open-loam 0.1.1 → 0.3.0

data/app/models/{loam → open_loam}/pending_action.rb

@@ -1,21 +1,21 @@
-module Loam
+module OpenLoam
   # A staged mutation awaiting human approval. When a caller runs under
-  # confirm-mode (an MCP tool acting for an AI agent — see Loam.mutation_mode), a
+  # confirm-mode (an MCP tool acting for an AI agent — see OpenLoam.mutation_mode), a
   # write is staged HERE as a preview instead of committing; a manager approves
-  # or rejects, and only approval executes it. This is Loam's thesis made
+  # or rejects, and only approval executes it. This is OpenLoam's thesis made
   # concrete: agent-triggered writes are gate-able.
   #
-  # The approval gate IS a workflow (Loam::Workflow): pending → (manager) approve
+  # The approval gate IS a workflow (OpenLoam::Workflow): pending → (manager) approve
   # / reject → executed / failed. "Who may approve" lives in one declarative,
-  # role-gated place. The proposed changes are encrypted at rest (Loam::Encryptable),
+  # role-gated place. The proposed changes are encrypted at rest (OpenLoam::Encryptable),
   # because a staged change to an encrypted target field would otherwise sit here
   # — and in this row's own audit — as plaintext, reopening the leak L-901 closed.
-  class PendingAction < Loam::TenantRecord
-    self.table_name = "loam_pending_actions"
+  class PendingAction < OpenLoam::TenantRecord
+    self.table_name = "open_loam_pending_actions"
 
-    include Loam::Auditable
-    include Loam::Encryptable
-    include Loam::Workflow
+    include OpenLoam::Auditable
+    include OpenLoam::Encryptable
+    include OpenLoam::Workflow
 
     belongs_to :actor, class_name: "User", optional: true
     belongs_to :reviewer, class_name: "User", foreign_key: :reviewed_by_id, optional: true
@@ -96,7 +96,7 @@ module Loam
     # write; the record ends "executed" or "failed". Executes as `by`, so the
     # TARGET's audit names the approving human — the person owns the change.
     def approve!(by:)
-      Loam.as_tenant(tenant, actor: by) do
+      OpenLoam.as_tenant(tenant, actor: by) do
         reject_self_approval!(by)
         self.reviewed_by_id = by.id
         self.reviewed_at = Time.current
@@ -107,7 +107,7 @@ module Loam
     end
 
     def reject!(by:, reason: nil)
-      Loam.as_tenant(tenant, actor: by) do
+      OpenLoam.as_tenant(tenant, actor: by) do
         self.reviewed_by_id = by.id
         self.reviewed_at = Time.current
         self.result = [ "rejected", reason.presence ].compact.join(": ")
@@ -126,9 +126,9 @@ module Loam
     # withdrawal, not a segregation-of-duties concern.)
     def reject_self_approval!(by)
       return unless by.id == actor_id
-      return if Loam::Configs.get("approvals.allow_self_approve", default: false)
+      return if OpenLoam::Configs.get("approvals.allow_self_approve", default: false)
 
-      raise Loam::NotAuthorizedError, "self-approval is not permitted; a different person must approve this change"
+      raise OpenLoam::NotAuthorizedError, "self-approval is not permitted; a different person must approve this change"
     end
 
     # Execution AND its status/result recording share ONE transaction with the
@@ -150,25 +150,69 @@ module Loam
       update!(error: error.message)
     end
 
+    # Never settable through a staged change: soft-delete state has its own
+    # audited action (and its own policy question), and the rest is plumbing.
+    PROTECTED_FIELDS = %w[id tenant_id deleted_at lock_version].freeze
+
     def execute_change!
       case action_type
       when "create"
-        record = target_class.create!(changeset)
+        record = target_class.new
+        authorize_action!(record, :create?)
+        record.assign_attributes(permitted_changeset(record))
+        record.save!
         "created #{target_type}##{record.id}"
       when "update"
-        target_class.find(target_id).update!(changeset)
+        record = target_class.find(target_id)
+        authorize_action!(record, :update?)
+        record.update!(permitted_changeset(record))
         "updated #{target_type}##{target_id}"
       when "destroy"
         target = target_class.find(target_id)
+        authorize_action!(target, :destroy?)
         target.respond_to?(:soft_delete!) ? target.soft_delete! : target.destroy!
         "deleted #{target_type}##{target_id}"
       else
-        raise Loam::Error, "unknown action_type #{action_type.inspect}"
+        raise OpenLoam::Error, "unknown action_type #{action_type.inspect}"
       end
     end
 
