Is your feature request related to a problem? Please describe.
Administrators have no way to see which users are currently logged in to SORT. This would help with support, auditing, and understanding usage.
Describe the solution you'd like
Add a section to the administrator console showing currently active/logged-in users.
Sessions are stored in the database (django.contrib.sessions, default DB-backed engine), so this can be built without new infrastructure:
- Query
Session.objects.filter(expire_date__gte=timezone.now()), decode each session, and collect the _auth_user_id values to look up active Users.
- Likely fits as a method on a service (e.g. a new
session_service, following the existing organisation_service / project_service pattern), exposed via an ADMIN-only view.
- For org admins, scope the list to users within their own organisation.
- Dedupe by user, since a single user may have multiple sessions (different devices/browsers).
Describe alternatives you've considered
- Registering
django.contrib.sessions.models.Session directly in Django admin — simpler, but shows raw session rows rather than a de-duped, permission-scoped list of users, and isn't tailored to the SORT admin console.
Additional context
"Logged in" here means "has a non-expired session," not "actively browsing right now." If we want true activity/last-seen tracking, that would need a last_seen field updated via middleware — out of scope for this issue but worth flagging as a possible follow-up.
This approach would break if session storage is ever switched from database-backed to cache-based sessions — worth noting for whoever implements it.
Is your feature request related to a problem? Please describe.
Administrators have no way to see which users are currently logged in to SORT. This would help with support, auditing, and understanding usage.
Describe the solution you'd like
Add a section to the administrator console showing currently active/logged-in users.
Sessions are stored in the database (
django.contrib.sessions, default DB-backed engine), so this can be built without new infrastructure:Session.objects.filter(expire_date__gte=timezone.now()), decode each session, and collect the_auth_user_idvalues to look up activeUsers.session_service, following the existingorganisation_service/project_servicepattern), exposed via an ADMIN-only view.Describe alternatives you've considered
django.contrib.sessions.models.Sessiondirectly in Django admin — simpler, but shows raw session rows rather than a de-duped, permission-scoped list of users, and isn't tailored to the SORT admin console.Additional context
"Logged in" here means "has a non-expired session," not "actively browsing right now." If we want true activity/last-seen tracking, that would need a
last_seenfield updated via middleware — out of scope for this issue but worth flagging as a possible follow-up.This approach would break if session storage is ever switched from database-backed to cache-based sessions — worth noting for whoever implements it.