open-loam 0.1.0

data/lib/generators/loam/install/templates/admin/base_controller.rb

@@ -0,0 +1,224 @@
+module Admin
+  class BaseController < ActionController::Base
+    include Pagination
+
+    layout "admin"
+
+    before_action :set_loam_context
+    before_action :set_locale
+
+    rescue_from Loam::NotAuthorizedError do
+      render plain: "403 Forbidden — your role does not permit this action.", status: :forbidden
+    end
+
+    # A disabled feature is "not here" for this tenant, so it 404s — unlike a
+    # policy refusal (403), which is "you may not". Capability vs. person.
+    rescue_from Loam::FeatureDisabledError do
+      render plain: "404 Not Found — this feature is not enabled for your tenant.", status: :not_found
+    end
+
+    # A business rule (or any code) can veto a workflow transition from
+    # `loam_perform_transition!`. Surface it as a clean 422, never a 500.
+    rescue_from Loam::TransitionVetoedError do |error|
+      render plain: "422 — #{error.message}", status: :unprocessable_entity
+    end
+
+    helper_method :current_tenant, :current_actor, :unread_notification_count, :feature_on?, :pending_approval_count, :current_role, :current_locale, :sort_link, :can?
+
+    private
+
+    # A clickable, stateful column header for the generated index tables (L-401):
+    # toggles asc/desc, shows the active-direction arrow, and carries the current
+    # search / filter / saved-view state so sorting composes with paging and
+    # filtering. The controller whitelists the column against real columns, so a
+    # crafted `sort` param can never reach ORDER BY.
+    def sort_link(column, label)
+      active = params[:sort].to_s == column.to_s
+      ascending = active && params[:dir].to_s.casecmp("asc").zero?
+      arrow = active ? (ascending ? " ↑" : " ↓") : ""
+      carried = respond_to?(:current_index_params, true) ? current_index_params : {}
+      helpers.link_to("#{label}#{arrow}", url_for(carried.merge(sort: column, dir: ascending ? "desc" : "asc")))
+    end
+
+    # Locale is request state like the tenant: from the switcher (param),
+    # remembered in the session, defaulting to Loam.default_locale. Content
+    # translations (Loam::Translatable) overlay onto it.
+    def set_locale
+      session[:locale] = params[:locale] if params[:locale].present? && Loam.locales.include?(params[:locale])
+      Loam::Current.locale = session[:locale] || Loam.default_locale
+      # Drive Rails i18n (UI strings) off the same choice, so the switcher moves
+      # both the chrome and the content — but only to a locale that actually has
+      # translations, so an unlisted locale keeps English UI (data still overlays).
+      chosen = Loam::Current.locale.to_s
+      I18n.locale = chosen if I18n.available_locales.map(&:to_s).include?(chosen)
+    end
+
+    def current_locale = Loam::Current.locale
+
+    def current_tenant = Loam::Current.tenant
+    def current_actor = Loam::Current.actor
+
+    # Establishes Loam::Current from the session, then proves the actor is
+    # allowed to be here.
+    #
+    # The order is load-bearing. Loam::Membership is itself tenant-scoped, so
+    # "is this actor a member?" is a question you can only ask from inside a
+    # tenant — the tenant has to be in Loam::Current first, or the check raises
+    # Loam::MissingTenantError instead of answering. The `&&` chain below
+    # guarantees that: membership is only consulted once both are set.
+    #
+    # If anything fails, BOTH halves of the context are cleared before the
+    # redirect, so a half-established context can never leak into the next
+    # request or into a job enqueued from it.
+    def set_loam_context
+      Loam::Current.tenant = Loam::Tenant.find_by(id: session[:tenant_id])
+      Loam::Current.actor = User.find_by(id: session[:user_id])
+
+      return if current_tenant && current_actor && member_of_current_tenant?
+
+      Loam::Current.reset
+      redirect_to new_admin_session_path
+    end
+
+    # Scoped to the current tenant by Loam::TenantRecord, which is the whole
+    # point: a membership in some other tenant is not membership here.
+    def member_of_current_tenant?
+      Loam::Membership.exists?(user_id: current_actor.id)
+    end
+
+    # Drives the bell in the admin layout. One COUNT per admin page render,
+    # which is fine at this scale; cache it if a screen ever gets hot.
+    def unread_notification_count
+      return 0 unless current_actor
+
+      Loam::Notification.unread.where(user_id: current_actor.id).count
+    end
+
+    # Staged changes awaiting review, for the "Approvals (N)" nav badge.
+    def pending_approval_count
+      return 0 unless current_tenant
+
+      Loam::PendingAction.pending.count
+    end
+
+    def policy_for(record)
+      Loam::Policy.for(record)
+    end
+
+    def authorize!(policy, action)
+      raise Loam::NotAuthorizedError unless policy.public_send(action)
+    end
+
+    # For admin screens with no per-record policy (e.g. field definitions,
