open-loam 0.1.1 → 0.3.0

data/lib/generators/{loam → open_loam}/install/templates/admin/scheduled_jobs_controller.rb

@@ -1,24 +1,24 @@
 module Admin
-  # Recurring schedules (Loam::ScheduledJob) — manager-only. List/create/edit/
+  # Recurring schedules (OpenLoam::ScheduledJob) — manager-only. List/create/edit/
   # delete a tenant's schedules, toggle active, and "run now". The runner
-  # (`loam:scheduler:tick`, wired to system cron) is what fires them on schedule.
+  # (`open_loam:scheduler:tick`, wired to system cron) is what fires them on schedule.
   class ScheduledJobsController < BaseController
     before_action { require_role!(:manager) }
     before_action :set_job, only: %i[edit update destroy run_now]
 
     def index
-      @jobs = Loam::ScheduledJob.order(:key)
+      @jobs = OpenLoam::ScheduledJob.order(:key)
     end
 
     def new
-      @job = Loam::ScheduledJob.new(scope: "tenant", active: true, schedule: "0 3 * * *")
+      @job = OpenLoam::ScheduledJob.new(scope: "tenant", active: true, schedule: "0 3 * * *")
     end
 
     def create
       # scope is forced to "tenant": a tenant admin must never create a
       # "system" schedule (which would run with no tenant context). System
       # schedules are created only by the app/console.
-      @job = Loam::ScheduledJob.new(job_params.merge(scope: "tenant"))
+      @job = OpenLoam::ScheduledJob.new(job_params.merge(scope: "tenant"))
       @job.next_run_at ||= safe_next_run(@job)
       if @job.save
         redirect_to admin_scheduled_jobs_path, notice: "Schedule created."
@@ -45,14 +45,14 @@ module Admin
     end
 
     def run_now
-      Loam::Scheduler.run_now(@job)
+      OpenLoam::Scheduler.run_now(@job)
       redirect_to admin_scheduled_jobs_path, notice: "#{@job.name} enqueued."
     end
 
     private
 
     def set_job
-      @job = Loam::ScheduledJob.find(params[:id])
+      @job = OpenLoam::ScheduledJob.find(params[:id])
     end
 
     def job_params

data/lib/generators/{loam → open_loam}/install/templates/admin/scheduled_jobs_form.html.erb

@@ -1,4 +1,4 @@
-<%%# Loam::ScheduledJob is namespaced, so pin the URL + param scope. %>
+<%%# OpenLoam::ScheduledJob is namespaced, so pin the URL + param scope. %>
 <%%= form_with model: @job, scope: :scheduled_job,
       url: (@job.persisted? ? admin_scheduled_job_path(@job) : admin_scheduled_jobs_path) do |f| %>
   <%% if @job.errors.any? %>

data/lib/generators/{loam → open_loam}/install/templates/admin/scheduled_jobs_index.html.erb

@@ -1,6 +1,6 @@
 <h1>Schedules</h1>
 
-<p>Recurring jobs for this tenant. The runner (<code>loam:scheduler:tick</code>,
+<p>Recurring jobs for this tenant. The runner (<code>open_loam:scheduler:tick</code>,
 wired to system cron) fires them on schedule. <%%= link_to "New schedule", new_admin_scheduled_job_path %></p>
 
 <table>

data/lib/generators/{loam → open_loam}/install/templates/admin/search_controller.rb

@@ -6,6 +6,8 @@ module Admin
   # tenant-scoped relation, so this can only ever find records the current
   # tenant owns.
   class SearchController < BaseController
+    skip_authorization! "Each model's `search` returns its own tenant-scoped relation; reads only."
+
     PER_ENTITY = 10
 
     helper_method :search_result_label
@@ -16,9 +18,9 @@ module Admin
     end
 
     # The first searchable column that has a value, plus the id — enough to
-    # recognise a record without Loam having to know what a "title" is.
+    # recognise a record without OpenLoam having to know what a "title" is.
     def search_result_label(record)
-      value = record.class.loam_searchable_columns.filter_map { |column| record.public_send(column).presence }.first
+      value = record.class.open_loam_searchable_columns.filter_map { |column| record.public_send(column).presence }.first
 
