open-loam 0.2.0 → 0.3.0

data/lib/open_loam/custom_field_index.rb

@@ -94,7 +94,7 @@ module OpenLoam
       join = "LEFT JOIN #{table} ON #{table}.indexable_type = #{conn.quote(index_type(model))} " \
              "AND #{table}.indexable_id = #{model.table_name}.id " \
              "AND #{table}.field_key = #{conn.quote(field_key.to_s)} " \
-             "AND #{table}.tenant_id = #{OpenLoam.tenant!.id}"
+             "AND #{table}.tenant_id = #{conn.quote(OpenLoam.tenant!.id)}"
       model.joins(join).order(Arel.sql("#{table}.value_text #{dir.to_s.casecmp('desc').zero? ? 'DESC' : 'ASC'}"))
     end
 
@@ -202,16 +202,19 @@ module OpenLoam
       when "neq"      then rows.where.not(value_text: value.to_s)
       when "contains" then rows.where("value_text LIKE ?", "%#{sanitize_like(value)}%")
       when "present"  then rows.where.not(value_text: [ nil, "" ])
-      when "gt"       then numeric(rows, value, ">")
-      when "gte"      then numeric(rows, value, ">=")
-      when "lt"       then numeric(rows, value, "<")
-      when "lte"      then numeric(rows, value, "<=")
+      when "gt", "gte", "lt", "lte" then numeric(rows, value, op)
       end
     end
 
-    # Numeric comparisons hit the indexed value_number column.
-    def numeric(rows, value, operator)
-      rows.where("value_number #{operator} ?", value.to_f)
+    # Numeric comparisons hit the indexed value_number column. Built through
+    # Arel rather than an interpolated fragment: `op` reaches here from
+    # params[:cf_op], and a comparison operator cannot be a bound parameter, so
+    # the only safe form is one that never becomes a string.
+    NUMERIC_PREDICATES = { "gt" => :gt, "gte" => :gteq, "lt" => :lt, "lte" => :lteq }.freeze
+
+    def numeric(rows, value, op)
+      column = OpenLoam::CustomFieldValue.arel_table[:value_number]
+      rows.where(column.public_send(NUMERIC_PREDICATES.fetch(op), value.to_f))
     end
 
     def row_for(record, definition, type)

data/lib/open_loam/encryptable.rb

@@ -88,7 +88,11 @@ module OpenLoam
             write_attribute(name, OpenLoam::Encryption.encrypt_scoped(value, resolved, aad: aad))
             # The blind index tracks the ciphertext column: rewrite it in the
             # same breath, so an exact-match lookup can never go stale.
-            write_attribute(hash_column, OpenLoam::Encryption.blind_index_scoped(value, resolved)) if searchable
+            if searchable
+              write_attribute(hash_column,
+                              OpenLoam::Encryption.blind_index_scoped(value, resolved,
+                                                                      table: self.class.table_name, column: name))
+            end
           end
         end
       end
@@ -98,10 +102,11 @@ module OpenLoam
       # call must hash-and-compare, never match a plaintext query against the
       # ciphertext column (which would silently find nothing).
       def define_open_loam_blind_index_finder(name)
-        hash_column = "#{name}_hash"
+        hash_column = :"#{name}_hash"
 
         define_singleton_method("where_#{name}") do |value|
-          where(hash_column => OpenLoam::Encryption.blind_index(value, OpenLoam.tenant!.id))
+          where(hash_column => OpenLoam::Encryption.blind_index(value, OpenLoam.tenant!.id,
+                                                                table: table_name, column: name))
         end
 
         define_singleton_method("find_by_#{name}") do |value|

data/lib/open_loam/encryption/key_provider.rb

@@ -26,10 +26,26 @@ module OpenLoam
       KEY_BYTES = 32   # AES-256 and HMAC-SHA256 both take a 32-byte key
 
       def data_key(scope:, purpose:)
+        derive(scope, purpose, OpenLoam::Encryption.master_key)
+      end
+
+      # The same derivation under the key being rotated away from, so decryption
+      # can fall back to it while open_loam:encryption:rotate rewrites rows under
+      # the new one. nil when no previous key is configured.
+      def previous_data_key(scope:, purpose:)
+        previous = OpenLoam::Encryption.previous_master_key
+        return nil if previous.nil?
+
+        derive(scope, purpose, previous)
+      end
+
+      private
+
+      def derive(scope, purpose, master)
         raise ArgumentError, "scope is required to derive a key" if scope.nil? || scope.to_s.empty?
 
