Hi Keith,

I'd separate the licensing logic from the authentication logic.

Rather than trying to determine whether a user is "active", I'd track authenticated sessions in a database table (for example: "user_id", "session_token", "last_activity", "expires_at"). A successful login creates a session, logout removes it, and expired sessions are cleaned up automatically.

If your goal is to prevent account sharing, allow only one active session per user account.

If your goal is a true per-seat licence, simply count active sessions against the purchased seat limit before allowing another login.

I wouldn't rely on frequent heartbeat/ping requests, as they add complexity and can keep abandoned sessions alive. Updating "last_activity" on normal requests, combined with a sensible inactivity timeout, is usually sufficient.

This approach also makes it straightforward to provide an admin page showing active sessions and allowing them to be terminated if required.

Cheers,
Si

P.S. In Trongate V2, an interceptor method could be a simple place to validate the user's licence session and update the last activity timestamp during normal requests, with a sensible interval (for example, only updating once every 60 seconds) to avoid unnecessary database writes.