open-loam 0.1.0

data/lib/loam/sso/http_client.rb

@@ -0,0 +1,42 @@
+require "net/http"
+require "json"
+
+module Loam
+  module Sso
+    # The one place SSO talks to the network — kept tiny and isolated so the rest
+    # of the flow is pure. Only Loam::Sso::OidcProvider uses it, and the test
+    # suite injects a FakeProvider instead, so this is never exercised offline.
+    module HttpClient
+      module_function
+
+      def get_json(url, bearer: nil)
+        uri = URI(url)
+        request = Net::HTTP::Get.new(uri)
+        request["Authorization"] = "Bearer #{bearer}" if bearer
+        parse(perform(uri, request))
+      end
+
+      def post_form(url, params)
+        uri = URI(url)
+        request = Net::HTTP::Post.new(uri)
+        request.set_form_data(params)
+        request["Accept"] = "application/json"
+        parse(perform(uri, request))
+      end
+
+      def perform(uri, request)
+        Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https") do |http|
+          http.request(request)
+        end
+      end
+
+      def parse(response)
+        unless response.is_a?(Net::HTTPSuccess)
+          raise Loam::Sso::Error, "identity provider returned #{response.code}"
+        end
+
+        JSON.parse(response.body)
+      end
+    end
+  end
+end

data/lib/loam/sso/oidc_provider.rb

@@ -0,0 +1,64 @@
+module Loam
+  module Sso
+    # The real OIDC Authorization Code provider. Discovers the issuer's endpoints
+    # from its .well-known document, sends the user to the authorization endpoint,
+    # then exchanges the returned code for an access token and reads the claims
+    # from the userinfo endpoint.
+    #
+    # Why userinfo rather than validating the id_token's JWT signature: these
+    # claims arrive over a server-to-server TLS channel WE opened, authenticated
+    # by the client_secret — the browser never touches them. Signature validation
+    # exists for a token you RECEIVE (the id_token, relayed via the browser);
+    # fetching userinfo over an authenticated back channel sidesteps hand-rolled
+    # JWKS verification for the prototype. Roadmap: full id_token + JWKS.
+    #
+    # NOT exercised by the test suite (a FakeProvider is injected via
+    # Loam::Sso.builder); live OIDC against a real IdP is verified manually.
+    class OidcProvider
+      SCOPE = "openid email profile".freeze
+
+      def initialize(record, redirect_uri:)
+        @record = record
+        @redirect_uri = redirect_uri
+      end
+
+      def authorization_url(state:, login_hint: nil)
+        params = {
+          response_type: "code",
+          client_id: @record.client_id,
+          redirect_uri: @redirect_uri,
+          scope: SCOPE,
+          state: state
+        }
+        params[:login_hint] = login_hint if login_hint.present?
+        "#{discovery.fetch('authorization_endpoint')}?#{params.to_query}"
+      end
+
+      def exchange(code:)
+        token = HttpClient.post_form(discovery.fetch("token_endpoint"), {
+          grant_type: "authorization_code",
+          code: code,
+          redirect_uri: @redirect_uri,
+          client_id: @record.client_id,
+          client_secret: @record.client_secret
+        })
+
+        info = HttpClient.get_json(discovery.fetch("userinfo_endpoint"), bearer: token.fetch("access_token"))
+
+        Claims.new(
+          sub: info["sub"],
+          email: info["email"],
+          email_verified: info["email_verified"],
+          name: info["name"],
+          groups: Array(info["groups"])
+        )
+      end
+
+      private
+
+      def discovery
+        @discovery ||= HttpClient.get_json(File.join(@record.issuer, ".well-known/openid-configuration"))
+      end
+    end
+  end
+end

