labimotion 2.4.0.rc8 → 2.4.0.rc9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fb80f2785578e7024da49b80d642b5d79360b576be7cd3035588d158e433ce9a
-  data.tar.gz: d34d16a3ea0499082e3573e8486acfc0039729ede44defaf191079ca8bcb53ff
+  metadata.gz: c6b27ce7b185d248cf78a19fbeb00cf5c60edeed1e090d1fa73c2de8d4465579
+  data.tar.gz: dd64b3fd5e1fbb717135444ed666df30e2ae542e6e65fb2a3616b210ab9d5832
 SHA512:
-  metadata.gz: fbd4bc4b60468e2ffabfd9da96d9425e3aa718a305747c794f35bd63d27ae3e0d630ee90d68b37a5ad353e307b692c41364ff905947b9b623f9d75a5d9dcedc9
-  data.tar.gz: 5062fc57240fb3319a7a2a272fccd20eee6d379910c7b14c7ff9a0ca975d1920f0dc019a812873fa173796d8ad3e26bced01610f48d296b7e6d3d2d8787dff8a
+  metadata.gz: 3cbf525c1197064ab1b25a11d77fd94249e064d6f705c1ae5e9306bc497e7080c5c2c3266fd8bec52c2ee502862e8b82f6324d3e3aca20d2a6565dbcaa67f811
+  data.tar.gz: 5c96c935475319618a2c9eb66d5cd102a0971b6f7628a7bd97bcaa5f5cd8686933c6c3cef110d24be30250f01493569ae966f3eb07ecde06ed3e04e710668b64

data/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## [Unreleased]
 * Features and enhancements:
+  * The AI whitelist reading moves into the gem as `Labimotion::MatriceLabimotion`, a concern the host mixes into whichever model holds its UI feature configs (`Matrice` in the Chemotion ELN). Who is allowed stays the host's decision and the host's data — an admin edits `ai_uids` / `fill_uids` on the UI Features page — but what the answer means is LabIMotion's: which generic types have an AI integration (`AI_FEATURES`), that auto-fill is a sub-gate on `ai_uids` rather than a list of its own, and that every step is closed by default, so a missing feature row, a missing key, an empty list or a malformed value all resolve to nobody. Supplies `.ai_uids`, `.fill_uids`, `.ai_enabled_for?`, `.ai_features_for` and `.ai_enabled_for_any?`; the uid reader behind them stays private to the including model. A host needs two things for it to work: the including model answers `find_by(name:)` with a record exposing a `configs` hash, and its user answers `matrix_check_by_name(name)` with whether that feature is visible to them at all. This also settles where `Labimotion::LabimotionAiAPI`'s own `Matrice.ai_enabled_for_any?` gate comes from — the method is now defined by this gem rather than borrowed from whatever the host happened to implement. It also absorbs the auto-fill gate the host used to own as a `LabimotionAiAccess` service: `.fill_enabled_for?(user)` is `ai_uids` AND `fill_uids` on `FILL_FEATURE` (genericElement, the only feature carrying such a list — the designer's "New (AI)" buttons on the other two types are admin-only and need no second gate), so the gem's `ai_fill_data` route and the host's own `aiFill` flag answer through one method and cannot disagree about who may auto-fill. That drops the gem from two host constants to one: it no longer reaches for a `LabimotionAiAccess` a host had to implement, only for the model carrying this concern. Host ELN change is the `include`, the deletion of the moved methods and of that service; **the host will not boot without a gem carrying this concern**, since the model that includes it is loaded app-wide.
+  * Per-user settings now live in a gem-owned `user_settings` table instead of the host's profile jsonb, starting with the AI settings that were the only occupant. One row per `(user_id, key)`, each with its own `settings` jsonb and a unique index on the pair — `Labimotion::UserSetting`, keys enumerated in `Constants::UserSettingKey` (`ai` today, `my_layers` next). Split by row rather than one blob per user on purpose: the keys have nothing to do with each other and differ wildly in size, so a shared row would mean every save rewrites the lot and two features saving at once would clobber each other. `Labimotion::ProfileAiSettings` — the concern the host mixed into `Profile` — is **removed** and replaced by `Labimotion::UserAiSettings`, a wrapper over the `ai` row with the same field semantics it always had (nil leaves a field unchanged, a blank string clears it, the api_key is stored encrypted and only ever reported as set-or-not) and an injectable store so the shape can be exercised without a database. Encryption stays the host's `Encryptor`, unchanged, so stored ciphertext keeps decrypting. `Constants::UserSetting` is renamed `Constants::UserKlassSetting` — its members are the sub-keys of the per-klass table and the old name would now read as the new one's. Requires host ELN twin migrations `create_user_settings` and `move_labimotion_ai_settings_to_user_settings`; the latter copies each profile's `labimotion_ai` object verbatim (ciphertext included — re-encrypting would be the only way to get it wrong) and then deletes the profile key, unlike the `ui_preference` consolidation which left an inert value behind: this one would otherwise leave a second copy of a credential in a column several endpoints serialize. It is reversible, so rolling the gem back does not strand a key in a table nothing reads. Deploy order is migrate → **restart**.
+  * New template-sharing role `Maintainer` ([chem-generic-ui#1082](https://github.com/cllde8/chem-generic-ui/issues/1082)): everything an editor may do plus releasing **minor** versions — major releases, activation, deletion and share management stay owner-only. `KlassShare::LEVELS` gains `maintainer: 25` (additive, strictly between editor and owner, nobody renumbered — the one-owner partial index on level 30 is untouched, so no migration); `ShareResolver::REQUIRED_LEVEL` gains `release_minor: 25` while `release` keeps meaning the major at 30; `update_template` now asks `:write` for a draft, `:release_minor` for a minor and `:release` for a major — an unrecognised release value fails toward the stricter gate. List payloads gain `can_release_minor` under the same `share_context` guard as the other capability booleans, the grant and level-change routes accept level 25, and the `release_minor` refusal names maintainer access instead of claiming owner-only. Ships with the matching chem-generic-ui change (Minor button gated on the new capability; an absent field on an older gem falls back to `can_release`).
   * `Link Element` is now available as a column type inside `Table` fields of generic elements and segments ([chem-generic-ui#1055](https://github.com/LabIMotion/chem-generic-ui/issues/1055), labimotion#261). A `drag_element` cell stores the same payload the layer-level field stores (`el_id`, `el_klass`, `el_label`, `el_name`, `el_tip`, `icon_name`) and deliberately carries no `is_new`/`cr_opt`: a drop links a record that already exists and must never create one on save, unlike the sample column it sits next to. The stored label, name, tooltip and icon are refreshed on every read by the new `Labimotion::Serializer.set_table_element`, called from `PropertiesEntity` and `ElnElementEntity` as well, so all three property loaders agree rather than drifting into three copies. `SampleAssociation.build_table_element` writes the `Labimotion::ElementsElement` join rows and feeds the same `els` list that the stale-link cleanup compares against — feeding it is load-bearing, since the cleanup would otherwise `destroy_all` the rows it had just created. Both paths skip a cell whose `el_klass` is a `Labimotion::LinkedElement::MODELS` key: such a column accepts reactions, wellplates, screens and the rest as readily as generic elements, and for those `el_id` is not a `Labimotion::Element` id, so resolving it would relabel or link a wholly unrelated element — the same guard the layer-level field already applies. Carried through every export path: XLSX (`exporter_helpers`, expandable like the sample and molecule columns, short label as the cell text and `Name` as an optional sub-column), DOCX (`export_element`), and the ZIP round-trip (`export_utils` remaps element ids to uuids, `import_utils` re-links them through the new `proc_table_element`). A linked element has no structure image, so the cell shows the klass icon instead of an SVG.
   * Element cover images, write path ([chem-generic-ui#1050](https://github.com/LabIMotion/chem-generic-ui/issues/1050), labimotion#259): the element create and update saves now validate the `cover_images` key of the optional `metadata` param — an array of at most 3 `{ source: attachment|analysis, id: <integer> }` references, mirroring the chem-generic-ui picker's cap and vocabulary, normalized to exactly those two entry keys — and refuse a malformed selection with a plain 422 before any container/sample-association write runs. All cover-image helpers live in the dedicated `Labimotion::CoverImageHelpers` module, with the contract cap and source vocabulary as `Constants::CoverImage::MAX`/`SOURCES`. The rest of the metadata document keeps its existing contract: a present param replaces the stored hash wholesale, because its other writers (layer groups/restrictions from the details page, host regComps through the registry seam) remove a key by omitting it, while an absent param leaves stored metadata untouched — an old client that does not send `metadata` can never wipe a saved cover selection. References only, no FK: a deleted attachment/analysis leaves a dangling reference the UI skips at render time. No migration (`elements.metadata` and `elements_revisions.metadata` already exist), no entity change (`metadata` was already exposed), no klass change (the per-klass `cover_image` toggle rides the existing `update_settings` shallow merge); revision snapshots already carry `metadata` alongside `properties`, and restoring a revision round-trips the cover selection through this validated save.
   * Element cover images, original serving ([chem-generic-ui#1050](https://github.com/LabIMotion/chem-generic-ui/issues/1050), labimotion#259): new `GET /generic_elements/cover_image?element_id=&source=&id=` answers the original file behind a cover-image reference, so the element page's display area can show originals while thumbnails stay in the picker. Gated by the `genericElement` matrix check plus `ElementPolicy` `read?` **and** `read_dataset?` (analysis previews are dataset attachments, and the ELN's own attachment reads demand both); the reference resolves through the element's own associations only, so a foreign attachment or container id answers 404, never a file. An `analysis` reference resolves the container preview server-side for the first time, mirroring the client's `getContainerImageData`: the container's `preferred_thumbnail` while it still exists, else the newest "combined" image, else the newest thumbnail-bearing dataset attachment. The body is the original bytes under the file's own content type — or the PNG thumbnail when a browser could not render the original (TIFF, raw-data files behind an analysis preview). An optional `variant=thumbnail` always answers the PNG thumbnail through the same gate and resolution, which is what the picker's rows show — for an svg the stored thumbnail (black: ImageMagick reads `transparent` as black) is replaced by a fresh white-background rasterization of the original, through the same shared converter as the docx export — with it, the whole cover-image feature runs on gem-owned API surface and the host wires no fetcher at all. The picker's Save persists directly through the new `POST /generic_elements/cover_images` (`element_id`, `cover_images`; gated by `ElementPolicy` `update?` + the matrix check): the same validation as the element-save path, then a **targeted merge** of exactly the `cover_images` key into the stored metadata — deliberately narrower than the element save's wholesale-replace contract, so this writer can neither wipe nor resurrect `groups`/host keys. Live like klass settings: the write is immediate and unversioned until the next element save snapshots metadata into the revisions. The docx export (`ExportElement`) now renders the cover selection too: the stored references resolve through the same helpers as the `cover_image` endpoint, each image is embedded above the layers (originals for the rasters Word renders reliably — png/jpeg/gif/bmp; other renderable originals such as svg are rasterized onto white via MiniMagick, with the CSS keyword `transparent` normalized to `none` first because ImageMagick’s own SVG renderer reads it as black — the PNG thumbnail only as last resort), captioned "ref: …" and scaled to the page via MiniMagick-read dimensions (best effort — without them the template placeholder geometry is kept), Requires the matching `Labimotion_lines.docx` template change in the host ELN (a `has_cover`-guarded `cover_images:each` block before the layers loop); an old template simply ignores the new context keys.

