argus-trail 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8012d44e5a16eb856aec00b306bc64e780d96c13f34e729e25b0ed0087aca325
-  data.tar.gz: 2990ef7c7ce767ce3f3a61874b4ddb185c44c7e50cce740e7628dfd0edf531ae
+  metadata.gz: d86d8207fc46e8cafc37a10432ca8c334a0532fab39d679011a48cb08be88a08
+  data.tar.gz: 3a6763f5853cb25fd301a6041276c69762e18bdf0fc7dafe1f5f8aaed01809fe
 SHA512:
-  metadata.gz: 0ac4bd48b2f65ac648d8ba978a5dc8e119f9e189403ae2ef0a97b350f400ff7ae35c4ee14b3e2271446b7083a6876daaaf6a9d2fd02a4ec50225a09e49da6a90
-  data.tar.gz: 711cee8042f3d5200792b1297f770cd0a016b67e017fe65f19f8d85c0b1f10688263300fdfe0298837c34dc170c476b39a73728b51ff50420c70de3d75725840
+  metadata.gz: 7b8f6ca3c73d1851e927ddd84a3e7e9916ec83af41d9a5746c4f21b6ff4dec457e0c1cbe65836ac043f36a03762e6d411550231a06aa07ee567657bf60d88afc
+  data.tar.gz: 57e1e8ff8a764adf00073a3e4c4a34769186eb62089904636526640e87461a12741a2257ab9aea3e627ee8323e969a91e333883a74c0fe98dfff0e2af9c264bd

data/CHANGELOG.md

@@ -0,0 +1,61 @@
+# Changelog
+
+## 0.2.0
+
+**Upgrading from 0.1.x? Run this first:**
+
+```bash
+bin/rails generate argus:trail:upgrade_v0_2
+bin/rails db:migrate
+```
+
+This adds `module_name`/`action` columns to `argus_trail_permissions`, a
+composite index on them, and an index on `argus_trail_audit_entries.created_at`.
+Safe to run on any install — every step is guarded and a no-op if already
+applied.
+
+### Added
+
+- **Module-wise permissions**: `Permission` now supports `module_name`/`action`
+  (e.g. `module_name: "admin/accounts", action: "read"`) alongside the
+  existing flat `name`/`description` permissions. Name/description auto-derive
+  when both are set. The role/permission admin screens group these by module
+  with a "select all" toggle.
+- **`bin/rails argus_trail:fetch_permissions`**: scans your app's routes and
+  creates a `Permission` for every controller/action pair found (skipping the
+  engine's own routes and framework-internal ones), safe to rerun —  only
+  ever adds. `argus_trail:fetch_permissions:prune` removes permissions whose
+  route is gone and aren't granted to any role.
+- **`Argus::Trail::Authorizable`**: a controller concern — `include
+  Argus::Trail::Authorizable` gates every action behind the matching
+  module-wise permission automatically, no further code needed.
+- **Plug-and-play install**: the install generator now auto-injects `include
+  Argus::Trail::Actor` into your actor model and the `current_actor`
+  before_action into `ApplicationController` (idempotent, skips gracefully if
+  the files don't exist yet).
+- **No more hard-fail without Pundit**: the admin screens default to "any
+  signed-in actor" when neither Pundit policies nor `config.authorize_with`
+  are set, instead of raising `MissingAuthorization`. Tighten with a policy
+  or `authorize_with` as before.
+- `Actor#has_permission?` now accepts either a plain permission name or a
+  `(module_name, action)` pair, and is memoized per actor instance (cleared
+  by `sync_roles!`) so repeated checks in one request don't re-query.
+- `config.permission_scan_excludes` and `config.action_name_mapper` to
+  customize what `fetch_permissions`/`Authorizable` scan and how actions
+  normalize.
+
+### Fixed
+
+- `roles#index`/`permissions#index` called `.count` on an already-preloaded
+  association inside the row loop — `.count` always re-queries regardless of
+  `includes`, unlike `.size`. Switched to `.size` (no behavior change, fewer
+  queries).
+- Added the missing index on `argus_trail_audit_entries.created_at` — used by
+  both the default `.recent` ordering and the "Today" stat on every page load
+  of what's an append-only, ever-growing table.
+
+## 0.1.1 / 0.1.0
+
+Initial mountable-engine release: roles, permissions, role assignments, and
+a unified audit log, with paginated HTML admin screens and install/views/config
+generators.

data/README.md

@@ -38,38 +38,65 @@ the engine's own tables (`argus_trail_roles`, `argus_trail_permissions`,
 `argus_trail_role_assignments` is a polymorphic join table the engine owns
 end to end.
 
-## Wiring up your app
+It also wires up the two integration points that used to be manual steps:
+it adds `include Argus::Trail::Actor` to your actor model (`User` by
+default — pass `--actor=YourModel` if it's called something else) and adds
+`before_action { Argus::Trail.current_actor = current_user }` to your
+`ApplicationController`. Both are idempotent (safe to rerun) and skipped
+with an explanatory message if the corresponding file doesn't exist yet.
+
+## Generating module-wise permissions
+
+```bash
+bin/rails argus_trail:fetch_permissions
+```
 
-**1. Opt your user model in:**
+Scans your app's routes and creates a `Permission` for every controller
+action it finds (skipping the engine's own routes and framework-internal
+ones), grouped by `module_name` (the controller, e.g. `"admin/accounts"`)
+and `action` (`read`/`create`/`update`/`destroy`, or a custom action name
+as-is). It only ever adds permissions — safe to rerun after adding
+controllers/actions. `bin/rails argus_trail:fetch_permissions:prune` removes
+the ones whose route is gone and that aren't granted to any role.
+
+Visit the mounted engine to create roles and check off which module-wise
+permissions (and any permissions you created by hand) each one grants.
+
+## Gating your own controllers
 
 ```ruby
-class User < ApplicationRecord
-  include Argus::Trail::Actor
+class AccountsController < ApplicationController
+  include Argus::Trail::Authorizable
 end
 ```
 