         OpenSSL::KDF.hkdf(
-          OpenLoam::Encryption.master_key,
+          master,
           salt: SALT,
           # info binds the key to owner AND purpose. "tenant/5" here reproduces
           # the pre-scope format exactly, so existing ciphertext still decrypts.

data/lib/open_loam/encryption.rb

@@ -41,6 +41,19 @@ module OpenLoam
         @master_key = value
       end
 
+      attr_writer :previous_master_key
+
+      # The key being rotated AWAY from. Set it alongside the new master and
+      # decryption falls back to it, which is what makes rotation possible at
+      # all: open_loam:encryption:rotate has to READ every row under the old key
+      # before it can rewrite it under the new one. Unset it once the rotation
+      # has run everywhere.
+      def previous_master_key
+        key = defined?(@previous_master_key) ? @previous_master_key : nil
+        key ||= ENV["OPEN_LOAM_PREVIOUS_MASTER_KEY"]
+        key.presence
+      end
+
       def master_key
         key = @master_key || ENV["OPEN_LOAM_MASTER_KEY"]
         raise MissingMasterKeyError if key.nil? || key.empty?
@@ -68,8 +81,8 @@ module OpenLoam
       # hash) — the accepted trade-off for searchability — but the per-tenant
       # HMAC key means the same value hashes differently across tenants, so
       # equality never leaks between them. Only searchable fields get one.
-      def blind_index(value, tenant_id)
-        blind_index_scoped(value, tenant_scope(tenant_id))
+      def blind_index(value, tenant_id, table: nil, column: nil)
+        blind_index_scoped(value, tenant_scope(tenant_id), table: table, column: column)
       end
 
       # Explicit-scope variants, for data owned by something OTHER than a tenant
@@ -82,7 +95,17 @@ module OpenLoam
 
       def decrypt_scoped(payload, scope, aad: nil)
         return nil if payload.nil?
+
         Cipher.open(payload, data_key(scope, :encryption), aad: aad)
+      rescue DecryptionError
+        # GCM's auth tag makes "wrong key" a loud, unambiguous failure, so
+        # falling back is safe: a blob that opens under the previous key really
+        # was sealed with it. Writes always use the CURRENT key, so a row is
+        # rotated the moment anything saves it.
+        previous = previous_data_key(scope, :encryption)
+        raise if previous.nil?
+
+        Cipher.open(payload, previous, aad: aad)
       end
 
       # The Additional Authenticated Data that BINDS a ciphertext to where it
@@ -96,9 +119,20 @@ module OpenLoam
         "loam-aad:v2:#{scope}:#{table}:#{column}"
       end
 
-      def blind_index_scoped(value, scope)
+      # The key is bound to (scope, table, column) for the same reason the
+      # ciphertext AAD is. A key scoped only to the tenant makes one value hash
+      # identically in every searchable column in that tenant: a dump correlates
+      # rows across tables, and anyone who can write one such field gets an
+      # equality oracle against columns they cannot read.
+      #
+      # table/column default to nil so an unbound caller still works — the
+      # per-tenant key, which is what OpenLoam::PendingActions wants for an
+      # idempotency digest that is not a column at all.
+      def blind_index_scoped(value, scope, table: nil, column: nil)
         return nil if value.nil?
-        OpenSSL::HMAC.hexdigest("SHA256", data_key(scope, :blind_index), value.to_s)
+
+        purpose = table && column ? "blind_index/#{table}/#{column}" : :blind_index
+        OpenSSL::HMAC.hexdigest("SHA256", data_key(scope, purpose), value.to_s)
       end
 
