concerns_on_rails 1.11.1 → 1.12.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f8d7976f6ba1afbdd29545f992c77fe50f42771828cb01ae14ea4dc194d6f36a
-  data.tar.gz: d159c7e96f3e430e71aa9d3d18f5ce8d70323cb6c13cb8fd403c8b122c4a0fb8
+  metadata.gz: 56664d3e955f53dbeec1d586c31b57c860a208cedff76990236a728de1c6f9ec
+  data.tar.gz: 6a427597a32d8a2d848d2f51ed9cf45d6a3ea41dd9ea77c2b215b4a66846170e
 SHA512:
-  metadata.gz: da311c75a34438a39c2bc2e2dc48916e205a15fee4aa40aeb609136ad2a26cba40b3c2ca919f5812e48aedde54bd22ac72ff778e86162e1f4ef29920468470b2
-  data.tar.gz: 9ad51a591b17b48c79afcb571090aa402338a87f491c0aba2f27b89ad0d28fd16f1e5a89b9f54f61790cc1c5ac15bec35e97698b3f7afefd157144cf513101c3
+  metadata.gz: b34bc02259d6a33a0d1fa1dac2f2e71473cc543515df2088766b736eed4cdc8e9925616cca6397a5318d22bdcafbf910e8bea6ea9f93e1de4746613f3aa747b2
+  data.tar.gz: 52e3f5a2dda49da303b118a4962ca479bb43b628d363ff133c23939fc523235a01065441cea4002dccd33130ace25149da275ddb9839dc864b2e442377f88a28

data/CHANGELOG.md

@@ -1,5 +1,30 @@
 <!-- CHANGELOG.md -->
 
+## 1.12.1 (2026-06-06)
+
+### Added
+- **Models::Sanitizable**: opt-in HTML sanitization for string attributes — defense-in-depth on top of Rails' default output escaping (not a replacement for it). `sanitizable :body, with: :safe_list` is **non-destructive by default** (`on: :read`): it adds a `sanitized_<field>` reader and leaves the stored column raw. `on: :write` is an explicit, lossy opt-in that overwrites the column in `before_validation` (so presence/length validations see the cleaned value). Presets: `:strip` (remove all tags), `:safe_list` (Rails' allow-list), `:no_links`, `:none`, plus custom `Array` / `Hash` (`{ tags:, attributes: }`) allow-lists and a `Proc` escape hatch. Schema-checked via `ColumnGuard`. Zero new runtime dependencies.
+- **Controllers::SecureHeadable**: modern security response headers + a thin delegation to Rails' native Content-Security-Policy DSL. `secure_headers :nosniff, :sameorigin_frame, :no_referrer_leak, :no_cross_domain, :disable_legacy_xss` (and custom `"Header-Name" => "value"` pairs), applied in an `after_action`. `content_security_policy_for(report_only:, only:, except:, …, &block)` forwards straight to Rails. Ships `X-XSS-Protection: 0` (the only correct modern value) and deliberately does **not** scrub params. Zero new runtime dependencies.
+- **Support::HtmlSanitizers**: shared, lazily-memoized, feature-detected (HTML5/HTML4) `FullSanitizer` / `SafeListSanitizer` / `LinkSanitizer` instances backing `Models::Sanitizable`, reusing the `rails-html-sanitizer` that already ships with Action View.
+
+### Notes
+- All changes are additive and backward-compatible. `ConcernsOnRails::Sanitizable` is aliased to `Models::Sanitizable`; the controller concern stays namespace-only (`ConcernsOnRails::Controllers::SecureHeadable`), matching the existing controller concerns.
+- These features were first tagged as `1.12.0`, but that tag's CI lint failed before the RubyGems publish step, so it was never released. `1.12.1` is the first published version carrying them.
+
+## 1.11.2 (2026-06-06)
+
+### Added
+- **Models::Taggable**: Lightweight, dependency-free tagging over a single string column (no join tables, no tagging engine; works on any database including SQLite). `taggable_by :tags` adds `tag_list` get/set (accepts a String or an Array, stripped + de-duped), `add_tags` / `remove_tags`, a `tagged_with?` predicate, a boundary-safe `tagged_with(*tags, any:)` class scope (AND by default, OR with `any: true`), and `all_tags`. Options: `delimiter:` and `downcase:`. Reach for `acts-as-taggable-on` when you need tag contexts, ownership, or tag clouds.
+- **Models::SoftDeletable**: `soft_deletable_by` gained `default_scope:` (default `true`) to opt out of the deleted-hiding `default_scope`; new explicit `soft_delete_all` class method (preferred over the `destroy_all` override).
+- **Models::Sluggable**: `sluggable_by` gained `reserved_words:` (reject slugs like `new` / `edit` / `admin` — saving such a record fails validation) and `finders: true` (`Model.find` accepts a slug directly), layering friendly_id's `:reserved` / `:finders` modules.
+- **Models::Sortable**: `sortable_by` now threads acts_as_list's `scope:` (independent position sequence per group) and `add_new_at:` (`:top` / `:bottom`) options through to `acts_as_list`.
+
+### Fixed
+- **Models::SoftDeletable**: `soft_delete!` / `restore!` (and the bulk `soft_delete_all` / `restore_all` / `destroy_all`) now run inside a transaction, so a raising `before_*` / `after_*` hook rolls the timestamp change back instead of leaving a half-applied state — adopting `discard`'s transactional playbook.
+
+### Notes
+- All changes are backward-compatible: the soft-delete `default_scope` stays on by default and `destroy_all` continues to soft-delete. New models are encouraged to set `default_scope: false` and use the explicit `soft_delete_all`.
+
 ## 1.11.1 (2026-06-05)
 
 ### Added

data/README.md

@@ -39,6 +39,8 @@ Article.published.without_deleted.find("hello-world")
   - [Sequenceable](#-sequenceable) — ordered, human-friendly reference numbers
   - [Stateable](#-stateable) — lightweight string-backed state machine
   - [Addressable](#-addressable) — postal address normalization + format validation
+  - [Taggable](#-taggable) — lightweight tagging over a single column
+  - [Sanitizable](#-sanitizable) — opt-in HTML sanitization (XSS defense-in-depth)
 - **Controller concerns**
   - [Paginatable](#-paginatable) — offset pagination with headers
   - [Filterable](#-filterable) — declarative URL-param filters
@@ -46,6 +48,7 @@ Article.published.without_deleted.find("hello-world")
   - [Respondable](#-respondable) — standardized JSON envelopes
   - [ErrorHandleable](#-errorhandleable) — JSON `rescue_from` handlers for common controller errors
   - [Includable](#-includable) — whitelisted association sideloading + sparse fieldsets
+  - [SecureHeadable](#-secureheadable) — security response headers + native CSP DSL
 - [Module paths & namespacing](#-module-paths--namespacing)
 - [Development](#-development)
 - [Contributing](#-contributing)
@@ -55,7 +58,7 @@ Article.published.without_deleted.find("hello-world")
 
