The Single Responsibility Principle is a good thing to aim for, for many classes. It doesn't always mean that each class only does one thing (though it can), but that it is responsible for a small amount of tightly-related functionality.
That said, the job of some classes is to collect together a number of responsibilities. User
may well be one of these, but the individual responsibilities can still be delegated to other classes - e.g. you could always give the userUser
an instance of a 'credentials'Credentials class that deals with the password checking.
You almost certainly don't want your database-related functions in User
as if you write any tests for User
, many of them are likely to have a need to hit the database when they run.