open-loam 0.1.1 → 0.3.0

data/lib/generators/{loam → open_loam}/install/templates/admin/field_definitions_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  # Manages Loam::FieldDefinition records: the "migration-free field" screen.
+  # Manages OpenLoam::FieldDefinition records: the "migration-free field" screen.
   # Structural, not per-entity — gated on the manager role rather than a
   # generated entity policy, since a field definition applies to a whole
   # entity_type, not one record.
@@ -9,16 +9,16 @@ module Admin
 
     def index
       @entity_type = params[:entity_type]
-      @records = Loam::FieldDefinition.order(:entity_type, :name)
+      @records = OpenLoam::FieldDefinition.order(:entity_type, :name)
       @records = @records.where(entity_type: @entity_type) if @entity_type.present?
     end
 
     def new
-      @record = Loam::FieldDefinition.new(entity_type: params[:entity_type])
+      @record = OpenLoam::FieldDefinition.new(entity_type: params[:entity_type])
     end
 
     def create
-      @record = Loam::FieldDefinition.new(permitted_params)
+      @record = OpenLoam::FieldDefinition.new(permitted_params)
       @record.writable_roles = parse_roles(params.dig(:field_definition, :writable_roles))
       @record.readable_roles = parse_roles(params.dig(:field_definition, :readable_roles))
 
@@ -38,7 +38,7 @@ module Admin
     private
 
     def set_record
-      @record = Loam::FieldDefinition.find(params[:id])
+      @record = OpenLoam::FieldDefinition.find(params[:id])
     end
 
     def permitted_params

data/lib/generators/{loam → open_loam}/install/templates/admin/field_definitions_new.html.erb

@@ -19,11 +19,11 @@
   </p>
   <p>
     <%%= f.label :field_type %><br>
-    <%%= f.select :field_type, Loam::FieldDefinition::FIELD_TYPES %>
+    <%%= f.select :field_type, OpenLoam::FieldDefinition::FIELD_TYPES %>
   </p>
   <p>
     <%%= f.label :dictionary_key, "Dictionary key (only for a 'dictionary' field type)" %><br>
-    <%%= f.select :dictionary_key, Loam::Dictionary.order(:key).pluck(:key), include_blank: true %>
+    <%%= f.select :dictionary_key, OpenLoam::Dictionary.order(:key).pluck(:key), include_blank: true %>
   </p>
   <p>
     <%%= f.label :writable_roles, "Writable by (comma-separated roles, blank = any member)" %><br>

data/lib/generators/open_loam/install/templates/admin/history_controller.rb

@@ -0,0 +1,64 @@
+module Admin
+  # A record's change history (OpenLoam::AuditRecord) with one-click Undo (L-704).
+  # Undo applies the inverse of a change and records ITSELF as an audit, so
+  # undoing an "undo" entry is redo — no separate redo action. Reading needs read
+  # on the record; undoing needs update (the same gate as editing it).
+  class HistoryController < BaseController
+    before_action :set_target
+
+    helper_method :visible_changeset
+
+    def index
+      authorize!(policy_for(@record), :read?)
+      @audits = OpenLoam::AuditRecord
+                .where(auditable_type: @record.class.name, auditable_id: @record.id)
+                .order(id: :desc).limit(100)
+    end
+
+    def undo
+      authorize!(policy_for(@record), :update?)
+      audit = OpenLoam::AuditRecord.find(params[:id])
+      OpenLoam::Undo.undo(audit, policy: policy_for(@record))
+      redirect_to admin_history_path(type: @record.class.name, record_id: @record.id), notice: "Change undone."
+    rescue OpenLoam::Undo::NotUndoableError => error
+      redirect_to admin_history_path(type: @record.class.name, record_id: @record.id), alert: error.message
+    end
+
+    private
+
+    # History is a read path like any other: a field the role may not read must
+    # not come back here as an old → new pair.
+    def visible_changeset(audit)
+      policy = (@history_policy ||= policy_for(@record))
+
+      (audit.changeset || {}).each_with_object({}) do |(field, values), visible|
+        if field == "custom_fields"
+          readable = readable_custom_fields(values, policy)
+          visible[field] = readable if readable
+        elsif policy.readable?(field)
+          visible[field] = values
+        end
+      end
+    end
+
+    # Runtime fields are audited as one json blob, so the filter goes inside the
+    # old/new pair rather than dropping the whole entry.
+    def readable_custom_fields(values, policy)
+      return values unless values.is_a?(Array)
+
+      sides = values.map { |side| side.to_h.select { |name, _| policy.custom_field_readable?(name) } }
+      sides.any?(&:present?) ? sides : nil
+    end
+
+    # The target record, looked up through its OWN default scope (tenancy holds;
+    # a soft-deleted row is still reachable to restore). The type is whitelisted
+    # to a OpenLoam::TenantRecord — never a bare constantize of a param.
+    def set_target
+      klass = params[:type].to_s.safe_constantize
+      raise OpenLoam::NotAuthorizedError unless klass.is_a?(Class) && klass < OpenLoam::TenantRecord
+
+      scope = klass.respond_to?(:with_deleted) ? klass.with_deleted : klass.all
+      @record = scope.find(params[:record_id])
+    end
+  end
+end

