Struct RlsContext 

pub struct RlsContext {
    pub tenant_id: String,
    pub agent_id: String,
    /* private fields */
}

RLS context carrying tenant identity for data isolation.

Fields

tenant_id: String

The unified tenant ID — the primary identity for data isolation. Empty string means no tenant scope.

agent_id: String

Legacy: The agent (reseller) this context is scoped to. Empty string means no agent scope.

Implementations

impl RlsContext

pub fn tenant(tenant_id: &str) -> RlsContext

Create a context scoped to a specific tenant (the unified identity).

pub fn agent(agent_id: &str) -> RlsContext

Create a context scoped to a specific agent (reseller).

pub fn tenant_and_agent(tenant_id: &str, agent_id: &str) -> RlsContext

Create a context scoped to both tenant and agent.

pub fn global() -> RlsContext

Create a global context scoped to platform rows (tenant_id IS NULL).

This is not a bypass: it applies explicit global scoping in AST injection and exposes app.is_global=true for policy usage at the database layer.

pub fn super_admin(_token: SuperAdminToken) -> RlsContext

Create a super admin context that bypasses tenant isolation.

Requires a SuperAdminToken — which can only be created via named constructors (for_system_process, for_webhook, for_auth).

Uses nil UUID for all IDs to avoid ''::uuid cast errors in PostgreSQL RLS policies (PostgreSQL doesn’t short-circuit OR).

pub fn empty() -> RlsContext

Create an empty context (no tenant, no super admin).

Used for system-level operations that must not operate within any tenant scope (startup introspection, migrations, health checks).

pub fn user(user_id: &str) -> RlsContext

Create a user-scoped context for authenticated end-user operations.

Sets app.current_user_id so that DB policies can enforce row-level isolation by user (e.g. user_id = get_current_user_id()). Does NOT bypass tenant isolation or grant super-admin.

pub fn with_user(self, user_id: &str) -> RlsContext

Attach an authenticated user ID to an existing tenant/global context.

User scope is orthogonal to tenant/agent scope: PostgreSQL policies can use both app.current_tenant_id and app.current_user_id.

pub fn has_tenant(&self) -> bool

Returns true if this context has a tenant scope.

pub fn has_agent(&self) -> bool

Returns true if this context has an agent scope.

pub fn has_user(&self) -> bool

Returns true if this context has a user scope.

pub fn user_id(&self) -> &str

Returns the user ID for this context (empty if none).

pub fn bypasses_rls(&self) -> bool

Returns true if this context bypasses tenant isolation.

pub fn is_global(&self) -> bool

Returns true if this context is explicitly scoped to global rows.

Trait Implementations

impl Clone for RlsContext

fn clone(&self) -> RlsContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RlsContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Display for RlsContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Eq for RlsContext

impl PartialEq for RlsContext

fn eq(&self, other: &RlsContext) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for RlsContext