pub struct IdentityUser {
pub id: String,
pub name: String,
pub email: String,
pub tenant_id: String,
pub roles: Vec<String>,
pub permissions: Vec<String>,
}Expand description
The standard identity a request can carry.
IdentityUser is a read-only projection of IClaims for request
handling — not a persistence entity. When an endpoint needs the raw claim
map, read it through IClaimsExt in middleware or
infrastructure code; IdentityUser covers the identity fields almost every
handler needs.
Put it in a request with #[fromclaim] and the binder fills it from the
authenticated principal:
#[derive(WebxRequestMeta)]
pub struct CreateOrderRequest {
#[fromclaim]
pub user: IdentityUser,
pub sku: String,
}The handler then reads req.user.id, req.user.tenant_id or
req.user.is_in_role("admin") without touching the token or the context.
Option<IdentityUser> makes the endpoint work for anonymous callers too.
Fields§
§id: StringThe subject (sub) — the stable user identifier.
name: StringDisplay name (name claim), empty when the token has none.
email: StringEmail address (email claim), empty when the token has none.
tenant_id: StringTenant identifier (tenant_id / tenant), empty for single-tenant apps.
roles: Vec<String>Roles assigned to the user.
permissions: Vec<String>Fine-grained permissions assigned to the user.
Implementations§
Source§impl IdentityUser
impl IdentityUser
Sourcepub fn from_claims(claims: &dyn IClaims) -> Self
pub fn from_claims(claims: &dyn IClaims) -> Self
Build the identity from an authenticated principal.
Sourcepub fn is_in_role(&self, role: &str) -> bool
pub fn is_in_role(&self, role: &str) -> bool
Whether the user has role.
Sourcepub fn has_permission(&self, permission: &str) -> bool
pub fn has_permission(&self, permission: &str) -> bool
Whether the user has permission.
Sourcepub fn display_name(&self) -> &str
pub fn display_name(&self) -> &str
The display name, falling back to the identifier.