data/lib/generators/{loam → open_loam}/install/templates/admin/history_index.html.erb

@@ -18,13 +18,13 @@ never reverted here.</p>
         <td><code><%%= audit.action %></code></td>
         <td><%%= audit.actor&.name || "—" %></td>
         <td>
-          <%% (audit.changeset || {}).each do |field, values| %>
+          <%% visible_changeset(audit).each do |field, values| %>
             <div><code><%%= field %></code>:
               <%%= values.is_a?(Array) ? "#{values.first.inspect} → #{values.last.inspect}" : values %></div>
           <%% end %>
         </td>
         <td>
-          <%% if Loam::Undo.undoable?(audit) %>
+          <%% if OpenLoam::Undo.undoable?(audit) %>
             <%%= button_to "Undo", admin_undo_history_path(id: audit.id, type: @record.class.name, record_id: @record.id),
                           form: { style: "display:inline" } %>
           <%% end %>

data/lib/generators/{loam → open_loam}/install/templates/admin/imports_controller.rb

@@ -2,7 +2,7 @@ module Admin
   # Generic CSV importer, scoped by entity_type — manager-only (a privileged bulk
   # mutation). Flow: new (upload) → preview (map columns) → create (dry-run
   # summary, or a backgrounded run reporting live progress). The mapping only
-  # offers fields the manager may write (Loam::Import.allowed_targets); a crafted
+  # offers fields the manager may write (OpenLoam::Import.allowed_targets); a crafted
   # target is refused by the engine.
   class ImportsController < BaseController
     before_action { require_role!(:manager) }
@@ -15,11 +15,11 @@ module Admin
     # Parse the uploaded file, show the mapping form + a few sample rows.
     def preview
       @csv = read_upload
-      preview = Loam::Import.preview(@csv)
+      preview = OpenLoam::Import.preview(@csv)
       @headers = preview[:headers]
       @sample = preview[:rows]
-      @targets = Loam::Import.allowed_targets(@model, current_actor).to_a.sort
-    rescue Loam::Error => error
+      @targets = OpenLoam::Import.allowed_targets(@model, current_actor).to_a.sort
+    rescue OpenLoam::Error => error
       redirect_to new_admin_import_path(entity_type: @entity_type), alert: error.message
     end
 