-This adds `has_many :roles` (through the engine's join table),
-`has_permission?(name)` (true if *any* assigned role has that permission),
-and `sync_roles!` — diffs the requested role ids against the ones the actor
-currently holds and writes one `AuditEntry` per assignment
-(`role_assigned`) or revocation (`role_revoked`):
+No further code needed — the required permission is derived automatically
+from the controller and action (the same `module_name`/`action` pair
+`fetch_permissions` generated), using
+`Argus::Trail.config.action_name_mapper`. A signed-in actor without a role
+granting that permission gets a 403.
+
+## Wiring up your app
+
+**Recording role changes on an actor.** Use `Actor#sync_roles!` (instead of
+assigning `role_ids=`/`roles=` directly) so assignments and revocations land
+in the audit log, and use `has_permission?` to check a permission by name or
+by module + action:
 
 ```ruby
 user.sync_roles!([ admin_role.id, support_role.id ], changed_by: current_user)
+
+user.has_permission?("manage_billing")        # a plain, manually created permission
+user.has_permission?("admin/accounts", :read) # a module-wise permission
 ```
 
 An actor can hold any number of roles at once; assigning a single role is
 just the `new_role_ids.size == 1` case of the same call.
 
-**2. Tell the engine who's making changes**, once, in your `ApplicationController`:
-
-```ruby
-before_action { Argus::Trail.current_actor = current_user }
-```
-
-**3. Authorize the admin screens.** If you have Pundit, define policies —
-Argus::Trail uses Pundit's normal lookup, so these are just regular
-policies:
+**Authorizing the admin screens.** With neither Pundit nor
+`config.authorize_with` configured, the admin screens default to "any
+signed-in actor" — they work out of the box with zero policies. Tighten
+this with Pundit:
 
 ```ruby
 class Argus::Trail::RolePolicy < ApplicationPolicy
@@ -78,11 +105,10 @@ class Argus::Trail::RolePolicy < ApplicationPolicy
 end
 ```
 
-Do the same for `Argus::Trail::PermissionPolicy` and
-`Argus::Trail::AuditEntryPolicy`. Without Pundit — e.g. if your app uses
-CanCanCan, Action Policy, or nothing at all — set `config.authorize_with` to
-a proc instead; it always takes priority over Pundit, so this works even if
-Pundit happens to also be in your Gemfile:
+(define the same for `Argus::Trail::PermissionPolicy` and
+`Argus::Trail::AuditEntryPolicy`), or with a proc — which always takes
+priority over Pundit, so this works even if Pundit happens to also be in
+your Gemfile:
 
 ```ruby
 # config/initializers/argus_trail.rb
@@ -93,18 +119,7 @@ end
 
 See [`docs/INTEGRATION_GUIDE.md`](docs/INTEGRATION_GUIDE.md#8-step-6--authorization)
 for a wiring example per authorization gem (Pundit, CanCanCan, Action
-Policy, plain proc). With neither Pundit nor `authorize_with` configured,
-the engine fails closed and raises an actionable error rather than silently
-allowing access.
-
-## Recording role changes on an actor
-
-Use `Actor#sync_roles!` (instead of assigning `role_ids=`/`roles=` directly)
-so assignments and revocations land in the audit log:
-
-```ruby
-user.sync_roles!(params[:role_ids], changed_by: current_user)
-```
+Policy, plain proc).
 
 ## Recording permission changes on a role
 
@@ -148,6 +163,8 @@ Argus::Trail.configure do |config|
   config.current_actor_method = :current_user
   config.per_page             = 30
   config.layout                = nil    # e.g. "application"
+  config.permission_scan_excludes = []  # extra controller paths for fetch_permissions to skip
+  config.action_name_mapper = ->(action) { ... }  # see lib/argus/trail/configuration.rb for the default
 end
 ```
 

data/app/controllers/argus/trail/application_controller.rb

@@ -18,27 +18,34 @@ module Argus
 
       # Call with a record (show/edit/update/destroy) or a class (index/new/create).
       # Resolution order: an explicitly configured proc always wins; otherwise, if
-      # Pundit is bundled, delegate to it (host must define policies, e.g.
-      # Argus::Trail::RolePolicy — same lookup Pundit already does for any
-      # namespaced record); otherwise fail closed with an actionable error.
+      # Pundit is bundled *and* a policy is actually defined for this record
+      # (e.g. Argus::Trail::RolePolicy), delegate to it; otherwise fall back to
+      # the plug-and-play default below so the admin screens work out of the
+      # box with no policies and no config.
       def authorize_access!(record_or_class)
         handler = Argus::Trail.config.authorize_with
         return handler.call(self, record_or_class) if handler
-        return authorize(record_or_class) if defined?(Pundit)
+        return authorize(record_or_class) if defined?(Pundit) && pundit_policy_defined?(record_or_class)
 
-        raise Argus::Trail::Configuration::MissingAuthorization
+        # No Pundit policy and no authorize_with configured — just require a
+        # signed-in actor. Define a policy or set config.authorize_with to
+        # tighten this further (e.g. restrict to admins only).
+        head :forbidden unless current_actor
       end
 
       # Scope a relation down to what the current actor may see. Only Pundit's
       # policy_scope narrows results; a custom authorize_with is a yes/no gate,
-      # not a scope, so it leaves the relation as-is.
+      # not a scope, so it leaves the relation as-is — same for the
+      # plug-and-play default.
       def authorized_scope(scope_class)
-        return authorized_scope_via_pundit(scope_class) if Argus::Trail.config.authorize_with.nil? && defined?(Pundit)
+        return policy_scope(scope_class) if Argus::Trail.config.authorize_with.nil? && defined?(Pundit) && pundit_policy_defined?(scope_class)
         scope_class.all
       end
 
-      def authorized_scope_via_pundit(scope_class)
-        policy_scope(scope_class)
+      def pundit_policy_defined?(record_or_class)
+        Pundit::PolicyFinder.new(record_or_class).policy.present?
+      rescue NameError
+        false
       end
     end
   end

data/app/controllers/argus/trail/permissions_controller.rb

@@ -56,7 +56,7 @@ module Argus
       end
 
       def permission_params
-        params.require(:permission).permit(:name, :description)
+        params.require(:permission).permit(:name, :description, :module_name, :action)
       end
 
       def permission_class = Argus::Trail.config.permission_class

data/app/controllers/argus/trail/roles_controller.rb

@@ -59,7 +59,7 @@ module Argus
       end
 
       def set_permissions
-        @permissions = permission_class.order(:name)
+        @grouped_permissions = permission_class.grouped_by_module
       end
 
       def role_params

data/app/models/argus/trail/permission.rb

@@ -4,8 +4,44 @@ module Argus
       has_many :role_permissions, class_name: Argus::Trail.config.role_permission_class_name, dependent: :destroy
       has_many :roles, through: :role_permissions
 