+    # which apply to a whole entity_type rather than one record).
+    def current_role
+      Loam::Membership.find_by(user_id: current_actor&.id)&.role&.to_sym
+    end
+
+    def require_role!(*roles)
+      raise Loam::NotAuthorizedError unless roles.include?(current_role)
+    end
+
+    # Feature-string permission gate (Loam::Permissions) — a finer capability
+    # check than require_role!. `can?` is a helper_method so views hide UI a role
+    # lacks; require_permission! enforces it (403) server-side.
+    def can?(permission)
+      Loam.can?(permission)
+    end
+
+    def require_permission!(permission)
+      raise Loam::NotAuthorizedError unless Loam.can?(permission)
+    end
+
+    # Feature guards. These gate a CAPABILITY (is the feature on for this
+    # tenant), orthogonal to require_role! / policies, which gate a PERSON.
+    # `feature_on?` is a helper_method, so views can hide UI a flag turns off.
+    def feature_on?(name)
+      Loam::Features.on?(name)
+    end
+
+    def require_feature!(name)
+      raise Loam::FeatureDisabledError unless Loam::Features.on?(name)
+    end
+
+    # Optimistic-locking conflict handling: someone saved this record between the
+    # user opening the edit form and submitting it (lock_version mismatch →
+    # StaleObjectError). Build a field-level diff of what the user tried to write
+    # vs the current saved values, then RELOAD to fresh data so the retry carries
+    # the new lock_version — never a 500, never a silent clobber. lock_version is
+    # the guarantee; the advisory Loam::RecordLock is only a courtesy warning.
+    #
+    # Encrypted fields are compared and shown via the reader (decrypted); the raw
+    # column is ciphertext that never matches (random IV), so a byte compare would
+    # be a false conflict every time.
+    def stale_conflict!(record, fields)
+      encrypted = record.class.respond_to?(:loam_encrypted_attributes) ? record.class.loam_encrypted_attributes.map(&:to_s) : []
+      attempted = fields.map(&:to_s).index_with { |field| conflict_value(record, field, encrypted) }
+
+      record.reload
+
+      @conflict = fields.map(&:to_s).each_with_object({}) do |field, diff|
+        theirs = conflict_value(record, field, encrypted)
+        yours = attempted[field]
+        diff[field] = { "yours" => yours, "theirs" => theirs } unless yours.to_s == theirs.to_s
+      end
+      flash.now[:alert] = "This #{record.model_name.human.downcase} changed since you opened it — review the differences and save again."
+    end
+
+    def conflict_value(record, field, encrypted)
+      encrypted.include?(field) ? record.public_send(field) : record[field]
+    end
+
+    # Step-up ("sudo") auth. Orthogonal to role: even a manager re-confirms for a
+    # sensitive action if their last authentication was more than SUDO_WINDOW ago.
+    # A fresh login or MFA verification stamps session[:sudo_at]; this re-checks
+    # it and, when stale, detours through the re-challenge and comes back.
+    SUDO_WINDOW = 5.minutes
+
+    def require_sudo!
+      return if sudo_fresh?
+
+      # A GET can be replayed after re-auth; a non-GET (a DELETE button) cannot,
+      # so we come back to the page it was on and the user repeats the action.
+      session[:sudo_return_to] = request.get? ? request.fullpath : request.referer
+      redirect_to new_admin_sudo_path
+    end
+
+    def sudo_fresh?
+      authenticated_at = session[:sudo_at]
+      authenticated_at.present? && Time.now.to_i - authenticated_at.to_i < SUDO_WINDOW.to_i
+    end
+
+    # Attaching a file changes the record, so it is an update: a role that may
+    # not update this record may not put files on it either.
+    #
+    # A `multiple: true` file field posts an empty string alongside any real
+    # files, so blanks are dropped BEFORE the authorization check — submitting
+    # a form with no file chosen is not an attempt to upload.
+    def attach_files!(record, policy)
+      submitted = Array(params.dig(record.model_name.param_key, :files)).reject(&:blank?)
+      return if submitted.empty?
+
+      raise Loam::NotAuthorizedError unless policy.update?
+
+      record.files.attach(submitted)
+    end
+
+    # Runtime custom fields (see Loam::CustomFields) go through the same
+    # field-level enforcement as real columns: only a writable definition's
+    # value is ever assigned.
+    def assign_custom_fields!(record, params, policy)
+      # The form partial nests inputs under the model's param key
+      # (equipment[custom_fields][serial_number]), so the values must be read
+      # from there — a top-level params[:custom_fields] read silently saves
+      # nothing while the redirect still says success. Found by an agent
+      # during the first golden-tasks benchmark run.
+      submitted = params.dig(record.model_name.param_key, :custom_fields)
+      return unless submitted
+
+      submitted.each do |name, value|
+        record.set_custom_field(name, value) if policy.custom_field_writable?(name)
+      end
+    end
+  end
+end

