Struct UserContext 

pub struct UserContext {
    pub subject: String,
    pub principal: PrincipalKind,
    pub email: Option<String>,
    pub username: Option<String>,
    pub roles: Vec<String>,
    pub scopes: Vec<String>,
    pub capabilities: Vec<String>,
    pub api_key_id: Option<String>,
    pub acr: Option<String>,
}

The authenticated caller, resolved once at the edge (gateway) and propagated to every service via signed headers. This is the single identity type shared across all services.

Fields

subject: String

Canonical, opaque principal id. For User this is the user’s UUID (as a string); for ApiKey/Service it is the principal’s stable id. Use UserContext::user_id when a typed UUID is required.

principal: PrincipalKind

email: Option<String>

username: Option<String>

roles: Vec<String>

scopes: Vec<String>

capabilities: Vec<String>

Effective account capabilities (entitlements) resolved by the identity service.

api_key_id: Option<String>

Present only for ApiKey principals.

acr: Option<String>

Authentication assurance level (acr) of the current session, propagated from the gateway (x-auth-acr) when a step-up has been satisfied. Consumed by the authorization PDP to enforce per-permission min_acr. None = base assurance.

Implementations

impl UserContext

pub fn user_id(&self) -> Result<Uuid, AppError>

Parse the subject as a user UUID. Errors for non-UUID principals (e.g. API keys).

pub fn user_id_opt(&self) -> Option<Uuid>

Parse the subject as a user UUID, or None for non-UUID principals.

pub fn is_user(&self) -> bool

pub fn is_api_key(&self) -> bool

pub fn is_service(&self) -> bool

pub fn has_role(&self, role: &str) -> bool

pub fn has_any_role(&self, roles: &[&str]) -> bool

pub fn require_role(&self, role: &str) -> Result<(), AppError>

pub fn require_any_role(&self, roles: &[&str]) -> Result<(), AppError>

pub fn is_admin(&self) -> bool

Platform-admin check: holds ADMIN or any *_ADMIN role (case-insensitive).

pub fn require_admin(&self) -> Result<(), AppError>

pub fn has_scope(&self, scope: &str) -> bool

pub fn require_scope(&self, scope: &str) -> Result<(), AppError>

pub fn has_capability(&self, capability: &str) -> bool

pub fn require_capability(&self, capability: &str) -> Result<(), AppError>

Trait Implementations

impl Clone for UserContext

fn clone(&self) -> UserContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for UserContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for UserContext

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for UserContext

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.