@@ -31,23 +31,23 @@ module Admin
       if params[:commit] == "Dry run"
         run_dry(mapping, match_key)
       else
-        ImportJob.perform_later(entity_type: @entity_type, csv: @csv, mapping: mapping,
+        ImportJob.perform_later(entity_type: @entity_type, blob_id: staged_csv_blob(@csv).id, mapping: mapping,
                                 match_key: match_key, tenant_id: current_tenant.id, actor_id: current_actor.id)
         redirect_to admin_progress_jobs_path, notice: "Import started — watch it progress under Tasks."
       end
-    rescue Loam::Error => error
+    rescue OpenLoam::Error => error
       redirect_to new_admin_import_path(entity_type: @entity_type), alert: error.message
     end
 
     # The failed rows as a fix-and-re-upload CSV.
     def download_errors
       @entity_type = params[:entity_type]
-      model = Loam::Import.allowed_model(@entity_type)
+      model = OpenLoam::Import.allowed_model(@entity_type)
       csv = params[:csv].to_s
       mapping = params[:mapping].to_unsafe_h.reject { |_h, target| target.blank? }
-      result = Loam::Import.run(csv, model: model, mapping: mapping, actor: current_actor,
+      result = OpenLoam::Import.run(csv, model: model, mapping: mapping, actor: current_actor,
                                 match_key: params[:match_key].presence, dry_run: true)
-      send_data Loam::Import.error_csv(result, csv),
+      send_data OpenLoam::Import.error_csv(result, csv),
                 filename: "#{@entity_type.underscore}-import-errors.csv", type: "text/csv"
     end
 
@@ -55,21 +55,33 @@ module Admin
 
     def set_model
       @entity_type = params[:entity_type]
-      @model = Loam::Import.allowed_model(@entity_type)
+      @model = OpenLoam::Import.allowed_model(@entity_type)
     end
 
     def run_dry(mapping, match_key)
-      @result = Loam::Import.run(@csv, model: @model, mapping: mapping, actor: current_actor,
+      @result = OpenLoam::Import.run(@csv, model: @model, mapping: mapping, actor: current_actor,
                                  match_key: match_key, dry_run: true)
-      @headers = Loam::Import.preview(@csv)[:headers]
+      @headers = OpenLoam::Import.preview(@csv)[:headers]
       render :summary
     end
 
     def read_upload
       file = params[:file]
-      raise Loam::Error, "choose a CSV file to upload" if file.blank?
+      raise OpenLoam::Error, "choose a CSV file to upload" if file.blank?
 
       file.read.force_encoding("UTF-8")
     end
+
+    # The CSV goes to blob storage and the JOB gets an id. ActiveJob arguments
+    # are serialized into the queue backend and echoed in the job log, so
+    # passing the file itself would leave every row sitting in the clear —
+    # including the columns headed for encrypted fields. ImportJob purges it.
+    def staged_csv_blob(csv)
+      ActiveStorage::Blob.create_and_upload!(
+        io: StringIO.new(csv),
+        filename: "#{@entity_type.underscore}-import-#{SecureRandom.hex(8)}.csv",
+        content_type: "text/csv"
+      )
+    end
   end
 end

data/lib/generators/{loam → open_loam}/install/templates/admin/inbound_webhook_sources_controller.rb

@@ -1,6 +1,6 @@
 module Admin
   # Manage the external systems allowed to POST webhooks into this tenant
-  # (Loam::InboundWebhookSource) — manager-only. Create a source (token + secret
+  # (OpenLoam::InboundWebhookSource) — manager-only. Create a source (token + secret
   # are generated), copy the receive URL and secret to the sender, rotate either,
   # toggle active, and see the most recent received deliveries.
   class InboundWebhookSourcesController < BaseController
@@ -8,16 +8,16 @@ module Admin
     before_action :set_source, only: %i[destroy rotate_secret rotate_token toggle]
 
     def index
-      @sources = Loam::InboundWebhookSource.order(:name)
-      @recent = Loam::InboundWebhookDelivery.order(received_at: :desc).limit(20)
+      @sources = OpenLoam::InboundWebhookSource.order(:name)
+      @recent = OpenLoam::InboundWebhookDelivery.order(received_at: :desc).limit(20)
     end
 