       private
@@ -120,6 +154,15 @@ module OpenLoam
 
         key_provider.data_key(scope: scope, purpose: purpose)
       end
+
+      # nil unless a previous master is configured AND the provider supports the
+      # fallback — a KMS-backed provider manages its own key versions, so the
+      # base KeyProvider answers nil and nothing changes for it.
+      def previous_data_key(scope, purpose)
+        return nil unless key_provider.respond_to?(:previous_data_key)
+
+        key_provider.previous_data_key(scope: scope, purpose: purpose)
+      end
     end
   end
 end

data/lib/open_loam/engine.rb

@@ -9,6 +9,7 @@ module OpenLoam
     config.after_initialize do
       OpenLoam::Webhooks.subscribe!
       OpenLoam::DurableEvents.subscribe!    # persist + retry durable subscribers (L-706)
+      OpenLoam::EventLog.subscribe!         # capture every event as queryable history (L-204)
       OpenLoam::BusinessRules.subscribe!
       OpenLoam::Widgets.register_builtins!  # the default dashboard widgets
       OpenLoam::Overrides.check!            # warn about any stale disable/replace overrides
@@ -19,6 +20,13 @@ module OpenLoam
         key: OpenLoam::DurableEvents::SWEEP_KEY, name: "Event redelivery sweep",
         job_class: "OpenLoam::EventRedeliverySweepJob", schedule: "interval:300", scope: "tenant"
       )
+
+      # Event-log retention, also per-tenant. interval:86400 = daily; the window
+      # itself is OpenLoam.event_log_retention.
+      OpenLoam::Scheduler.register(
+        key: OpenLoam::EventLog::PRUNE_KEY, name: "Event log prune",
+        job_class: "OpenLoam::EventLogPruneJob", schedule: "interval:86400", scope: "tenant"
+      )
     end
 
     # OpenLoam's Active Record layer — TenantRecord, Auditable, Eventful and the

data/lib/open_loam/errors.rb

@@ -41,6 +41,16 @@ module OpenLoam
   # it as 403, like any other field-access denial.
   class FieldAccessError < NotAuthorizedError; end
 
+  # Raised when a controller action finishes without having authorized anything
+  # (see the `verify_authorized!` guard in the generated base controllers).
+  #
+  # Deliberately NOT a NotAuthorizedError: that one means "this person may not",
+  # and the base controllers render it as a tidy 403. This means "this code
+  # forgot to ask", which is a developer bug that must not be dressed up as a
+  # refusal — nothing rescues it, so it surfaces as a 500 in dev and a failure
+  # in tests.
+  class AuthorizationNotPerformedError < Error; end
+
   # Raised when a OpenLoam::BusinessRule with a `block_transition` action vetoes a
   # workflow transition. Distinct from NotAuthorizedError (a role gate) and
   # InvalidTransitionError (an illegal move): the move is legal and permitted,