       [ value || record.model_name.human, "##{record.id}" ].join(" ")
     end
@@ -32,7 +34,7 @@ module Admin
       end.to_h
     end
 
-    # Every Loam entity that opted into search, in name order.
+    # Every OpenLoam entity that opted into search, in name order.
     #
     # This eager loads, unlike Admin::CommentsController, and for the opposite
     # reason: there is no user-supplied class name to check here, we need the
@@ -41,8 +43,8 @@ module Admin
     def searchable_models
       Rails.application.eager_load!
 
-      Loam::TenantRecord.descendants.select do |model|
-        model.name.present? && model.respond_to?(:loam_searchable?) && model.loam_searchable?
+      OpenLoam::TenantRecord.descendants.select do |model|
+        model.name.present? && model.respond_to?(:open_loam_searchable?) && model.open_loam_searchable?
       end.sort_by(&:name)
     end
   end

data/lib/generators/{loam → open_loam}/install/templates/admin/sessions_controller.rb

@@ -1,12 +1,12 @@
 module Admin
   # Email + password login for the admin, then (if the user has MFA) a TOTP
-  # challenge, then the tenant pick. A Loam user can belong to several tenants,
+  # challenge, then the tenant pick. A OpenLoam user can belong to several tenants,
   # so: authenticate → second factor → choose a tenant where they hold a
   # membership. The second factor runs BEFORE any tenant is chosen, which is why
-  # the MFA secret is keyed to the user, not a tenant (Loam::MfaCredential).
+  # the MFA secret is keyed to the user, not a tenant (OpenLoam::MfaCredential).
   #
   # Not a BaseController subclass: everything there assumes an established
-  # Loam::Current, which is exactly what this controller is trying to build.
+  # OpenLoam::Current, which is exactly what this controller is trying to build.
   class SessionsController < ActionController::Base
     layout "admin"
 
@@ -14,17 +14,17 @@ module Admin
       return redirect_to mfa_challenge_admin_session_path if session[:mfa_pending]
 
       @user = authenticated_user
-      @tenants = @user ? Loam::Membership.tenants_for(@user) : Loam::Tenant.none
+      @tenants = @user ? OpenLoam::Membership.tenants_for(@user) : OpenLoam::Tenant.none
     end
 
     def create
       email = params[:email]
 
-      # Rate-limit BEFORE touching the password (Loam::AuthThrottle). Throttle by
+      # Rate-limit BEFORE touching the password (OpenLoam::AuthThrottle). Throttle by
       # the submitted identifier whether or not the account exists, and give the
       # SAME generic locked response either way — so a lockout can't become an
       # account-existence oracle.
-      if Loam::AuthThrottle.locked?(email)
+      if OpenLoam::AuthThrottle.locked?(email)
         @error = throttle_message(email)
         return render :new, status: :too_many_requests
       end
@@ -32,20 +32,21 @@ module Admin
       user = User.authenticate_by(email: email, password: params[:password])
 
       if user.nil?
-        Loam::AuthThrottle.record_failure(email, kind: "password", ip: request.remote_ip)
+        OpenLoam::AuthThrottle.record_failure(email, kind: "password", ip: request.remote_ip)
         # One message for both cases on purpose: saying which half was wrong
         # tells an attacker which emails exist.
         @error = "Wrong email or password."
         return render :new, status: :unauthorized
       end
 
-      Loam::AuthThrottle.clear(email) # a successful login resets the counter
+      # PASSWORD only — clearing every kind here would reset the TOTP counter.
+      OpenLoam::AuthThrottle.clear(email, kind: "password")
       reset_session # a fresh session id at login: no fixation
       session[:user_id] = user.id
 
