open-loam 0.1.0

data/lib/loam/record_locks.rb

@@ -0,0 +1,89 @@
+module Loam
+  # Advisory record locks (Loam::RecordLock) — a "who's editing this" courtesy
+  # for the multi-user admin.
+  #
+  #   Loam::RecordLocks.acquire(record, by: current_actor)  # take/refresh, or nil if held
+  #   Loam::RecordLocks.holder(record)                      # the user holding it, or nil
+  #   Loam::RecordLocks.release(record, by: current_actor)  # give it up
+  #   Loam::RecordLocks.force_release(record)               # manager override
+  #
+  # THIS IS ADVISORY: a held lock warns, it does not hard-block — optimistic
+  # locking (lock_version) is the actual guarantee that two edits can't clobber.
+  # Every query is tenant-scoped by Loam::RecordLock, so a lock is invisible and
+  # unaffectable from another tenant.
+  module RecordLocks
+    DEFAULT_TTL = 5.minutes
+
+    class << self
+      # Take or refresh the lock if it is free (or already yours). The same
+      # holder re-acquiring extends the TTL (heartbeat). Returns the lock, or nil
+      # when someone else holds a live one. A record that no longer exists
+      # (hard- or soft-deleted) cannot be locked.
+      def acquire(record, by:, ttl: DEFAULT_TTL)
+        return nil unless present?(record)
+
+        lock = lock_row(record)
+        return nil if lock && !lock.expired? && lock.locked_by_id != by.id
+
+        lock ||= Loam::RecordLock.new(lockable_type: type_of(record), lockable_id: record.id)
+        # A fresh session token when the lock is newly created or taken over from
+        # an expired holder; kept as-is on a heartbeat by the same user.
+        lock.token = SecureRandom.hex(16) if lock.new_record? || lock.locked_by_id != by.id
+        lock.locked_by_id = by.id
+        lock.expires_at = Time.current + ttl
+        lock.save!
+        lock
+      rescue ActiveRecord::RecordNotUnique
+        # Lost the create race — someone else got it first, which is exactly the
+        # nil contract. Advisory honesty over cleverness.
+        nil
+      end
+
+      # The live lock on a record, or nil — cleaning up a lock that is expired or
+      # whose record is gone (an auto-free), so orphaned rows don't linger.
+      def active_lock(record)
+        lock = lock_row(record)
+        return nil unless lock
+
+        if lock.expired? || !present?(record)
+          lock.destroy
+          return nil
+        end
+        lock
+      end
+
+      def holder(record)
+        active_lock(record)&.locked_by
+      end
+
+      def release(record, by:)
+        lock = lock_row(record)
+        lock.destroy if lock && lock.locked_by_id == by.id
+        true
+      end
+
+      # Manager override: drop whoever holds it. The controller gates the role.
+      def force_release(record)
+        lock_row(record)&.destroy
+        true
+      end
+
+      private
+
+      def lock_row(record)
+        Loam::RecordLock.find_by(lockable_type: type_of(record), lockable_id: record.id)
+      end
+
+      def type_of(record)
+        record.class.base_class.name
+      end
+
+      # Does the record still exist in the ordinary (non-soft-deleted) scope? A
+      # soft-deleted or hard-deleted record is "gone", so its lock auto-frees.
+      # Runs under the tenant default scope, which every call site has.
+      def present?(record)
+        record.class.base_class.where(id: record.id).exists?
+      end
+    end
+  end
+end