     def new
-      @source = Loam::InboundWebhookSource.new(event_name: "inbound.webhook.received")
+      @source = OpenLoam::InboundWebhookSource.new(event_name: "inbound.webhook.received")
     end
 
     def create
-      @source = Loam::InboundWebhookSource.new(source_params)
+      @source = OpenLoam::InboundWebhookSource.new(source_params)
       if @source.save
         redirect_to admin_inbound_webhook_sources_path, notice: "Source created. Copy the secret now — it signs every call."
       else
@@ -48,12 +48,12 @@ module Admin
     private
 
     def set_source
-      @source = Loam::InboundWebhookSource.find(params[:id])
+      @source = OpenLoam::InboundWebhookSource.find(params[:id])
     end
 
     def source_params
       params.require(:inbound_webhook_source).permit(
-        :name, :event_name, :signature_header, :delivery_id_header,
+        :name, :event_name, :signature_header,
         :timestamp_header, :timestamp_tolerance
       )
     end

data/lib/generators/{loam → open_loam}/install/templates/admin/inbound_webhook_sources_new.html.erb

@@ -14,13 +14,11 @@
     <%%= f.text_field :event_name %>
   </p>
   <p>
-    <%%= f.label :signature_header, "Signature header (default X-Loam-Signature)" %><br>
-    <%%= f.text_field :signature_header, placeholder: "X-Loam-Signature" %>
+    <%%= f.label :signature_header, "Signature header (default X-OpenLoam-Signature)" %><br>
+    <%%= f.text_field :signature_header, placeholder: "X-OpenLoam-Signature" %>
     <small>e.g. X-Hub-Signature-256 for GitHub.</small>
   </p>
   <p>
-    <%%= f.label :delivery_id_header, "Delivery-id header (optional, for dedupe)" %><br>
-    <%%= f.text_field :delivery_id_header %>
     <small>Blank = dedupe on a hash of the body.</small>
   </p>
   <p>

