concerns_on_rails 1.22.0 → 1.24.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7414e40bd04fc80a1b87b4c27b908ff169c5a9c2f9c50e66d8ab8d75198b9f40
-  data.tar.gz: 6f458ab30c720e633cd50f34515b7941ec9b6b8a8ef208f3beed909860ac1d9f
+  metadata.gz: a5361fdba6417a0a46213e0e8e41f8ced13d00f76cb17f102404d1d794a98a39
+  data.tar.gz: 0fab62907022084c9b54d1cca52f8b4eeefbecced0a4bc905e4b3a8a55f8f582
 SHA512:
-  metadata.gz: dbbcf38ca1645b801c05e8949f869e587752607bb0d679c279eeac2bc8904c446d7da7ee865498b8578ca5d1d8212477b60cb840d0e3c53e1a1d9593065805af
-  data.tar.gz: 524c14d7bd3e5824c0d266a3ab84e13cd21d622d7637dc4bde38225ff40e88d24559eb36055c16eaa60edb53b99c025c96effa4a458e1701b36a0826bd8a12b5
+  metadata.gz: 5654215000d983a63260507d6741090add3b7861e200e81ebd180ad7d7de61891c0646c49b666d4b01b179b51ae88d1da73386ffb35bc1cbb24328d8f3238c99
+  data.tar.gz: 436b80fa129a4a3922a0a6b7ba4945f90205f1071a4d190875fa26e87458bb39ba483b0f682bff0c64cd3fb09fda79ec15cec776f22b3d085af03d14fe5a2275

data/CHANGELOG.md

@@ -1,5 +1,28 @@
 <!-- CHANGELOG.md -->
 
+## 1.24.0 (2026-08-15)
+
+A developer-experience wave from the 2026-08-15 usability review: leaner install, lazy loading, teaching errors, and one-initializer store configuration. No behavior changes for configured concerns. 1084 examples, 0 failures.
+
+### Changed
+- **Dependencies**: the gem now depends on `actionpack` / `activerecord` / `activesupport` instead of the full `rails` meta-gem (API-only hosts stop pulling Action Cable / Mailbox / Text), and the `acts_as_list` constraint is `>= 0.7.5, < 2` — the old `~> 0.7.5` pin was an unresolvable Bundler conflict for any app already on acts_as_list 1.x. Suite verified against acts_as_list 1.2.6.
+- **Lazy loading**: `require "concerns_on_rails"` no longer eagerly loads all 40 concern/support files — everything is autoloaded on first constant reference, and `friendly_id` / `acts_as_list` load only when Sluggable / Sortable is actually used (a missing gem raises `ConcernsOnRails::MissingDependency`, a `LoadError` subclass whose message names the Gemfile line to add). The pre-1.6 top-level aliases (`ConcernsOnRails::Sluggable`, …) keep working, now resolved lazily via `const_missing`.
+- **Support::ColumnGuard** (all model concerns): the missing-column `ArgumentError` now teaches the fix — it appends a ready-to-paste `bin/rails generate migration ...` command carrying the concern's expected column type (e.g. `AddDeletedAtToArticles deleted_at:datetime`; token/slug columns suggest `string:uniq`, Encryptable blind-index columns `string:index`).
+
+### Added
+- **`ConcernsOnRails.setup`**: gem-wide configuration entry point (`lib/concerns_on_rails/configuration.rb`). First setting: `config.cache_store` — a store or a Proc (e.g. `-> { Rails.cache }`) used as the fallback store by `Controllers::Throttleable` and `Controllers::Idempotentable`, so one initializer line replaces per-controller `self.throttleable_store = ...` / `self.idempotency_store = ...` wiring. A class-level store still wins; with neither configured the concerns raise exactly as before.
+
+## 1.23.0 (2026-07-26)
+
+Two new model concerns — the roadmap picks after 1.22's fixes round: the right-to-erasure capability that completes the sensitive-data suite, and the concern-aware deep copy that makes "duplicate this invoice" safe next to unique slugs, tokens, and sequence numbers. 1075 examples, 0 failures.
+
+### Added
+- **Models::Anonymizable**: declarative right-to-erasure ("GDPR-lite") for personal data — the fourth member of the sensitive-data suite (Maskable masks display, Sanitizable strips HTML, Encryptable protects at rest; Anonymizable DESTROYS). `anonymizable *fields, with:` declares an erasure strategy per field group (repeatable; rules merge): presets `:nullify`, `:redact`, `:hash` (SHA-256 — deterministic pseudonymization, joins keep working), `:email` (random unique `anon-…@anonymized.invalid`, so NOT NULL + unique email columns survive erasure), `:random_hex`, or a callable (`->(value)` / `->(value, record)`); presets pass nil through untouched. `anonymize!` runs `before_anonymize` + ONE `update_columns` UPDATE + `after_anonymize` in a single transaction — deliberately skipping validations (erasure must not be blocked by a presence check) and callbacks (nothing may copy the old values elsewhere; Auditable's capture hook is the canonical example) — then reloads. Values serialize through the model's attribute types, so a field that is also `encryptable` stores a fresh ciphertext envelope of the anonymized value, never plaintext (spec-verified). When an erased field is also `auditable_by`, the audit column (which holds its plaintext history) is cleared in the same UPDATE (`clear_audit_trail: false` opts out). `stamp:` column (default `:anonymized_at`; `false` opts out) powers `anonymized?`, the `anonymized`/`not_anonymized` scopes (affixable via `prefix:`/`suffix:`), and the idempotent batch `anonymize_all!` (Integer count, skips stamped records — the 1.22 batch contract). Macro-time `ArgumentError` validation for fields, presets, callables, and columns. Zero new dependencies.
+- **Models::Duplicable**: concern-aware deep copy ("clone this invoice/template"). A bare AR `dup` copies identity-bearing columns — slug, API token, invoice number, audit trail, even `created_at` (which AR preserves on save when present) — so naive copies collide with unique indexes or lie about their history. `duplicate` (unsaved) / `duplicate!(overrides)` (saved, one transaction, autosaved children) blank exactly those columns automatically: timestamps, Sluggable's slug, Tokenizable/Hashable columns, Sequenceable sequence + `into:` columns, Auditable's trail (the copy inherits no history; its own creation is then audited normally), SoftDeletable's timestamp (a copy of trash is live), and Lockable's attempts (0) / locked_at (nil) — each concern regenerates fresh values on the copy's save. Business state (Publishable/Stateable/…) is deliberately NOT auto-reset — list it in `reset:`. `duplicable_by associations:, reset:, suffix:` (optional — bare include works): the association allow-list is validated at macro time (declared-before, the CounterCacheable convention); `has_many`/`has_one` children deep-copy — a child whose class also includes Duplicable copies via ITS OWN rules, so nested graphs stay declarative; `has_and_belongs_to_many` re-links the same records; `belongs_to` and `has_many :through` are rejected with explanations. `suffix: { title: " (copy)" }` appends to present values; `on_duplicate(copy)` is the override hook. Zero new dependencies.
+
+### Internal
+- Top-level aliases `ConcernsOnRails::Anonymizable` / `ConcernsOnRails::Duplicable` registered alongside the existing set; docs site pages + registry entries added for both concerns.
+
 ## 1.22.0 (2026-07-26)
 