+      before_validation :set_derived_attributes
+
       validates :name, presence: true, uniqueness: true
       validates :description, presence: true
+      validates :action, uniqueness: { scope: :module_name }, if: -> { module_name.present? }
+
+      scope :module_wise, -> { where.not(module_name: nil) }
+
+      # Groups permissions by `module_name` (e.g. every permission generated
+      # from the "admin/accounts" controller) in the order the admin UI
+      # renders its checkbox matrix. Manually-created, module-less
+      # permissions land together under a `nil` key.
+      def self.grouped_by_module
+        order(:module_name, :action).group_by(&:module_name)
+      end
+
+      def module_permission?
+        module_name.present? && action.present?
+      end
+
+      def display_name
+        return name.humanize unless module_permission?
+
+        "#{module_name.humanize} — #{action.humanize}"
+      end
+
+      private
+
+      # Module-wise permissions (created by `rails argus_trail:fetch_permissions`,
+      # or by hand) derive their name/description from module_name + action so
+      # callers never have to invent one; a manually created, module-less
+      # permission just keeps whatever name/description it was given.
+      def set_derived_attributes
+        return unless module_permission?
+
+        self.name = name.presence || "#{module_name}##{action}"
+        self.description = description.presence || "#{action.to_s.humanize} access to #{module_name.to_s.humanize}"
+      end
     end
   end
 end

data/app/views/argus/trail/permissions/_form.html.erb

@@ -10,14 +10,32 @@
     </div>
   <% end %>
 
+  <div class="grid grid-cols-1 sm:grid-cols-2 gap-4">
+    <div>
+      <label class="block text-sm font-semibold text-gray-700 mb-1">Module</label>
+      <%= f.text_field :module_name, placeholder: "e.g. admin/accounts",
+          class: "block w-full px-3 py-2 border border-gray-300 rounded-lg text-sm shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500" %>
+      <p class="text-xs text-gray-400 mt-1">Leave blank for a one-off, module-less permission.</p>
+    </div>
+    <div>
+      <label class="block text-sm font-semibold text-gray-700 mb-1">Action</label>
+      <%= f.text_field :action, placeholder: "e.g. read",
+          class: "block w-full px-3 py-2 border border-gray-300 rounded-lg text-sm shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500" %>
+    </div>
+  </div>
+
   <div>
-    <label class="block text-sm font-semibold text-gray-700 mb-1">Permission Name <span class="text-red-500">*</span></label>
-    <%= f.text_field :name, placeholder: "e.g. manage_users",
+    <label class="block text-sm font-semibold text-gray-700 mb-1">
+      Permission Name <% unless permission.module_name.present? %><span class="text-red-500">*</span><% end %>
+    </label>
+    <%= f.text_field :name, placeholder: "e.g. manage_users — auto-filled from Module/Action above when both are set",
         class: "block w-full px-3 py-2 border border-gray-300 rounded-lg text-sm shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500" %>
   </div>
 
   <div>
-    <label class="block text-sm font-semibold text-gray-700 mb-1">Description <span class="text-red-500">*</span></label>
+    <label class="block text-sm font-semibold text-gray-700 mb-1">
+      Description <% unless permission.module_name.present? %><span class="text-red-500">*</span><% end %>
+    </label>
     <%= f.text_area :description, rows: 2,
         class: "block w-full px-3 py-2 border border-gray-300 rounded-lg text-sm shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500 resize-none" %>
   </div>

data/app/views/argus/trail/permissions/edit.html.erb

@@ -1,7 +1,7 @@
 <div class="max-w-3xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
   <div class="flex items-center gap-4 mb-8">
     <%= link_to "← Back", permission_path(@permission), class: "text-gray-400 hover:text-gray-600" %>
-    <h1 class="text-2xl font-bold text-gray-900">Edit Permission: <%= @permission.name.humanize %></h1>
+    <h1 class="text-2xl font-bold text-gray-900">Edit Permission: <%= @permission.display_name %></h1>
   </div>
 
   <div class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">

data/app/views/argus/trail/permissions/index.html.erb

@@ -13,6 +13,7 @@
         <thead class="bg-gray-50">
           <tr>
             <th class="px-6 py-3 text-left text-xs font-semibold text-gray-500 uppercase tracking-wider">Permission</th>
+            <th class="px-6 py-3 text-left text-xs font-semibold text-gray-500 uppercase tracking-wider">Module</th>
             <th class="px-6 py-3 text-left text-xs font-semibold text-gray-500 uppercase tracking-wider">Description</th>
             <th class="px-6 py-3 text-left text-xs font-semibold text-gray-500 uppercase tracking-wider">Roles</th>
             <th class="px-6 py-3 text-right text-xs font-semibold text-gray-500 uppercase tracking-wider">Actions</th>
@@ -21,9 +22,10 @@
         <tbody class="bg-white divide-y divide-gray-200">
           <% @permissions.each do |permission| %>
             <tr class="hover:bg-gray-50 transition-colors">
-              <td class="px-6 py-4 whitespace-nowrap text-sm font-medium text-gray-900"><%= permission.name.humanize %></td>
+              <td class="px-6 py-4 whitespace-nowrap text-sm font-medium text-gray-900"><%= permission.display_name %></td>
+              <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500"><%= permission.module_name&.humanize %></td>
               <td class="px-6 py-4 text-sm text-gray-600"><%= permission.description %></td>
-              <td class="px-6 py-4 text-sm text-gray-600"><%= permission.roles.count %></td>
+              <td class="px-6 py-4 text-sm text-gray-600"><%= permission.roles.size %></td>
               <td class="px-6 py-4 whitespace-nowrap text-right text-sm font-medium">
                 <div class="flex items-center justify-end gap-3">
                   <%= link_to "View", permission_path(permission), class: "text-blue-600 hover:text-blue-800" %>

