Session Management
Feature Detail
Description
Session Management gives organization and global administrators visibility into and control over active user sessions within their organization. Admins can view all active sessions with device type, last activity timestamp, and IP address; forcibly terminate individual or all sessions for a specific user; and manage time-bounded Global Admin support access grants, including immediate revocation. When a session is terminated, the associated refresh token chain is invalidated so the session cannot be silently resumed. The feature exposes the administrative controls over session lifecycle that the Authentication Module manages internally, without the auth module owning any admin UI itself.
Sources & reasoning
Line 207 explicitly names admin-initiated session revocation as an auth module capability, and line 259 requires organizations to be able to revoke Global Admin support access immediately on demand. admin-security is always-on (line 241), fixing target release at MVP. Session Management is the admin surface that exposes the auth module's revocation capability; without it, the revocation requirement from line 259 cannot be fulfilled.
-
docs/source/likeperson.md · line 207Session revocation (sign-out, forced expiry, admin-initiated)
-
docs/source/likeperson.md · line 259Orgs can grant a Global Admin *time-bounded* support access via a flag in Organization Settings (e.g. "Allow Norse support access until {date}"); revoking the flag or hitting the expiry immediately removes access.
Analysis
Admin-initiated session revocation is listed as a core authentication module capability (line 207) and is an incident-response prerequisite: if a user's device is lost or an account is compromised, administrators must be able to terminate all active sessions immediately without waiting for token expiry. The time-bounded support access mechanism (line 259) further requires that organizations can revoke Global Admin access at any moment, not merely let it expire passively - which requires a session surface with active revocation controls. Under GDPR, the ability to demonstrably terminate access upon request is a data processor obligation. With admin-security always-on, these controls must be present at launch; deferring them would leave organizations unable to respond to security incidents.
SessionManagementPage is a Next.js SSR page reading from user_sessions and refresh_tokens, scoped by organization_id. SessionManagementService handles termination by marking the refresh token as revoked in the database; in-flight access tokens expire naturally within their short-lived window (≤15 minutes) per the auth module contract. SessionRepository provides the data access layer with queries for active sessions by organization, user, and session ID. Support access grant revocation calls both the session invalidation path and updates the support_access_grants record, triggering an AuditLogService entry. Bulk-revoke for a user is a single database transaction. All session listing queries enforce organization_id scoping. WCAG 2.2 AA compliance required for all interactive elements.
Components (7)
Shared Components
These components are reused across multiple features
User Stories
No user stories have been generated for this feature yet.