What does it do?

Adds missing default permissions for the auth.refresh and auth.logout endpoints to the DEFAULT_PERMISSIONS array in the users-permissions plugin:

• auth.refresh → public role (allows unauthenticated token refresh)
• auth.logout → authenticated role (requires valid access token)

Why is it needed?

403 Forbidden when calling /api/auth/refresh, as it was never added to DEFAULT_PERMISSIONS. Even with a valid refresh token, because the public role had no permission to access the endpoint.

How to test it?

Prerequisites:

• Configure users and permissions with jwtManagement: 'refresh'

Test refresh endpoint (public access):

# Login to get refresh token
curl -X POST http://localhost:1337/api/auth/local \
  -H "Content-Type: application/json" \
  -d '{"identifier":"[email protected]","password":"password"}'

# Refresh WITHOUT Authorization header (should return 200, not 403)
curl -X POST http://localhost:1337/api/auth/refresh \
  -H "Content-Type: application/json" \
  -d '{"refreshToken":"<token-from-login>"}'

Expected: Returns HTTP 200 with new JWT and refreshToken

Test logout endpoint (authenticated access):
# Should require Authorization header
curl -X POST http://localhost:1337/api/auth/logout \
  -H "Authorization: Bearer <jwt-token>"

Expected: Returns HTTP 200 and invalidates session

Related issue(s)/PR(s)

Fixes #24867
Fixes #24871