 A fixes-and-optimizations release driven by a full-library review of all 40 concerns: one data-loss bug, three request-crashing 500s verified through real ActionController dispatch, security headers restored on rescued error responses, a fail-open authorization path closed, and the gem's largest performance defect (unmemoized PBKDF2 per encrypted-value access) eliminated. 1031 examples, 0 failures.

data/README.md

@@ -12,7 +12,7 @@ One `include`, one declarative macro — done.
 [![Rails](https://img.shields.io/badge/rails-5.0--8.x-CC0000?logo=rubyonrails&logoColor=white)](https://rubyonrails.org)
 [![License: MIT](https://img.shields.io/badge/license-MIT-3fb950.svg)](#-license)
 
-🧩 **23 model concerns**  ·  🎮 **16 controller concerns**  ·  🪶 **lean deps**  ·  ✅ **schema-validated**
+🧩 **26 model concerns**  ·  🎮 **16 controller concerns**  ·  🪶 **lean deps**  ·  ✅ **schema-validated**
 
 </div>
 
@@ -66,6 +66,8 @@ Article.published.without_deleted.find("hello-world")
 | [⚙️ Storable](#-storable) | Typed accessors over one JSON column ("store_attribute-lite") |
 | [🧮 CounterCacheable](#-countercacheable) | Conditional denormalized counters ("counter_culture-lite") |
 | [🔏 Encryptable](#-encryptable) | Transparent field encryption (AES-256-GCM) + blind-index lookups |
+| [🕵️ Anonymizable](#-anonymizable) | GDPR right-to-erasure with per-field strategies |
+| [🧬 Duplicable](#-duplicable) | Concern-aware deep copy ("clone this invoice") |
 
 ### 🎮 Controller concerns
 
@@ -92,9 +94,9 @@ Article.published.without_deleted.find("hello-world")
 
 ## ✨ Why this gem?
 
-- **Twenty-four model concerns + sixteen controller concerns**, all production-ready
+- **Twenty-six model concerns + sixteen controller concerns**, all production-ready
 - **One include, one macro** — no boilerplate, no glue code
-- **Lean dependencies** — only `acts_as_list` (Sortable) and `friendly_id` (Sluggable); controller concerns have zero extra deps
+- **Lean dependencies** — only `acts_as_list` (Sortable) and `friendly_id` (Sluggable), and both load **lazily**: an app that never includes those concerns never loads them. Depends on `activerecord`/`actionpack`/`activesupport`, not the full `rails` meta-gem; controller concerns have zero extra deps
 - **Schema-validated configuration** — every macro checks that the configured column exists and raises `ArgumentError` early
 - **Composable** — concerns are independent; mix and match per model
 