       # Password is only the first factor when MFA is active — hold the login in
       # a "pending" state (no tenant, no access) until the code checks out.
-      if Loam::MfaCredential.active_for(user)
+      if OpenLoam::MfaCredential.active_for(user)
         session[:mfa_pending] = true
         redirect_to mfa_challenge_admin_session_path
       else
@@ -58,27 +59,25 @@ module Admin
       @user = mfa_challenge_user or return redirect_to new_admin_session_path
     end
 
-    # TODO (follow-up): rate-limit / lock out repeated failed codes here (needs
-    # throttling infra) — a 6-digit TOTP is brute-forceable without it.
     def mfa_verify
       user = mfa_challenge_user or return redirect_to new_admin_session_path
 
       # A 6-digit TOTP (with drift, several codes valid) is the prime brute-force
       # target — lock it out on the user's identifier.
-      if Loam::AuthThrottle.locked?(user.email)
+      if OpenLoam::AuthThrottle.locked?(user.email)
         @user = user
         @error = throttle_message(user.email)
         return render :mfa_challenge, status: :too_many_requests
       end
 
-      credential = Loam::MfaCredential.active_for(user)
+      credential = OpenLoam::MfaCredential.active_for(user)
 
       if credential.verify_totp(params[:code]) || credential.consume_recovery_code(params[:code])
-        Loam::AuthThrottle.clear(user.email)
+        OpenLoam::AuthThrottle.clear(user.email, kind: "totp")
         session.delete(:mfa_pending)
         complete_authentication(user)
       else
-        Loam::AuthThrottle.record_failure(user.email, kind: "totp", ip: request.remote_ip)
+        OpenLoam::AuthThrottle.record_failure(user.email, kind: "totp", ip: request.remote_ip)
         # One generic error — never reveal whether a code was close or a
         # recovery code was already spent.
         @user = user
@@ -92,7 +91,7 @@ module Admin
     # back to password login. The `state` is our CSRF token for the round-trip.
     def sso_start
       email = params[:email].to_s
-      provider = Loam::Sso.provider_for(email: email)
+      provider = OpenLoam::Sso.provider_for(email: email)
 
       if provider.nil?
         return redirect_to new_admin_session_path(email: email),
@@ -105,8 +104,8 @@ module Admin
       session[:sso_provider_id] = provider.id
       session[:sso_tenant_id] = provider.tenant_id
 
-      url = Loam.as_tenant(provider.tenant) do
-        Loam::Sso.build(provider, redirect_uri: sso_callback_admin_session_url)
+      url = OpenLoam.as_tenant(provider.tenant) do
+        OpenLoam::Sso.build(provider, redirect_uri: sso_callback_admin_session_url)
                  .authorization_url(state: state, login_hint: email)
       end
       redirect_to url, allow_other_host: true
@@ -124,15 +123,15 @@ module Admin
         return redirect_to new_admin_session_path, alert: "SSO sign-in could not be verified. Please try again."
       end
 
-      tenant = Loam::Tenant.find_by(id: tenant_id)
-      provider = tenant && Loam.as_tenant(tenant) { Loam::SsoProvider.find_by(id: provider_id) }
+      tenant = OpenLoam::Tenant.find_by(id: tenant_id)
+      provider = tenant && OpenLoam.as_tenant(tenant) { OpenLoam::SsoProvider.find_by(id: provider_id) }
       if provider.nil? || !provider.active?
         return redirect_to new_admin_session_path, alert: "That SSO provider is no longer available."
       end
 