data/lib/labimotion/apis/generic_element_api.rb

@@ -233,19 +233,20 @@ module Labimotion
       # instance route and Element.find(nil) is raised.
       namespace :ai_fill_data do
         # Auto-fill is the one AI action ordinary users reach — the designer's
-        # create/refine routes are admin-only — so it carries its own whitelist,
-        # supplied by the host: the genericElement AI list narrowed by
-        # :fill_uids. Reached through the host the same way this API already
-        # reaches ElementPolicy, and CLOSED when the host provides no such
-        # policy, matching how every other gate in this feature defaults.
+        # create/refine routes are admin-only — so it carries its own whitelist:
+        # the genericElement AI list narrowed by :fill_uids. The rule is ours
+        # (Labimotion::MatriceLabimotion); the lists are the host's, on the
+        # model it mixes that concern into. Reached the same way this API already
+        # reaches ElementPolicy, and CLOSED when the host mounts no such model,
+        # matching how every other gate in this feature defaults.
         # NameError, not defined?: under Zeitwerk `defined?` is nil until the
         # constant has actually been referenced, so testing it would refuse the
         # first request after every boot. Referencing it triggers the autoload;
-        # a host that genuinely ships no such policy raises, and that is a
+        # a host that genuinely ships no such model raises, and that is a
         # refusal too.
         before do
           allowed = begin
-            LabimotionAiAccess.fill_enabled_for?(current_user)
+            Matrice.fill_enabled_for?(current_user)
           rescue NameError
             false
           end

data/lib/labimotion/apis/klass_share_api.rb

@@ -7,7 +7,7 @@ module Labimotion
   # Share management for generic templates (template-sharing.md §7). Its own API class, not
   # more namespaces in GenericKlassAPI, so the spec harness can load and mount it alone.
   #
-  # Grant and level-change accept viewer/editor only: the owner level never moves through
+  # Grant and level-change accept viewer/editor/maintainer only: the owner level never moves through
   # these routes. It moves through transfer_ownership, an update of the single owner row, so
   # the one-owner-per-klass invariant holds at every instant and the handover is auditable.
   #
@@ -292,7 +292,7 @@ module Labimotion
           { mc: 'se00', msg: e.message }
         end
 
-        desc 'grant viewer/editor access to users (upsert)'
+        desc 'grant viewer/editor/maintainer access to users (upsert)'
         params do
           requires :klass, type: String, desc: 'Klass', values: Labimotion::Constants::Klass::ALL
           requires :id, type: Integer, desc: 'Klass ID'
@@ -300,10 +300,11 @@ module Labimotion
           # rubocop:disable Style/RedundantArrayConstructor
           requires :user_ids, type: Array[Integer], desc: 'users to share with (Persons only)'
           # rubocop:enable Style/RedundantArrayConstructor
-          # Literal 10/20 (viewer/editor), not KlassShare::LEVELS: params blocks run while
-          # the routes are built, and referencing the ActiveRecord model there would force it
-          # to load in any process that only mounts the API. Owner (30) is absent on purpose.
-          requires :permission_level, type: Integer, desc: 'viewer or editor', values: [10, 20]
+          # Literal 10/20/25 (viewer/editor/maintainer), not KlassShare::LEVELS: params blocks
+          # run while the routes are built, and referencing the ActiveRecord model there would
+          # force it to load in any process that only mounts the API. Owner (30) is absent on
+          # purpose.
+          requires :permission_level, type: Integer, desc: 'viewer, editor or maintainer', values: [10, 20, 25]
         end
         post do
           klz = fetch_klass(params[:klass], params[:id])
@@ -331,7 +332,7 @@ module Labimotion
           # grant into an se00 (labimotion#255 — moved in from the host).
           Labimotion::ShareNotifier.grant(
             klass: klz, actor: current_user, user_ids: params[:user_ids].uniq,
-            level: params[:permission_level] == 20 ? 'editor' : 'viewer'
+            level: { 10 => 'viewer', 20 => 'editor', 25 => 'maintainer' }.fetch(params[:permission_level])
           )
           { mc: 'ss00' }.merge(represent_shares(klz))
         rescue StandardError => e
@@ -339,13 +340,14 @@ module Labimotion
           { mc: 'se00', msg: e.message }
         end
 