@@ -105,7 +107,7 @@ Article.published.without_deleted.find("hello-world")
 Add to your application's `Gemfile`:
 
 ```ruby
-gem "concerns_on_rails", "~> 1.22"
+gem "concerns_on_rails", "~> 1.24"
 ```
 
 Or pull the latest from GitHub:
@@ -120,6 +122,27 @@ Then run:
 bundle install
 ```
 
+### Optional: one-initializer configuration
+
+Everything works with zero configuration. The store-backed controller concerns
+(`Throttleable`, `Idempotentable`) need a cache store — set it once, gem-wide,
+instead of per controller class:
+
+```ruby
+# config/initializers/concerns_on_rails.rb
+ConcernsOnRails.setup do |config|
+  config.cache_store = -> { Rails.cache }   # fallback for Throttleable / Idempotentable
+end
+
+# Encryptable's key lives in its own config (see the Encryptable section):
+ConcernsOnRails.configure_encryption do |c|
+  c.key = -> { Rails.application.credentials.dig(:encryption, :key) }
+end
+```
+
+A per-class `self.throttleable_store = ...` / `self.idempotency_store = ...`
+still wins over the gem-wide fallback.
+
 ---
 
 ## 🧪 Compatibility
@@ -1167,6 +1190,66 @@ Patient.where_email("a@b.com")       # chainable Relation (accepts arrays too)
 
 ---
 
+## 🕵️ Anonymizable
+
+Declarative right-to-erasure ("GDPR-lite"): each personal-data field gets an erasure strategy, and `anonymize!` rewrites them all in **one UPDATE** while stamping `anonymized_at`. Completes the sensitive-data suite — Maskable masks *display*, Sanitizable strips *HTML*, Encryptable protects *at rest*; Anonymizable **destroys**.
+
+```ruby
+class User < ApplicationRecord
+  include ConcernsOnRails::Models::Anonymizable
+
+  anonymizable :email, with: :email                 # unique fake address
+  anonymizable :first_name, :last_name, with: :redact
+  anonymizable :ssn, with: :nullify
+  anonymizable :bio, with: ->(value) { value && "removed by user request" }
+end
+
+user.anonymize!                    # hooks + single UPDATE + stamp, in one transaction
+user.anonymized?                   # => true
+User.not_anonymized                # scope (and .anonymized)
+User.where(...).anonymize_all!     # batch; returns the count, skips stamped records
+```
+
+**Strategies** (`with:`): `:nullify`, `:redact` (`"[REDACTED]"`), `:hash` (SHA-256 — deterministic *pseudonymization*, joins keep working), `:email` (random unique `anon-…@anonymized.invalid`, so NOT NULL + unique email columns survive), `:random_hex`, or a callable (`->(value)` / `->(value, record)`). Presets pass `nil` through untouched.
+
+**Options** (repeatable; field rules merge): `stamp:` (default `:anonymized_at`; `false` disables stamping + scopes), `clear_audit_trail:` (default `true` — when an erased field is also `auditable_by`, the trail holding its plaintext history is cleared in the same UPDATE), `prefix:`/`suffix:` (scope names).
+
+**Notes**
+- Deliberately `update_columns`: erasure is never blocked by validations and never runs callbacks that could copy old values elsewhere. Values still serialize through the attribute types, so an `encryptable` field stores a fresh ciphertext envelope — never plaintext.
+- `before_anonymize`/`after_anonymize` hooks run inside the transaction; the record reloads afterwards (erasure is terminal for the instance).
+- `:hash` is pseudonymization — use `:nullify`/`:random_hex` for true erasure. Backups/replicas/logs are out of scope.
+
+---
+
+## 🧬 Duplicable
+
+Concern-aware deep copy — the "clone this invoice / duplicate this template" feature. A bare `dup` copies identity-bearing columns (slug, token, invoice number, audit trail, even `created_at`, which AR preserves on save), so naive copies collide with unique indexes. Duplicable blanks exactly those columns and lets each sibling concern regenerate fresh values on save.
+
+```ruby
+class Invoice < ApplicationRecord
+  include ConcernsOnRails::Models::Duplicable
+
+  has_many :line_items
+  duplicable_by associations: %i[line_items],
+                reset: %i[issued_at],
+                suffix: { title: " (copy)" }
+end
+
+copy = invoice.duplicate                # unsaved deep copy
+copy = invoice.duplicate!(title: "Q3")  # saved (one transaction, autosaved children)
+```
+
+**Auto-reset identity columns** (no configuration): `created_at`/`updated_at`, Sluggable slug, Tokenizable/Hashable tokens, Sequenceable sequence + `into:` columns, Auditable trail, SoftDeletable timestamp, Lockable attempts/locked_at. Business state (Publishable, Stateable, …) is a judgment call — list it in `reset:`.
