Struct AdminPlugin 

pub struct AdminPlugin { /* private fields */ }

The admin panel plugin.

Register models via .register() and the plugin will mount a full admin UI under the configured prefix (default: /admin).

Implementations

impl AdminPlugin

pub fn new() -> Self

Create a new admin plugin with default settings.

Mounts at /admin and requires the "admin" role in the session. Links to the actuator UI under /actuator. Reads the user identifier from session key "user_id" (Autumn’s default auth.session_key).

pub fn prefix(self, prefix: impl Into<String>) -> Self

Override the URL prefix (default: /admin).

pub fn actuator_prefix(self, prefix: impl Into<String>) -> Self

Override the actuator mount prefix that dashboard links/polling target (default: /actuator). Must match config.actuator.prefix from your autumn config — the plugin cannot read it automatically because config is loaded after Plugin::build runs.

pub fn auth_session_key(self, key: impl Into<String>) -> Self

Override the session key the role middleware reads to detect an authenticated user. Default: "user_id", matching Autumn’s default auth.session_key. Must match whatever your application populates after login — e.g. set this to "uid" if you configured auth.session_key = "uid".

The plugin can’t read config.auth.session_key automatically because config is loaded after Plugin::build runs.

pub fn require_role(self, role: impl Into<Option<String>>) -> Self

Set the required session role for accessing the admin panel.

Pass None to disable role checks entirely. Authentication (a populated user_id session key) is always required when a role is set.

pub fn register<M: AdminModel>(self, model: M) -> Self

Register a model for admin management.

The model must implement AdminModel, which provides field metadata, CRUD operations, and display configuration.

pub fn with_runtime_config(self, svc: Arc<RuntimeConfigService>) -> Self

Enable the runtime config management page.

Mounts GET /config, POST /config/{key}/set, POST /config/{key}/unset, and GET /config/{key}/history under the admin prefix, and adds a “Runtime Config” item to the sidebar navigation.

pub const fn with_step_up_mutations(self) -> Self

Require step-up (fresh) authentication before any mutating admin action.

When enabled, every POST (create/update) and DELETE (destroy) request to the admin panel is checked against the session’s last_strong_auth_at claim using the global step-up max-age configured in [auth.step_up] (default: 5 minutes). Requests without a valid fresh-auth claim are redirected to /reauth?return_to=… (HTML clients) or receive a 401 step_up_required problem-details response (JSON clients).

Highly recommended for production admin panels to reduce the blast radius of a hijacked admin session.

Example

AdminPlugin::new()
    .register(UserAdmin::default())
    .with_step_up_mutations()

pub const fn with_step_up_max_age(self, secs: u64) -> Self

Override the step-up freshness window for admin mutations.

Only meaningful when with_step_up_mutations is also called. Calls with_step_up_mutations implicitly.

Example

AdminPlugin::new()
    .register(UserAdmin::default())
    .with_step_up_max_age(600) // 10-minute window

pub fn with_impersonation(self, gate: ImpersonationGate) -> Self

Enable user impersonation (“log in as this user”) for this admin panel, gated by gate (issue #1394).

Opt-in in two senses. Without this call the impersonation routes are not mounted at all, and the core primitive (autumn_web::auth::impersonation) default-denies — so an app can never acquire impersonation by accident. With it, two routes appear:

Route	Guard
POST {prefix}/impersonate (body: user_id)	admin role + step-up (if enabled) + gate
POST {prefix}/impersonate/stop	none — reverting must always work

Every admin page then renders the persistent “Viewing as … — Stop impersonating” banner. Put the same banner in your application layout with impersonation_banner_for so it is visible on the pages the operator is actually looking at.

Requires an audit sink. begin_impersonation refuses with 500 unless the app has an AuditLogger carrying at least one sink, because an unrecorded identity swap is the exact failure this feature exists to prevent. The plugin logs an error at startup when the sink is missing.

The gate is also where an app enforces its own boundaries — in particular tenancy, which the framework cannot infer: the policy receives the full PolicyContext, session and DB pool included.

Example

use autumn_web::auth::impersonation::ImpersonationGate;

AdminPlugin::new()
    .register(UserAdmin::default())
    .with_impersonation(ImpersonationGate::allow_roles(["admin"]))

Trait Implementations

impl Default for AdminPlugin

fn default() -> Self

Returns the “default value” for a type.

impl Plugin for AdminPlugin

fn contract(&self) -> Option<PluginContract>

This plugin ships in lockstep with autumn-web — see lockstep_contract.

fn name(&self) -> Cow<'static, str>

Stable identifier used for duplicate-registration detection.

fn build(self, app: AppBuilder) -> AppBuilder

Apply this plugin’s configuration to the builder.

fn route_group(&self) -> Cow<'static, str>

The route group of the routes this plugin adds (#3544).