open-loam 0.1.0 → 0.2.0

data/lib/open_loam.rb

@@ -0,0 +1,122 @@
+require "open_loam/version"
+require "open_loam/errors"
+require "open_loam/current"
+require "open_loam/events"
+require "open_loam/policy"
+require "open_loam/lifecycle"
+require "open_loam/configs"
+require "open_loam/features"
+require "open_loam/auth_throttle"
+require "open_loam/dictionaries"
+require "open_loam/custom_field_index"
+require "open_loam/undo"
+require "open_loam/permissions"
+require "open_loam/telemetry"
+require "open_loam/eval"
+require "open_loam/mcp"
+require "open_loam/mcp/server"
+require "open_loam/progress"
+require "open_loam/cron"
+require "open_loam/scheduler"
+require "open_loam/csv"
+require "open_loam/export"
+require "open_loam/import"
+require "open_loam/bulk"
+require "open_loam/widgets"
+require "open_loam/dashboard"
+require "open_loam/overrides"
+require "open_loam/open_api"
+require "open_loam/encryption"
+require "open_loam/base32"
+require "open_loam/totp"
+require "open_loam/pending_actions"
+require "open_loam/perspectives"
+require "open_loam/record_locks"
+require "open_loam/event_stream"
+require "open_loam/enrichers"
+require "open_loam/search"
+require "open_loam/search/driver"
+require "open_loam/search/like_driver"
+require "open_loam/search/token_driver"
+require "open_loam/notifications"
+require "open_loam/sso"
+require "open_loam/business_rules"
+require "open_loam/webhooks"
+require "open_loam/inbound_webhooks"
+require "open_loam/durable_events"
+require "open_loam/engine" if defined?(Rails::Engine)
+
+module OpenLoam
+  # The current tenant, or a loud failure. This is THE guardrail: tenant-scoped
+  # code paths call this, so a missing tenant context can never silently widen
+  # a query to all tenants.
+  def self.tenant!
+    Current.tenant or raise MissingTenantError
+  end
+
+  def self.tenant
+    Current.tenant
+  end
+
+  def self.actor
+    Current.actor
+  end
+
+  # Feature-string permission check for the current actor's role (see
+  # OpenLoam::Permissions) — deny-by-default, wildcard-aware. `role:` overrides the
+  # actor's role. Returns false with no actor/role.
+  def self.can?(permission, role: nil)
+    role ||= Current.actor && OpenLoam::Membership.find_by(user_id: Current.actor.id)&.role
+    OpenLoam::Permissions.allow?(role, permission)
+  end
+
+  # The approval-gate seam. When a caller runs under :confirm (an MCP tool acting
+  # for an AI agent), a write should be STAGED for human approval via
+  # OpenLoam::PendingActions.stage instead of committed. OpenLoam does not intercept
+  # Active Record globally — this is the documented hook a write path checks.
+  def self.mutation_mode
+    Current.mutation_mode || :direct
+  end
+
+  def self.require_confirmation?
+    mutation_mode == :confirm
+  end
+
+  # Run a block with writes gated for approval. The one blessed way to enter
+  # confirm-mode; restores the previous mode afterwards.
+  def self.with_confirmation
+    previous = Current.mutation_mode
+    Current.mutation_mode = :confirm
+    yield
+  ensure
+    Current.mutation_mode = previous
+  end
+
+  # Run a block inside a tenant (and optional actor) context, restoring the
+  # previous context afterwards. The one blessed way to switch tenants.
+  def self.as_tenant(tenant, actor: nil)
+    previous_tenant = Current.tenant
+    previous_actor = Current.actor
+    Current.tenant = tenant
+    Current.actor = actor if actor
+    yield
+  ensure
+    Current.tenant = previous_tenant
+    Current.actor = previous_actor
+  end
+end
+
+ActiveSupport.on_load(:active_record) do
+  require "open_loam/generated_key"
+  require "open_loam/tenant_record"
+  require "open_loam/auditable"
+  require "open_loam/soft_deletable"
+  require "open_loam/eventful"
+  require "open_loam/custom_fields"
+  require "open_loam/workflow"
+  require "open_loam/searchable"
+  require "open_loam/encryptable"
+  require "open_loam/translatable"
+  require "open_loam/commentable"
+  require "open_loam/attachable"
+end