+
+**Associations** (`associations:` allow-list, declared before the macro, validated at macro time): `has_many`/`has_one` children are deep-copied — a child that also includes Duplicable copies via **its own** rules, so nested graphs stay declarative; `has_and_belongs_to_many` re-links the *same* records; `belongs_to` and `has_many :through` are rejected with an explanation.
+
+**Notes**
+- The macro is optional — bare `include` gives `duplicate`/`duplicate!` with the auto resets.
+- Override `on_duplicate(copy)` for custom tweaks; it receives the unsaved copy last.
+- Reach for [`amoeba`](https://github.com/amoeba-rb/amoeba) when you need per-attribute regex/prepend rules or belongs_to graph copying.
+
+---
+
 # 🎮 Controller Concerns
 
 Pure ActionController + ActiveRecord — **zero extra runtime dependencies** (no Kaminari, Pundit, or Ransack).
@@ -1537,7 +1620,7 @@ Fixed-window counter: the key embeds a floored time bucket (`epoch / period`) so
 
 **Notes**
 - The store MUST support **atomic increment-with-expiry** (`Rails.cache` with `#increment`, or Redis) — a non-atomic store under-counts under concurrency.
-- There is **no in-process default store** on purpose: the first throttled request raises `ArgumentError` until you set `throttleable_store`, so you never silently rate-limit per-process.
+- There is **no in-process default store** on purpose: the first throttled request raises `ArgumentError` until you set `throttleable_store` (or the gem-wide fallback `ConcernsOnRails.setup { |c| c.cache_store = -> { Rails.cache } }`), so you never silently rate-limit per-process.
 - When `Respondable` is included, the 429 body delegates to `render_error` (`code: "rate_limited"`).
 - Backports the essentials of Rails 7.2's `rate_limit` (with standardized headers) to Rails 5.0+. For richer rules (fail2ban, allow/deny lists, exponential backoff) reach for [`rack-attack`](https://github.com/rack/rack-attack).
 
@@ -1586,7 +1669,7 @@ Per-key lifecycle: claim atomically (`write unless_exist`, TTL `lock_ttl:`) →
 
 **Notes**
 - Cache keys are scoped per `controller#action` and the client key is SHA256-hashed, so the same key on different endpoints never collides.
-- There is **no in-process default store** on purpose: the first keyed request raises `ArgumentError` until you set `idempotency_store`.
+- There is **no in-process default store** on purpose: the first keyed request raises `ArgumentError` until you set `idempotency_store` (or the gem-wide fallback `ConcernsOnRails.setup { |c| c.cache_store = -> { Rails.cache } }`).
 - When `Respondable` is included, the 400/409/422 bodies delegate to `render_error`.
 - Declare halting filters (authentication, `Throttleable`) **before** including this concern — a 401/403 rendered by an inner filter would be cached and replayed for the full TTL. Responses rendered by `rescue_from` handlers are never cached.
 - Keys must be ≤255 chars with no control characters (the raw key is echoed in `X-Idempotency-Key`); set `lock_ttl:` above the slowest declared action's worst case.
@@ -1739,6 +1822,7 @@ Both forms reference the same module, so you can freely mix them.
 | Full-text search with ranking / stemming | [`pg_search`](https://github.com/Casecommons/pg_search) / Elasticsearch |
 | Versioned audit trails with undo/reify, who-dunnit queries, or association tracking | [`paper_trail`](https://github.com/paper-trail-gem/paper_trail) / [`audited`](https://github.com/collectiveidea/audited) |
 | Field encryption with managed key rotation / Rails-native key infrastructure | [`lockbox`](https://github.com/ankane/lockbox) / Rails 7+ native `encrypts` |
+| Deep clone with per-attribute regex/prepend rules or belongs_to graph copying | [`amoeba`](https://github.com/amoeba-rb/amoeba) |
 
 `Sluggable` wraps [`friendly_id`](https://github.com/norman/friendly_id) and `Sortable` wraps [`acts_as_list`](https://github.com/brendon/acts_as_list), so you get those leaders' engines behind the declarative macro.
 
@@ -1750,7 +1834,7 @@ Both forms reference the same module, so you can freely mix them.
 bundle install                                  # install dev dependencies
 bundle exec rspec                               # run the test suite
 gem build concerns_on_rails.gemspec             # build the gem
-gem install ./concerns_on_rails-1.22.0.gem      # install locally
+gem install ./concerns_on_rails-1.24.0.gem      # install locally
 ```
 
