LocalUser

SQL-backed user.

Stores credentials and profile information locally. Users may be identified
by email, username, or phone_number; at least one identifier is required.
Default implementation for rapid development.

Attributes:
    email: Optional unique email address
    username: Optional unique username
    phone_number: Optional unique phone number
    email_verified: Whether email ownership has been verified
    phone_verified: Whether phone ownership has been verified
    password_hash: Argon2 hash of password (excluded from serialization)
    full_name: Optional display name
    is_active: Whether user can log in (default True)
    roles: List of assigned roles used for RBAC checks

Security:
    - password_hash is excluded from model_dump() and model_dump_json()
    - Never store plaintext passwords
    - Use argon2 for hashing (see LocalIdentityAdapter)

Example:
    user = LocalUser(
        email="john@example.com",
        password_hash="$argon2id$v=19$...",
        full_name="John Doe",
    )

Source: user.py

Fields

Field	Type	Required	Description	Validators
email	None		Unique email address (optional if username/phone provided)	-
username	None		Unique username (optional if email/phone provided)	-
phone_number	None		Unique phone number (optional if email/username provided)	-
email_verified	bool		Whether the email address has been verified	-
phone_verified	bool		Whether the phone number has been verified	-
password_hash	None		password hash	-
full_name	None		User's display name	-
is_active	bool		Whether user can log in	-
roles	list[str]		Assigned RBAC roles	-
tenants	list[str]		(

    "Tenant binds this user may access. Empty means unscoped: combined with "
    "the 'System' role it yields a trustee/back-office view across every "
    "registered tenant; without 'System' an empty list grants no tenant data."
) | - |

Permissions

Role	Create	Delete	Read	Write
Admin	✓	✓	✓	✓
User			✓	✓

Configuration

Setting	Value
Submittable	False
Track Changes	True

Controller

Controller hooks are implemented in *_controller.py files. Available lifecycle hooks:

• validate() - Called before save, raise exceptions for validation errors
• before_insert() - Called before inserting a new document
• after_insert() - Called after successfully inserting
• before_save() - Called before saving (insert or update)
• after_save() - Called after saving
• before_delete() - Called before deleting
• after_delete() - Called after deleting