open-loam 0.1.1 → 0.3.0

data/lib/generators/{loam → open_loam}/entity/templates/controller.rb

@@ -15,34 +15,39 @@ module Admin
     end
 
     def index
-      @perspective = Loam::Perspectives.resolve("<%= class_name %>", user: current_actor, id: params[:perspective_id])
-      @perspectives = Loam::Perspectives.visible_to("<%= class_name %>", user: current_actor)
+      authorize!(policy_for(<%= class_name %>.new), :read?)
+      @perspective = OpenLoam::Perspectives.resolve("<%= class_name %>", user: current_actor, id: params[:perspective_id])
+      @perspectives = OpenLoam::Perspectives.visible_to("<%= class_name %>", user: current_actor)
       @records, @page, @has_next = paginate(index_scope)
-      @index_partial = params[:cf_field].present? && Loam::CustomFieldIndex.partial?  # incomplete-index warning (L-919)
+      @index_partial = params[:cf_field].present? && OpenLoam::CustomFieldIndex.partial?  # incomplete-index warning (L-919)
     end
 
     # CSV of the CURRENT filtered/perspective view — manager-only, policy- and
-    # encryption-aware (Loam::Export).
+    # encryption-aware (OpenLoam::Export).
     def export
       require_role!(:manager)
-      send_data Loam::Export.csv(index_scope, actor: current_actor),
+      send_data OpenLoam::Export.csv(index_scope, actor: current_actor),
                 filename: "<%= plural_name %>-#{Date.current}.csv", type: "text/csv"
     end
 
     # Datatable bulk actions on the selected ids — each is policy-checked per
-    # record and tenant-scoped (Loam::Bulk). Zero selection is a no-op.
+    # record and tenant-scoped (OpenLoam::Bulk). Zero selection is a no-op.
     def bulk
+      # OpenLoam::Bulk checks the policy PER record (destroy? for soft_delete,
+      # update? + writable? for set_field) and silently skips what the actor may
+      # not touch, so the authorization is real — it just lives there, not here.
+      authorized!
       ids = Array(params[:ids])
       case params[:bulk_action]
       when "soft_delete"
-        count = Loam::Bulk.soft_delete(<%= class_name %>, ids)
+        count = OpenLoam::Bulk.soft_delete(<%= class_name %>, ids)
         redirect_to polymorphic_path([:admin, <%= class_name %>]), notice: "Deleted #{count} record(s)."
       when "set_field"
-        count = Loam::Bulk.set_field(<%= class_name %>, ids, field: params[:field], value: params[:value])
+        count = OpenLoam::Bulk.set_field(<%= class_name %>, ids, field: params[:field], value: params[:value])
         redirect_to polymorphic_path([:admin, <%= class_name %>]), notice: "Updated #{count} record(s)."
       when "export"
         require_role!(:manager)  # same gate as the dedicated export action
-        send_data Loam::Export.csv(Loam::Bulk.selected(<%= class_name %>, ids), actor: current_actor),
+        send_data OpenLoam::Export.csv(OpenLoam::Bulk.selected(<%= class_name %>, ids), actor: current_actor),
                   filename: "<%= plural_name %>-selected.csv", type: "text/csv"
       else
         redirect_to polymorphic_path([:admin, <%= class_name %>]), alert: "Unknown bulk action."
@@ -75,7 +80,7 @@ module Admin
       attach_files!(@record, policy)
 
       if @record.save
-        redirect_to [:admin, @record], notice: t("loam.flash.created", name: <%= class_name %>.model_name.human)
+        redirect_to [:admin, @record], notice: t("open_loam.flash.created", name: <%= class_name %>.model_name.human)
       else
         render :new, status: :unprocessable_entity
       end
@@ -84,7 +89,7 @@ module Admin
     def edit
       authorize!(policy_for(@record), :update?)
       # Take the advisory lock (courtesy) or learn who holds it, for the banner.
-      @lock = Loam::RecordLocks.acquire(@record, by: current_actor) || Loam::RecordLocks.active_lock(@record)
+      @lock = OpenLoam::RecordLocks.acquire(@record, by: current_actor) || OpenLoam::RecordLocks.active_lock(@record)
     end
 
     def update
@@ -94,15 +99,15 @@ module Admin
       attach_files!(@record, policy)
 
       if @record.update(permitted_params(policy))
-        Loam::RecordLocks.release(@record, by: current_actor)
-        redirect_to [:admin, @record], notice: t("loam.flash.updated", name: <%= class_name %>.model_name.human)
+        OpenLoam::RecordLocks.release(@record, by: current_actor)
+        redirect_to [:admin, @record], notice: t("open_loam.flash.updated", name: <%= class_name %>.model_name.human)
       else
         render :edit, status: :unprocessable_entity
       end
     rescue ActiveRecord::StaleObjectError
       # Someone saved between open and submit — show the diff, reload fresh, retry.
       stale_conflict!(@record, FIELDS)
-      @lock = Loam::RecordLocks.acquire(@record, by: current_actor) || Loam::RecordLocks.active_lock(@record)
+      @lock = OpenLoam::RecordLocks.acquire(@record, by: current_actor) || OpenLoam::RecordLocks.active_lock(@record)
       render :edit, status: :conflict
     end
 
@@ -111,8 +116,8 @@ module Admin
     def destroy
       authorize!(policy_for(@record), :destroy?)
       @record.soft_delete!
-      Loam::RecordLocks.release(@record, by: current_actor)
-      redirect_to [:admin, <%= class_name %>], notice: t("loam.flash.destroyed", name: <%= class_name %>.model_name.human)
+      OpenLoam::RecordLocks.release(@record, by: current_actor)
+      redirect_to [:admin, <%= class_name %>], notice: t("open_loam.flash.destroyed", name: <%= class_name %>.model_name.human)
     end
 
     # Restore looks through the deleted rows — the default scope hides them, so a
@@ -121,7 +126,7 @@ module Admin
       @record = <%= class_name %>.with_deleted.find(params[:id])
       authorize!(policy_for(@record), :update?)
       @record.restore!
-      redirect_to [:deleted, :admin, <%= class_name %>], notice: t("loam.flash.restored", name: <%= class_name %>.model_name.human)
+      redirect_to [:deleted, :admin, <%= class_name %>], notice: t("open_loam.flash.restored", name: <%= class_name %>.model_name.human)
     end
 
     private
@@ -134,7 +139,7 @@ module Admin
     # export so the CSV matches what the manager is looking at.
     def index_scope
       scope = <%= class_name %>.all
-      perspective = Loam::Perspectives.resolve("<%= class_name %>", user: current_actor, id: params[:perspective_id])
+      perspective = OpenLoam::Perspectives.resolve("<%= class_name %>", user: current_actor, id: params[:perspective_id])
       scope = perspective.apply(scope) if perspective
 <% if searchable_attributes.any? -%>
       scope = scope.search(params[:q])
@@ -147,9 +152,14 @@ module Admin
     # against real columns (never interpolated from params — that would be SQL
     # injection), and the direction is constrained to asc/desc. With no valid
     # sort param, a perspective's own order is kept, else a stable default.
+    #
+    # It must also be a column the role may READ: ordering by a hidden field
+    # leaks its ordering, which is an inference oracle on a value the role
+    # cannot see. Same reasoning as OpenLoam::FieldAccessError on custom fields —
+    # ignored rather than raised, since the header is not rendered either.
     def apply_sort(scope)
       column = params[:sort].to_s
-      if <%= class_name %>.column_names.include?(column)
+      if <%= class_name %>.column_names.include?(column) && policy_for(<%= class_name %>.new).readable?(column)
         dir = params[:dir].to_s.casecmp("asc").zero? ? :asc : :desc
         scope.reorder(column => dir).order(id: dir)
       elsif scope.order_values.empty?
@@ -160,13 +170,13 @@ module Admin
     end
 
     # A custom-field filter routed through the read-model index
-    # (Loam::CustomFieldIndex) — index-backed, not a JSON scan. An unknown field
+    # (OpenLoam::CustomFieldIndex) — index-backed, not a JSON scan. An unknown field
     # is ignored rather than raising.
     def apply_custom_field_filter(scope)
       return scope if params[:cf_field].blank?
 
-      scope.merge(Loam::CustomFieldIndex.filter(<%= class_name %>, params[:cf_field], params[:cf_op].presence || "eq", params[:cf_value]))
-    rescue Loam::Error
+      scope.merge(OpenLoam::CustomFieldIndex.filter(<%= class_name %>, params[:cf_field], params[:cf_op].presence || "eq", params[:cf_value]))
+    rescue OpenLoam::Error
       scope
     end
 

data/lib/generators/{loam → open_loam}/entity/templates/entity_test.rb

@@ -1,19 +1,19 @@
 require "test_helper"
 
-# Generated guardrail tests for <%= class_name %>. They prove the Loam
+# Generated guardrail tests for <%= class_name %>. They prove the OpenLoam
 # invariants hold for THIS entity: tenant isolation, loud failure without
 # context, audit-by-default, lifecycle events, membership-gated policies.
 # Extend freely; never delete.
-class <%= class_name %>LoamTest < ActiveSupport::TestCase
+class <%= class_name %>OpenLoamTest < ActiveSupport::TestCase
   setup do
-    @tenant_a = Loam::Tenant.create!(name: "Tenant A", slug: "a-<%= file_name %>")
-    @tenant_b = Loam::Tenant.create!(name: "Tenant B", slug: "b-<%= file_name %>")
+    @tenant_a = OpenLoam::Tenant.create!(name: "Tenant A", slug: "a-<%= file_name %>")
+    @tenant_b = OpenLoam::Tenant.create!(name: "Tenant B", slug: "b-<%= file_name %>")
     @manager = User.create!(name: "Manager", email: "manager@example.test", password: "password")
     @employee = User.create!(name: "Employee", email: "employee@example.test", password: "password")
 
     with_tenant(@tenant_a) do
-      Loam::Membership.create!(user: @manager, role: "manager")
-      Loam::Membership.create!(user: @employee, role: "employee")
+      OpenLoam::Membership.create!(user: @manager, role: "manager")
+      OpenLoam::Membership.create!(user: @employee, role: "employee")
     end
   end
 
@@ -29,15 +29,15 @@ class <%= class_name %>LoamTest < ActiveSupport::TestCase
   end
 
   test "guardrail: touching the model with no tenant context raises" do
-    assert_raises(Loam::MissingTenantError) { <%= class_name %>.count }
-    assert_raises(Loam::MissingTenantError) { <%= class_name %>.new }
+    assert_raises(OpenLoam::MissingTenantError) { <%= class_name %>.count }
+    assert_raises(OpenLoam::MissingTenantError) { <%= class_name %>.new }
   end
 
   test "guardrail: a record cannot be written into a foreign tenant" do
     record = with_tenant(@tenant_a) { <%= class_name %>.create!(<%= sample_attributes %>) }
 
     with_tenant(@tenant_b) do
-      assert_raises(Loam::MissingTenantError) { record.update!(<%= sample_attributes(1) %>) }
+      assert_raises(OpenLoam::MissingTenantError) { record.update!(<%= sample_attributes(1) %>) }
     end
   end
 
@@ -45,7 +45,7 @@ class <%= class_name %>LoamTest < ActiveSupport::TestCase
     with_tenant(@tenant_a, actor: @manager) do
       record = <%= class_name %>.create!(<%= sample_attributes %>)
 
-      audit = Loam::AuditRecord.find_by(
+      audit = OpenLoam::AuditRecord.find_by(
         auditable_type: "<%= class_name %>", auditable_id: record.id, action: "create"
       )
       assert audit, "expected an audit record for the create"
@@ -56,7 +56,7 @@ class <%= class_name %>LoamTest < ActiveSupport::TestCase
 
   test "lifecycle events are published with the tenant stamped" do
     received = []
-    subscription = Loam::Events.subscribe("<%= domain %>.<%= singular_name %>.created") do |_name, payload|
+    subscription = OpenLoam::Events.subscribe("<%= domain %>.<%= singular_name %>.created") do |_name, payload|
       received << payload
     end
 
@@ -78,7 +78,7 @@ class <%= class_name %>LoamTest < ActiveSupport::TestCase
     with_tenant(@tenant_a) do
       assert_equal 0, <%= class_name %>.count, "a soft-deleted record is gone from ordinary queries"
       assert_equal 1, <%= class_name %>.with_deleted.count, "but the row still exists"
-      assert Loam::AuditRecord.exists?(auditable_type: "<%= class_name %>", auditable_id: record_id, action: "soft_delete")
+      assert OpenLoam::AuditRecord.exists?(auditable_type: "<%= class_name %>", auditable_id: record_id, action: "soft_delete")
     end
 
