open-loam 0.1.0

data/app/models/loam/perspective.rb

@@ -0,0 +1,104 @@
+module Loam
+  # A saved view of an entity's admin index — which columns show, active filters,
+  # sort, and page size — that a user can name, make their default, or share.
+  #
+  # Three visibility tiers, widening in audience:
+  #   * "private" — only its owner sees it (owner_id).
+  #   * "role"    — everyone with the named membership role in the tenant.
+  #   * "tenant"  — everyone in the tenant.
+  # A private view is invisible to others by construction (see
+  # Loam::Perspectives.visible_to), not merely by a permission check.
+  #
+  # Tenant-scoped like everything else, and audited. Optimistic-locked
+  # (lock_version) so two people editing a shared view don't silently clobber
+  # each other — the admin controller rescues ActiveRecord::StaleObjectError.
+  class Perspective < Loam::TenantRecord
+    self.table_name = "loam_perspectives"
+
+    include Loam::Auditable
+
+    VISIBILITIES = %w[private role tenant].freeze
+
+    # Columns a saved filter/sort may NEVER touch: tenant_id is enforced by the
+    # default scope (a filter on it is a footgun, not a leak), and the rest are
+    # plumbing, not data. Everything else on the entity is fair game.
+    NON_FILTERABLE = %w[id tenant_id lock_version deleted_at created_at updated_at].freeze
+
+    belongs_to :owner, class_name: "User", optional: true
+
+    validates :entity_type, :name, presence: true
+    validates :visibility, inclusion: { in: VISIBILITIES }
+    validates :role, presence: true, if: -> { visibility == "role" }
+
+    # Apply this view's stored filters and sort to a base scope, returning a
+    # relation (columns and page_size are read by the controller/view). SAFE BY
+    # CONSTRUCTION: a filter or sort key is honored only if it names a real,
+    # non-plumbing column of the entity — a crafted key (arbitrary SQL, or
+    # tenant_id) is skipped, never executed. Values ride as hash conditions, so
+    # Active Record quotes them.
+    def apply(scope)
+      allowed = filterable_columns(scope.klass)
+      filters = config_hash("filters")
+
+      # A free-text "q" runs the entity's own Searchable search when it has one;
+      # on a non-searchable entity `search` returns `all`, so this safely no-ops.
+      if filters["q"].present? && scope.klass.respond_to?(:search)
+        scope = scope.search(filters["q"])
+      end
+
+      filters.each do |column, value|
+        next if column == "q"
+        next unless allowed.include?(column.to_s)
+
+        scope = scope.where(column => value)
+      end
+
+      sort = config_hash("sort")
+      if allowed.include?(sort["field"].to_s)
+        # reorder (not order) so the saved sort REPLACES the base order; id keeps
+        # pagination stable when the sort column has ties.
+        direction = sort["dir"].to_s == "desc" ? :desc : :asc
+        scope = scope.reorder(sort["field"] => direction, id: :desc)
+      end
+
+      scope
+    end
+
+    def columns
+      Array(config_hash_root["columns"])
+    end
+
+    def page_size
+      config_hash_root["page_size"]
+    end
+
+    # Make this the default for its audience, unsetting the sibling default it
+    # would otherwise compete with (same entity + visibility, and same owner/role
+    # where those narrow the audience).
+    def make_default!
+      siblings = self.class.where(entity_type: entity_type, visibility: visibility).where.not(id: id)
+      siblings = siblings.where(owner_id: owner_id) if visibility == "private"
+      siblings = siblings.where(role: role) if visibility == "role"
+
+      transaction do
+        siblings.update_all(is_default: false)
+        update!(is_default: true)
+      end
+    end
+
+    private
+
+    def filterable_columns(klass)
+      klass.column_names - NON_FILTERABLE
+    end
+
+    def config_hash_root
+      config.is_a?(Hash) ? config : {}
+    end
+
+    def config_hash(key)
+      value = config_hash_root[key]
+      value.is_a?(Hash) ? value : {}
+    end
+  end
+end

