eidetica/user/
mod.rs

1//! User system for Eidetica.
2//!
3//! Provides multi-user account management with per-user key storage, database tracking,
4//! and sync preferences.
5//!
6//! # Architecture
7//!
8//! - **[`Instance`](crate::Instance)**: Manages infrastructure (user accounts, system databases, backends)
9//! - **[`User`]**: Handles contextual operations (database access, key management) via sessions
10//!
11//! The user's root signing key is stored in `_users` as [`types::UserCredentials`]
12//! (encrypted or unencrypted). Each user has a private database (`_user_<username>`)
13//! owned by the user's root key (Admin(0)), with the device key granted Read permission.
14//! The private database stores:
15//! - **keys**: Additional Ed25519 keypairs with per-database SigKey mappings
16//! - **databases**: Tracked databases with sync preferences
17//! - **settings**: User configuration
18//!
19//! # Key Management
20//!
21//! Keys are Ed25519 keypairs. The root key is encrypted at rest using the user's password
22//! (Argon2id key derivation + AES-256-GCM). Decryption failure IS password verification —
23//! no separate password hash is stored. Each key can authenticate with multiple databases
24//! via SigKey mappings, which are auto-discovered when tracking a database.
25//!
26//! # Sync Settings
27//!
28//! Per-database sync preferences ([`types::SyncSettings`]):
29//! - `sync_enabled`: Master switch
30//! - `sync_on_commit`: Trigger sync on each commit
31//! - `interval_seconds`: Periodic sync interval
32//!
33//! When multiple users track the same database, settings are merged to use the most aggressive settings.
34
35pub mod admin;
36pub mod crypto;
37pub mod errors;
38pub mod key_manager;
39pub mod session;
40pub mod system_databases;
41pub mod types;
42
43pub use admin::InstanceAdmin;
44pub use errors::UserError;
45pub use key_manager::UserKeyManager;
46pub use session::{DatabaseBuilder, User};
47pub use types::*;
eidetica/user/mod.rs

eidetica/user/
mod.rs