data/app/views/argus/trail/permissions/show.html.erb

@@ -3,7 +3,7 @@
     <div class="flex items-center gap-4">
       <%= link_to "← Back", permissions_path, class: "text-gray-400 hover:text-gray-600" %>
       <div>
-        <h1 class="text-2xl font-bold text-gray-900"><%= @permission.name.humanize %></h1>
+        <h1 class="text-2xl font-bold text-gray-900"><%= @permission.display_name %></h1>
         <p class="text-sm text-gray-500 mt-0.5"><%= @permission.description %></p>
       </div>
     </div>

data/app/views/argus/trail/roles/_form.html.erb

@@ -23,22 +23,40 @@
 
   <div>
     <label class="block text-sm font-semibold text-gray-700 mb-3">Permissions</label>
-    <div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
-      <% @permissions.each do |permission| %>
-        <label class="flex items-start gap-3 p-3 border border-gray-200 rounded-lg hover:border-indigo-300 hover:bg-indigo-50/50 cursor-pointer">
-          <input type="checkbox" name="permission_ids[]" value="<%= permission.id %>"
-                 <%= "checked" if role.permission_ids.include?(permission.id) %>
-                 class="mt-0.5 h-4 w-4 rounded border-gray-300 text-indigo-600 focus:ring-indigo-500">
-          <div>
-            <p class="text-sm font-medium text-gray-800"><%= permission.name.humanize %></p>
-            <p class="text-xs text-gray-500 mt-0.5"><%= permission.description %></p>
+
+    <div class="space-y-4">
+      <% @grouped_permissions.sort_by { |module_name, _| module_name.to_s }.each do |module_name, permissions| %>
+        <div class="argus-trail-permission-group border border-gray-200 rounded-lg overflow-hidden">
+          <div class="flex items-center gap-2 bg-gray-50 px-4 py-2 border-b border-gray-200">
+            <input type="checkbox" class="argus-trail-module-toggle h-4 w-4 rounded border-gray-300 text-indigo-600 focus:ring-indigo-500"
+                   <%= "checked" if permissions.all? { |p| role.permission_ids.include?(p.id) } %>
+                   onclick="const group = this.closest('.argus-trail-permission-group'); group.querySelectorAll('.argus-trail-permission-checkbox').forEach(cb => cb.checked = this.checked)">
+            <span class="text-sm font-semibold text-gray-700">
+              <%= module_name.present? ? module_name.humanize : "General" %>
+            </span>
+          </div>
+          <div class="grid grid-cols-1 sm:grid-cols-2 gap-3 p-4">
+            <% permissions.each do |permission| %>
+              <label class="flex items-start gap-3 p-3 border border-gray-200 rounded-lg hover:border-indigo-300 hover:bg-indigo-50/50 cursor-pointer">
+                <input type="checkbox" name="permission_ids[]" value="<%= permission.id %>"
+                       <%= "checked" if role.permission_ids.include?(permission.id) %>
+                       class="argus-trail-permission-checkbox mt-0.5 h-4 w-4 rounded border-gray-300 text-indigo-600 focus:ring-indigo-500"
+                       onchange="const group = this.closest('.argus-trail-permission-group'); group.querySelector('.argus-trail-module-toggle').checked = [...group.querySelectorAll('.argus-trail-permission-checkbox')].every(cb => cb.checked)">
+                <div>
+                  <p class="text-sm font-medium text-gray-800"><%= permission.module_permission? ? permission.action.humanize : permission.name.humanize %></p>
+                  <p class="text-xs text-gray-500 mt-0.5"><%= permission.description %></p>
+                </div>
+              </label>
+            <% end %>
           </div>
-        </label>
+        </div>
       <% end %>
     </div>
-    <% if @permissions.empty? %>
+
+    <% if @grouped_permissions.empty? %>
       <p class="text-sm text-gray-400 italic mt-2">
-        No permissions exist yet. <%= link_to "Create one first", new_permission_path %>.
+        No permissions exist yet. <%= link_to "Create one first", new_permission_path %>, or run
+        <code class="bg-gray-100 px-1 rounded">bin/rails argus_trail:fetch_permissions</code> to generate them from your routes.
       </p>
     <% end %>
   </div>

data/app/views/argus/trail/roles/index.html.erb

@@ -32,12 +32,12 @@
                   <% if role.permissions.any? %>
                     <% role.permissions.first(3).each do |perm| %>
                       <span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-indigo-50 text-indigo-700 border border-indigo-100">
-                        <%= perm.name.humanize %>
+                        <%= perm.display_name %>
                       </span>
                     <% end %>
-                    <% if role.permissions.count > 3 %>
+                    <% if role.permissions.size > 3 %>
                       <span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-gray-100 text-gray-600">
-                        +<%= role.permissions.count - 3 %> more
+                        +<%= role.permissions.size - 3 %> more
                       </span>
                     <% end %>
                   <% else %>

data/app/views/argus/trail/roles/show.html.erb

@@ -15,9 +15,9 @@
       <h2 class="text-base font-semibold text-gray-900 mb-4">Permissions (<%= @role.permissions.count %>)</h2>
       <% if @role.permissions.any? %>
         <div class="space-y-2">
-          <% @role.permissions.order(:name).each do |perm| %>
+          <% @role.permissions.order(:module_name, :action, :name).each do |perm| %>
             <div class="p-3 bg-indigo-50 rounded-lg">
-              <p class="text-sm font-medium text-indigo-900"><%= perm.name.humanize %></p>
+              <p class="text-sm font-medium text-indigo-900"><%= perm.display_name %></p>
               <p class="text-xs text-indigo-600 mt-0.5"><%= perm.description %></p>
             </div>
           <% end %>

data/lib/argus/trail/actor.rb

@@ -24,8 +24,37 @@ module Argus
                  as: :changed_by, class_name: "Argus::Trail::AuditEntry", dependent: :nullify
       end
 
