https://medplum.com logo
Join Discord
Powered by
Prevent/refuse login for inactive Patient users
# support
a
Hi all. I'd like to refuse login for users where 
Patient.active === false
, ideally using just the patient user email before password entry. I tried creating a Medplum bot that takes a 
Parameters
input with the email and returns a boolean, but it fails because bots require authentication by the user who invoked them, and there's no session yet during the login flow. As a work around, I've tried to call the bot immediately following successful user login, but have been unable to get that to work either. Is there a recommended way to enforce this kind of check? Thank you!
f
Hey @alex_empallo , what I would suggest is having another AccessPolicy for inactive Patient Users, and when you mark Patient.active === false , you switch out whatever your current default Patient AccessPolicy is for the inactive one. You would likely want your inactive patient's AccessPolicy to be very restrictive. For example, you could just create a blank one with no resource access.
This way, you can still handle your messaging after the login to notify the Patient that they are inactive, but the token that they receive will also not be able to retrieve any clinical information
For context, usually the Patient.active field is used for searching and filtering for all active or inactive Patients, rather than conditionally granting access to that Patient when they are logging in
a
Got it. Thank you, Finn!
f
No worries!
152 Views
PreviousNext
Powered by