Users

The privileges system schema, Argon2id password hashes and the shell's login password.

NarDB has two separate passwords, and they protect different things.

Password	Where	Protects
`nardb-root-user`	the operating system's keychain	logging in to NarDB Shell
database users	the `privileges` schema inside the `.ndbc`	access through the server and connector (future)

Both are hashed with Argon2id (RFC 9106: 64 MiB, 3 passes, 4 threads); the plain password is never written anywhere.

Creating users#

In the shell:

Terminal

>> create_user -n admin -p secret-password
>> create_user -n editor              # opens a password dialog
>> show_users

File → New ▸ User... opens the same dialog. In the Go API:

err := db.CreateUser("admin", "secret-password")
ok, err := db.VerifyUser("admin", typedPassword)

Rules:

Names are lowercase snake_case, at most 63 characters.
Passwords need at least 8 characters. Characters are counted, not bytes, so ğğğğğğğğ is valid.
A name cannot be used twice.

A password given with -p is written to the shell's command history as ••••••.

Users are not created from query files. create_user(...) is not a NarQL statement, so passwords stay out of .nqf files and version control.

NarQL

# error: create users from the shell (create_user -n name) or the Go API
create_user('admin');

Permissions#

A user connected to the server (nardbd) can only do what their grants allow; a user without grants can do nothing:

Terminal

>> grant -u admin -s members -p write
>> revoke -u admin -s members

The permissions are read, write and admin; -s '*' covers every schema. Details: Server. In embedded use (the shell or the Go API) the process that opens the database can access everything; grants apply to remote connections.

Resetting the shell password#

On macOS:

Terminal

security delete-generic-password -s nardb-shell -a nardb-root-user

The setup screen appears again on the next start. Your .ndbc files are not touched.