CLI: operation access and read rules

Access has three levels: whether an operation exists, who may invoke it and which records it returns. For example, external-list permission exposes a list, while readRule limits it to published records. A client filter does not replace a mandatory server rule.

Enable the required operations

admingen-cli --path ./docs-demo entity update Article \
  --admin-list=true --admin-get=true --admin-delete=false \
  --external-list anonymous --external-get anonymous \
  --external-create off --external-update off --external-delete off

When creating a regular entity, admin access is allowed and external access is disabled. Update preserves omitted properties. A projection supports reads only. Inspect routes in Generated routes or OpenAPI after Generate.

A permission does not enable a disabled CRUD operation. First ensure the model itself supports the action.

Return only published records

There is no separate CLI flag for readRule. Configure the condition in Entity settings → Access or add it to an existing entity in .admingen/project.yaml:

access:
  external:
    list: anonymous
    get: anonymous
    create: off
    update: off
    delete: off
    readRule:
      field: status
      op: eq
      value: published

The example assumes Article has an enum status with a published variant. When editing manually, preserve other access settings, especially admin. Validate the model, run Generate and update the backend normally.

External list/get applies the rule even without a URL filter. A client cannot request a broader set; a record rejected by the rule is also unreadable by ID. This readRule does not restrict the Admin API or write operations.

Separate block, page and item conditions

Suppose a virtual entity's source is PageBlock, with a belongsTo page relationship and a selected items collection. Conditions for the block and its page belong in access.external.readRule:

readRule:
  all:
    - field: isVisible
      op: eq
      value: "true"
    - field: page.status
      op: eq
      value: published

Item rules are configured separately on the selected collection in virtual.select. The selection fragment below requires the referenced fields to exist in your model:

- relation: items
  collection:
    defaultLimit: 20
    maxLimit: 100
    orderBy:
      field: position
      direction: asc
    readRule:
      all:
        - field: isVisible
          op: eq
          value: "true"
        - field: title
          op: ne
          value: ""
  select:
    - field: id
    - field: title
      searchable: true
      filterable: true
    - field: position
      sortable: true

The response contains visible blocks of published pages. Each contains visible items with a nonempty title, sorted by position. If no items match, the block still returns with an empty collection.

In the UI, these conditions occupy separate entity blocks so parent filtering is not mixed with nested-record filtering.

Define groups and values

all combines conditions with AND, any with OR. A group may include conditions and other groups, up to8 levels and64 nodes. A regular condition contains field/op/value.

Values are strings, including numbers and booleans. ne with "" checks for an empty string, not null. Nullable fields support isNull/isNotNull without value.

A rule belongs to a specific entity or projection. It is not inherited from its source or relationship targets. Conditions in this version are constant: they cannot substitute the current user or time. searchable/filterable/sortable controls client query capabilities; readRule applies independently of them.

Apply settings

admingen-cli --path ./docs-demo plan
admingen-cli --path ./docs-demo generate --dry-run
admingen-cli --path ./docs-demo generate

Generate creates code but does not restart the running backend. After updating it, check the required responses. See application API, projection CLI and sign-in and access.

Public cache

Enable it in Access → External READ access → Cache public responses. For a manually edited manifest, use the entity's access.external settings:

cache:
  enabled: true
  ttlSeconds: 30

This supplements existing permissions rather than replacing access rules. Caching requires anonymous List or Get. After Generate, release the updated backend and Nginx. Complete behavior and content-update delay are described in public caching.