Partner portal

Travel Partner

Travel and logistics partners: flight bookings, patient accommodation, medical transport, visas and itineraries, booking confirmations, and settlements.

Implementation status: requirements documented — authenticated workflows not built (blocked on backend).

Intended users

  • Travel and logistics partner staff (travel coordinators and partner admins) managing patient travel, accommodation, and medical transport.

Authentication & access

  • Invitation-based entry (LOG-00). The invite is valid for 7 days according to the existing invite contract.

  • Mandatory MFA for every LOG role, including Travel Coordinator and Partner Admin, before protected portal routes.

  • Sign-in, password reset, lockout, and session timeout reuse the shared staff authentication flow with 30-minute session timeout.

Onboarding

  • Accept invitation, set password, enrol mandatory MFA, and complete first-login setup (language, display name, mobile, notification channels).

Navigation & screens (Figma)

  • LOG-00 sign-in, MFA challenge, password reset, account lockout, invitation acceptance, and first-login setup.

  • Preview cards and messaging reflect the Travel Partner Portal workspace.

Workflows

  • Valid invite → password setup → mandatory MFA enrollment → first-login preferences setup → sign-in with MFA on subsequent sessions.

Permissions boundary

  • Role and permissions shown on the invite are display copy aligned with LOG roles (Travel Coordinator, Partner Admin). The backend remains the source of truth.

  • Client navigation cannot skip mandatory MFA or mark an invitation accepted.

Backend capabilities needed (no API paths in repo)

  • Partner staff sign-in, MFA verification, password reset, and invitation validation.

  • Travel coordination, itinerary, and booking APIs are outside LOG-00.

UI states to implement

  • Wrong credentials

  • Wrong MFA code

  • Account locked (5 failed attempts, 30-min duration)

  • Session timeout (30 minutes)

  • Reset link expired / invalid / used

  • Invite expired (7 days), already accepted, or revoked

Acceptance criteria

  • Travel Partner Portal sign-in and invite screens use travel partner branding, value propositions, and preview copy.

  • English and Arabic, including RTL, follow the shared locale cookie.

  • Mandatory MFA and 30-minute session timeout work for all LOG roles.

Figma references

← All categories