fraiseql_core::security::security_context

Struct SecurityContext

pub struct SecurityContext {Show 13 fields
    pub user_id: UserId,
    pub roles: Vec<String>,
    pub tenant_id: Option<TenantId>,
    pub scopes: Vec<String>,
    pub attributes: HashMap<String, Value>,
    pub request_id: String,
    pub ip_address: Option<String>,
    pub authenticated_at: DateTime<Utc>,
    pub expires_at: DateTime<Utc>,
    pub issuer: Option<String>,
    pub audience: Option<String>,
    pub email: Option<String>,
    pub display_name: Option<String>,
}

Expand description

Security context for authorization evaluation.

Carries information about the authenticated user and their permissions throughout the request lifecycle.

§Fields

user_id: Unique identifier for the authenticated user (from JWT ‘sub’ claim)
roles: User’s roles (e.g., ["admin", "moderator"], from JWT ‘roles’ claim)
tenant_id: Organization/tenant identifier for multi-tenant systems
scopes: OAuth/permission scopes (e.g., ["read:user", "write:post"])
attributes: Custom claims from JWT (e.g., department, region, tier)
request_id: Correlation ID for audit logging and tracing
ip_address: Client IP address for geolocation and fraud detection
authenticated_at: When the JWT was issued
expires_at: When the JWT expires
issuer: Token issuer for multi-issuer systems
audience: Token audience for validation

Fields§

§user_id: UserId

User ID (from JWT ‘sub’ claim)

§roles: Vec<String>

User’s roles (e.g., ["admin", "moderator"])

Extracted from JWT ‘roles’ claim or derived from other claims. Used for role-based access control (RBAC) decisions.

§tenant_id: Option<TenantId>

Tenant/organization ID (for multi-tenancy)

When present, RLS policies can enforce tenant isolation. Extracted from JWT ‘tenant_id’ or X-Tenant-Id header.

§scopes: Vec<String>

OAuth/permission scopes

Format: {action}:{resource} or {action}:{type}.{field} Examples:

read:user
write:post
read:User.email
admin:*

Extracted from JWT ‘scope’ claim.

§attributes: HashMap<String, Value>

Custom attributes from JWT claims

Arbitrary key-value pairs from JWT payload. Examples: “department”, “region”, “tier”, “country”

Used by custom RLS policies that need domain-specific attributes.

§request_id: String

Request correlation ID for audit trails

Extracted from X-Request-Id header or generated. Used for tracing and audit logging across services.

§ip_address: Option<String>

Client IP address

Extracted from X-Forwarded-For or connection socket. Used for geolocation and fraud detection in RLS policies.

§authenticated_at: DateTime<Utc>

When the JWT was issued

§expires_at: DateTime<Utc>

When the JWT expires

§issuer: Option<String>

Token issuer (for multi-issuer systems)

§audience: Option<String>

Token audience (for audience validation)

§email: Option<String>

Normalised email address from the JWT email claim.

Available as jwt:email in session variable mappings for RLS policies.

§display_name: Option<String>

Normalised display name from the JWT name claim.

Available as jwt:name or jwt:display_name in session variable mappings.

Implementations§

Source §

impl SecurityContext

Source

pub fn from_user(user: &AuthenticatedUser, request_id: String) -> Self

Create a security context from an authenticated user and request metadata.

§Arguments

user - Authenticated user from JWT validation
request_id - Correlation ID for this request

§Example

// Requires: a live AuthenticatedUser from JWT validation.
// See: tests/integration/ for runnable examples.
let context = SecurityContext::from_user(&authenticated_user, "req-123".to_string());

Source

pub fn has_role(&self, role: &str) -> bool

Check if the user has a specific role.

§Arguments

role - Role name to check (e.g., “admin”, “moderator”)

§Returns

true if the user has the specified role, false otherwise.

Source

pub fn has_scope(&self, scope: &str) -> bool

Check if the user has a specific scope.

Supports wildcards: admin:* matches any admin scope.

§Arguments

scope - Scope to check (e.g., “read:user”, “write:post”)

§Returns

true if the user has the specified scope, false otherwise.

Source

pub fn get_attribute(&self, key: &str) -> Option<&Value>

Get a custom attribute from the JWT claims.

§Arguments

key - Attribute name

§Returns

The attribute value if present, None otherwise.

Source

pub fn is_expired(&self) -> bool

Check if the token has expired.

§Returns

true if the JWT has expired, false otherwise.

Source

pub fn ttl_secs(&self) -> i64

Get time until expiry in seconds.

§Returns

Seconds until JWT expiry, negative if already expired.

Source

pub fn is_admin(&self) -> bool

Check if the user is an admin.

§Returns

true if the user has the “admin” role, false otherwise.

Source

pub const fn is_multi_tenant(&self) -> bool

Check if the context has a tenant ID (multi-tenancy enabled).

§Returns

true if tenant_id is present, false otherwise.

Source

pub fn with_role(self, role: String) -> Self

Set or override a role (for testing or runtime role modification).

Source

pub fn with_scopes(self, scopes: Vec<String>) -> Self

Set or override scopes (for testing or runtime permission modification).

Source

pub fn with_tenant(self, tenant_id: impl Into<TenantId>) -> Self

Set tenant ID (for multi-tenancy).

Source

pub fn with_attribute(self, key: String, value: Value) -> Self

Set a custom attribute (for testing or runtime attribute addition).

Source

pub fn can_access_scope( &self, security_config: &SecurityConfig, required_scope: &str, ) -> bool

Check if user can access a field based on role definitions.

Takes a required scope and checks if any of the user’s roles grant that scope.

§Arguments

security_config - Security config from compiled schema with role definitions
required_scope - Scope required to access the field (e.g., “read:User.email”)

§Returns

true if user’s roles grant the required scope, false otherwise.

§Example

// Requires: a SecurityConfig from a compiled schema.
// See: tests/integration/ for runnable examples.
let can_access = context.can_access_scope(&config, "read:User.email");