 The test suite uses an in-memory SQLite database and a lightweight `FakeController` harness for controller-concern specs — no Rails routes or boot required.

data/lib/concerns_on_rails/configuration.rb

@@ -0,0 +1,27 @@
+module ConcernsOnRails
+  # Gem-wide configuration, set once from an initializer:
+  #
+  #   ConcernsOnRails.setup do |config|
+  #     config.cache_store = -> { Rails.cache }
+  #   end
+  #
+  # `cache_store` is the fallback store consulted by Controllers::Throttleable
+  # and Controllers::Idempotentable when the controller class hasn't set its
+  # own (`self.throttleable_store = ...` / `self.idempotency_store = ...`
+  # still win). A store object or a zero-arg callable — prefer a Proc so
+  # `Rails.cache` is read lazily, after the framework has booted. The store
+  # contract is unchanged: atomic #increment for throttling, #read /
+  # #write(expires_in:, unless_exist:) / #delete for idempotency. There is
+  # still no in-process default on purpose — a non-atomic store silently
+  # under-counts, so the host must opt in explicitly (just once, here).
+  class Configuration
+    attr_accessor :cache_store
+
+    # The fallback store with any callable resolved (per lookup, so a Proc
+    # reading Rails.cache follows a swapped-out cache in tests). nil when the
+    # host never configured one.
+    def resolved_cache_store
+      cache_store.respond_to?(:call) ? cache_store.call : cache_store
+    end
+  end
+end

data/lib/concerns_on_rails/controllers/idempotentable.rb

@@ -33,8 +33,10 @@ module ConcernsOnRails
     # The claim is taken atomically via `write(..., unless_exist: true)`
     # (memcached `add` / Redis `SET NX` through Rails.cache); a store without
     # that atomicity is best-effort under concurrency. There is no in-process
-    # default store on purpose — configure one explicitly or the first keyed
-    # request raises ArgumentError. Note that responses rendered by
+    # default store on purpose — configure one explicitly (per controller as
+    # above, or once for the whole app via `ConcernsOnRails.setup { |c|
+    # c.cache_store = -> { Rails.cache } }`) or the first keyed request raises
+    # ArgumentError. Note that responses rendered by
     # `rescue_from` handlers bypass the around filter's success path and are
     # never cached.
     #
@@ -246,12 +248,13 @@ module ConcernsOnRails
       end
 
       def idempotency_store!
-        store = self.class.idempotency_store
+        store = self.class.idempotency_store || ConcernsOnRails.config.resolved_cache_store
         return store if store
 
         raise ArgumentError,
               "ConcernsOnRails::Controllers::Idempotentable: no store configured. " \
-              "Set `self.idempotency_store = Rails.cache` " \
+              "Set `self.idempotency_store = Rails.cache` on the controller, or the gem-wide " \
+              "fallback: ConcernsOnRails.setup { |c| c.cache_store = -> { Rails.cache } } " \
               "(must support #read, #write(expires_in:, unless_exist:) and #delete)."
       end
 

data/lib/concerns_on_rails/controllers/throttleable.rb

@@ -23,7 +23,9 @@ module ConcernsOnRails
     # exact. The store MUST support atomic increment-with-expiry (`Rails.cache`
     # with `#increment`, or Redis); a non-atomic store under-counts under
     # concurrency. There is no in-process default store on purpose — configure
-    # one explicitly or the first throttled request raises ArgumentError.
+    # one explicitly (per controller as above, or once for the whole app via
+    # `ConcernsOnRails.setup { |c| c.cache_store = -> { Rails.cache } }`) or
+    # the first throttled request raises ArgumentError.
     module Throttleable
       extend ActiveSupport::Concern
 
@@ -161,12 +163,14 @@ module ConcernsOnRails
       end
 
       def throttle_store!
-        store = self.class.throttleable_store
+        store = self.class.throttleable_store || ConcernsOnRails.config.resolved_cache_store
         return store if store
 
         raise ArgumentError,
               "ConcernsOnRails::Controllers::Throttleable: no store configured. " \
-              "Set `self.throttleable_store = Rails.cache` (must support atomic #increment)."
+              "Set `self.throttleable_store = Rails.cache` on the controller, or the gem-wide " \
+              "fallback: ConcernsOnRails.setup { |c| c.cache_store = -> { Rails.cache } } " \
+              "(must support atomic #increment)."
       end
 