data/lib/loam/sso.rb

@@ -0,0 +1,129 @@
+require "loam/sso/claims"
+require "loam/sso/http_client"
+require "loam/sso/oidc_provider"
+require "loam/sso/fake_provider"
+
+module Loam
+  # Single sign-on. SHIPPED: OIDC Authorization Code flow end-to-end —
+  # home-realm discovery by email domain, just-in-time user provisioning, IdP
+  # group -> role mapping, and account linking to an existing User. SEAMS
+  # (documented, not built): SAML (another protocol behind the same interface,
+  # raises NotImplementedError until implemented) and SCIM 2.0 provisioning
+  # (see docs/_foundation/overview.md). See Loam::SsoProvider for the per-tenant config.
+  #
+  # A protocol provider implements two methods:
+  #   authorization_url(state:, login_hint: nil) -> the IdP URL to redirect to
+  #   exchange(code:)                             -> Loam::Sso::Claims
+  #
+  # The provider is built through a swappable `builder` so tests and the demo
+  # inject a FakeProvider and NOTHING touches the network. Loam::Sso::OidcProvider
+  # is the real one; it is never constructed in the test suite.
+  module Sso
+    class Error < Loam::Error; end
+
+    # The identity provider did not assert a verified email. Linking or creating
+    # an account on an unverified email is an account-takeover vector, so the
+    # flow refuses it.
+    class UnverifiedEmailError < Error; end
+
+    # The verified email is on a domain this provider does not own. A provider
+    # only vouches for its OWN domain; letting it assert an email on another
+    # domain would let a tenant's IdP hijack a user of a different domain
+    # (cross-domain account takeover), so the flow refuses it.
+    class DomainMismatchError < Error; end
+
+    class << self
+      attr_writer :builder
+
+      def builder
+        @builder ||= method(:default_builder)
+      end
+
+      # Wrap a Loam::SsoProvider record in its protocol provider.
+      def build(record, redirect_uri:)
+        builder.call(record, redirect_uri)
+      end
+
+      def default_builder(record, redirect_uri)
+        case record.protocol
+        when "oidc"
+          OidcProvider.new(record, redirect_uri: redirect_uri)
+        when "saml"
+          raise NotImplementedError,
+                "SAML SSO is a documented seam — implement Loam::Sso::SamlProvider behind this interface."
+        else
+          raise Error, "Unsupported SSO protocol: #{record.protocol.inspect}"
+        end
+      end
+
+      # Home-realm discovery. THE blessed cross-tenant lookup for SSO (like
+      # Loam::Membership.tenants_for): "which tenant's IdP owns this email
+      # domain?" is asked at the sign-in page, before any tenant is chosen, so it
+      # reaches across tenants via `unscoped` — something host code must never do.
+      def provider_for(email:)
+        domain = email.to_s.split("@").last.to_s.strip.downcase
+        return nil if domain.blank?
+
+        Loam::SsoProvider.unscoped.where(domain: domain, active: true).first
+      end
+
+      # Resolve verified IdP claims to a signed-in User, in the provider's tenant.
+      # MUST be called inside Loam.as_tenant(provider.tenant). Order matters:
+      # match the durable (provider, sub) identity first, then an existing User by
+      # verified email (link), else just-in-time create — always with a tenant
+      # membership at the mapped role.
+      def provision(provider, claims)
+        raise UnverifiedEmailError, "the identity provider did not verify #{claims.email.inspect}" unless claims.email_verified?
+
+        # The provider only vouches for its own domain. Check this BEFORE any
+        # lookup, link, or create — an email on another domain is refused
+        # outright (no session, nothing touched).
+        email_domain = claims.email.to_s.split("@").last.to_s.downcase
+        unless email_domain.present? && email_domain == provider.domain.to_s.downcase
+          raise DomainMismatchError,
+                "verified email domain #{email_domain.inspect} is not this provider's domain #{provider.domain.inspect}"
+        end
+
+        # Resolve the user: the durable (provider, sub) identity first, then an
+        # existing User by verified email (link), else just-in-time create.
+        identity = Loam::SsoIdentity.find_by(sso_provider_id: provider.id, sub: claims.sub)
+        user = identity&.user || User.find_by(email: claims.email) || jit_create_user(claims)
+
+        # Re-map claims -> role on EVERY login (including a returning identity),
+        # so an IdP role change takes effect.
+        ensure_membership(provider, user, claims)
+        Loam::SsoIdentity.create!(user: user, sso_provider: provider, sub: claims.sub) unless identity
+        user
+      end
+
+      # IdP group -> role; first configured group that the user carries wins,
+      # otherwise the provider's default role.
+      def role_for(provider, claims)
+        map = provider.group_roles
+        match = Array(claims.groups).map(&:to_s).find { |group| map.key?(group) }
+        match ? map[match] : provider.jit_role
+      end
+
+      private
+
+      def jit_create_user(claims)
+        # SSO users authenticate at the IdP; the random password satisfies
+        # has_secure_password and is unguessable, never used to log in.
+        User.create!(
+          name: claims.name.presence || claims.email,
+          email: claims.email,
+          password: SecureRandom.hex(32)
+        )
+      end
+
+      # Re-map claims -> role on EVERY login, so an IdP role change takes effect
+      # (a promotion reflects, a removed group downgrades) rather than freezing
+      # at whatever the role was when the membership was first created.
+      def ensure_membership(provider, user, claims)
+        membership = Loam::Membership.find_or_initialize_by(user_id: user.id)
+        membership.role = role_for(provider, claims)
+        membership.save!
+      end
+    end
+  end
+end

