danvics/pediatric-ai-scribe-v3
1
0
Fork 0
Code Issues Pull requests Projects Releases 14 Packages Wiki Activity Actions

Hide Active Sessions for SSO-only users

Browse source 
Follows the same pattern as Change Password and 2FA sections —
hidden by default in the HTML, revealed only when canLocalAuth=true.

Why: revoke technically deletes the PedScribe session row and clears
the cookie on that device, but the SSO user can re-auth instantly
because their IdP session is still live. Surfacing a "revoke" button
that the IdP will immediately undo is misleading. SSO users now see
only the SSO-relevant sections of Settings.
This commit is contained in:
Daniel 2026-04-14 05:07:07 +02:00
parent 17fa3d56f4
commit 2f8bf16ace
2 changed files with 10 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
public/components/settings.html
View file

@ -133,8 +133,8 @@
</div>
</div>
<!-- Active Sessions -->
<div class="settings-section card">
<!-- Active Sessions — hidden for SSO-only users (revoke can't stick against an active IdP session) -->
<div class="settings-section card" id="sessions-section" style="display:none;">
<h3><i class="fas fa-desktop"></i> Active Sessions</h3>
<p style="font-size:13px;color:var(--g600);">Devices where you are currently logged in. Revoke any session to immediately log that device out.</p>
<div style="margin-bottom:10px;">

12
public/js/auth.js
View file

@ -743,16 +743,20 @@ document.addEventListener('DOMContentLoaded', function() {
}
// Keep cache in sync
window.CURRENT_USER = data.user;
// Sections are display:none by default in the HTML. Only reveal them
// if the server confirms this user has a real password hash
// (canLocalAuth === true). SSO-auto-created users never see these UIs.
// Sections are display:none by default in the HTML. Reveal them only
// for users with a real password hash (canLocalAuth === true).
// SSO-only users never see password change, 2FA, or session
// management — session revoke can't stick against an active IdP
// session, so showing it would be misleading.
var pwSection = document.getElementById('change-password-section');
var twofaSection = document.getElementById('2fa-section');
var sessionsSection = document.getElementById('sessions-section');
if (data.user.canLocalAuth !== true) {
return; // Stay hidden — nothing more to load for SSO-only users
return;
}
if (pwSection) pwSection.style.display = '';
if (twofaSection) twofaSection.style.display = '';
if (sessionsSection) sessionsSection.style.display = '';
var status = document.getElementById('2fa-status');
var setupBtn = document.getElementById('btn-setup-2fa');
var disableBtn = document.getElementById('btn-disable-2fa');