data/lib/open_loam/event_log.rb

@@ -0,0 +1,77 @@
+module OpenLoam
+  # Captures every published event as a queryable OpenLoam::EventRecord row —
+  # the capture half of the event system, where OpenLoam::DurableEvents is the
+  # delivery half ("durability is of DELIVERY, not CAPTURE").
+  #
+  # Capture is ON by default and captures everything but OpenLoam.uncaptured_events.
+  # That inverts OpenLoam.broadcast_events on purpose; see ADR 0007 for why, and
+  # for why this stayed in-gem rather than adopting Rails Event Store.
+  #
+  # Capture runs INLINE in the publisher's thread, so a failed insert propagates
+  # into whatever published the event. Deliberate — do not rescue it. Swallowing
+  # the error re-opens the silent gap this module exists to close.
+  module EventLog
+    PRUNE_KEY = "open_loam_event_log_prune".freeze
+
+    class << self
+      # Idempotent: subscribing twice would capture every event twice.
+      def subscribe!
+        @subscription ||= OpenLoam::Events.subscribe_all { |event_name, payload| capture(event_name, payload) }
+      end
+
+      # Exclusion is the only knob, because pattern_matches? has no match-all
+      # spelling ("" is an exact match on the empty name). Do not add an
+      # allow-list: capture-all has to stay the absence of configuration.
+      def capturable?(event_name)
+        OpenLoam.uncaptured_events.none? do |pattern|
+          next false if OpenLoam::Overrides.disabled?(:uncaptured_events, pattern) # an app can re-enable a default exclusion
+
+          OpenLoam::Events.pattern_matches?(pattern, event_name)
+        end
+      end
+
+      def capture(event_name, payload)
+        return unless capturable?(event_name)
+
+        tenant = OpenLoam::Tenant.find_by(id: payload[:tenant_id])
+        return if tenant.nil? # nil-tenant events are not captured (as Webhooks.dispatch / DurableEvents.capture)
+
+        OpenLoam.as_tenant(tenant) do
+          OpenLoam::EventRecord.create!(
+            name: event_name.to_s,
+            payload: payload.transform_keys(&:to_s),
+            occurred_at: Time.current
+          )
+        end
+      end
+
+      # name_or_prefix takes an exact event name or a trailing-dot domain
+      # prefix, the same rule as Events.subscribe. Oldest first.
+      def read(name_or_prefix = nil, since: nil, limit: nil)
+        scope = OpenLoam::EventRecord.chronological
+        scope = scope.matching(name_or_prefix) if name_or_prefix.present?
+        scope = scope.where(occurred_at: since..) if since
+        scope = scope.limit(limit) if limit
+        scope
+      end
+
+      # A re-read of history, NOT a second publish: nothing else on the bus fires
+      # and a replayed event is not re-captured. Handlers must be idempotent, and
+      # get string payload keys (from the row) where a live subscriber got symbols.
+      def replay(name_or_prefix = nil, since: nil, limit: nil, &handler)
+        read(name_or_prefix, since: since, limit: limit).each do |record|
+          handler.call(record.name, record.payload_hash)
+        end
+      end
+
+      # delete_all, NOT destroy_all: rows are readonly once persisted, and
+      # destroy on a readonly record raises ActiveRecord::ReadOnlyRecord.
+      def prune(now: Time.current)
+        retention = OpenLoam.event_log_retention
+        return 0 if retention.nil?
+
+        OpenLoam::EventRecord.where(occurred_at: ...(now - retention)).delete_all
+      end
+    end
+  end
+end

data/lib/open_loam/export.rb

@@ -9,8 +9,9 @@ module OpenLoam
   # * an ENCRYPTED column is NEVER exported in the clear — its cell is
   #   "[encrypted]" (the same redaction as the audit trail), so a bulk export can
   #   never become a plaintext dump of PII a role shouldn't see;
-  # * declared custom fields are included (a dictionary field exports its stored
-  #   code, so the file round-trips back through OpenLoam::Import);
+  # * declared custom fields go through the same read check
+  #   (OpenLoam::Policy#custom_field_readable?) — a dictionary field exports its
+  #   stored code, so the file round-trips back through OpenLoam::Import;
   # * tenant isolation is free — the relation is already scoped.
   #
   # Prototype scale: builds the CSV in memory with the stdlib CSV. A very large
@@ -48,6 +49,8 @@ module OpenLoam
 
       if model.respond_to?(:custom_field_definitions)
         model.custom_field_definitions.order(:name).each do |definition|
+          next unless policy.custom_field_readable?(definition.name)
+
           columns << { header: definition.name, name: definition.name, kind: :custom }
         end
       end
@@ -65,10 +68,7 @@ module OpenLoam
     end
 
     def policy_for(model, actor)
-      klass = "#{model.name}Policy".safe_constantize
-      # A blank instance as the record: readable? keys off the role, but the
-      # policy's custom-field checks read record.class.
-      (klass || OpenLoam::Policy).new(actor, model.new)
+      OpenLoam::Policy.for_model(model, actor)
     end
   end
 end

data/lib/open_loam/import.rb

@@ -159,10 +159,7 @@ module OpenLoam
     end
 
     def policy_for(model, actor)
-      klass = "#{model.name}Policy".safe_constantize
-      # A blank instance as the record: readable?/writable? key off the role, but
-      # custom_field_writable? reads record.class.custom_field_definitions.
-      (klass || OpenLoam::Policy).new(actor, model.new)
+      OpenLoam::Policy.for_model(model, actor)
     end
   end
 end

