- Shipped
- 26 Agosti 2026, 06:53 UTC
- Author
- Kamo
- Commit
- d399309
A patient is NOT a Member, and this is deliberately not the workforce identity. Reusing the staff login would mean a patient held a principal that every internal authorisation check has to remember to exclude, and the first check that forgot would hand a patient a staff screen. A portal principal resolves to one patient plus whatever proxy grants that login holds, and to nothing else. SESSIONS ARE ROWS, not self-contained tokens. A practice withdrawing access, or a patient reporting a lost phone, needs the session to stop working NOW — and a stateless token cannot be revoked before it expires. There is an idle timeout as well as an absolute one, because a portal left open on a family computer is the ordinary case rather than the exotic one. INVITATIONS ARE SINGLE-USE AND TIME-BOXED, and only the token's hash is stored. A link lives in an inbox for years; a reusable one is a permanent credential sitting in whatever mailbox that address later belongs to. The refusal says WHICH problem it is — used, superseded, expired — because "invalid link" sends a patient to the practice with nothing to say and the practice with nothing to look up. PROXY ACCESS CARRIES AN END DATE BY DEFAULT. This is where portals go wrong, and they go wrong in one specific way: a grant is made and never reviewed. A parent's access to a child's record is entirely appropriate at seven and is a disclosure at seventeen, so a minor's grant expires on the day they reach majority, computed from their birth date at grant time. Scope is stored because a carer who manages appointments has no business reading a mental-health note, and a system offering only access/no-access makes a practice choose between too much and nothing. Rows are never deleted. Withdrawing access is a decision somebody made about a person's §164.524 right and has to stay visible as one; a deleted row looks like an account that never existed.