-      user = Loam.as_tenant(tenant) do
-        claims = Loam::Sso.build(provider, redirect_uri: sso_callback_admin_session_url).exchange(code: params[:code])
-        Loam::Sso.provision(provider, claims)
+      user = OpenLoam.as_tenant(tenant) do
+        claims = OpenLoam::Sso.build(provider, redirect_uri: sso_callback_admin_session_url).exchange(code: params[:code])
+        OpenLoam::Sso.provision(provider, claims)
       end
 
       reset_session
@@ -141,13 +140,13 @@ module Admin
 
       # SSO establishes primary auth; if the user also runs app-side MFA, still
       # require the second factor (the safe choice — SSO does not waive it).
-      if Loam::MfaCredential.active_for(user)
+      if OpenLoam::MfaCredential.active_for(user)
         session[:mfa_pending] = true
         redirect_to mfa_challenge_admin_session_path
       else
         complete_authentication(user)
       end
-    rescue Loam::Sso::Error
+    rescue OpenLoam::Sso::Error
       # An unverified email, a domain the provider does not own, or any other
       # provisioning refusal: no session, nothing linked, one generic message.
       reset_session
@@ -162,7 +161,7 @@ module Admin
       user = authenticated_user
       return redirect_to new_admin_session_path if user.nil?
 
-      tenant = Loam::Membership.tenants_for(user).find_by(id: params[:tenant_id])
+      tenant = OpenLoam::Membership.tenants_for(user).find_by(id: params[:tenant_id])
 
       # A tenant the user has no membership in is simply not in that list, so
       # picking one is impossible rather than merely forbidden.
@@ -173,7 +172,7 @@ module Admin
 
     def destroy
       reset_session
-      Loam::Current.reset
+      OpenLoam::Current.reset
       redirect_to new_admin_session_path
     end
 
@@ -184,7 +183,7 @@ module Admin
     end
 
     def throttle_message(identifier)
-      minutes = (Loam::AuthThrottle.remaining_lockout(identifier) / 60.0).ceil
+      minutes = (OpenLoam::AuthThrottle.remaining_lockout(identifier) / 60.0).ceil
       "Too many attempts. Try again in about #{[ minutes, 1 ].max} minute(s)."
     end
 
@@ -206,11 +205,11 @@ module Admin
       # SSO knows exactly which tenant to enter (the IdP's), so honor it even for
       # a multi-tenant user rather than showing the picker.
       if (sso_tenant_id = session.delete(:sso_tenant_id))
-        tenant = Loam::Membership.tenants_for(user).find_by(id: sso_tenant_id)
+        tenant = OpenLoam::Membership.tenants_for(user).find_by(id: sso_tenant_id)
         return enter(user, tenant) if tenant
       end
 
-      tenants = Loam::Membership.tenants_for(user)
+      tenants = OpenLoam::Membership.tenants_for(user)
 
       if tenants.one?
         enter(user, tenants.first)
@@ -237,11 +236,11 @@ module Admin
     # resolved in that tenant). If the user's role is on the list and they have
     # no active credential, they are sent to enrollment before they can work.
     def mfa_enrollment_required?(user, tenant)
-      return false if Loam::MfaCredential.active_for(user)
+      return false if OpenLoam::MfaCredential.active_for(user)
 
-      Loam.as_tenant(tenant) do
-        role = Loam::Membership.find_by(user_id: user.id)&.role
-        role.present? && Array(Loam::Configs.get("security.mfa_required_roles", default: [])).include?(role)
+      OpenLoam.as_tenant(tenant) do
+        role = OpenLoam::Membership.find_by(user_id: user.id)&.role
+        role.present? && Array(OpenLoam::Configs.get("security.mfa_required_roles", default: [])).include?(role)
       end
     end
   end

data/lib/generators/{loam → open_loam}/install/templates/admin/sso_providers_controller.rb

