open-loam 0.2.0 → 0.3.0

data/lib/generators/open_loam/install/templates/admin/api_tokens_index.html.erb

@@ -37,3 +37,26 @@ audit trail. Send it as <code>Authorization: Bearer &lt;token&gt;</code>.</p>
     <%% end %>
   </tbody>
 </table>
+
+<%% if @tenant_records.any? %>
+  <h2>Everyone else's tokens</h2>
+  <p>Manager view. Removing someone's membership already stops their tokens
+  working; revoking is the clean end of it.</p>
+
+  <table>
+    <thead>
+      <tr><th>Owner</th><th>Label</th><th>Created</th><th>Last used</th><th></th></tr>
+    </thead>
+    <tbody>
+      <%% @tenant_records.each do |record| %>
+        <tr>
+          <td><%%= record.user.name %></td>
+          <td><%%= record.label %></td>
+          <td><%%= record.created_at.to_fs(:short) %></td>
+          <td><%%= record.last_used_at&.to_fs(:short) || "never" %></td>
+          <td><%%= button_to "Revoke", admin_api_token_path(record), method: :delete, form: { style: "display:inline" } %></td>
+        </tr>
+      <%% end %>
+    </tbody>
+  </table>
+<%% end %>

data/lib/generators/open_loam/install/templates/admin/base_controller.rb

@@ -5,8 +5,28 @@ module Admin
     layout "admin"
 
     before_action :set_open_loam_context
+    before_action :require_mfa_enrollment!
     before_action :set_locale
 
+    # Fails an action that never authorized anything. Forgetting `authorize!` is
+    # otherwise silent — the screen renders, and nothing says the policy was
+    # never consulted.
+    #
+    # It runs AFTER the action, so it catches the omission in development and in
+    # tests; it is not a runtime access-control layer. A `destroy` that forgot to
+    # authorize has already destroyed the record by the time this raises.
+    after_action :verify_authorized!
+
+    # For screens that are authorized STRUCTURALLY rather than by a policy call —
+    # a list scoped to current_actor, a pre-auth screen. The reason is required
+    # and shows up in the source, so every exemption is a documented claim rather
+    # than a silent opt-out.
+    def self.skip_authorization!(reason, **options)
+      raise ArgumentError, "skip_authorization! needs a reason" if reason.to_s.strip.empty?
+
+      skip_after_action :verify_authorized!, **options
+    end
+
     rescue_from OpenLoam::NotAuthorizedError do
       render plain: "403 Forbidden — your role does not permit this action.", status: :forbidden
     end
@@ -86,6 +106,22 @@ module Admin
       OpenLoam::Membership.exists?(user_id: current_actor.id)
     end
 
+    # security.mfa_required_roles has to hold on EVERY request, not just as a
+    # redirect at the end of login — otherwise typing any other admin URL walks
+    # straight past enrollment and the requirement means nothing.
+    def require_mfa_enrollment!
+      return if OpenLoam::MfaCredential.active_for(current_actor)
+      return unless mfa_required_role?
+
+      redirect_to new_admin_mfa_path,
+                  alert: "Your role requires two-factor authentication — set it up to continue."
+    end
+
+    def mfa_required_role?
+      required = Array(OpenLoam::Configs.get("security.mfa_required_roles", default: []))
+      required.map(&:to_s).include?(current_role.to_s)
+    end
+
     # Drives the bell in the admin layout. One COUNT per admin page render,
     # which is fine at this scale; cache it if a screen ever gets hot.
     def unread_notification_count
@@ -106,9 +142,30 @@ module Admin
     end
 
     def authorize!(policy, action)
+      authorized!
       raise OpenLoam::NotAuthorizedError unless policy.public_send(action)
     end
 