data/lib/loam/scheduler.rb

@@ -0,0 +1,153 @@
+module Loam
+  # Per-tenant recurring jobs. Modules self-register default schedules; an app
+  # also creates them from the admin. A runner calls Loam::Scheduler.tick
+  # periodically (wire `loam:scheduler:tick` to system cron — every minute) and
+  # each DUE schedule enqueues its ActiveJob.
+  #
+  # NO DOUBLE-FIRE — the whole correctness story. tick ATOMICALLY CLAIMS due
+  # jobs so two worker processes never enqueue the same one:
+  #   * PostgreSQL: `SELECT ... FOR UPDATE SKIP LOCKED` — one worker wins each row.
+  #   * SQLite (demo/harness): a transactional claim; SQLite serializes writers,
+  #     which is correct for the single-process prototype.
+  # The mechanism is behind `claim_due`, chosen per adapter. A claim also stamps
+  # `locked_until` so a crashed worker's rows free themselves after LOCK_TTL.
+  module Scheduler
+    class UnknownJobError < Loam::Error; end
+
+    class << self
+      # --- declarative registry (like broadcast_events / feature_defaults) ---
+
+      def register(key:, job_class:, schedule:, scope: "tenant", name: nil)
+        registry[key.to_s] = {
+          key: key.to_s, job_class: job_class.to_s, schedule: schedule.to_s,
+          scope: scope.to_s, name: (name || key).to_s
+        }
+      end
+
+      def registered = registry.values
+
+      def reset_registry!
+        @registry = {}
+      end
+
+      # Materialize the registered TENANT-scope schedules as rows in `tenant`
+      # (idempotent — safe from on_tenant_created and `loam:sync`). System-scope
+      # schedules are created explicitly by the app (they are not per-tenant).
+      def sync_tenant(tenant)
+        Loam.as_tenant(tenant) do
+          registered.each do |default|
+            next unless default[:scope] == "tenant"
+
+            job = Loam::ScheduledJob.find_or_initialize_by(key: default[:key])
+            job.name = default[:name]
+            job.job_class = default[:job_class]
+            job.schedule = default[:schedule]
+            job.scope = "tenant"
+            job.active = true if job.new_record?
+            job.next_run_at ||= job.compute_next_run
+            job.save!
+          end
+        end
+      end
+
+      # --- the tick ---
+
+      # Claim and enqueue every due schedule. Returns how many fired. One job's
+      # failure never blocks the others (its lock is released so a later tick
+      # retries it).
+      def tick(now: Time.current)
+        Loam::Telemetry.span("scheduler_tick") { run_tick(now) }
+      end
+
+      def run_tick(now)
+        fired = 0
+        claim_due(now).each do |job|
+          begin
+            enqueue_target(job)
+            job.update_columns(last_run_at: now, next_run_at: job.compute_next_run(now),
+                               locked_until: nil, updated_at: now)
+            fired += 1
+          rescue StandardError => error
+            job.update_columns(locked_until: nil, updated_at: now)
+            logger&.error("[loam scheduler] #{job.key} failed: #{error.class}: #{error.message}")
+          end
+        end
+        fired
+      end
+
+      # Enqueue a schedule's job right now without touching its schedule (the
+      # admin "run now" button). Re-validates job_class.
+      def run_now(job)
+        enqueue_target(job)
+      end
+
+      # THE code-execution guard: a job_class must resolve to a real ActiveJob
+      # subclass AND be ALLOWLISTED — either registered here or listed in
+      # Loam.schedulable_jobs. "Any ActiveJob" would let a tenant admin schedule
+      # ActiveStorage::PurgeJob, a mailer's delivery job, etc.
+      def resolve_job_class(name)
+        name = name.to_s
+        return nil unless allowed_job_class?(name)
+
+        klass = name.safe_constantize
+        klass if klass.is_a?(Class) && defined?(ActiveJob::Base) && klass < ActiveJob::Base
+      end
+
+      def allowed_job_class?(name)
+        registered.any? { |default| default[:job_class] == name } || Loam.schedulable_jobs.include?(name)
+      end
+
+      def resolve_job_class!(name)
+        resolve_job_class(name) || raise(UnknownJobError, "#{name.inspect} is not a known ActiveJob")
+      end
+
+      private
+
+      def registry
+        @registry ||= {}
+      end
+
+      def enqueue_target(job)
+        klass = resolve_job_class!(job.job_class)
+
+        if job.scope == "system"
+          klass.perform_later
+        else
+          # Carry the tenant explicitly (ActiveJob doesn't serialize Loam::Current),
+          # and enqueue inside the tenant so any enqueue-time scoping is correct.
+          Loam.as_tenant(job.tenant) { klass.perform_later(tenant_id: job.tenant_id) }
+        end
+      end
+
+      # Atomically claim due, unlocked schedules across ALL tenants (a blessed
+      # cross-tenant scan — the runner has no tenant context, like
+      # Loam::Membership.tenants_for), stamping locked_until so a concurrent tick
+      # skips them.
+      def claim_due(now)
+        lock_until = now + Loam::ScheduledJob::LOCK_TTL
+        due = Loam::ScheduledJob.unscoped.active
+                                .where("next_run_at <= ?", now)
+                                .where("locked_until IS NULL OR locked_until < ?", now)
+
+        claimed = []
+        Loam::ScheduledJob.transaction do
+          relation = postgres? ? due.lock("FOR UPDATE SKIP LOCKED") : due
+          ids = relation.pluck(:id)
+          break if ids.empty?
+
+          Loam::ScheduledJob.unscoped.where(id: ids).update_all(locked_until: lock_until)
+          claimed = Loam::ScheduledJob.unscoped.where(id: ids).to_a
+        end
+        claimed
+      end
+
+      def postgres?
+        Loam::ScheduledJob.connection.adapter_name.to_s.downcase.include?("postgres")
+      end
+
+      def logger
+        Rails.logger if defined?(Rails) && Rails.respond_to?(:logger)
+      end
+    end
+  end
+end

