Struct Identity 

pub struct Identity {
    pub user_id: i64,
    pub email: String,
    pub role: Role,
    pub is_active: bool,
    pub is_demo: bool,
    pub demo_label: Option<String>,
    pub must_change_password: bool,
    pub mfa_enabled: bool,
    pub trust_level: SessionTrust,
}

The identity attached to a request by the auth middleware. Kept cheap to clone because we pass it into handler bodies.

Fields

user_id: i64

email: String

role: Role

is_active: bool

is_demo: bool

Whether this user was seeded by a demo-fixture flow. Drives the red banner in the admin UI; remains FALSE for users created via the normal create_user path.

demo_label: Option<String>

must_change_password: bool

Mirrors the rustio_users.must_change_password column added in R1’s recovery migration. When TRUE, R2’s login_guard (commit #13) redirects every authenticated request to /admin/must-change-password until the user completes the forced rotation, except for a small whitelist (/admin/must-change-password, /admin/logout, /admin/account/sessions). R1 emissions don’t read this field; this commit only loads it from the SQL paths so commits #9 / #13 can act on it.

mfa_enabled: bool

Mirrors the rustio_users.mfa_enabled column added in R3’s MFA migration (commit #1). When TRUE, the login flow (commit #16) redirects to /admin/mfa/verify after successful password verification, and R3’s login_guard extension (commit #18) restricts non-MFA-verified sessions to a small whitelist (/admin/mfa/verify, /admin/logout, /admin/account/sessions). Pre-R3 sessions and users who have not enrolled get FALSE and bypass the challenge entirely — pre-R3 framework behaviour.

trust_level: SessionTrust

The active session’s trust level (authenticated / elevated / mfa_verified). R3’s login_guard (commit #18) reads this together with mfa_enabled to gate the pending-MFA state: an MFA-enrolled user whose current session has trust_level != mfa_verified (i.e. just signed in, hasn’t yet completed /admin/mfa/verify) is restricted to a tiny whitelist until they finish the second-factor challenge. Pre-R3 sessions default to SessionTrust::Authenticated from the schema’s column default — no migration data change.

Implementations

impl Identity

pub fn is_admin(&self) -> bool

Administrator-or-higher (Administrator, Developer).

pub fn can_access_admin(&self) -> bool

Anyone allowed into the admin panel (Staff and above).

Trait Implementations

impl Clone for Identity

fn clone(&self) -> Identity

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Identity

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.