code: async def save_form(self, form, request, **resources):
          
          if not self.can_create and not self.resource:
              raise muffin.HTTPForbidden()
  
          if not self.can_edit and self.resource:
              raise muffin.HTTPForbidden()
  
          resource = self.resource or self.populate()
          form.populate_obj(resource)
          return resource
docs: Save self form.