data/lib/loam/search/driver.rb

@@ -0,0 +1,31 @@
+module Loam
+  module Search
+    # The driver contract. Subclass and override the class methods.
+    #
+    #   search(model, query, scope:) -> a relation
+    #     Return a subset of `scope` (already tenant-scoped, and any saved-view
+    #     filter already applied) matching `query`. MUST return a relation so it
+    #     composes with the caller's own `.where`/`.order`/`.limit`. A blank
+    #     query returns `scope` unchanged (an empty search box is "no filter").
+    #
+    #   index(record) / remove(record)
+    #     Maintain the driver's index as records are saved and destroyed. Called
+    #     from Loam::Searchable's after_save / after_destroy.
+    #
+    #   reindex(model)
+    #     Rebuild the index for a model (used by `loam:search:reindex` and seeds).
+    #
+    # A driver that needs no index (LIKE) leaves index/remove/reindex as no-ops.
+    class Driver
+      class << self
+        def search(model, query, scope:)
+          raise NotImplementedError, "#{name} must implement .search(model, query, scope:)"
+        end
+
+        def index(record) = nil
+        def remove(record) = nil
+        def reindex(model) = nil
+      end
+    end
+  end
+end

data/lib/loam/search/like_driver.rb

@@ -0,0 +1,29 @@
+module Loam
+  module Search
+    # The default driver: a substring LIKE across the declared columns — exactly
+    # the original Loam::Searchable behavior, now behind the seam. Portable
+    # (Arel's `matches` emits ILIKE on PostgreSQL, case-insensitive LIKE on
+    # SQLite for ASCII) and needs no index, so index/remove/reindex are no-ops.
+    #
+    # What it does NOT do — ignore accents, split on words, rank — is the reason
+    # the seam exists: swap in Loam::Search::TokenDriver (or an external engine)
+    # and every `Model.search(q)` call site keeps working unchanged.
+    class LikeDriver < Driver
+      class << self
+        def search(model, query, scope:)
+          query = query.to_s.strip
+          return scope if query.blank? || !model.loam_searchable?
+
+          # sanitize_sql_like escapes the LIKE wildcards so a literal % or _ in
+          # the query stays literal; the second arg to `matches` declares that
+          # escape character to the database (SQLite has none by default).
+          pattern = "%#{model.sanitize_sql_like(query)}%"
+          conditions = model.loam_searchable_columns.map do |column|
+            model.arel_table[column].matches(pattern, "\\")
+          end
+          scope.where(conditions.inject(:or))
+        end
+      end
+    end
+  end
+end