+    # Records that this action asked a person-authorization question — marked
+    # whether the answer was yes or no, since a refusal is still a check.
+    #
+    # Call it directly only where the check is an inline `raise` rather than one
+    # of the helpers below (see Admin::PerspectivesController). Deliberately NOT
+    # called by require_feature! (a capability gate, not a person gate) or
+    # require_sudo! (step-up, orthogonal to role) — either marking the action
+    # would let a feature-gated screen skip authorization silently.
+    def authorized!
+      @open_loam_authorized = true
+    end
+
+    def verify_authorized!
+      return if @open_loam_authorized
+
+      raise OpenLoam::AuthorizationNotPerformedError,
+            "#{self.class.name}##{action_name} finished without authorizing. Call authorize!/require_role!/" \
+            "require_permission!, or declare `skip_authorization! \"<why>\"` if it is authorized structurally."
+    end
+
     # For admin screens with no per-record policy (e.g. field definitions,
     # which apply to a whole entity_type rather than one record).
     def current_role
@@ -116,6 +173,7 @@ module Admin
     end
 
     def require_role!(*roles)
+      authorized!
       raise OpenLoam::NotAuthorizedError unless roles.include?(current_role)
     end
 
@@ -127,6 +185,7 @@ module Admin
     end
 
     def require_permission!(permission)
+      authorized!
       raise OpenLoam::NotAuthorizedError unless OpenLoam.can?(permission)
     end
 
@@ -153,6 +212,10 @@ module Admin
     # be a false conflict every time.
     def stale_conflict!(record, fields)
       encrypted = record.class.respond_to?(:open_loam_encrypted_attributes) ? record.class.open_loam_encrypted_attributes.map(&:to_s) : []
+      # The diff shows the OTHER person's saved values, so it obeys the same field
+      # rules as any other read. Anything not writable was never submitted anyway.
+      policy = policy_for(record)
+      fields = fields.select { |field| policy.writable?(field) && policy.readable?(field) }
       attempted = fields.map(&:to_s).index_with { |field| conflict_value(record, field, encrypted) }
 
       record.reload

data/lib/generators/open_loam/install/templates/admin/dashboard_controller.rb

@@ -1,5 +1,7 @@
 module Admin
   class DashboardController < BaseController
+    skip_authorization! "Widgets are filtered by role in OpenLoam::Dashboard.for; there is no per-record subject."
+
     def index
       # Configurable, role-visible widgets (OpenLoam::Dashboard) — a raising widget
       # is isolated into an error tile, never breaking the page. Register your

data/lib/generators/open_loam/install/templates/admin/events_controller.rb

@@ -7,6 +7,8 @@ module Admin
   # committed and there is no going back; that ordering is the whole safety of a
   # Live action.
   class EventsController < BaseController
+    skip_authorization! "OpenLoam::EventStream gates every message: declared pattern, matching tenant, and audience."
+
     include ActionController::Live
 
     HEARTBEAT_SECONDS = 20

data/lib/generators/open_loam/install/templates/admin/history_controller.rb

@@ -6,6 +6,8 @@ module Admin
   class HistoryController < BaseController
     before_action :set_target
 
+    helper_method :visible_changeset
+
     def index
       authorize!(policy_for(@record), :read?)
       @audits = OpenLoam::AuditRecord
@@ -24,6 +26,30 @@ module Admin
 
     private
 
+    # History is a read path like any other: a field the role may not read must
+    # not come back here as an old → new pair.
+    def visible_changeset(audit)
+      policy = (@history_policy ||= policy_for(@record))
+
+      (audit.changeset || {}).each_with_object({}) do |(field, values), visible|
+        if field == "custom_fields"
+          readable = readable_custom_fields(values, policy)
+          visible[field] = readable if readable
+        elsif policy.readable?(field)
+          visible[field] = values
+        end
+      end
+    end
+
+    # Runtime fields are audited as one json blob, so the filter goes inside the
+    # old/new pair rather than dropping the whole entry.
+    def readable_custom_fields(values, policy)
+      return values unless values.is_a?(Array)
+
+      sides = values.map { |side| side.to_h.select { |name, _| policy.custom_field_readable?(name) } }
+      sides.any?(&:present?) ? sides : nil
+    end
+
     # The target record, looked up through its OWN default scope (tenancy holds;
     # a soft-deleted row is still reachable to restore). The type is whitelisted
     # to a OpenLoam::TenantRecord — never a bare constantize of a param.