-        desc 'change the level of one share (viewer/editor only)'
+        desc 'change the level of one share (viewer/editor/maintainer only)'
         params do
           requires :share_id, type: Integer, desc: 'Share ID'
-          # Literal 10/20 (viewer/editor), not KlassShare::LEVELS: params blocks run while
-          # the routes are built, and referencing the ActiveRecord model there would force it
-          # to load in any process that only mounts the API. Owner (30) is absent on purpose.
-          requires :permission_level, type: Integer, desc: 'viewer or editor', values: [10, 20]
+          # Literal 10/20/25 (viewer/editor/maintainer), not KlassShare::LEVELS: params blocks
+          # run while the routes are built, and referencing the ActiveRecord model there would
+          # force it to load in any process that only mounts the API. Owner (30) is absent on
+          # purpose.
+          requires :permission_level, type: Integer, desc: 'viewer, editor or maintainer', values: [10, 20, 25]
         end
         put ':share_id' do
           row = find_share!(params[:share_id])

data/lib/labimotion/apis/labimotion_ai_api.rb

@@ -6,10 +6,9 @@ module Labimotion
   # Per-user LabIMotion AI settings: the model, an optional personal API key and
   # an optional provider endpoint of one's own.
   #
-  # These live on the HOST's user profile rather than in a gem table, because the
-  # credential belongs to the person, not to LabIMotion — so the routes stay
-  # under /profiles and reach the host's Profile through current_user, the same
-  # way the rest of this gem reaches ElementPolicy and Matrice.
+  # They live in our own user_settings table under the 'ai' key
+  # (Labimotion::UserAiSettings). The routes stay under /profiles, where clients
+  # already reach them, but nothing is stored on the host's profile any more.
   #
   # The API key is stored encrypted and never returned; a read only reports
   # whether one is set.
@@ -18,6 +17,7 @@ module Labimotion
     # :models) lists none. A representative subset of the chat-capable KI-Toolbox
     # models (ki-toolbox.scc.kit.edu); the full list lives in the yml.
     DEFAULT_MODELS = %w[
+      kit.mistral-small-4-119b-a8b
       azure.gpt-4.1-mini
       azure.gpt-4.1
       azure.gpt-5
@@ -81,10 +81,16 @@ module Labimotion
           # with the user's saved model so their current selection is always valid.
           def labimotion_ai_models
             models = labimotion_ai_server_models
-            append_ai_model(models, current_user.profile.labimotion_ai_model.to_s)
+            append_ai_model(models, ai_settings.model.to_s)
             models
           end
 
+          # This user's stored AI settings. Memoized per request: several of the
+          # routes below read it more than once.
+          def ai_settings
+            @ai_settings ||= Labimotion::UserAiSettings.for(current_user)
+          end
+
           # Model ids the SHARED server key permits — the server models plus the
           # ENV default. Unlike available_models this excludes the user's own saved
           # model, so it is safe to enforce a keyless user's selection against.
@@ -122,13 +128,13 @@ module Labimotion
 
         desc 'get the current user LabIMotion AI settings (never returns the key)'
         get do
-          profile = current_user.profile
+          settings = ai_settings
           configured = Rails.configuration.respond_to?(:labimotion_ai) ? Rails.configuration.labimotion_ai : nil
           {
-            model: profile.labimotion_ai_model,
-            api_key_set: profile.labimotion_ai_api_key?,
-            base_url: profile.labimotion_ai_base_url,
-            api_path: profile.labimotion_ai_api_path,
+            model: settings.model,
+            api_key_set: settings.api_key?,
+            base_url: settings.base_url,
+            api_path: settings.api_path,
             available_models: labimotion_ai_models,
             default_model: (configured && configured[:model]).presence,
             default_base_url: (configured && configured[:base_url]).presence,
@@ -146,7 +152,7 @@ module Labimotion
           optional :clear_endpoint, type: Boolean, default: false, desc: 'Remove the stored provider endpoint'
         end
         put do
-          profile = current_user.profile
+          settings = ai_settings
           api_key_arg =
             if params[:clear_api_key]
               '' # blank -> clear
@@ -162,7 +168,7 @@ module Labimotion
             elsif params[:api_key].present?
               true
             else
-              profile.labimotion_ai_api_key?
+              settings.api_key?
             end
           # A keyless user's AI calls run on the shared server key, so the chosen
           # model must be one the admin approved. A user on their own key may pick
@@ -184,7 +190,7 @@ module Labimotion
           api_path_arg = params[:clear_endpoint] ? '' : params[:api_path]
           validate_ai_endpoint!(base_url_arg, will_have_key)
 
-          summary = profile.update_labimotion_ai(
+          summary = settings.update(
             model: params[:model].presence, api_key: api_key_arg,
             base_url: base_url_arg, api_path: api_path_arg
           )
@@ -201,14 +207,14 @@ module Labimotion
 
         desc 'fetch the live model list from the AI provider with the user personal key'
         post 'models' do
-          profile = current_user.profile
+          settings = ai_settings
           # Deliberately the PERSONAL key only: the shared server key must not be
           # sent to a user-supplied provider URL, and a keyless user's model choice
           # is restricted to labimotion_ai_admin_model_ids anyway.
           result = Labimotion::AiModels.new(
-            api_key: profile.labimotion_ai_api_key,
-            base_url: profile.labimotion_ai_base_url,
-            api_path: profile.labimotion_ai_api_path
+            api_key: settings.api_key,
+            base_url: settings.base_url,
+            api_path: settings.api_path
           ).call
           { status: true, models: result[:models], endpoint: result[:endpoint] }
         rescue StandardError => e
@@ -217,15 +223,15 @@ module Labimotion
 
         desc 'test the current user LabIMotion AI connection (nothing is saved)'
         post 'test' do
-          profile = current_user.profile
+          settings = ai_settings
           # Same values the runtime override path reads, so the test exercises the
           # real config: base_url/api_path are honored by the gem only alongside a
           # personal key, and a custom endpoint is SSRF-validated there.
           result = Labimotion::AiTemplate.ping(
-            model: profile.labimotion_ai_model,
-            api_key: profile.labimotion_ai_api_key,
-            base_url: profile.labimotion_ai_base_url,
-            api_path: profile.labimotion_ai_api_path
+            model: settings.model,
+            api_key: settings.api_key,
+            base_url: settings.base_url,
+            api_path: settings.api_path
           )
           { status: true, ok: true, model: result['model'],
             endpoint: result['endpoint'], ms: result['ms'] }

data/lib/labimotion/apis/user_klass_settings_api.rb

@@ -20,12 +20,12 @@ module Labimotion
       # as "leave alone"; an empty linked_el_attrs array reads as "clear".
       def submitted_settings(settings)
         settings = (settings || {}).transform_keys(&:to_s)
-        toolbar = settings[Labimotion::Constants::UserSetting::TOOLBAR]
-        attrs = settings[Labimotion::Constants::UserSetting::LINKED_EL_ATTRS]
+        toolbar = settings[Labimotion::Constants::UserKlassSetting::TOOLBAR]
+        attrs = settings[Labimotion::Constants::UserKlassSetting::LINKED_EL_ATTRS]
         {}.tap do |result|
-          result[Labimotion::Constants::UserSetting::TOOLBAR] = toolbar if toolbar.is_a?(Hash)
+          result[Labimotion::Constants::UserKlassSetting::TOOLBAR] = toolbar if toolbar.is_a?(Hash)
           if attrs.is_a?(Array)
-            result[Labimotion::Constants::UserSetting::LINKED_EL_ATTRS] = normalize_linked_el_attrs(attrs)
+            result[Labimotion::Constants::UserKlassSetting::LINKED_EL_ATTRS] = normalize_linked_el_attrs(attrs)
           end
         end
       end

data/lib/labimotion/constants.rb

@@ -46,11 +46,28 @@ module Labimotion
 
     # The independent sub-settings held side by side in
     # user_klass_settings.settings. A save writes only the ones it carries.
-    module UserSetting
+    #
+    # Named for the table: these are the sub-keys of a per-user, per-KLASS row.
+    # The per-user, klass-independent settings are a different table with its own
+    # key list — see UserSettingKey below.
+    module UserKlassSetting
       TOOLBAR = 'toolbar'
       LINKED_EL_ATTRS = 'linked_el_attrs'
     end
 