data/lib/loam/search/token_driver.rb

@@ -0,0 +1,88 @@
+module Loam
+  module Search
+    # A portable, word-level index (the flagship second driver). Each record's
+    # searchable text is normalized into tokens stored in loam_search_tokens;
+    # a query is tokenized the same way and matched with AND semantics — a record
+    # must carry EVERY query token — so "excavator cat" finds "CAT 320 Excavator"
+    # regardless of word order or position. Plain SQL: works on SQLite and
+    # PostgreSQL, no external service, and genuinely better than LIKE (word-level,
+    # order-independent). When an app outgrows even this, the same seam takes a
+    # Meilisearch/Elasticsearch driver with no call-site change.
+    #
+    # Tenant isolation is free: Loam::SearchToken is a TenantRecord, so both the
+    # match subquery and every write are scoped to the current tenant.
+    class TokenDriver < Driver
+      class << self
+        def search(model, query, scope:)
+          tokens = tokenize(query)
+          return scope if tokens.empty? || !model.loam_searchable?
+
+          # AND semantics: keep only records carrying all N distinct query
+          # tokens. Under AND every hit has the full match count, so ranking is
+          # degenerate — ordering is left to the caller.
+          matches = Loam::SearchToken
+            .where(searchable_type: type_for(model), token: tokens)
+            .group(:searchable_id)
+            .having("COUNT(DISTINCT token) = #{tokens.size}")
+            .select(:searchable_id)
+
+          scope.where(id: matches)
+        end
+
+        # Rebuild one record's tokens in place. Called from after_save; runs in
+        # the record's tenant, so the token rows land in the right tenant.
+        def index(record)
+          model = record.class
+          return unless model.loam_searchable?
+
+          type = type_for(model)
+          Loam::SearchToken.where(searchable_type: type, searchable_id: record.id).delete_all
+
+          tokens = tokenize(searchable_text(record))
+          return if tokens.empty?
+
+          rows = tokens.map do |token|
+            { tenant_id: record.tenant_id, searchable_type: type, searchable_id: record.id, token: token }
+          end
+          Loam::SearchToken.insert_all(rows)
+        end
+
+        def remove(record)
+          Loam::SearchToken.where(searchable_type: type_for(record.class), searchable_id: record.id).delete_all
+        end
+
+        # Rebuild every current-tenant record of a model — run inside
+        # Loam.as_tenant per tenant (the loam:search:reindex task does that).
+        def reindex(model)
+          Loam::SearchToken.where(searchable_type: type_for(model)).delete_all
+          model.find_each { |record| index(record) }
+        end
+
+        private
+
+        def type_for(model) = model.name
+
+        # THE SAFETY BOUNDARY: an encrypted column is skipped. Its stored value
+        # is ciphertext (meaningless to tokenize), and tokenizing the PLAINTEXT
+        # into a searchable table would recreate exactly the leak
+        # Loam::Encryptable closes — an encrypted field stays exact-match-only via
+        # its blind index. `searchable_by` already refuses to declare an
+        # encrypted column; this subtraction is the second line of that defense.
+        def searchable_text(record)
+          columns = record.class.loam_searchable_columns
+          if record.class.respond_to?(:loam_encrypted_attributes)
+            columns -= record.class.loam_encrypted_attributes
+          end
+          columns.map { |column| record.public_send(column) }.join(" ")
+        end
+
+        # Downcase, split on any run of non-alphanumeric (Unicode-aware, so
+        # "Kraków" stays one token), drop blanks, de-dup. Deliberately NOT
+        # linguistic — no stemming — for the prototype.
+        def tokenize(text)
+          text.to_s.downcase.split(/[^[:alnum:]]+/).reject(&:blank?).uniq
+        end
+      end
+    end
+  end
+end

data/lib/loam/search.rb

@@ -0,0 +1,27 @@
+module Loam
+  # The search seam. `Model.search(q)` and the `searchable_by` declaration never
+  # change; the STRATEGY behind them is a swappable driver:
+  #
+  #   Loam::Search.driver = Loam::Search::TokenDriver   # in an initializer
+  #
+  # The default is the LIKE driver — portable and zero-setup — so nothing
+  # changes out of the box. A driver turns a text query into a subset of an
+  # already-tenant-scoped relation and maintains whatever index it needs; see
+  # Loam::Search::Driver for the contract. This is the same shape as
+  # Loam::EventStream.broadcaster and Loam::Enrichers: one seam, drivers behind
+  # it, callers untouched.
+  module Search
+    class << self
+      attr_writer :driver
+
+      def driver
+        @driver ||= Loam::Search::LikeDriver
+      end
+
+      def search(model, query, scope:) = driver.search(model, query, scope: scope)
+      def index(record)  = driver.index(record)
+      def remove(record) = driver.remove(record)
+      def reindex(model) = driver.reindex(model)
+    end
+  end
+end

