Struct AdminPlugin 

pub struct AdminPlugin { /* private fields */ }

The admin panel plugin.

Register models via .register() and the plugin will mount a full admin UI under the configured prefix (default: /admin).

Implementations

impl AdminPlugin

pub fn new() -> Self

Create a new admin plugin with default settings.

Mounts at /admin and requires the "admin" role in the session. Links to the actuator UI under /actuator. Reads the user identifier from session key "user_id" (Autumn’s default auth.session_key).

pub fn prefix(self, prefix: impl Into<String>) -> Self

Override the URL prefix (default: /admin).

pub fn actuator_prefix(self, prefix: impl Into<String>) -> Self

Override the actuator mount prefix that dashboard links/polling target (default: /actuator). Must match config.actuator.prefix from your autumn config — the plugin cannot read it automatically because config is loaded after Plugin::build runs.

pub fn auth_session_key(self, key: impl Into<String>) -> Self

Override the session key the role middleware reads to detect an authenticated user. Default: "user_id", matching Autumn’s default auth.session_key. Must match whatever your application populates after login — e.g. set this to "uid" if you configured auth.session_key = "uid".

The plugin can’t read config.auth.session_key automatically because config is loaded after Plugin::build runs.

pub fn require_role(self, role: impl Into<Option<String>>) -> Self

Set the required session role for accessing the admin panel.

Pass None to disable role checks entirely. Authentication (a populated user_id session key) is always required when a role is set.

pub fn register<M: AdminModel>(self, model: M) -> Self

Register a model for admin management.

The model must implement AdminModel, which provides field metadata, CRUD operations, and display configuration.

pub fn with_runtime_config(self, svc: Arc<RuntimeConfigService>) -> Self

Enable the runtime config management page.

Mounts GET /config, POST /config/{key}/set, POST /config/{key}/unset, and GET /config/{key}/history under the admin prefix, and adds a “Runtime Config” item to the sidebar navigation.

pub const fn with_step_up_mutations(self) -> Self

Require step-up (fresh) authentication before any mutating admin action.

When enabled, every POST (create/update) and DELETE (destroy) request to the admin panel is checked against the session’s last_strong_auth_at claim using the global step-up max-age configured in [auth.step_up] (default: 5 minutes). Requests without a valid fresh-auth claim are redirected to /reauth?return_to=… (HTML clients) or receive a 401 step_up_required problem-details response (JSON clients).

Highly recommended for production admin panels to reduce the blast radius of a hijacked admin session.

Example

AdminPlugin::new()
    .register(UserAdmin::default())
    .with_step_up_mutations()

pub const fn with_step_up_max_age(self, secs: u64) -> Self

Override the step-up freshness window for admin mutations.

Only meaningful when with_step_up_mutations is also called. Calls with_step_up_mutations implicitly.

Example

AdminPlugin::new()
    .register(UserAdmin::default())
    .with_step_up_max_age(600) // 10-minute window

Trait Implementations

impl Default for AdminPlugin

fn default() -> Self

Returns the “default value” for a type.

impl Plugin for AdminPlugin

fn name(&self) -> Cow<'static, str>

Stable identifier used for duplicate-registration detection.

fn build(self, app: AppBuilder) -> AppBuilder

Apply this plugin’s configuration to the builder.