member events / activity feed endpoints - all
member fields were returned here, so the transient_id would also be
returned - which is not needed and bloats the API response size
(`transient_id` is not a secret because the cookies are signed)
- Removed `loadMemberSession` from public settings browse (not used
anymore + bad pattern)

Performance tests on site with 50.000 members (on Macbook M1 Pro):
- Migrate: 6s (adding column 4s, setting to email is 1s, dropping
nullable: 1s)
- Rollback: 2s
2023-11-15 17:10:28 +01:00
..
content 🎨 Updated Source to v1.1.0 2023-10-27 15:03:15 +00:00
core 🔒 Added support for logging out members on all devices (#18935) 2023-11-15 17:10:28 +01:00
test 🔒 Added support for logging out members on all devices (#18935) 2023-11-15 17:10:28 +01:00
.c8rc.e2e.json Split CI database tests into separate types 2023-05-22 19:34:17 +02:00
.c8rc.json Added eslint rule for file naming convention 2023-05-09 12:34:34 -04:00
.eslintignore Updated .eslintignore list for core 2022-10-10 15:12:52 +07:00
.eslintrc.js Updated linting and migration comment to improve practices 2023-06-26 15:29:37 +02:00
.npmignore Moved monobundle into monorepo 2023-11-13 13:30:38 +01:00
config.development.json Converted Ghost repo into a monorepo 2022-07-20 16:41:05 +02:00
ghost.js Added browser-based testing framework 2022-11-22 14:12:34 +00:00
index.js Configured New Relic to load earlier in the process 2023-08-30 11:47:50 +02:00
jsconfig.json Deleted reference to core/admin 2022-08-03 16:28:41 +02:00
loggingrc.js Added version information to log lines 2023-01-20 13:18:44 +01:00
MigratorConfig.js Added eslint rule for file naming convention 2023-05-09 12:34:34 -04:00
monobundle.js Moved monobundle into monorepo 2023-11-13 13:30:38 +01:00
newrelic.js Configured New Relic integration within Ghost core 2023-08-29 09:30:25 +01:00
package.json 🐛 Fixed highlight formatting not showing in rendered posts (#18997) 2023-11-15 14:08:14 +00:00
playwright.config.js Parallelise browser tests 2023-10-13 11:42:39 +00:00