Session Management
Feature Detail
Description
Session Management gives organization administrators visibility into active user sessions within their tenant and the ability to revoke them individually or in bulk. Admins can view active sessions with user identity and last-activity timestamps, force sign-out specific users, and invalidate the full refresh-token chain for an account. The feature is essential for incident response to compromised accounts, offboarding departing users, and enforcing access policy changes without waiting for natural token expiry.
Sources & reasoning
The Authentication Module capabilities list explicitly names "Session revocation (sign-out, forced expiry, admin-initiated)" as a core capability. The Global Admin time-bounded access model further requires revocation to take effect immediately on expiry or manual revocation. The blueprint places this under admin-security as MVP, confirming it is required at launch for the admin portal.
No source references — this artifact was included based on reasoning alone (see above).
Analysis
Immediate session revocation is a critical incident response capability for organizations managing peer mentors with access to sensitive contact and assignment data. When an account is compromised or a user offboarded, waiting for natural token expiry leaves a window of unauthorized access. The feature also supports the Global Admin time-bounded access model: when a support window expires or is manually revoked, active sessions must terminate immediately. This directly underpins the platform's GDPR data protection obligations and the strict tenant isolation model. Without it, organizations cannot guarantee that access ends when authorization ends - a fundamental data protection requirement.
Session state is managed in the sessions and refresh_tokens tables. The Session Management UI queries active sessions scoped to the admin's tenant, joining with users to show display names and last-activity timestamps. Revocation calls the Authentication Module's revocation endpoint, marking the session and refresh-token chain as invalid. The mobile API client (ApiHttpClient) treats revocation-specific 401 responses as non-retryable, forcing the user to the login screen. Admin-initiated revocations are recorded in the audit log. Cross-tenant session access is never permitted, even for Global Admins without an explicit time-bounded support access grant for the target organization.
Components (46)
Shared Components
These components are reused across multiple features
Service Layer (11)
Data Layer (23)
Infrastructure (7)
User Stories
No user stories have been generated for this feature yet.