-      def has_permission?(permission_name)
-        roles.joins(:permissions).exists?(Argus::Trail.config.permission_class.table_name => { name: permission_name })
+      # Two calling conventions:
+      #   has_permission?("manage_billing")        — match a plain permission name
+      #   has_permission?("admin/accounts", :read)  — match a module-wise permission
+      #                                                (module_name + action), e.g. the
+      #                                                ones `argus_trail:fetch_permissions`
+      #                                                generates from your routes.
+      #
+      # Memoized per actor instance/per (name|module+action) pair — a single
+      # request typically loads `current_user` once and then asks it several
+      # has_permission? questions across controllers/views (e.g. one per
+      # Argus::Trail::Authorizable-gated controller, plus any UI that checks
+      # a few more to decide what to show); without this, each of those re-ran
+      # the same roles->permissions join query. Cleared by sync_roles! below,
+      # since that's the only thing in this concern that can change the
+      # answer for an already-loaded actor.
+      def has_permission?(module_name_or_permission_name, action = nil)
+        cache_key = [ module_name_or_permission_name.to_s, action&.to_s ]
+        @argus_trail_permission_cache ||= {}
+        return @argus_trail_permission_cache[cache_key] if @argus_trail_permission_cache.key?(cache_key)
+
+        table = Argus::Trail.config.permission_class.table_name
+        scope = roles.joins(:permissions)
+
+        result =
+          if action.nil?
+            scope.exists?(table => { name: cache_key[0] })
+          else
+            scope.exists?(table => { module_name: cache_key[0], action: cache_key[1] })
+          end
+
+        @argus_trail_permission_cache[cache_key] = result
       end
 
       # Diffs the requested role ids against the actor's current ones and
@@ -49,6 +78,8 @@ module Argus
             argus_trail_record_role_change("role_revoked", role, changed_by)
           end
         end
+
+        @argus_trail_permission_cache = nil
       end
 
       private

data/lib/argus/trail/authorizable.rb

@@ -0,0 +1,38 @@
+module Argus
+  module Trail
+    # Include in any of *your* controllers to gate every action behind a
+    # module-wise permission — zero further code required:
+    #
+    #   class AccountsController < ApplicationController
+    #     include Argus::Trail::Authorizable
+    #   end
+    #
+    # The required permission is derived automatically from the controller
+    # and action, using the exact same convention
+    # `bin/rails argus_trail:fetch_permissions` used to create the Permission
+    # rows in the first place: module_name is `controller_path` (e.g.
+    # "admin/accounts"), and the action is normalized through
+    # `Argus::Trail.config.action_name_mapper` (index/show -> read, new/create
+    # -> create, edit/update -> update, destroy -> destroy, anything else kept
+    # as-is). A signed-in actor without a role granting that permission gets a
+    # 403; a signed-out request also gets a 403 (authenticate first in your
+    # own `before_action` if you need a redirect to a login page instead).
+    module Authorizable
+      extend ActiveSupport::Concern
+
+      included do
+        before_action :argus_trail_authorize_permission!
+      end
+
+      private
+
+      def argus_trail_authorize_permission!
+        actor = send(Argus::Trail.config.current_actor_method)
+        return head :forbidden unless actor
+
+        action = Argus::Trail.config.action_name_mapper.call(action_name)
+        head :forbidden unless actor.has_permission?(controller_path, action)
+      end
+    end
+  end
+end

data/lib/argus/trail/configuration.rb

@@ -1,18 +1,10 @@
 module Argus
   module Trail
     class Configuration
-      class MissingAuthorization < StandardError
-        def message
-          "Argus::Trail could not determine how to authorize access to its admin screens. " \
-            "Either add Pundit to your Gemfile with Argus::Trail::Role/Permission policies, " \
-            "or set `config.authorize_with` in config/initializers/argus_trail.rb " \
-            "(e.g. `config.authorize_with = ->(controller, record) { controller.current_user&.admin? }`)."
-        end
-      end
-
       attr_accessor :actor_class_name, :role_class_name, :permission_class_name,
                     :role_permission_class_name, :changed_by_resolver, :authorize_with,
-                    :current_actor_method, :per_page, :layout
+                    :current_actor_method, :per_page, :layout,
+                    :permission_scan_excludes, :action_name_mapper
 
       def initialize
         @actor_class_name           = "User"
@@ -24,6 +16,27 @@ module Argus
         @current_actor_method = :current_user
         @per_page            = 30
         @layout              = nil
+
+        # Used by `bin/rails argus_trail:fetch_permissions` when scanning your
+        # app's routes to build module-wise (controller x action) permissions.
+        # Extra controller paths (strings or Regexps) to skip, on top of the
+        # engine's own routes and framework-internal ones (Rails health check,
+        # Active Storage, Action Mailbox/Text), which are always excluded.
+        @permission_scan_excludes = []
+
+        # How a route's Rails action name maps to the permission's `action`
+        # column. Default collapses the standard 7 REST actions down to the
+        # 4 CRUD-ish verbs the admin UI groups checkboxes by; anything else
+        # (a custom member/collection action) is kept as-is.
+        @action_name_mapper = lambda do |action|
+          case action.to_s
+          when "index", "show" then "read"
+          when "new", "create" then "create"
+          when "edit", "update" then "update"
+          when "destroy" then "destroy"
+          else action.to_s
+          end
+        end
       end
 
       def actor_class

data/lib/argus/trail/permission_scanner.rb

@@ -0,0 +1,59 @@
+module Argus
+  module Trail
+    # Scans the host app's routes to build the (module_name, action) pairs
+    # that back module-wise permissions — the same data `bin/rails
+    # argus_trail:fetch_permissions` syncs into Permission rows, and that
+    # Argus::Trail::Authorizable checks a signed-in actor against.
+    #
+    # `module_name` is a route's controller path exactly as Rails reports it
+    # (e.g. "admin/accounts", "sessions") — the same string
+    # `ActionController::Metal#controller_path` returns at runtime, so a
+    # scanned permission always lines up with the controller it came from.
+    class PermissionScanner
+      DEFAULT_EXCLUDES = [
+        %r{\Aargus/trail/},
+        %r{\Arails/},
+        %r{\Aactive_storage/},
+        %r{\Aaction_mailbox/},
+        %r{\Aaction_text/},
+        "rails/health_check"
+      ].freeze
+
+      def self.scan
+        new.scan
+      end
+
+      # Array of unique [module_name, action] pairs across every routed
+      # controller action, actions already normalized via
+      # `Argus::Trail.config.action_name_mapper`.
+      def scan
+        Rails.application.eager_load!
+
+        routes.filter_map { |route| build_pair(route) }.uniq
+      end
+
+      private
+
+      def routes
+        Rails.application.routes.routes
+      end
+
+      def build_pair(route)
+        controller = route.defaults[:controller]
+        action = route.defaults[:action]
+        return if controller.blank? || action.blank?
+        return if excluded?(controller)
+
+        [ controller, Argus::Trail.config.action_name_mapper.call(action) ]
+      end
+
+      def excluded?(controller)
+        excludes.any? { |pattern| pattern.is_a?(Regexp) ? pattern.match?(controller) : pattern.to_s == controller }
+      end
+
+      def excludes
+        DEFAULT_EXCLUDES + Array(Argus::Trail.config.permission_scan_excludes)
+      end
+    end
+  end
+end

