Umbral Permissions

"Can this user do this?" is a question the admin and REST both ask on every request — so answer it once, in a language they already speak. Umbral Permissions is role-based access control wired straight into the framework: groups, per-model view / add / change / delete permissions, and per-object ownership checks for "you may edit your posts, not everyone's". A deactivated account is denied at the permission layer, not just bounced from the login form, so disabling someone actually disables them.

Install

cargo add umbral-permissions

Wire it up

On boot it walks every registered model and provisions the four standard permissions for each.

use umbral::prelude::*;
use umbral_permissions::PermissionsPlugin;

let app = App::builder()
    .database("default", pool)
    .plugin(BlogPlugin::default())          // models to protect
    .plugin(PermissionsPlugin::default())   // provisions their permissions
    .build()?;

Target: editors can publish, authors only draft

Put users in groups, grant the group the model permissions it needs, and both the admin and the REST API enforce it automatically.

What you get

• Groups + per-model view / add / change / delete permissions
• Per-object ownership checks ("edit your own rows only")
• The same checks the admin and umbral-rest already consult
• Deactivated accounts denied at the permission layer, not just login
• Auto-provisioned permissions for every registered model