data/lib/generators/loam/install/templates/admin/business_rules_controller.rb

@@ -0,0 +1,64 @@
+module Admin
+  # Managing business rules (Loam::BusinessRule) — manager-only, since a rule can
+  # notify, emit events, and set fields across the tenant. The condition and
+  # actions are edited as JSON for the prototype (a visual builder is a future
+  # increment). The recent execution log shows WHY rules fired.
+  class BusinessRulesController < BaseController
+    before_action { require_role!(:manager) }
+    before_action :set_rule, only: %i[edit update destroy]
+
+    rescue_from JSON::ParserError do |error|
+      flash.now[:alert] = "Condition and actions must be valid JSON: #{error.message}"
+      @rule ||= Loam::BusinessRule.new
+      render(@rule.persisted? ? :edit : :new, status: :unprocessable_entity)
+    end
+
+    def index
+      @rules = Loam::BusinessRule.by_priority
+      @recent_runs = Loam::BusinessRuleRun.recent.limit(20)
+    end
+
+    def new
+      @rule = Loam::BusinessRule.new(active: true, condition: {}, actions: [])
+    end
+
+    def create
+      @rule = Loam::BusinessRule.new(rule_params)
+      if @rule.save
+        redirect_to admin_business_rules_path, notice: "Rule created."
+      else
+        render :new, status: :unprocessable_entity
+      end
+    end
+
+    def edit; end
+
+    def update
+      if @rule.update(rule_params)
+        redirect_to admin_business_rules_path, notice: "Rule updated."
+      else
+        render :edit, status: :unprocessable_entity
+      end
+    end
+
+    def destroy
+      @rule.destroy!
+      redirect_to admin_business_rules_path, notice: "Rule deleted."
+    end
+
+    private
+
+    def set_rule
+      @rule = Loam::BusinessRule.find(params[:id])
+    end
+
+    # Parse the JSON textareas here; a malformed value raises JSON::ParserError,
+    # which the rescue above turns into a form error (never a 500).
+    def rule_params
+      attributes = params.require(:business_rule).permit(:name, :entity_type, :trigger, :active, :priority)
+      attributes[:condition] = JSON.parse(params[:business_rule][:condition].presence || "{}")
+      attributes[:actions] = JSON.parse(params[:business_rule][:actions].presence || "[]")
+      attributes
+    end
+  end
+end