data/lib/open_loam/inbound_webhooks.rb

@@ -19,9 +19,12 @@ module OpenLoam
   # Every AUTH failure returns 401 with no distinguishing body, so a sender can't
   # probe which check failed; the specific reason is logged server-side only.
   #
-  # REPLAY: the real defense is the (source_id, external_id) dedupe. The timestamp
-  # window is defense-in-depth: unless the sender signs the timestamp too, a
-  # replayer can refresh an unsigned timestamp header. Don't over-trust it.
+  # REPLAY: the real defense is the (source_id, external_id) dedupe, and
+  # external_id is derived from the SIGNED body — never from a header. Anything
+  # an attacker can vary without invalidating the signature is a way to mint a
+  # fresh dedupe key and replay the delivery. The timestamp window is
+  # defense-in-depth only, for the same reason: unless the sender signs the
+  # timestamp, a replayer just refreshes it.
   module InboundWebhooks
     MAX_BYTES = 1_000_000
 
@@ -92,14 +95,12 @@ module OpenLoam
       (Time.current.to_i - seconds).abs <= tolerance.to_i
     end
 
-    def delivery_id(source, headers, body)
-      if source.delivery_id_header.present?
-        value = header(headers, source.delivery_id_header)
-        return value if value.present?
-      end
-      # No delivery-id header configured (or absent): fall back to a body hash.
-      # Consequence: identical bodies dedupe. A sender with a real delivery id
-      # should configure delivery_id_header so distinct-but-identical bodies pass.
+    # The dedupe key must come from SIGNED material, which means the body: the
+    # HMAC covers the body alone, so a captured (body, signature) replayed with a
+    # fresh delivery-id header used to mint a new external_id every time and
+    # re-publish the event. Cost: a sender emitting distinct deliveries with
+    # identical bodies sees the second deduped — its nonce belongs in the body.
+    def delivery_id(_source, _headers, body)
       Digest::SHA256.hexdigest(body)
     end
 

data/lib/open_loam/lifecycle.rb

@@ -87,6 +87,27 @@ module OpenLoam
       @broadcast_events = Array(patterns).map(&:to_s)
     end
 
+    # Event-name patterns EXCLUDED from the event log (OpenLoam::EventLog), which
+    # captures everything else. An empty list captures everything; there is no
+    # opt-in spelling. Progress ticks fire once per row during a bulk import.
+    def self.uncaptured_events
+      @uncaptured_events ||= [ "open_loam.progress." ]
+    end
+
+    def self.uncaptured_events=(patterns)
+      @uncaptured_events = Array(patterns).map(&:to_s)
+    end
+
+    # How long a captured event is kept before OpenLoam::EventLogPruneJob deletes
+    # it. nil disables pruning, leaving an unbounded log.
+    def self.event_log_retention
+      defined?(@event_log_retention) ? @event_log_retention : 90.days
+    end
+
+    def self.event_log_retention=(duration)
+      @event_log_retention = duration
+    end
+
     # The locales content translations (OpenLoam::Translatable) may be authored in —
     # declared in the initializer (`OpenLoam.locales = %w[en de pl]`), so the admin
     # knows which languages to offer. A registry like the others; defaults to the
@@ -164,6 +185,14 @@ module OpenLoam
   def self.broadcast_events=(patterns)
     Lifecycle.broadcast_events = patterns
   end
+  def self.uncaptured_events = Lifecycle.uncaptured_events
+  def self.uncaptured_events=(patterns)
+    Lifecycle.uncaptured_events = patterns
+  end
+  def self.event_log_retention = Lifecycle.event_log_retention
+  def self.event_log_retention=(duration)
+    Lifecycle.event_log_retention = duration
+  end
   def self.locales = Lifecycle.locales
   def self.locales=(codes)
     Lifecycle.locales = codes

