Struct Principal 

pub struct Principal {
    pub user_id: String,
    pub org_id: String,
    pub role: Role,
    pub display_name: Option<String>,
    pub groups: Vec<String>,
}

The authenticated identity a request runs as. Everything the admin API reads is scoped to org_id; role gates which operations are allowed and whether reads are org-wide or self-only.

Fields

user_id: String

Stable user id (the JWT sub).

org_id: String

The organization this principal belongs to (the JWT org / org_id). Every admin read is filtered to this org.

role: Role

The principal’s role in the org.

display_name: Option<String>

Optional human-readable name (the JWT name).

groups: Vec<String>

The groups the principal belongs to (the JWT groups claim). These are the entitlements the document-level ACL layer matches against: a document scoped to group github:owner/repo is readable only by a principal carrying that group. Empty when the token has no groups claim (the principal then sees only org-public + user-scoped docs).

Implementations

impl Principal

pub fn new( user_id: impl Into<String>, org_id: impl Into<String>, role: Role, display_name: Option<String>, ) -> Self

Construct a principal (mostly for tests + the no-auth path).

pub fn with_groups<I, S>(self, groups: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Attach group memberships to this principal (builder). The groups flow into access_context so the document-level ACL layer can match a group-scoped document.

pub fn has_role(&self, min: Role) -> bool

Whether this principal may act at min or above.

pub fn access_context(&self) -> AccessContext

Map this principal to the document-level AccessContext used by the knowledge-retrieval ACL layer. Both the user id and the principal’s groups carry through, so a retrieval as this principal can match a document scoped to the user or to any group the principal belongs to (the JWT groups claim — see [Claims]).

Trait Implementations

impl Clone for Principal

fn clone(&self) -> Principal

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Principal

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Principal

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Principal

impl PartialEq for Principal

fn eq(&self, other: &Principal) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Principal

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Principal