data/lib/generators/open_loam/install/templates/admin/layout.html.erb

@@ -0,0 +1,76 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Admin</title>
+    <%%= csrf_meta_tags %>
+    <%%= stylesheet_link_tag "admin", media: "all" %>
+  </head>
+  <body>
+    <%% flash.each do |type, message| %>
+      <div class="flash flash-<%%= type.to_s == "alert" ? "alert" : "notice" %>"><%%= message %></div>
+    <%% end %>
+    <%% if defined?(current_tenant) && current_tenant %>
+      <div class="context">
+        <%%= t("open_loam.chrome.tenant") %>: <strong><%%= current_tenant.name %></strong> ·
+        <%%= t("open_loam.chrome.user") %>: <strong><%%= current_actor&.name %></strong> ·
+        <%%= button_to t("open_loam.chrome.sign_out"), admin_session_path, method: :delete, form: { style: "display:inline" } %>
+      </div>
+      <nav>
+        <%%= link_to t("open_loam.nav.dashboard"), admin_root_path %>
+        <%%= link_to admin_notifications_path do %><%%= t("open_loam.nav.notifications") %> (<span id="open-loam-notification-count"><%%= unread_notification_count %></span>)<%% end %>
+        <%%= link_to t("open_loam.nav.api_tokens"), admin_api_tokens_path %>
+        <%%= link_to t("open_loam.nav.security"), admin_mfa_path %>
+        <%%= link_to "#{t('open_loam.nav.approvals')} (#{pending_approval_count})", admin_pending_actions_path %>
+        <%%= link_to t("open_loam.nav.settings"), admin_configs_path %>
+        <%%= link_to t("open_loam.nav.features"), admin_features_path %>
+        <%%= link_to t("open_loam.nav.rules"), admin_business_rules_path %>
+        <%%= link_to t("open_loam.nav.sso"), admin_sso_providers_path %>
+        <%%= link_to t("open_loam.nav.dictionaries"), admin_dictionaries_path %>
+        <%%= link_to t("open_loam.nav.tasks"), admin_progress_jobs_path %>
+        <%%= link_to t("open_loam.nav.schedules"), admin_scheduled_jobs_path %>
+        <%%= link_to t("open_loam.nav.deliveries"), admin_event_deliveries_path %>
+        <%%= link_to t("open_loam.nav.inbound"), admin_inbound_webhook_sources_path %>
+        <%%= link_to t("open_loam.nav.api_docs"), admin_api_docs_path %>
+        <%%= link_to t("open_loam.nav.overrides"), admin_overrides_path %>
+        <%%= form_with url: admin_search_path, method: :get, class: "search" do %>
+          <%%= text_field_tag :q, params[:q], placeholder: t("open_loam.chrome.search") %>
+        <%% end %>
+        <%%# Locale switcher (OpenLoam::Translatable): overlays content onto the picked language. %>
+        <%% if OpenLoam.locales.size > 1 %>
+          <span class="locale">
+            <%% OpenLoam.locales.each do |loc| %><%%= link_to loc.upcase, "#{request.path}?locale=#{loc}", style: (loc == current_locale ? "font-weight:bold" : "") %> <%% end %>
+          </span>
+        <%% end %>
+      </nav>
+
+      <%%# Live updates over SSE (OpenLoam::EventStream). Degrades gracefully: if
+          EventSource is unavailable or the stream drops, the per-page-load bell
+          count above still works. %>
+      <script>
+        (function () {
+          if (typeof EventSource === "undefined") return;
+          var source = new EventSource("<%%= admin_events_stream_path %>");
+          source.addEventListener("open_loam.notification.created", function () {
+            var badge = document.getElementById("open-loam-notification-count");
+            if (badge) badge.textContent = (parseInt(badge.textContent, 10) || 0) + 1;
+          });
+          // Live task progress (OpenLoam::ProgressJob): move the matching bar. The
+          // frame carries only id/percent/status.
+          source.addEventListener("open_loam.progress.updated", function (e) {
+            var d = JSON.parse(e.data);
+            var fill = document.getElementById("progress-fill-" + d.id);
+            if (fill) fill.style.width = d.percent + "%";
+            var pct = document.getElementById("progress-percent-" + d.id);
+            if (pct) pct.textContent = d.percent + "%";
+            var st = document.getElementById("progress-status-" + d.id);
+            if (st) st.textContent = d.status;
+          });
+          source.onerror = function () {
+            if (source.readyState === EventSource.CLOSED) source.close();
+          };
+        })();
+      </script>
+    <%% end %>
+    <%%= yield %>
+  </body>
+</html>

data/lib/generators/{loam → open_loam}/install/templates/admin/mfa_controller.rb

@@ -6,6 +6,11 @@ module Admin
   # old secret stays valid until the new one is proven — so neither a cross-site
   # GET nor an abandoned re-enrollment can downgrade an active credential.
   class MfaController < BaseController
+    skip_authorization! "Your own MFA credentials; sensitive changes go through require_sudo! instead."
+
+    # This IS the enrollment screen the requirement sends people to.
+    skip_before_action :require_mfa_enrollment!
+
     # Shown in authenticator apps as the account issuer; defaults to the app name.
     ISSUER = Rails.application.class.module_parent_name.freeze
 
@@ -15,7 +20,7 @@ module Admin
     before_action :require_sudo!, only: %i[create destroy], if: :active_mfa?
 
     def show
-      @credential = Loam::MfaCredential.active_for(current_actor)
+      @credential = OpenLoam::MfaCredential.active_for(current_actor)
     end
 