data/lib/argus/trail/version.rb

@@ -1,5 +1,5 @@
 module Argus
   module Trail
-    VERSION = "0.1.0"
+    VERSION = "0.2.0"
   end
 end

data/lib/argus/trail.rb

@@ -2,6 +2,8 @@ require "argus/trail/version"
 require "argus/trail/configuration"
 require "argus/trail/current"
 require "argus/trail/actor"
+require "argus/trail/authorizable"
+require "argus/trail/permission_scanner"
 require "argus/trail/pagination"
 require "argus/trail/engine"
 

data/lib/generators/argus/trail/install/install_generator.rb

@@ -10,6 +10,9 @@ module Argus
 
         source_root File.expand_path("templates", __dir__)
 
+        class_option :actor, type: :string, default: "User",
+                     desc: "Name of your actor/user model — gets `include Argus::Trail::Actor`"
+
         def self.next_migration_number(dirname)
           ActiveRecord::Migration.next_migration_number(current_migration_number(dirname) + 1)
         end
@@ -31,6 +34,48 @@ module Argus
           route 'mount Argus::Trail::Engine => "/admin/access"'
         end
 
+        # No code needed beyond running this generator: opts your actor model
+        # into role assignment/permission checks automatically, instead of
+        # asking you to add `include Argus::Trail::Actor` by hand.
+        def include_actor_concern
+          model_file = File.expand_path("app/models/#{actor_file_name}.rb", destination_root)
+
+          unless File.exist?(model_file)
+            say_status :skip,
+                       "app/models/#{actor_file_name}.rb not found — add `include Argus::Trail::Actor` " \
+                       "to your actor model by hand (run with --actor=YourModel if it's not User)", :yellow
+            return
+          end
+
+          if File.read(model_file).include?("Argus::Trail::Actor")
+            say_status :skip, "app/models/#{actor_file_name}.rb already includes Argus::Trail::Actor", :blue
+            return
+          end
+
+          inject_into_class model_file, options[:actor], "  include Argus::Trail::Actor\n\n"
+        end
+
+        # Likewise, wires up "who's making this change" for the audit log
+        # automatically instead of asking for a manual before_action.
+        def wire_current_actor
+          controller_file = File.expand_path("app/controllers/application_controller.rb", destination_root)
+
+          unless File.exist?(controller_file)
+            say_status :skip,
+                       "app/controllers/application_controller.rb not found — add " \
+                       "`before_action { Argus::Trail.current_actor = current_user }` by hand", :yellow
+            return
+          end
+
+          if File.read(controller_file).include?("Argus::Trail.current_actor")
+            say_status :skip, "application_controller.rb already wires Argus::Trail.current_actor", :blue
+            return
+          end
+
+          inject_into_class controller_file, "ApplicationController",
+                             "  before_action { Argus::Trail.current_actor = current_user }\n\n"
+        end
+
         def show_readme
           readme "POST_INSTALL" if behavior == :invoke
         end
@@ -40,6 +85,10 @@ module Argus
         def migration_version
           "[#{ActiveRecord::Migration.current_version}]"
         end
+
+        def actor_file_name
+          options[:actor].underscore
+        end
       end
     end
   end

data/lib/generators/argus/trail/install/templates/POST_INSTALL

@@ -2,40 +2,42 @@
 Argus::Trail installed
 ========================================================================
 
+Done automatically by this generator:
+  - config/initializers/argus_trail.rb written
+  - migration for argus_trail_roles/permissions/role_permissions/
+    role_assignments/audit_entries created
+  - Argus::Trail::Engine mounted in config/routes.rb (default /admin/access)
+  - `include Argus::Trail::Actor` added to your actor model (--actor=User
+    by default — rerun with --actor=YourModel if you skipped this)
+  - `before_action { Argus::Trail.current_actor = current_user }` added to
+    ApplicationController
+
 Next steps:
 
-1. Run the migrations:
+1. Run the migration:
      bin/rails db:migrate
 
-2. Add one line to the user/account model you configured as actor_class_name.
-   No migration needed on that model — roles live in the engine's own
-   polymorphic join table, so an actor can hold any number of roles:
-
-     class User < ApplicationRecord
-       include Argus::Trail::Actor
-     end
-
-3. Tell the engine who's making each change, once, in your ApplicationController:
+2. Generate module-wise permissions from your existing routes:
+     bin/rails argus_trail:fetch_permissions
 
-     class ApplicationController < ActionController::Base
-       before_action { Argus::Trail.current_actor = current_user }
-     end
+   Re-run it any time you add controllers/actions — it only ever adds new
+   permissions. `bin/rails argus_trail:fetch_permissions:prune` removes ones
+   whose route is gone and that aren't granted to any role.
 
-4. If you have Pundit in your Gemfile, define policies for the engine's
-   records so its admin screens know who's allowed in, e.g.:
+3. Gate your own controllers behind a permission with one line — no further
+   code needed, the required permission is derived from the controller and
+   action automatically:
 
-     class Argus::Trail::RolePolicy < ApplicationPolicy
-       def index? = user.admin?
-       def show?  = user.admin?
-       # ...
+     class AccountsController < ApplicationController
+       include Argus::Trail::Authorizable
      end
 
-   Do the same for Argus::Trail::PermissionPolicy and
-   Argus::Trail::AuditEntryPolicy. No Pundit? Set config.authorize_with
-   in config/initializers/argus_trail.rb instead.
-
-5. Visit the mounted engine (default /admin/access, see config/routes.rb)
-   to manage roles, permissions, and view the audit log.
+4. Visit the mounted engine (default /admin/access, see config/routes.rb) to
+   create roles, assign permissions, and assign roles to actors. With
+   neither Pundit policies nor config.authorize_with set, the admin screens
+   are open to any signed-in actor — define
+   Argus::Trail::RolePolicy/PermissionPolicy/AuditEntryPolicy (Pundit) or set
+   config.authorize_with to restrict further (e.g. to admins only).
 