data/lib/generators/open_loam/install/templates/admin/history_index.html.erb

@@ -18,7 +18,7 @@ never reverted here.</p>
         <td><code><%%= audit.action %></code></td>
         <td><%%= audit.actor&.name || "—" %></td>
         <td>
-          <%% (audit.changeset || {}).each do |field, values| %>
+          <%% visible_changeset(audit).each do |field, values| %>
             <div><code><%%= field %></code>:
               <%%= values.is_a?(Array) ? "#{values.first.inspect} → #{values.last.inspect}" : values %></div>
           <%% end %>

data/lib/generators/open_loam/install/templates/admin/imports_controller.rb

@@ -31,7 +31,7 @@ module Admin
       if params[:commit] == "Dry run"
         run_dry(mapping, match_key)
       else
-        ImportJob.perform_later(entity_type: @entity_type, csv: @csv, mapping: mapping,
+        ImportJob.perform_later(entity_type: @entity_type, blob_id: staged_csv_blob(@csv).id, mapping: mapping,
                                 match_key: match_key, tenant_id: current_tenant.id, actor_id: current_actor.id)
         redirect_to admin_progress_jobs_path, notice: "Import started — watch it progress under Tasks."
       end
@@ -71,5 +71,17 @@ module Admin
 
       file.read.force_encoding("UTF-8")
     end
+
+    # The CSV goes to blob storage and the JOB gets an id. ActiveJob arguments
+    # are serialized into the queue backend and echoed in the job log, so
+    # passing the file itself would leave every row sitting in the clear —
+    # including the columns headed for encrypted fields. ImportJob purges it.
+    def staged_csv_blob(csv)
+      ActiveStorage::Blob.create_and_upload!(
+        io: StringIO.new(csv),
+        filename: "#{@entity_type.underscore}-import-#{SecureRandom.hex(8)}.csv",
+        content_type: "text/csv"
+      )
+    end
   end
 end

data/lib/generators/open_loam/install/templates/admin/inbound_webhook_sources_controller.rb

@@ -53,7 +53,7 @@ module Admin
 
     def source_params
       params.require(:inbound_webhook_source).permit(
-        :name, :event_name, :signature_header, :delivery_id_header,
+        :name, :event_name, :signature_header,
         :timestamp_header, :timestamp_tolerance
       )
     end

data/lib/generators/open_loam/install/templates/admin/inbound_webhook_sources_new.html.erb

@@ -19,8 +19,6 @@
     <small>e.g. X-Hub-Signature-256 for GitHub.</small>
   </p>
   <p>
-    <%%= f.label :delivery_id_header, "Delivery-id header (optional, for dedupe)" %><br>
-    <%%= f.text_field :delivery_id_header %>
     <small>Blank = dedupe on a hash of the body.</small>
   </p>
   <p>

data/lib/generators/open_loam/install/templates/admin/mfa_controller.rb

@@ -6,6 +6,11 @@ module Admin
   # old secret stays valid until the new one is proven — so neither a cross-site
   # GET nor an abandoned re-enrollment can downgrade an active credential.
   class MfaController < BaseController
+    skip_authorization! "Your own MFA credentials; sensitive changes go through require_sudo! instead."
+
+    # This IS the enrollment screen the requirement sends people to.
+    skip_before_action :require_mfa_enrollment!
+
     # Shown in authenticator apps as the account issuer; defaults to the app name.
     ISSUER = Rails.application.class.module_parent_name.freeze
 

data/lib/generators/open_loam/install/templates/admin/notifications_controller.rb

@@ -5,6 +5,8 @@ module Admin
   # OpenLoam::TenantRecord) and BaseController has already established that this
   # actor is signed in to this tenant. Recipient scoping is the whole rule.
   class NotificationsController < BaseController
+    skip_authorization! "Scoped to current_actor — there is no path to another user's notifications."
+
     def index
       @records = notifications.order(created_at: :desc).limit(100)
     end

data/lib/generators/open_loam/install/templates/admin/perspectives_controller.rb

@@ -8,6 +8,11 @@ module Admin
   # ones. A private view of someone else's is invisible here by construction
   # (OpenLoam::Perspectives.visible_to never returns it).
   class PerspectivesController < BaseController
+    # update/destroy/set_default authorize via authorize_manage!. index and create
+    # act only on the actor's own private views, so there is no subject to gate.
+    skip_authorization! "index lists views visible to the actor; create only ever makes a private one, owned by them.",
+                        only: %i[index create]
+
     before_action :set_perspective, only: %i[update destroy set_default]
     before_action :authorize_manage!, only: %i[update destroy set_default]
 