 ## ✨ Why this gem?
 
-- **Fourteen model concerns + six controller concerns**, all production-ready
+- **Sixteen model concerns + seven controller concerns**, all production-ready
 - **One include, one macro** — no boilerplate, no glue code
 - **Lean dependencies** — only `acts_as_list` (Sortable) and `friendly_id` (Sluggable); controller concerns have zero extra deps
 - **Schema-validated configuration** — every macro checks that the configured column exists and raises `ArgumentError` early
@@ -158,6 +161,13 @@ Post.friendly.find("old-slug")   # still resolves to the renamed post
 
 # Unique slug only within a scope column (same slug allowed in different accounts)
 sluggable_by :title, scope: :account_id
+
+# Reject reserved slugs — saving a record whose slug would be reserved fails validation
+sluggable_by :title, reserved_words: %w[new edit admin]
+
+# Let Model.find accept a slug directly (not just the id)
+sluggable_by :title, finders: true
+Post.find("hello-world")   # resolves by slug
 ```
 
 **Notes**
@@ -191,6 +201,8 @@ Task.last.move_higher
 sortable_by :priority                       # ascending priority
 sortable_by priority: :desc                 # descending priority
 sortable_by :position, use_acts_as_list: false   # just the default_scope ordering, no acts_as_list
+sortable_by :position, scope: :list_id           # independent position sequence per list (acts_as_list scope:)
+sortable_by :position, add_new_at: :top          # new rows insert at the top (acts_as_list add_new_at:)
 ```
 
 **Notes**
@@ -246,7 +258,7 @@ publishable_by :published_at, default_scope: true
 
 ## ❌ SoftDeletable
 
-Soft delete records using a timestamp field (default: `deleted_at`). Includes a `default_scope` that hides deleted records and overrides `destroy_all` to soft-delete in bulk.
+Soft delete records using a timestamp field (default: `deleted_at`). By default a `default_scope` hides deleted records — **opt out** with `soft_deletable_by :deleted_at, default_scope: false` and chain `.without_deleted` explicitly (the safer choice for new models, avoiding `default_scope`'s join/uniqueness footguns). `soft_delete!` / `restore!` and the bulk helpers run inside a transaction, so a raising hook rolls the change back.
 
 ```ruby
 class User < ApplicationRecord
@@ -280,11 +292,14 @@ User.unscoped             # everything (deleted + non-deleted)
 **Bulk operations**
 
 ```ruby
-User.destroy_all          # soft-deletes all matching records
+User.soft_delete_all      # soft-deletes all matching records (explicit — preferred)
+User.destroy_all          # alias of soft_delete_all (kept for backwards compatibility)
 User.really_destroy_all   # hard-deletes all matching records
 User.restore_all          # restores all soft-deleted records
 ```
 
+All of these run in a transaction, so a raising hook rolls the whole batch back.
+
 **Lifecycle hooks** — override these methods on the model:
 
 ```ruby
@@ -775,6 +790,87 @@ end
 
 ---
 
+## 🏷️ Taggable
+
+Lightweight, dependency-free tagging stored in a **single string column** — no join tables, no tagging engine. Works on any database, including SQLite.
+
+```ruby
+class Article < ApplicationRecord
+  include ConcernsOnRails::Taggable
+
+  taggable_by :tags                      # default column :tags
+  # taggable_by :skills, downcase: true  # custom column, case-folded
+end
+
+article = Article.new
+article.tag_list = "Ruby, Rails, Ruby"   # accepts a String or an Array
+article.tag_list                          # => ["Ruby", "Rails"]  (stripped + de-duped)
+article.add_tags("api")
+article.remove_tags("Rails")
+article.tagged_with?("ruby")              # => membership predicate
+article.save!
+
+Article.tagged_with("ruby", "rails")          # records carrying BOTH tags
+Article.tagged_with("ruby", "go", any: true)  # records carrying ANY tag
+Article.all_tags                               # => sorted unique tags in use
+```
+
+**Options**
+
+| Option       | Default | Purpose                                                          |
+|--------------|---------|------------------------------------------------------------------|
+| `delimiter:` | `","`   | Character joining the stored tags (a tag must not contain it).    |
+| `downcase:`  | `false` | Case-fold tags on write so matching is case-insensitive.          |
+
+**Notes**
+- Matching is **boundary-safe** — searching `rail` does not match `rails`. An explicit SQL `ESCAPE` clause makes tags containing `_` / `%` match literally on every adapter.
+- Tags are normalized in `before_validation`, so a direct `record.tags = "a, b"` assignment is cleaned too. An empty list stores `NULL`.
+- Reach for [`acts-as-taggable-on`](https://github.com/mbleigh/acts-as-taggable-on) when you need tag contexts, ownership, counts/clouds, or polymorphic tags shared across models.
+
+---
+
+## 🧼 Sanitizable
+
+Opt-in HTML sanitization for string attributes — **defense-in-depth, not a replacement for Rails' default output escaping** (`<%= %>` already escapes). Reach for it on the rare column you render as trusted HTML (`raw` / `html_safe`) or that must stay plain text. Zero extra dependencies — it uses the `rails-html-sanitizer` that already ships with Action View.
+
+```ruby
+class Article < ApplicationRecord
+  include ConcernsOnRails::Sanitizable
+
+  # DEFAULT (on: :read) — non-destructive. The column stays raw; a
+  # `sanitized_<field>` reader returns the cleaned value:
+  sanitizable :body, with: :safe_list            # => article.sanitized_body
+  sanitizable :summary, with: :strip             # => article.sanitized_summary
+  sanitizable :body, with: { tags: %w[b i a], attributes: %w[href] }
+
+  # EXPLICIT destructive opt-in — for plain-text-only columns only:
+  sanitizable :title, with: :strip, on: :write   # overwrites in before_validation
+end
+
+article = Article.new(body: "<b>Hi</b><script>alert(1)</script>")
+article.body            # => "<b>Hi</b><script>alert(1)</script>"  (raw, intact)
+article.sanitized_body  # => "<b>Hi</b>alert(1)"                    (script tag dropped)
+```
+
+**Presets** (`with:`)
+
+| Preset       | Behavior                                                               |
+|--------------|------------------------------------------------------------------------|
+| `:strip`     | Remove all tags, keep inner text (the default).                        |
+| `:safe_list` | Rails' allow-list: keep formatting tags, drop `<script>` / `<iframe>`. |
+| `:no_links`  | Strip only `<a>` tags, keep their text.                                |
+| `:none`      | No-op (declare the field / reader without transforming).               |
+| `Array`      | Custom tag allow-list, e.g. `with: %w[b i a]`.                         |
+| `Hash`       | `{ tags: [...], attributes: [...] }` allow-list.                       |
+| `Proc`       | Used as-is (you own the non-String guard).                             |
+
+**Notes**
+- `on: :read` (default) is **non-destructive**: it adds a `sanitized_<field>` reader and leaves the stored column untouched.
+- `on: :write` overwrites the column in `before_validation` — **lossy and irreversible** (never use it on code, Markdown, math, or prices), and bypassed by `update_column` / `update_all` / raw SQL.
+- For full user-authored rich text, prefer [Action Text](https://guides.rubyonrails.org/action_text_overview.html).
+
+---
+
 # 🎮 Controller Concerns
 