     # with_deleted lifts the deleted_at filter but NOT the tenant filter.

data/lib/generators/{loam → open_loam}/entity/templates/migration.rb

@@ -1,10 +1,10 @@
 class Create<%= table_name.camelize %> < ActiveRecord::Migration[<%= ActiveRecord::VERSION::STRING.to_f %>]
   def change
-    create_table :<%= table_name %><%= loam_id_option %> do |t|
-      t.references :tenant, null: false, foreign_key: { to_table: :loam_tenants }<%= loam_type_option %>
+    create_table :<%= table_name %><%= open_loam_id_option %> do |t|
+      t.references :tenant, null: false, foreign_key: { to_table: :open_loam_tenants }<%= open_loam_type_option %>
 <% attributes.each do |attribute| -%>
 <% if encrypted?(attribute) -%>
-      t.text :<%= attribute.name %>   # encrypted at rest (Loam::Encryptable) — text, since ciphertext outgrows varchar
+      t.text :<%= attribute.name %>   # encrypted at rest (OpenLoam::Encryptable) — text, since ciphertext outgrows varchar
 <% else -%>
       t.<%= attribute.type %> :<%= attribute.name %>
 <% end -%>
@@ -14,10 +14,10 @@ class Create<%= table_name.camelize %> < ActiveRecord::Migration[<%= ActiveRecor
 <% end -%>
       t.json :custom_fields, null: false, default: {}
       t.datetime :deleted_at
-      t.integer :lock_version, null: false, default: 0   # optimistic locking (Loam::RecordLock)
+      t.integer :lock_version, null: false, default: 0   # optimistic locking (OpenLoam::RecordLock)
       t.timestamps
     end
-    # Loam::SoftDeletable filters `deleted_at IS NULL` on every query.
+    # OpenLoam::SoftDeletable filters `deleted_at IS NULL` on every query.
     add_index :<%= table_name %>, :deleted_at
 <% encrypt_searchable_names.each do |field| -%>
     add_index :<%= table_name %>, :<%= field %>_hash

data/lib/generators/{loam → open_loam}/entity/templates/model.rb

@@ -1,14 +1,14 @@
 # Tenant-scoped, audited, evented — by inheritance, not by remembering.
-class <%= class_name %> < Loam::TenantRecord
-  include Loam::Auditable
-  include Loam::Eventful
-  include Loam::CustomFields
-  include Loam::Commentable
-  include Loam::Attachable
-  include Loam::Searchable
-  include Loam::SoftDeletable
+class <%= class_name %> < OpenLoam::TenantRecord
+  include OpenLoam::Auditable
+  include OpenLoam::Eventful
+  include OpenLoam::CustomFields
+  include OpenLoam::Commentable
+  include OpenLoam::Attachable
+  include OpenLoam::Searchable
+  include OpenLoam::SoftDeletable
 <% if encrypted_field_names.any? -%>
-  include Loam::Encryptable
+  include OpenLoam::Encryptable
 <% end -%>
 
   event_domain :<%= domain %>
@@ -23,5 +23,5 @@ class <%= class_name %> < Loam::TenantRecord
 <% end -%>
 
   # Business logic goes here. Publish business events explicitly:
-  #   Loam::Events.publish("<%= domain %>.something.happened", id: id)
+  #   OpenLoam::Events.publish("<%= domain %>.something.happened", id: id)
 end

data/lib/generators/{loam → open_loam}/entity/templates/policy.rb

@@ -1,4 +1,4 @@
-class <%= class_name %>Policy < Loam::Policy
+class <%= class_name %>Policy < OpenLoam::Policy
   # Action defaults: any member of the current tenant may read/create/update/
   # destroy. Tighten by overriding, e.g.:
   #

data/lib/generators/{loam → open_loam}/entity/templates/views/_form.html.erb

@@ -1,4 +1,4 @@
-<%% policy = Loam::Policy.for(@record) %>
+<%% policy = OpenLoam::Policy.for(@record) %>
 
