Struct Account 

pub struct Account<R, G>
where
    R: AccessHierarchy + Eq,
    G: Eq + Clone,
{
    pub account_id: Uuid,
    pub user_id: String,
    pub roles: Vec<R>,
    pub groups: Vec<G>,
    pub permissions: Permissions,
}

Authorization-relevant information about a user or principal.

Account is the main input to authorization checks in webgates-core. It stores the user identity plus the roles, groups, and direct permissions that a policy may evaluate.

In most applications, you create or load an account during authentication, then pass it into an authorization service when a protected operation is requested.

Creating Accounts

use webgates_core::accounts::Account;
use webgates_core::groups::Group;
use webgates_core::permissions::Permissions;
use webgates_core::roles::Role;

let account = Account::<Role, Group>::new("user123");

let permissions: Permissions = ["read:profile", "write:profile"].into_iter().collect();
let account = Account::<Role, Group>::new("admin@example.com")
    .with_roles(vec![Role::Admin])
    .with_groups(vec![Group::new("staff")])
    .with_permissions(permissions);

Working with Permissions

account.grant_permission("read:api");
account.grant_permission(PermissionId::from("write:api"));

if account.permissions.has("read:api") {
    println!("User can read API");
}

account.revoke_permission("write:api");

Fields

account_id: Uuid

Stable unique identifier for the account.

This UUID is generated when the account is created. Applications can use it as the durable internal identifier that links account state to other records such as credentials, profiles, or repository entries.

user_id: String

Application-level user identifier, such as an email address or username.

This is typically the identifier a person uses to log in and the one your application uses to look up the account.

roles: Vec<R>

Roles assigned to this account.

Roles usually represent broad privilege levels such as user, moderator, or admin. When the role type implements AccessHierarchy, higher roles can satisfy lower-role requirements when a policy allows supervisor access.

groups: Vec<G>

Groups this account belongs to.

Groups model exact membership such as departments, tenants, project teams, or support rotations.

permissions: Permissions

Directly granted permissions for this account.

Use direct permissions when roles or groups are too broad and you need feature-level or action-level access control.

Implementations

impl<R, G> Account<R, G>

where R: AccessHierarchy + Eq + Clone + Default, G: Eq + Clone,

pub fn new(user_id: &str) -> Self

Creates a new account for the given user identifier.

A fresh UUID is generated automatically. The new account starts with:

• the default role for R
• no groups
• no direct permissions

With the built-in crate::roles::Role type, the default role is Role::User.

Parameters

• user_id: Unique identifier for the user, such as an email or username.

Examples

use webgates_core::accounts::Account;
use webgates_core::groups::Group;
use webgates_core::roles::Role;

let account = Account::<Role, Group>::new("user@example.com");

assert_eq!(account.user_id, "user@example.com");
assert_eq!(account.roles, vec![Role::User]);
assert!(account.groups.is_empty());

pub fn with_roles(self, roles: Vec<R>) -> Self

Returns this account with the provided roles.

This is useful when building an account that should not keep the single default role assigned by Self::new.

Example

use webgates_core::accounts::Account;
use webgates_core::groups::Group;
use webgates_core::roles::Role;

let account = Account::<Role, Group>::new("user@example.com")
    .with_roles(vec![Role::Admin]);

assert!(account.has_role(&Role::Admin));
assert!(!account.has_role(&Role::User));

pub fn with_groups(self, groups: Vec<G>) -> Self

Returns this account with the provided groups.

This is useful when building an account with initial group membership.

Example

use webgates_core::accounts::Account;
use webgates_core::groups::Group;
use webgates_core::roles::Role;

let account = Account::<Role, Group>::new("user@example.com")
    .with_groups(vec![Group::new("engineering")]);

assert!(account.is_member_of(&Group::new("engineering")));
assert!(!account.is_member_of(&Group::new("marketing")));

pub fn with_permissions(self, permissions: Permissions) -> Self

Returns this account with the provided direct permissions.

This is useful when building an account that starts with a known permission set.

Example

use webgates_core::accounts::Account;
use webgates_core::groups::Group;
use webgates_core::permissions::Permissions;
use webgates_core::roles::Role;

let permissions: Permissions = ["read:profile", "write:profile"].into_iter().collect();
let account = Account::<Role, Group>::new("user@example.com")
    .with_permissions(permissions);

pub fn grant_permission<P>(&mut self, permission: P)

where P: Into<PermissionId>,

Grants a direct permission to this account.

Example

use webgates_core::accounts::Account;
use webgates_core::groups::Group;
use webgates_core::permissions::permission_id::PermissionId;
use webgates_core::roles::Role;

let mut account = Account::<Role, Group>::new("user");
account.grant_permission("read:profile");
account.grant_permission(PermissionId::from("write:profile"));

pub fn revoke_permission<P>(&mut self, permission: P)

where P: Into<PermissionId>,

Revokes a direct permission from this account.

Example

use webgates_core::accounts::Account;
use webgates_core::groups::Group;
use webgates_core::permissions::permission_id::PermissionId;
use webgates_core::roles::Role;

let mut account = Account::<Role, Group>::new("user");
account.grant_permission("write:profile");
account.revoke_permission(PermissionId::from("write:profile"));

pub fn has_role(&self, role: &R) -> bool

Returns true when this account has the given role.

Example

use webgates_core::accounts::Account;
use webgates_core::groups::Group;
use webgates_core::roles::Role;

let account = Account::<Role, Group>::new("user@example.com");

assert!(account.has_role(&Role::User));
assert!(!account.has_role(&Role::Admin));

pub fn is_member_of(&self, group: &G) -> bool

Returns true when this account belongs to the given group.

Example

use webgates_core::accounts::Account;
use webgates_core::groups::Group;
use webgates_core::roles::Role;

let mut account = Account::<Role, Group>::new("user@example.com");
account.groups.push(Group::new("engineering"));

assert!(account.is_member_of(&Group::new("engineering")));
assert!(!account.is_member_of(&Group::new("marketing")));

pub fn has_permission<P>(&self, permission: P) -> bool

where P: Into<PermissionId>,

Returns true when this account has the specified direct permission.

Accepts any type that converts into PermissionId, such as &str or PermissionId itself.

Example

use webgates_core::accounts::Account;
use webgates_core::groups::Group;
use webgates_core::permissions::permission_id::PermissionId;
use webgates_core::roles::Role;

let mut account = Account::<Role, Group>::new("user@example.com");
account.grant_permission("read:api");
account.grant_permission(PermissionId::from("write:docs"));

assert!(account.has_permission("read:api"));
assert!(account.has_permission(PermissionId::from("write:docs")));
assert!(!account.has_permission("admin:system"));

Trait Implementations

impl<R, G> Clone for Account<R, G>

where R: AccessHierarchy + Eq + Clone, G: Eq + Clone + Clone,

fn clone(&self) -> Account<R, G>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<R, G> Debug for Account<R, G>

where R: AccessHierarchy + Eq + Debug, G: Eq + Clone + Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de, R, G> Deserialize<'de> for Account<R, G>

where R: AccessHierarchy + Eq + Deserialize<'de>, G: Eq + Clone + Deserialize<'de>,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<R, G> PartialEq for Account<R, G>

where R: AccessHierarchy + Eq + PartialEq, G: Eq + Clone + PartialEq,

fn eq(&self, other: &Account<R, G>) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<R, G> Serialize for Account<R, G>

where R: AccessHierarchy + Eq + Serialize, G: Eq + Clone + Serialize,

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl<R, G> StructuralPartialEq for Account<R, G>

where R: AccessHierarchy + Eq, G: Eq + Clone,