data/lib/tasks/{loam.rake → open_loam.rake}

@@ -1,75 +1,75 @@
-namespace :loam do
-  desc "Re-run every Loam.on_tenant_created callback for every existing tenant (idempotent)"
+namespace :open_loam do
+  desc "Re-run every OpenLoam.on_tenant_created callback for every existing tenant (idempotent)"
   task sync: :environment do
-    synced = Loam.sync_tenants!
-    puts "loam:sync — ran #{Loam.tenant_created_callbacks.size} tenant callback(s) across #{synced} tenant(s)."
+    synced = OpenLoam.sync_tenants!
+    puts "open_loam:sync — ran #{OpenLoam.tenant_created_callbacks.size} tenant callback(s) across #{synced} tenant(s)."
   end
 
   namespace :openapi do
     # Write the OpenAPI 3.1 document + a Markdown rendering to disk, for CI or
     # publishing. Introspection only — no server, no network.
     #
-    #   bin/rails loam:openapi:export
+    #   bin/rails open_loam:openapi:export
     desc "Export the API's OpenAPI JSON + Markdown to doc/"
     task export: :environment do
       require "json"
       dir = ENV["DIR"].presence || "doc"
       FileUtils.mkdir_p(dir)
-      File.write(File.join(dir, "openapi.json"), JSON.pretty_generate(Loam::OpenApi.document))
-      File.write(File.join(dir, "openapi.md"), Loam::OpenApi.markdown)
-      puts "loam:openapi:export — wrote #{dir}/openapi.json and #{dir}/openapi.md."
+      File.write(File.join(dir, "openapi.json"), JSON.pretty_generate(OpenLoam::OpenApi.document))
+      File.write(File.join(dir, "openapi.md"), OpenLoam::OpenApi.markdown)
+      puts "open_loam:openapi:export — wrote #{dir}/openapi.json and #{dir}/openapi.md."
     end
   end
 
   namespace :scheduler do
     # Fire every due recurring job once. Wire to system cron, every minute:
-    #   * * * * * cd /app && bin/rails loam:scheduler:tick
+    #   * * * * * cd /app && bin/rails open_loam:scheduler:tick
     # The claim is atomic, so running this from several hosts never double-fires
     # a job (Postgres SKIP LOCKED; SQLite serializes the single-process claim).
-    desc "Enqueue every due Loam::ScheduledJob (run from cron)"
+    desc "Enqueue every due OpenLoam::ScheduledJob (run from cron)"
     task tick: :environment do
-      fired = Loam::Scheduler.tick
-      puts "loam:scheduler:tick — fired #{fired} scheduled job(s)."
+      fired = OpenLoam::Scheduler.tick
+      puts "open_loam:scheduler:tick — fired #{fired} scheduled job(s)."
     end
   end
 
   namespace :index do
-    # Rebuild the custom-field read-model index (Loam::CustomFieldIndex) for every
+    # Rebuild the custom-field read-model index (OpenLoam::CustomFieldIndex) for every
     # entity with custom fields, in every tenant. Run once after enabling it so
     # existing rows are projected; new/updated records index themselves on save.
     #
-    #   bin/rails loam:index:reindex
+    #   bin/rails open_loam:index:reindex
     desc "Rebuild the custom-field read-model index for every model in every tenant"
     task reindex: :environment do
       Rails.application.eager_load!
-      models = Loam::TenantRecord.descendants.select do |model|
+      models = OpenLoam::TenantRecord.descendants.select do |model|
         model.name.present? && model.respond_to?(:custom_field_definitions)
       end
 
       tenants = 0
-      Loam::Tenant.find_each do |tenant|
-        Loam.as_tenant(tenant) { models.each { |model| Loam::CustomFieldIndex.reindex(model) } }
+      OpenLoam::Tenant.find_each do |tenant|
+        OpenLoam.as_tenant(tenant) { models.each { |model| OpenLoam::CustomFieldIndex.reindex(model) } }
         tenants += 1
       end
-      puts "loam:index:reindex — rebuilt #{models.size} model(s) across #{tenants} tenant(s)."
+      puts "open_loam:index:reindex — rebuilt #{models.size} model(s) across #{tenants} tenant(s)."
     end
 
     # Report custom-field index coverage (indexed vs expected) per model/field
     # per tenant — the trust signal for whether the index is complete or drifting.
     #
-    #   bin/rails loam:index:coverage
+    #   bin/rails open_loam:index:coverage
     desc "Report custom-field index coverage per model/field per tenant"
     task coverage: :environment do
       Rails.application.eager_load!
-      models = Loam::TenantRecord.descendants.select do |model|
+      models = OpenLoam::TenantRecord.descendants.select do |model|
         model.name.present? && model.respond_to?(:custom_field_definitions)
       end
 