 <%%# Optimistic-locking conflict: what the user typed vs what is now saved. %>
 <%% if @conflict.present? %>
@@ -36,25 +36,28 @@
     </ul>
   <%% end %>
 
+<%%# Three states per field: writable (input), readable-only (shown, labelled
+    read-only), or neither (absent). There is no branch for the third case on
+    purpose — a field the role may not read is not rendered at all. %>
 <% attributes.each do |attribute| -%>
   <%% if policy.writable?(:<%= attribute.name %>) %>
     <p>
       <%%= f.label :<%= attribute.name %> %><br>
       <%%= f.<%= form_field_helper(attribute) %> :<%= attribute.name %> %>
     </p>
-  <%% else %>
+  <%% elsif policy.readable?(:<%= attribute.name %>) %>
     <p>
       <%%= f.label :<%= attribute.name %> %>: <%%= @record.<%= attribute.name %> %>
-      <em><%%= t("loam.form.read_only") %></em>
+      <em><%%= t("open_loam.form.read_only") %></em>
     </p>
   <%% end %>
 <% end -%>
 
-  <%%= render "loam/custom_fields/fields", record: @record, policy: policy, mode: :edit %>
+  <%%= render "open_loam/custom_fields/fields", record: @record, policy: policy, mode: :edit %>
 
   <%% if policy.update? %>
     <p>
-      <%%= f.label :files, t("loam.form.attach_files") %><br>
+      <%%= f.label :files, t("open_loam.form.attach_files") %><br>
       <%%= f.file_field :files, multiple: true %>
     </p>
   <%% end %>

data/lib/generators/{loam → open_loam}/entity/templates/views/deleted.html.erb

@@ -1,13 +1,13 @@
-<h1><%%= t("loam.actions.deleted_title", name: <%= class_name %>.model_name.human(count: 2)) %></h1>
+<h1><%%= t("open_loam.actions.deleted_title", name: <%= class_name %>.model_name.human(count: 2)) %></h1>
 
-<p><%%= link_to t("loam.actions.back"), [:admin, <%= class_name %>] %></p>
+<p><%%= link_to t("open_loam.actions.back"), [:admin, <%= class_name %>] %></p>
 
 <%%# No Show/Edit here: these rows are hidden by the default scope, so a plain
     find would 404. The one action a deleted record offers is Restore. %>
 <table>
   <thead>
     <tr>
-      <th><%%= t("loam.labels.id") %></th>
+      <th><%%= t("open_loam.labels.id") %></th>
 <% attributes.each do |attribute| -%>
       <th><%%= <%= class_name %>.human_attribute_name("<%= attribute.name %>") %></th>
 <% end -%>
@@ -23,7 +23,7 @@
         <td><%%= record.<%= attribute.name %> %></td>
 <% end -%>
         <td><%%= record.deleted_at %></td>
-        <td><%%= button_to t("loam.actions.restore"), [:restore, :admin, record], method: :patch %></td>
+        <td><%%= button_to t("open_loam.actions.restore"), [:restore, :admin, record], method: :patch %></td>
       </tr>
     <%% end %>
   </tbody>
@@ -32,10 +32,10 @@
 <%%# Page links carry nothing but the page: the recycle bin has no filter box. %>
 <p>
   <%% if @page > 1 %>
-    <%%= link_to t("loam.pagination.previous"), polymorphic_path([:deleted, :admin, <%= class_name %>], page: @page - 1) %>
+    <%%= link_to t("open_loam.pagination.previous"), polymorphic_path([:deleted, :admin, <%= class_name %>], page: @page - 1) %>
   <%% end %>
-  <%%= t("loam.pagination.page", page: @page) %>
+  <%%= t("open_loam.pagination.page", page: @page) %>
   <%% if @has_next %>
-    <%%= link_to t("loam.pagination.next"), polymorphic_path([:deleted, :admin, <%= class_name %>], page: @page + 1) %>
+    <%%= link_to t("open_loam.pagination.next"), polymorphic_path([:deleted, :admin, <%= class_name %>], page: @page + 1) %>
   <%% end %>
 </p>

data/lib/generators/open_loam/entity/templates/views/edit.html.erb

@@ -0,0 +1,3 @@
+<h1><%%= t("open_loam.actions.edit_title", name: <%= class_name %>.model_name.human, id: @record.id) %></h1>
+
+<%%= render "form" %>