     # READ-ONLY: mint a candidate secret into the (encrypted cookie) session and
@@ -28,7 +33,7 @@ module Admin
     # recovery codes once. The active secret is replaced only on success.
     def create
       secret = session[:mfa_enrollment_secret]
-      credential = Loam::MfaCredential.find_or_initialize_by(user_id: current_actor.id)
+      credential = OpenLoam::MfaCredential.find_or_initialize_by(user_id: current_actor.id)
       @recovery_codes = secret && credential.activate_with!(secret, params[:code])
 
       if @recovery_codes
@@ -42,7 +47,7 @@ module Admin
     end
 
     def destroy
-      Loam::MfaCredential.where(user_id: current_actor.id).delete_all
+      OpenLoam::MfaCredential.where(user_id: current_actor.id).delete_all
       session.delete(:mfa_enrollment_secret)
       redirect_to admin_mfa_path, notice: "Two-factor authentication disabled."
     end
@@ -50,12 +55,12 @@ module Admin
     private
 
     def set_enrollment_secret
-      @secret = (session[:mfa_enrollment_secret] ||= Loam::Totp.generate_secret)
-      @provisioning_uri = Loam::Totp.provisioning_uri(@secret, account: current_actor.email, issuer: ISSUER)
+      @secret = (session[:mfa_enrollment_secret] ||= OpenLoam::Totp.generate_secret)
+      @provisioning_uri = OpenLoam::Totp.provisioning_uri(@secret, account: current_actor.email, issuer: ISSUER)
     end
 
     def active_mfa?
-      Loam::MfaCredential.active_for(current_actor).present?
+      OpenLoam::MfaCredential.active_for(current_actor).present?
     end
   end
 end

data/lib/generators/{loam → open_loam}/install/templates/admin/notifications_controller.rb

@@ -1,10 +1,12 @@
 module Admin
   # The bell. Every query here is scoped to the current actor, so there is no
   # "read someone else's notifications" path to authorize and no per-record
-  # policy to write: tenancy is structural (Loam::Notification is a
-  # Loam::TenantRecord) and BaseController has already established that this
+  # policy to write: tenancy is structural (OpenLoam::Notification is a
+  # OpenLoam::TenantRecord) and BaseController has already established that this
   # actor is signed in to this tenant. Recipient scoping is the whole rule.
   class NotificationsController < BaseController
+    skip_authorization! "Scoped to current_actor — there is no path to another user's notifications."
+
     def index
       @records = notifications.order(created_at: :desc).limit(100)
     end
@@ -17,7 +19,7 @@ module Admin
     private
 
     def notifications
-      Loam::Notification.where(user_id: current_actor.id)
+      OpenLoam::Notification.where(user_id: current_actor.id)
     end
   end
 end

data/lib/generators/{loam → open_loam}/install/templates/admin/overrides_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  # Read-only view of the app's Loam::Overrides — which registry entries are
+  # Read-only view of the app's OpenLoam::Overrides — which registry entries are
   # disabled or replaced, plus any STALE overrides (a key that no longer exists).
   # Manager-only, for legibility: it's config declared in an initializer, shown
   # here so an operator can see what's been customized without reading code.
@@ -7,8 +7,8 @@ module Admin
     before_action { require_role!(:manager) }
 
     def index
-      @overrides = Loam::Overrides.all
-      @stale = Loam::Overrides.stale
+      @overrides = OpenLoam::Overrides.all
+      @stale = OpenLoam::Overrides.stale
     end
   end
 end

data/lib/generators/{loam → open_loam}/install/templates/admin/overrides_index.html.erb

@@ -1,7 +1,7 @@
 <h1>Overrides</h1>
 
 <p>Registry entries this app disables or replaces (declared in
-<code>config/initializers/loam.rb</code> via <code>Loam::Overrides</code>) —
+<code>config/initializers/open_loam.rb</code> via <code>OpenLoam::Overrides</code>) —
 customization without forking. Structural pieces (views, controllers, routes)
 are overridden the Rails way (path shadowing), not here.</p>
 