data/lib/generators/loam/install/templates/admin/business_rules_edit.html.erb

@@ -0,0 +1,3 @@
+<h1>Edit rule</h1>
+
+<%%= render "form" %>

data/lib/generators/loam/install/templates/admin/business_rules_form.html.erb

@@ -0,0 +1,32 @@
+<%% if @error || flash[:alert] %>
+  <p style="color:#b00"><%%= @error || flash[:alert] %></p>
+<%% end %>
+
+<%# The model is namespaced (Loam::BusinessRule), so an inferred URL/param-scope
+    would be admin_loam_business_rule_path / loam_business_rule[...]. Pin both to
+    the un-namespaced route and the "business_rule" key the controller permits. %>
+<%%= form_with model: @rule, scope: :business_rule,
+      url: (@rule.persisted? ? admin_business_rule_path(@rule) : admin_business_rules_path) do |f| %>
+  <%% if @rule.errors.any? %>
+    <ul><%% @rule.errors.full_messages.each do |m| %><li><%%= m %></li><%% end %></ul>
+  <%% end %>
+
+  <p><%%= f.label :name %><br><%%= f.text_field :name %></p>
+  <p><%%= f.label :trigger, "Trigger (event pattern, e.g. billing.invoice.submit)" %><br><%%= f.text_field :trigger %></p>
+  <p><%%= f.label :entity_type, "Entity type (e.g. Invoice; blank for event-only)" %><br><%%= f.text_field :entity_type %></p>
+  <p><%%= f.label :priority %><br><%%= f.number_field :priority %></p>
+  <p><%%= f.label :active %> <%%= f.check_box :active %></p>
+
+  <p>
+    <%%= f.label :condition, "Condition (JSON)" %><br>
+    <%%= f.text_area :condition, value: JSON.pretty_generate(@rule.condition_tree), rows: 6, cols: 60 %>
+  </p>
+  <p>
+    <%%= f.label :actions, "Actions (JSON list)" %><br>
+    <%%= f.text_area :actions, value: JSON.pretty_generate(@rule.action_list), rows: 6, cols: 60 %>
+  </p>
+
+  <%%= f.submit %>
+<%% end %>
+
+<p><%%= link_to "Back", admin_business_rules_path %></p>

data/lib/generators/loam/install/templates/admin/business_rules_index.html.erb

@@ -0,0 +1,45 @@
+<h1>Business rules</h1>
+
+<p><%%= link_to "New rule", new_admin_business_rule_path %></p>
+
+<table>
+  <thead>
+    <tr><th>Name</th><th>Trigger</th><th>Entity</th><th>Priority</th><th>Active</th><th></th></tr>
+  </thead>
+  <tbody>
+    <%% @rules.each do |rule| %>
+      <tr>
+        <td><%%= rule.name %></td>
+        <td><code><%%= rule.trigger %></code></td>
+        <td><%%= rule.entity_type %></td>
+        <td><%%= rule.priority %></td>
+        <td><%%= rule.active? ? "yes" : "no" %></td>
+        <td>
+          <%%= link_to "Edit", edit_admin_business_rule_path(rule) %>
+          <%%= button_to "Delete", admin_business_rule_path(rule), method: :delete, form: { style: "display:inline" } %>
+        </td>
+      </tr>
+    <%% end %>
+  </tbody>
+</table>
+
+<h2>Recent runs</h2>
+<p>Why rules did (or didn't) act — the last 20.</p>
+<table>
+  <thead>
+    <tr><th>When</th><th>Rule</th><th>Subject</th><th>Event</th><th>Matched</th><th>Actions</th><th>Error</th></tr>
+  </thead>
+  <tbody>
+    <%% @recent_runs.each do |run| %>
+      <tr>
+        <td><%%= run.created_at.strftime("%H:%M:%S") %></td>
+        <td><%%= run.business_rule.name %></td>
+        <td><%%= [run.subject_type, run.subject_id].compact.join(" #") %></td>
+        <td><code><%%= run.event_name %></code></td>
+        <td><%%= run.matched ? "yes" : "no" %></td>
+        <td><%%= Array(run.actions_taken).join(", ") %></td>
+        <td><%%= run.error %></td>
+      </tr>
+    <%% end %>
+  </tbody>
+</table>