data/lib/generators/open_loam/entity/templates/views/index.html.erb

@@ -0,0 +1,94 @@
+<%%# One policy for the whole table: readable? keys off the actor's ROLE, not the
+    row, so building it per record would only add a membership query per row. %>
+<%% policy = OpenLoam::Policy.for_model(<%= class_name %>, current_actor) %>
+
+<h1><%%= <%= class_name %>.model_name.human(count: 2) %></h1>
+
+<%% if @index_partial %>
+  <p style="color:#b00"><%%= t("open_loam.index.incomplete") %></p>
+<%% end %>
+
+<p>
+  <%%= link_to t("open_loam.actions.new", name: <%= class_name %>.model_name.human), new_polymorphic_path([:admin, <%= class_name %>]) %>
+  <%%= link_to t("open_loam.actions.deleted", name: <%= class_name %>.model_name.human(count: 2)), polymorphic_path([:deleted, :admin, <%= class_name %>]) %>
+  <%% if current_role == :manager %>
+    <%%= link_to t("open_loam.actions.export_csv"), url_for(action: :export, **current_index_params) %>
+    <%%= link_to t("open_loam.actions.import_csv"), new_admin_import_path(entity_type: "<%= class_name %>") %>
+  <%% end %>
+</p>
+
+<%%# Saved views (OpenLoam::Perspectives): pick one to apply, or save the current one. %>
+<%% if @perspectives.any? %>
+  <%%= form_with url: [:admin, <%= class_name %>], method: :get do %>
+    <%%= select_tag :perspective_id,
+          options_for_select([[t("open_loam.views.all", name: <%= class_name %>.model_name.human(count: 2)), "none"]] + @perspectives.map { |p| [p.name, p.id] }, @perspective&.id),
+          onchange: "this.form.submit()" %>
+    <%%= link_to t("open_loam.views.manage"), admin_perspectives_path(entity_type: "<%= class_name %>") %>
+  <%% end %>
+<%% else %>
+  <p><%%= link_to t("open_loam.views.manage_saved"), admin_perspectives_path(entity_type: "<%= class_name %>") %></p>
+<%% end %>
+
+<%%= form_with url: admin_perspectives_path, method: :post do %>
+  <%%= hidden_field_tag :entity_type, "<%= class_name %>" %>
+  <%%= hidden_field_tag :q, params[:q] %>
+  <%%= text_field_tag :name, nil, placeholder: t("open_loam.views.name_placeholder") %>
+  <%%= submit_tag t("open_loam.views.save_current") %>
+<%% end %>
+<% if searchable_attributes.any? -%>
+
+<%%= form_with url: [:admin, <%= class_name %>], method: :get do |f| %>
+  <%%= text_field_tag :q, params[:q], placeholder: t("open_loam.views.filter_placeholder", name: <%= class_name %>.model_name.human(count: 2)) %>
+  <%%= f.submit t("open_loam.actions.filter") %>
+<%% end %>
+<% end -%>
+
+<%%# Bulk actions on selected rows (OpenLoam::Bulk). Zero selection = no-op; each
+    action is policy-checked per record server-side. %>
+<%%= form_with url: url_for(action: :bulk), method: :post do %>
+  <p>
+    <%%= select_tag :bulk_action, options_for_select([[t("open_loam.bulk.delete_selected"), "soft_delete"], [t("open_loam.bulk.set_field"), "set_field"], [t("open_loam.bulk.export_selected"), "export"]]) %>
+    <%%= select_tag :field, options_for_select(%i[<%= field_names.join(" ") %>]) %>
+    <%%= text_field_tag :value, nil, placeholder: t("open_loam.bulk.new_value") %>
+    <%%= submit_tag t("open_loam.bulk.apply"), data: { turbo_confirm: t("open_loam.bulk.confirm") } %>
+  </p>
+
+  <table>
+    <thead>
+      <tr>
+        <th><input type="checkbox" onclick="document.querySelectorAll('.bulk-select').forEach(function(c){c.checked=this.checked}.bind(this))"></th>
+        <th><%%= t("open_loam.labels.id") %></th>
+<% attributes.each do |attribute| -%>
+        <%% if policy.readable?(:<%= attribute.name %>) %><th><%%= sort_link("<%= attribute.name %>", <%= class_name %>.human_attribute_name("<%= attribute.name %>")) %></th><%% end %>
+<% end -%>
+        <th></th>
+      </tr>
+    </thead>
+    <tbody>
+      <%% @records.each do |record| %>
+        <tr>
+          <td><%%= check_box_tag "ids[]", record.id, false, class: "bulk-select" %></td>
+          <td><%%= record.id %></td>
+<% attributes.each do |attribute| -%>
+          <%% if policy.readable?(:<%= attribute.name %>) %><td><%%= record.<%= attribute.name %> %></td><%% end %>
+<% end -%>
+          <td>
+            <%%= link_to t("open_loam.actions.show"), [:admin, record] %>
+            <%%= link_to t("open_loam.actions.edit"), edit_polymorphic_path([:admin, record]) %>
+          </td>
+        </tr>
+      <%% end %>
+    </tbody>
+  </table>
+<%% end %>
+
+<%%# Page links carry the full filter state, or page 2 would quietly drop it. %>
+<p>
+  <%% if @page > 1 %>
+    <%%= link_to t("open_loam.pagination.previous"), polymorphic_path([:admin, <%= class_name %>], **current_index_params, page: @page - 1) %>
+  <%% end %>
+  <%%= t("open_loam.pagination.page", page: @page) %>
+  <%% if @has_next %>
+    <%%= link_to t("open_loam.pagination.next"), polymorphic_path([:admin, <%= class_name %>], **current_index_params, page: @page + 1) %>
+  <%% end %>
+</p>