data/lib/open_loam/mcp.rb

@@ -163,7 +163,10 @@ module OpenLoam
       clean = {}
       (changes || {}).each do |field, value|
         field = field.to_s
-        raise ToolError, "#{field} cannot be set" if %w[id tenant_id lock_version].include?(field)
+        # deleted_at belongs with the rest: staging a direct soft-delete would
+        # bypass a destroy? override and the audited action label, which is
+        # exactly what OpenLoam::Bulk and BusinessRules both refuse.
+        raise ToolError, "#{field} cannot be set" if %w[id tenant_id lock_version deleted_at].include?(field)
         raise ToolError, "#{field} changes go through a workflow transition, not a direct write" if field == workflow_column
 
         if model.column_names.include?(field)
@@ -268,6 +271,12 @@ module OpenLoam
       return scope.order(id: :asc) if order.blank?
       raise ToolError, "unknown sort column #{order.inspect}" unless model.column_names.include?(order.to_s)
 
+      # Same gate apply_filters enforces. Values are redacted from the result,
+      # but ordering by a restricted column still leaks its ranking — which is
+      # the inference oracle the filter gate exists to close.
+      policy = OpenLoam::Policy.for_model(model, OpenLoam::Current.actor)
+      raise ToolError, "#{order} is not readable for this role" unless policy.readable?(order.to_s)
+
       direction = dir.to_s.casecmp("desc").zero? ? :desc : :asc
       scope.reorder(order.to_s => direction)
     end

data/lib/open_loam/outbound_url.rb

@@ -0,0 +1,100 @@
+require "ipaddr"
+require "resolv"
+require "uri"
+
+module OpenLoam
+  # Guard for URLs a TENANT supplies and the SERVER then fetches — webhook
+  # endpoints and the SSO issuer. Without it the tenant names an address only
+  # the server can reach (169.254.169.254, loopback, a private subnet) and gets
+  # the result back from inside the perimeter.
+  #
+  #   uri, address = OpenLoam::OutboundUrl.resolve!(endpoint.url)
+  #   http = Net::HTTP.new(uri.host, uri.port)
+  #   http.ipaddr = address   # connect to the address that was CHECKED
+  #
+  # The pin is the load-bearing half: a host that resolves publicly during the
+  # check and privately a moment later (DNS rebinding) beats a name-only check.
+  module OutboundUrl
+    class BlockedError < OpenLoam::Error; end
+
+    SCHEMES = %w[http https].freeze
+
+    # Loopback, link-local (incl. the 169.254.169.254 cloud metadata service),
+    # RFC1918, carrier-grade NAT, and the IPv6 equivalents.
+    BLOCKED = [
+      "0.0.0.0/8", "10.0.0.0/8", "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16",
+      "172.16.0.0/12", "192.0.0.0/24", "192.168.0.0/16", "198.18.0.0/15",
+      "224.0.0.0/4", "240.0.0.0/4",
+      "::1/128", "::/128", "fc00::/7", "fe80::/10", "ff00::/8"
+    ].map { |range| IPAddr.new(range) }.freeze
+
+    module_function
+
+    # Shape only — no DNS. Model validations call this: saving must not depend on
+    # the network, and a save-time lookup proves nothing resolve! doesn't re-prove.
+    def validate!(url, require_https: false)
+      uri = parse!(url, require_https: require_https)
+      if literal_address(uri.host) && blocked?(uri.host)
+        raise BlockedError, "#{uri.host} is not a public address"
+      end
+
+      uri
+    end
+
+    # Shape, DNS, and the address to connect to — call this at FETCH time.
+    def resolve!(url, require_https: false)
+      uri = validate!(url, require_https: require_https)
+      [ uri, address_for!(uri.host) ]
+    end
+
+    def parse!(url, require_https: false)
+      uri = begin
+        URI.parse(url.to_s)
+      rescue URI::InvalidURIError => error
+        raise BlockedError, "not a valid URL: #{error.message}"
+      end
+
+      raise BlockedError, "#{uri.scheme.inspect} is not an allowed scheme" unless SCHEMES.include?(uri.scheme)
+      raise BlockedError, "https is required" if require_https && uri.scheme != "https"
+      raise BlockedError, "no host in #{url.inspect}" if uri.host.blank?
+      # Credentials in the URL are a redirect/parsing-confusion trick more often
+      # than a real need, and nothing here has a use for them.
+      raise BlockedError, "credentials in the URL are not allowed" if uri.userinfo.present?
+
+      uri
+    end
+
+    # Every address the host resolves to must be allowed — a name with one
+    # public and one private A record is still an internal reach.
+    def address_for!(host)
+      addresses = resolve_all(host)
+      raise BlockedError, "#{host} does not resolve" if addresses.empty?
+
+      addresses.each do |address|
+        raise BlockedError, "#{host} resolves to the non-public address #{address}" if blocked?(address)
+      end
+      addresses.first
+    end
+
+    def resolve_all(host)
+      return [ host ] if literal_address(host)
+
+      Resolv.getaddresses(host)
+    rescue Resolv::ResolvError
+      []
+    end
+
+    def literal_address(host)
+      IPAddr.new(host.to_s)
+    rescue IPAddr::Error
+      nil
+    end
+
+    def blocked?(address)
+      ip = IPAddr.new(address.to_s)
+      BLOCKED.any? { |range| range.include?(ip) }
+    rescue IPAddr::Error
+      true # unparseable is not provably public
+    end
+  end
+end