data/app/models/loam/progress_job.rb

@@ -0,0 +1,103 @@
+module Loam
+  # Progress of a long-running job (a bulk import, a reindex, a report) so the
+  # admin can watch it live instead of guessing. Tenant-scoped; a job started in
+  # one tenant is only visible and streamable there.
+  #
+  # Deliberately NOT audited: progress is high-frequency churn (many `advance`
+  # ticks) and the audit trail would fill with noise. The terminal status and
+  # any error are captured on the row itself, which is the summary that matters.
+  #
+  # Each meaningful change publishes `loam.progress.updated` (broadcastable → SSE)
+  # carrying only id/percent/status — no record contents. See Loam::Progress for
+  # the entry point.
+  class ProgressJob < Loam::TenantRecord
+    self.table_name = "loam_progress_jobs"
+
+    STATUSES = %w[running completed failed cancelled].freeze
+    STALE_AFTER = 5.minutes
+
+    validates :name, presence: true
+    validates :status, inclusion: { in: STATUSES }
+
+    scope :recent, -> { order(started_at: :desc, id: :desc) }
+
+    # Integer 0..100. A zero total is treated as 0% (an unknown-size job).
+    def percent
+      return 0 if total.to_i <= 0
+
+      [ (completed.to_f / total * 100).floor, 100 ].min
+    end
+
+    def running? = status == "running"
+    def terminal? = !running?
+
+    # Seconds remaining, extrapolated from the rate so far, or nil when it can't
+    # be estimated yet (no progress, or already finished).
+    def eta_seconds
+      return nil unless running? && completed.to_i.positive? && started_at
+
+      elapsed = Time.current - started_at
+      rate = completed / elapsed # items per second
+      return nil unless rate.positive?
+
+      ((total - completed) / rate).round
+    end
+
+    # A running job whose process died leaves the row "running" forever; it is
+    # stale once its heartbeat (updated_at, bumped on every advance) goes quiet.
+    # The prototype exposes the predicate and a manual mark-failed; a reaper
+    # daemon is the roadmap.
+    def stale?
+      running? && updated_at < STALE_AFTER.ago
+    end
+
+    # Increment progress. Persists every tick (so the count and heartbeat stay
+    # current) but THROTTLES the SSE broadcast to once per whole percent (or a
+    # message change) — a 10k-item job pushes ~100 frames, not 10k.
+    def advance(by: 1, message: nil)
+      before = percent
+      self.completed = completed.to_i + by
+      self.message = message if message
+      save!
+      broadcast if percent != before || message
+      self
+    end
+
+    def complete!
+      finish!("completed") { self.completed = total if total.to_i.positive? }
+    end
+
+    def fail!(error_message = nil)
+      finish!("failed") { self.error = error_message.to_s.presence }
+    end
+
+    def cancel!
+      finish!("cancelled")
+    end
+
+    # A cooperative cancel: a long job calls this periodically and stops early.
+    # Re-reads the status column so an admin's cancel in ANOTHER request is seen
+    # without clobbering the in-memory counters.
+    def cancelled?
+      self.class.where(id: id).pick(:status) == "cancelled"
+    end
+
+    private
+
+    def finish!(new_status)
+      yield if block_given?
+      self.status = new_status
+      self.finished_at = Time.current
+      save!
+      broadcast
+      self
+    end
+
+    # Only ever id/percent/status leave the server (Loam::Events stamps tenant_id
+    # for the SSE deliverable filter; the frame's safe_payload drops everything
+    # else).
+    def broadcast
+      Loam::Events.publish("loam.progress.updated", id: id, percent: percent, status: status)
+    end
+  end
+end

data/app/models/loam/record_lock.rb

@@ -0,0 +1,19 @@
+module Loam
+  # An advisory "someone is editing this" lock on a record — the COURTESY layer.
+  # The real guarantee against a silent clobber is optimistic locking
+  # (lock_version, see Loam::RecordLocks docs); this only warns the second
+  # editor. One lock per record, with a TTL: an expired lock is treated as free,
+  # and re-acquiring as the same holder extends it (a heartbeat). Plumbing, so
+  # not audited — like Loam::ApiToken.
+  class RecordLock < Loam::TenantRecord
+    self.table_name = "loam_record_locks"
+
+    belongs_to :locked_by, class_name: "User"
+
+    validates :lockable_type, :lockable_id, :token, :expires_at, presence: true
+
+    def expired?
+      expires_at.nil? || expires_at <= Time.current
+    end
+  end
+end