+    # The field rules below are not the whole policy: a host may restrict the
+    # ACTION itself (destroy? to an owner, say). Staging must not route around
+    # that, so the approver's verdict on the action is asked first.
+    def authorize_action!(record, question)
+      return if OpenLoam::Policy.for(record).public_send(question)
+
+      raise OpenLoam::NotAuthorizedError,
+            "the approver may not #{question.to_s.chomp('?')} #{target_type}"
+    end
+
+    # target_type is a string off a stored row, so it gets the same treatment as
+    # any other type resolution from untrusted input. The TenantRecord check is
+    # the load-bearing half: a non-tenant-scoped target (User, say) has no
+    # default scope, which would turn approval into a cross-tenant write.
     def target_class
-      target_type.constantize
+      klass = target_type.to_s.safe_constantize
+      unless klass.is_a?(Class) && klass < OpenLoam::TenantRecord
+        raise OpenLoam::Error, "#{target_type.inspect} is not a tenant-scoped model — refusing to apply a staged change"
+      end
+
+      klass
+    end
+
+    # Staging is deliberately ungated ("propose" is not "apply"), so approval is
+    # where authority is spent and the APPROVER's field rules are what bind —
+    # otherwise staging routes around every one of them. Refusals raise rather
+    # than drop, so the proposal fails visibly instead of applying a lesser change.
+    def permitted_changeset(record)
+      blocked = changeset.keys & PROTECTED_FIELDS
+      raise OpenLoam::Error, "a staged change may not set #{blocked.join(', ')}" if blocked.any?
+
+      policy = OpenLoam::Policy.for(record)
+      refused = changeset.keys - policy.permitted_fields(changeset.keys).map(&:to_s)
+      raise OpenLoam::NotAuthorizedError, "the approver may not write #{refused.join(', ')}" if refused.any?
+
+      changeset
     end
 
     def load_target
@@ -178,31 +222,31 @@ module Loam
     end
 
     def encrypted_target_fields
-      return [] unless target_class.respond_to?(:loam_encrypted_attributes)
+      return [] unless target_class.respond_to?(:open_loam_encrypted_attributes)
 
-      target_class.loam_encrypted_attributes.map(&:to_s)
+      target_class.open_loam_encrypted_attributes.map(&:to_s)
     end
 
     # Set while a workflow transition is performing its save, so the validation
     # below can tell a legitimate status move from a direct assignment.
-    def loam_perform_transition!(transition)
-      @loam_status_via_transition = true
+    def open_loam_perform_transition!(transition)
+      @open_loam_status_via_transition = true
       super
     ensure
-      @loam_status_via_transition = false
+      @open_loam_status_via_transition = false
     end
 
     def status_changes_only_through_a_transition
       return unless will_save_change_to_status?
-      return if @loam_status_via_transition
+      return if @open_loam_status_via_transition
 
       errors.add(:status, "may only change through an approval transition (approve!/reject!), not a direct write")
     end
 
     def status_starts_at_the_initial_state
-      return if status == self.class.loam_workflow.initial
+      return if status == self.class.open_loam_workflow.initial
 
-      errors.add(:status, "must start at #{self.class.loam_workflow.initial.inspect} — a staged action begins pending")
+      errors.add(:status, "must start at #{self.class.open_loam_workflow.initial.inspect} — a staged action begins pending")
     end
   end
 end

data/app/models/{loam → open_loam}/perspective.rb

@@ -1,4 +1,4 @@
-module Loam
+module OpenLoam
   # A saved view of an entity's admin index — which columns show, active filters,
   # sort, and page size — that a user can name, make their default, or share.
   #
@@ -7,15 +7,15 @@ module Loam
   #   * "role"    — everyone with the named membership role in the tenant.
   #   * "tenant"  — everyone in the tenant.
   # A private view is invisible to others by construction (see
-  # Loam::Perspectives.visible_to), not merely by a permission check.
+  # OpenLoam::Perspectives.visible_to), not merely by a permission check.
   #
   # Tenant-scoped like everything else, and audited. Optimistic-locked
   # (lock_version) so two people editing a shared view don't silently clobber
   # each other — the admin controller rescues ActiveRecord::StaleObjectError.
-  class Perspective < Loam::TenantRecord
-    self.table_name = "loam_perspectives"
+  class Perspective < OpenLoam::TenantRecord
+    self.table_name = "open_loam_perspectives"
 
-    include Loam::Auditable
+    include OpenLoam::Auditable
 
     VISIBILITIES = %w[private role tenant].freeze
 

data/app/models/{loam → open_loam}/progress_job.rb

@@ -1,4 +1,4 @@
-module Loam
+module OpenLoam
   # Progress of a long-running job (a bulk import, a reindex, a report) so the
   # admin can watch it live instead of guessing. Tenant-scoped; a job started in
   # one tenant is only visible and streamable there.
@@ -7,11 +7,11 @@ module Loam
   # ticks) and the audit trail would fill with noise. The terminal status and
   # any error are captured on the row itself, which is the summary that matters.
   #
-  # Each meaningful change publishes `loam.progress.updated` (broadcastable → SSE)
-  # carrying only id/percent/status — no record contents. See Loam::Progress for
+  # Each meaningful change publishes `open_loam.progress.updated` (broadcastable → SSE)
+  # carrying only id/percent/status — no record contents. See OpenLoam::Progress for
   # the entry point.
-  class ProgressJob < Loam::TenantRecord
-    self.table_name = "loam_progress_jobs"
+  class ProgressJob < OpenLoam::TenantRecord
+    self.table_name = "open_loam_progress_jobs"
 
     STATUSES = %w[running completed failed cancelled].freeze
     STALE_AFTER = 5.minutes
@@ -93,11 +93,11 @@ module Loam
       self
     end
 
-    # Only ever id/percent/status leave the server (Loam::Events stamps tenant_id
+    # Only ever id/percent/status leave the server (OpenLoam::Events stamps tenant_id
     # for the SSE deliverable filter; the frame's safe_payload drops everything
     # else).
     def broadcast
-      Loam::Events.publish("loam.progress.updated", id: id, percent: percent, status: status)
+      OpenLoam::Events.publish("open_loam.progress.updated", id: id, percent: percent, status: status)
     end
   end
 end

data/app/models/{loam → open_loam}/record_lock.rb

@@ -1,12 +1,12 @@
-module Loam
+module OpenLoam
   # An advisory "someone is editing this" lock on a record — the COURTESY layer.
   # The real guarantee against a silent clobber is optimistic locking
-  # (lock_version, see Loam::RecordLocks docs); this only warns the second
+  # (lock_version, see OpenLoam::RecordLocks docs); this only warns the second
   # editor. One lock per record, with a TTL: an expired lock is treated as free,
   # and re-acquiring as the same holder extends it (a heartbeat). Plumbing, so
-  # not audited — like Loam::ApiToken.
-  class RecordLock < Loam::TenantRecord
-    self.table_name = "loam_record_locks"
+  # not audited — like OpenLoam::ApiToken.
+  class RecordLock < OpenLoam::TenantRecord
+    self.table_name = "open_loam_record_locks"
 
     belongs_to :locked_by, class_name: "User"
 

data/app/models/{loam → open_loam}/scheduled_job.rb

@@ -1,16 +1,16 @@
-module Loam
+module OpenLoam
   # A recurring job that runs on a schedule (cron or interval). Tenant-scoped:
   # a "tenant"-scope schedule enqueues its job in this tenant on schedule; a
   # "system"-scope schedule enqueues once with no tenant context. Audited on
   # config changes (not per run — runs are tracked by last_run_at/next_run_at).
   #
   # SECURITY: job_class is validated to be a known ActiveJob (see
-  # Loam::Scheduler.resolve_job_class) at save AND at enqueue — a scheduler that
+  # OpenLoam::Scheduler.resolve_job_class) at save AND at enqueue — a scheduler that
   # constantized and ran arbitrary user input would be a code-execution hole.
-  class ScheduledJob < Loam::TenantRecord
-    self.table_name = "loam_scheduled_jobs"
+  class ScheduledJob < OpenLoam::TenantRecord
+    self.table_name = "open_loam_scheduled_jobs"
 
-    include Loam::Auditable
+    include OpenLoam::Auditable
 
     SCOPES = %w[tenant system].freeze
     LOCK_TTL = 5.minutes    # how long a claim holds a due job before another tick may retry it
@@ -26,11 +26,11 @@ module Loam
     # The next fire time strictly after `from`, in this job's timezone (UTC when
     # unset). Stored in next_run_at as UTC.
     def compute_next_run(from = Time.current)
-      Loam::Cron.next_after(schedule, from: from, zone: timezone.presence || "UTC")
+      OpenLoam::Cron.next_after(schedule, from: from, zone: timezone.presence || "UTC")
     end
 
     def job_class_constant
-      Loam::Scheduler.resolve_job_class(job_class)
+      OpenLoam::Scheduler.resolve_job_class(job_class)
     end
 
     private

data/app/models/open_loam/search_token.rb

@@ -0,0 +1,9 @@
+module OpenLoam
+  # The word-level search index maintained by OpenLoam::Search::TokenDriver: one row
+  # per (record, token), tenant-scoped like every OpenLoam entity. Plumbing — not
+  # audited, not soft-deletable. Only the TokenDriver reads or writes it; under
+  # the default LikeDriver this table simply stays empty.
+  class SearchToken < OpenLoam::TenantRecord
+    self.table_name = "open_loam_search_tokens"
+  end
+end

data/app/models/{loam → open_loam}/sso_identity.rb

@@ -1,12 +1,12 @@
-module Loam
+module OpenLoam
   # Links an external IdP identity (a provider's stable `sub`) to a local User.
   # The durable key SSO callbacks resolve on — an email can change at the IdP,
   # `sub` does not. Tenant-scoped (created and read inside the provider's tenant).
-  class SsoIdentity < Loam::TenantRecord
-    self.table_name = "loam_sso_identities"
+  class SsoIdentity < OpenLoam::TenantRecord
+    self.table_name = "open_loam_sso_identities"
 
     belongs_to :user
-    belongs_to :sso_provider, class_name: "Loam::SsoProvider"
+    belongs_to :sso_provider, class_name: "OpenLoam::SsoProvider"
 
     validates :sub, presence: true, uniqueness: { scope: :sso_provider_id }
   end

data/app/models/open_loam/sso_provider.rb

@@ -0,0 +1,66 @@
+module OpenLoam
+  # A tenant's connection to an external identity provider (OIDC). Per-tenant
+  # config: each tenant/org wires its OWN IdP, so the client_secret is encrypted
+  # under the tenant key (the default Encryptable scope) — unlike MFA, which is
+  # user-keyed. Home-realm discovery matches an email `domain` to the owning
+  # provider at the sign-in page (see OpenLoam::Sso.provider_for).
+  class SsoProvider < OpenLoam::TenantRecord
+    self.table_name = "open_loam_sso_providers"
+
+    include OpenLoam::Auditable      # config changes are audited; the secret is redacted
+    include OpenLoam::Encryptable
+
+    # Tenant-scoped key (default): SSO config belongs to the tenant, and the
+    # secret is only ever read inside that tenant's context on callback.
+    encrypts :client_secret
+
+    has_many :identities, class_name: "OpenLoam::SsoIdentity",
+             foreign_key: :sso_provider_id, dependent: :delete_all
+
+    validates :name, :protocol, :domain, :jit_role, presence: true
+    # Globally unique so HRD resolves exactly one owning IdP per domain. Rails'
+    # uniqueness validator queries WITHOUT the default tenant scope, so this
+    # catches a collision across tenants too.
+    validates :domain, uniqueness: true
+
+    normalizes :domain, with: ->(domain) { domain.to_s.strip.downcase.presence }
+
+    # The server fetches the issuer's discovery document and posts the code
+    # exchange to it, so a manager-typed issuer is an SSRF vector unless it is
+    # provably external. https because the client_secret travels over it.
+    validate :issuer_is_reachable_from_outside, if: -> { issuer.present? }
+
+    # Editing the domain drops the proof — otherwise a verified provider could be
+    # repointed at a domain nobody approved.
+    before_validation :reset_domain_verification, if: -> { persisted? && domain_changed? }
+
+    scope :active, -> { where(active: true) }
+    scope :domain_verified, -> { where.not(domain_verified_at: nil) }
+
+    # Until ownership is proven, HRD skips the provider and OpenLoam::Sso refuses
+    # to link an existing account through it.
+    def domain_verified? = domain_verified_at.present?
+
+    # Operator entry point (rake open_loam:sso:verify_domain), off the admin path.
+    def verify_domain!(at: Time.current)
+      update!(domain_verified_at: at)
+    end
+
+    # IdP group -> OpenLoam role, first match wins; falls back to jit_role.
+    def group_roles
+      group_role_map.is_a?(Hash) ? group_role_map : {}
+    end
+
+    private
+
+    def reset_domain_verification
+      self.domain_verified_at = nil
+    end
+
+    def issuer_is_reachable_from_outside
+      OpenLoam::OutboundUrl.validate!(issuer, require_https: true)
+    rescue OpenLoam::OutboundUrl::BlockedError => error
+      errors.add(:issuer, error.message)
+    end
+  end
+end

data/app/models/open_loam/tenant.rb

@@ -0,0 +1,20 @@
+module OpenLoam
+  # The tenant itself is deliberately NOT tenant-scoped — it is the axis the
+  # rest of the system is scoped by.
+  class Tenant < ActiveRecord::Base
+    include OpenLoam::GeneratedKey
+    self.table_name = "open_loam_tenants"
+
+    validates :name, presence: true
+    validates :slug, presence: true, uniqueness: true
+
+    has_many :memberships, class_name: "OpenLoam::Membership", dependent: :delete_all
+
+    # A new tenant is never empty: whatever the app registered via
+    # OpenLoam.on_tenant_created runs here, inside this tenant's context. After
+    # commit, so callbacks see a persisted tenant and may enqueue jobs.
+    # `bin/rails open_loam:sync` re-runs the same callbacks for existing tenants —
+    # which is why they must be idempotent (see OpenLoam::Lifecycle).
+    after_create_commit { OpenLoam::Lifecycle.run_tenant_created(self) }
+  end
+end

data/app/models/{loam → open_loam}/translation.rb

@@ -1,13 +1,13 @@
-module Loam
+module OpenLoam
   # A per-locale override for ONE field of ONE record — the storage behind
-  # Loam::Translatable. The record's own column holds the base (default-locale)
+  # OpenLoam::Translatable. The record's own column holds the base (default-locale)
   # value; a translation row overrides it for a specific locale. Additive:
   # writing a translation never touches the base column, so the base value is
   # never lost. Tenant-scoped and audited.
-  class Translation < Loam::TenantRecord
-    self.table_name = "loam_translations"
+  class Translation < OpenLoam::TenantRecord
+    self.table_name = "open_loam_translations"
 
-    include Loam::Auditable
+    include OpenLoam::Auditable
 
     belongs_to :translatable, polymorphic: true
 

data/app/models/open_loam/webhook_endpoint.rb

@@ -0,0 +1,39 @@
+module OpenLoam
+  # Where one tenant wants its domain events delivered. `event_pattern` uses
+  # the same rule as OpenLoam::Events.subscribe — a trailing dot is a domain prefix
+  # ("rental."), anything else is an exact event name.
+  #
+  # The secret signs every delivery (X-OpenLoam-Signature), so a receiver can tell
+  # a real call from a forged one.
+  class WebhookEndpoint < OpenLoam::TenantRecord
+    self.table_name = "open_loam_webhook_endpoints"
+
+    validates :url, presence: true
+    validates :event_pattern, presence: true
+
+    # The server fetches this URL, so a tenant must not be able to aim it at an
+    # address only the server can reach. Rejected at save for a clear error;
+    # OpenLoam::WebhookDeliveryJob re-checks at delivery, because DNS moves.
+    validate :url_is_reachable_from_outside, if: -> { url.present? }
+
+    scope :active, -> { where(active: true) }
+
+    before_validation on: :create do
+      self.secret ||= SecureRandom.hex(32)
+    end
+
+    # One matcher, shared with the event bus, so "rental." means the same thing
+    # to a subscriber and to a webhook.
+    def matches?(event_name)
+      OpenLoam::Events.pattern_matches?(event_pattern, event_name)
+    end
+
+    private
+
+    def url_is_reachable_from_outside
+      OpenLoam::OutboundUrl.validate!(url)
+    rescue OpenLoam::OutboundUrl::BlockedError => error
+      errors.add(:url, error.message)
+    end
+  end
+end

data/app/views/{loam → open_loam}/attachments/_attachments.html.erb

@@ -2,7 +2,7 @@
     Uploading happens through the entity's own form (it is an update, and the
     entity's policy decides who may do it); this partial only lists what is
     already attached. Note that these links are signed URLs, not tenant-checked
-    addresses — see Loam::Attachable. %>
+    addresses — see OpenLoam::Attachable. %>
 <h2>Files</h2>
 
 <% if record.files.attached? %>

data/app/views/{loam → open_loam}/comments/_comments.html.erb

@@ -8,7 +8,7 @@
   <p style="color:#b00"><%= flash[:alert] %></p>
 <% end %>
 
-<% record.loam_comments.oldest_first.each do |comment| %>
+<% record.open_loam_comments.oldest_first.each do |comment| %>
   <p>
     <strong><%= User.find_by(id: comment.author_id)&.name || "—" %></strong>
     <em><%= comment.created_at.to_fs(:short) %></em><br>

data/app/views/{loam → open_loam}/custom_fields/_fields.html.erb

@@ -3,6 +3,10 @@
     rendering lives once in the gem instead of being inlined per entity. %>
 <% mode = local_assigns.fetch(:mode, :edit) %>
 <% record.class.custom_field_definitions.each do |definition| %>
+  <%# Not readable by this role: omit the field entirely. Falling through to the
+      read-only branch below would print the value to anyone who merely lacks
+      WRITE access, which is a different question. %>
+  <% next unless policy.custom_field_readable?(definition.name) %>
   <% param_name = "#{record.model_name.param_key}[custom_fields][#{definition.name}]" %>
   <% value = record.custom_field(definition.name) %>
   <p>
@@ -20,14 +24,14 @@
       <% when "integer", "decimal" %>
         <%= number_field_tag param_name, value %>
       <% when "dictionary" %>
-        <% options = Loam::Dictionaries.entries(definition.dictionary_key).map { |e| [e.label, e.value] } %>
+        <% options = OpenLoam::Dictionaries.entries(definition.dictionary_key).map { |e| [e.label, e.value] } %>
         <%= select_tag param_name, options_for_select(options, value), include_blank: true, id: param_name %>
       <% else %>
         <%= text_field_tag param_name, value %>
       <% end %>
     <% else %>
       <%# A dictionary field shows its entry label, not the raw stored code. %>
-      <% display = definition.field_type == "dictionary" ? Loam::Dictionaries.label_for(definition.dictionary_key, value) : value %>
+      <% display = definition.field_type == "dictionary" ? OpenLoam::Dictionaries.label_for(definition.dictionary_key, value) : value %>
       <%= definition.name.humanize %>: <%= display %>
       <% if mode == :edit %><em>(read-only for your role)</em><% end %>
     <% end %>

data/lib/generators/{loam → open_loam}/entity/entity_generator.rb

@@ -1,19 +1,19 @@
 require "rails/generators"
 require "rails/generators/active_record"
-require "generators/loam/primary_key_options"
+require "generators/open_loam/primary_key_options"
 
-module Loam
+module OpenLoam
   module Generators
-    # `rails g loam:entity Equipment name:string daily_rate:decimal --domain rental`
+    # `rails g open_loam:entity Equipment name:string daily_rate:decimal --domain rental`
     #
     # THE interface for adding a business entity — for humans and AI agents
     # alike. One command produces a tenant-scoped, audited, evented model, its
     # policy, an admin screen, and the isolation tests that prove the
-    # guardrails hold. No decisions about how tenancy/permissions work: Loam
+    # guardrails hold. No decisions about how tenancy/permissions work: OpenLoam
     # already decided.
     class EntityGenerator < Rails::Generators::NamedBase
       include ActiveRecord::Generators::Migration
-      include Loam::Generators::PrimaryKeyOptions
+      include OpenLoam::Generators::PrimaryKeyOptions
 
       source_root File.expand_path("templates", __dir__)
 
@@ -21,7 +21,7 @@ module Loam
       class_option :domain, type: :string, default: "app",
                             desc: "Event domain prefix (-> domain.entity.created)"
       class_option :encrypt, type: :array, default: [], banner: "field field",
-                             desc: "Encrypt these fields at rest, per tenant (Loam::Encryptable)"
+                             desc: "Encrypt these fields at rest, per tenant (OpenLoam::Encryptable)"
       class_option :encrypt_searchable, type: :array, default: [], banner: "field field",
                                         desc: "Encrypt + add a blind index for exact-match lookup"
 
@@ -59,7 +59,7 @@ module Loam
       end
 
       # `namespace:` makes Rails inject the route INTO the existing
-      # `namespace :admin do` block (the one loam:install wrote) instead of
+      # `namespace :admin do` block (the one open_loam:install wrote) instead of
       # stacking one admin block per entity, and falls back to creating the
       # block when there is none. Re-running the generator is a no-op: the
       # injection is `force: false`, so identical routing code is skipped.
@@ -70,7 +70,7 @@ module Loam
       # identical `resources :gadgets` lines would leave the second one out.
       #
       # The admin resource carries the soft-delete recycle bin: `deleted` lists
-      # `only_deleted`, `restore` brings one back (see Loam::SoftDeletable).
+      # `only_deleted`, `restore` brings one back (see OpenLoam::SoftDeletable).
       def add_route
         route <<~RUBY.strip, namespace: :admin
           resources :#{plural_file_name} do
@@ -101,7 +101,7 @@ module Loam
         attributes.map(&:name)
       end
 
-      # Only text-ish columns are worth a LIKE (see Loam::Searchable), so an
+      # Only text-ish columns are worth a LIKE (see OpenLoam::Searchable), so an
       # entity with none gets no `searchable_by` declaration and stays out of
       # the global search. Encrypted columns are excluded: ciphertext is
       # meaningless to LIKE, and declaring both would raise at class load.

data/lib/generators/{loam → open_loam}/entity/templates/api_controller.rb

@@ -8,8 +8,9 @@ module Api
     before_action :set_record, only: %i[show update destroy]
 
     def index
+      authorize!(policy_for(<%= class_name %>.new), :read?)
       records = <%= class_name %>.order(created_at: :desc).to_a
-      enriched = Loam::Enrichers.enrich_many(records)   # one batched pass, no N+1
+      enriched = OpenLoam::Enrichers.enrich_many(records)   # one batched pass, no N+1
       render json: records.map { |record| entity_json(record, enrichments: enriched[record.id]) }
     end