User module ports — persistence and service seams for the user domain.
Three repositories (users, sessions, audit log) and one service facade. The repositories are what an alternative backend implements; the service is what the rest of the framework calls.
Email, notifications, events and metrics are not here — email lives in libs/email, observability owns logging/metrics/audit.
User module ports — persistence and service seams for the user domain. Three repositories (users, sessions, audit log) and one service facade. The repositories are what an alternative backend implements; the service is what the rest of the framework calls. Email, notifications, events and metrics are not here — email lives in libs/email, observability owns logging/metrics/audit.
Memberships and assignments that end (BOU-856). An assignment takes its end
as :expires-at in insert-assignment. Once passed, every read of
IUserGroupRepository leaves the row out; remove-expired deletes it.
Memberships and assignments that end (BOU-856). An assignment takes its end as :expires-at in `insert-assignment`. Once passed, every read of IUserGroupRepository leaves the row out; `remove-expired` deletes it.
(insert-member-until this group-id user-id expires-at)(remove-expired this now)(claim-login-attempts this user-id n lockout)(release-login-attempt this user-id unlock?)(add-group-member-until this group-id user-id expires-at)(expire-access! this now)What an admin does for a user who cannot sign in. Each change is audited with the admin as actor.
What an admin does for a user who cannot sign in. Each change is audited with the admin as actor.
(reset-user-mfa this user-id)(unlock-user this user-id)Audit-log persistence. Entries are immutable once written.
Audit-log persistence. Entries are immutable once written.
(create-audit-log this audit-entity)(find-audit-logs this options)(find-audit-logs-by-user this user-id options)(delete-audit-logs-before this cutoff)(delete-user this user-id)(delete-users this user-ids opts)Groups, their members, managed roles and the roles assigned to groups. A group is {:id :name :description :created-at :updated-at}; a managed role {:id :name kw :description :permissions #{kw} :created-at :updated-at}; an assignment {:id :group-id :role kw :scope map :created-at}. Deleting a group or a user removes their memberships and, with a group, its assignments.
Groups, their members, managed roles and the roles assigned to groups. A
group is {:id :name :description :created-at :updated-at}; a managed role
{:id :name kw :description :permissions #{kw} :created-at :updated-at}; an
assignment {:id :group-id :role kw :scope map :created-at}. Deleting a
group or a user removes their memberships and, with a group, its
assignments.(any-non-admin-users? this)(modify-role this role)(ensure-tables this)(insert-assignment this assignment)(insert-member this group-id user-id)(find-user-groups this user-id)(find-group this group-id)(remove-role this role-name)(find-legacy-viewers this)(find-role-holders this role-names)(remove-member this group-id user-id)(modify-group this group)(find-role-assignments this role-name)(find-assignments this group-id)(remove-group this group-id)(mark-legacy-grant-migrated this grant-id)(ensure-everyone this)(remove-assignment this group-id assignment-id)(insert-group this group)(insert-role this role)(find-members this group-id)(find-legacy-grants this)(find-groups this)(find-user-assignments this user-id group-names)(clear-legacy-roles this)(in-transaction this f)(find-roles this)Groups of users and the roles assigned to them (ADR-041). A user's grants
are the permissions of the roles of their groups: those they were added
to, the built-in Everyone, and those the :group-membership hook names.
Joining, leaving, a changed assignment and a changed managed role are
audited for each user whose rights change; a change to Everyone once, for
the actor. Nothing is cached: user-grants reads the database, so a change
applies to the next request. The :admin role is separate and needs no
group. Throws ex-infos carrying :type: :validation-error, :not-found,
:conflict.
Groups of users and the roles assigned to them (ADR-041). A user's grants are the permissions of the roles of their groups: those they were added to, the built-in Everyone, and those the `:group-membership` hook names. Joining, leaving, a changed assignment and a changed managed role are audited for each user whose rights change; a change to Everyone once, for the actor. Nothing is cached: `user-grants` reads the database, so a change applies to the next request. The :admin role is separate and needs no group. Throws ex-infos carrying :type: :validation-error, :not-found, :conflict.
(role-holders this role-names)(update-group this group)(remove-group-role this group-id assignment-id)(remove-group-grant this group-id grant-id)(add-group-grant this group-id grant)(delete-group this group-id)(create-role this role)(provider-members this group-id)(get-group this group-id)(permission-holders this permission)(user-groups this user)(create-group this group)(add-group-role this group-id assignment)(user-grants this user)(add-group-member this group-id user-id)(import-groups! this groups opts)(remove-group-member this group-id user-id)(delete-role this role-name)(update-role this role)(list-roles this)(list-groups this)Links between an account and an external sign-in: an OpenID Connect (issuer, subject) pair. An issuer never reuses a subject, so the pair names one person for good, where an email address can change hands.
Links between an account and an external sign-in: an OpenID Connect (issuer, subject) pair. An issuer never reuses a subject, so the pair names one person for good, where an email address can change hands.
(find-identities-by-user this user-id)(find-identity this issuer subject)(link-identity this identity)(touch-identity this issuer subject at)(unlink-identity this issuer subject)User persistence. Entities are kebab-case maps per wagoe.user.schema.
User persistence. Entities are kebab-case maps per wagoe.user.schema.
(create-user this user-entity)(find-user-by-email this email)(find-user-by-id this user-id)(find-users this options)(hard-delete-user this user-id)(soft-delete-user this user-id)(update-user this user-entity)User domain service — orchestrates the repositories, the auth shell and the audit trail. Every method may throw an ex-info carrying :type (ADR-022); the listed types are the ones callers branch on.
User domain service — orchestrates the repositories, the auth shell and the audit trail. Every method may throw an ex-info carrying :type (ADR-022); the listed types are the ones callers branch on.
(logout-user this session-token)(list-audit-logs this options)(change-password this user-id current-password new-password)(get-user-by-id this user-id)(update-user-profile this user-entity)(register-user this user-data)(validate-session this session-token)(register-or-authenticate-user this user-data login-context)(claim-user-identity this request)(get-audit-logs-for-user this user-id options)(logout-user-everywhere this user-id)(permanently-delete-user this user-id)(list-users this options)(deactivate-user this user-id)(authenticate-user this user-credentials)(get-user-sessions this user-id)(get-user-by-email this email)(invalidate-user-session this user-id session-id)Session persistence. A session is active when it has not expired and has no :revoked-at; every read here filters on both.
Session persistence. A session is active when it has not expired and has no :revoked-at; every read here filters on both.
(create-session this session-entity)(delete-sessions-expired-before this cutoff)(find-all-sessions this)(find-session-by-token this session-token)(find-sessions-by-user this user-id)(invalidate-all-user-sessions this user-id)(invalidate-session this session-token)(update-session this session-entity)(revoke-sessions-except this user-id keep-session-id)(revoke-user-session this user-id session-id)cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |