open-loam 0.1.1 → 0.3.0

data/lib/{loam → open_loam}/searchable.rb

@@ -1,8 +1,8 @@
-module Loam
+module OpenLoam
   # Text search over an entity's own columns:
   #
-  #   class Equipment < Loam::TenantRecord
-  #     include Loam::Searchable
+  #   class Equipment < OpenLoam::TenantRecord
+  #     include OpenLoam::Searchable
   #     searchable_by :name, :status
   #   end
   #
@@ -12,19 +12,19 @@ module Loam
   # to remember: the default scope is already on it, and the result composes
   # with ordering, pagination and anything else.
   #
-  # HOW a query matches is a swappable driver (Loam::Search.driver): the default
+  # HOW a query matches is a swappable driver (OpenLoam::Search.driver): the default
   # LikeDriver is a substring LIKE; the TokenDriver is a portable word-level
   # index; an external engine is a third. This concern is only the DECLARATION
   # (`searchable_by`) and the untouched call site (`Model.search(q)`) — swapping
-  # the driver changes neither. See Loam::Search.
+  # the driver changes neither. See OpenLoam::Search.
   module Searchable
     extend ActiveSupport::Concern
 
     included do
-      class_attribute :loam_searchable_columns, default: [].freeze, instance_writer: false
+      class_attribute :open_loam_searchable_columns, default: [].freeze, instance_writer: false
 
       # Keep the active driver's index current. A no-op under the default
-      # LikeDriver; the TokenDriver maintains loam_search_tokens here. Guarded so
+      # LikeDriver; the TokenDriver maintains open_loam_search_tokens here. Guarded so
       # non-searchable models pay nothing, and skipped when no searchable column
       # actually changed — so a soft-delete (which touches only deleted_at)
       # leaves the tokens in place, and the base scope hides the row anyway.
@@ -33,8 +33,8 @@ module Loam
       # exercise the `searchable_by` DSL (its encrypted-field check), with no
       # ActiveRecord underneath — only a real model gets the callbacks.
       if respond_to?(:after_save)
-        after_save    :loam_update_search_index,     if: :loam_search_index_stale?
-        after_destroy :loam_remove_from_search_index, if: -> { self.class.loam_searchable? }
+        after_save    :open_loam_update_search_index,     if: :open_loam_search_index_stale?
+        after_destroy :open_loam_remove_from_search_index, if: -> { self.class.open_loam_searchable? }
       end
     end
 
@@ -45,24 +45,24 @@ module Loam
       def searchable_by(*columns)
         columns = columns.map(&:to_s)
 
-        # The mirror of Loam::Encryptable's check: an encrypted column is
+        # The mirror of OpenLoam::Encryptable's check: an encrypted column is
         # ciphertext at rest, which LIKE cannot match. Caught here when
         # `searchable_by` is the later declaration (encrypts catches the reverse).
-        if respond_to?(:loam_encrypted_attributes)
-          conflict = columns & loam_encrypted_attributes
+        if respond_to?(:open_loam_encrypted_attributes)
+          conflict = columns & open_loam_encrypted_attributes
           if conflict.any?
-            raise Loam::Error,
+            raise OpenLoam::Error,
                   "#{name}: cannot `searchable_by` encrypted field(s) #{conflict.join(', ')} — " \
                   "ciphertext cannot be LIKE-searched. Use `encrypts :field, searchable: true` " \
                   "for exact-match lookup instead."
           end
         end
 
-        self.loam_searchable_columns = columns.freeze
+        self.open_loam_searchable_columns = columns.freeze
       end
 
-      def loam_searchable?
-        loam_searchable_columns.any?
+      def open_loam_searchable?
+        open_loam_searchable_columns.any?
       end
 
