Sessions

An enrolled device needs an open session before any call that gets a decision. Use client.session to:

• sign in through the identity provider
• resume after inactivity
• sign out
• read the session’s state and, while a session is open, who is signed in and for how long

Sign in, resume, sign out

signIn opens the identity provider in the system browser and proves the device key in the same step. Call resume after inactivity. It unlocks the device key and signs a fresh nonce, with no round trip to the identity provider. If the tenant requires the identity provider on resume, resume throws sign-in-required instead.

TypeScript

const session = await client.session.signIn();
// later, after inactivity:
await client.session.resume();
await client.session.signOut();

Swift

let session = try await client.session.signIn()
try await client.session.resume()
try await client.session.signOut()

Kotlin

val session = client.session.signIn()
client.session.resume()
client.session.signOut()

Watch the session state

client.session.state is one of five values. client.on('session', ...) reports each change. React to it, typically by calling resume while the person is still there.

SessionState	Meaning
none	No session has been opened yet.
open	Signed in and active.
inactive	The person stepped away past the inactivity lifetime. resume gets them back in.
offline	The Seald Healthcare Cloud is unreachable. What the offline lease covers still opens.
ended	Your application called signOut, or the session’s overall lifetime ran out.

TypeScript

client.on('session', async ({ state }) => {
  if (state === 'inactive') await client.session.resume();
});

Swift

for await event in client.on(.session) {
  if event.state == .inactive { try await client.session.resume() }
}

Kotlin

client.on<ClientEvent.Session>().collect { event ->
  if (event.state == SessionState.INACTIVE) client.session.resume()
}

Read the current session

While a session is open, client.session.current is a Session. It carries:

• person: the signed-in person
• multiFactor: whether they signed in with multi-factor
• openedAt: when the session opened
• lifetimes: the tenant’s three lifetimes, in seconds
  • inactivity: how long the session may stay idle before inactive
  • tokenRefresh: how often the SDK refreshes the identity provider’s token
  • overall: the hard ceiling before ended

TypeScript

const current = client.session.current;
if (current) showBadge(current.person, current.multiFactor, current.lifetimes.overall);

Swift

if let current = client.session.current {
  showBadge(current.person, current.multiFactor, current.lifetimes.overall)
}

Kotlin

client.session.current?.let { showBadge(it.person, it.multiFactor, it.lifetimes.overall) }

Lock the device key

client.lock() locks the device key in memory without ending the session on the Seald Healthcare Cloud. The next call that needs the key unlocks it again through the unlock adapter. Check client.locked before a call that would otherwise surprise the person with an unlock prompt.

TypeScript

client.lock();
if (client.locked) showUnlockPrompt();

Swift

client.lock()
if client.locked { showUnlockPrompt() }

Kotlin

client.lock()
if (client.locked) showUnlockPrompt()

What the SDK does for you

• Runs the identity provider’s authorization code flow with PKCE, holding no client secret.
• Proves the device key on every request for the life of the session.
• Refreshes the identity provider’s token on its own, at the tenant’s tokenRefresh lifetime.
• Sends the session’s manifest, a record of what it opened, when the session ends.
• Pins the backup key registration’s fingerprint on the first session in a tenant.

Decisions and errors you may see

Outcome or ErrorCode	When	What to do
locked	A call needed the device key and it is locked.	Prompt for the person’s unlock secret. The SDK also asks through the unlock adapter automatically.
no-session	A call needed an open session and none exists.	Call signIn.
sign-in-required	The tenant requires the identity provider on resume, or the token refresh was refused.	Call signIn again.
revoked	The device certificate (card) of this device is no longer active.	The SDK has already discarded the offline lease and locked the device key. Tell the person to re-enroll from another device.
release-below-floor	This application’s release is below the tenant’s version floor.	Tell the person to update through your release channel.
unreachable	The Seald Healthcare Cloud cannot be reached.	Retry when back online. What the offline lease covers still opens.

Next

• Enroll a device before a session exists.
• Open records and files once a session is open.
• Work offline for what happens while unreachable.
• Restore a lost device after a revoked card.