@@ -68,6 +73,7 @@ module Admin
     end
 
     def authorize_manage!
+      authorized!
       raise OpenLoam::NotAuthorizedError unless can_manage?(@perspective)
     end
 

data/lib/generators/open_loam/install/templates/admin/progress_jobs_controller.rb

@@ -4,6 +4,9 @@ module Admin
   # Your app starts jobs with OpenLoam::Progress.start in its own background jobs;
   # a running one can be cancelled cooperatively here.
   class ProgressJobsController < BaseController
+    skip_authorization! "A tenant-scoped list of the tenant's own jobs; cancel is the gated action.",
+                        only: :index
+
     def index
       @jobs = OpenLoam::ProgressJob.recent.limit(20)
     end
@@ -11,6 +14,7 @@ module Admin
     def cancel
       job = OpenLoam::ProgressJob.find(params[:id])
       # Manager-or-owner: a member must not cancel another user's job.
+      authorized!
       raise OpenLoam::NotAuthorizedError unless current_role == :manager || job.actor_id == current_actor&.id
       job.cancel! if job.running?
       redirect_to admin_progress_jobs_path, notice: "Job cancelled."

data/lib/generators/open_loam/install/templates/admin/search_controller.rb

@@ -6,6 +6,8 @@ module Admin
   # tenant-scoped relation, so this can only ever find records the current
   # tenant owns.
   class SearchController < BaseController
+    skip_authorization! "Each model's `search` returns its own tenant-scoped relation; reads only."
+
     PER_ENTITY = 10
 
     helper_method :search_result_label

data/lib/generators/open_loam/install/templates/admin/sessions_controller.rb

@@ -39,7 +39,8 @@ module Admin
         return render :new, status: :unauthorized
       end
 
-      OpenLoam::AuthThrottle.clear(email) # a successful login resets the counter
+      # PASSWORD only — clearing every kind here would reset the TOTP counter.
+      OpenLoam::AuthThrottle.clear(email, kind: "password")
       reset_session # a fresh session id at login: no fixation
       session[:user_id] = user.id
 
@@ -58,8 +59,6 @@ module Admin
       @user = mfa_challenge_user or return redirect_to new_admin_session_path
     end
 
-    # TODO (follow-up): rate-limit / lock out repeated failed codes here (needs
-    # throttling infra) — a 6-digit TOTP is brute-forceable without it.
     def mfa_verify
       user = mfa_challenge_user or return redirect_to new_admin_session_path
 
@@ -74,7 +73,7 @@ module Admin
       credential = OpenLoam::MfaCredential.active_for(user)
 
       if credential.verify_totp(params[:code]) || credential.consume_recovery_code(params[:code])
-        OpenLoam::AuthThrottle.clear(user.email)
+        OpenLoam::AuthThrottle.clear(user.email, kind: "totp")
         session.delete(:mfa_pending)
         complete_authentication(user)
       else

data/lib/generators/open_loam/install/templates/admin/sso_providers_index.html.erb

@@ -4,9 +4,15 @@
 below is sent to that identity provider to sign in (OIDC), and provisioned on
 first login. <%%= link_to "New provider", new_admin_sso_provider_path %></p>
 
+<p>A provider does nothing until an operator confirms your organisation owns the
+domain — anyone can type a domain here, so the claim has to be checked off the
+admin path. Ask your operator to run
+<code>rake open_loam:sso:verify_domain[&lt;id&gt;]</code>. Editing the domain
+later clears the confirmation.</p>
+
 <table>
   <thead>
-    <tr><th>Name</th><th>Protocol</th><th>Domain</th><th>JIT role</th><th>Active</th><th></th></tr>
+    <tr><th>Name</th><th>Protocol</th><th>Domain</th><th>Ownership</th><th>JIT role</th><th>Active</th><th></th></tr>
   </thead>
   <tbody>
     <%% @providers.each do |provider| %>
@@ -14,6 +20,7 @@ first login. <%%= link_to "New provider", new_admin_sso_provider_path %></p>
         <td><%%= provider.name %></td>
         <td><%%= provider.protocol %></td>
         <td><code><%%= provider.domain %></code></td>
+        <td><%%= provider.domain_verified? ? "confirmed" : "not confirmed — SSO is inactive" %></td>
         <td><%%= provider.jit_role %></td>
         <td><%%= provider.active? ? "yes" : "no" %></td>
         <td>

data/lib/generators/open_loam/install/templates/admin/sudo_controller.rb

@@ -4,6 +4,8 @@ module Admin
   # (or TOTP code, if the user has MFA) stamps a fresh sudo timestamp and returns
   # to wherever they were headed.
   class SudoController < BaseController
+    skip_authorization! "The step-up re-challenge itself — authorizing it would require the sudo it grants."
+
     def new
     end
 