 Pure ActionController + ActiveRecord — **zero extra runtime dependencies** (no Kaminari, Pundit, or Ransack).
@@ -998,6 +1094,46 @@ GET /articles?include=author,comments&fields[articles]=id,title&fields[authors]=
 
 ---
 
+## 🛡️ SecureHeadable
+
+Modern security response headers + a thin wrapper over Rails' native Content-Security-Policy DSL. Defense-in-depth on top of output escaping — it does **not** scrub request params and never re-enables the deprecated X-XSS-Protection auditor. Zero extra dependencies.
+
+```ruby
+class ApplicationController < ActionController::Base
+  include ConcernsOnRails::Controllers::SecureHeadable
+
+  # Preset headers, plus any custom "Header-Name" => "value" pairs:
+  secure_headers :nosniff, :sameorigin_frame, :no_referrer_leak, :disable_legacy_xss
+  secure_headers "Permissions-Policy" => "geolocation=()"
+
+  # Delegates to Rails' native CSP DSL — roll out report-only FIRST:
+  content_security_policy_for(report_only: true) do |policy|
+    policy.default_src :self
+    policy.script_src  :self
+    policy.object_src  :none
+  end
+end
+```
+
+**Header presets** (`secure_headers`)
+
+| Preset                | Header                                                 |
+|-----------------------|--------------------------------------------------------|
+| `:nosniff`            | `X-Content-Type-Options: nosniff`                      |
+| `:sameorigin_frame`   | `X-Frame-Options: SAMEORIGIN`                          |
+| `:deny_frame`         | `X-Frame-Options: DENY`                                |
+| `:no_referrer_leak`   | `Referrer-Policy: strict-origin-when-cross-origin`     |
+| `:no_cross_domain`    | `X-Permitted-Cross-Domain-Policies: none`              |
+| `:disable_legacy_xss` | `X-XSS-Protection: 0` (the only correct modern value)  |
+
+**Notes**
+- Headers are applied in an `after_action`, so they reinforce Rails' middleware defaults; later `secure_headers` declarations win on a colliding name.
+- `content_security_policy_for` forwards `report_only:` and per-action `only:` / `except:` / `if:` / `unless:` straight to Rails — it never re-implements CSP. Per-controller CSP overrides the global initializer for that controller.
+- CSP nonce generation (`content_security_policy_nonce_generator`) is app-wide initializer config and intentionally stays out of the concern.
+- These headers mitigate clickjacking / MIME-sniffing and (via CSP) XSS as **defense-in-depth** — output escaping remains the primary defense.
+
+---
+
 ## 🗂️ Module paths & namespacing
 
 Every concern is available under two paths:
@@ -1023,13 +1159,29 @@ Both forms reference the same module, so you can freely mix them.
 
 ---
 
+## 🧭 Philosophy & when to reach for a dedicated gem
+
+`concerns_on_rails` aims to cover the common 80% of each behavior with **one `include` + one declarative macro**, **schema-validated** configuration, **no-surprise defaults**, and **lean dependencies** (only `acts_as_list` and `friendly_id`; controller concerns have none). It is deliberately *not* a re-implementation of the category leaders — reach for a dedicated gem when you outgrow the basics:
+
+| Need | Use instead |
+|------|-------------|
+| Complex state machines (callbacks, transition logging) | [`aasm`](https://github.com/aasm/aasm) |
+| Association-cascade soft delete / sentinel-aware unique indexes | [`paranoia`](https://github.com/rubysherpas/paranoia) or [`discard`](https://github.com/jhawthorn/discard) |
+| Tagging with contexts, ownership, or tag clouds | [`acts-as-taggable-on`](https://github.com/mbleigh/acts-as-taggable-on) |
+| Full-text search with ranking / stemming | [`pg_search`](https://github.com/Casecommons/pg_search) / Elasticsearch |
+| Audit trails / version history | [`paper_trail`](https://github.com/paper-trail-gem/paper_trail) / [`audited`](https://github.com/collectiveidea/audited) |
+
+`Sluggable` wraps [`friendly_id`](https://github.com/norman/friendly_id) and `Sortable` wraps [`acts_as_list`](https://github.com/brendon/acts_as_list), so you get those leaders' engines behind the declarative macro.
+
+---
+
 ## 🛠️ Development
 
 ```sh
 bundle install                                  # install dev dependencies
 bundle exec rspec                               # run the test suite
 gem build concerns_on_rails.gemspec             # build the gem
-gem install ./concerns_on_rails-1.11.0.gem      # install locally
+gem install ./concerns_on_rails-1.11.2.gem      # install locally
 ```
 
 The test suite uses an in-memory SQLite database and a lightweight `FakeController` harness for controller-concern specs — no Rails routes or boot required.