data/lib/open_loam/policy.rb

@@ -19,10 +19,23 @@ module OpenLoam
       end
 
       def for(record)
-        policy_class = "#{record.class.name}Policy".safe_constantize
-        raise Error, "No policy defined for #{record.class.name} (expected #{record.class.name}Policy)" unless policy_class
+        policy_class_for(record.class).new(OpenLoam::Current.actor, record)
+      end
+
+      # A policy for a MODEL rather than one record — for bulk paths (export,
+      # import) that decide the column set once, before any row is read. The
+      # blank instance is a stand-in: the field checks key off the role, but
+      # the custom-field ones need record.class to find the definitions.
+      def for_model(model, actor)
+        policy_class_for(model).new(actor, model.new)
+      end
 
-        policy_class.new(OpenLoam::Current.actor, record)
+      # Falling back to the base Policy for a model with no policy class would
+      # fail OPEN — every check there answers "any member", so a missing policy
+      # would silently grant what an explicit one restricts.
+      def policy_class_for(model)
+        "#{model.name}Policy".safe_constantize ||
+          raise(Error, "No policy defined for #{model.name} (expected #{model.name}Policy)")
       end
     end
 

data/lib/open_loam/search/token_driver.rb

@@ -23,7 +23,7 @@ module OpenLoam
           matches = OpenLoam::SearchToken
             .where(searchable_type: type_for(model), token: tokens)
             .group(:searchable_id)
-            .having("COUNT(DISTINCT token) = #{tokens.size}")
+            .having("COUNT(DISTINCT token) = ?", tokens.size)
             .select(:searchable_id)
 
           scope.where(id: matches)

data/lib/open_loam/sso/http_client.rb

@@ -10,22 +10,31 @@ module OpenLoam
       module_function
 
       def get_json(url, bearer: nil)
-        uri = URI(url)
+        uri, address = checked(url)
         request = Net::HTTP::Get.new(uri)
         request["Authorization"] = "Bearer #{bearer}" if bearer
-        parse(perform(uri, request))
+        parse(perform(uri, address, request))
       end
 
       def post_form(url, params)
-        uri = URI(url)
+        uri, address = checked(url)
         request = Net::HTTP::Post.new(uri)
         request.set_form_data(params)
         request["Accept"] = "application/json"
-        parse(perform(uri, request))
+        parse(perform(uri, address, request))
       end
 
-      def perform(uri, request)
-        Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https") do |http|
+      # The issuer is typed by a tenant manager, so these URLs are as untrusted
+      # as a webhook endpoint's. https is mandatory here rather than merely
+      # allowed: the client_secret and the code exchange travel over it.
+      def checked(url)
+        OpenLoam::OutboundUrl.resolve!(url, require_https: true)
+      rescue OpenLoam::OutboundUrl::BlockedError => error
+        raise OpenLoam::Sso::Error, "identity provider URL refused: #{error.message}"
+      end
+
+      def perform(uri, address, request)
+        Net::HTTP.start(uri.host, uri.port, use_ssl: true, ipaddr: address) do |http|
           http.request(request)
         end
       end