data/lib/generators/loam/install/templates/admin/business_rules_new.html.erb

@@ -0,0 +1,3 @@
+<h1>New rule</h1>
+
+<%%= render "form" %>

data/lib/generators/loam/install/templates/admin/comments_controller.rb

@@ -0,0 +1,39 @@
+module Admin
+  # One controller for every commentable entity, because a comment form is the
+  # same form whatever it is attached to.
+  #
+  # Create only: comments are a record of what was said, so there is no edit
+  # and no delete here.
+  class CommentsController < BaseController
+    def create
+      record = commentable
+
+      # Commenting is open to any member — and membership is already proven:
+      # BaseController refuses the request otherwise. The policy check is the
+      # record's own, so an entity that hides itself from a role hides its
+      # discussion too.
+      authorize!(policy_for(record), :read?)
+
+      comment = record.loam_comments.new(body: params[:body], author: current_actor)
+      flash[:alert] = comment.errors.full_messages.to_sentence unless comment.save
+
+      redirect_back fallback_location: [ :admin, record ]
+    end
+
+    private
+
+    # The type arrives from the browser, so it is never constantized blindly.
+    # `safe_constantize` returns nil for anything that is not a real constant,
+    # and the class then has to prove it is a Loam entity that opted into
+    # comments — the allowlist is the contract, not a hand-kept list of names.
+    def commentable
+      klass = params[:commentable_type].to_s.safe_constantize
+
+      unless klass.is_a?(Class) && klass < Loam::TenantRecord && klass.include?(Loam::Commentable)
+        raise Loam::NotAuthorizedError, "#{params[:commentable_type].inspect} is not a commentable Loam entity"
+      end
+
+      klass.find(params[:commentable_id])
+    end
+  end
+end

data/lib/generators/loam/install/templates/admin/configs_controller.rb

@@ -0,0 +1,46 @@
+module Admin
+  # Per-tenant settings (Loam::Configs). Structural, not per-record, so it is
+  # gated on the manager role rather than an entity policy — settings are
+  # privileged. Everything routes through Loam::Configs, never Loam::Config
+  # directly, so the cross-level resolution stays in vetted gem code.
+  class ConfigsController < BaseController
+    before_action { require_role!(:manager) }
+
+    def index
+      # Feature flags share the loam_configs store but have their own screen
+      # (/admin/features), so hide their reserved-prefix keys from Settings.
+      keys = Loam::Configs.defined_keys.reject { |key| key.start_with?(Loam::Features::PREFIX) }
+      @settings = keys.map do |key|
+        { key: key, value: Loam::Configs.get(key), overridden: Loam::Configs.overridden?(key) }
+      end
+    end
+
+    def edit
+      @key = params[:key]
+      @value = Loam::Configs.get(@key)
+      @overridden = Loam::Configs.overridden?(@key)
+    end
+
+    def update
+      Loam::Configs.set(params[:key], coerce(params[:value]))
+      redirect_to admin_configs_path, notice: "#{params[:key]} set for this tenant."
+    end
+
+    def reset
+      Loam::Configs.reset(params[:key])
+      redirect_to admin_configs_path, notice: "#{params[:key]} reset to the default."
+    end
+
+    private
+
+    # The form is a single text field, so values arrive as strings. Parse them
+    # as JSON so numbers/booleans/objects keep their type; anything that is not
+    # valid JSON (a bare word like PLN) is stored as the string it is. Known
+    # quirk: typing 25 stores the number, never the string "25" — fine here.
+    def coerce(raw)
+      JSON.parse(raw)
+    rescue JSON::ParserError
+      raw
+    end
+  end
+end