       def throttle_action_name

data/lib/concerns_on_rails/legacy_aliases.rb

@@ -1,29 +1,27 @@
 module ConcernsOnRails
-  # Backwards-compatibility aliases for pre-1.6 module paths.
-  # Existing apps doing `include ConcernsOnRails::Sluggable` continue to work;
-  # new code is encouraged to use the namespaced form: `ConcernsOnRails::Models::Sluggable`.
-  Sluggable     = Models::Sluggable
-  Sortable      = Models::Sortable
-  Publishable   = Models::Publishable
-  SoftDeletable = Models::SoftDeletable
-  Hashable      = Models::Hashable
-  Schedulable   = Models::Schedulable
-  Expirable     = Models::Expirable
-  Normalizable  = Models::Normalizable
-  Searchable    = Models::Searchable
-  Activatable   = Models::Activatable
-  Tokenizable   = Models::Tokenizable
-  Stateable     = Models::Stateable
-  Addressable   = Models::Addressable
-  Sequenceable  = Models::Sequenceable
-  Taggable      = Models::Taggable
-  Sanitizable   = Models::Sanitizable
-  Maskable      = Models::Maskable
-  Monetizable   = Models::Monetizable
-  Auditable     = Models::Auditable
-  Lockable      = Models::Lockable
-  Aliasable     = Models::Aliasable
-  Storable      = Models::Storable
-  CounterCacheable = Models::CounterCacheable
-  Encryptable = Models::Encryptable
+  # Backwards-compatibility aliases for pre-1.6 module paths, resolved lazily:
+  # eager `Sluggable = Models::Sluggable` assignments would force-load every
+  # concern file at boot and defeat the loader's autoload laziness. The first
+  # reference to `ConcernsOnRails::<Name>` loads the real module and pins the
+  # alias constant, so `include ConcernsOnRails::Sluggable` works unchanged.
+  # New code is encouraged to use the namespaced form:
+  # `ConcernsOnRails::Models::Sluggable`.
+  #
+  # Note `Sortable` resolves to Models::Sortable (as it always has) — the
+  # controller concern is only reachable as Controllers::Sortable.
+  LEGACY_MODEL_ALIASES = %i[
+    Sluggable Sortable Publishable SoftDeletable Hashable Schedulable
+    Expirable Normalizable Searchable Activatable Tokenizable Stateable
+    Addressable Sequenceable Taggable Sanitizable Maskable Monetizable
+    Auditable Lockable Aliasable Storable CounterCacheable Encryptable
+    Anonymizable Duplicable
+  ].freeze
+
+  def self.const_missing(name)
+    return super unless LEGACY_MODEL_ALIASES.include?(name)
+
+    # Idempotent under a concurrent first reference: both threads pin the
+    # same module object, and once pinned const_missing never fires again.
+    const_set(name, Models.const_get(name))
+  end
 end

data/lib/concerns_on_rails/models/activatable.rb

@@ -33,7 +33,7 @@ module ConcernsOnRails
 
         def activatable_by(field = DEFAULT_FIELD, prefix: nil, suffix: nil)
           self.activatable_field = field.to_sym
-          ensure_columns!("ConcernsOnRails::Models::Activatable", activatable_field)
+          ensure_columns!("ConcernsOnRails::Models::Activatable", activatable_field, types: :boolean)
 
           # Affix the scope names so two concerns that each define `.active`
           # (e.g. SoftDeletable / Expirable) can coexist on one model.

data/lib/concerns_on_rails/models/addressable.rb

@@ -86,7 +86,7 @@ module ConcernsOnRails
           raise ArgumentError, "#{LABEL}: unknown address part(s): #{unknown.join(', ')}" if unknown.any?
 
           overrides = mapping.to_h { |part, column| [part.to_sym, column.to_sym] }
-          ensure_columns!(LABEL, overrides.values)
+          ensure_columns!(LABEL, overrides.values, types: :string)
           DEFAULT_FIELDS.merge(overrides).select { |_part, column| column_names.include?(column.to_s) }
         end
 