 Want to customize the HTML? Run:
      bin/rails generate argus:trail:views

data/lib/generators/argus/trail/install/templates/create_argus_trail_tables.rb.erb

@@ -10,9 +10,20 @@ class CreateArgusTrailTables < ActiveRecord::Migration<%= migration_version %>
     create_table :argus_trail_permissions do |t|
       t.string :name, null: false
       t.string :description
+      # module_name/action back "module-wise" permissions — the rows
+      # `bin/rails argus_trail:fetch_permissions` generates from your routes
+      # (e.g. module_name: "admin/accounts", action: "read"). Both stay nil
+      # for a manually created, one-off permission.
+      t.string :module_name
+      t.string :action
       t.timestamps
     end
     add_index :argus_trail_permissions, :name, unique: true
+    # Composite, not module_name alone — every module-wise permission lookup
+    # (Actor#has_permission?, Authorizable) filters on both columns together,
+    # and the leftmost-prefix rule means this still serves a module_name-only
+    # query (grouped_by_module) just as well as a single-column index would.
+    add_index :argus_trail_permissions, [ :module_name, :action ]
 
     create_table :argus_trail_role_permissions do |t|
       t.references :role, null: false, foreign_key: { to_table: :argus_trail_roles }
@@ -43,5 +54,10 @@ class CreateArgusTrailTables < ActiveRecord::Migration<%= migration_version %>
       t.datetime :created_at, null: false
     end
     add_index :argus_trail_audit_entries, :event_type
+    # This table is append-only and grows forever (see AuditEntry's class
+    # comment) — .recent orders by created_at DESC on every paginated page
+    # load, and the admin screen's "Today" stat filters on it too, so an
+    # unindexed created_at turns into a full-table sort/scan as the log grows.
+    add_index :argus_trail_audit_entries, :created_at
   end
 end

data/lib/generators/argus/trail/install/templates/initializer.rb

@@ -23,9 +23,10 @@ Argus::Trail.configure do |config|
   # config.changed_by_resolver = -> { Argus::Trail.current_actor }
 
   # Gate for who may use the roles/permissions/audit-log admin screens.
-  # Left unset, Argus::Trail falls back to Pundit if it's in your Gemfile
-  # (define Argus::Trail::RolePolicy / PermissionPolicy / AuditEntryPolicy)
-  # — otherwise it raises until you set one of the two.
+  # Left unset, Argus::Trail falls back to Pundit if it's in your Gemfile and
+  # a policy is defined (e.g. Argus::Trail::RolePolicy) — otherwise it just
+  # requires someone to be signed in, so the admin screens work out of the
+  # box with zero policies/config. Tighten either way you like:
   # config.authorize_with = ->(controller, record_or_class) { controller.current_user&.admin? }
 
   # The method the engine calls on its controllers to get the logged-in actor.
@@ -37,4 +38,16 @@ Argus::Trail.configure do |config|
   # Render engine screens inside one of your app's own layouts instead of
   # the engine's self-contained Tailwind-CDN layout.
   # config.layout = "application"
+
+  # Extra controller paths `bin/rails argus_trail:fetch_permissions` should
+  # skip when scanning your routes to build module-wise permissions (strings
+  # or Regexps). The engine's own routes and Rails-internal ones (health
+  # check, Active Storage, Action Mailbox/Text) are always skipped.
+  # config.permission_scan_excludes = [ "rails/conductor", %r{\Aadmin/sidekiq} ]
+
+  # How a scanned route's Rails action name maps to a permission's `action`
+  # column — also used by Argus::Trail::Authorizable. Defaults to collapsing
+  # index/show -> read, new/create -> create, edit/update -> update,
+  # destroy -> destroy, and keeping anything else (a custom action) as-is.
+  # config.action_name_mapper = ->(action) { action.to_s }
 end

data/lib/generators/argus/trail/upgrade_v0_2/templates/POST_INSTALL

@@ -0,0 +1,24 @@
+========================================================================
+Argus::Trail upgrade migration generated
+========================================================================
+
+This adds what's new to your existing install:
+  - module_name/action columns on argus_trail_permissions
+  - a composite index on (module_name, action)
+  - an index on argus_trail_audit_entries.created_at
+
+Next steps:
+
+1. Run it:
+     bin/rails db:migrate
+
+2. Generate module-wise permissions from your existing routes:
+     bin/rails argus_trail:fetch_permissions
+
+3. (Optional) Gate your own controllers behind a permission with one line:
+     class AccountsController < ApplicationController
+       include Argus::Trail::Authorizable
+     end
+
+See README.md and docs/INTEGRATION_GUIDE.md for the full picture.
+========================================================================

data/lib/generators/argus/trail/upgrade_v0_2/templates/add_module_wise_permissions_and_audit_index.rb.erb

@@ -0,0 +1,21 @@
+class ArgusTrailAddModuleWisePermissionsAndAuditIndex < ActiveRecord::Migration<%= migration_version %>
+  def change
+    # Every step below is guarded so this is safe to run twice, and safe even
+    # on a host where create_argus_trail_tables already created these (every
+    # check just becomes a no-op) — this migration only exists for hosts
+    # upgrading from a version of argus-trail that predates module-wise
+    # permissions.
+    unless column_exists?(:argus_trail_permissions, :module_name)
+      add_column :argus_trail_permissions, :module_name, :string
+    end
+    unless column_exists?(:argus_trail_permissions, :action)
+      add_column :argus_trail_permissions, :action, :string
+    end
+    unless index_exists?(:argus_trail_permissions, [ :module_name, :action ])
+      add_index :argus_trail_permissions, [ :module_name, :action ]
+    end
+    unless index_exists?(:argus_trail_audit_entries, :created_at)
+      add_index :argus_trail_audit_entries, :created_at
+    end
+  end
+end

