systemprompt-users 0.75.0

User management for systemprompt.io AI governance infrastructure. 6-tier RBAC, sessions, IP bans, and role-scoped access control for the MCP governance pipeline.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

//! # systemprompt-users
//!
//! User management for the systemprompt.io AI governance platform. The crate
//! provides:
//!
//! - **6-tier RBAC** — typed `UserRole` and policy-aware promotion/demotion
//!   helpers in [`UserAdminService`].
//! - **Sessions** — lifecycle management for browser, API, and anonymous
//!   sessions including bulk-end and recent-activity queries.
//! - **API keys** — issuance, hashing, and verification via [`ApiKeyService`].
//! - **Device certificates** — enrollment and rotation via
//!   [`DeviceCertService`].
//! - **IP bans** — typed [`BannedIpRepository`] with metadata-aware queries.
//! - **Rate-limit buckets** — [`UserRateLimitBucketRepository`], the
//!   replica-shared counters behind the global per-user HTTP throttle.
//! - **Cleanup job** — purges anonymous users past the retention window.
//!
//! ## Feature flags
//!
//! | Feature | Default | Effect |
//! |---------|---------|--------|
//! | _none_  | n/a     | The crate exposes a single feature surface; all modules are compiled unconditionally. The `[package.metadata.docs.rs] all-features = true` setting is retained so future feature additions automatically appear in published docs. |
//!
//! ## Layering
//!
//! `systemprompt-users` is a **domain** crate. It depends downward on
//! `systemprompt-database`, `systemprompt-extension`, `systemprompt-models`,
//! `systemprompt-traits`, `systemprompt-provider-contracts`, and
//! `systemprompt-identifiers`.
//!
//! Copyright (c) systemprompt.io — Business Source License 1.1.
//! See <https://systemprompt.io> for licensing details.

pub mod error;
pub(crate) mod extension;
pub mod jobs;
pub(crate) mod models;
pub(crate) mod repository;
pub(crate) mod services;

pub use extension::UsersExtension;

pub use error::{Result, UserError, UserResult};
pub use models::{
    AccountKind, ApiKeyKind, ApiKeyLimits, NewApiKey, User, UserActivity, UserApiKey,
    UserCountBreakdown, UserDeviceCert, UserExport, UserRole, UserSession, UserStats, UserStatus,
    UserWithSessions, normalise_email,
};
pub use repository::{
    ArchiveOutcome, ArchiveParams, ArchiveState, BanDuration, BanIpParams, BanIpWithMetadataParams,
    BannedIp, BannedIpRepository, CreateApiKeyParams, DeclaredUserRow, DeclaredUserWrite,
    EnrollDeviceCertParams, EnsuredServiceAccount, MERGE_EXCLUDED_SECURITY_TABLES, MergeResult,
    NewServiceAccount, NewSsoLoginEvent, PurgeCount, SessionRepository,
    SessionTrafficRollupRepository, SsoLoginEvent, SsoLoginEventRepository,
    UserRateLimitBucketRepository, UserRepository, UsersRoleDirectory,
};
pub use services::{
    API_KEY_PREFIX, ApiKeyLifetime, ApiKeyService, DEVICE_FINGERPRINT_FOREIGN_USER, DemoteResult,
    DeviceCertService, EnrollDeviceCertServiceParams, EnsuredApiKey, IssueApiKeyParams,
    OUTCOME_REFUSED, OUTCOME_SUCCESS, PostgresAuthEventSink, PromoteResult, UpdateUserParams,
    UserAdminService, UserService,
};

pub use systemprompt_traits::auth::{RoleProvider, UserProvider};

pub(crate) mod sessions;
pub use sessions::UsersAiSessionProvider;