@@ -18,7 +18,7 @@ are overridden the Rails way (path shadowing), not here.</p>
         <tr>
           <td><code><%%= registry %></code></td>
           <td><code><%%= key %></code></td>
-          <td><%%= value == Loam::Overrides::DISABLED ? "disabled" : "replaced" %></td>
+          <td><%%= value == OpenLoam::Overrides::DISABLED ? "disabled" : "replaced" %></td>
         </tr>
       <%% end %>
     <%% end %>

data/lib/generators/{loam → open_loam}/install/templates/admin/pending_actions_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  # The approval queue: staged mutations (Loam::PendingAction) waiting on a
+  # The approval queue: staged mutations (OpenLoam::PendingAction) waiting on a
   # human. Manager-only — approving EXECUTES the change. The workflow's role gate
   # is the deeper enforcement (approve!/reject! raise for a non-manager); this
   # screen is a manager screen on top of it.
@@ -8,7 +8,7 @@ module Admin
     before_action :set_pending_action, only: %i[approve reject]
 
     def index
-      @pending = Loam::PendingAction.pending.order(created_at: :desc)
+      @pending = OpenLoam::PendingAction.pending.order(created_at: :desc)
     end
 
     def approve
@@ -24,7 +24,7 @@ module Admin
     private
 
     def set_pending_action
-      @pending_action = Loam::PendingAction.find(params[:id])
+      @pending_action = OpenLoam::PendingAction.find(params[:id])
     end
 
     def approval_notice(pending)

data/lib/generators/{loam → open_loam}/install/templates/admin/perspectives_controller.rb

@@ -1,13 +1,18 @@
 module Admin
-  # Managing saved views (Loam::Perspective) for an entity. A view is CREATED by
+  # Managing saved views (OpenLoam::Perspective) for an entity. A view is CREATED by
   # "save current view" on the entity index (capturing the live filters/sort); it
   # starts private, owned by you. Here you rename it, widen its audience, make it
   # the default, or delete it.
   #
   # Who may manage a view: its owner always; a manager for role/tenant-visibility
   # ones. A private view of someone else's is invisible here by construction
-  # (Loam::Perspectives.visible_to never returns it).
+  # (OpenLoam::Perspectives.visible_to never returns it).
   class PerspectivesController < BaseController
+    # update/destroy/set_default authorize via authorize_manage!. index and create
+    # act only on the actor's own private views, so there is no subject to gate.
+    skip_authorization! "index lists views visible to the actor; create only ever makes a private one, owned by them.",
+                        only: %i[index create]
+
     before_action :set_perspective, only: %i[update destroy set_default]
     before_action :authorize_manage!, only: %i[update destroy set_default]
 
@@ -18,12 +23,12 @@ module Admin
 
     def index
       @entity_type = params[:entity_type].to_s
-      @perspectives = Loam::Perspectives.visible_to(@entity_type, user: current_actor)
+      @perspectives = OpenLoam::Perspectives.visible_to(@entity_type, user: current_actor)
     end
 
     # From the entity index: save the CURRENT filters/sort as a new private view.
     def create
-      perspective = Loam::Perspective.create!(
+      perspective = OpenLoam::Perspective.create!(
         entity_type: params[:entity_type].to_s,
         name: params[:name].presence || "Saved view",
         visibility: "private",
@@ -38,7 +43,7 @@ module Admin
       # the audience clears the default flag so it is re-chosen deliberately.
       attributes = perspective_params
       if attributes[:visibility].present? && attributes[:visibility] != @perspective.visibility
-        raise Loam::NotAuthorizedError if attributes[:visibility] != "private" && current_role != :manager
+        raise OpenLoam::NotAuthorizedError if attributes[:visibility] != "private" && current_role != :manager
 
         attributes[:is_default] = false
       end
@@ -64,11 +69,12 @@ module Admin
     private
 
     def set_perspective
-      @perspective = Loam::Perspective.find(params[:id])
+      @perspective = OpenLoam::Perspective.find(params[:id])
     end
 
     def authorize_manage!
-      raise Loam::NotAuthorizedError unless can_manage?(@perspective)
+      authorized!
+      raise OpenLoam::NotAuthorizedError unless can_manage?(@perspective)
     end
 