data/lib/concerns_on_rails/controllers/secure_headable.rb

@@ -0,0 +1,105 @@
+require "active_support/concern"
+
+module ConcernsOnRails
+  module Controllers
+    # Adds modern security response headers and wires Rails' native
+    # Content-Security-Policy DSL. Defense-in-depth on top of output escaping —
+    # this does NOT scrub request params (context-blind and lossy) and never
+    # re-enables the deprecated X-XSS-Protection auditor.
+    #
+    #   class ApplicationController < ActionController::Base
+    #     include ConcernsOnRails::Controllers::SecureHeadable
+    #
+    #     # Apply preset headers, plus any custom "Header-Name" => "value" pairs:
+    #     secure_headers :nosniff, :sameorigin_frame, :no_referrer_leak, :disable_legacy_xss
+    #     secure_headers "Permissions-Policy" => "geolocation=()"
+    #
+    #     # Delegates to Rails' native CSP DSL — roll out report-only FIRST:
+    #     content_security_policy_for(report_only: true) do |policy|
+    #       policy.default_src :self
+    #       policy.script_src  :self
+    #       policy.object_src  :none
+    #     end
+    #   end
+    #
+    # The headers mitigate clickjacking / MIME-sniffing and (via CSP) XSS as
+    # defense-in-depth — they are NOT a standalone XSS fix; output escaping
+    # remains the primary defense. Per-controller CSP overrides the global
+    # initializer for that controller. CSP nonce generation
+    # (content_security_policy_nonce_generator / _nonce_directives) is app-wide
+    # initializer configuration and intentionally stays out of this concern.
+    #
+    # Header presets (the `secure_headers` arguments):
+    #   :nosniff            — X-Content-Type-Options: nosniff
+    #   :sameorigin_frame   — X-Frame-Options: SAMEORIGIN
+    #   :deny_frame         — X-Frame-Options: DENY
+    #   :no_referrer_leak   — Referrer-Policy: strict-origin-when-cross-origin
+    #   :no_cross_domain    — X-Permitted-Cross-Domain-Policies: none
+    #   :disable_legacy_xss — X-XSS-Protection: 0 (the only correct modern value)
+    module SecureHeadable
+      extend ActiveSupport::Concern
+
+      # Frozen, string-only header presets, each "Header-Name" => "value".
+      # :disable_legacy_xss emits "0" deliberately — the legacy browser XSS
+      # auditor was itself exploitable and is gone from modern browsers
+      # (Rails 7+ ships "0"), so "0" is the only correct value.
+      PRESETS = {
+        nosniff: %w[X-Content-Type-Options nosniff],
+        sameorigin_frame: %w[X-Frame-Options SAMEORIGIN],
+        deny_frame: %w[X-Frame-Options DENY],
+        no_referrer_leak: %w[Referrer-Policy strict-origin-when-cross-origin],
+        no_cross_domain: %w[X-Permitted-Cross-Domain-Policies none],
+        disable_legacy_xss: %w[X-XSS-Protection 0]
+      }.freeze
+
+      included do
+        class_attribute :secure_headable_headers, instance_accessor: false, default: {}
+        # after_action (not before) so the headers survive render and reinforce
+        # Rails' middleware defaults when a name collides.
+        after_action :apply_secure_headers
+      end
+
+      class_methods do
+        # Register preset headers (by symbol) plus optional custom
+        # "Header-Name" => "value" pairs. Later declarations win on collision.
+        def secure_headers(*presets, **custom)
+          resolved = presets.to_h do |key|
+            PRESETS.fetch(key) do
+              raise ArgumentError,
+                    "ConcernsOnRails::Controllers::SecureHeadable: unknown preset '#{key}'. " \
+                    "Valid presets: #{PRESETS.keys.join(', ')}"
+            end
+          end
+
+          self.secure_headable_headers =
+            secure_headable_headers.merge(resolved).merge(custom.transform_keys(&:to_s))
+        end
+
+        # Thin pass-through to Rails' native CSP DSL — never re-implement CSP.
+        # Forwards per-action conditions (only: / except: / if: / unless:) and
+        # the policy block straight through.
+        def content_security_policy_for(report_only: false, **action_opts, &block)
+          unless respond_to?(:content_security_policy)
+            raise ArgumentError,
+                  "ConcernsOnRails::Controllers::SecureHeadable: CSP requires " \
+                  "ActionController::ContentSecurityPolicy (Rails 5.2+)"
+          end
+
+          if report_only
+            content_security_policy_report_only(true, **action_opts, &block)
+          else
+            content_security_policy(**action_opts, &block)
+          end
+        end
+      end
+
+      # Public so subclasses can override; guarded exactly like Paginatable so
+      # it no-ops cleanly when there is no response object.
+      def apply_secure_headers
+        return unless respond_to?(:response) && response
+
+        self.class.secure_headable_headers.each { |name, value| response.set_header(name, value) }
+      end
+    end
+  end
+end

data/lib/concerns_on_rails/legacy_aliases.rb

@@ -16,4 +16,6 @@ module ConcernsOnRails
   Stateable     = Models::Stateable
   Addressable   = Models::Addressable
   Sequenceable  = Models::Sequenceable
+  Taggable      = Models::Taggable
+  Sanitizable   = Models::Sanitizable
 end