data/app/models/loam/scheduled_job.rb

@@ -0,0 +1,42 @@
+module Loam
+  # A recurring job that runs on a schedule (cron or interval). Tenant-scoped:
+  # a "tenant"-scope schedule enqueues its job in this tenant on schedule; a
+  # "system"-scope schedule enqueues once with no tenant context. Audited on
+  # config changes (not per run — runs are tracked by last_run_at/next_run_at).
+  #
+  # SECURITY: job_class is validated to be a known ActiveJob (see
+  # Loam::Scheduler.resolve_job_class) at save AND at enqueue — a scheduler that
+  # constantized and ran arbitrary user input would be a code-execution hole.
+  class ScheduledJob < Loam::TenantRecord
+    self.table_name = "loam_scheduled_jobs"
+
+    include Loam::Auditable
+
+    SCOPES = %w[tenant system].freeze
+    LOCK_TTL = 5.minutes    # how long a claim holds a due job before another tick may retry it
+    STALE_LOCK = LOCK_TTL
+
+    validates :key, presence: true, uniqueness: { scope: :tenant_id }
+    validates :name, :schedule, presence: true
+    validates :scope, inclusion: { in: SCOPES }
+    validate :job_class_is_a_known_job
+
+    scope :active, -> { where(active: true) }
+
+    # The next fire time strictly after `from`, in this job's timezone (UTC when
+    # unset). Stored in next_run_at as UTC.
+    def compute_next_run(from = Time.current)
+      Loam::Cron.next_after(schedule, from: from, zone: timezone.presence || "UTC")
+    end
+
+    def job_class_constant
+      Loam::Scheduler.resolve_job_class(job_class)
+    end
+
+    private
+
+    def job_class_is_a_known_job
+      errors.add(:job_class, "must name a known ActiveJob") unless job_class_constant
+    end
+  end
+end

data/app/models/loam/search_token.rb

@@ -0,0 +1,9 @@
+module Loam
+  # The word-level search index maintained by Loam::Search::TokenDriver: one row
+  # per (record, token), tenant-scoped like every Loam entity. Plumbing — not
+  # audited, not soft-deletable. Only the TokenDriver reads or writes it; under
+  # the default LikeDriver this table simply stays empty.
+  class SearchToken < Loam::TenantRecord
+    self.table_name = "loam_search_tokens"
+  end
+end

data/app/models/loam/sso_identity.rb

@@ -0,0 +1,13 @@
+module Loam
+  # Links an external IdP identity (a provider's stable `sub`) to a local User.
+  # The durable key SSO callbacks resolve on — an email can change at the IdP,
+  # `sub` does not. Tenant-scoped (created and read inside the provider's tenant).
+  class SsoIdentity < Loam::TenantRecord
+    self.table_name = "loam_sso_identities"
+
+    belongs_to :user
+    belongs_to :sso_provider, class_name: "Loam::SsoProvider"
+
+    validates :sub, presence: true, uniqueness: { scope: :sso_provider_id }
+  end
+end

data/app/models/loam/sso_provider.rb

@@ -0,0 +1,35 @@
+module Loam
+  # A tenant's connection to an external identity provider (OIDC). Per-tenant
+  # config: each tenant/org wires its OWN IdP, so the client_secret is encrypted
+  # under the tenant key (the default Encryptable scope) — unlike MFA, which is
+  # user-keyed. Home-realm discovery matches an email `domain` to the owning
+  # provider at the sign-in page (see Loam::Sso.provider_for).
+  class SsoProvider < Loam::TenantRecord
+    self.table_name = "loam_sso_providers"
+
+    include Loam::Auditable      # config changes are audited; the secret is redacted
+    include Loam::Encryptable
+
+    # Tenant-scoped key (default): SSO config belongs to the tenant, and the
+    # secret is only ever read inside that tenant's context on callback.
+    encrypts :client_secret
+
+    has_many :identities, class_name: "Loam::SsoIdentity",
+             foreign_key: :sso_provider_id, dependent: :delete_all
+
+    validates :name, :protocol, :domain, :jit_role, presence: true
+    # Globally unique so HRD resolves exactly one owning IdP per domain. Rails'
+    # uniqueness validator queries WITHOUT the default tenant scope, so this
+    # catches a collision across tenants too.
+    validates :domain, uniqueness: true
+
+    normalizes :domain, with: ->(domain) { domain.to_s.strip.downcase.presence }
+
+    scope :active, -> { where(active: true) }
+
+    # IdP group -> Loam role, first match wins; falls back to jit_role.
+    def group_roles
+      group_role_map.is_a?(Hash) ? group_role_map : {}
+    end
+  end
+end

