feat: Start implementing roles (and domainless service users)

src/db/user.rs

@@ -1,23 +1,35 @@
 use std::fmt;
 
+use crate::db::{Operation, Role};
+
 #[derive(Clone, Debug)]
 pub struct UserRef {
     pub username: String,
-    pub domain: String,
+    pub domain: Option<String>,
 }
 
 impl fmt::Display for UserRef {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{}@{}", self.username, self.domain)
+        if let Some(domain) = &self.domain {
+            write!(f, "{}@{}", self.username, domain)
+        } else {
+            write!(f, "{}", self.username)
+        }
     }
 }
 
 #[derive(Clone, Debug)]
 pub struct User {
+    /// Username, without the domain part. Once set, cannot be edited.
     pub username: String,
-    pub domain: String,
+    /// Domain of the user. Once set, cannot be edited.
+    ///
+    /// Service accounts may exist with an empty domain.
+    pub domain: Option<String>,
     pub password: String,
+    /// Mail for the user. Computed from username/domain, cannot be edited.
     pub mail: String,
+    pub role: Role,
     // recovery_mail: String,
 }
 
@@ -28,10 +40,19 @@ impl User {
             domain: self.domain.clone(),
         }
     }
+
+    #[expect(unused)]
+    pub fn can_perform(&self, operation: &Operation) -> bool {
+        self.role.can_perform(operation)
+    }
 }
 
 impl fmt::Display for User {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{}@{}", self.username, self.domain)
+        if let Some(domain) = &self.domain {
+            write!(f, "{}@{}", self.username, domain)
+        } else {
+            write!(f, "{}", self.username)
+        }
     }
 }