Crate cadmus 

Cadmus: a batteries-included web framework for axum and SeaORM.

Register SeaORM entities as models and the crate serves admin pages (list, search, create, edit, delete) and REST endpoints for each one, behind accounts with permissions, and keeps their tables up to date with migrations. A project is configured with one Settings value (see settings) and App::from_settings; the pieces below can also be put together by hand. Look and feel (UiSettings) and authentication (AuthConfig, EnvUserStore) can be configured entirely from environment variables.

let admin = Admin::builder()
    .settings(UiSettings::from_env()?)
    .auth(AuthConfig::from_env()?, EnvUserStore::from_env()?)
    .register(SeaOrmResource::<post::Entity>::new(db.clone()))
    .build()?;
let app = axum::Router::new().merge(admin.router());

Re-exports

pub use settings::NavLink;

pub use settings::Settings;

pub use settings::Theme;

pub use settings::UiSettings;

Modules

file

The storage_file entity: one stored file.

group

The auth_group entity: a named set of permissions that accounts can be put in.

identity

The auth_identity entity: which account each login through another site belongs to.

migrations

Versioned migrations.

session

The storage_upload entity: one resumable upload in progress.

settings

Settings: the whole project’s configuration (Settings), and the look of the admin (UiSettings).

user

The auth_user entity.

Structs

Access

What one account may do. Returned by crate::UserStore::access for every request.

Admin

A configured admin panel. Create with Admin::builder, mount with Admin::router.

AdminBuilder

Builder for Admin.

AdminUser

An account allowed into the admin.

ApiError

An AdminError answered as JSON: {"error": {"code", "message", "field"}}.

ApiKeyOwner

The account an API key belongs to, as UserStore::api_key finds it.

App

An application: register models, add your own routes, then call App::run.

AuthConfig

Authentication settings. Build in code, or load with AuthConfig::from_env.

DbUserStore

UserStore backed by the auth_user table. Only active staff accounts are returned.

DocsConfig

Settings for the API documentation. Build in code, or load with DocsConfig::from_env.

Email

One message to one person.

EnvUserStore

A single admin account defined by environment variables.

Field

Metadata for one column of a model.

Filter

One condition on a column, as ?published=true or ?created_at__gte=2026-01-01 asks.

HomeConfig

Settings for the home page. Build in code, or load with HomeConfig::from_env.

ListQuery

A page request for Resource::list.

LogMailer

Writes each message to the log instead of sending it: for development, where the login links can be copied from the terminal. This is what a site without mail.url uses.

ModelOptions

How a model appears in the admin: list columns, search, filters, read-only and hidden fields, actions and more.

Page

One page of rows plus the total match count.

Reference

What a foreign-key column points to.

SeaOrmResource

Admin resource backed by a SeaORM entity.

Sink

A streaming write of unknown length.

SmtpMailer

Sends messages through an SMTP server.

Storage

A storage backend plus the key prefix this app writes under.

Uploads

The upload service: storage backend, database and limits.

Enums

Action

Something an account can be allowed to do to a model.

AdminError

Everything that can go wrong while configuring or serving the app.

FieldKind

How a field is rendered and parsed.

FilterOp

How a Filter compares the column with its value.

Progress

Result of appending a chunk.

WriteMode

How Resource::update treats columns that are missing from the input.

Traits

Mailer

Something that delivers Emails.

Resource

A model the admin can list and edit.

UserStore

Where admin accounts come from. Implement this over your own users table; EnvUserStore covers the single-operator case.

Functions

change_password

Replaces an account’s password.

create_superuser

Creates an active superuser: an account that may do everything, including managing other accounts.

disable_totp

Turns two-factor authentication off for an account, e.g. after its device was lost.

enable_totp

Turns two-factor authentication on for an account, replacing any earlier secret, and returns the new base32 secret to put into an authenticator app (see crate::totp_uri).

hash_password

Hashes a password with Argon2id for storage in ADMIN_PASSWORD_HASH or your users table.

hash_password_async

hash_password on the blocking thread pool, for use from async code.

new_api_key

Creates an API key for an account and returns it. It is shown once: only its digest is stored. The key acts as the account, with the account’s permissions (only reading, if read_only), until it is revoked, expires_in_days pass, or the account is deactivated. What the apikey command does.

new_recovery_codes

Replaces an account’s two-factor recovery codes with a new set of ten and returns them, to be shown once: each logs in once in place of an authenticator code. What the totp command prints after turning two-factor authentication on.

promote

Makes an existing account an active superuser, keeping its password.

set_email

Sets the e-mail address of an account, e.g. after createsuperuser --email.

totp_uri

The otpauth:// address an authenticator app reads from a QR code. issuer is the name the app shows next to the account, usually the site’s title.

verify_totp

Verifies an RFC 6238 code (SHA-1, 6 digits, 30 s step), accepting one step of clock drift either way.

Type Aliases

ApiResult

Result of a JSON handler.

Input

Values to write, keyed by column name. None is an explicit null; a missing key means “not provided”.

Row

One database row as a JSON object keyed by column name.