       # Delegates to the active driver, handing it the current relation as the
@@ -70,21 +70,21 @@ module Loam
       # (a class method called on a relation runs with `all` == that relation).
       # A blank query returns everything: an empty search box means "no filter".
       def search(query)
-        Loam::Search.search(self, query, scope: all)
+        OpenLoam::Search.search(self, query, scope: all)
       end
     end
 
     private
 
-    def loam_update_search_index     = Loam::Search.index(self)
-    def loam_remove_from_search_index = Loam::Search.remove(self)
+    def open_loam_update_search_index     = OpenLoam::Search.index(self)
+    def open_loam_remove_from_search_index = OpenLoam::Search.remove(self)
 
     # On create every column counts as changed, so a new record is always
     # indexed; on update, reindex only when a searchable column actually moved.
-    def loam_search_index_stale?
-      return false unless self.class.loam_searchable?
+    def open_loam_search_index_stale?
+      return false unless self.class.open_loam_searchable?
 
-      saved_changes.keys.intersect?(self.class.loam_searchable_columns)
+      saved_changes.keys.intersect?(self.class.open_loam_searchable_columns)
     end
   end
 end

data/lib/{loam → open_loam}/soft_deletable.rb

@@ -1,7 +1,7 @@
-module Loam
+module OpenLoam
   # Soft-delete: destroying a business record hides it instead of erasing it.
   # A recycle bin — for GDPR retention, for undo, for audits that still read
-  # cleanly after the fact. Loam is "safe by default", so a soft-deleted record
+  # cleanly after the fact. OpenLoam is "safe by default", so a soft-deleted record
   # is EXCLUDED from every ordinary query; seeing it is something you opt INTO,
   # never a filter you must remember to add.
   #
@@ -34,19 +34,19 @@ module Loam
     end
 
     def soft_delete
-      loam_toggle_deleted(deleted: true, bang: false)
+      open_loam_toggle_deleted(deleted: true, bang: false)
     end
 
     def soft_delete!
-      loam_toggle_deleted(deleted: true, bang: true)
+      open_loam_toggle_deleted(deleted: true, bang: true)
     end
 
     def restore
-      loam_toggle_deleted(deleted: false, bang: false)
+      open_loam_toggle_deleted(deleted: false, bang: false)
     end
 
     def restore!
-      loam_toggle_deleted(deleted: false, bang: true)
+      open_loam_toggle_deleted(deleted: false, bang: true)
     end
 
     private
@@ -55,18 +55,18 @@ module Loam
     # record to the state it is already in (a double-clicked button) is a no-op,
     # so the trail never fills with deleted_at -> deleted_at noise.
     #
-    # A soft-delete is an UPDATE, so Loam::Auditable's after_destroy never fires
+    # A soft-delete is an UPDATE, so OpenLoam::Auditable's after_destroy never fires
     # for it. Rather than write our own audit row we borrow Auditable's single
-    # audit path via `loam_audit_as`, which relabels this save's audit
+    # audit path via `open_loam_audit_as`, which relabels this save's audit
     # "soft_delete"/"restore" instead of the "update" it would otherwise record.
-    def loam_toggle_deleted(deleted:, bang:)
+    def open_loam_toggle_deleted(deleted:, bang:)
       return true if deleted == deleted?
 
       self.deleted_at = deleted ? Time.current : nil
       action = deleted ? "soft_delete" : "restore"
       write = -> { bang ? save! : save }
 
-      respond_to?(:loam_audit_as, true) ? loam_audit_as(action, &write) : write.call
+      respond_to?(:open_loam_audit_as, true) ? open_loam_audit_as(action, &write) : write.call
     end
   end
 end

data/lib/{loam → open_loam}/sso/claims.rb

@@ -1,4 +1,4 @@
-module Loam
+module OpenLoam
   module Sso
     # Normalized identity claims, protocol-independent. Every provider's
     # `exchange` returns one of these so the rest of the flow never knows whether

data/lib/{loam → open_loam}/sso/fake_provider.rb

@@ -1,6 +1,6 @@
 require "base64"
 
-module Loam
+module OpenLoam
   module Sso
     # An OFFLINE stand-in for a real IdP — for the demo and the test suite ONLY,
     # NEVER production. `authorization_url` loops straight back to our own

data/lib/open_loam/sso/http_client.rb

@@ -0,0 +1,51 @@
+require "net/http"
+require "json"
+
+module OpenLoam
+  module Sso
+    # The one place SSO talks to the network — kept tiny and isolated so the rest
+    # of the flow is pure. Only OpenLoam::Sso::OidcProvider uses it, and the test
+    # suite injects a FakeProvider instead, so this is never exercised offline.
+    module HttpClient
+      module_function
+
+      def get_json(url, bearer: nil)
+        uri, address = checked(url)
+        request = Net::HTTP::Get.new(uri)
+        request["Authorization"] = "Bearer #{bearer}" if bearer
+        parse(perform(uri, address, request))
+      end
+
+      def post_form(url, params)
+        uri, address = checked(url)
+        request = Net::HTTP::Post.new(uri)
+        request.set_form_data(params)
+        request["Accept"] = "application/json"
+        parse(perform(uri, address, request))
+      end
+
+      # The issuer is typed by a tenant manager, so these URLs are as untrusted
+      # as a webhook endpoint's. https is mandatory here rather than merely
+      # allowed: the client_secret and the code exchange travel over it.
+      def checked(url)
+        OpenLoam::OutboundUrl.resolve!(url, require_https: true)
+      rescue OpenLoam::OutboundUrl::BlockedError => error
+        raise OpenLoam::Sso::Error, "identity provider URL refused: #{error.message}"
+      end
+
+      def perform(uri, address, request)
+        Net::HTTP.start(uri.host, uri.port, use_ssl: true, ipaddr: address) do |http|
+          http.request(request)
+        end
+      end
+
+      def parse(response)
+        unless response.is_a?(Net::HTTPSuccess)
+          raise OpenLoam::Sso::Error, "identity provider returned #{response.code}"
+        end
+
+        JSON.parse(response.body)
+      end
+    end
+  end
+end

data/lib/{loam → open_loam}/sso/oidc_provider.rb

@@ -1,4 +1,4 @@
-module Loam
+module OpenLoam
   module Sso
     # The real OIDC Authorization Code provider. Discovers the issuer's endpoints
     # from its .well-known document, sends the user to the authorization endpoint,
@@ -13,7 +13,7 @@ module Loam
     # JWKS verification for the prototype. Roadmap: full id_token + JWKS.
     #
     # NOT exercised by the test suite (a FakeProvider is injected via
-    # Loam::Sso.builder); live OIDC against a real IdP is verified manually.
+    # OpenLoam::Sso.builder); live OIDC against a real IdP is verified manually.
     class OidcProvider
       SCOPE = "openid email profile".freeze
 

data/lib/{loam → open_loam}/sso.rb

@@ -1,25 +1,25 @@
-require "loam/sso/claims"
-require "loam/sso/http_client"
-require "loam/sso/oidc_provider"
-require "loam/sso/fake_provider"
+require "open_loam/sso/claims"
+require "open_loam/sso/http_client"
+require "open_loam/sso/oidc_provider"
+require "open_loam/sso/fake_provider"
 
-module Loam
+module OpenLoam
   # Single sign-on. SHIPPED: OIDC Authorization Code flow end-to-end —
   # home-realm discovery by email domain, just-in-time user provisioning, IdP
   # group -> role mapping, and account linking to an existing User. SEAMS
   # (documented, not built): SAML (another protocol behind the same interface,
   # raises NotImplementedError until implemented) and SCIM 2.0 provisioning
-  # (see docs/_foundation/overview.md). See Loam::SsoProvider for the per-tenant config.
+  # (see docs/_foundation/overview.md). See OpenLoam::SsoProvider for the per-tenant config.
   #
   # A protocol provider implements two methods:
   #   authorization_url(state:, login_hint: nil) -> the IdP URL to redirect to
-  #   exchange(code:)                             -> Loam::Sso::Claims
+  #   exchange(code:)                             -> OpenLoam::Sso::Claims
   #
   # The provider is built through a swappable `builder` so tests and the demo
-  # inject a FakeProvider and NOTHING touches the network. Loam::Sso::OidcProvider
+  # inject a FakeProvider and NOTHING touches the network. OpenLoam::Sso::OidcProvider
   # is the real one; it is never constructed in the test suite.
   module Sso
-    class Error < Loam::Error; end
+    class Error < OpenLoam::Error; end
 
     # The identity provider did not assert a verified email. Linking or creating
     # an account on an unverified email is an account-takeover vector, so the
@@ -32,6 +32,11 @@ module Loam
     # (cross-domain account takeover), so the flow refuses it.
     class DomainMismatchError < Error; end
 
+    # The provider has not proven it owns its `domain`, so it may not adopt an
+    # existing account. Ownership is stamped out of band by an operator
+    # (rake open_loam:sso:verify_domain).
+    class UnverifiedDomainError < Error; end
+
     class << self
       attr_writer :builder
 
@@ -39,7 +44,7 @@ module Loam
         @builder ||= method(:default_builder)
       end
 
-      # Wrap a Loam::SsoProvider record in its protocol provider.
+      # Wrap a OpenLoam::SsoProvider record in its protocol provider.
       def build(record, redirect_uri:)
         builder.call(record, redirect_uri)
       end
@@ -50,25 +55,28 @@ module Loam
           OidcProvider.new(record, redirect_uri: redirect_uri)
         when "saml"
           raise NotImplementedError,
-                "SAML SSO is a documented seam — implement Loam::Sso::SamlProvider behind this interface."
+                "SAML SSO is a documented seam — implement OpenLoam::Sso::SamlProvider behind this interface."
         else
           raise Error, "Unsupported SSO protocol: #{record.protocol.inspect}"
         end
       end
 
       # Home-realm discovery. THE blessed cross-tenant lookup for SSO (like
-      # Loam::Membership.tenants_for): "which tenant's IdP owns this email
+      # OpenLoam::Membership.tenants_for): "which tenant's IdP owns this email
       # domain?" is asked at the sign-in page, before any tenant is chosen, so it
       # reaches across tenants via `unscoped` — something host code must never do.
+      #
+      # Verified providers only: the domain is manager-typed, so an unverified
+      # claim would capture every sign-in on a domain the tenant does not own.
       def provider_for(email:)
         domain = email.to_s.split("@").last.to_s.strip.downcase
         return nil if domain.blank?
 
-        Loam::SsoProvider.unscoped.where(domain: domain, active: true).first
+        OpenLoam::SsoProvider.unscoped.domain_verified.where(domain: domain, active: true).first
       end
 
       # Resolve verified IdP claims to a signed-in User, in the provider's tenant.
-      # MUST be called inside Loam.as_tenant(provider.tenant). Order matters:
+      # MUST be called inside OpenLoam.as_tenant(provider.tenant). Order matters:
       # match the durable (provider, sub) identity first, then an existing User by
       # verified email (link), else just-in-time create — always with a tenant
       # membership at the mapped role.
@@ -86,13 +94,13 @@ module Loam
 
         # Resolve the user: the durable (provider, sub) identity first, then an
         # existing User by verified email (link), else just-in-time create.
-        identity = Loam::SsoIdentity.find_by(sso_provider_id: provider.id, sub: claims.sub)
-        user = identity&.user || User.find_by(email: claims.email) || jit_create_user(claims)
+        identity = OpenLoam::SsoIdentity.find_by(sso_provider_id: provider.id, sub: claims.sub)
+        user = identity&.user || link_or_create_user(provider, claims)
 
         # Re-map claims -> role on EVERY login (including a returning identity),
         # so an IdP role change takes effect.
         ensure_membership(provider, user, claims)
-        Loam::SsoIdentity.create!(user: user, sso_provider: provider, sub: claims.sub) unless identity
+        OpenLoam::SsoIdentity.create!(user: user, sso_provider: provider, sub: claims.sub) unless identity
         user
       end
 
@@ -106,6 +114,19 @@ module Loam
 
       private
 
+      # `User` is global, so linking adopts an account this tenant did not create
+      # — allowed only once the provider proved it owns the domain. JIT-creating
+      # needs no proof: the new user lands in the claimant's own tenant.
+      def link_or_create_user(provider, claims)
+        existing = User.find_by(email: claims.email)
+        return jit_create_user(claims) if existing.nil?
+        return existing if provider.domain_verified?
+
+        raise UnverifiedDomainError,
+              "provider for #{provider.domain.inspect} has not proven it owns that domain — " \
+              "refusing to link the existing account #{claims.email.inspect}"
+      end
+
       def jit_create_user(claims)
         # SSO users authenticate at the IdP; the random password satisfies
         # has_secure_password and is unguessable, never used to log in.
@@ -120,7 +141,7 @@ module Loam
       # (a promotion reflects, a removed group downgrades) rather than freezing
       # at whatever the role was when the membership was first created.
       def ensure_membership(provider, user, claims)
-        membership = Loam::Membership.find_or_initialize_by(user_id: user.id)
+        membership = OpenLoam::Membership.find_or_initialize_by(user_id: user.id)
         membership.role = role_for(provider, claims)
         membership.save!
       end

data/lib/{loam → open_loam}/telemetry.rb

@@ -1,16 +1,16 @@
-module Loam
+module OpenLoam
   # A dependency-free observability seam (L-712). Wrap a unit of work in a span;
   # by default it emits an `ActiveSupport::Notifications` event
-  # ("loam.span.<name>") carrying the attributes and duration, so ANY subscriber
+  # ("open_loam.span.<name>") carrying the attributes and duration, so ANY subscriber
   # — an OpenTelemetry bridge, StatsD, a log line — picks it up with no hard
-  # dependency on Loam's side. An app that wants real OTLP spans replaces the
+  # dependency on OpenLoam's side. An app that wants real OTLP spans replaces the
   # whole strategy:
   #
-  #   Loam::Telemetry.backend = ->(name, attributes, work) do
+  #   OpenLoam::Telemetry.backend = ->(name, attributes, work) do
   #     Tracer.in_span(name, attributes: attributes) { work.call }
   #   end
   #
-  # Loam instruments its async/background hot paths (scheduler tick, durable
+  # OpenLoam instruments its async/background hot paths (scheduler tick, durable
   # event delivery, inbound webhook ingest) so an operator sees them without
   # wiring anything per-call.
   module Telemetry
@@ -24,7 +24,7 @@ module Loam
       if backend
         backend.call(name.to_s, attributes, block)
       else
-        ActiveSupport::Notifications.instrument("loam.span.#{name}", **attributes, &block)
+        ActiveSupport::Notifications.instrument("open_loam.span.#{name}", **attributes, &block)
       end
     end
 

data/lib/{loam → open_loam}/tenant_record.rb

@@ -1,8 +1,8 @@
-module Loam
+module OpenLoam
   # Base class for every tenant-scoped model. Inheriting from it is what makes
-  # a model a "Loam entity":
+  # a model a "OpenLoam entity":
   #
-  #   * every query is scoped to Loam::Current.tenant via default_scope
+  #   * every query is scoped to OpenLoam::Current.tenant via default_scope
   #   * building/creating a record assigns the current tenant automatically
   #   * touching the model with NO tenant in context raises MissingTenantError
   #
@@ -12,24 +12,24 @@ module Loam
   class TenantRecord < ActiveRecord::Base
     self.abstract_class = true
 
-    # Generates the key when it is not an integer (see Loam::GeneratedKey).
-    include Loam::GeneratedKey
+    # Generates the key when it is not an integer (see OpenLoam::GeneratedKey).
+    include OpenLoam::GeneratedKey
 
-    belongs_to :tenant, class_name: "Loam::Tenant"
+    belongs_to :tenant, class_name: "OpenLoam::Tenant"
 
