Built-in user
Every new project is born authentication-ready. Unless you pass --no-user, gize new scaffolds a complete users resource — model, migration and hardened routes — wired into src/app/mod.rs and gize.toml.
Born with the app
gize new shop generates the same layered slice that gize make crud produces (model, dto, repository, service, handler, routes, error, tests), plus a migration for the users table. After gize migrate you have a working, auth-ready identity resource without writing a line of code.
Passwords are hashed with Argon2id before storage and are never serialized back into API responses. The register and login endpoints issue a stateless JWT (HS256) signed with GIZE_JWT_SECRET, and an is_admin claim rides in the token so admin routes need no extra database read.
It is one resource, not a hidden framework: every file is plain, owned Rust you can read, diff and extend. Pass gize new shop --no-user to skip it entirely.
The User model
The users table is created with an email UNIQUE constraint and is_admin defaulting to false. The generated model maps to it one-to-one:
idUuidPrimary key, generated by the database.nameStringThe user's display name.emailStringLogin identifier; UNIQUE at the database level.passwordStringArgon2id hash. Marked #[serde(skip_serializing)], so it is read from the database but never returned in responses.is_adminboolRole flag, defaults to false. Gates the admin-only routes; a public register can never set it.created_at / updated_atDateTimeTimestamps managed by the resource.Routes that ship with it
The slice is hardened by default (ADR-013 / ADR-021): register and login are public, /users/me is self-service for any authenticated caller, and every other route — including reads of arbitrary users — requires an admin bearer token. On a versioned project (gize new --api v1) they sit under the /api/v1 prefix.
POST /users/registerPublicCreate a user (never an admin) and receive a session token.
POST /users/loginPublicExchange email and password for a session token.
GET /users/meAuthenticatedReturn the caller's own record, identified by the token's sub claim. Any valid token works — no admin flag required.
GET /usersAdminList every user. Admin-gated so the API never leaks emails or enables enumeration through public reads.
POST /usersAdminCreate a user directly, including admins. This is how admins are minted.
GET /users/:idAdminRead an arbitrary user by id.
PUT /users/:idAdminUpdate an arbitrary user by id.
DELETE /users/:idAdminDelete an arbitrary user by id.
Access levels: Public needs no token; Authenticated needs any valid bearer token; Admin needs a token whose is_admin claim is true. Create the first admin with gize createadmin.