+    # The `key` column of user_settings: one row per user per key, each owning an
+    # independent `settings` jsonb. A feature claims a key here and nothing else
+    # in the table can disturb it, which is the point of splitting by row rather
+    # than sharing one blob — a large layer library and a stored credential have
+    # no reason to be rewritten by each other's saves.
+    module UserSettingKey
+      # Per-user AI settings: model, personal API key (encrypted), provider
+      # endpoint. Read and written through Labimotion::UserAiSettings.
+      AI = 'ai'
+      # A user's own layers — visible to them alone, not published to a template.
+      MY_LAYERS = 'my_layers'
+    end
+
     # The independent sub-settings held side by side in a KLASS's own `settings`
     # jsonb (element_klasses / segment_klasses / dataset_klasses). A save
     # shallow-merges, so writing one never disturbs the others.

data/lib/labimotion/entities/generic_klass_entity.rb

@@ -26,7 +26,7 @@ module Labimotion
     # in the class body would chain-autoload KlassShare (an ActiveRecord model) just to load
     # this entity, which the gem's Rails-less spec harness cannot do. The blocks only run when
     # a share context was preloaded, so inside them the constants are safe.
-    %i[write release deactivate destroy manage].each do |action|
+    %i[write release release_minor deactivate destroy manage].each do |action|
       expose "can_#{action}", if: :share_context do |object, options|
         context = options[:share_context]
         key = Labimotion::KlassShare.key_of(object)

data/lib/labimotion/helpers/generic_helpers.rb

@@ -31,8 +31,11 @@ module Labimotion
     # the helpers. ShareResolver stays the enforcement authority.
     ACTION_PHRASE = {
       read: 'view', write: 'edit', release: 'release',
+      release_minor: 'release a minor version of',
       deactivate: 'activate or deactivate', destroy: 'delete', manage: 'manage sharing for'
     }.freeze
+    # `release_minor` is deliberately NOT here: a maintainer holds it too, so its refusal
+    # must not claim "only the owner can" — it gets its own maintainer wording below.
     OWNER_ONLY_ACTIONS = %i[release deactivate destroy manage].freeze
 
     # What makes a klass unique among the *active* rows. These are model validations only —
@@ -92,6 +95,8 @@ module Labimotion
     def authorization_refusal_msg(name, action)
       requirement = if OWNER_ONLY_ACTIONS.include?(action)
                       "Only the owner can #{ACTION_PHRASE[action]} this template."
+                    elsif action == :release_minor
+                      "You need maintainer access to #{ACTION_PHRASE[action]} this template."
                     elsif action == :read
                       "You need shared access to #{ACTION_PHRASE[action]} this template."
                     else
@@ -109,20 +114,18 @@ module Labimotion
       raise e
     end
 
-    # Per-user AI overrides (model + API key) resolved from the host app's user
-    # profile. Returns {} when the host doesn't expose them, so AiTemplate falls
-    # back to the server-wide yml/ENV configuration. Guarded with respond_to? to
-    # keep the gem decoupled from the host's Profile implementation. Shared by the
-    # dataset / element / segment AI helpers.
+    # Per-user AI overrides (model + API key) from the user's own settings row.
+    # Returns {} when nothing is stored, so AiTemplate falls back to the
+    # server-wide yml/ENV configuration. Shared by the dataset / element /
+    # segment AI helpers.
     def ai_user_overrides(current_user)
-      profile = current_user.respond_to?(:profile) ? current_user.profile : nil
-      return {} if profile.nil?
+      return {} if current_user.nil?
 
-      model   = (profile.labimotion_ai_model if profile.respond_to?(:labimotion_ai_model))
-      api_key = (profile.labimotion_ai_api_key if profile.respond_to?(:labimotion_ai_api_key))
-      model   = ai_shared_key_model(model) if api_key.blank?
+      settings = Labimotion::UserAiSettings.for(current_user)
+      api_key = settings.api_key
+      model   = api_key.blank? ? ai_shared_key_model(settings.model) : settings.model
 
-      { model: model, api_key: api_key }.merge(ai_provider_overrides(profile, api_key)).compact
+      { model: model, api_key: api_key }.merge(ai_provider_overrides(settings, api_key)).compact
     rescue StandardError => e
       Labimotion.log_exception(e, current_user)
       {}
@@ -131,13 +134,10 @@ module Labimotion
     # Personal provider endpoint (base_url/api_path) — honored only ALONGSIDE a
     # personal key, so the shared server key is never sent to a user-supplied URL.
     # The base_url itself is SSRF-validated later, in AiTemplate.
-    def ai_provider_overrides(profile, api_key)
+    def ai_provider_overrides(settings, api_key)
       return {} if api_key.blank?
 
-      {
-        base_url: (profile.labimotion_ai_base_url if profile.respond_to?(:labimotion_ai_base_url)),
-        api_path: (profile.labimotion_ai_api_path if profile.respond_to?(:labimotion_ai_api_path))
-      }
+      { base_url: settings.base_url, api_path: settings.api_path }
     end
 
     # On the SHARED server key (user has no personal key), keep the user's model
@@ -205,10 +205,18 @@ module Labimotion
 
     def update_template(params, current_user)
       klz = fetch_klass(params[:klass], params[:id])
-      # The split that makes `editor` mean "drafting only": a draft save needs :write, while
-      # anything else bumps the version and cuts a revision — publishing, which is :release.
+      # The split that makes `editor` mean "drafting only" and `maintainer` mean "drafting
+      # plus minor releases": a draft save needs :write; a minor release bumps the version
+      # and cuts a revision, which a maintainer may do (:release_minor); a major release —
+      # and any release value nobody recognises — stays owner-only (:release), so an unknown
+      # value fails toward the stricter gate.
       # Authorization before the stale check: who may act comes before whether the copy is fresh.
-      authorize_klass!(klz, params[:release] == 'draft' ? :write : :release)
+      release_action = case params[:release]
+                       when 'draft' then :write
+                       when 'minor' then :release_minor
+                       else :release
+                       end
+      authorize_klass!(klz, release_action)
       guard_stale_template!(klz, params[:properties_template])
       uuid = SecureRandom.uuid
       properties = params[:properties_template]

