Forms

FlowPanel can generate forms from adapter metadata. Declare the field lists when you need a predictable write surface, different create and update behavior, or controls the adapter cannot infer.

Start with explicit fields

resource(schema.users, {
  columns: ["email", "name", "role", "createdAt"],
  create: {
    fields: [
      { name: "email", type: "email", required: true },
      { name: "name", required: true },
      { name: "role", type: "select", options: ["member", "admin"] },
    ],
  },
  update: {
    fields: [
      { name: "name", required: true },
      { name: "role", type: "select", options: ["member", "admin"] },
    ],
  },
})

The create form can collect fields that should never be editable later. Omitted fields remain outside that form; they are not silently accepted by the write route.

Choose controls

Use type for the intended input: text, textarea, number, email, password, URL, date/time, boolean controls, select variants, JSON, Markdown, tags, reference, hidden, or color. Add label, help, and placeholder only when the field name and control do not explain the task.

options accepts static strings, { label, value } pairs, or a server-side function. Dynamic options receive the typed query context and are resolved per request.

Relation fields

A reference field stores the foreign key while showing a searchable label from another registered resource:

{
  name: "customerId",
  label: "Customer",
  reference: {
    resource: "customers",
    valueField: "id",
    labelField: "email",
  },
  required: true,
}

The target resource's access, tenant scope, and searchable label field apply to the lookup. Register string-named resources in FlowpanelResources so the names and fields are checked.

Validate on the server

Adapter or resource schema validation is authoritative. A field validate rule runs afterward and can use a Zod schema or return a message. required also improves browser feedback, but a handcrafted request still passes through the same server checks.

Use a server defaultValue for trusted values such as the current tenant or initial status. Do not render sensitive defaults into the client just to post them back.

Restrict fields

readOnly, hidden, and requireRole affect rendering and writes. A submitted read-only or unauthorized field is rejected by the server rather than silently applied. Use field policies when the rule depends on the operation or session.

Understand submission

Generated forms post to FlowPanel route handlers. A successful create returns to the resource list; a successful update returns to the row. Writes pass through auth, resource access, scope, field policy, validation, the adapter, then post-commit audit/realtime/revalidation.

Use a custom page when the operation needs a multi-step transaction, several resources, or client state that does not fit a resource form. See Request and mutation lifecycle and the generated Resources reference.