-      Loam::Tenant.find_each do |tenant|
-        Loam.as_tenant(tenant) do
+      OpenLoam::Tenant.find_each do |tenant|
+        OpenLoam.as_tenant(tenant) do
           models.each do |model|
             model.custom_field_definitions.find_each do |definition|
-              c = Loam::CustomFieldIndex.coverage(model, definition.name)
+              c = OpenLoam::CustomFieldIndex.coverage(model, definition.name)
               flag = c[:complete] ? "ok" : "GAP"
               puts "  [#{flag}] #{tenant.slug} #{model.name}.#{definition.name}: #{c[:indexed]}/#{c[:expected]} indexed"
             end
@@ -82,24 +82,24 @@ namespace :loam do
   namespace :search do
     # Rebuild the active driver's search index for every searchable model in
     # every tenant. Needed once after switching to a driver that keeps an index
-    # (Loam::Search::TokenDriver): existing rows have no tokens until reindexed,
+    # (OpenLoam::Search::TokenDriver): existing rows have no tokens until reindexed,
     # while new and updated records index themselves on save. A no-op under the
     # default LikeDriver (its reindex does nothing), so it is always safe to run.
     #
-    #   bin/rails loam:search:reindex
+    #   bin/rails open_loam:search:reindex
     desc "Rebuild the search index for every searchable model in every tenant"
     task reindex: :environment do
       Rails.application.eager_load!
-      models = Loam::TenantRecord.descendants.select do |model|
-        model.name.present? && model.respond_to?(:loam_searchable?) && model.loam_searchable?
+      models = OpenLoam::TenantRecord.descendants.select do |model|
+        model.name.present? && model.respond_to?(:open_loam_searchable?) && model.open_loam_searchable?
       end
 
       tenants = 0
-      Loam::Tenant.find_each do |tenant|
-        Loam.as_tenant(tenant) { models.each { |model| Loam::Search.reindex(model) } }
+      OpenLoam::Tenant.find_each do |tenant|
+        OpenLoam.as_tenant(tenant) { models.each { |model| OpenLoam::Search.reindex(model) } }
         tenants += 1
       end
-      puts "loam:search:reindex — rebuilt #{models.size} model(s) across #{tenants} tenant(s) using #{Loam::Search.driver}."
+      puts "open_loam:search:reindex — rebuilt #{models.size} model(s) across #{tenants} tenant(s) using #{OpenLoam::Search.driver}."
     end
   end
 
@@ -110,20 +110,20 @@ namespace :loam do
     # coexist, so this can run incrementally without downtime. Each record is an
     # ordinary audited "[encrypted]" update.
     #
-    #   bin/rails loam:encryption:rotate[Customer,42]
+    #   bin/rails open_loam:encryption:rotate[Customer,42]
     desc "Re-encrypt a model's encrypted fields for one tenant (rotation step)"
     task :rotate, %i[model tenant_id] => :environment do |_task, args|
       model = fetch_encryptable_model(args[:model])
-      tenant = Loam::Tenant.find(args[:tenant_id])
+      tenant = OpenLoam::Tenant.find(args[:tenant_id])
 
       count = 0
-      Loam.as_tenant(tenant) do
+      OpenLoam.as_tenant(tenant) do
         each_record(model) do |record|
-          record.loam_reencrypt!
+          record.open_loam_reencrypt!
           count += 1
         end
       end
-      puts "loam:encryption:rotate — re-encrypted #{count} #{model.name} record(s) in tenant #{tenant.slug}."
+      puts "open_loam:encryption:rotate — re-encrypted #{count} #{model.name} record(s) in tenant #{tenant.slug}."
     end
 
     # Decrypt and print one tenant's encrypted fields, e.g. for a GDPR data
@@ -132,15 +132,15 @@ namespace :loam do
     # a shell history that syncs), and only for a tenant you are authorized to
     # export.
     #
-    #   bin/rails loam:encryption:decrypt_dump[Customer,42]
+    #   bin/rails open_loam:encryption:decrypt_dump[Customer,42]
     desc "Print decrypted encrypted-field values for one tenant (GDPR export; handle with care)"
     task :decrypt_dump, %i[model tenant_id] => :environment do |_task, args|
       require "json"
       model = fetch_encryptable_model(args[:model])
-      tenant = Loam::Tenant.find(args[:tenant_id])
-      fields = model.loam_encrypted_attributes
+      tenant = OpenLoam::Tenant.find(args[:tenant_id])
+      fields = model.open_loam_encrypted_attributes
 