data/lib/labimotion/libs/ai_template.rb

@@ -16,7 +16,7 @@ module Labimotion
   #   :api_key  / KI_TOOLBOX_API_KEY    (required) bearer token (created in the UI)
   #   :base_url / KI_TOOLBOX_BASE_URL   default https://ki-toolbox.scc.kit.edu
   #   :api_path / KI_TOOLBOX_API_PATH   default /api/v1/chat/completions
-  #   :model    / KI_TOOLBOX_MODEL      default azure.gpt-4.1-mini
+  #   :model    / KI_TOOLBOX_MODEL      default kit.mistral-small-4-119b-a8b
   #   :max_tokens, :timeout, :system_prompt
   #
   # The LLM is asked to return a JSON document describing the template layers
@@ -26,7 +26,7 @@ module Labimotion
   class AiTemplate
     DEFAULT_BASE_URL = 'https://ki-toolbox.scc.kit.edu'
     DEFAULT_API_PATH = '/api/v1/chat/completions'
-    DEFAULT_MODEL = 'azure.gpt-4.1-mini'
+    DEFAULT_MODEL = 'kit.mistral-small-4-119b-a8b'
     DEFAULT_MAX_TOKENS = 8000
     # A connection test only needs a valid round-trip, not a useful completion, so
     # cap the reply hard to keep the ping cheap and fast.
@@ -422,6 +422,12 @@ module Labimotion
     # POST an OpenAI-compatible chat-completions request for the given messages.
     # tokens defaults to the full max_tokens; the connection ping passes a small
     # cap so a test round-trip stays cheap.
+    #
+    # A timeout is named rather than left as Net::ReadTimeout. That exception
+    # carries no message a client can show, so it reached the dialog as "Unknown
+    # error" with the only evidence in log/labimotion.log — and it is the likeliest
+    # failure of the lot, because generating a whole template is a far longer
+    # request than the connection test that appears to succeed beside it.
     def post_chat(messages, tokens = max_tokens)
       HTTParty.post(
         "#{base_url}#{api_path}",
@@ -439,6 +445,11 @@ module Labimotion
         # is the classic SSRF bypass of the egress guard.
         follow_redirects: false
       )
+    # Timeout::Error alone: Net::OpenTimeout and Net::ReadTimeout both descend
+    # from it, so naming those too would only shadow them.
+    rescue Timeout::Error
+      raise "AI provider did not respond within #{request_timeout}s — choose a faster " \
+            'model in your AI settings, or raise :timeout in config/labimotion_ai.yml.'
     end
 
     # OpenAI-compatible chat completions return the text at
@@ -1361,10 +1372,14 @@ module Labimotion
           some with a fixed "unit". Return an ARRAY of row objects keyed by those
           column NAMES, one object per row the document describes, e.g.
             [ {"Concentration": 0.5}, {"Concentration": 10} ]
-          A cell follows its column's type — including the system-defined rule
-          above, so a column offering "units" takes {"value":..,"unit":".."} too.
-          Leave out a column you have no value for, and omit the field entirely if
-          the text describes no rows.
+          A cell follows its column's type, by the SAME rules as a field of that
+          type above: a column offering "units" takes {"value":..,"unit":".."},
+          and a "select" column carries its own "options" and takes one of their
+          "key" values. Fill a column for EVERY row it applies to, not just the
+          rows where the document repeats it — when the text describes a set of
+          rows that share a property, each row still states it. Leave out a
+          column you have no value for, and omit the field entirely if the text
+          describes no rows.
         - "text" / "textarea" -> a string.
         - If you find no values at all, return { "values": {}, "summary": "..." }.
 
@@ -1443,7 +1458,7 @@ module Labimotion
       when 'system-defined'
         entry.merge!(unit_info(field))
       when 'table'
-        columns = fill_table_columns(field)
+        columns = fill_table_columns(field, select_options)
         return nil if columns.empty?
 
         entry['columns'] = columns
@@ -1479,11 +1494,14 @@ module Labimotion
       end
     end
 
-    # The columns of a "table" field, as the model can talk about them: name, type
-    # and the unit a measured column is fixed to. Columns that hold a dragged ELN
-    # record (a sample, a molecule) are dropped — nothing in a document's text can
-    # resolve to one, so offering them only invites made-up rows.
-    def fill_table_columns(field)
+    # The columns of a "table" field, as the model can talk about them: name, type,
+    # the unit a measured column is fixed to and the options a choice column allows.
+    # A select column without its options is unfillable in exactly the way a select
+    # FIELD without them is: the model is asked for a value from a list it was never
+    # shown, so it leaves the column empty. Columns that hold a dragged ELN record
+    # (a sample, a molecule) are dropped — nothing in a document's text can resolve
+    # to one, so offering them only invites made-up rows.
+    def fill_table_columns(field, select_options)
       Array(field['sub_fields']).filter_map do |col|
         next unless col.is_a?(Hash)
 
@@ -1491,7 +1509,21 @@ module Labimotion
         type = col['type'].to_s
         next if name.empty? || type.start_with?('drag')
 
-        { 'name' => name, 'type' => type }.merge(type == 'system-defined' ? unit_info(col) : {})
+        { 'name' => name, 'type' => type }.merge(fill_column_choices(col, type, select_options))
+      end
+    end
+
+    # What a column is allowed to hold, by type: the unit group of a measured
+    # column, the option list of a choice column. Both are keyed off the column's
+    # own `option_layers`, exactly as a top-level field's are.
+    def fill_column_choices(col, type, select_options)
+      case type
+      when 'system-defined'
+        unit_info(col)
+      when 'select', 'select-multi'
+        { 'options' => fill_option_pairs(select_options, col) }
+      else
+        {}
       end
     end
 
@@ -1710,7 +1742,7 @@ module Labimotion
       when 'datetime-range'
         coerce_duration(value)
       when 'table'
-        coerce_table_rows(field, value)
+        coerce_table_rows(field, value, select_options)
       else
         coerce_fill_text(value)
       end
@@ -1738,12 +1770,12 @@ module Labimotion
     # to ids when it applies them (the same split as select-multi's sub_fields).
     # Unknown column names and uncoercible cells are dropped; a row left empty by
     # that goes too, so a table never gains a blank line.
-    def coerce_table_rows(field, value)
+    def coerce_table_rows(field, value, select_options)
       return nil unless value.is_a?(Array)
 
       # rubocop:disable Rails/IndexBy -- Enumerable#index_by is ActiveSupport;
       # the gem's own suite boots without it (spec/support/core_extensions.rb).
-      columns = fill_table_columns(field).to_h { |c| [c['name'], c] }
+      columns = fill_table_columns(field, select_options).to_h { |c| [c['name'], c] }
       # rubocop:enable Rails/IndexBy
       rows = value.first(MAX_TABLE_ROWS).filter_map { |row| coerce_table_row(columns, row) }
       rows.empty? ? nil : rows
@@ -1776,11 +1808,27 @@ module Labimotion
         coerce_measured_choices(column['units'], cell)
       when 'checkbox'
         fill_to_boolean(cell)
+      when 'select', 'select-multi'
+        coerce_column_option(column, cell)
       else
         coerce_fill_text(cell)
       end
     end
 
+    # A choice cell as the option KEY the grid renders from. An answer given as
+    # the human label is mapped back, otherwise a column whose key and label
+    # differ ("reference" / "reference standard") would store a string the
+    # dropdown cannot match and the cell would read as empty.
+    def coerce_column_option(column, cell)
+      pairs = Array(column['options'])
+      if column['type'].to_s == 'select-multi'
+        list = cell.is_a?(Array) ? cell : [cell]
+        return list.filter_map { |v| resolve_option_key(pairs, v) }.uniq
+      end
+
+      resolve_option_key(pairs, cell.is_a?(Array) ? cell.first : cell)
+    end
+
     # A measured value: a bare number (read in the field's own unit) or a
     # { 'value', 'unit' } pair naming one of the field's units.
     def coerce_measured(defn, value)

data/lib/labimotion/libs/share_resolver.rb

@@ -9,14 +9,18 @@ module Labimotion
   # a hundred-template list must cost a fixed number of queries, not a lookup per row
   # (template-sharing.md §7).
   class ShareResolver
-    # The authorization ladder (§6). Six names even where thresholds coincide: the call site
+    # The authorization ladder (§6). Seven names even where thresholds coincide: the call site
     # documents intent, and the collapse stays visible in one constant instead of drifting
-    # apart across the codebase. Values are KlassShare::LEVELS (10 viewer / 20 editor /
-    # 30 owner) as literals — dereferencing the ActiveRecord model in this class body would
-    # force it to load in any process that touches the resolver, and the numbers are already
-    # frozen into the one-owner partial index anyway.
+    # apart across the codebase. `release_minor` (25, the maintainer's one extra right) is
+    # distinct from `release` (30, major — still owner-only) for the same reason: the two
+    # release buttons ask two different questions, and collapsing them here is how an editor
+    # once ended up refused on a button the grid had offered. Values are KlassShare::LEVELS
+    # (10 viewer / 20 editor / 25 maintainer / 30 owner) as literals — dereferencing the
+    # ActiveRecord model in this class body would force it to load in any process that touches
+    # the resolver, and the numbers are already frozen into the one-owner partial index anyway.
     REQUIRED_LEVEL = {
-      read: 10, write: 20, release: 30, deactivate: 30, destroy: 30, manage: 30
+      read: 10, write: 20, release_minor: 25, release: 30, deactivate: 30, destroy: 30,
+      manage: 30
     }.freeze
 
