Struct Account 

pub struct Account<R, G>
where
    R: AccessHierarchy + Eq,
    G: Eq + Clone,
{
    pub account_id: Uuid,
    pub user_id: String,
    pub roles: Vec<R>,
    pub groups: Vec<G>,
    pub permissions: Permissions,
}

An account contains authorization information about a user.

Accounts store user identification, roles, groups, and permissions. They are the core entity for authorization decisions in axum-gate.

Creating Accounts

use axum_gate::accounts::Account;
use axum_gate::prelude::{Role, Group};
use axum_gate::permissions::Permissions;

// Create a basic account
let account = Account::new("user123", &[Role::User], &[Group::new("staff")]);

// Create account with permissions
let permissions: Permissions = ["read:profile", "write:profile"].into_iter().collect();
let account = Account::<Role, Group>::new("admin@example.com", &[Role::Admin], &[])
    .with_permissions(permissions);

Working with Permissions

// Grant permissions
account.grant_permission("read:api");
account.grant_permission(PermissionId::from("write:api"));

// Check permissions directly
if account.permissions.has("read:api") {
    println!("User can read API");
}

// Revoke permissions
account.revoke_permission("write:api");

Fields

account_id: Uuid

The unique identifier of the account generated during registration.

This UUID links the account to its corresponding authentication secret in the secret repository. The separation of account data from secrets enhances security by allowing different storage backends and access controls.

user_id: String

The user identifier for this account (e.g., email, username).

This should be unique within your application and is typically what users provide during login. It’s used to look up accounts in the repository.

roles: Vec<R>

Roles assigned to this account.

Roles determine what actions a user can perform. If your roles implement AccessHierarchy, supervisor roles automatically inherit subordinate permissions.

groups: Vec<G>

Groups this account belongs to.

Groups provide another dimension of access control, allowing you to grant permissions based on team membership, department, or other organizational units.

permissions: Permissions

Custom permissions granted to this account.

Uses a compressed bitmap for efficient storage and fast permission checks. Permissions are automatically available when referenced by name using deterministic hashing - no coordination between nodes required.

Implementations

impl<R, G> Account<R, G>

where R: AccessHierarchy + Eq + Clone, G: Eq + Clone,

pub fn new(user_id: &str, roles: &[R], groups: &[G]) -> Self

Creates a new account with the specified user ID, roles, and groups.

A random UUID is automatically generated for the account ID. The account starts with no permissions - use with_permissions() or grant_permission() to add them.

Arguments

• user_id - Unique identifier for the user (e.g., email or username)
• roles - Roles to assign to this account
• groups - Groups this account should belong to

Example

use axum_gate::accounts::Account;
use axum_gate::prelude::{Role, Group};

let account = Account::new(
    "user@example.com",
    &[Role::User, Role::Reporter],
    &[Group::new("engineering"), Group::new("backend-team")]
);

pub fn with_permissions(self, permissions: Permissions) -> Self

Consumes this account and returns it with the specified permissions.

This is useful when building accounts with specific permission sets.

Example

use axum_gate::accounts::Account;
use axum_gate::prelude::{Role, Group};
use axum_gate::permissions::Permissions;

// Create permissions
let permissions: Permissions = ["read:profile", "write:profile"].into_iter().collect();
let account = Account::<Role, Group>::new("user@example.com", &[Role::User], &[])
    .with_permissions(permissions);

pub fn grant_permission<P>(&mut self, permission: P)

where P: Into<PermissionId>,

Grants a permission to this account.

Example

use axum_gate::accounts::Account;
use axum_gate::prelude::{Role, Group};
use axum_gate::permissions::PermissionId;

let mut account = Account::<Role, Group>::new("user", &[], &[]);
account.grant_permission("read:profile");
account.grant_permission(PermissionId::from("write:profile"));

pub fn revoke_permission<P>(&mut self, permission: P)

where P: Into<PermissionId>,

Revokes a permission from this account.

Example

use axum_gate::accounts::Account;
use axum_gate::prelude::{Role, Group};
use axum_gate::permissions::PermissionId;

let mut account = Account::<Role, Group>::new("user", &[], &[]);
account.grant_permission("write:profile");
account.revoke_permission(PermissionId::from("write:profile"));

pub fn has_role(&self, role: &R) -> bool

Returns true if this account has the given role.

Example

use axum_gate::accounts::Account;
use axum_gate::prelude::{Role, Group};

let account = Account::<Role, Group>::new(
    "user@example.com",
    &[Role::User],
    &[Group::new("engineering")]
);

assert!(account.has_role(&Role::User));
assert!(!account.has_role(&Role::Admin));

pub fn is_member_of(&self, group: &G) -> bool

Returns true if this account is a member of the given group.

Example

use axum_gate::accounts::Account;
use axum_gate::prelude::{Role, Group};

let account = Account::<Role, Group>::new(
    "user@example.com",
    &[Role::User],
    &[Group::new("engineering")]
);

assert!(account.is_member_of(&Group::new("engineering")));
assert!(!account.is_member_of(&Group::new("marketing")));

pub fn has_permission<P>(&self, permission: P) -> bool

where P: Into<PermissionId>,

Returns true if this account has the specified permission.

Accepts any type that converts into PermissionId (e.g., &str, PermissionId).

Example

use axum_gate::accounts::Account;
use axum_gate::prelude::{Role, Group};
use axum_gate::permissions::PermissionId;

let mut account = Account::<Role, Group>::new("user@example.com", &[], &[]);
account.grant_permission("read:api");
account.grant_permission(PermissionId::from("write:docs"));

assert!(account.has_permission("read:api"));
assert!(account.has_permission(PermissionId::from("write:docs")));
assert!(!account.has_permission("admin:system"));

Trait Implementations

impl<R, G> Clone for Account<R, G>

where R: AccessHierarchy + Eq + Clone, G: Eq + Clone + Clone,

fn clone(&self) -> Account<R, G>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<R, G> Debug for Account<R, G>

where R: AccessHierarchy + Eq + Debug, G: Eq + Clone + Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de, R, G> Deserialize<'de> for Account<R, G>

where R: AccessHierarchy + Eq + Deserialize<'de>, G: Eq + Clone + Deserialize<'de>,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<R, G> From<Account<R, G>> for ActiveModel

where R: AccessHierarchy + Eq, Vec<R>: CommaSeparatedValue, G: Eq + Clone, Vec<G>: CommaSeparatedValue,

fn from(value: Account<R, G>) -> Self

Converts to this type from the input type.

impl<R, G> Serialize for Account<R, G>

where R: AccessHierarchy + Eq + Serialize, G: Eq + Clone + Serialize,

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl<R, G> TryFrom<Model> for Account<R, G>

where R: AccessHierarchy + Eq + Display + Clone, Vec<R>: CommaSeparatedValue, G: Eq + Clone, Vec<G>: CommaSeparatedValue,

Available on crate feature storage-seaorm only.

type Error = String

The type returned in the event of a conversion error.

fn try_from(value: Model) -> Result<Self, Self::Error>

Performs the conversion.