data/lib/loam/telemetry.rb

@@ -0,0 +1,43 @@
+module Loam
+  # A dependency-free observability seam (L-712). Wrap a unit of work in a span;
+  # by default it emits an `ActiveSupport::Notifications` event
+  # ("loam.span.<name>") carrying the attributes and duration, so ANY subscriber
+  # — an OpenTelemetry bridge, StatsD, a log line — picks it up with no hard
+  # dependency on Loam's side. An app that wants real OTLP spans replaces the
+  # whole strategy:
+  #
+  #   Loam::Telemetry.backend = ->(name, attributes, work) do
+  #     Tracer.in_span(name, attributes: attributes) { work.call }
+  #   end
+  #
+  # Loam instruments its async/background hot paths (scheduler tick, durable
+  # event delivery, inbound webhook ingest) so an operator sees them without
+  # wiring anything per-call.
+  module Telemetry
+    module_function
+
+    # Run `block` as a span named `name` with `attributes`. Returns the block's
+    # value. A nil/absent block is a no-op that returns nil.
+    def span(name, **attributes, &block)
+      return block&.call unless block_given?
+
+      if backend
+        backend.call(name.to_s, attributes, block)
+      else
+        ActiveSupport::Notifications.instrument("loam.span.#{name}", **attributes, &block)
+      end
+    end
+
+    def backend
+      @backend
+    end
+
+    def backend=(callable)
+      @backend = callable
+    end
+
+    def reset!
+      @backend = nil
+    end
+  end
+end

data/lib/loam/tenant_record.rb

@@ -0,0 +1,36 @@
+module Loam
+  # Base class for every tenant-scoped model. Inheriting from it is what makes
+  # a model a "Loam entity":
+  #
+  #   * every query is scoped to Loam::Current.tenant via default_scope
+  #   * building/creating a record assigns the current tenant automatically
+  #   * touching the model with NO tenant in context raises MissingTenantError
+  #
+  # Escape hatch: `Model.unscoped` skips the scope. It is deliberately the
+  # standard Rails spelling so it is trivially greppable in review, and
+  # AGENTS.md forbids agents from using it.
+  class TenantRecord < ActiveRecord::Base
+    self.abstract_class = true
+
+    # Generates the key when it is not an integer (see Loam::GeneratedKey).
+    include Loam::GeneratedKey
+
+    belongs_to :tenant, class_name: "Loam::Tenant"
+
+    default_scope { where(tenant_id: Loam.tenant!.id) }
+
+    validates :tenant_id, presence: true
+
+    before_validation on: :create do
+      self.tenant_id ||= Loam.tenant!.id
+    end
+
+    # Guardrail for writes: a record can never be saved into a foreign tenant.
+    before_save do
+      if tenant_id != Loam.tenant!.id
+        raise MissingTenantError, "Attempted to write #{self.class.name} into tenant #{tenant_id} " \
+                                  "while Loam::Current.tenant is #{Loam.tenant!.id}"
+      end
+    end
+  end
+end

data/lib/loam/test_helpers.rb

@@ -0,0 +1,15 @@
+module Loam
+  # Mixed into ActiveSupport::TestCase by the install generator.
+  module TestHelpers
+    extend ActiveSupport::Concern
+
+    included do
+      setup { Loam::Current.reset }
+      teardown { Loam::Current.reset }
+    end
+
+    def with_tenant(tenant, actor: nil, &block)
+      Loam.as_tenant(tenant, actor: actor, &block)
+    end
+  end
+end