data/lib/concerns_on_rails/models/sanitizable.rb

@@ -0,0 +1,148 @@
+require "active_support/concern"
+require "concerns_on_rails/support/html_sanitizers"
+
+module ConcernsOnRails
+  module Models
+    # Opt-in HTML sanitization for string attributes — defense-in-depth, NOT a
+    # substitute for Rails' default output escaping.
+    #
+    # ESCAPE-FIRST: Rails already HTML-escapes `<%= record.body %>` via
+    # SafeBuffer, so for ordinary columns you need nothing here. Reach for this
+    # concern only for the rare column you render as trusted HTML
+    # (`raw` / `html_safe`) or that must be kept plain text. For full
+    # user-authored rich text, prefer Action Text.
+    #
+    #   class Article < ApplicationRecord
+    #     include ConcernsOnRails::Models::Sanitizable
+    #
+    #     # DEFAULT (on: :read) — non-destructive. The stored column stays raw;
+    #     # a `sanitized_<field>` reader returns the cleaned value:
+    #     sanitizable :body, with: :safe_list           # => article.sanitized_body
+    #     sanitizable :summary, with: :strip            # => article.sanitized_summary
+    #     sanitizable :body, with: { tags: %w[b i a], attributes: %w[href] }
+    #
+    #     # EXPLICIT destructive opt-in — for plain-text-only columns only:
+    #     sanitizable :title, with: :strip, on: :write  # overwrites in before_validation
+    #   end
+    #
+    # WARNING: `on: :write` is lossy and irreversible — never use it on code,
+    # Markdown, math, or anything where `<` / `>` are legitimate. It is also
+    # bypassed by `update_column` / `update_all` / raw SQL, which skip
+    # callbacks. The non-destructive `on: :read` default is preferred.
+    #
+    # Presets (the `with:` argument):
+    #   :strip      — remove all tags, keep inner text (the default)
+    #   :safe_list  — Rails' allow-list: keep formatting tags, drop <script> etc.
+    #   :no_links   — strip only <a> tags, keep their text
+    #   :none       — no-op (declare the field / reader without transforming)
+    #   Array       — custom tag allow-list, e.g. with: %w[b i a]
+    #   Hash        — { tags: [...], attributes: [...] } allow-list
+    #   Proc        — used as-is (the caller owns the non-String guard)
+    module Sanitizable
+      extend ActiveSupport::Concern
+
+      # Frozen, string-safe lambdas — non-String values pass through untouched,
+      # exactly like Normalizable::PRESETS. Each resolves its sanitizer through
+      # the shared Support helper (fully qualified, so there is no lexical-scope
+      # dependency and libgumbo is probed once, not per access) and always
+      # returns a plain String via #to_s, so a SafeBuffer is never persisted.
+      PRESETS = {
+        strip: ->(v) { v.is_a?(String) ? ConcernsOnRails::Support::HtmlSanitizers.full.sanitize(v).to_s : v },
+        safe_list: ->(v) { v.is_a?(String) ? ConcernsOnRails::Support::HtmlSanitizers.safe.sanitize(v).to_s : v },
+        no_links: ->(v) { v.is_a?(String) ? ConcernsOnRails::Support::HtmlSanitizers.link.sanitize(v).to_s : v },
+        none: ->(v) { v }
+      }.freeze
+
+      included do
+        # field => { sanitizer: <lambda>, on: :read|:write }
+        class_attribute :sanitizable_rules, instance_accessor: false, default: {}
+        before_validation :apply_sanitizations
+      end
+
+      class_methods do
+        include ConcernsOnRails::Support::ColumnGuard
+
+        # Declare which string fields to sanitize, how, and when.
+        #   sanitizable :body, with: :safe_list           # non-destructive reader
+        #   sanitizable :title, with: :strip, on: :write  # destructive overwrite
+        def sanitizable(*fields, with: :strip, on: :read)
+          raise ArgumentError, "ConcernsOnRails::Models::Sanitizable: at least one field is required" if fields.empty?
+
+          unless %i[read write].include?(on)
+            raise ArgumentError,
+                  "ConcernsOnRails::Models::Sanitizable: :on must be :read or :write, got #{on.inspect}"
+          end
+
+          sanitizer = resolve_sanitizer(with)
+          ensure_columns!("ConcernsOnRails::Models::Sanitizable", fields)
+
+          fields.each do |field|
+            key = field.to_sym
+            self.sanitizable_rules = sanitizable_rules.merge(key => { sanitizer: sanitizer, on: on })
+
+            # Non-destructive default: a clean reader, with the raw column intact.
+            define_method("sanitized_#{field}") { sanitizer.call(self[key]) } if on == :read
+          end
+        end
+      end
+
+      class_methods do # rubocop:disable Metrics/BlockLength
+        private
+
+        # Accepts a preset Symbol, a Proc (used as-is), an Array (custom tags
+        # allow-list), or a Hash with :tags / :attributes.
+        def resolve_sanitizer(with)
+          case with
+          when Symbol then preset_sanitizer(with)
+          when Proc   then with
+          when Array  then allowlist_sanitizer(tags: with.map(&:to_s))
+          when Hash   then hash_allowlist_sanitizer(with)
+          else
+            raise ArgumentError,
+                  "ConcernsOnRails::Models::Sanitizable: :with must be a preset symbol, an allow-list " \
+                  "(Array or Hash), or a Proc/lambda, got #{with.class}"
+          end
+        end
+
+        def preset_sanitizer(name)
+          PRESETS.fetch(name) do
+            raise ArgumentError,
+                  "ConcernsOnRails::Models::Sanitizable: unknown preset '#{name}'. " \
+                  "Valid presets: #{PRESETS.keys.join(', ')}"
+          end
+        end
+
+        def hash_allowlist_sanitizer(opts)
+          unknown = opts.keys - %i[tags attributes]
+          unless unknown.empty?
+            raise ArgumentError,
+                  "ConcernsOnRails::Models::Sanitizable: allow-list keys must be :tags / :attributes, got #{unknown.inspect}"
+          end
+
+          allowlist_sanitizer(tags: opts[:tags]&.map(&:to_s), attributes: opts[:attributes]&.map(&:to_s))
+        end
+
+        # Builds a SafeListSanitizer lambda restricted to the given tags/attributes.
+        def allowlist_sanitizer(tags: nil, attributes: nil)
+          options = {}
+          options[:tags] = tags if tags
+          options[:attributes] = attributes if attributes
+          ->(v) { v.is_a?(String) ? ConcernsOnRails::Support::HtmlSanitizers.safe.sanitize(v, **options).to_s : v }
+        end
+      end
+
+      # Only fields declared with on: :write are mutated; on: :read fields keep
+      # their raw column value and are exposed through their sanitized_ reader.
+      def apply_sanitizations
+        self.class.sanitizable_rules.each do |field, rule|
+          next unless rule[:on] == :write
+
+          value = self[field]
+          next if value.nil?
+
+          self[field] = rule[:sanitizer].call(value) # plain String, never a SafeBuffer
+        end
+      end
+    end
+  end
+end

data/lib/concerns_on_rails/models/sluggable.rb

@@ -34,27 +34,40 @@ module ConcernsOnRails
         # Define sluggable field, with optional friendly_id features.
         # Example:
         #   sluggable_by :wonderful_name
-        #   sluggable_by :title, history: true       # old slugs keep resolving (needs a friendly_id_slugs table)
-        #   sluggable_by :title, scope: :account_id  # slugs unique per scope column
-        def sluggable_by(field, history: false, scope: nil)
+        #   sluggable_by :title, history: true            # old slugs keep resolving (needs a friendly_id_slugs table)
+        #   sluggable_by :title, scope: :account_id       # slugs unique per scope column
+        #   sluggable_by :title, reserved_words: %w[new]  # block these slugs (a UUID is appended instead)
+        #   sluggable_by :title, finders: true            # Model.find accepts a slug directly
+        def sluggable_by(field, history: false, scope: nil, reserved_words: nil, finders: false)
           self.sluggable_field = field.to_sym
           ensure_columns!("ConcernsOnRails::Models::Sluggable", [sluggable_field, scope].compact)
-          reconfigure_friendly_id(history: history, scope: scope) if history || scope
+          return unless history || scope || reserved_words || finders
+
+          reconfigure_friendly_id(history: history, scope: scope,
+                                  reserved_words: reserved_words, finders: finders)
         end
 
