Derive Macro WebxRequestMeta 

#[derive(WebxRequestMeta)]
{
    // Attributes available to this derive:
    #[frompath]
    #[fromquery]
    #[frombody]
    #[fromform]
    #[fromfile]
    #[fromheader]
    #[fromclaim]
    #[request]
}

Registers parameter metadata and the request binder from #[from*] fields.

Markers: #[frompath], #[fromquery], #[frombody], #[fromform], #[fromfile], #[fromheader("Name")], #[fromclaim("key")]. Every marker except #[frombody] accepts an optional source key.

Identity fields (fail-closed)

The authenticated identity is a normal request field of type IdentityUser. Anonymous access must be declared explicitly, so a request that silently works for anonymous callers cannot happen by accident:

Field	Declaration	Anonymous callers
user: IdentityUser	#[fromclaim]	rejected with 401
user: Option<IdentityUser>	#[fromclaim(optional)]	allowed, filled with None

A bare #[fromclaim] on Option<IdentityUser> is a compile error, and so is #[fromclaim(optional)] on anything else. A request may carry at most one identity field. The derive also implements RequestUser for that field.

Unmarked fields follow the request method: GET/HEAD/DELETE/OPTIONS bind from the query string, then the route; POST/PUT/PATCH bind from the JSON body, then the form, then the query string. Headers and claims are opt-in only. #[request(queryall)] forces unmarked fields to the query.

The derive also registers the request type’s TypeId, so OpenAPI resolves its parameter metadata unambiguously — a qualified self_ty (contracts::ListOrdersRequest) or two same-named request types in different modules/crates never lose or share parameters.