data/lib/loam/totp.rb

@@ -0,0 +1,63 @@
+require "openssl"
+require "securerandom"
+require "uri"
+require "erb"
+
+module Loam
+  # RFC 6238 time-based one-time passwords — the shipped second factor.
+  # HMAC-SHA1, 30-second step, 6 digits, ±1 step of drift tolerance (so a code
+  # entered a few seconds either side of a boundary still verifies). Hand-rolled
+  # on OpenSSL rather than pulling a gem; it is ~20 lines of a well-specified
+  # algorithm, verified against the RFC's own test vectors in the test suite.
+  module Totp
+    DIGITS = 6
+    PERIOD = 30      # seconds per step
+    DRIFT  = 1       # accept the neighbouring step on each side
+
+    # A fresh random secret, base32-encoded for authenticator apps. 20 bytes
+    # (160 bits) is the RFC-recommended size for SHA1.
+    def self.generate_secret(bytes: 20)
+      Loam::Base32.encode(SecureRandom.random_bytes(bytes))
+    end
+
+    # True if `code` is valid for `secret` right now.
+    def self.verify(secret, code, at: Time.now.to_i)
+      !matching_step(secret, code, at: at).nil?
+    end
+
+    # The step counter a code matches (within the drift window), or nil. Callers
+    # that must prevent replay (login, sudo) persist this and reject a code whose
+    # step is not strictly greater than the last accepted one. The length/charset
+    # check runs FIRST, so a malformed code never reaches the constant-time
+    # compare (which assumes equal-length inputs).
+    def self.matching_step(secret, code, at: Time.now.to_i)
+      code = code.to_s.gsub(/\s+/, "")
+      return nil unless code.match?(/\A\d{#{DIGITS}}\z/)
+
+      counter = at.to_i / PERIOD
+      (-DRIFT..DRIFT).each do |offset|
+        step = counter + offset
+        return step if ActiveSupport::SecurityUtils.secure_compare(code_at(secret, step), code)
+      end
+      nil
+    end
+
+    # The HOTP code for a given step counter (RFC 4226 dynamic truncation).
+    def self.code_at(secret, counter, digits: DIGITS)
+      hmac = OpenSSL::HMAC.digest("SHA1", Loam::Base32.decode(secret), [counter].pack("Q>"))
+      offset = hmac.bytes.last & 0x0f
+      truncated = hmac[offset, 4].unpack1("N") & 0x7fffffff
+      (truncated % (10**digits)).to_s.rjust(digits, "0")
+    end
+
+    # The otpauth:// URI an authenticator app imports (usually via QR — rendering
+    # the QR image is a UI nicety left for later; the URI + secret are enough).
+    def self.provisioning_uri(secret, account:, issuer:)
+      label = ERB::Util.url_encode("#{issuer}:#{account}")
+      query = URI.encode_www_form(
+        secret: secret, issuer: issuer, algorithm: "SHA1", digits: DIGITS, period: PERIOD
+      )
+      "otpauth://totp/#{label}?#{query}"
+    end
+  end
+end

