Struct IdentityManager

pub struct IdentityManager { /* private fields */ }

Implementations

impl IdentityManager

pub fn new( store: Arc<CacheStore>, bus: Arc<ObserverBus>, clock: Arc<dyn Clock>, ) -> Self

pub fn current_user(&self) -> User

pub fn current_user_scope(&self) -> String

The user scope used by the local cache layer ONLY — app_user_id if identified, else rovenue_id. So a logged-in user’s cached entitlements live in their own namespace and flip on identify/log_out.

NEVER send this on the wire. Every server endpoint resolves the inbound identity header/field as a rovenueId (the app_user_id is a server-side label attached via POST /v1/identify). Use rovenue_id as the network identity instead; sending the app_user_id routes requests to an orphan subscriber row.

pub fn set_app_user_id(&self, app_user_id: String) -> RovenueResult<bool>

Optimistic-local identity set. Persists the app_user_id with synced: false (a follow-up POST /v1/identify flips it to synced via [mark_synced]). Emits IdentityChanged only when the value actually changes. Returns true when the identity changed, false when it was already this app_user_id (no write, no emit).

pub fn mark_synced(&self, sent: &PendingBind) -> RovenueResult<()>

Marks the persisted identity row as synced (server POST /v1/identify succeeded) — but ONLY when the row still carries the pair that was actually sent. This guards two races: identify(A)’s slow POST completing after identify(B) overwrote the row (stamping B synced though only A was sent), and an old device’s POST completing after log_out + identify(A) paired A with a new device (stamping the new pair synced though only the old one was sent). Runs under the identity lock so it cannot write back a row log_out just replaced. Does not touch the in-memory User or emit.

pub fn pending_bind(&self) -> Option<PendingBind>

The pending identify bind, read as one pair from the persisted row under the identity lock — Some only while the row has synced == false, carries an app_user_id, and still matches the in-memory identity. A row the current identity no longer matches (the identity changed since it was written) yields None: the bind is skipped rather than sent for a device that has moved on.

pub fn pending_app_user_id(&self) -> Option<String>

Returns the app_user_id awaiting server sync — the app_user_id of pending_bind.

pub fn rovenue_id(&self) -> String

The current anonymous device id.

pub fn log_out(&self) -> RovenueResult<()>

Resets identity to a fresh anonymous user: mints a new rovenue_id, drops any app_user_id, persists, and notifies observers. Callers that hold scope-bound caches must clear them after this returns.