@@ -16,7 +18,7 @@ module Admin
       end
 
       if reauthenticated?
-        OpenLoam::AuthThrottle.clear(identifier)
+        OpenLoam::AuthThrottle.clear(identifier, kind: "sudo")
         session[:sudo_at] = Time.now.to_i
         redirect_to(session.delete(:sudo_return_to).presence || admin_root_path,
                     notice: "Re-authenticated — you can complete the action now.")

data/lib/generators/open_loam/install/templates/api_base_controller.rb

@@ -14,6 +14,17 @@ module Api
   class BaseController < ActionController::API
     before_action :authenticate_api_token!
 
+    # Same guard as the admin base controller: an endpoint that never authorized
+    # anything fails loudly rather than silently serving. Runs after the action,
+    # so it catches the omission in tests, not at runtime.
+    after_action :verify_authorized!
+
+    def self.skip_authorization!(reason, **options)
+      raise ArgumentError, "skip_authorization! needs a reason" if reason.to_s.strip.empty?
+
+      skip_after_action :verify_authorized!, **options
+    end
+
     rescue_from OpenLoam::NotAuthorizedError do
       render json: { error: "forbidden" }, status: :forbidden
     end
@@ -46,27 +57,53 @@ module Api
     end
 
     def authorize!(policy, action)
+      authorized!
       raise OpenLoam::NotAuthorizedError unless policy.public_send(action)
     end
 
-    # The JSON shape of an entity: its columns, custom fields included (they
-    # live in the `custom_fields` column that every generated entity carries).
+    # Marked whether the answer was yes or no — a refusal is still a check.
+    def authorized!
+      @open_loam_authorized = true
+    end
+
+    def verify_authorized!
+      return if @open_loam_authorized
+
+      raise OpenLoam::AuthorizationNotPerformedError,
+            "#{self.class.name}##{action_name} finished without authorizing. Call authorize!, or declare " \
+            "`skip_authorization! \"<why>\"` if it is authorized structurally."
+    end
+
+    # The JSON shape of an entity: the columns this actor's role may READ, plus
+    # the readable custom fields (which live in the `custom_fields` column that
+    # every generated entity carries).
+    #
+    # The read check is the same one the CSV export and the admin screens apply.
+    # Without it the API is a way around every `field readable:` rule in the app:
+    # the record is already loaded and `record.attributes` emits everything on it.
     #
     # Encrypted fields (OpenLoam::Encryptable) are returned DECRYPTED — the caller is
     # authenticated, tenant-scoped and policy-gated, exactly like the admin show
     # screen — and their blind-index `<field>_hash` column is dropped, so the
-    # equality-leaking hash never goes over the wire. `record.attributes` alone
-    # would emit the raw ciphertext plus the hash.
+    # equality-leaking hash never goes over the wire.
     def entity_json(record, enrichments: nil)
-      json = record.attributes
+      policy = policy_for(record)
+      json = record.attributes.slice(*policy.readable_fields(record.attribute_names))
 
       if record.class.respond_to?(:open_loam_encrypted_attributes)
         record.class.open_loam_encrypted_attributes.each do |name|
-          json[name] = record.public_send(name)
+          json[name] = record.public_send(name) if json.key?(name)
           json.delete("#{name}_hash")
         end
       end
 
+      # `custom_fields` is one JSON column, so it is all-or-nothing at the
+      # column level — filter its contents per definition instead.
+      if json.key?("custom_fields") && record.class.respond_to?(:custom_field_definitions)
+        readable = record.class.custom_field_definitions.map(&:name).select { |n| policy.custom_field_readable?(n) }
+        json["custom_fields"] = json["custom_fields"].to_h.slice(*readable)
+      end
+
       # Computed cross-module blocks (OpenLoam::Enrichers), under a separate key so
       # they're never confused with the record's own columns. An index passes the
       # batched result (avoiding N+1); a single show computes it here.

