Roles, permissions and sign-in security
Five roles resolved in code, not menus — and the one thing no role grants: issuing a prescription or signing an encounter needs a linked provider profile, checked before the owner bypass; every page and every back-channel call runs the same permission check and logs a refusal; five wrong passwords lock an account for five minutes and fifteen failures from one address in ten minutes block that address for fifteen; a disabled member is refused on their next request. Two-factor sign-in is not available yet.
2705
The one thing an owner cannot do
Owner is the highest role and bypasses every permission check — except one. Signing an encounter and issuing a prescription are granted by a linked provider profile, not a role, and that test is written above the owner bypass. An owner who is also the physician links their profile and signs; an owner who runs the business and does not see patients never can. Raising a requisition works the same way.
Hiding a link is presentation; the check is the security
A front-desk session can type the address of the activity log. The page asks whether they may read it before anything is drawn, writes "Denied" to your log first, and sends them back to their own start page. Every server call behind a page carries the same check and writes the same line.
Two locks on the front door
Five failed sign-ins on one account lock it for five minutes. Fifteen failures from one public address inside ten minutes block that address for fifteen minutes, whoever it was aiming at. Each failure is a row (auth.login_failed, auth.login_lockout). Three different mistakes — unknown address, wrong password, patient account on the clinic form — get one answer, word for word: "Invalid login attempt." A locked account is told it is locked. An unexpected error shows one sentence and an eight-character reference you can quote to support.
Taking access away
Membership is checked on every request: a disabled member fails every permission check, is logged and signed out on their next click. The identity cookie re-validates on a thirty-minute interval, so the underlying sign-in can survive that long — every page it reaches has already refused it.
What is not claimed
Two-factor sign-in is not available — the plumbing exists, the page was never built, and it is the largest single gap on the security page. No certification is held: SOC 2 is in preparation and nobody has audited Qlynic against anything yet. Records sit on Microsoft Azure in Canada Central with the encryption that platform applies at rest and in transit; Qlynic adds no encryption of its own. Every number above is a constant in a file, not a target.
Where to look