         private
 
         # Re-runs friendly_id with the extra modules. friendly_id merges config
-        # across calls, so this layers :history / :scoped onto the base :slugged.
-        def reconfigure_friendly_id(history:, scope:)
+        # across calls, so this layers :history / :scoped / :finders / :reserved onto :slugged.
+        def reconfigure_friendly_id(history:, scope:, reserved_words: nil, finders: false)
           modules = [:slugged]
           modules << :history if history
           modules << :scoped if scope
-          options = { use: modules }
-          options[:scope] = scope if scope
+          modules << :finders if finders
+          modules << :reserved if reserved_words
           # friendly_id's second argument is a positional options hash (not kwargs),
           # so pass it positionally to stay correct on both Ruby 2.7 and 3.x.
-          friendly_id(:slug_source, options)
+          friendly_id(:slug_source, friendly_id_options(modules, scope, reserved_words))
+        end
+
+        # Build friendly_id's positional options hash from the resolved modules.
+        def friendly_id_options(modules, scope, reserved_words)
+          options = { use: modules }
+          options[:scope] = scope if scope
+          options[:reserved_words] = Array(reserved_words).map(&:to_s) if reserved_words
+          options
         end
       end
 

data/lib/concerns_on_rails/models/soft_deletable.rb

@@ -9,6 +9,11 @@ module ConcernsOnRails
         # declare class attributes and set default values
         class_attribute :soft_delete_field, instance_accessor: false, default: :deleted_at
         class_attribute :soft_delete_touch, instance_accessor: false, default: true
+        # Whether `.all` hides soft-deleted rows via a default_scope. ON by default for
+        # backwards compatibility; opt out with `soft_deletable_by ..., default_scope: false`.
+        # A default_scope is sticky and breaks unscoped joins / uniqueness validations /
+        # eager-loading, so new models are encouraged to disable it and chain `.without_deleted`.
+        class_attribute :soft_delete_default_scope, instance_accessor: false, default: true
 
         # scopes
         scope :active, -> { unscope(where: soft_delete_field).where(soft_delete_field => nil) }
@@ -19,25 +24,35 @@ module ConcernsOnRails
         scope :with_deleted, -> { unscope(where: soft_delete_field) }
         # Records soft-deleted within the last `duration` (e.g. `deleted_within(7.days)`).
         scope :deleted_within, ->(duration) { soft_deleted.where(soft_delete_field => duration.ago..) }
-        # Optionally, uncomment to hide deleted by default:
-        default_scope { without_deleted }
+
+        # Hide soft-deleted rows from `.all` only when enabled (the default). The block is
+        # evaluated lazily, so toggling `soft_delete_default_scope` via the macro takes effect.
+        default_scope { soft_delete_default_scope ? without_deleted : all }
       end
 
       class_methods do
         include ConcernsOnRails::Support::ColumnGuard
 
-        # Define soft delete field and options
+        # Define soft delete field and options.
         # Example:
         #   soft_deletable_by :deleted_at, touch: false
-        def soft_deletable_by(field = nil, touch: true)
+        #   soft_deletable_by :deleted_at, default_scope: false  # don't hide deleted rows from .all
+        def soft_deletable_by(field = nil, touch: true, default_scope: true)
           self.soft_delete_field = field || :deleted_at
           self.soft_delete_touch = touch
+          self.soft_delete_default_scope = default_scope
           ensure_columns!("ConcernsOnRails::Models::SoftDeletable", soft_delete_field)
         end
 
-        # Override destroy_all to perform soft delete on all records
+        # Soft-delete every matching record, wrapped in a transaction so the batch is atomic.
+        def soft_delete_all
+          transaction { all.each(&:soft_delete!) }
+        end
+
+        # Override destroy_all to soft delete. Kept for backwards compatibility, but prefer the
+        # explicit `soft_delete_all` — silently redefining a standard AR method is a known footgun.
         def destroy_all
-          all.each(&:soft_delete!)
+          soft_delete_all
         end
 
         # Provide really_destroy_all to hard delete all records
@@ -45,9 +60,9 @@ module ConcernsOnRails
           unscoped.delete_all
         end
 
-        # Restore every soft-deleted record (mirror of the destroy_all override).
+        # Restore every soft-deleted record, atomically (mirror of soft_delete_all).
         def restore_all
-          soft_deleted.each(&:restore!)
+          transaction { soft_deleted.each(&:restore!) }
         end
       end
 
@@ -60,26 +75,34 @@ module ConcernsOnRails
       def soft_delete!
         return true if deleted?
 
-        before_soft_delete
-        result = if self.class.soft_delete_touch
-                   update(self.class.soft_delete_field => Time.zone.now)
-                 else
-                   update_column(self.class.soft_delete_field, Time.zone.now)
-                 end
-        after_soft_delete if result
+        result = false
+        # Wrap the timestamp change and its hooks in a transaction so a raising
+        # before/after hook rolls the change back instead of leaving a half-applied state.
+        transaction do
+          before_soft_delete
+          result = if self.class.soft_delete_touch
+                     update(self.class.soft_delete_field => Time.zone.now)
+                   else
+                     update_column(self.class.soft_delete_field, Time.zone.now)
+                   end
+          after_soft_delete if result
+        end
         result
       end
 
       def restore!
         return true unless deleted?
 
-        before_restore
-        result = if self.class.soft_delete_touch
-                   update(self.class.soft_delete_field => nil)
-                 else
-                   update_column(self.class.soft_delete_field, nil)
-                 end
-        after_restore if result
+        result = false
+        transaction do
+          before_restore
+          result = if self.class.soft_delete_touch
+                     update(self.class.soft_delete_field => nil)
+                   else
+                     update_column(self.class.soft_delete_field, nil)
+                   end
+          after_restore if result
+        end
         result
       end
 

data/lib/concerns_on_rails/models/sortable.rb

@@ -34,14 +34,16 @@ module ConcernsOnRails
       class_methods do
         include ConcernsOnRails::Support::ColumnGuard
 
-        # Define sortable field and direction
+        # Define sortable field and direction.
         # Example:
         #   sortable_by :position
         #   sortable_by position: :asc
         #   sortable_by position: :desc
         #
         #   sortable_by :position, use_acts_as_list: false
-        def sortable_by(field_config = nil, use_acts_as_list: true, **field_options)
+        #   sortable_by :position, scope: :list_id        # independent ordering within each list
+        #   sortable_by :position, add_new_at: :top       # new records go to the top of the list
+        def sortable_by(field_config = nil, use_acts_as_list: true, scope: nil, add_new_at: nil, **field_options)
           field_config = field_options if field_config.nil? && field_options.any?
 
