Repository: strapi/strapi
File: packages/plugins/users-permissions/server/controllers/auth.js (JavaScript)

Code before:
      if (user.blocked === true) {
        throw new ApplicationError('Your account has been blocked by an administrator');
      }

      const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
      if (mode === 'refresh') {
        const deviceId = extractDeviceId(ctx.request.body);

        const refresh = await strapi
          .sessionManager('users-permissions')
          .generateRefreshToken(String(user.id), deviceId, { type: 'refresh' });

        const access = await strapi
          .sessionManager('users-permissions')
          .generateAccessToken(refresh.token);
        if ('error' in access) {
          throw new ApplicationError('Invalid credentials');
        }

        const upSessions = strapi.config.get('plugin::users-permissions.sessions');
        const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
        if (upSessions?.httpOnly || requestHttpOnly) {
          const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
          const cookieOptions = {
            httpOnly: true,
            secure: process.env.NODE_ENV === 'production' || Boolean(upSessions.cookie?.secure),
            sameSite: upSessions.cookie?.sameSite ?? 'lax',
            path: upSessions.cookie?.path ?? '/',
            domain: upSessions.cookie?.domain,
            overwrite: true,
          };

          ctx.cookies.set(cookieName, refresh.token, cookieOptions);
          return ctx.send({ jwt: access.token, user: await sanitizeUser(user, ctx) });
        }

        return ctx.send({
          jwt: access.token,
          refreshToken: refresh.token,
          user: await sanitizeUser(user, ctx),
        });
      }

      return ctx.send({
        jwt: getService('jwt').issue({ id: user.id }),
        user: await sanitizeUser(user, ctx),
      });
    }

    // Connect the user with the third-party provider.
    try {

Review comment (suggestion):
These don't seem right, because they will always resolve to `true` for production

Code after:
      if (user.blocked === true) {
        throw new ApplicationError('Your account has been blocked by an administrator');
      }

      const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
      if (mode === 'refresh') {
        const deviceId = extractDeviceId(ctx.request.body);

        const refresh = await strapi
          .sessionManager('users-permissions')
          .generateRefreshToken(String(user.id), deviceId, { type: 'refresh' });

        const access = await strapi
          .sessionManager('users-permissions')
          .generateAccessToken(refresh.token);
        if ('error' in access) {
          throw new ApplicationError('Invalid credentials');
        }

        const upSessions = strapi.config.get('plugin::users-permissions.sessions');
        const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
        if (upSessions?.httpOnly || requestHttpOnly) {
          const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
          const isProduction = process.env.NODE_ENV === 'production';
          const isSecure =
            typeof upSessions.cookie?.secure === 'boolean'
              ? upSessions.cookie?.secure
              : isProduction;

          const cookieOptions = {
            httpOnly: true,
            secure: isSecure,
            sameSite: upSessions.cookie?.sameSite ?? 'lax',
            path: upSessions.cookie?.path ?? '/',
            domain: upSessions.cookie?.domain,
            overwrite: true,
          };

          ctx.cookies.set(cookieName, refresh.token, cookieOptions);
          return ctx.send({ jwt: access.token, user: await sanitizeUser(user, ctx) });
        }

        return ctx.send({
          jwt: access.token,
          refreshToken: refresh.token,
          user: await sanitizeUser(user, ctx),
        });
      }

      return ctx.send({
        jwt: getService('jwt').issue({ id: user.id }),