open-loam 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7fda058767d913097dee8faac85c9957d680233405c3d57004cf786a9ccc155d
-  data.tar.gz: 87763cfa7c0fa23c24111d8dceda31d73c491b6b8ead4cd1559aaeb742c7df2e
+  metadata.gz: 48bb3940900ff3d8ee4f6a8dc499779b3d00ed9ff37ceeab4849d36662377a47
+  data.tar.gz: 65440f973fc99d793ae2439cb1a1b373cd7f79d41c82398fd8d59c6e4dcba784
 SHA512:
-  metadata.gz: 1d40e81813088308a110726cea561b9a2fa4496658e95b7292e64af28473d2363a6b629546892989fae52abd05cd13bddc76578fdd08257fed60f8736ca37efc
-  data.tar.gz: 97caae5c7991ccadff19905a0224959aa9c40b1c446dfc39dcae4a51bb575ce685c579d24836e92069c7b8b4788c20002d519e3e613556967c4e43e63bd90f87
+  metadata.gz: a091472e49805c7fffe3aa95a6ddfd0ffc02fea5c7e8d368443be195854e5bdd87b4b7b7635d4c7024842d4a62015d55e6a63064009d13cce8158fff3b7bb207
+  data.tar.gz: 10546c0bc5b0e6facacf2ede136cd930aa3851c833ae05aa908f990bc60ea02db3efccf1483b5577c0ba4d5cf7136b369c31956a3d1c989444824a1f87836c08

data/CHANGELOG.md

@@ -5,6 +5,122 @@ with the caveat that 0.x releases may break the public surface; the
 [backward-compatibility contract](BACKWARD_COMPATIBILITY.md) names what is
 frozen and what is not.
 