-    default_scope { where(tenant_id: Loam.tenant!.id) }
+    default_scope { where(tenant_id: OpenLoam.tenant!.id) }
 
     validates :tenant_id, presence: true
 
     before_validation on: :create do
-      self.tenant_id ||= Loam.tenant!.id
+      self.tenant_id ||= OpenLoam.tenant!.id
     end
 
     # Guardrail for writes: a record can never be saved into a foreign tenant.
     before_save do
-      if tenant_id != Loam.tenant!.id
+      if tenant_id != OpenLoam.tenant!.id
         raise MissingTenantError, "Attempted to write #{self.class.name} into tenant #{tenant_id} " \
-                                  "while Loam::Current.tenant is #{Loam.tenant!.id}"
+                                  "while OpenLoam::Current.tenant is #{OpenLoam.tenant!.id}"
       end
     end
   end

data/lib/{loam → open_loam}/test_helpers.rb

@@ -1,15 +1,15 @@
-module Loam
+module OpenLoam
   # Mixed into ActiveSupport::TestCase by the install generator.
   module TestHelpers
     extend ActiveSupport::Concern
 
     included do
-      setup { Loam::Current.reset }
-      teardown { Loam::Current.reset }
+      setup { OpenLoam::Current.reset }
+      teardown { OpenLoam::Current.reset }
     end
 
     def with_tenant(tenant, actor: nil, &block)
-      Loam.as_tenant(tenant, actor: actor, &block)
+      OpenLoam.as_tenant(tenant, actor: actor, &block)
     end
   end
 end

data/lib/{loam → open_loam}/totp.rb

@@ -3,7 +3,7 @@ require "securerandom"
 require "uri"
 require "erb"
 
-module Loam
+module OpenLoam
   # RFC 6238 time-based one-time passwords — the shipped second factor.
   # HMAC-SHA1, 30-second step, 6 digits, ±1 step of drift tolerance (so a code
   # entered a few seconds either side of a boundary still verifies). Hand-rolled
@@ -17,7 +17,7 @@ module Loam
     # A fresh random secret, base32-encoded for authenticator apps. 20 bytes
     # (160 bits) is the RFC-recommended size for SHA1.
     def self.generate_secret(bytes: 20)
-      Loam::Base32.encode(SecureRandom.random_bytes(bytes))
+      OpenLoam::Base32.encode(SecureRandom.random_bytes(bytes))
     end
 
     # True if `code` is valid for `secret` right now.
@@ -44,7 +44,7 @@ module Loam
 
     # The HOTP code for a given step counter (RFC 4226 dynamic truncation).
     def self.code_at(secret, counter, digits: DIGITS)
-      hmac = OpenSSL::HMAC.digest("SHA1", Loam::Base32.decode(secret), [counter].pack("Q>"))
+      hmac = OpenSSL::HMAC.digest("SHA1", OpenLoam::Base32.decode(secret), [counter].pack("Q>"))
       offset = hmac.bytes.last & 0x0f
       truncated = hmac[offset, 4].unpack1("N") & 0x7fffffff
       (truncated % (10**digits)).to_s.rjust(digits, "0")

data/lib/{loam → open_loam}/translatable.rb

@@ -1,32 +1,32 @@
-module Loam
+module OpenLoam
   # Per-record, per-locale translations of DATA fields — a product name, a
   # category label — distinct from Rails i18n (developer UI strings, still
   # Rails-native and out of scope here).
   #
-  #   class Equipment < Loam::TenantRecord
-  #     include Loam::Translatable
+  #   class Equipment < OpenLoam::TenantRecord
+  #     include OpenLoam::Translatable
   #     translates :name, :description
   #   end
   #
   # READ OVERLAY: the field reader returns the translation for the CURRENT locale
-  # (Loam.locale) when one exists, else the record's own COLUMN value — the base
+  # (OpenLoam.locale) when one exists, else the record's own COLUMN value — the base
   # is the fallback and stays authoritative for the default locale:
   #
-  #   equipment.name                  # => overlay for Loam.locale, else base
+  #   equipment.name                  # => overlay for OpenLoam.locale, else base
   #   equipment.name(locale: "de")    # => explicit locale, else base
   #   equipment.set_translation(:name, "de", "Bagger")
   #   equipment.translations_for(:name)  # => { "de" => "Bagger", ... }
   #
   # Writes still go through the ordinary `name=` writer to the base column, so
-  # translations are purely additive rows in loam_translations — the base value
+  # translations are purely additive rows in open_loam_translations — the base value
   # is never overwritten or lost.
   module Translatable
     extend ActiveSupport::Concern
 