     # The requester's inbox predicate (§7), verbatim from the design, as one SQL fragment

data/lib/labimotion/libs/user_ai_settings.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+
+module Labimotion
+  ## Per-user LabIMotion AI settings: the model, an optional personal API key and
+  # an optional provider endpoint of one's own.
+  #
+  # These used to sit in the host's profile jsonb. They now live in our own
+  # user_settings table under the 'ai' key, because the settings are LabIMotion's
+  # and the host's profile is not a good place to keep growing them — see
+  # Labimotion::UserSetting.
+  #
+  # The API key is stored ENCRYPTED and never returned to a client: only whether
+  # one is set. Encryption stays the HOST's — key management is a deployment
+  # concern and a gem has no business inventing one. Chemotion supplies it as an
+  # `Encryptor` concern, pulled in below when present. A host that names its
+  # encryption differently defines `encrypt_value` / `decrypt_value` instead.
+  #
+  #   settings = Labimotion::UserAiSettings.for(current_user)
+  #   settings.model            # => 'azure.gpt-4.1'
+  #   settings.api_key?         # => true   (never the key itself, to a client)
+  #   settings.update(model: 'azure.gpt-5')
+  #
+  # `store` is injectable so the shape can be exercised without a database.
+  class UserAiSettings
+    KEY = Labimotion::Constants::UserSettingKey::AI
+
+    # Reference, not `defined?`: under Zeitwerk the latter reads nil until a
+    # constant has been touched, while referencing it triggers the autoload.
+    # rubocop:disable Layout/EmptyLinesAfterModuleInclusion -- the blank line
+    # this wants collides with EmptyLinesAroundExceptionHandlingKeywords.
+    begin
+      include Encryptor
+    rescue NameError
+      nil
+    end
+    # rubocop:enable Layout/EmptyLinesAfterModuleInclusion
+
+    attr_reader :user_id
+
+    def initialize(user_id, store: Labimotion::UserSetting)
+      @user_id = user_id
+      @store = store
+    end
+
+    # From whatever the host calls a user. Accepts the record or a bare id.
+    def self.for(user, store: Labimotion::UserSetting)
+      new(user.respond_to?(:id) ? user.id : user, store: store)
+    end
+
+    def settings
+      @store.settings_for(@user_id, KEY)
+    end
+
+    def model
+      settings['model'].presence
+    end
+
+    # Personal provider endpoint (BYO-Provider). Honored only alongside a
+    # personal key, and SSRF-validated by Labimotion::AiEgressGuard before any
+    # request is made.
+    def base_url
+      settings['base_url'].presence
+    end
+
+    def api_path
+      settings['api_path'].presence
+    end
+
+    def api_key?
+      settings['api_key'].present?
+    end
+
+    # Decrypted personal API key, or nil when none is stored.
+    def api_key
+      enc = settings['api_key']
+      return nil if enc.blank?
+
+      decrypt_value(enc).presence
+    end
+
+    # What is safe to hand a client: everything but the key, which is reported
+    # only as set-or-not.
+    def summary
+      stored = settings
+      { model: stored['model'], api_key_set: stored['api_key'].present?,
+        base_url: stored['base_url'], api_path: stored['api_path'] }
+    end
+
+    # Persist the settings. For every field: nil leaves it unchanged, a blank
+    # string clears it, anything else is stored (the api_key encrypted).
+    # Returns the safe summary — never the key itself.
+    def update(model: nil, api_key: nil, base_url: nil, api_path: nil)
+      @store.update_settings(@user_id, KEY) do |ai|
+        set_or_clear(ai, 'model', model)
+        set_or_clear_api_key(ai, api_key)
+        set_or_clear(ai, 'base_url', base_url)
+        set_or_clear(ai, 'api_path', api_path)
+        ai
+      end
+      summary
+    end
+
+    private
+
+    # nil -> leave unchanged; blank string -> clear; else store the trimmed value.
+    def set_or_clear(stored, key, value)
+      return if value.nil?
+
+      trimmed = value.to_s.strip
+      if trimmed.blank?
+        stored.delete(key)
+      else
+        stored[key] = trimmed
+      end
+    end
+
+    # As set_or_clear, but the value is encrypted on the way in.
+    def set_or_clear_api_key(stored, value)
+      return if value.nil?
+
+      trimmed = value.to_s.strip
+      if trimmed.blank?
+        stored.delete('api_key')
+      else
+        stored['api_key'] = encrypt_value(trimmed)
+      end
+    end
+  end
+end

data/lib/labimotion/models/concerns/matrice_labimotion.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+module Labimotion
+  ## The LabIMotion side of a host's UI-feature model — whatever this gem needs
+  # to read out of the per-feature JSON configs an admin edits.
+  #
+  # Today that is one thing: which users may reach the AI integration. Named for
+  # the seam rather than for that one job, so the next setting we need from a
+  # feature's configs lands beside it instead of in a second concern mixed into
+  # the same model.
+  #
+  # The division throughout: which users are allowed is the HOST's decision and
+  # the host's data — an admin edits the lists on the UI Features page and they
+  # live in the host's own table. What the answer MEANS is LabIMotion's: which
+  # generic types have an AI integration, that auto-fill is a sub-gate rather
+  # than a separate one, and that every step is closed by default. So the shape
+  # lives here and the storage stays there, the same division the rest of this
+  # gem keeps with its host.
+  #
+  # Chemotion holds the configs on its `Matrice` model, which includes this:
+  #
+  #   class Matrice < ApplicationRecord
+  #     include Labimotion::MatriceLabimotion
+  #   end
+  #
+  # A host supplying it needs two things: the including model must answer
+  # `find_by(name:)` with a record exposing a `configs` hash, and its user must
+  # answer `matrix_check_by_name(name)` with whether that feature is on for them
+  # at all. Both already hold for the model this was extracted from.
+  #
+  # The configs a feature may carry:
+  #
+  #   { "ai_uids": [109, 147], "fill_uids": [109] }
+  #
+  module MatriceLabimotion
+    extend ActiveSupport::Concern
+
+    # UI features whose JSON configs may carry an AI whitelist. Each one gates the
+    # LabIMotion AI integration of its own generic type (the designer's "New (AI)"
+    # / "Fine-tune with AI" buttons, and — for genericElement — the AI auto-fill in
+    # the element detail view).
+    AI_FEATURES = %w[genericElement segment genericDataset].freeze
+
+    # The feature carrying the auto-fill whitelist. Only this one has a
+    # `fill_uids` list: auto-fill is the AI action ordinary users reach, in the
+    # element detail view, while the designer's "New (AI)" buttons on the other
+    # two types are admin-only and need no second gate.
+    FILL_FEATURE = 'genericElement'
+
+    # rubocop:disable Metrics/BlockLength -- a concern's class_methods block is a
+    # namespace for the methods it contributes, not a unit of logic to keep short.
+    class_methods do
+      # User ids allowed to use the AI integration of a UI feature, read from that
+      # feature's JSON configs:
+      #
+      #   { "ai_uids": [109] }
+      def ai_uids(name)
+        whitelist_uids(name, 'ai_uids')
+      end
+
+      # User ids allowed to run AI auto-fill, read from the same JSON configs:
+      #
+      #   { "ai_uids": [109, 147], "fill_uids": [109] }
+      #
+      # A sub-gate on ai_uids, not a separate one — auto-fill is the AI action
+      # ordinary users reach, so it is narrowed to a subset of the group that sees
+      # the integration at all. Only genericElement consults it; the designer's
+      # "New (AI)" buttons are admin-only and have no equivalent.
+      def fill_uids(name)
+        whitelist_uids(name, 'fill_uids')
+      end
+
+      # True when `user` may use the AI integration of `name`. The whitelist is a
+      # sub-gate on top of normal feature visibility, so a whitelisted user still
+      # sees nothing when the feature itself is off for them.
+      def ai_enabled_for?(user, name)
+        return false if user.nil?
+
+        ai_uids(name).include?(user.id) && user.matrix_check_by_name(name)
+      end
+
+      # { 'genericElement' => true, 'segment' => false, ... } for the UI to gate on.
+      def ai_features_for(user)
+        AI_FEATURES.index_with { |name| ai_enabled_for?(user, name) }
+      end
+
+      # True when `user` is whitelisted for at least one generic type — the gate for
+      # shared surfaces such as the "AI" tab in My LabIMotion.
+      def ai_enabled_for_any?(user)
+        AI_FEATURES.any? { |name| ai_enabled_for?(user, name) }
+      end
+
+      # True when `user` may run AI auto-fill (the wand in the generic element
+      # toolbar, POST /generic_elements/ai_fill_data). Takes no feature name
+      # because only FILL_FEATURE has such a list.
+      #
+      # Both gates must pass: `ai_uids` decides who sees the AI integration at
+      # all, `fill_uids` narrows that group. It narrows rather than widens, so a
+      # user on fill_uids alone gets nothing.
+      #
+      # The endpoint is defined in this gem and the host reports the same answer
+      # to its client, both through this one method, so the button and the
+      # endpoint can never disagree about who may use it.
+      def fill_enabled_for?(user)
+        return false if user.nil?
+
+        ai_enabled_for?(user, FILL_FEATURE) && fill_uids(FILL_FEATURE).include?(user.id)
+      end
+
+      private
+
+      # Closed by default: a missing key, a non-array value or an empty list all mean
+      # nobody. Non-numeric entries are dropped rather than raising, so a typo in the
+      # admin JSON editor narrows the whitelist instead of breaking the page.
+      def whitelist_uids(name, key)
+        uids = (find_by(name: name)&.configs || {})[key]
+        return [] unless uids.is_a?(Array)
+
+        uids.filter_map { |uid| Integer(uid, exception: false) }
+      end
+    end
+    # rubocop:enable Metrics/BlockLength
+  end
+end

