Umbral REST

The same models that power your admin can become a JSON API without a second data layer. Umbral REST is the DRF-equivalent: register a resource and get list / create / retrieve / update / delete, pagination, filtering, search, and an auth + permission chain — all wired to the model you already declared. And it's safe by default: a resource with no explicit permission is read-only, so a stray POST returns 403 until you opt writes in.

Install

cargo add umbral-rest

Wire it up

use umbral::prelude::*;
use umbral_rest::{RestPlugin, ResourceConfig};

let app = App::builder()
    .database("default", pool)
    .plugin(
        RestPlugin::default()
            // Expose a model, hiding a sensitive column from the wire.
            .resource(ResourceConfig::for_::<AuthUser>().hide(["password_hash"])),
    )
    .build()?;

GET /api/ lists every resource; GET /api/authuser/ returns a paginated page.

Target: writable, but only for the right callers

Flip a resource to writable and gate it behind a permission — the default stays read-only for everything you don't opt in.

use umbral_rest::{ResourceConfig, permissions::IsAuthenticated};

RestPlugin::default()
    .resource(
        ResourceConfig::for_::<Article>()
            .default_permission(IsAuthenticated),  // anonymous reads, members write
    );

What you get

• Model → JSON resource with zero serializer code
• Pagination, query-string filters, and free-text search
• Session / bearer auth chain with per-resource permission gates
• GET /api/ discovery root listing resources and endpoints
• Custom @action endpoints beyond CRUD
• Safe by default: writes 403 until a permission opts them in; list capped