data/lib/generators/loam/install/templates/admin/configs_edit.html.erb

@@ -0,0 +1,22 @@
+<h1>Setting: <%%= @key %></h1>
+
+<p>Overriding for <strong><%%= current_tenant.name %></strong>.
+Current value: <code><%%= @value.inspect %></code>
+(<%%= @overridden ? "overridden here" : "inherited default" %>).</p>
+
+<%%= form_with url: admin_configs_path, method: :patch do |f| %>
+  <%%= hidden_field_tag :key, @key %>
+  <p>
+    <%%= label_tag :value, "Value" %><br>
+    <%%= text_field_tag :value, @value.is_a?(String) ? @value : @value.to_json %>
+  </p>
+  <p class="hint">Numbers, true/false and JSON objects keep their type; plain text is stored as a string.</p>
+  <%%= f.submit "Save override" %>
+<%% end %>
+
+<p>
+  <%% if @overridden %>
+    <%%= button_to "Reset to default", admin_configs_path(key: @key), method: :delete %>
+  <%% end %>
+  <%%= link_to "Back", admin_configs_path %>
+</p>

data/lib/generators/loam/install/templates/admin/configs_index.html.erb

@@ -0,0 +1,30 @@
+<h1>Settings</h1>
+
+<p>Values resolve override → global → declared default. Editing sets an override
+for <strong><%%= current_tenant.name %></strong> only; Reset drops it.</p>
+
+<table>
+  <thead>
+    <tr>
+      <th>Key</th>
+      <th>Value (this tenant)</th>
+      <th>Source</th>
+      <th></th>
+    </tr>
+  </thead>
+  <tbody>
+    <%% @settings.each do |setting| %>
+      <tr>
+        <td><%%= setting[:key] %></td>
+        <td><%%= setting[:value].inspect %></td>
+        <td><%%= setting[:overridden] ? "override" : "default" %></td>
+        <td>
+          <%%= link_to "Edit", admin_edit_config_path(key: setting[:key]) %>
+          <%% if setting[:overridden] %>
+            <%%= button_to "Reset", admin_configs_path(key: setting[:key]), method: :delete, form: { style: "display:inline" } %>
+          <%% end %>
+        </td>
+      </tr>
+    <%% end %>
+  </tbody>
+</table>

data/lib/generators/loam/install/templates/admin/dashboard_controller.rb

@@ -0,0 +1,10 @@
+module Admin
+  class DashboardController < BaseController
+    def index
+      # Configurable, role-visible widgets (Loam::Dashboard) — a raising widget
+      # is isolated into an error tile, never breaking the page. Register your
+      # own with Loam::Widgets.register; arrange them under Dashboard settings.
+      @widgets = Loam::Dashboard.for(actor: current_actor, role: current_role)
+    end
+  end
+end

data/lib/generators/loam/install/templates/admin/dashboard_index.html.erb

@@ -0,0 +1,26 @@
+<h1>Dashboard</h1>
+
+<%% if current_role == :manager %>
+  <p><%%= link_to "Dashboard settings", admin_dashboard_widgets_path %></p>
+<%% end %>
+
+<div class="widgets" style="display:flex; flex-wrap:wrap; gap:1rem">
+  <%% @widgets.each do |widget| %>
+    <div class="widget" style="border:1px solid #ccc; padding:0.75rem; min-width:200px">
+      <h3><%%= widget[:title] %></h3>
+      <%% if widget[:error] %>
+        <p style="color:#b00">This widget could not load.</p>
+      <%% else %>
+        <%% data = widget[:data] %>
+        <%% case data[:kind] %>
+        <%% when "count" %>
+          <p style="font-size:2rem; margin:0"><%%= data[:value] %></p>
+        <%% when "list" %>
+          <ul><%% data[:items].each do |item| %><li><%%= item %></li><%% end %></ul>
+        <%% else %>
+          <p><%%= data.inspect %></p>
+        <%% end %>
+      <%% end %>
+    </div>
+  <%% end %>
+</div>