@@ -1,6 +1,6 @@
 module Admin
   # Configure this tenant's SSO (OIDC) provider — manager-only, since it governs
-  # who can sign in and at what role. Tenant-scoped by Loam::SsoProvider's default
+  # who can sign in and at what role. Tenant-scoped by OpenLoam::SsoProvider's default
   # scope, so a manager only ever sees and edits their own tenant's connection.
   # The client_secret is WRITE-ONLY: it is encrypted at rest and never rendered
   # back, so editing without retyping it leaves the stored secret untouched.
@@ -10,20 +10,20 @@ module Admin
 
     rescue_from JSON::ParserError do |error|
       flash.now[:alert] = "The group→role map must be valid JSON: #{error.message}"
-      @provider ||= Loam::SsoProvider.new
+      @provider ||= OpenLoam::SsoProvider.new
       render(@provider.persisted? ? :edit : :new, status: :unprocessable_entity)
     end
 
     def index
-      @providers = Loam::SsoProvider.order(:domain)
+      @providers = OpenLoam::SsoProvider.order(:domain)
     end
 
     def new
-      @provider = Loam::SsoProvider.new(protocol: "oidc", active: true, jit_role: "employee")
+      @provider = OpenLoam::SsoProvider.new(protocol: "oidc", active: true, jit_role: "employee")
     end
 
     def create
-      @provider = Loam::SsoProvider.new(provider_params)
+      @provider = OpenLoam::SsoProvider.new(provider_params)
       if @provider.save
         redirect_to admin_sso_providers_path, notice: "SSO provider created."
       else
@@ -49,7 +49,7 @@ module Admin
     private
 
     def set_provider
-      @provider = Loam::SsoProvider.find(params[:id])
+      @provider = OpenLoam::SsoProvider.find(params[:id])
     end
 
     def provider_params

data/lib/generators/{loam → open_loam}/install/templates/admin/sso_providers_form.html.erb

@@ -2,8 +2,8 @@
   <p style="color:#b00"><%%= @error || flash[:alert] %></p>
 <%% end %>
 
-<%# The model is namespaced (Loam::SsoProvider), so an inferred URL/param-scope
-    would be admin_loam_sso_provider_path / loam_sso_provider[...]. Pin both to
+<%# The model is namespaced (OpenLoam::SsoProvider), so an inferred URL/param-scope
+    would be admin_open_loam_sso_provider_path / open_loam_sso_provider[...]. Pin both to
     the un-namespaced route and the "sso_provider" key the controller permits. %>
 <%%= form_with model: @provider, scope: :sso_provider,
       url: (@provider.persisted? ? admin_sso_provider_path(@provider) : admin_sso_providers_path) do |f| %>

data/lib/generators/{loam → open_loam}/install/templates/admin/sso_providers_index.html.erb

@@ -4,9 +4,15 @@
 below is sent to that identity provider to sign in (OIDC), and provisioned on
 first login. <%%= link_to "New provider", new_admin_sso_provider_path %></p>
 
+<p>A provider does nothing until an operator confirms your organisation owns the
+domain — anyone can type a domain here, so the claim has to be checked off the
+admin path. Ask your operator to run
+<code>rake open_loam:sso:verify_domain[&lt;id&gt;]</code>. Editing the domain
+later clears the confirmation.</p>
+
 <table>
   <thead>
-    <tr><th>Name</th><th>Protocol</th><th>Domain</th><th>JIT role</th><th>Active</th><th></th></tr>
+    <tr><th>Name</th><th>Protocol</th><th>Domain</th><th>Ownership</th><th>JIT role</th><th>Active</th><th></th></tr>
   </thead>
   <tbody>
     <%% @providers.each do |provider| %>
@@ -14,6 +20,7 @@ first login. <%%= link_to "New provider", new_admin_sso_provider_path %></p>
         <td><%%= provider.name %></td>
         <td><%%= provider.protocol %></td>
         <td><code><%%= provider.domain %></code></td>
+        <td><%%= provider.domain_verified? ? "confirmed" : "not confirmed — SSO is inactive" %></td>
         <td><%%= provider.jit_role %></td>
         <td><%%= provider.active? ? "yes" : "no" %></td>
         <td>

data/lib/generators/{loam → open_loam}/install/templates/admin/sudo_controller.rb

