Struct Principal 

pub struct Principal {
    pub user: User,
    pub kind: PrincipalKind,
    pub orgs: Vec<(OrgId, Role)>,
    pub platform_admin: bool,
    pub downscoped: Option<OrgId>,
}

An authenticated caller: who, how, and what they may reach. For an org-scoped token, orgs is that one org and platform_admin is false whatever the user is.

Fields

user: User

kind: PrincipalKind

orgs: Vec<(OrgId, Role)>

platform_admin: bool

downscoped: Option<OrgId>

Set on an org-bound endpoint for a superadmin or platform admin: an admin of this org only.

Implementations

impl Principal

pub fn scopes(&self) -> &[String]

The token’s scopes; empty for sessions and unscoped tokens.

pub fn restricted(&self) -> bool

A token scoped short of admin: it may not change who has access.

pub fn downscoped_to(&self, org: &OrgId) -> Principal

This principal as an org-bound endpoint sees it. A superadmin or a platform admin becomes an admin of org only (an owner stays one): not a platform admin, no other org. Everyone else is unchanged.

pub fn workspace(org: &OrgId, name: &str, role: Role) -> Principal

The principal an org’s workspace token authenticates: no account (user id 0, named workspace), confined to org with role.

pub fn is_workspace(&self) -> bool

An org’s workspace, rather than a person or a user’s token.

pub fn agent(label: &str, orgs: Vec<(OrgId, Role)>) -> Principal

The principal of a tailnet or Access agent: no account (user id 0, named after its source), confined to orgs, never a platform admin. label is tailnet:<login or node> or access:<name>.

pub fn is_agent(&self) -> bool

A tailnet or Access agent identity mapped by an org.

impl Principal

pub fn is_platform_admin(&self) -> bool

pub fn role_in(&self, org: &OrgId) -> Option<Role>

pub fn can_admin_org(&self, org: &OrgId) -> bool

Apps, stacks, sandboxes and secrets in org.

pub fn can_read_org(&self, org: &OrgId) -> bool

Read-only tools in org.

pub fn can_manage_members(&self, org: &OrgId) -> bool

Members, invitations and every token in org.

pub fn can_delete_org(&self, org: &OrgId) -> bool

pub fn max_grant(&self, org: &OrgId) -> Option<Role>

The highest role this principal may hand out in org.

pub fn session_id(&self) -> Option<i64>

Trait Implementations

impl Clone for Principal

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Principal

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Principal

impl PartialEq for Principal

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Principal