data/lib/loam/searchable.rb

@@ -0,0 +1,90 @@
+module Loam
+  # Text search over an entity's own columns:
+  #
+  #   class Equipment < Loam::TenantRecord
+  #     include Loam::Searchable
+  #     searchable_by :name, :status
+  #   end
+  #
+  #   Equipment.search("cat")   # => a relation, still tenant-scoped
+  #
+  # `search` returns a relation, so tenant isolation is not something this has
+  # to remember: the default scope is already on it, and the result composes
+  # with ordering, pagination and anything else.
+  #
+  # HOW a query matches is a swappable driver (Loam::Search.driver): the default
+  # LikeDriver is a substring LIKE; the TokenDriver is a portable word-level
+  # index; an external engine is a third. This concern is only the DECLARATION
+  # (`searchable_by`) and the untouched call site (`Model.search(q)`) — swapping
+  # the driver changes neither. See Loam::Search.
+  module Searchable
+    extend ActiveSupport::Concern
+
+    included do
+      class_attribute :loam_searchable_columns, default: [].freeze, instance_writer: false
+
+      # Keep the active driver's index current. A no-op under the default
+      # LikeDriver; the TokenDriver maintains loam_search_tokens here. Guarded so
+      # non-searchable models pay nothing, and skipped when no searchable column
+      # actually changed — so a soft-delete (which touches only deleted_at)
+      # leaves the tokens in place, and the base scope hides the row anyway.
+      #
+      # `respond_to?` guard: Searchable is includable in a plain class purely to
+      # exercise the `searchable_by` DSL (its encrypted-field check), with no
+      # ActiveRecord underneath — only a real model gets the callbacks.
+      if respond_to?(:after_save)
+        after_save    :loam_update_search_index,     if: :loam_search_index_stale?
+        after_destroy :loam_remove_from_search_index, if: -> { self.class.loam_searchable? }
+      end
+    end
+
+    class_methods do
+      # Declared columns are code, not input — no runtime validation here,
+      # because reading the schema at class-definition time would need a
+      # database connection just to boot.
+      def searchable_by(*columns)
+        columns = columns.map(&:to_s)
+
+        # The mirror of Loam::Encryptable's check: an encrypted column is
+        # ciphertext at rest, which LIKE cannot match. Caught here when
+        # `searchable_by` is the later declaration (encrypts catches the reverse).
+        if respond_to?(:loam_encrypted_attributes)
+          conflict = columns & loam_encrypted_attributes
+          if conflict.any?
+            raise Loam::Error,
+                  "#{name}: cannot `searchable_by` encrypted field(s) #{conflict.join(', ')} — " \
+                  "ciphertext cannot be LIKE-searched. Use `encrypts :field, searchable: true` " \
+                  "for exact-match lookup instead."
+          end
+        end
+
+        self.loam_searchable_columns = columns.freeze
+      end
+
+      def loam_searchable?
+        loam_searchable_columns.any?
+      end
+
+      # Delegates to the active driver, handing it the current relation as the
+      # base scope — so `Model.search(q)` and `some_scope.search(q)` both work
+      # (a class method called on a relation runs with `all` == that relation).
+      # A blank query returns everything: an empty search box means "no filter".
+      def search(query)
+        Loam::Search.search(self, query, scope: all)
+      end
+    end
+
+    private
+
+    def loam_update_search_index     = Loam::Search.index(self)
+    def loam_remove_from_search_index = Loam::Search.remove(self)
+
+    # On create every column counts as changed, so a new record is always
+    # indexed; on update, reindex only when a searchable column actually moved.
+    def loam_search_index_stale?
+      return false unless self.class.loam_searchable?
+
+      saved_changes.keys.intersect?(self.class.loam_searchable_columns)
+    end
+  end
+end