+## 0.3.0 — 2026-09-05
+
+### Security
+
+A full-repo audit found 16 issues. Fifteen are fixed here, each with a regression
+test verified by reverting the fix and confirming the test fails; the sixteenth
+is the demo app's committed `master.key`, which is accepted — the demo holds no
+real data and must never be deployed. **Anyone running 0.2.0 or earlier should
+upgrade**, and the migration below is not optional: three steps change stored
+data.
+
+Worst first:
+
+- **Cross-tenant account takeover through SSO.** A tenant could register a domain
+  it did not own and be handed the matching global account, then select any
+  tenant that account belonged to. A provider now does nothing until an operator
+  confirms ownership out of band (`rake open_loam:sso:verify_domain`), and
+  editing `domain` revokes the confirmation.
+- **The MFA lockout was bypassable** — a password success cleared the TOTP
+  counter, so a 6-digit code could be brute-forced without limit. Each factor now
+  clears only its own attempts.
+- **`readable:` field rules were ignored on most read paths** — the JSON API, the
+  generated admin index/show/form, the custom-fields partial, the CSV export,
+  the history screen and the edit-conflict diff all served restricted values.
+  Sorting by an unreadable column is refused too: ordering leaks a ranking even
+  when the values are hidden. A model with no policy class no longer falls back
+  to the base policy, which answered "any member" to everything.
+- **API tokens were stored in plaintext.** A SHA-256 digest is persisted now and
+  the value is shown once. Offboarding a user ends their machine access, and
+  managers can revoke another member's token — previously nobody could.
+- **SSRF through tenant-supplied URLs** — webhook endpoints and the SSO issuer
+  were both fetched unvalidated. `OpenLoam::OutboundUrl` checks shape at save and
+  pins the resolved address at fetch, so DNS rebinding cannot swap the target
+  after the check. The issuer must now be `https`.
+- **Inbound webhook replay** — the dedupe key came from an unsigned header, so
+  one captured delivery could re-publish its event without limit. `external_id`
+  is now the body hash, the only signed material.
+- **A staged change was applied without checks.** The target must now be a
+  `TenantRecord`, and approval runs the approver's own policy — both the action
+  (`create?`/`update?`/`destroy?`) and the fields the changeset writes.
+- **`security.mfa_required_roles` was advisory** — enrollment was redirected to
+  at login and never checked again. Now enforced on every request.
+- **Master-key rotation was impossible**, despite being the documented answer to
+  key compromise. Set `OPEN_LOAM_PREVIOUS_MASTER_KEY` to the outgoing key and
+  `open_loam:encryption:rotate` works.
+- **The blind-index key ignored table and column**, so one value hashed alike
+  across every searchable encrypted column. It now binds both, like the AAD.
+- **The uploaded import CSV** sat in the clear in the queue backend and the
+  request log. It goes to blob storage now, and the job purges it.
+- **Brakeman never scanned the gem**, only `demo/`. CI now scans both, which
+  surfaced four warnings, all fixed. CI's `GITHUB_TOKEN` is read-only, and the
+  repository has secret scanning, push protection and private vulnerability
+  reporting enabled.
+
+Report vulnerabilities through [private reporting](https://github.com/DeliveristsIO/open-loam/security/advisories/new),
+not a public issue.
+
+#### Migration
+
+- `open_loam_api_tokens`: add `token_digest`, backfill `sha256(token)` per row,
+  drop `token`. Tokens in use keep working. See the demo's
+  `hash_open_loam_api_tokens`.
+- `open_loam_sso_providers`: add `domain_verified_at`, then run
+  `rake open_loam:sso:verify_domain[<id>]` for each provider you actually own.
+  Until you do, SSO will not resolve for it.
+- Searchable encrypted fields: re-index by running
+  `rake open_loam:encryption:rotate[Model,tenant_id]` for each model that has
+  one. The blind-index derivation changed, so existing `<field>_hash` values no
+  longer match.
+- `delivery_id_header` on inbound webhook sources is gone; the column can be
+  dropped.
+
+### Added
+
+- **The event log — `OpenLoam::EventLog` + `OpenLoam::EventRecord`.** Every
+  published event is captured as an append-only, tenant-scoped row, so a
+  tenant's history is queryable and replayable rather than only observable live.
+  `EventLog.read(name_or_prefix, since:, limit:)` and `EventLog.replay(...)` take
+  the same patterns as `Events.subscribe`. `OpenLoam::DurableEvents` had made
+  *delivery* durable; this closes *capture*, which its contract explicitly did
+  not cover.
+
+  Capture is on by default and captures everything except
+  `OpenLoam.uncaptured_events` (default: `["open_loam.progress."]`). It runs
+  inline, so a failed insert propagates into the publishing operation. Retention
+  is `OpenLoam.event_log_retention` (90 days), swept per tenant by
+  `OpenLoam::EventLogPruneJob`. New apps get the table from
+  `rails g open_loam:install`; existing apps need the
+  `create_open_loam_event_records` migration.
+
+- **An authorization-called guard in the generated base controllers** (L-202).
+  `verify_authorized!` fails any admin or API action that finished without
+  calling `authorize!`, `require_role!` or `require_permission!`. Forgetting the
+  check was previously silent — the screen just rendered. Screens authorized
+  structurally declare `skip_authorization! "<reason>"`, and the reason is
+  required, so every exemption is a documented claim.
+
+  It runs *after* the action, so it is a development and test guard, not a
+  runtime access-control layer. It raises `OpenLoam::AuthorizationNotPerformedError`,
+  deliberately not a `NotAuthorizedError` — a developer bug must not render as a
+  polite 403.
+
+  Turning it on found two generated actions that never checked `read?` while
+  their `show`/`deleted` siblings did: the admin and JSON `index`. Both now
+  authorize. Existing apps will see the guard fire on any action of their own
+  that never authorized.
+
+### Changed
+
+- **The four "wrap a proven gem" roadmap items are resolved**, recorded in
+  [ADR 0007](docs/_adr/0007-proven-gem-swaps-resolved.md). Tenancy (L-201) and
+  audit (L-203) stay in-gem for good; the Pundit swap (L-202) is declined, but
+  the gap it exposed — no `verify_authorized`-equivalent guard — is tracked
+  separately. L-204 is the event log above. No public `OpenLoam::` contract
+  changed.
+
 ## 0.2.0 — 2026-09-05
 