data/lib/loam/translatable.rb

@@ -0,0 +1,88 @@
+module Loam
+  # Per-record, per-locale translations of DATA fields — a product name, a
+  # category label — distinct from Rails i18n (developer UI strings, still
+  # Rails-native and out of scope here).
+  #
+  #   class Equipment < Loam::TenantRecord
+  #     include Loam::Translatable
+  #     translates :name, :description
+  #   end
+  #
+  # READ OVERLAY: the field reader returns the translation for the CURRENT locale
+  # (Loam.locale) when one exists, else the record's own COLUMN value — the base
+  # is the fallback and stays authoritative for the default locale:
+  #
+  #   equipment.name                  # => overlay for Loam.locale, else base
+  #   equipment.name(locale: "de")    # => explicit locale, else base
+  #   equipment.set_translation(:name, "de", "Bagger")
+  #   equipment.translations_for(:name)  # => { "de" => "Bagger", ... }
+  #
+  # Writes still go through the ordinary `name=` writer to the base column, so
+  # translations are purely additive rows in loam_translations — the base value
+  # is never overwritten or lost.
+  module Translatable
+    extend ActiveSupport::Concern
+
+    included do
+      class_attribute :loam_translatable_attributes, default: [].freeze, instance_writer: false
+
+      has_many :loam_translations, class_name: "Loam::Translation",
+               as: :translatable, dependent: :delete_all
+    end
+
+    class_methods do
+      def translates(*names)
+        names = names.map(&:to_s)
+
+        # An encrypted field must NOT be translatable: a translation row would
+        # store its PLAINTEXT in loam_translations, recreating exactly the leak
+        # Loam::Encryptable closes (same posture as searchable_by's refusal).
+        if respond_to?(:loam_encrypted_attributes)
+          conflict = names & loam_encrypted_attributes
+          if conflict.any?
+            raise Loam::Error,
+                  "#{name}: cannot `translates` encrypted field(s) #{conflict.join(', ')} — " \
+                  "a translation would store plaintext. Encrypted data is not translatable."
+          end
+        end
+
+        self.loam_translatable_attributes = (loam_translatable_attributes + names).freeze
+
+        names.each do |field|
+          # The overlay reader. `read_attribute` (not super) is the base value,
+          # so it works regardless of AR's lazy attribute-method definition.
+          define_method(field) do |locale: nil|
+            loam_translation_value(field, locale) || read_attribute(field)
+          end
+        end
+      end
+
+      def loam_translatable?(field)
+        loam_translatable_attributes.include?(field.to_s)
+      end
+    end
+
+    # The stored translation for a field in a locale (default: the current one),
+    # or nil when there is none.
+    def loam_translation_value(field, locale = nil)
+      locale = (locale || Loam.locale).to_s
+      return nil if locale.blank?
+
+      loam_translations.detect { |t| t.field == field.to_s && t.locale == locale }&.value
+    end
+
+    def set_translation(field, locale, value)
+      raise Loam::Error, "#{field} is not translatable on #{self.class.name}" unless self.class.loam_translatable?(field)
+
+      row = loam_translations.find_or_initialize_by(field: field.to_s, locale: locale.to_s)
+      row.value = value
+      row.save!
+      loam_translations.reset
+      value
+    end
+
+    def translations_for(field)
+      loam_translations.select { |t| t.field == field.to_s }.to_h { |t| [ t.locale, t.value ] }
+    end
+  end
+end

