Struct User 

pub struct User {
    pub id: i64,
    pub email: EmailAddress,
    pub password_hash: String,
    pub roles: Vec<String>,
    pub permissions: Vec<String>,
    pub email_verified: bool,
    pub created_at: DateTime<Utc>,
    pub updated_at: DateTime<Utc>,
}

User model representing an authenticated user

This model is designed to be stored in a database and includes all necessary fields for authentication, authorization, and session management.

Security Considerations

• Password hash is stored, never the plaintext password
• Email addresses are normalized to lowercase
• Created/updated timestamps for audit trail
• Roles and permissions for authorization (Cedar policy integration)

Database Schema

CREATE TABLE users (
    id BIGSERIAL PRIMARY KEY,
    email TEXT NOT NULL UNIQUE,
    password_hash TEXT NOT NULL,
    roles TEXT[] NOT NULL DEFAULT '{"user"}',
    permissions TEXT[] NOT NULL DEFAULT '{}',
    email_verified BOOLEAN NOT NULL DEFAULT FALSE,
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE INDEX idx_users_email ON users(email);
CREATE INDEX idx_users_roles ON users USING GIN(roles);

Fields

id: i64

User ID (primary key)

email: EmailAddress

Email address (unique, normalized to lowercase)

password_hash: String

Argon2id password hash (never exposed in responses)

roles: Vec<String>

User roles for authorization Common roles: “user”, “admin”, “moderator” Used by Cedar policy engine for role-based access control (RBAC)

permissions: Vec<String>

User permissions for fine-grained authorization Format: “resource:action” (e.g., “posts:create”, “posts:delete”) Used by Cedar policy engine for attribute-based access control (ABAC)

email_verified: bool

Email verification status Required for certain actions (e.g., posting content)

created_at: DateTime<Utc>

Timestamp when user was created

updated_at: DateTime<Utc>

Timestamp when user was last updated

Implementations

impl User

pub fn verify_password(&self, password: &str) -> Result<bool, PasswordError>

Verify a password against this user’s hash

Uses constant-time comparison to prevent timing attacks.

Errors

Returns error if verification fails

Example

if user.verify_password("user-password")? {
    println!("Password correct!");
}

pub async fn create(data: CreateUser, pool: &PgPool) -> Result<Self, UserError>

Create a new user with hashed password

Errors

Returns error if:

• Password hashing fails
• Database operation fails
• Email already exists (unique constraint)

Example

use acton_htmx::auth::user::{User, CreateUser, EmailAddress};
use sqlx::PgPool;

let email = EmailAddress::parse("new@example.com")?;
let create = CreateUser {
    email,
    password: "secure-password".to_string(),
};

let user = User::create(create, pool).await?;
println!("Created user with ID: {}", user.id);

pub async fn find_by_email( email: &EmailAddress, pool: &PgPool, ) -> Result<Self, UserError>

Find a user by email

Errors

Returns error if database operation fails or user not found

Example

use acton_htmx::auth::user::{User, EmailAddress};
use sqlx::PgPool;

let email = EmailAddress::parse("user@example.com")?;
let user = User::find_by_email(&email, pool).await?;
println!("Found user: {}", user.email);

pub async fn find_by_id(id: i64, pool: &PgPool) -> Result<Self, UserError>

Find a user by ID

Errors

Returns error if database operation fails or user not found

pub async fn authenticate( email: &EmailAddress, password: &str, pool: &PgPool, ) -> Result<Self, UserError>

Authenticate a user with email and password

Errors

Returns UserError::InvalidCredentials if:

• Email not found
• Password incorrect

Returns other errors for database or verification failures

Example

use acton_htmx::auth::user::{User, EmailAddress};
use sqlx::PgPool;

let email = EmailAddress::parse("user@example.com")?;
match User::authenticate(&email, "password", pool).await {
    Ok(user) => println!("Authenticated: {}", user.email),
    Err(_) => println!("Invalid credentials"),
}

Trait Implementations

impl Clone for User

fn clone(&self) -> User

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for User

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for User

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<'a, R: Row> FromRow<'a, R> for User

where &'a str: ColumnIndex<R>, i64: Decode<'a, R::Database> + Type<R::Database>, EmailAddress: Decode<'a, R::Database> + Type<R::Database>, String: Decode<'a, R::Database> + Type<R::Database>, Vec<String>: Decode<'a, R::Database> + Type<R::Database>, bool: Decode<'a, R::Database> + Type<R::Database>, DateTime<Utc>: Decode<'a, R::Database> + Type<R::Database>,

fn from_row(__row: &'a R) -> Result<Self>

impl Serialize for User

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.