data/lib/generators/argus/trail/upgrade_v0_2/upgrade_v0_2_generator.rb

@@ -0,0 +1,42 @@
+require "rails/generators"
+require "rails/generators/migration"
+require "active_record"
+
+module Argus
+  module Trail
+    module Generators
+      # Upgrade path for a host that installed argus-trail before module-wise
+      # permissions existed (argus_trail_permissions had no module_name/action
+      # columns, argus_trail_audit_entries had no index on created_at). A
+      # fresh install never needs this — create_argus_trail_tables already
+      # includes both — this generator exists purely for pre-existing hosts
+      # upgrading the gem in place.
+      #
+      # Usage: bin/rails generate argus:trail:upgrade_v0_2 && bin/rails db:migrate
+      class UpgradeV02Generator < Rails::Generators::Base
+        include Rails::Generators::Migration
+
+        source_root File.expand_path("templates", __dir__)
+
+        def self.next_migration_number(dirname)
+          ActiveRecord::Migration.next_migration_number(current_migration_number(dirname) + 1)
+        end
+
+        def create_upgrade_migration
+          migration_template "add_module_wise_permissions_and_audit_index.rb.erb",
+                              "db/migrate/argus_trail_add_module_wise_permissions_and_audit_index.rb"
+        end
+
+        def show_readme
+          readme "POST_INSTALL" if behavior == :invoke
+        end
+
+        private
+
+        def migration_version
+          "[#{ActiveRecord::Migration.current_version}]"
+        end
+      end
+    end
+  end
+end

data/lib/tasks/argus_trail.rake

@@ -0,0 +1,40 @@
+namespace :argus_trail do
+  desc "Scan your app's routes and create any missing module-wise Argus::Trail::Permission records"
+  task fetch_permissions: :environment do
+    permission_class = Argus::Trail.config.permission_class
+    pairs = Argus::Trail::PermissionScanner.scan
+    existing = permission_class.module_wise.pluck(:module_name, :action).to_set
+
+    created = pairs.reject { |pair| existing.include?(pair) }.map do |module_name, action|
+      permission_class.create!(module_name: module_name, action: action)
+    end
+
+    puts "Argus::Trail: scanned #{pairs.size} controller/action pair(s), " \
+         "created #{created.size} new permission(s)."
+    created.each { |permission| puts "  + #{permission.module_name}##{permission.action}" }
+  end
+
+  namespace :fetch_permissions do
+    desc "Remove module-wise Argus::Trail::Permission records whose route no longer exists " \
+         "and that aren't granted to any role"
+    task prune: :environment do
+      permission_class = Argus::Trail.config.permission_class
+      current_pairs = Argus::Trail::PermissionScanner.scan.to_set
+
+      orphaned = permission_class.module_wise.reject { |permission| current_pairs.include?([ permission.module_name, permission.action ]) }
+      removable, blocked = orphaned.partition { |permission| permission.roles.none? }
+
+      removable.each(&:destroy!)
+
+      puts "Argus::Trail: removed #{removable.size} orphaned permission(s)."
+      removable.each { |permission| puts "  - #{permission.module_name}##{permission.action}" }
+
+      if blocked.any?
+        puts "Argus::Trail: left #{blocked.size} orphaned permission(s) in place — still granted to a role:"
+        blocked.each do |permission|
+          puts "  ! #{permission.module_name}##{permission.action} (role(s): #{permission.roles.pluck(:name).join(', ')})"
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: argus-trail
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Ram Laxman Yadav
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-11 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -24,17 +23,19 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '6.1'
-description: Plug-and-play role/permission management with a unified audit log of
-  role reassignments and permission grants/revokes, shipped as a mountable engine
-  with paginated HTML admin screens and generators for install/views/config. Agnostic
-  to auth (works standalone, auto-integrates with Pundit) and pagination (auto-integrates
-  with Kaminari).
+description: Plug-and-play role/permission management with module-wise permissions
+  generated from your own routes, one-line controller enforcement, and a unified audit
+  log of role reassignments and permission grants/revokes — shipped as a mountable
+  engine with paginated HTML admin screens and generators for install/views/config.
+  Agnostic to auth (works standalone, auto-integrates with Pundit) and pagination
+  (auto-integrates with Kaminari).
 email:
 - yadavramlaxman@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - MIT-LICENSE
 - README.md
 - Rakefile
@@ -65,24 +66,32 @@ files:
 - config/routes.rb
 - lib/argus/trail.rb
 - lib/argus/trail/actor.rb
+- lib/argus/trail/authorizable.rb
 - lib/argus/trail/configuration.rb
 - lib/argus/trail/current.rb
 - lib/argus/trail/engine.rb
 - lib/argus/trail/pagination.rb
+- lib/argus/trail/permission_scanner.rb
 - lib/argus/trail/version.rb
 - lib/generators/argus/trail/config/config_generator.rb
 - lib/generators/argus/trail/install/install_generator.rb
 - lib/generators/argus/trail/install/templates/POST_INSTALL
 - lib/generators/argus/trail/install/templates/create_argus_trail_tables.rb.erb
 - lib/generators/argus/trail/install/templates/initializer.rb
+- lib/generators/argus/trail/upgrade_v0_2/templates/POST_INSTALL
+- lib/generators/argus/trail/upgrade_v0_2/templates/add_module_wise_permissions_and_audit_index.rb.erb
+- lib/generators/argus/trail/upgrade_v0_2/upgrade_v0_2_generator.rb
 - lib/generators/argus/trail/views/views_generator.rb
-homepage: https://github.com/reddoorz/argus-trail
+- lib/tasks/argus_trail.rake
+homepage: https://ramlaxmanyadav.github.io/argus-trail/
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/reddoorz/argus-trail
-  source_code_uri: https://github.com/reddoorz/argus-trail
-post_install_message:
+  source_code_uri: https://github.com/ramlaxmanyadav/argus-trail
+  documentation_uri: https://ramlaxmanyadav.github.io/argus-trail/
+  changelog_uri: https://github.com/ramlaxmanyadav/argus-trail/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/ramlaxmanyadav/argus-trail/issues
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -97,8 +106,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Mountable Rails engine for roles, permissions, and an audit trail of who
   changed what.