data/lib/labimotion/models/klass_share.rb

@@ -31,9 +31,12 @@ module Labimotion
     # message in the main ELN, this acknowledges a share row in the Designer, and the two answer
     # different questions in different places.
 
-    # Strictly nested ladder (requested ⊂ viewer ⊂ editor ⊂ owner), which is what makes `>=`
-    # threshold checks valid. Spaced by ten so a future level is additive; never renumber —
-    # the one-owner-per-klass partial index freezes `permission_level = 30` into the schema.
+    # Strictly nested ladder (requested ⊂ viewer ⊂ editor ⊂ maintainer ⊂ owner), which is
+    # what makes `>=` threshold checks valid. Spaced by ten so a future level is additive —
+    # `maintainer` (25) is exactly that: everything an editor may do plus releasing minor
+    # versions, slotted between editor and owner without renumbering anybody. Never
+    # renumber — the one-owner-per-klass partial index freezes `permission_level = 30`
+    # into the schema.
     #
     # `requested` is the odd one: it grants nothing. It is how an access request is stored —
     # a row rather than a message, because the last hop of the request loop lands on the
@@ -42,7 +45,7 @@ module Labimotion
     # state changes on it, and the unique (klass_type, klass_id, shared_with_id) index
     # dedupes repeat asks for free. `0 >= 10` is false, so every threshold check refuses it
     # without a special case.
-    LEVELS = { requested: 0, viewer: 10, editor: 20, owner: 30 }.freeze
+    LEVELS = { requested: 0, viewer: 10, editor: 20, maintainer: 25, owner: 30 }.freeze
 
     # Which account types may hold a share row. `Admin` is in the list because both seeding
     # paths have to reach the same verdict: the seed migration is raw SQL over `created_by`

data/lib/labimotion/models/user_klass_setting.rb

@@ -18,8 +18,8 @@ module Labimotion
     # key itself as the identifier — 'sample', 'reaction', ...
     PERMIT_TARGET = Labimotion::Constants::Klass::PERMIT_TARGET
 
-    TOOLBAR = Labimotion::Constants::UserSetting::TOOLBAR
-    LINKED_EL_ATTRS = Labimotion::Constants::UserSetting::LINKED_EL_ATTRS
+    TOOLBAR = Labimotion::Constants::UserKlassSetting::TOOLBAR
+    LINKED_EL_ATTRS = Labimotion::Constants::UserKlassSetting::LINKED_EL_ATTRS
 
     self.table_name = :user_klass_settings
 

data/lib/labimotion/models/user_setting.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module Labimotion
+  # Per-user, klass-independent settings — one row per (user, key), each with its
+  # own `settings` jsonb.
+  #
+  # The sibling table user_klass_settings holds what a user configures ABOUT a
+  # klass (toolbar, linked-element attributes); this one holds what belongs to
+  # the user themselves, whatever klass they are looking at: their AI credentials
+  # today, their own layers next.
+  #
+  # Split by row rather than one settings blob per user on purpose. The keys have
+  # nothing to do with each other and differ wildly in size — a stored credential
+  # is a few hundred bytes, a personal layer library can be a lot more — so
+  # sharing a row would mean every save rewrites the lot, and two features saving
+  # at once would clobber each other. A unique index on (user_id, key) keeps one
+  # row per feature per user; see Labimotion::Constants::UserSettingKey for the
+  # keys in use.
+  #
+  # Values are read and written through a per-key wrapper that owns the shape
+  # (Labimotion::UserAiSettings for AI), not by reaching into `settings` from
+  # callers — the same division the klass-settings API keeps.
+  class UserSetting < ApplicationRecord
+    self.table_name = :user_settings
+
+    # The stored hash for one key, or {} when the user has never saved any.
+    # Never nil, so callers can read straight through it.
+    def self.settings_for(user_id, key)
+      return {} if user_id.blank? || key.blank?
+
+      find_by(user_id: user_id, key: key)&.settings || {}
+    end
+
+    # Replace the stored hash for one key. Blank-out (an empty hash) deletes the
+    # row rather than leaving an empty one behind, so "has this user configured
+    # anything?" stays answerable by the row's existence.
+    def self.write_settings(user_id, key, settings)
+      raise ArgumentError, 'user_id is required' if user_id.blank?
+      raise ArgumentError, 'key is required' if key.blank?
+
+      row = find_or_initialize_by(user_id: user_id, key: key)
+      if settings.blank?
+        row.destroy! if row.persisted?
+        return {}
+      end
+
+      row.settings = settings
+      row.save!
+      row.settings
+    end
+
+    # Read-modify-write of one key's hash. The block is handed a mutable copy and
+    # whatever it returns is stored, so a caller changing one field cannot drop
+    # the others by accident.
+    def self.update_settings(user_id, key)
+      current = settings_for(user_id, key).dup
+      write_settings(user_id, key, yield(current))
+    end
+  end
+end

