Sign-in and session lifetime

How people sign in to HealthyRides, and when a session ends.

Signing in

People sign in through WorkOS, which is the record of who has access and which roles they hold. HealthyRides keeps its own copy of each membership for the details WorkOS has no place for, such as which locations a person works at (docs/decisions/0010-workos-is-the-system-of-record-for-identity.md).

Single sign-on through WorkOS is available on request. Once it is connected, the Admin screen shows the connection's state as WorkOS reports it (docs/decisions/0010-workos-is-the-system-of-record-for-identity.md).

Multi-factor authentication is available through WorkOS, and recommended. HealthyRides does not report whether an organization requires it (docs/decisions/0010-workos-is-the-system-of-record-for-identity.md).

How long a session lasts

A session ends 14 days after sign-in at the latest, however active it is (docs/decisions/0021-idle-timeout-slides-on-the-sealed-session.md; platform/apps/web/lib/server/session.ts).

A session also ends after a period nobody used it. A facility organization starts at 15 minutes, and its admin can set 5 to 720 minutes or turn it off. A provider organization has no idle limit until its admin sets one (docs/decisions/0021-idle-timeout-slides-on-the-sealed-session.md; docs/prd/healthyrides-mvp-prd.md).

A screen that refreshes itself on a timer does not count as use, so a dashboard left open at a nurses' station still times out (docs/decisions/0021-idle-timeout-slides-on-the-sealed-session.md).

When a session times out, the app signs the person out of WorkOS too, rather than back into it, so the next person at a shared workstation is asked to sign in, and the screen clears the patient information it was showing (docs/decisions/0021-idle-timeout-slides-on-the-sealed-session.md).

The time of last use is kept inside the encrypted session cookie, so a browser cannot move it forward (docs/decisions/0021-idle-timeout-slides-on-the-sealed-session.md).

When access is taken away

Suspending or removing a person ends their sessions on every device at their next request, because every request checks the membership as it stands (docs/decisions/0011-membership-status-is-checked-on-every-request.md). See Access control and roles.

A refused session is logged with its reason only, never with the cookie (docs/decisions/0021-idle-timeout-slides-on-the-sealed-session.md).