 ### BREAKING

data/README.md

@@ -136,8 +136,10 @@ whole thesis in miniature.
 **How honest the "prototype" label is** — deliberately, each pillar is a
 *minimal in-gem implementation* rather than a wrapper around
 `acts_as_tenant`/`pundit`/`paper_trail`/Rails Event Store: the smallest surface
-that proves the conventions and the agent flow. Swapping the proven gems back in
-*behind the same `OpenLoam::` conventions* is the roadmap, not a reversal. Custom
+that proves the conventions and the agent flow. Those swaps have since been
+evaluated one at a time and settled — the in-gem versions stay, and the one real
+gap they exposed (event capture) was closed in-gem too, in
+[ADR 0007](docs/_adr/0007-proven-gem-swaps-resolved.md). Custom
 fields use the portable Rails `json` column (not Postgres `jsonb`/GIN) because
 the demo runs on SQLite. See [How OpenLoam works](docs/_foundation/overview.md) for
 the pillar-by-pillar breakdown and the decisions behind them.

data/app/jobs/open_loam/event_log_prune_job.rb

@@ -0,0 +1,15 @@
+module OpenLoam
+  # Enforces the event log's retention window (OpenLoam::EventLog.prune).
+  # Registered per-tenant in OpenLoam::Engine, so it runs inside one tenant and
+  # never deletes across the boundary.
+  class EventLogPruneJob < ActiveJob::Base
+    queue_as :default
+
+    def perform(tenant_id: nil)
+      tenant = OpenLoam::Tenant.find_by(id: tenant_id)
+      return if tenant.nil?
+
+      OpenLoam.as_tenant(tenant) { OpenLoam::EventLog.prune }
+    end
+  end
+end

data/app/jobs/open_loam/webhook_delivery_job.rb

@@ -13,6 +13,10 @@ module OpenLoam
   class WebhookDeliveryJob < ActiveJob::Base
     queue_as :default
 
+    # A URL that points inside the perimeter will never become deliverable by
+    # retrying, and retrying is itself the SSRF attempt repeated.
+    discard_on OpenLoam::OutboundUrl::BlockedError
+
     TIMEOUT_SECONDS = 5
 
     def self.body_for(event_name, payload, tenant_id)
@@ -40,9 +44,14 @@ module OpenLoam
     private
 
     def deliver(endpoint, body, event_name)
-      uri = URI.parse(endpoint.url)
+      # Re-checked at delivery, not just at save: the URL was validated when the
+      # tenant entered it, but DNS can be repointed at an internal address any
+      # time afterwards. Connecting to the address we just checked closes the
+      # window between the check and the connection.
+      uri, address = OpenLoam::OutboundUrl.resolve!(endpoint.url)
 
       http = Net::HTTP.new(uri.host, uri.port)
+      http.ipaddr = address
       http.use_ssl = uri.scheme == "https"
       http.open_timeout = TIMEOUT_SECONDS
       http.read_timeout = TIMEOUT_SECONDS

data/app/models/open_loam/api_token.rb

@@ -1,16 +1,31 @@
+require "openssl"
+
 module OpenLoam
   # A bearer token that lets a machine act as one user in one tenant. Same
   # rules as a human session: whatever the token's user may do in that tenant,
   # no more. Plumbing, so not audited and not evented.
+  #
+  # Only the SHA-256 digest is stored. The plaintext is returned once, from the
+  # instance that generated it, and is unrecoverable afterwards — a dump of this
+  # table is not a set of working credentials. A 24-byte random token needs no
+  # slow KDF; it is not guessable the way a password is.
   class ApiToken < OpenLoam::TenantRecord
     self.table_name = "open_loam_api_tokens"
 
     belongs_to :user
 
-    validates :token, presence: true, uniqueness: true
+    validates :token_digest, presence: true, uniqueness: true
+
+    # Present only on the instance that just created it — never after a reload.
+    attr_reader :token
 
     before_validation on: :create do
-      self.token ||= SecureRandom.hex(24)
+      @token ||= SecureRandom.hex(24)
+      self.token_digest = self.class.digest(@token)
+    end
+
+    def self.digest(raw_token)
+      OpenSSL::Digest::SHA256.hexdigest(raw_token.to_s)
     end
 
     # THE blessed cross-tenant lookup, and the reason it lives in the gem.
@@ -27,13 +42,21 @@ module OpenLoam
     def self.authenticate(raw_token)
       return nil if raw_token.blank?
 