data/lib/generators/open_loam/entity/templates/views/new.html.erb

@@ -0,0 +1,3 @@
+<h1><%%= t("open_loam.actions.new_title", name: <%= class_name %>.model_name.human) %></h1>
+
+<%%= render "form" %>

data/lib/generators/open_loam/entity/templates/views/show.html.erb

@@ -0,0 +1,38 @@
+<%% policy = OpenLoam::Policy.for(@record) %>
+
+<h1><%%= t("open_loam.actions.show_title", name: <%= class_name %>.model_name.human, id: @record.id) %></h1>
+
+<% attributes.each do |attribute| -%>
+<%% if policy.readable?(:<%= attribute.name %>) %>
+<p><strong><%%= <%= class_name %>.human_attribute_name("<%= attribute.name %>") %>:</strong> <%%= @record.<%= attribute.name %> %></p>
+<%% end %>
+<% end -%>
+
+<%%= render "open_loam/custom_fields/fields", record: @record, policy: policy, mode: :show %>
+
+<%%# Computed cross-module blocks (OpenLoam::Enrichers) — no section when none registered. %>
+<%% enrichments = OpenLoam::Enrichers.enrich(@record) %>
+<%% if enrichments.any? %>
+  <h2><%%= t("open_loam.labels.enrichments") %></h2>
+  <dl>
+    <%% enrichments.each do |key, value| %>
+      <dt><strong><%%= key.humanize %></strong></dt>
+      <dd><%%= value %></dd>
+    <%% end %>
+  </dl>
+<%% end %>
+
+<p>
+  <%%= link_to t("open_loam.actions.edit"), edit_polymorphic_path([:admin, @record]) %>
+  <%%= link_to "History", admin_history_path(type: @record.class.name, record_id: @record.id) %>
+  <%% if @record.class.respond_to?(:open_loam_translatable_attributes) && @record.class.open_loam_translatable_attributes.any? && current_role == :manager %>
+    <%%= link_to t("open_loam.actions.translations"), admin_translations_path(translatable_type: @record.class.name, translatable_id: @record.id) %>
+  <%% end %>
+  <%%# Delete soft-deletes: the record moves to the recycle bin, not oblivion. %>
+  <%%= button_to t("open_loam.actions.destroy"), [:admin, @record], method: :delete if policy.destroy? %>
+  <%%= link_to t("open_loam.actions.back"), [:admin, <%= class_name %>] %>
+</p>
+
+<%%= render "open_loam/attachments/attachments", record: @record %>
+
+<%%= render "open_loam/comments/comments", record: @record %>