data/app/models/loam/tenant.rb

@@ -0,0 +1,20 @@
+module Loam
+  # The tenant itself is deliberately NOT tenant-scoped — it is the axis the
+  # rest of the system is scoped by.
+  class Tenant < ActiveRecord::Base
+    include Loam::GeneratedKey
+    self.table_name = "loam_tenants"
+
+    validates :name, presence: true
+    validates :slug, presence: true, uniqueness: true
+
+    has_many :memberships, class_name: "Loam::Membership", dependent: :delete_all
+
+    # A new tenant is never empty: whatever the app registered via
+    # Loam.on_tenant_created runs here, inside this tenant's context. After
+    # commit, so callbacks see a persisted tenant and may enqueue jobs.
+    # `bin/rails loam:sync` re-runs the same callbacks for existing tenants —
+    # which is why they must be idempotent (see Loam::Lifecycle).
+    after_create_commit { Loam::Lifecycle.run_tenant_created(self) }
+  end
+end

data/app/models/loam/translation.rb

@@ -0,0 +1,17 @@
+module Loam
+  # A per-locale override for ONE field of ONE record — the storage behind
+  # Loam::Translatable. The record's own column holds the base (default-locale)
+  # value; a translation row overrides it for a specific locale. Additive:
+  # writing a translation never touches the base column, so the base value is
+  # never lost. Tenant-scoped and audited.
+  class Translation < Loam::TenantRecord
+    self.table_name = "loam_translations"
+
+    include Loam::Auditable
+
+    belongs_to :translatable, polymorphic: true
+
+    validates :locale, :field, presence: true
+    validates :field, uniqueness: { scope: %i[translatable_type translatable_id locale] }
+  end
+end

data/app/models/loam/webhook_endpoint.rb

@@ -0,0 +1,26 @@
+module Loam
+  # Where one tenant wants its domain events delivered. `event_pattern` uses
+  # the same rule as Loam::Events.subscribe — a trailing dot is a domain prefix
+  # ("rental."), anything else is an exact event name.
+  #
+  # The secret signs every delivery (X-Loam-Signature), so a receiver can tell
+  # a real call from a forged one.
+  class WebhookEndpoint < Loam::TenantRecord
+    self.table_name = "loam_webhook_endpoints"
+
+    validates :url, presence: true, format: { with: %r{\Ahttps?://}, message: "must start with http:// or https://" }
+    validates :event_pattern, presence: true
+
+    scope :active, -> { where(active: true) }
+
+    before_validation on: :create do
+      self.secret ||= SecureRandom.hex(32)
+    end
+
+    # One matcher, shared with the event bus, so "rental." means the same thing
+    # to a subscriber and to a webhook.
+    def matches?(event_name)
+      Loam::Events.pattern_matches?(event_pattern, event_name)
+    end
+  end
+end

data/app/views/loam/attachments/_attachments.html.erb

@@ -0,0 +1,16 @@
+<%# locals: record — shared by every generated entity's show.html.erb.
+    Uploading happens through the entity's own form (it is an update, and the
+    entity's policy decides who may do it); this partial only lists what is
+    already attached. Note that these links are signed URLs, not tenant-checked
+    addresses — see Loam::Attachable. %>
+<h2>Files</h2>
+
+<% if record.files.attached? %>
+  <ul>
+    <% record.files.each do |file| %>
+      <li><%= link_to file.filename.to_s, url_for(file) %> (<%= number_to_human_size(file.byte_size) %>)</li>
+    <% end %>
+  </ul>
+<% else %>
+  <p>No files attached.</p>
+<% end %>

data/app/views/loam/comments/_comments.html.erb

@@ -0,0 +1,24 @@
+<%# locals: record — shared by every generated entity's show.html.erb so the
+    discussion is rendered once, in the gem, instead of per entity. Posting is
+    open to any member: BaseController has already proven that whoever is here
+    holds a membership in this tenant. %>
+<h2>Comments</h2>
+
+<% if flash[:alert] %>
+  <p style="color:#b00"><%= flash[:alert] %></p>
+<% end %>
+
+<% record.loam_comments.oldest_first.each do |comment| %>
+  <p>
+    <strong><%= User.find_by(id: comment.author_id)&.name || "—" %></strong>
+    <em><%= comment.created_at.to_fs(:short) %></em><br>
+    <%= comment.body %>
+  </p>
+<% end %>
+
+<%= form_with url: admin_comments_path, method: :post do |f| %>
+  <%= hidden_field_tag :commentable_type, record.class.name %>
+  <%= hidden_field_tag :commentable_id, record.id %>
+  <%= text_area_tag :body, nil, rows: 3, placeholder: "Add a comment" %>
+  <%= f.submit "Comment" %>
+<% end %>