           # parse field_config
@@ -56,7 +58,14 @@ module ConcernsOnRails
 
           ensure_columns!("ConcernsOnRails::Models::Sortable", sortable_field)
 
-          acts_as_list column: sortable_field if use_acts_as_list
+          return unless use_acts_as_list
+
+          # Thread acts_as_list's own options through (scope: for per-group ordering,
+          # add_new_at: for where freshly-inserted rows land).
+          list_options = { column: sortable_field }
+          list_options[:scope] = scope unless scope.nil?
+          list_options[:add_new_at] = add_new_at unless add_new_at.nil?
+          acts_as_list(list_options)
         end
 
         private

data/lib/concerns_on_rails/models/taggable.rb

@@ -0,0 +1,160 @@
+require "active_support/concern"
+
+module ConcernsOnRails
+  module Models
+    # Lightweight, dependency-free tagging over a single string column.
+    # Tags are stored delimiter-joined in one column — no join tables, no
+    # tagging engine — so it works on any database, including SQLite.
+    #
+    #   class Article < ApplicationRecord
+    #     include ConcernsOnRails::Taggable
+    #
+    #     taggable_by :tags                       # default column :tags
+    #     # taggable_by :skills, downcase: true   # custom column, case-folded
+    #   end
+    #
+    #   a = Article.new
+    #   a.tag_list = "Ruby, Rails, Ruby"          # accepts a String or an Array
+    #   a.tag_list                                 # => ["Ruby", "Rails"]  (stripped + de-duped)
+    #   a.add_tags("api"); a.remove_tags("Rails")
+    #   a.tagged_with?("ruby")                     # membership predicate
+    #   a.save!
+    #
+    #   Article.tagged_with("ruby", "rails")          # records carrying BOTH tags
+    #   Article.tagged_with("ruby", "go", any: true)  # records carrying ANY tag
+    #   Article.all_tags                               # sorted unique tags in use
+    #
+    # Notes:
+    #   * Matching is boundary-safe ("rail" does not match "rails").
+    #   * A tag must not contain the delimiter (default ",").
+    #   * Reach for acts-as-taggable-on when you need tag contexts, ownership,
+    #     tag counts/clouds, or polymorphic tags shared across models.
+    module Taggable
+      extend ActiveSupport::Concern
+
+      LABEL = "ConcernsOnRails::Models::Taggable".freeze
+      DEFAULT_FIELD = :tags
+      DEFAULT_DELIMITER = ",".freeze
+
+      included do
+        class_attribute :taggable_field, instance_accessor: false, default: DEFAULT_FIELD
+        class_attribute :taggable_delimiter, instance_accessor: false, default: DEFAULT_DELIMITER
+        class_attribute :taggable_downcase, instance_accessor: false, default: false
+      end
+
+      # Real module (not `class_methods do`) so the private query helpers live
+      # under a single `private`. ActiveSupport::Concern auto-extends ClassMethods.
+      module ClassMethods
+        include ConcernsOnRails::Support::ColumnGuard
+
+        # Configure the tag column. See the module docs for the DSL.
+        def taggable_by(field = DEFAULT_FIELD, delimiter: DEFAULT_DELIMITER, downcase: false)
+          self.taggable_field = field.to_sym
+          self.taggable_delimiter = delimiter.to_s
+          self.taggable_downcase = downcase
+          ensure_columns!(LABEL, taggable_field)
+
+          before_validation :taggable_normalize!
+        end
+
+        # Records carrying the given tags. `any: true` matches ANY tag (OR);
+        # the default requires ALL tags (AND). Returns a chainable relation.
+        def tagged_with(*names, any: false)
+          tags = taggable_clean_all(names)
+          return all if tags.empty?
+
+          clauses = tags.map { |t| taggable_clause(t) }
+          sql = clauses.map(&:first).join(any ? " OR " : " AND ")
+          where(sql, *clauses.flat_map(&:last))
+        end
+
+        # All distinct tags currently stored across the table, sorted.
+        def all_tags
+          pluck(taggable_field).flat_map { |raw| taggable_split(raw) }.uniq.sort
+        end
+
+        # Split a raw stored column value into a normalized tag array.
+        def taggable_split(raw)
+          taggable_clean_all(raw.to_s.split(taggable_delimiter))
+        end
+
+        # Normalize a single tag (strip + optional downcase).
+        def taggable_clean(tag)
+          tag = tag.to_s.strip
+          taggable_downcase ? tag.downcase : tag
+        end
+
+        private
+
+        def taggable_clean_all(names)
+          names.flatten.map { |t| taggable_clean(t) }.reject(&:blank?).uniq
+        end
+
+        # Boundary-safe match for one tag against the delimiter-joined column.
+        # Returns [sql_fragment, [bind_params...]]. An explicit ESCAPE clause makes
+        # the backslash escaping below work on every adapter (SQLite has no default
+        # LIKE escape), so a tag containing `_` or `%` matches literally.
+        def taggable_clause(tag)
+          column = "#{connection.quote_table_name(table_name)}.#{connection.quote_column_name(taggable_field)}"
+          delim = taggable_delimiter
+          escaped = taggable_escape_like(tag)
+          esc = " ESCAPE '\\'"
+          ["(#{column} = ? OR #{column} LIKE ?#{esc} OR #{column} LIKE ?#{esc} OR #{column} LIKE ?#{esc})",
+           [tag, "#{escaped}#{delim}%", "%#{delim}#{escaped}", "%#{delim}#{escaped}#{delim}%"]]
+        end
+
+        # Treat the user's tag as a LIKE literal: %, _ and \ are not wildcards.
+        def taggable_escape_like(str)
+          str.gsub(/[\\%_]/) { |char| "\\#{char}" }
+        end
+      end
+
+      # ---- instance methods ----
+
+      def tag_list
+        self.class.taggable_split(self[self.class.taggable_field])
+      end
+
+      def tag_list=(value)
+        tags = taggable_coerce(value)
+        self[self.class.taggable_field] = tags.empty? ? nil : tags.join(self.class.taggable_delimiter)
+      end
+
+      def add_tags(*names)
+        self.tag_list = tag_list + names.flatten.map { |t| self.class.taggable_clean(t) }
+        tag_list
+      end
+      alias add_tag add_tags
+
+      def remove_tags(*names)
+        drop = names.flatten.map { |t| self.class.taggable_clean(t) }
+        self.tag_list = tag_list.reject { |t| drop.include?(t) }
+        tag_list
+      end
+      alias remove_tag remove_tags
+
+      def tagged_with?(tag)
+        tag_list.include?(self.class.taggable_clean(tag))
+      end
+      alias has_tag? tagged_with?
+
+      private
+
+      # before_validation hook — re-normalize whatever sits in the column, covering
+      # direct `record.tags = "..."` assignment, not just the tag_list= setter.
+      def taggable_normalize!
+        field = self.class.taggable_field
+        raw = self[field]
+        return if raw.nil?
+
+        tags = self.class.taggable_split(raw)
+        self[field] = tags.empty? ? nil : tags.join(self.class.taggable_delimiter)
+      end
+
+      def taggable_coerce(value)
+        items = value.is_a?(Array) ? value : value.to_s.split(self.class.taggable_delimiter)
+        items.map { |t| self.class.taggable_clean(t) }.reject(&:blank?).uniq
+      end
+    end
+  end
+end