data/lib/loam/undo.rb

@@ -0,0 +1,126 @@
+module Loam
+  # Undo/redo built ON the audit trail (L-704). Every change already records a
+  # Loam::AuditRecord with its changeset; undoing one applies the inverse and
+  # writes a NEW audit record — so the inverse is itself undoable, and "redo" is
+  # just undoing that undo entry. No separate command log to keep in sync.
+  #
+  # THE STACK: a field revert is refused unless the audit is the record's LATEST
+  # update/undo — undoing an old change out from under newer ones would silently
+  # clobber them. Undo therefore walks the history back one entry at a time.
+  #
+  # BOUNDARIES (each a deliberate skip, not a gap):
+  #   * encrypted fields — the audit stores "[encrypted]", never the old value,
+  #     so there is nothing to revert to;
+  #   * the workflow column — a direct write is blocked by the transition gate
+  #     (Loam::Workflow), so state is undone by performing the reverse TRANSITION,
+  #     not here;
+  #   * fields the actor's role may not write (when a policy is supplied).
+  module Undo
+    class NotUndoableError < Loam::Error; end
+
+    IGNORE = %w[id lock_version created_at updated_at].freeze
+
+    module_function
+
+    # Coarse, action-level check the admin view consults to decide whether to
+    # offer an Undo button. The fine checks (something revertable, still latest)
+    # happen in `undo` and surface as NotUndoableError.
+    def undoable?(audit)
+      case audit.action
+      when "update", "undo"                    then true
+      when "create", "soft_delete", "restore"  then soft_deletable?(audit)
+      else false
+      end
+    end
+
+    # Apply the inverse of one audit record. Returns the affected record.
+    # `policy:` (optional) restricts a field revert to policy-writable fields.
+    def undo(audit, policy: nil)
+      ensure_current_tenant!(audit)
+      record = load_record(audit)
+
+      case audit.action
+      when "update", "undo" then revert_fields(record, audit, policy)
+      when "create"         then undo_create(record)
+      when "soft_delete"    then guard_soft_delete(record).restore!
+      when "restore"        then guard_soft_delete(record).soft_delete!
+      else raise NotUndoableError, "#{audit.action.inspect} cannot be undone"
+      end
+      record
+    end
+
+    # --- internals ---
+
+    def revert_fields(record, audit, policy)
+      ensure_latest!(audit)
+      workflow_column = record.class.respond_to?(:loam_workflow) ? record.class.loam_workflow&.column.to_s : nil
+
+      updates = {}
+      (audit.changeset || {}).each do |field, values|
+        next unless values.is_a?(Array)                 # skip "[encrypted]" (a String)
+        next if IGNORE.include?(field)
+        next if field == workflow_column                # undo state via the reverse transition, not a direct write
+        next unless record.class.column_names.include?(field)
+        next if policy && !policy.writable?(field)
+
+        updates[field] = values.first                   # the "before" value
+      end
+
+      raise NotUndoableError, "nothing revertable in this change" if updates.empty?
+
+      # Relabel this save's audit as "undo" so the history reads legibly (and the
+      # entry is itself undoable = redo). loam_audit_as is the same hook
+      # SoftDeletable uses for soft_delete/restore.
+      if record.respond_to?(:loam_audit_as, true)
+        record.send(:loam_audit_as, "undo") { record.update!(updates) }
+      else
+        record.update!(updates)
+      end
+    end
+
+    def undo_create(record)
+      guard_soft_delete(record).soft_delete!
+    end
+
+    def guard_soft_delete(record)
+      unless record.respond_to?(:soft_delete!) && record.respond_to?(:restore!)
+        raise NotUndoableError, "#{record.class.name} is not soft-deletable, so this change can't be undone"
+      end
+      record
+    end
+
+    # The audit must be the record's most recent update/undo — else undoing it
+    # would overwrite newer edits. Tenant-scoped via AuditRecord's default scope.
+    def ensure_latest!(audit)
+      latest = Loam::AuditRecord
+               .where(auditable_type: audit.auditable_type, auditable_id: audit.auditable_id, action: %w[update undo])
+               .order(:id).last
+      return if latest.nil? || latest.id == audit.id
+
+      raise NotUndoableError, "a newer change exists — undo that first"
+    end
+
+    # Look the record up through its OWN default scope (tenant holds), lifting
+    # only the soft-delete filter so a soft-deleted row is still reachable to
+    # restore. Never AuditRecord#auditable, which is unscoped.
+    def load_record(audit)
+      klass = audit.auditable_type.safe_constantize
+      raise NotUndoableError, "unknown type #{audit.auditable_type.inspect}" unless klass.is_a?(Class) && klass < Loam::TenantRecord
+
+      scope = klass.respond_to?(:with_deleted) ? klass.with_deleted : klass.all
+      record = scope.find_by(id: audit.auditable_id)
+      raise NotUndoableError, "the record no longer exists" unless record
+
+      record
+    end
+
+    def soft_deletable?(audit)
+      klass = audit.auditable_type.safe_constantize
+      klass.is_a?(Class) && klass.instance_methods.include?(:soft_delete!)
+    end
+
+    def ensure_current_tenant!(audit)
+      raise NotUndoableError, "not in this tenant" unless audit.tenant_id == Loam.tenant!.id
+    end
+  end
+end

data/lib/loam/version.rb

@@ -0,0 +1,3 @@
+module Loam
+  VERSION = "0.1.0"
+end

data/lib/loam/webhooks.rb

@@ -0,0 +1,34 @@
+module Loam
+  # Domain events, delivered over HTTP to whoever asked for them.
+  #
+  # One global subscriber listens to every Loam event and, in the tenant the
+  # event was published in, enqueues a delivery per matching active endpoint.
+  # Matching happens at dispatch time rather than at subscribe time because
+  # endpoints are data: a tenant can add one from the admin without a reboot.
+  module Webhooks
+    # Wired once from Loam::Engine. Idempotent: subscribing twice would deliver
+    # every event twice.
+    def self.subscribe!
+      @subscription ||= Events.subscribe_all { |event_name, payload| dispatch(event_name, payload) }
+    end
+
+    # Runs inline in whatever published the event, so it stays cheap: one
+    # query for the tenant's active endpoints, then the HTTP call is a job.
+    def self.dispatch(event_name, payload)
+      tenant = Tenant.find_by(id: payload[:tenant_id])
+      return if tenant.nil?
+
+      # Only JSON-safe primitives cross into the job — event payloads are ids
+      # and scalars by convention, never records.
+      deliverable = payload.transform_keys(&:to_s)
+
+      Loam.as_tenant(tenant) do
+        WebhookEndpoint.active.each do |endpoint|
+          next unless endpoint.matches?(event_name)
+
+          WebhookDeliveryJob.perform_later(tenant.id, endpoint.id, event_name, deliverable)
+        end
+      end
+    end
+  end
+end