-      api_token = unscoped.find_by(token: raw_token)
+      api_token = unscoped.find_by(token_digest: digest(raw_token))
       return nil unless api_token
 
       OpenLoam::Current.tenant = api_token.tenant
       OpenLoam::Current.actor = api_token.user
-      api_token.update_column(:last_used_at, Time.current)
 
+      # A token outlives the membership that justified it, so offboarding a user
+      # from a tenant would otherwise leave their machine access intact. Checked
+      # here rather than at revoke time: the membership is the authority.
+      unless OpenLoam::Membership.exists?(user_id: api_token.user_id)
+        OpenLoam::Current.reset
+        return nil
+      end
+
+      api_token.update_column(:last_used_at, Time.current)
       api_token
     end
   end

data/app/models/open_loam/event_record.rb

@@ -0,0 +1,42 @@
+module OpenLoam
+  # One captured domain event (see OpenLoam::EventLog). Where
+  # OpenLoam::EventDelivery records that a durable subscriber was told, this
+  # records that the thing happened at all.
+  #
+  # Append-only: a persisted row is readonly, so retention must delete_all
+  # rather than destroy.
+  class EventRecord < OpenLoam::TenantRecord
+    self.table_name = "open_loam_event_records"
+
+    validates :name, :occurred_at, presence: true
+
+    scope :chronological, -> { order(:occurred_at, :id) }
+
+    # ESCAPE is load-bearing: sanitize_sql_like backslash-escapes `_`, and SQLite
+    # has no default escape character, so "damage_report." would search for a
+    # literal backslash and silently match nothing.
+    scope :matching, ->(name_or_prefix) {
+      pattern = name_or_prefix.to_s
+      if pattern.end_with?(".")
+        where("name LIKE ? ESCAPE ?", "#{sanitize_sql_like(pattern)}%", "\\")
+      else
+        where(name: pattern)
+      end
+    }
+
+    def readonly?
+      persisted?
+    end
+
+    # The stored payload as a Hash regardless of adapter (Postgres jsonb returns
+    # a Hash; a text/json column may hand back a String).
+    def payload_hash
+      value = self[:payload]
+      return value if value.is_a?(Hash)
+
+      JSON.parse(value.to_s.presence || "{}")
+    rescue JSON::ParserError
+      {}
+    end
+  end
+end

data/app/models/open_loam/pending_action.rb

@@ -150,16 +150,26 @@ module OpenLoam
       update!(error: error.message)
     end
 
+    # Never settable through a staged change: soft-delete state has its own
+    # audited action (and its own policy question), and the rest is plumbing.
+    PROTECTED_FIELDS = %w[id tenant_id deleted_at lock_version].freeze
+
     def execute_change!
       case action_type
       when "create"
-        record = target_class.create!(changeset)
+        record = target_class.new
+        authorize_action!(record, :create?)
+        record.assign_attributes(permitted_changeset(record))
+        record.save!
         "created #{target_type}##{record.id}"
       when "update"
-        target_class.find(target_id).update!(changeset)
+        record = target_class.find(target_id)
+        authorize_action!(record, :update?)
+        record.update!(permitted_changeset(record))
         "updated #{target_type}##{target_id}"
       when "destroy"
         target = target_class.find(target_id)
+        authorize_action!(target, :destroy?)
         target.respond_to?(:soft_delete!) ? target.soft_delete! : target.destroy!
         "deleted #{target_type}##{target_id}"
       else
@@ -167,8 +177,42 @@ module OpenLoam
       end
     end
 