@@ -4,24 +4,26 @@ module Admin
   # (or TOTP code, if the user has MFA) stamps a fresh sudo timestamp and returns
   # to wherever they were headed.
   class SudoController < BaseController
+    skip_authorization! "The step-up re-challenge itself — authorizing it would require the sudo it grants."
+
     def new
     end
 
     def create
       identifier = "#{current_actor.email}:sudo"  # a distinct throttle bucket from login
 
-      if Loam::AuthThrottle.locked?(identifier)
+      if OpenLoam::AuthThrottle.locked?(identifier)
         @error = "Too many attempts. Try again later."
         return render :new, status: :too_many_requests
       end
 
       if reauthenticated?
-        Loam::AuthThrottle.clear(identifier)
+        OpenLoam::AuthThrottle.clear(identifier, kind: "sudo")
         session[:sudo_at] = Time.now.to_i
         redirect_to(session.delete(:sudo_return_to).presence || admin_root_path,
                     notice: "Re-authenticated — you can complete the action now.")
       else
-        Loam::AuthThrottle.record_failure(identifier, kind: "sudo", ip: request.remote_ip)
+        OpenLoam::AuthThrottle.record_failure(identifier, kind: "sudo", ip: request.remote_ip)
         @error = "That did not verify. Try again."
         render :new, status: :unauthorized
       end
@@ -32,9 +34,9 @@ module Admin
     # If the user has MFA, step-up takes a TOTP code — NOT a recovery code:
     # recovery codes are single-use and reserved for LOGIN, so a routine sudo
     # must never silently burn one. Otherwise fall back to the password. Either
-    # way it is the SAME person in Loam::Current re-confirming.
+    # way it is the SAME person in OpenLoam::Current re-confirming.
     def reauthenticated?
-      credential = Loam::MfaCredential.active_for(current_actor)
+      credential = OpenLoam::MfaCredential.active_for(current_actor)
       if credential
         credential.verify_totp(params[:code])
       else

data/lib/generators/{loam → open_loam}/install/templates/admin/sudo_new.html.erb

@@ -7,7 +7,7 @@
 <p>This action is sensitive, so please re-authenticate.</p>
 
 <%%= form_with url: admin_sudo_path, method: :post do |f| %>
-  <%% if Loam::MfaCredential.active_for(current_actor) %>
+  <%% if OpenLoam::MfaCredential.active_for(current_actor) %>
     <p>
       <%%= label_tag :code, "Authenticator code" %><br>
       <%%= text_field_tag :code, nil, autofocus: true, autocomplete: "one-time-code", inputmode: "numeric" %>

data/lib/generators/{loam → open_loam}/install/templates/admin/translations_controller.rb

@@ -1,7 +1,7 @@
 module Admin
-  # Per-record content translations (Loam::Translatable) — manager-only, since
+  # Per-record content translations (OpenLoam::Translatable) — manager-only, since
   # translating content is a privileged edit. Scoped by translatable_type +
-  # translatable_id; edits each translatable field across Loam.locales. The base
+  # translatable_id; edits each translatable field across OpenLoam.locales. The base
   # (default-locale) value stays on the record itself and is shown read-only for
   # reference — translations are additive.
   class TranslationsController < BaseController
@@ -12,9 +12,9 @@ module Admin
 
     def update
       params.require(:translations).to_unsafe_h.each do |field, by_locale|
-        next unless @record.class.loam_translatable?(field)
+        next unless @record.class.open_loam_translatable?(field)
 
-        by_locale.each { |locale, value| @record.set_translation(field, locale, value) if Loam.locales.include?(locale) }
+        by_locale.each { |locale, value| @record.set_translation(field, locale, value) if OpenLoam.locales.include?(locale) }
       end
       redirect_to translate_path, notice: "Translations saved."
     end
@@ -22,11 +22,11 @@ module Admin
     private
 
     def set_record
-      model = Loam::Import.allowed_model(params[:translatable_type]) # whitelist: a Loam entity only
-      raise ActiveRecord::RecordNotFound unless model.include?(Loam::Translatable)
+      model = OpenLoam::Import.allowed_model(params[:translatable_type]) # whitelist: a OpenLoam entity only
+      raise ActiveRecord::RecordNotFound unless model.include?(OpenLoam::Translatable)
 
