Guides

Accounts and permissions

Users, groups, superusers and staff, and the view/add/change/delete permissions that apply to the admin and the API.

Accounts are built in: they live in the auth_user table, and superusers manage them in the admin under Users and Groups.

#The three switches

#Permissions

Staff who are not superusers can only do what they were given: for each model, any of view, add, change and delete. Permissions are given to an account directly, or to a group of accounts (such as "Editors"); an account has both. Whoever may change a model may also view it, and file uploads count as a model named files.

The same rules apply in the admin and the API (403 with code forbidden), and the admin hides links and buttons an account cannot use.

• Changes apply at once: permissions are checked on every request, so deactivating an account locks it out immediately, even if it is logged in.
• Nobody can remove their own access or delete their own account, so a superuser always remains. If you are locked out anyway, cargo run -- promote --username U makes an account superuser again.

#Account details

Accounts have a username, an e-mail address (unique, stored in lower case; it can be used to log in), first and last name and phone, and record when they joined and last logged in. Passwords are stored as Argon2id hashes, never as text.

For fields of your own, add a model linked to cadmus::user::Entity, with one profile row per account:

#[derive(Clone, Debug, PartialEq, Eq, DeriveEntityModel)]
#[sea_orm(table_name = "profile")]
pub struct Model {
    #[sea_orm(primary_key)]
    pub id: i32,
    #[sea_orm(unique)]
    pub user_id: i32,
    pub bio: Option<String>,
}

#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
pub enum Relation {
    #[sea_orm(belongs_to = "cadmus::user::Entity", from = "Column::UserId", to = "cadmus::user::Column::Id")]
    User,
}

#Creating accounts

• From the terminal: cargo run -- createsuperuser --username U [--email E].
• In the admin: Users → Add. "Send an invitation instead" e-mails a link where the person chooses their own password (see E-mail).
• By logging in through another site, when sign-up is allowed (see Login methods).

#Commands

#Your own account store

To use accounts kept elsewhere, implement the UserStore trait and pass it to App::users. Every account is then a superuser unless you implement UserStore::access, API keys work only if you implement UserStore::api_key, and the Users and Groups pages are not shown.