+    # The field rules below are not the whole policy: a host may restrict the
+    # ACTION itself (destroy? to an owner, say). Staging must not route around
+    # that, so the approver's verdict on the action is asked first.
+    def authorize_action!(record, question)
+      return if OpenLoam::Policy.for(record).public_send(question)
+
+      raise OpenLoam::NotAuthorizedError,
+            "the approver may not #{question.to_s.chomp('?')} #{target_type}"
+    end
+
+    # target_type is a string off a stored row, so it gets the same treatment as
+    # any other type resolution from untrusted input. The TenantRecord check is
+    # the load-bearing half: a non-tenant-scoped target (User, say) has no
+    # default scope, which would turn approval into a cross-tenant write.
     def target_class
-      target_type.constantize
+      klass = target_type.to_s.safe_constantize
+      unless klass.is_a?(Class) && klass < OpenLoam::TenantRecord
+        raise OpenLoam::Error, "#{target_type.inspect} is not a tenant-scoped model — refusing to apply a staged change"
+      end
+
+      klass
+    end
+
+    # Staging is deliberately ungated ("propose" is not "apply"), so approval is
+    # where authority is spent and the APPROVER's field rules are what bind —
+    # otherwise staging routes around every one of them. Refusals raise rather
+    # than drop, so the proposal fails visibly instead of applying a lesser change.
+    def permitted_changeset(record)
+      blocked = changeset.keys & PROTECTED_FIELDS
+      raise OpenLoam::Error, "a staged change may not set #{blocked.join(', ')}" if blocked.any?
+
+      policy = OpenLoam::Policy.for(record)
+      refused = changeset.keys - policy.permitted_fields(changeset.keys).map(&:to_s)
+      raise OpenLoam::NotAuthorizedError, "the approver may not write #{refused.join(', ')}" if refused.any?
+
+      changeset
     end
 
     def load_target

data/app/models/open_loam/sso_provider.rb

@@ -25,11 +25,42 @@ module OpenLoam
 
     normalizes :domain, with: ->(domain) { domain.to_s.strip.downcase.presence }
 
+    # The server fetches the issuer's discovery document and posts the code
+    # exchange to it, so a manager-typed issuer is an SSRF vector unless it is
+    # provably external. https because the client_secret travels over it.
+    validate :issuer_is_reachable_from_outside, if: -> { issuer.present? }
+
+    # Editing the domain drops the proof — otherwise a verified provider could be
+    # repointed at a domain nobody approved.
+    before_validation :reset_domain_verification, if: -> { persisted? && domain_changed? }
+
     scope :active, -> { where(active: true) }
+    scope :domain_verified, -> { where.not(domain_verified_at: nil) }
+
+    # Until ownership is proven, HRD skips the provider and OpenLoam::Sso refuses
+    # to link an existing account through it.
+    def domain_verified? = domain_verified_at.present?
+
+    # Operator entry point (rake open_loam:sso:verify_domain), off the admin path.
+    def verify_domain!(at: Time.current)
+      update!(domain_verified_at: at)
+    end
 
     # IdP group -> OpenLoam role, first match wins; falls back to jit_role.
     def group_roles
       group_role_map.is_a?(Hash) ? group_role_map : {}
     end
+
+    private
+
+    def reset_domain_verification
+      self.domain_verified_at = nil
+    end
+
+    def issuer_is_reachable_from_outside
+      OpenLoam::OutboundUrl.validate!(issuer, require_https: true)
+    rescue OpenLoam::OutboundUrl::BlockedError => error
+      errors.add(:issuer, error.message)
+    end
   end
 end

data/app/models/open_loam/webhook_endpoint.rb

@@ -8,9 +8,14 @@ module OpenLoam
   class WebhookEndpoint < OpenLoam::TenantRecord
     self.table_name = "open_loam_webhook_endpoints"
 
-    validates :url, presence: true, format: { with: %r{\Ahttps?://}, message: "must start with http:// or https://" }
+    validates :url, presence: true
     validates :event_pattern, presence: true
 