data/lib/generators/loam/install/templates/admin/dashboard_widgets_controller.rb

@@ -0,0 +1,23 @@
+module Admin
+  # Dashboard settings (Loam::DashboardWidget) — manager-only. Choose which
+  # registered widgets appear and in what order for this tenant.
+  class DashboardWidgetsController < BaseController
+    before_action { require_role!(:manager) }
+
+    def index
+      @registered = Loam::Widgets.registered
+      @config = Loam::DashboardWidget.all.index_by(&:widget_key)
+    end
+
+    def update
+      Loam::Widgets.keys.each do |key|
+        attrs = params.dig(:widgets, key) || {}
+        row = Loam::DashboardWidget.find_or_initialize_by(widget_key: key)
+        row.active = attrs[:active] == "1"
+        row.position = attrs[:position].to_i
+        row.save!
+      end
+      redirect_to admin_root_path, notice: "Dashboard updated."
+    end
+  end
+end

data/lib/generators/loam/install/templates/admin/dashboard_widgets_index.html.erb

@@ -0,0 +1,24 @@
+<h1>Dashboard settings</h1>
+
+<p>Choose which widgets appear on the dashboard and their order (lower position
+first). Leaving none active shows the default set.</p>
+
+<%%= form_with url: admin_dashboard_widgets_path, method: :patch do %>
+  <table>
+    <thead><tr><th>Show</th><th>Widget</th><th>Roles</th><th>Position</th></tr></thead>
+    <tbody>
+      <%% @registered.each do |widget| %>
+        <%% row = @config[widget.key] %>
+        <tr>
+          <td><%%= check_box_tag "widgets[#{widget.key}][active]", "1", row.nil? || row.active %></td>
+          <td><%%= widget.title %> <small>(<code><%%= widget.key %></code>)</small></td>
+          <td><%%= widget.roles ? Array(widget.roles).join(", ") : "all" %></td>
+          <td><%%= number_field_tag "widgets[#{widget.key}][position]", row&.position || 0, style: "width:4rem" %></td>
+        </tr>
+      <%% end %>
+    </tbody>
+  </table>
+  <%%= submit_tag "Save dashboard" %>
+<%% end %>
+
+<p><%%= link_to "Back to dashboard", admin_root_path %></p>

data/lib/generators/loam/install/templates/admin/dictionaries_controller.rb

@@ -0,0 +1,55 @@
+module Admin
+  # Managed lookup lists (Loam::Dictionary) — manager-only. The index lists a
+  # tenant's dictionaries; the edit screen curates a dictionary's entries
+  # (Admin::DictionaryEntriesController). Tenant-scoped by the model's default
+  # scope, so a manager only ever sees their own tenant's lists.
+  class DictionariesController < BaseController
+    before_action { require_role!(:manager) }
+    before_action :set_dictionary, only: %i[edit update destroy]
+
+    def index
+      @dictionaries = Loam::Dictionary.order(:key)
+    end
+
+    def new
+      @dictionary = Loam::Dictionary.new
+    end
+
+    def create
+      @dictionary = Loam::Dictionary.new(dictionary_params)
+      if @dictionary.save
+        redirect_to edit_admin_dictionary_path(@dictionary), notice: "Dictionary created — add its entries below."
+      else
+        render :new, status: :unprocessable_entity
+      end
+    end
+
+    def edit
+      @entry = @dictionary.entries.new(active: true)
+    end
+
+    def update
+      if @dictionary.update(dictionary_params)
+        redirect_to admin_dictionaries_path, notice: "Dictionary updated."
+      else
+        @entry = @dictionary.entries.new
+        render :edit, status: :unprocessable_entity
+      end
+    end
+
+    def destroy
+      @dictionary.destroy!
+      redirect_to admin_dictionaries_path, notice: "Dictionary deleted."
+    end
+
+    private
+
+    def set_dictionary
+      @dictionary = Loam::Dictionary.find(params[:id])
+    end
+
+    def dictionary_params
+      params.require(:dictionary).permit(:key, :name)
+    end
+  end
+end