systemprompt_users/lib.rs
1//! # systemprompt-users
2//!
3//! User management for the systemprompt.io AI governance platform. The crate
4//! provides:
5//!
6//! - **6-tier RBAC** — typed `UserRole` and policy-aware promotion/demotion
7//! helpers in [`UserAdminService`].
8//! - **Sessions** — lifecycle management for browser, API, and anonymous
9//! sessions including bulk-end and recent-activity queries.
10//! - **API keys** — issuance, hashing, and verification via [`ApiKeyService`].
11//! - **Device certificates** — enrollment and rotation via
12//! [`DeviceCertService`].
13//! - **IP bans** — typed [`BannedIpRepository`] with metadata-aware queries.
14//! - **Rate-limit buckets** — [`UserRateLimitBucketRepository`], the
15//! replica-shared counters behind the global per-user HTTP throttle.
16//! - **Cleanup job** — purges anonymous users past the retention window.
17//!
18//! ## Feature flags
19//!
20//! | Feature | Default | Effect |
21//! |---------|---------|--------|
22//! | _none_ | n/a | The crate exposes a single feature surface; all modules are compiled unconditionally. The `[package.metadata.docs.rs] all-features = true` setting is retained so future feature additions automatically appear in published docs. |
23//!
24//! ## Layering
25//!
26//! `systemprompt-users` is a **domain** crate. It depends downward on
27//! `systemprompt-database`, `systemprompt-extension`, `systemprompt-models`,
28//! `systemprompt-traits`, `systemprompt-provider-contracts`, and
29//! `systemprompt-identifiers`.
30//!
31//! Copyright (c) systemprompt.io — Business Source License 1.1.
32//! See <https://systemprompt.io> for licensing details.
33
34#![expect(
35 missing_debug_implementations,
36 reason = "service types in this crate hold pools/clients that intentionally do not implement \
37 Debug"
38)]
39
40pub mod error;
41pub(crate) mod extension;
42pub mod jobs;
43pub(crate) mod models;
44pub(crate) mod repository;
45pub(crate) mod services;
46
47pub use extension::UsersExtension;
48
49pub use error::{Result, UserError, UserResult};
50pub use models::{
51 NewApiKey, User, UserActivity, UserApiKey, UserCountBreakdown, UserDeviceCert, UserExport,
52 UserRole, UserSession, UserStats, UserStatus, UserWithSessions, normalise_email,
53};
54pub use repository::{
55 BanDuration, BanIpParams, BanIpWithMetadataParams, BannedIp, BannedIpRepository,
56 CreateApiKeyParams, EnrollDeviceCertParams, MERGE_EXCLUDED_SECURITY_TABLES, MergeResult,
57 UserRateLimitBucketRepository, UserRepository,
58};
59pub use services::{
60 API_KEY_PREFIX, ApiKeyService, DemoteResult, DeviceCertService, EnrollDeviceCertServiceParams,
61 IssueApiKeyParams, PromoteResult, UpdateUserParams, UserAdminService, UserService,
62};
63
64pub use systemprompt_traits::auth::{RoleProvider, UserProvider};