-      Loam.as_tenant(tenant) do
+      OpenLoam.as_tenant(tenant) do
         each_record(model) do |record|
           row = { id: record.id }.merge(fields.index_with { |field| record.public_send(field) })
           puts row.to_json
@@ -150,15 +150,15 @@ namespace :loam do
   end
 end
 
-# Resolve a model name to a class that actually uses Loam::Encryptable — a typo
+# Resolve a model name to a class that actually uses OpenLoam::Encryptable — a typo
 # or a plain model should fail loudly, not silently dump/rotate nothing.
 def fetch_encryptable_model(name)
-  # Force the app's classes (and Loam::TenantRecord, required lazily via the
+  # Force the app's classes (and OpenLoam::TenantRecord, required lazily via the
   # active_record on_load hook) to load before we constantize a model name.
   Rails.application.eager_load!
   model = name.to_s.constantize
-  unless model.respond_to?(:loam_encrypted_attributes) && model.loam_encrypted_attributes.any?
-    abort "#{name} does not `include Loam::Encryptable` with any `encrypts` fields."
+  unless model.respond_to?(:open_loam_encrypted_attributes) && model.open_loam_encrypted_attributes.any?
+    abort "#{name} does not `include OpenLoam::Encryptable` with any `encrypts` fields."
   end
   model
 end

data/lib/tasks/{loam_eval.rake → open_loam_eval.rake}

@@ -1,23 +1,23 @@
 require "json"
 require "fileutils"
 
-namespace :loam do
+namespace :open_loam do
   # Score the app's current test suite as a golden-task eval result and record it
-  # under ai/benchmark_runs/ (L-303). Run this in a Loam app AFTER an agent (or
+  # under ai/benchmark_runs/ (L-303). Run this in a OpenLoam app AFTER an agent (or
   # you) has implemented a golden task:
   #
-  #   bin/rails "loam:eval[2]"                       # task 2, tests only
-  #   bin/rails "loam:eval[2,tenancy_leak:unscoped]" # note an invariant breach
+  #   bin/rails "open_loam:eval[2]"                       # task 2, tests only
+  #   bin/rails "open_loam:eval[2,tenancy_leak:unscoped]" # note an invariant breach
   #
   # Exits non-zero if the task did not pass, so it drops straight into CI.
-  desc "Score the current test suite as a golden-task eval result (loam:eval[task,violation,violation,...])"
+  desc "Score the current test suite as a golden-task eval result (open_loam:eval[task,violation,violation,...])"
   task :eval, [ :task ] => :environment do |_task, args|
     task_id = args[:task] || "unspecified"
     violations = args.extras # any positional args after the task id are violations
 
     output = `bin/rails test 2>&1`
-    summary = Loam::Eval.parse_summary(output)
-    card = Loam::Eval.scorecard(task: task_id, summary: summary, violations: violations)
+    summary = OpenLoam::Eval.parse_summary(output)
+    card = OpenLoam::Eval.scorecard(task: task_id, summary: summary, violations: violations)
 
     dir = Rails.root.join("ai", "benchmark_runs")
     FileUtils.mkdir_p(dir)

data/lib/tasks/open_loam_mcp.rake

@@ -0,0 +1,20 @@
+require "logger"
+
+namespace :open_loam do
+  namespace :mcp do
+    # Serve the OpenLoam MCP server over stdio. Point an MCP client (Claude Code,
+    # Cursor, Codex) at `bin/rails open_loam:mcp:serve` with OPEN_LOAM_MCP_TOKEN set to a
+    # OpenLoam API token — the agent then acts as that token's user, in that tenant.
+    #
+    # stdout carries JSON-RPC only; every log is sent to stderr so it can't
+    # corrupt the stream.
+    desc "Serve the OpenLoam MCP server over stdio (auth via OPEN_LOAM_MCP_TOKEN)"
+    task serve: :environment do
+      Rails.logger = Logger.new($stderr)
+      ActiveRecord::Base.logger = Rails.logger
+      $stdout.sync = true
+
+      OpenLoam::Mcp::Server.new.run
+    end
+  end
+end