     included do
-      class_attribute :loam_translatable_attributes, default: [].freeze, instance_writer: false
+      class_attribute :open_loam_translatable_attributes, default: [].freeze, instance_writer: false
 
-      has_many :loam_translations, class_name: "Loam::Translation",
+      has_many :open_loam_translations, class_name: "OpenLoam::Translation",
                as: :translatable, dependent: :delete_all
     end
 
@@ -35,54 +35,54 @@ module Loam
         names = names.map(&:to_s)
 
         # An encrypted field must NOT be translatable: a translation row would
-        # store its PLAINTEXT in loam_translations, recreating exactly the leak
-        # Loam::Encryptable closes (same posture as searchable_by's refusal).
-        if respond_to?(:loam_encrypted_attributes)
-          conflict = names & loam_encrypted_attributes
+        # store its PLAINTEXT in open_loam_translations, recreating exactly the leak
+        # OpenLoam::Encryptable closes (same posture as searchable_by's refusal).
+        if respond_to?(:open_loam_encrypted_attributes)
+          conflict = names & open_loam_encrypted_attributes
           if conflict.any?
-            raise Loam::Error,
+            raise OpenLoam::Error,
                   "#{name}: cannot `translates` encrypted field(s) #{conflict.join(', ')} — " \
                   "a translation would store plaintext. Encrypted data is not translatable."
           end
         end
 
-        self.loam_translatable_attributes = (loam_translatable_attributes + names).freeze
+        self.open_loam_translatable_attributes = (open_loam_translatable_attributes + names).freeze
 
         names.each do |field|
           # The overlay reader. `read_attribute` (not super) is the base value,
           # so it works regardless of AR's lazy attribute-method definition.
           define_method(field) do |locale: nil|
-            loam_translation_value(field, locale) || read_attribute(field)
+            open_loam_translation_value(field, locale) || read_attribute(field)
           end
         end
       end
 
-      def loam_translatable?(field)
-        loam_translatable_attributes.include?(field.to_s)
+      def open_loam_translatable?(field)
+        open_loam_translatable_attributes.include?(field.to_s)
       end
     end
 
     # The stored translation for a field in a locale (default: the current one),
     # or nil when there is none.
-    def loam_translation_value(field, locale = nil)
-      locale = (locale || Loam.locale).to_s
+    def open_loam_translation_value(field, locale = nil)
+      locale = (locale || OpenLoam.locale).to_s
       return nil if locale.blank?
 
-      loam_translations.detect { |t| t.field == field.to_s && t.locale == locale }&.value
+      open_loam_translations.detect { |t| t.field == field.to_s && t.locale == locale }&.value
     end
 
     def set_translation(field, locale, value)
-      raise Loam::Error, "#{field} is not translatable on #{self.class.name}" unless self.class.loam_translatable?(field)
+      raise OpenLoam::Error, "#{field} is not translatable on #{self.class.name}" unless self.class.open_loam_translatable?(field)
 
-      row = loam_translations.find_or_initialize_by(field: field.to_s, locale: locale.to_s)
+      row = open_loam_translations.find_or_initialize_by(field: field.to_s, locale: locale.to_s)
       row.value = value
       row.save!
-      loam_translations.reset
+      open_loam_translations.reset
       value
     end
 
     def translations_for(field)
-      loam_translations.select { |t| t.field == field.to_s }.to_h { |t| [ t.locale, t.value ] }
+      open_loam_translations.select { |t| t.field == field.to_s }.to_h { |t| [ t.locale, t.value ] }
     end
   end
 end