+    # The server fetches this URL, so a tenant must not be able to aim it at an
+    # address only the server can reach. Rejected at save for a clear error;
+    # OpenLoam::WebhookDeliveryJob re-checks at delivery, because DNS moves.
+    validate :url_is_reachable_from_outside, if: -> { url.present? }
+
     scope :active, -> { where(active: true) }
 
     before_validation on: :create do
@@ -22,5 +27,13 @@ module OpenLoam
     def matches?(event_name)
       OpenLoam::Events.pattern_matches?(event_pattern, event_name)
     end
+
+    private
+
+    def url_is_reachable_from_outside
+      OpenLoam::OutboundUrl.validate!(url)
+    rescue OpenLoam::OutboundUrl::BlockedError => error
+      errors.add(:url, error.message)
+    end
   end
 end

data/app/views/open_loam/custom_fields/_fields.html.erb

@@ -3,6 +3,10 @@
     rendering lives once in the gem instead of being inlined per entity. %>
 <% mode = local_assigns.fetch(:mode, :edit) %>
 <% record.class.custom_field_definitions.each do |definition| %>
+  <%# Not readable by this role: omit the field entirely. Falling through to the
+      read-only branch below would print the value to anyone who merely lacks
+      WRITE access, which is a different question. %>
+  <% next unless policy.custom_field_readable?(definition.name) %>
   <% param_name = "#{record.model_name.param_key}[custom_fields][#{definition.name}]" %>
   <% value = record.custom_field(definition.name) %>
   <p>

data/lib/generators/open_loam/entity/templates/api_controller.rb

@@ -8,6 +8,7 @@ module Api
     before_action :set_record, only: %i[show update destroy]
 
     def index
+      authorize!(policy_for(<%= class_name %>.new), :read?)
       records = <%= class_name %>.order(created_at: :desc).to_a
       enriched = OpenLoam::Enrichers.enrich_many(records)   # one batched pass, no N+1
       render json: records.map { |record| entity_json(record, enrichments: enriched[record.id]) }

data/lib/generators/open_loam/entity/templates/controller.rb

@@ -15,6 +15,7 @@ module Admin
     end
 
     def index
+      authorize!(policy_for(<%= class_name %>.new), :read?)
       @perspective = OpenLoam::Perspectives.resolve("<%= class_name %>", user: current_actor, id: params[:perspective_id])
       @perspectives = OpenLoam::Perspectives.visible_to("<%= class_name %>", user: current_actor)
       @records, @page, @has_next = paginate(index_scope)
@@ -32,6 +33,10 @@ module Admin
     # Datatable bulk actions on the selected ids — each is policy-checked per
     # record and tenant-scoped (OpenLoam::Bulk). Zero selection is a no-op.
     def bulk
+      # OpenLoam::Bulk checks the policy PER record (destroy? for soft_delete,
+      # update? + writable? for set_field) and silently skips what the actor may
+      # not touch, so the authorization is real — it just lives there, not here.
+      authorized!
       ids = Array(params[:ids])
       case params[:bulk_action]
       when "soft_delete"
@@ -147,9 +152,14 @@ module Admin
     # against real columns (never interpolated from params — that would be SQL
     # injection), and the direction is constrained to asc/desc. With no valid
     # sort param, a perspective's own order is kept, else a stable default.
+    #
+    # It must also be a column the role may READ: ordering by a hidden field
+    # leaks its ordering, which is an inference oracle on a value the role
+    # cannot see. Same reasoning as OpenLoam::FieldAccessError on custom fields —
+    # ignored rather than raised, since the header is not rendered either.
     def apply_sort(scope)
       column = params[:sort].to_s
-      if <%= class_name %>.column_names.include?(column)
+      if <%= class_name %>.column_names.include?(column) && policy_for(<%= class_name %>.new).readable?(column)
         dir = params[:dir].to_s.casecmp("asc").zero? ? :asc : :desc
         scope.reorder(column => dir).order(id: dir)
       elsif scope.order_values.empty?

