Admin Metadata

The Model derive macro stores optional admin labels and capability flags in model and field metadata. afastorm does not generate or serve management pages, perform authorization, or enforce these flags in repository methods. An application integration is responsible for interpreting the metadata and enforcing access control on the server.

#[derive(Model)]
#[orm(
    table = "posts",
    admin(label = "Posts", list, detail, create, update, delete)
)]
struct Post {
    #[orm(primary_key, auto_increment, admin(label = "ID", list, detail, readonly))]
    id: Option<i64>,
    #[orm(admin(label = "Title", list, detail, create, update, search))]
    title: String,
    #[orm(admin(label = "Body", detail, create, update))]
    body: String,
    #[orm(soft_delete, admin(hidden))]
    deleted_at: Option<String>,
    #[orm(version, admin(label = "Version", detail, readonly))]
    version: i64,
}

Model-level options are label, list, detail, create, update, and delete. Field-level options are label, list, detail, create, update, filter, search, readonly, and hidden. These are metadata booleans/labels only; fields are not automatically included in a UI, and hidden/readonly are not security controls.

Read metadata from M::INFO or the registered models returned by the ORM. A web integration should validate submitted field names and values, enforce user permissions independently, and use the repository/query APIs rather than treating client-side controls as authorization.