data/lib/concerns_on_rails/models/anonymizable.rb

@@ -0,0 +1,218 @@
+require "active_support/concern"
+require "concerns_on_rails/support/column_guard"
+require "digest"
+require "securerandom"
+
+module ConcernsOnRails
+  module Models
+    # Declarative right-to-erasure ("GDPR-lite") for personal data. The fourth
+    # member of the sensitive-data suite: Maskable masks *display*, Sanitizable
+    # strips *HTML*, Encryptable protects *at rest* — Anonymizable DESTROYS.
+    #
+    #   class User < ApplicationRecord
+    #     include ConcernsOnRails::Models::Anonymizable
+    #
+    #     anonymizable :email, with: :email                 # unique fake address
+    #     anonymizable :first_name, :last_name, with: :redact
+    #     anonymizable :ssn, with: :nullify
+    #     anonymizable :bio, with: ->(value) { value && "removed by user request" }
+    #   end
+    #
+    #   user.anonymize!        # one UPDATE: strategies + anonymized_at stamp
+    #   user.anonymized?       # => true
+    #   User.not_anonymized    # scope (and .anonymized)
+    #   User.where(...).anonymize_all!   # batch; returns the count
+    #
+    # HOW IT WRITES — deliberately update_columns (single UPDATE, no
+    # validations, no callbacks): erasure must not be blocked by a presence/
+    # format validation, and must not run callbacks that would copy the OLD
+    # values somewhere new (Auditable's capture hook is the canonical example).
+    # update_columns serializes each value through the model's attribute types
+    # — Encryptable's custom type included — so a field that is also
+    # `encryptable` stores a fresh ciphertext envelope of the anonymized
+    # value, never plaintext. The record is reloaded afterwards so in-memory
+    # readers see the anonymized values through the types.
+    #
+    # Strategy presets (`with:`):
+    #   :nullify    — nil
+    #   :redact     — "[REDACTED]"
+    #   :hash       — SHA-256 hex of the value (deterministic pseudonymization:
+    #                 the same input digests the same, so datasets keyed on the
+    #                 value still join — NOT full anonymization)
+    #   :email      — "anon-<random-hex>@anonymized.invalid" (random + unique,
+    #                 so NOT NULL / unique-index email columns survive erasure;
+    #                 .invalid is an RFC 2606 reserved TLD — it can never send)
+    #   :random_hex — 32 random hex chars (unique tokens/usernames)
+    #   a callable  — ->(value) { ... } or ->(value, record) { ... }; nil-in
+    #                 nil-out is the preset convention, custom callables choose
+    #
+    # Notes:
+    #   * The stamp column (default :anonymized_at, `stamp: false` to opt out)
+    #     is what makes `anonymized?`, the scopes, and anonymize_all!'s
+    #     idempotency work — add it (a datetime) unless you truly can't.
+    #   * Auditable interaction: if any anonymized field is also audited, the
+    #     trail already holds historical plaintext, so anonymize! clears the
+    #     audit column in the SAME update (opt out per-macro with
+    #     `clear_audit_trail: false`). The trail is one column — clearing is
+    #     all-or-nothing.
+    #   * Encryptable interaction: works transparently (see HOW IT WRITES).
+    #   * Erasure is terminal: unsaved changes on the instance are discarded by
+    #     the post-write reload.
+    module Anonymizable
+      extend ActiveSupport::Concern
+
+      LABEL = "ConcernsOnRails::Models::Anonymizable".freeze
+      DEFAULT_STAMP = :anonymized_at
+      # Distinguishes "option not passed" from an explicit value, so repeat
+      # macro calls merge fields without silently resetting earlier options.
+      UNSET = Object.new
+
+      PRESETS = {
+        nullify: ->(_value) {},
+        redact: ->(value) { value.nil? ? nil : "[REDACTED]" },
+        hash: ->(value) { value.nil? ? nil : Digest::SHA256.hexdigest(value.to_s) },
+        email: ->(value) { value.nil? ? nil : "anon-#{SecureRandom.hex(10)}@anonymized.invalid" },
+        random_hex: ->(value) { value.nil? ? nil : SecureRandom.hex(16) }
+      }.freeze
+
+      included do
+        class_attribute :anonymizable_rules, instance_accessor: false, default: {}
+        class_attribute :anonymizable_stamp, instance_accessor: false, default: DEFAULT_STAMP
+        class_attribute :anonymizable_clear_audit, instance_accessor: false, default: true
+        class_attribute :anonymizable_scopes_defined, instance_accessor: false, default: false
+      end
+
+      module ClassMethods
+        include ConcernsOnRails::Support::ColumnGuard
+
+        # Declare fields and their erasure strategy. Repeatable — field rules
+        # merge across calls; stamp:/clear_audit_trail:/prefix:/suffix: apply
+        # only when explicitly passed (last explicit value wins).
+        def anonymizable(*fields, with:, stamp: UNSET, clear_audit_trail: UNSET, prefix: nil, suffix: nil)
+          raise ArgumentError, "#{LABEL}: at least one field is required" if fields.empty?
+
+          strategy = anonymizable_resolve_strategy(with)
+          anonymizable_apply_options(stamp, clear_audit_trail)
+
+          ensure_columns!(LABEL, fields)
+          ensure_columns!(LABEL, anonymizable_stamp) if anonymizable_stamp
+          self.anonymizable_rules = anonymizable_rules.merge(fields.to_h { |f| [f.to_sym, strategy] })
+
+          anonymizable_define_scopes(prefix, suffix)
+        end
+
+        # Anonymize every matching record that isn't already stamped, in one
