Type Alias Principal 

pub type Principal = Principal;

Who the session belongs to.

The SSH username is deliberately not in here: it is decorative and must never reach an authorisation decision (the ACL model).

Aliased Type

pub struct Principal {
    pub id: String,
    pub name: String,
    pub kind: PrincipalKind,
    pub created: i64,
}

Fields

id: String

Stable identifier, used as the key everywhere else. Same character rules as a namespace, so it can never be mistaken for a path.

It is also the account: the namespace this principal intrinsically owns (AuthTable::owns_account), the key a gate is filed under, and what a policy file’s allowed_principals names. Chosen once, at creation, and never moved. Everything that may change about a principal changes in name.

name: String

Display name, for humans and for UIs.

Not the identity. It defaults to the id and it may be changed (AuthTable::rename_principal) without touching a key, a grant, a membership, a gate or the namespace. It is unique on the table by construction — see the names index in AuthTable — and may not equal another principal’s id either, so a listing never shows two rows a human reads as one.

kind: PrincipalKind

What kind of identity this is.

created: i64

When the row was created, by the table’s clock, in unix milliseconds.

Stamped by AuthTable::add_principal — one writer — and 0 for a row from before the field existed, which is what the wire reported for every principal until then. A caller that pins a principal by (id, created) can tell a delete-and-recreate under the same id from the row it first saw; the id alone cannot say, because an account slug is claimable again once its account is purged.