data/lib/concerns_on_rails/support/html_sanitizers.rb

@@ -0,0 +1,63 @@
+require "active_support/concern"
+
+begin
+  require "rails-html-sanitizer"
+rescue LoadError
+  # rails-html-sanitizer ships transitively via actionview in every Rails app
+  # (actionview -> rails-html-sanitizer -> loofah), so this require is purely
+  # defensive for the rare host that pins an unusually old actionview. If the
+  # library is genuinely absent, referencing a sanitizer below raises a clear
+  # NameError at first use rather than at gem load.
+end
+
+module ConcernsOnRails
+  module Support
+    # Memoized, feature-detected HTML sanitizer instances shared by the
+    # sanitizing concerns (currently Models::Sanitizable).
+    #
+    # Picks the HTML5 parser (Rails::HTML5::*, the default since Rails 7.1, so
+    # it matches the host app's own ActionView sanitize/strip_tags output) when
+    # the platform supports it, and otherwise falls back to HTML4 (libgumbo /
+    # HTML5 is unavailable on JRuby) — mirroring Rails core.
+    #
+    # The namespace decision and each sanitizer are built lazily on first use,
+    # so libgumbo / ActionView is never probed at file-load time, and the
+    # instances are reused (they are thread-safe for #sanitize) rather than
+    # re-allocated per attribute access.
+    #
+    # We reference Rails::HTML5 / Rails::HTML4 explicitly: the bare
+    # Rails::HTML::* aliases silently resolve to the HTML4 implementation.
+    module HtmlSanitizers
+      module_function
+
+      def namespace
+        @namespace ||=
+          if defined?(Rails::HTML::Sanitizer) &&
+             Rails::HTML::Sanitizer.respond_to?(:html5_support?) &&
+             Rails::HTML::Sanitizer.html5_support?
+            Rails::HTML5
+          else
+            Rails::HTML4
+          end
+      end
+
+      # Removes every tag, keeping the inner text. The safe default and the
+      # only sanitizer appropriate for a destructive write (it cannot
+      # reintroduce markup).
+      def full
+        @full ||= namespace::FullSanitizer.new
+      end
+
+      # Rails' curated allow-list: keeps formatting tags (em / strong / a / p…),
+      # drops <script> / <iframe>, and neutralizes javascript: URLs.
+      def safe
+        @safe ||= namespace::SafeListSanitizer.new
+      end
+
+      # Strips only <a> tags, keeping their visible text and other markup.
+      def link
+        @link ||= namespace::LinkSanitizer.new
+      end
+    end
+  end
+end

data/lib/concerns_on_rails/version.rb

@@ -1,3 +1,3 @@
 module ConcernsOnRails
-  VERSION = "1.11.1".freeze
+  VERSION = "1.12.1".freeze
 end

data/lib/concerns_on_rails.rb

@@ -12,6 +12,7 @@ require "concerns_on_rails/support/column_guard"
 require "concerns_on_rails/support/random_value"
 require "concerns_on_rails/support/address_data"
 require "concerns_on_rails/support/sequence_calculator"
+require "concerns_on_rails/support/html_sanitizers"
 
 # Model concerns
 require "concerns_on_rails/models/sluggable"
@@ -28,6 +29,8 @@ require "concerns_on_rails/models/tokenizable"
 require "concerns_on_rails/models/stateable"
 require "concerns_on_rails/models/addressable"
 require "concerns_on_rails/models/sequenceable"
+require "concerns_on_rails/models/taggable"
+require "concerns_on_rails/models/sanitizable"
 
 # Controller concerns
 require "concerns_on_rails/controllers/paginatable"
@@ -36,6 +39,7 @@ require "concerns_on_rails/controllers/sortable"
 require "concerns_on_rails/controllers/respondable"
 require "concerns_on_rails/controllers/error_handleable"
 require "concerns_on_rails/controllers/includable"
+require "concerns_on_rails/controllers/secure_headable"
 
 # Backwards compatibility (top-level aliases for pre-1.6 module paths)
 require "concerns_on_rails/legacy_aliases"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: concerns_on_rails
 version: !ruby/object:Gem::Version
-  version: 1.11.1
+  version: 1.12.1
 platform: ruby
 authors:
 - Ethan Nguyen
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-05 00:00:00.000000000 Z
+date: 2026-06-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -75,6 +75,7 @@ files:
 - lib/concerns_on_rails/controllers/includable.rb
 - lib/concerns_on_rails/controllers/paginatable.rb
 - lib/concerns_on_rails/controllers/respondable.rb
+- lib/concerns_on_rails/controllers/secure_headable.rb
 - lib/concerns_on_rails/controllers/sortable.rb
 - lib/concerns_on_rails/legacy_aliases.rb
 - lib/concerns_on_rails/models/activatable.rb
@@ -83,6 +84,7 @@ files:
 - lib/concerns_on_rails/models/hashable.rb
 - lib/concerns_on_rails/models/normalizable.rb
 - lib/concerns_on_rails/models/publishable.rb
+- lib/concerns_on_rails/models/sanitizable.rb
 - lib/concerns_on_rails/models/schedulable.rb
 - lib/concerns_on_rails/models/searchable.rb
 - lib/concerns_on_rails/models/sequenceable.rb
@@ -90,9 +92,11 @@ files:
 - lib/concerns_on_rails/models/soft_deletable.rb
 - lib/concerns_on_rails/models/sortable.rb
 - lib/concerns_on_rails/models/stateable.rb
+- lib/concerns_on_rails/models/taggable.rb
 - lib/concerns_on_rails/models/tokenizable.rb
 - lib/concerns_on_rails/support/address_data.rb
 - lib/concerns_on_rails/support/column_guard.rb
+- lib/concerns_on_rails/support/html_sanitizers.rb
 - lib/concerns_on_rails/support/random_value.rb
 - lib/concerns_on_rails/support/sequence_calculator.rb
 - lib/concerns_on_rails/version.rb