From 2f8bf16ace91ad2b2a875f0ef10ac699bf724a8e Mon Sep 17 00:00:00 2001
From: Daniel <daniel@danvics.com>
Date: Tue, 14 Apr 2026 05:07:07 +0200
Subject: [PATCH] Hide Active Sessions for SSO-only users
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follows the same pattern as Change Password and 2FA sections —
hidden by default in the HTML, revealed only when canLocalAuth=true.

Why: revoke technically deletes the PedScribe session row and clears
the cookie on that device, but the SSO user can re-auth instantly
because their IdP session is still live. Surfacing a "revoke" button
that the IdP will immediately undo is misleading. SSO users now see
only the SSO-relevant sections of Settings.
---
 public/components/settings.html |  4 ++--
 public/js/auth.js               | 12 ++++++++----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/public/components/settings.html b/public/components/settings.html
index f88883d..b4cd898 100644
--- a/public/components/settings.html
+++ b/public/components/settings.html
@@ -133,8 +133,8 @@
             </div>
           </div>
 
-          <!-- Active Sessions -->
-          <div class="settings-section card">
+          <!-- Active Sessions — hidden for SSO-only users (revoke can't stick against an active IdP session) -->
+          <div class="settings-section card" id="sessions-section" style="display:none;">
             <h3><i class="fas fa-desktop"></i> Active Sessions</h3>
             <p style="font-size:13px;color:var(--g600);">Devices where you are currently logged in. Revoke any session to immediately log that device out.</p>
             <div style="margin-bottom:10px;">
diff --git a/public/js/auth.js b/public/js/auth.js
index 57655cb..54a2460 100644
--- a/public/js/auth.js
+++ b/public/js/auth.js
@@ -743,16 +743,20 @@ document.addEventListener('DOMContentLoaded', function() {
       }
       // Keep cache in sync
       window.CURRENT_USER = data.user;
-      // Sections are display:none by default in the HTML. Only reveal them
-      // if the server confirms this user has a real password hash
-      // (canLocalAuth === true). SSO-auto-created users never see these UIs.
+      // Sections are display:none by default in the HTML. Reveal them only
+      // for users with a real password hash (canLocalAuth === true).
+      // SSO-only users never see password change, 2FA, or session
+      // management — session revoke can't stick against an active IdP
+      // session, so showing it would be misleading.
       var pwSection = document.getElementById('change-password-section');
       var twofaSection = document.getElementById('2fa-section');
+      var sessionsSection = document.getElementById('sessions-section');
       if (data.user.canLocalAuth !== true) {
-        return; // Stay hidden — nothing more to load for SSO-only users
+        return;
       }
       if (pwSection) pwSection.style.display = '';
       if (twofaSection) twofaSection.style.display = '';
+      if (sessionsSection) sessionsSection.style.display = '';
       var status = document.getElementById('2fa-status');
       var setupBtn = document.getElementById('btn-setup-2fa');
       var disableBtn = document.getElementById('btn-disable-2fa');