data/lib/generators/open_loam/entity/templates/views/_form.html.erb

@@ -36,13 +36,16 @@
     </ul>
   <%% end %>
 
+<%%# Three states per field: writable (input), readable-only (shown, labelled
+    read-only), or neither (absent). There is no branch for the third case on
+    purpose — a field the role may not read is not rendered at all. %>
 <% attributes.each do |attribute| -%>
   <%% if policy.writable?(:<%= attribute.name %>) %>
     <p>
       <%%= f.label :<%= attribute.name %> %><br>
       <%%= f.<%= form_field_helper(attribute) %> :<%= attribute.name %> %>
     </p>
-  <%% else %>
+  <%% elsif policy.readable?(:<%= attribute.name %>) %>
     <p>
       <%%= f.label :<%= attribute.name %> %>: <%%= @record.<%= attribute.name %> %>
       <em><%%= t("open_loam.form.read_only") %></em>

data/lib/generators/open_loam/entity/templates/views/index.html.erb

@@ -1,3 +1,7 @@
+<%%# One policy for the whole table: readable? keys off the actor's ROLE, not the
+    row, so building it per record would only add a membership query per row. %>
+<%% policy = OpenLoam::Policy.for_model(<%= class_name %>, current_actor) %>
+
 <h1><%%= <%= class_name %>.model_name.human(count: 2) %></h1>
 
 <%% if @index_partial %>
@@ -55,7 +59,7 @@
         <th><input type="checkbox" onclick="document.querySelectorAll('.bulk-select').forEach(function(c){c.checked=this.checked}.bind(this))"></th>
         <th><%%= t("open_loam.labels.id") %></th>
 <% attributes.each do |attribute| -%>
-        <th><%%= sort_link("<%= attribute.name %>", <%= class_name %>.human_attribute_name("<%= attribute.name %>")) %></th>
+        <%% if policy.readable?(:<%= attribute.name %>) %><th><%%= sort_link("<%= attribute.name %>", <%= class_name %>.human_attribute_name("<%= attribute.name %>")) %></th><%% end %>
 <% end -%>
         <th></th>
       </tr>
@@ -66,7 +70,7 @@
           <td><%%= check_box_tag "ids[]", record.id, false, class: "bulk-select" %></td>
           <td><%%= record.id %></td>
 <% attributes.each do |attribute| -%>
-          <td><%%= record.<%= attribute.name %> %></td>
+          <%% if policy.readable?(:<%= attribute.name %>) %><td><%%= record.<%= attribute.name %> %></td><%% end %>
 <% end -%>
           <td>
             <%%= link_to t("open_loam.actions.show"), [:admin, record] %>

data/lib/generators/open_loam/entity/templates/views/show.html.erb

@@ -3,7 +3,9 @@
 <h1><%%= t("open_loam.actions.show_title", name: <%= class_name %>.model_name.human, id: @record.id) %></h1>
 
 <% attributes.each do |attribute| -%>
+<%% if policy.readable?(:<%= attribute.name %>) %>
 <p><strong><%%= <%= class_name %>.human_attribute_name("<%= attribute.name %>") %>:</strong> <%%= @record.<%= attribute.name %> %></p>
+<%% end %>
 <% end -%>
 
 <%%= render "open_loam/custom_fields/fields", record: @record, policy: policy, mode: :show %>

data/lib/generators/open_loam/install/install_generator.rb

@@ -42,6 +42,7 @@ module OpenLoam
         migration_template "migrations/create_open_loam_auth_attempts.rb", "db/migrate/create_open_loam_auth_attempts.rb"
         migration_template "migrations/create_open_loam_custom_field_values.rb", "db/migrate/create_open_loam_custom_field_values.rb"
         migration_template "migrations/create_open_loam_event_deliveries.rb", "db/migrate/create_open_loam_event_deliveries.rb"
+        migration_template "migrations/create_open_loam_event_records.rb", "db/migrate/create_open_loam_event_records.rb"
         migration_template "migrations/create_open_loam_inbound_webhooks.rb", "db/migrate/create_open_loam_inbound_webhooks.rb"
       end
 