data/lib/loam/soft_deletable.rb

@@ -0,0 +1,72 @@
+module Loam
+  # Soft-delete: destroying a business record hides it instead of erasing it.
+  # A recycle bin — for GDPR retention, for undo, for audits that still read
+  # cleanly after the fact. Loam is "safe by default", so a soft-deleted record
+  # is EXCLUDED from every ordinary query; seeing it is something you opt INTO,
+  # never a filter you must remember to add.
+  #
+  #   equipment.soft_delete    # deleted_at = now; gone from Equipment.all
+  #   Equipment.with_deleted   # includes it — but STILL tenant-scoped
+  #   Equipment.only_deleted   # just the recycle bin
+  #   equipment.restore        # deleted_at = nil; back in every query
+  #   equipment.destroy        # the real erase — the row leaves the database
+  #
+  # `destroy` still hard-deletes, for a genuine "forget me". The generated admin
+  # calls `soft_delete`, so its delete button is undoable; reach for `destroy`
+  # only when the row must actually leave the database.
+  module SoftDeletable
+    extend ActiveSupport::Concern
+
+    included do
+      # A second default_scope: Rails ANDs it with TenantRecord's tenant scope,
+      # so a hidden record is invisible AND still tenant-isolated.
+      default_scope { where(deleted_at: nil) }
+
+      # `unscope`, never `unscoped`: this drops ONLY the deleted_at predicate and
+      # keeps the tenant_id one, so the recycle bin can never surface another
+      # tenant's rows. `unscoped` would drop both and is forbidden here.
+      scope :with_deleted, -> { unscope(where: :deleted_at) }
+      scope :only_deleted, -> { with_deleted.where.not(deleted_at: nil) }
+    end
+
+    def deleted?
+      deleted_at.present?
+    end
+
+    def soft_delete
+      loam_toggle_deleted(deleted: true, bang: false)
+    end
+
+    def soft_delete!
+      loam_toggle_deleted(deleted: true, bang: true)
+    end
+
+    def restore
+      loam_toggle_deleted(deleted: false, bang: false)
+    end
+
+    def restore!
+      loam_toggle_deleted(deleted: false, bang: true)
+    end
+
+    private
+
+    # One write for all four entry points. Idempotent by design: toggling a
+    # record to the state it is already in (a double-clicked button) is a no-op,
+    # so the trail never fills with deleted_at -> deleted_at noise.
+    #
+    # A soft-delete is an UPDATE, so Loam::Auditable's after_destroy never fires
+    # for it. Rather than write our own audit row we borrow Auditable's single
+    # audit path via `loam_audit_as`, which relabels this save's audit
+    # "soft_delete"/"restore" instead of the "update" it would otherwise record.
+    def loam_toggle_deleted(deleted:, bang:)
+      return true if deleted == deleted?
+
+      self.deleted_at = deleted ? Time.current : nil
+      action = deleted ? "soft_delete" : "restore"
+      write = -> { bang ? save! : save }
+
+      respond_to?(:loam_audit_as, true) ? loam_audit_as(action, &write) : write.call
+    end
+  end
+end

data/lib/loam/sso/claims.rb

@@ -0,0 +1,10 @@
+module Loam
+  module Sso
+    # Normalized identity claims, protocol-independent. Every provider's
+    # `exchange` returns one of these so the rest of the flow never knows whether
+    # it came from OIDC, SAML, or a test fake.
+    Claims = Data.define(:sub, :email, :email_verified, :name, :groups) do
+      def email_verified? = email_verified == true || email_verified.to_s == "true"
+    end
+  end
+end

data/lib/loam/sso/fake_provider.rb

@@ -0,0 +1,51 @@
+require "base64"
+
+module Loam
+  module Sso
+    # An OFFLINE stand-in for a real IdP — for the demo and the test suite ONLY,
+    # NEVER production. `authorization_url` loops straight back to our own
+    # callback carrying the login email (as the "code"), so the whole SSO
+    # round-trip runs with no network. `exchange` returns verified claims for
+    # that email.
+    #
+    # Tests drive the security paths through two class-level overrides (reset in
+    # teardown): `force_email_verified = false` to prove an unverified email is
+    # refused, and `claims_override` to inject arbitrary claims (a fixed `sub`,
+    # IdP groups for role mapping, a different email).
+    class FakeProvider
+      class << self
+        attr_accessor :claims_override, :force_email_verified
+
+        def reset!
+          self.claims_override = nil
+          self.force_email_verified = nil
+        end
+      end
+
+      def initialize(record, redirect_uri:)
+        @record = record
+        @redirect_uri = redirect_uri
+      end
+
+      def authorization_url(state:, login_hint: nil)
+        uri = URI(@redirect_uri)
+        uri.query = { code: Base64.urlsafe_encode64(login_hint.to_s), state: state }.to_query
+        uri.to_s
+      end
+
+      def exchange(code:)
+        return self.class.claims_override if self.class.claims_override
+
+        email = Base64.urlsafe_decode64(code.to_s)
+        verified = self.class.force_email_verified.nil? ? true : self.class.force_email_verified
+        Claims.new(
+          sub: "fake|#{email}",
+          email: email,
+          email_verified: verified,
+          name: email.split("@").first,
+          groups: []
+        )
+      end
+    end
+  end
+end