     # Owner always; a manager for shared (role/tenant) views. A private view of

data/lib/generators/{loam → open_loam}/install/templates/admin/perspectives_index.html.erb

@@ -24,7 +24,7 @@ or delete it.</p>
           <%% if perspective.owner_id == current_actor.id || (perspective.visibility != "private" && current_role == :manager) %>
             <%%= form_with url: admin_perspective_path(perspective, entity_type: @entity_type), method: :patch, class: "inline" do %>
               <%%= text_field_tag :"perspective[name]", perspective.name, size: 16 %>
-              <%%= select_tag :"perspective[visibility]", options_for_select(Loam::Perspective::VISIBILITIES, perspective.visibility) %>
+              <%%= select_tag :"perspective[visibility]", options_for_select(OpenLoam::Perspective::VISIBILITIES, perspective.visibility) %>
               <%%= text_field_tag :"perspective[role]", perspective.role, placeholder: "role", size: 8 %>
               <%%= submit_tag "Save" %>
             <%% end %>

data/lib/generators/open_loam/install/templates/admin/progress_jobs_controller.rb

@@ -0,0 +1,23 @@
+module Admin
+  # Long-running task progress (OpenLoam::ProgressJob) — a tenant-scoped list of
+  # recent jobs with a live bar (the open_loam.progress.updated SSE event updates it).
+  # Your app starts jobs with OpenLoam::Progress.start in its own background jobs;
+  # a running one can be cancelled cooperatively here.
+  class ProgressJobsController < BaseController
+    skip_authorization! "A tenant-scoped list of the tenant's own jobs; cancel is the gated action.",
+                        only: :index
+
+    def index
+      @jobs = OpenLoam::ProgressJob.recent.limit(20)
+    end
+
+    def cancel
+      job = OpenLoam::ProgressJob.find(params[:id])
+      # Manager-or-owner: a member must not cancel another user's job.
+      authorized!
+      raise OpenLoam::NotAuthorizedError unless current_role == :manager || job.actor_id == current_actor&.id
+      job.cancel! if job.running?
+      redirect_to admin_progress_jobs_path, notice: "Job cancelled."
+    end
+  end
+end

data/lib/generators/{loam → open_loam}/install/templates/admin/progress_jobs_index.html.erb

@@ -1,7 +1,7 @@
 <h1>Tasks</h1>
 
 <p>Long-running jobs report progress here live (no reload — pushed over SSE).
-Start one from your own code with <code>Loam::Progress.start(name:, total:)</code>.</p>
+Start one from your own code with <code>OpenLoam::Progress.start(name:, total:)</code>.</p>
 
 <table>
   <thead>

data/lib/generators/{loam → open_loam}/install/templates/admin/record_locks_controller.rb

@@ -1,16 +1,16 @@
 module Admin
-  # Manager take-over of an advisory edit lock (Loam::RecordLocks). Only a
+  # Manager take-over of an advisory edit lock (OpenLoam::RecordLocks). Only a
   # manager may force-release someone else's lock; the record it points at is
-  # resolved through a whitelist (a Loam::TenantRecord subclass), never a raw
+  # resolved through a whitelist (a OpenLoam::TenantRecord subclass), never a raw
   # constantize of user input.
   class RecordLocksController < BaseController
     before_action { require_role!(:manager) }
 
     def destroy
       klass = params[:lockable_type].to_s.safe_constantize
-      raise Loam::NotAuthorizedError unless klass && klass < Loam::TenantRecord
+      raise OpenLoam::NotAuthorizedError unless klass && klass < OpenLoam::TenantRecord
 
-      Loam::RecordLocks.force_release(klass.find(params[:lockable_id]))
+      OpenLoam::RecordLocks.force_release(klass.find(params[:lockable_id]))
       redirect_back fallback_location: admin_root_path, notice: "Lock released — you can edit now."
     end
   end