ServiceStack：AuthUser与IAuthSession对比——如何获取AuthUser？

Hey there, let's unpack your questions about ServiceStack's UserAuth table and objects clearly:

1. Where is the UserAuth table & how to get a UserAuth object? #

First off, the UserAuth table is the core persistent storage for ServiceStack's authentication system—it gets automatically created by default when you enable the AuthFeature (assuming you're using an ORM like OrmLite with auto-migrate enabled, which is the default setup).

To fetch a UserAuth object, you'll need to use the IAuthRepository interface, which is ServiceStack's abstraction for accessing auth data:

• If you have a user's ID (you can get this from IAuthSession.UserAuthId), you can retrieve their full UserAuth record like this:

  // Get the auth repository from the AppHost
  var authRepo = HostContext.AppHost.GetAuthRepository();
  using (authRepo as IDisposable) // Ensure proper disposal
  {
      // Fetch the UserAuth using the session's UserAuthId
      var userAuth = authRepo.GetUserAuth(session.UserAuthId);
  }
  

• In services, you can also inject IAuthRepository directly via constructor dependency injection instead of fetching it from the AppHost.

2. What's the difference between IAuthSession and UserAuth? #

• IAuthSession: This is a session-level object that holds temporary, request-scoped data about the currently authenticated user—things like their session ID, basic user info (name, email), roles/permissions, and expiry. It's designed to be lightweight so it can be efficiently serialized and cached (e.g., in Redis or cookies), which is why it only includes a subset of user data.
• UserAuth: This is the persistent entity mapped to the UserAuth table. It stores all the core, long-term user authentication data: hashed passwords, email verification status, creation/last login timestamps, custom metadata (the Meta dictionary @mythz mentioned), and any extended fields you add when customizing the auth system.

3. When would you use UserAuth? #

Here are common use cases:

• Accessing full user data: When you need more than what's in the session (like the Meta dictionary, password reset tokens, or custom user fields you've added).
• Extending the auth system: If you want to add custom properties to users (e.g., PhoneNumber, Address), you'd create a class inheriting from UserAuth and configure your IAuthRepository to use this custom class.
• Admin operations: Managing user accounts (creating users, updating roles, resetting passwords) all interact with the UserAuth entity directly.

If you're still not seeing the UserAuth table, double-check that you've properly registered AuthFeature in your AppHost and that your database connection string is correct—sometimes auto-migration might be disabled if you've changed the default ORM settings.

内容的提问来源于stack exchange，提问作者Ted