@@ -69,6 +70,16 @@ module OpenLoam
         template "initializer.rb", "config/initializers/open_loam.rb"
       end
 
+      # Rails' default filter list covers passwords and tokens but not the params
+      # OpenLoam introduces: an uploaded :csv is a payload of real records, and
+      # :code is a live TOTP.
+      def filter_open_loam_parameters
+        append_to_file "config/initializers/filter_parameter_logging.rb", <<~RUBY
+
+          Rails.application.config.filter_parameters += %i[csv file code recovery secret otp]
+        RUBY
+      end
+
       def create_agents_md
         template "AGENTS.md", "AGENTS.md"
       end

data/lib/generators/open_loam/install/templates/AGENTS.md

@@ -307,7 +307,11 @@ So the block MUST be idempotent — `find_or_create_by!`, never `create!`.
   `OpenLoam::FieldDefinition` doesn't exist — create it, don't swallow the error.
 - **Never write raw SQL that touches tenant tables** without a `tenant_id` predicate.
 - **Every controller action checks a policy** (`authorize!`); every form uses
-  `policy.permitted_fields` — no hand-rolled `params.permit` lists.
+  `policy.permitted_fields` — no hand-rolled `params.permit` lists. This is
+  ENFORCED: an action that authorizes nothing raises
+  `OpenLoam::AuthorizationNotPerformedError` after it runs. If a screen really is
+  authorized structurally, say so with `skip_authorization! "<reason>"` — never
+  add a token `authorize!` to quiet the guard.
 - **Event names are `domain.thing.happened`** — three+ dot-separated segments.
 - **`OpenLoam.on_tenant_created` callbacks are idempotent** — `open_loam:sync` re-runs them.
 - **Never assign a workflow column directly** — call the transition, so the legal

data/lib/generators/open_loam/install/templates/admin/api_tokens_controller.rb

@@ -1,23 +1,37 @@
 module Admin
-  # Your own API tokens, and only ever your own: every query is scoped to
-  # current_actor, so there is no path to another user's credentials. A token
-  # acts as its user in this tenant, which is precisely why nobody else may
-  # list, create or revoke one for you.
+  # Your own API tokens — creating and listing is scoped to current_actor, so
+  # there is no path to another user's credentials. Revoking is the exception: a
+  # manager owns offboarding, and a token that outlives someone's access is the
+  # thing offboarding is supposed to end.
   class ApiTokensController < BaseController
+    skip_authorization! "Scoped to current_actor; the manager-wide revoke path calls require_role! itself."
+
+    # Revoking an API token cuts off a machine's access — sensitive enough to
+    # re-confirm, even for a manager (step-up is orthogonal to role).
+    before_action :require_sudo!, only: :destroy
+
     def index
       @records = api_tokens.order(created_at: :desc)
+      # Only the label, owner and usage — never a token value, which no longer
+      # exists in a readable form anyway.
+      @tenant_records = manager? ? OpenLoam::ApiToken.where.not(user_id: current_actor.id).order(created_at: :desc) : []
     end
 
     def create
       token = api_tokens.create!(label: params[:label].presence || "API token")
 
-      # Shown once, on the next screen — the habit that matters when tokens
-      # are eventually stored hashed rather than in the clear.
+      # The only time the plaintext exists: only its digest is stored, so this
+      # screen is genuinely the last chance to copy it.
       redirect_to admin_api_tokens_path, flash: { token: token.token }
     end
 
     def destroy
-      api_tokens.find(params[:id]).destroy!
+      # Tenant-scoped by the default scope, so another tenant's token is not
+      # merely forbidden here — it is not findable.
+      record = OpenLoam::ApiToken.find(params[:id])
+      require_role!(:manager) unless record.user_id == current_actor.id
+
+      record.destroy!
       redirect_to admin_api_tokens_path
     end
 
@@ -26,5 +40,9 @@ module Admin
     def api_tokens
       OpenLoam::ApiToken.where(user_id: current_actor.id)
     end
+
+    def manager?
+      current_role == :manager
+    end
   end
 end