       @record = model.find(params[:translatable_id])
-      @fields = model.loam_translatable_attributes
+      @fields = model.open_loam_translatable_attributes
     end
 
     def translate_path

data/lib/generators/{loam → open_loam}/install/templates/admin/translations_index.html.erb

@@ -1,14 +1,14 @@
 <h1>Translations — <%%= @record.class.model_name.human %> #<%%= @record.id %></h1>
 
-<p>Translate content per locale. The base (<%%= Loam.default_locale.upcase %>) value
+<p>Translate content per locale. The base (<%%= OpenLoam.default_locale.upcase %>) value
 stays on the record; other locales overlay onto it, falling back to the base when
 empty.</p>
 
 <%%= form_with url: translate_path, method: :patch do %>
   <%% @fields.each do |field| %>
     <h3><%%= field.humanize %></h3>
-    <p><em>Base (<%%= Loam.default_locale.upcase %>):</em> <%%= @record.read_attribute(field) %></p>
-    <%% (Loam.locales - [Loam.default_locale]).each do |locale| %>
+    <p><em>Base (<%%= OpenLoam.default_locale.upcase %>):</em> <%%= @record.read_attribute(field) %></p>
+    <%% (OpenLoam.locales - [OpenLoam.default_locale]).each do |locale| %>
       <p>
         <%%= label_tag "translations[#{field}][#{locale}]", locale.upcase %><br>
         <%%= text_field_tag "translations[#{field}][#{locale}]", @record.translations_for(field)[locale] %>

data/lib/generators/{loam → open_loam}/install/templates/admin/webhook_endpoints_controller.rb

@@ -6,15 +6,15 @@ module Admin
     before_action { require_role!(:manager) }
 
     def index
-      @records = Loam::WebhookEndpoint.order(:event_pattern)
+      @records = OpenLoam::WebhookEndpoint.order(:event_pattern)
     end
 
     def new
-      @record = Loam::WebhookEndpoint.new(active: true)
+      @record = OpenLoam::WebhookEndpoint.new(active: true)
     end
 
     def create
-      @record = Loam::WebhookEndpoint.new(permitted_params)
+      @record = OpenLoam::WebhookEndpoint.new(permitted_params)
 
       if @record.save
         redirect_to admin_webhook_endpoints_path
@@ -24,7 +24,7 @@ module Admin
     end
 
     def destroy
-      Loam::WebhookEndpoint.find(params[:id]).destroy!
+      OpenLoam::WebhookEndpoint.find(params[:id]).destroy!
       redirect_to admin_webhook_endpoints_path
     end
 

data/lib/generators/{loam → open_loam}/install/templates/admin/webhook_endpoints_index.html.erb

@@ -28,5 +28,5 @@ domain ("rental."); anything else is one exact event name.</p>
   </tbody>
 </table>
 
-<p>Each delivery is signed: <code>X-Loam-Signature: sha256=HMAC-SHA256(secret, body)</code>.
+<p>Each delivery is signed: <code>X-OpenLoam-Signature: sha256=HMAC-SHA256(secret, body)</code>.
 Recompute it on your side and reject anything that does not match.</p>

data/lib/generators/{loam → open_loam}/install/templates/admin.css

@@ -1,4 +1,4 @@
-/* Loam admin console — shared styles (extracted from the layout, L-402). */
+/* OpenLoam admin console — shared styles (extracted from the layout, L-402). */
 body { font-family: system-ui, -apple-system, sans-serif; margin: 2rem; color: #1c1c1a; line-height: 1.5; }
 h1 { font-size: 1.55rem; margin: 0 0 0.75rem; }
 h2 { font-size: 1.2rem; margin: 1.25rem 0 0.5rem; }