data/app/views/loam/custom_fields/_fields.html.erb

@@ -0,0 +1,35 @@
+<%# locals: record, policy, mode (:edit or :show, default :edit) — shared by every
+    generated entity's _form.html.erb and show.html.erb so runtime custom-field
+    rendering lives once in the gem instead of being inlined per entity. %>
+<% mode = local_assigns.fetch(:mode, :edit) %>
+<% record.class.custom_field_definitions.each do |definition| %>
+  <% param_name = "#{record.model_name.param_key}[custom_fields][#{definition.name}]" %>
+  <% value = record.custom_field(definition.name) %>
+  <p>
+    <% if mode == :edit && policy.custom_field_writable?(definition.name) %>
+      <%= label_tag param_name, definition.name.humanize %><br>
+      <% case definition.field_type %>
+      <% when "boolean" %>
+        <%= check_box_tag param_name, "true", value, id: param_name %>
+      <% when "text" %>
+        <%= text_area_tag param_name, value %>
+      <% when "date" %>
+        <%= date_field_tag param_name, value %>
+      <% when "datetime" %>
+        <%= datetime_field_tag param_name, value %>
+      <% when "integer", "decimal" %>
+        <%= number_field_tag param_name, value %>
+      <% when "dictionary" %>
+        <% options = Loam::Dictionaries.entries(definition.dictionary_key).map { |e| [e.label, e.value] } %>
+        <%= select_tag param_name, options_for_select(options, value), include_blank: true, id: param_name %>
+      <% else %>
+        <%= text_field_tag param_name, value %>
+      <% end %>
+    <% else %>
+      <%# A dictionary field shows its entry label, not the raw stored code. %>
+      <% display = definition.field_type == "dictionary" ? Loam::Dictionaries.label_for(definition.dictionary_key, value) : value %>
+      <%= definition.name.humanize %>: <%= display %>
+      <% if mode == :edit %><em>(read-only for your role)</em><% end %>
+    <% end %>
+  </p>
+<% end %>