data/lib/generators/open_loam/install/templates/import_job.rb

@@ -2,13 +2,22 @@
 # watches it live (L-915). Carries tenant + actor explicitly, like every OpenLoam job.
 # The per-row summary (created/updated/failed + error rows) is stored on the
 # ProgressJob's `result` for the summary screen.
+#
+# The file arrives as a blob id, never as a job argument. ActiveJob arguments are
+# serialized into the queue backend and echoed in the job log, so passing the CSV
+# itself would persist every row — including columns bound for encrypted fields —
+# in the clear, outside the encryption the destination columns exist to provide.
 class ImportJob < ApplicationJob
   queue_as :default
 
-  def perform(entity_type:, csv:, mapping:, match_key:, tenant_id:, actor_id:)
+  def perform(entity_type:, blob_id:, mapping:, match_key:, tenant_id:, actor_id:)
     tenant = OpenLoam::Tenant.find(tenant_id)
     actor = User.find_by(id: actor_id)
     model = OpenLoam::Import.allowed_model(entity_type)
+    blob = ActiveStorage::Blob.find_by(id: blob_id)
+    return if blob.nil? # already purged: nothing to import, not an error
+
+    csv = blob.download.force_encoding("UTF-8")
 
     OpenLoam.as_tenant(tenant, actor: actor) do
       total = [ CSV.parse(csv).size - 1, 0 ].max
@@ -21,5 +30,9 @@ class ImportJob < ApplicationJob
         progress.fail!(error.message)
       end
     end
+  ensure
+    # The upload has done its job; leaving it behind is a second copy of the
+    # same data with none of the destination's protections.
+    blob&.purge_later
   end
 end

data/lib/generators/open_loam/install/templates/initializer.rb

@@ -8,8 +8,11 @@
 #
 #   OpenLoam::Encryption.master_key = ENV.fetch("OPEN_LOAM_MASTER_KEY")
 #
-# Rotating the key without re-encrypting orphans existing ciphertext — see
-# `bin/rails open_loam:encryption:rotate[Model,tenant_id]`.
+# To ROTATE: keep the outgoing key in OPEN_LOAM_PREVIOUS_MASTER_KEY while the new
+# one is in OPEN_LOAM_MASTER_KEY. Reads fall back to the old key, writes always use
+# the new one, so `bin/rails open_loam:encryption:rotate[Model,tenant_id]` can walk
+# each tenant's rows. Drop the previous key once every model has been rotated —
+# until then, both keys are live and the old one is still worth protecting.
 
 # Roles every tenant of this app is expected to have. A registry read by your
 # own seeding/admin code — OpenLoam does not create memberships for you, because
@@ -65,6 +68,15 @@ OpenLoam.locales = %w[en]
 # nothing reaches the browser unless it matches a pattern here (security posture).
 OpenLoam.broadcast_events = [ "open_loam.notification.", "open_loam.progress." ]
 
+# Events EXCLUDED from the event log (OpenLoam::EventLog), which otherwise
+# captures everything. Progress ticks are excluded because a bulk import fires
+# one per row — volume without history worth keeping.
+OpenLoam.uncaptured_events = [ "open_loam.progress." ]
+
+# How long captured events are kept before the daily per-tenant prune. nil keeps
+# everything, which means an unbounded table.
+OpenLoam.event_log_retention = 90.days
+
 # Response enrichers (OpenLoam::Enrichers): attach a computed block onto ANOTHER
 # module's entity in admin/API responses, with no foreign-key coupling — billing
 # can annotate an Equipment without Equipment knowing billing exists. Pass a

data/lib/generators/open_loam/install/templates/migrations/create_open_loam_api_tokens.rb

@@ -3,13 +3,13 @@ class CreateOpenLoamApiTokens < ActiveRecord::Migration[<%= ActiveRecord::VERSIO
     create_table :open_loam_api_tokens<%= open_loam_id_option %> do |t|
       t.references :tenant, null: false, foreign_key: { to_table: :open_loam_tenants }<%= open_loam_type_option %>
       t.references :user, null: false, foreign_key: true<%= open_loam_type_option %>
-      t.string :token, null: false
+      t.string :token_digest, null: false   # SHA-256; the plaintext is never stored
       t.string :label
       t.datetime :last_used_at
       t.timestamps
     end
     # Tokens are looked up before a tenant is known, so the uniqueness that
     # matters is global.
-    add_index :open_loam_api_tokens, :token, unique: true
+    add_index :open_loam_api_tokens, :token_digest, unique: true
   end
 end

data/lib/generators/open_loam/install/templates/migrations/create_open_loam_event_records.rb