+        # transaction. Returns the Integer count of records anonymized (the
+        # 1.22 batch contract). Without a stamp column every record matches.
+        def anonymize_all!
+          transaction do
+            all.to_a.count do |record|
+              next false if record.anonymized?
+
+              record.anonymize!
+              true
+            end
+          end
+        end
+
+        private
+
+        def anonymizable_apply_options(stamp, clear_audit_trail)
+          # `.presence` (not `&.`): `stamp: false` must resolve to nil, and
+          # false&.to_sym would raise.
+          self.anonymizable_stamp = stamp.presence && stamp.to_sym unless stamp.equal?(UNSET)
+          return if clear_audit_trail.equal?(UNSET)
+
+          self.anonymizable_clear_audit = clear_audit_trail ? true : false
+        end
+
+        def anonymizable_resolve_strategy(with)
+          case with
+          when Symbol
+            PRESETS.fetch(with) do
+              raise ArgumentError, "#{LABEL}: unknown preset '#{with}'. Valid presets: #{PRESETS.keys.join(', ')}"
+            end
+          else
+            raise ArgumentError, "#{LABEL}: :with must be a preset symbol or a callable, got #{with.class}" unless with.respond_to?(:call)
+
+            with
+          end
+        end
+
+        # Scopes read the class attribute lazily, so later stamp changes take
+        # effect; defined once (affixes come from the first defining call).
+        def anonymizable_define_scopes(prefix, suffix)
+          return if anonymizable_scopes_defined || anonymizable_stamp.nil?
+
+          self.anonymizable_scopes_defined = true
+          affixed = ->(base) { [prefix, base, suffix].compact.join("_") }
+          scope affixed.call("anonymized"), -> { where.not(anonymizable_stamp => nil) }
+          scope affixed.call("not_anonymized"), -> { where(anonymizable_stamp => nil) }
+        end
+      end
+
+      # Lifecycle hooks — override in the model. Run inside the anonymize!
+      # transaction, so a raising hook rolls the erasure back.
+      def before_anonymize; end
+      def after_anonymize; end
+
+      # Erase the configured fields in a single UPDATE (see the module docs for
+      # why validations and callbacks are deliberately skipped). Returns true.
+      def anonymize!
+        raise ArgumentError, "#{LABEL}: anonymize! cannot be called on a new record" if new_record?
+
+        payload = anonymizable_payload
+        transaction do
+          before_anonymize
+          update_columns(payload)
+          after_anonymize
+        end
+        # update_columns leaves DB-serialized values (e.g. ciphertext) in the
+        # in-memory attributes; reload so readers decode through the types.
+        reload
+        true
+      end
+
+      # True when the stamp column is set; always false with `stamp: false`
+      # (there is nothing to observe).
+      def anonymized?
+        stamp = self.class.anonymizable_stamp
+        stamp ? self[stamp].present? : false
+      end
+
+      private
+
+      # { column => value }: strategy output cast through the attribute's type,
+      # plus the stamp and — when an anonymized field is also audited — the
+      # cleared audit column. update_columns serializes each value through the
+      # model's attribute types (verified: Encryptable's custom type included),
+      # so an encrypted field stores a fresh ciphertext envelope — passing a
+      # pre-serialized value here would double-encrypt.
+      def anonymizable_payload
+        payload = {}
+        self.class.anonymizable_rules.each do |field, strategy|
+          value = anonymizable_apply_strategy(strategy, public_send(field))
+          payload[field] = self.class.type_for_attribute(field.to_s).cast(value)
+        end
+        stamp = self.class.anonymizable_stamp
+        payload[stamp] = Time.zone.now if stamp
+        payload[self.class.auditable_into] = nil if anonymizable_clear_audit_column?
+        payload
+      end
+
+      def anonymizable_apply_strategy(strategy, value)
+        strategy.arity == 1 ? strategy.call(value) : strategy.call(value, self)
+      end
+
+      # The audit trail holds historical plaintext of tracked fields; when any
+      # of them is being erased, the trail must go too (see module docs).
+      def anonymizable_clear_audit_column?
+        return false unless self.class.anonymizable_clear_audit
+        return false unless self.class.respond_to?(:auditable_fields)
+
+        tracked = Array(self.class.auditable_fields).map(&:to_sym)
+        self.class.anonymizable_rules.keys.intersect?(tracked)
+      end
+    end
+  end
+end

data/lib/concerns_on_rails/models/auditable.rb

@@ -74,7 +74,7 @@ module ConcernsOnRails
           self.auditable_actor = actor
           self.auditable_max_entries = max_entries
           self.auditable_max_value_length = max_value_length
-          ensure_columns!(LABEL, into, *fields)
+          ensure_columns!(LABEL, into, *fields, types: { into => :text })
           auditable_guard_encryptable!(fields)
 
           before_save :auditable_capture_changes

data/lib/concerns_on_rails/models/counter_cacheable.rb

@@ -139,7 +139,7 @@ module ConcernsOnRails
           end
           return unless klass
 
-          ensure_columns_on!(LABEL, klass, count_column)
+          ensure_columns_on!(LABEL, klass, count_column, types: :integer)
         end
 
         def counter_cacheable_recount_rule(rule)