data/lib/generators/loam/entity/entity_generator.rb

@@ -0,0 +1,160 @@
+require "rails/generators"
+require "rails/generators/active_record"
+require "generators/loam/primary_key_options"
+
+module Loam
+  module Generators
+    # `rails g loam:entity Equipment name:string daily_rate:decimal --domain rental`
+    #
+    # THE interface for adding a business entity — for humans and AI agents
+    # alike. One command produces a tenant-scoped, audited, evented model, its
+    # policy, an admin screen, and the isolation tests that prove the
+    # guardrails hold. No decisions about how tenancy/permissions work: Loam
+    # already decided.
+    class EntityGenerator < Rails::Generators::NamedBase
+      include ActiveRecord::Generators::Migration
+      include Loam::Generators::PrimaryKeyOptions
+
+      source_root File.expand_path("templates", __dir__)
+
+      argument :attributes, type: :array, default: [], banner: "field:type field:type"
+      class_option :domain, type: :string, default: "app",
+                            desc: "Event domain prefix (-> domain.entity.created)"
+      class_option :encrypt, type: :array, default: [], banner: "field field",
+                             desc: "Encrypt these fields at rest, per tenant (Loam::Encryptable)"
+      class_option :encrypt_searchable, type: :array, default: [], banner: "field field",
+                                        desc: "Encrypt + add a blind index for exact-match lookup"
+
+      def create_migration_file
+        migration_template "migration.rb", "db/migrate/create_#{table_name}.rb"
+      end
+
+      def create_model
+        template "model.rb", "app/models/#{file_name}.rb"
+      end
+
+      def create_policy
+        template "policy.rb", "app/policies/#{file_name}_policy.rb"
+      end
+
+      def create_admin_controller
+        template "controller.rb", "app/controllers/admin/#{plural_file_name}_controller.rb"
+      end
+
+      def create_api_controller
+        template "api_controller.rb", "app/controllers/api/#{plural_file_name}_controller.rb"
+      end
+
+      def create_admin_views
+        template "views/index.html.erb", "app/views/admin/#{plural_file_name}/index.html.erb"
+        template "views/deleted.html.erb", "app/views/admin/#{plural_file_name}/deleted.html.erb"
+        template "views/show.html.erb", "app/views/admin/#{plural_file_name}/show.html.erb"
+        template "views/new.html.erb", "app/views/admin/#{plural_file_name}/new.html.erb"
+        template "views/edit.html.erb", "app/views/admin/#{plural_file_name}/edit.html.erb"
+        template "views/_form.html.erb", "app/views/admin/#{plural_file_name}/_form.html.erb"
+      end
+
+      def create_entity_test
+        template "entity_test.rb", "test/entities/#{file_name}_test.rb"
+      end
+
+      # `namespace:` makes Rails inject the route INTO the existing
+      # `namespace :admin do` block (the one loam:install wrote) instead of
+      # stacking one admin block per entity, and falls back to creating the
+      # block when there is none. Re-running the generator is a no-op: the
+      # injection is `force: false`, so identical routing code is skipped.
+      # The API line carries `defaults: { format: :json }` — it is what an API
+      # namespace wants anyway, and it also has to differ textually from the
+      # admin line above: Rails' route injection skips code the file already
+      # contains (that is what makes re-running this generator a no-op), so two
+      # identical `resources :gadgets` lines would leave the second one out.
+      #
+      # The admin resource carries the soft-delete recycle bin: `deleted` lists
+      # `only_deleted`, `restore` brings one back (see Loam::SoftDeletable).
+      def add_route
+        route <<~RUBY.strip, namespace: :admin
+          resources :#{plural_file_name} do
+            get :deleted, on: :collection
+            patch :restore, on: :member
+            get :export, on: :collection   # CSV of the current view
+            post :bulk, on: :collection    # datatable bulk actions
+          end
+        RUBY
+        route "resources :#{plural_file_name}, defaults: { format: :json }", namespace: :api
+      end
+
+      def print_next_steps
+        say ""
+        say "Entity #{class_name} created. Next:", :green
+        say "  1. bin/rails db:migrate"
+        say "  2. Declare field-level permissions in app/policies/#{file_name}_policy.rb"
+        say "  3. bin/rails test"
+      end
+
+      private
+
+      def domain
+        options[:domain]
+      end
+
+      def field_names
+        attributes.map(&:name)
+      end
+
+      # Only text-ish columns are worth a LIKE (see Loam::Searchable), so an
+      # entity with none gets no `searchable_by` declaration and stays out of
+      # the global search. Encrypted columns are excluded: ciphertext is
+      # meaningless to LIKE, and declaring both would raise at class load.
+      def searchable_attributes
+        attributes.select do |attribute|
+          %i[string text].include?(attribute.type) && !encrypted_field_names.include?(attribute.name)
+        end
+      end
+
+      # Fields to encrypt at rest. `--encrypt-searchable` also gets a blind index
+      # (a `<field>_hash` column) for exact-match lookup; plain `--encrypt` does not.
+      def encrypt_searchable_names
+        options[:encrypt_searchable]
+      end
+
+      def encrypted_field_names
+        options[:encrypt] + options[:encrypt_searchable]
+      end
+
+      def encrypted?(attribute)
+        encrypted_field_names.include?(attribute.name)
+      end
+
+      # A plausible literal per attribute type, used by the generated test.
+      def sample_value(attribute, variant = 0)
+        case attribute.type
+        when :integer, :bigint, :references then 1 + variant
+        when :decimal, :float then "%.2f" % (9.99 + variant)
+        when :boolean then (variant.zero? ? "true" : "false")
+        when :date then "Date.new(2026, 1, #{1 + variant})"
+        when :datetime, :time, :timestamp then "Time.utc(2026, 1, #{1 + variant})"
+        else "\"Sample #{attribute.name} #{variant}\""
+        end
+      end
+
+      def sample_attributes(variant = 0)
+        attributes.map { |a| "#{a.name}: #{sample_value(a, variant)}" }.join(", ")
+      end
+
+      def first_field
+        field_names.first || "tenant_id"
+      end
+
+      def form_field_helper(attribute)
+        case attribute.type
+        when :boolean then "check_box"
+        when :text then "text_area"
+        when :date then "date_field"
+        when :datetime, :time, :timestamp then "datetime_field"
+        when :integer, :bigint, :decimal, :float, :references then "number_field"
+        else "text_field"
+        end
+      end
+    end
+  end
+end