@@ -0,0 +1,13 @@
+class CreateOpenLoamEventRecords < ActiveRecord::Migration[<%= ActiveRecord::VERSION::STRING.to_f %>]
+  def change
+    create_table :open_loam_event_records<%= open_loam_id_option %> do |t|
+      t.references :tenant, null: false, foreign_key: { to_table: :open_loam_tenants }<%= open_loam_type_option %>
+      t.string :name, null: false                  # "rental.equipment.created"
+      t.json :payload, null: false                 # JSON-scalar event payload, as published
+      t.datetime :occurred_at, null: false         # publish time, not row-write time
+      t.timestamps
+    end
+    # Matches OpenLoam::EventLog.read: tenant, then name or prefix, in time order.
+    add_index :open_loam_event_records, %i[tenant_id name occurred_at]
+  end
+end

data/lib/generators/open_loam/install/templates/migrations/create_open_loam_inbound_webhooks.rb

@@ -6,7 +6,6 @@ class CreateOpenLoamInboundWebhooks < ActiveRecord::Migration[<%= ActiveRecord::
       t.string :token, null: false                 # unguessable URL id: /webhooks/:token
       t.string :secret, null: false                # HMAC key (authenticates the call)
       t.string :signature_header, null: false, default: "X-OpenLoam-Signature"
-      t.string :delivery_id_header                 # optional: external delivery-id for dedupe
       t.string :timestamp_header                   # optional: enables the freshness window
       t.integer :timestamp_tolerance               # seconds; nil = default 300
       t.string :event_name, null: false            # what to publish on the bus

data/lib/generators/open_loam/install/templates/migrations/create_open_loam_sso_providers.rb

@@ -11,6 +11,9 @@ class CreateOpenLoamSsoProviders < ActiveRecord::Migration[<%= ActiveRecord::VER
       t.string :jit_role, null: false, default: "employee"  # role for JIT-provisioned users
       t.json :group_role_map, null: false, default: {}    # IdP group -> OpenLoam role (first match wins)
       t.boolean :active, null: false, default: true
+      # Proof of domain ownership, stamped by an operator (rake
+      # open_loam:sso:verify_domain) — never by the manager who typed the domain.
+      t.datetime :domain_verified_at
       t.timestamps
     end
     # HRD resolves a provider by email domain, cross-tenant, before login — so the

data/lib/open_loam/auth_throttle.rb

@@ -6,7 +6,7 @@ module OpenLoam
   #
   #   OpenLoam::AuthThrottle.locked?(email)                      # refuse if true
   #   OpenLoam::AuthThrottle.record_failure(email, kind: "password", ip: request.ip)
-  #   OpenLoam::AuthThrottle.clear(email)                        # on success
+  #   OpenLoam::AuthThrottle.clear(email, kind: "password")      # on success
   #
   # PER-IDENTIFIER is the primary defense (an attacker targets one account /
   # code). A per-ip throttle to blunt spraying across accounts is a clean
@@ -46,6 +46,9 @@ module OpenLoam
 
     # Locked if there are >= max failures within the window. Old attempts age out
     # of the window automatically (the window query IS the expiry — no reaper).
+    #
+    # Both auth call sites ask WITHOUT a kind on purpose: failures on either
+    # factor lock both, so grinding TOTP also costs the attacker the password form.
     def locked?(identifier, kind: nil)
       recent_failures(identifier, kind: kind) >= max_attempts
     end
@@ -58,8 +61,13 @@ module OpenLoam
 
     # Reset the counter — call on a SUCCESSFUL auth so a legitimate user who
     # eventually gets in isn't left throttled.
-    def clear(identifier)
-      attempts(identifier).delete_all
+    #
+    # Pass `kind:` — clearing every kind on one factor's success lets an attacker
+    # holding the password reset the TOTP counter before each guess.
+    def clear(identifier, kind: nil)
+      scope = attempts(identifier)
+      scope = scope.where(kind: Array(kind).map(&:to_s)) if kind
+      scope.delete_all
     end
 
     # Seconds until the identifier unlocks (for the "try again in N" message),