data/lib/labimotion/version.rb

@@ -2,5 +2,5 @@
 
 ## Labimotion Version
 module Labimotion
-  VERSION = '2.4.0.rc8'
+  VERSION = '2.4.0.rc9'
 end

data/lib/labimotion.rb

@@ -90,6 +90,7 @@ module Labimotion
   autoload :AiTemplate, 'labimotion/libs/ai_template'
   autoload :AiEgressGuard, 'labimotion/libs/ai_egress_guard'
   autoload :AiModels, 'labimotion/libs/ai_models'
+  autoload :UserAiSettings, 'labimotion/libs/user_ai_settings'
   autoload :OntologyTerms, 'labimotion/libs/ontology_terms'
   autoload :OntologyStore, 'labimotion/libs/ontology_store'
   autoload :FileExtractor, 'labimotion/libs/file_extractor'
@@ -152,6 +153,7 @@ module Labimotion
   autoload :StdLayer, 'labimotion/models/std_layer'
   autoload :StdLayersRevision, 'labimotion/models/std_layers_revision'
   autoload :UserKlassSetting, 'labimotion/models/user_klass_setting'
+  autoload :UserSetting, 'labimotion/models/user_setting'
   autoload :KlassShare, 'labimotion/models/klass_share'
 
   autoload :CellLine, 'labimotion/models/cellline'
@@ -172,7 +174,7 @@ module Labimotion
   autoload :Segmentable, 'labimotion/models/concerns/segmentable'
   autoload :Datasetable, 'labimotion/models/concerns/datasetable'
   autoload :AttachmentConverter, 'labimotion/models/concerns/attachment_converter'
-  autoload :ProfileAiSettings, 'labimotion/models/concerns/profile_ai_settings'
+  autoload :MatriceLabimotion, 'labimotion/models/concerns/matrice_labimotion'
   autoload :LinkedProperties, 'labimotion/models/concerns/linked_properties'
   autoload :TemplateDoi, 'labimotion/models/concerns/template_doi'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: labimotion
 version: !ruby/object:Gem::Version
-  version: 2.4.0.rc8
+  version: 2.4.0.rc9
 platform: ruby
 authors:
 - Chia-Lin Lin
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-12 00:00:00.000000000 Z
+date: 2026-08-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: caxlsx
@@ -174,6 +174,7 @@ files:
 - lib/labimotion/libs/share_resolver.rb
 - lib/labimotion/libs/template_hub.rb
 - lib/labimotion/libs/template_matcher.rb
+- lib/labimotion/libs/user_ai_settings.rb
 - lib/labimotion/libs/vocabulary_handler.rb
 - lib/labimotion/libs/xlsx_exporter.rb
 - lib/labimotion/models/cellline.rb
@@ -186,8 +187,8 @@ files:
 - lib/labimotion/models/concerns/generic_revisions.rb
 - lib/labimotion/models/concerns/klass_revision.rb
 - lib/labimotion/models/concerns/linked_properties.rb
+- lib/labimotion/models/concerns/matrice_labimotion.rb
 - lib/labimotion/models/concerns/metadata_validation.rb
-- lib/labimotion/models/concerns/profile_ai_settings.rb
 - lib/labimotion/models/concerns/segmentable.rb
 - lib/labimotion/models/concerns/template_doi.rb
 - lib/labimotion/models/concerns/workflow.rb
@@ -220,6 +221,7 @@ files:
 - lib/labimotion/models/std_layers_revision.rb
 - lib/labimotion/models/template_submission.rb
 - lib/labimotion/models/user_klass_setting.rb
+- lib/labimotion/models/user_setting.rb
 - lib/labimotion/models/vocabulary.rb
 - lib/labimotion/models/wellplate.rb
 - lib/labimotion/usecases/build_template_doi_xml.rb

data/lib/labimotion/models/concerns/profile_ai_settings.rb

@@ -1,116 +0,0 @@
-# frozen_string_literal: true
-
-module Labimotion
-  ## Per-user LabIMotion AI settings, stored on the host's profile record.
-  #
-  # The model, an optional personal API key and an optional provider endpoint of
-  # one's own live under one key in the host's `data` jsonb. They sit on the
-  # profile rather than in a table of ours because the credential belongs to the
-  # person, not to LabIMotion — but the shape of the value is ours, so reading
-  # and writing it belongs here rather than in each host.
-  #
-  # The API key is stored ENCRYPTED and never returned to a client: only whether
-  # one is set. Encryption stays the HOST's — key management is a deployment
-  # concern and a gem has no business inventing one. Chemotion supplies it as an
-  # `Encryptor` concern, which is pulled in below when present, so a host there
-  # includes this one alone:
-  #
-  #   class Profile < ApplicationRecord
-  #     include Labimotion::ProfileAiSettings
-  #   end
-  #
-  # A host that names its encryption differently just defines `encrypt_value`
-  # and `decrypt_value` on the model itself.
-  module ProfileAiSettings
-    extend ActiveSupport::Concern
-
-    DATA_KEY = 'labimotion_ai'
-
-    included do
-      # Reference, not `defined?`: under Zeitwerk the latter reads nil until a
-      # constant has been touched, while referencing it triggers the autoload.
-      # A host without an Encryptor supplies the two methods itself.
-      # rubocop:disable Layout/EmptyLinesAfterModuleInclusion -- the blank line
-      # this wants collides with EmptyLinesAroundExceptionHandlingKeywords.
-      begin
-        include Encryptor
-      rescue NameError
-        nil
-      end
-      # rubocop:enable Layout/EmptyLinesAfterModuleInclusion
-
-      # Kept as a constant on the including class too: hosts reference it to
-      # strip these settings out of profile payloads, which is how the encrypted
-      # key stays out of every response that is not this feature's own.
-      const_set(:LABIMOTION_AI_DATA_KEY, DATA_KEY) unless const_defined?(:LABIMOTION_AI_DATA_KEY)
-    end
-
-    def labimotion_ai_settings
-      (data || {})[DATA_KEY] || {}
-    end
-
-    def labimotion_ai_model
-      labimotion_ai_settings['model'].presence
-    end
-
-    # Personal provider endpoint (BYO-Provider). Honored only alongside a
-    # personal key, and SSRF-validated by Labimotion::AiEgressGuard before any
-    # request is made.
-    def labimotion_ai_base_url
-      labimotion_ai_settings['base_url'].presence
-    end
-
-    def labimotion_ai_api_path
-      labimotion_ai_settings['api_path'].presence
-    end
-
-    def labimotion_ai_api_key?
-      labimotion_ai_settings['api_key'].present?
-    end
-
-    # Decrypted personal API key, or nil when none is stored.
-    def labimotion_ai_api_key
-      enc = labimotion_ai_settings['api_key']
-      return nil if enc.blank?
-
-      decrypt_value(enc).presence
-    end
-
-    # Persist the settings. For every field: nil leaves it unchanged, a blank
-    # string clears it, anything else is stored (the api_key encrypted).
-    # Returns the safe summary — never the key itself.
-    def update_labimotion_ai(model: nil, api_key: nil, base_url: nil, api_path: nil)
-      ai = labimotion_ai_settings.dup
-      ai['model'] = model.to_s if model
-      unless api_key.nil?
-        if api_key.to_s.strip.blank?
-          ai.delete('api_key')
-        else
-          ai['api_key'] = encrypt_value(api_key.to_s.strip)
-        end
-      end
-      set_or_clear_labimotion_ai(ai, 'base_url', base_url)
-      set_or_clear_labimotion_ai(ai, 'api_path', api_path)
-      # Reassign the whole `data` hash rather than mutating in place, so the
-      # jsonb column is reliably marked dirty and actually persisted.
-      self.data = (data || {}).merge(DATA_KEY => ai)
-      save!
-      { model: ai['model'], api_key_set: ai['api_key'].present?,
-        base_url: ai['base_url'], api_path: ai['api_path'] }
-    end
-
-    private
-
-    # nil -> leave unchanged; blank string -> clear; else store the trimmed value.
-    def set_or_clear_labimotion_ai(settings, key, value)
-      return if value.nil?
-
-      trimmed = value.to_s.strip
-      if trimmed.blank?
-        settings.delete(key)
-      else
-        settings[key] = trimmed
-      end
-    end
-  end
-end