plutonium 0.39.2 → 0.40.0

data/.claude/skills/plutonium-rodauth/SKILL.md

@@ -35,8 +35,8 @@ rails generate pu:rodauth:account user
 # Admin with 2FA and security features
 rails generate pu:rodauth:admin admin
 
-# Customer with entity association
-rails generate pu:rodauth:customer customer
+# SaaS user with entity/organization (multi-tenant)
+rails generate pu:saas:setup --user Customer --entity Organization
 ```
 
 ## Account Generators
@@ -94,40 +94,132 @@ Creates a secure admin account with:
 - Account lockout
 - Active sessions tracking
 - Audit logging
-- No public signup (accounts created via rake task)
+- Role-based access control
+- Invite interaction for adding new admins
+- No public signup (accounts created via rake task or invite)
 
 ```bash
 rails generate pu:rodauth:admin admin
+rails generate pu:rodauth:admin admin --roles=super_admin,admin,viewer
+rails generate pu:rodauth:admin admin --extra-attributes=name:string,department:string
+```
+
+**Options:**
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `--roles` | super_admin,admin | Comma-separated roles for admin accounts |
+| `--extra_attributes` | | Additional model attributes (e.g., name:string) |
+
+**Generated role enum:**
+```ruby
+# app/models/admin.rb
+enum :role, super_admin: 0, admin: 1
+```
+
+**Generated invite interaction:**
+```ruby
+# app/interactions/admin/invite_interaction.rb
+class Admin::InviteInteraction < Plutonium::Interaction::Base
+  attribute :email, :string
+  attribute :role, default: :admin  # Second role is default
+
+  def execute
+    # Creates admin via internal request and sends invite email
+  end
+end
 ```
 
 **Creates rake task:**
 ```bash
-# Create admin account
+# Create admin account directly
 rails rodauth_admin:create[admin@example.com,password123]
 ```
 
-### Customer Account (`pu:rodauth:customer`)
+### SaaS Setup (`pu:saas:setup`)
 
-Creates a customer account with an associated entity (organization/company):
+Creates a complete multi-tenant SaaS setup with user account, entity, and membership:
 
 ```bash
-rails generate pu:rodauth:customer customer
-rails generate pu:rodauth:customer customer --entity=Organization
-rails generate pu:rodauth:customer customer --no-allow_signup
+rails generate pu:saas:setup --user Customer --entity Organization
+rails generate pu:saas:setup --user Customer --entity Organization --roles=member,admin,owner
+rails generate pu:saas:setup --user Customer --entity Organization --no-allow-signup
+rails generate pu:saas:setup --user Customer --entity Organization --user-attributes=name:string --entity-attributes=slug:string
 ```
 
 **Options:**
 
-| Option | Description |
-|--------|-------------|
-| `--entity=NAME` | Entity model name (default: "Entity") |
-| `--no-allow_signup` | Disable public registration |
+| Option | Default | Description |
+|--------|---------|-------------|
+| `--user=NAME` | (required) | User account model name (e.g., Customer) |
+| `--entity=NAME` | (required) | Entity model name (e.g., Organization) |
+| `--allow-signup` | true | Allow public registration |
+| `--roles` | member,owner | Comma-separated membership roles |
+| `--skip-entity` | false | Skip entity model generation |
+| `--skip-membership` | false | Skip membership model generation |
+| `--user-attributes` | | Additional user model attributes |
+| `--entity-attributes` | | Additional entity model attributes (name is always included) |
+| `--membership-attributes` | | Additional membership model attributes |
+
+**Individual Generators:**
+
+You can also run each component separately:
+
+```bash
+# Just the user account
+rails g pu:saas:user Customer
+
+# Just the entity model
+rails g pu:saas:entity Organization
+
+# Just the membership (requires user and entity to exist)
+rails g pu:saas:membership --user Customer --entity Organization
+```
+
+**Generated Models:**
+
+1. **User account** - The user model with Rodauth authentication
+2. **Entity model** - The organization/company with unique name
+3. **Membership model** - Join table `{entity}_{user}` (e.g., `OrganizationCustomer`)
 
-This creates:
-- Customer account model
-- Entity model (Organization, Company, etc.)
-- Membership join model
-- Has-many-through associations
+```ruby
+# app/models/customer.rb
+class Customer < ApplicationRecord
+  include Rodauth::Rails.model(:customer)
+
+  has_many :organization_customers, dependent: :destroy
+  has_many :organizations, through: :organization_customers
+end
+
+# app/models/organization.rb
+class Organization < ApplicationRecord
+  has_many :organization_customers, dependent: :destroy
+  has_many :customers, through: :organization_customers
+end
+
+# app/models/organization_customer.rb
+class OrganizationCustomer < ApplicationRecord
+  belongs_to :organization
+  belongs_to :customer
+
+  enum :role, member: 0, owner: 1
+
+  validates :customer, uniqueness: {
+    scope: :organization_id,
+    message: "is already a member of this organization"
+  }
+end
+```
+
+**Membership Roles:**
+
+The membership model includes a role enum for access control within the entity:
+
+```ruby
+membership = OrganizationCustomer.find_by(organization: org, customer: current_user)
+membership.member?  # Default role
+membership.owner?   # Admin role for the entity
+```
 
 ## Connecting Auth to Controllers
 
@@ -450,3 +542,4 @@ User.create!(
 - `plutonium-installation` - Initial Plutonium setup
 - `plutonium-portal` - Portal configuration
 - `plutonium-policy` - Authorization after authentication
+- `plutonium-invites` - User invitation system for multi-tenant apps

data/CHANGELOG.md

@@ -1,3 +1,46 @@
+## [0.40.0] - 2026-02-04
+
+### 🚀 Features
+
+- *(invites)* Add user invitation system for multi-tenant apps
+- *(generators)* Add roles and extra_attributes options to rodauth generators
+- *(generator)* Add --scope flag to portal generator for entity scoping
+- *(generator)* Add --singular flag to pu:res:conn for singular resources
+- *(generators)* Add pu:lite namespace for SQLite-based services
+- *(generators)* Add pu:saas namespace for multi-tenant SaaS setup
+- *(definition)* Add default_scope method for setting default query scope
+
+### 🐛 Bug Fixes
+
+- *(rodauth)* Scope load_memory to account-specific paths
+- *(generators)* Resolve Thor invoke caching in entity generator
+- *(test)* Use dynamic migration versioning for Rails compatibility
+- *(config)* Wrap SQLite alias in defined? check for compatibility
+- *(test)* Add variants to product policy permitted attributes
+- *(test)* Improve has_one url assertion in resource_url_for test
+- *(generators)* Normalize CamelCase package names and validate resource records
+- *(generators)* Dedupe namespace and read model attrs with --no-model
+- *(templates)* Use local gem path when LOCAL=1
+- *(generators)* Guard against envs gems during template execution
+- *(generators)* Run db:prepare after config in lite generators
+- *(generators)* Restore ResourceController to portal generator
+
+### 🚜 Refactor
+
+- *(generators)* Comment out default policy methods
+
+### 📚 Documentation
+
+- *(skills)* Add invites skill and update rodauth skill
+- *(guides)* Add user invites guide
+
+### 🧪 Testing
+
+- *(generators)* Add tests for rodauth and invites generators
+
+### ⚙️ Miscellaneous Tasks
+
+- Remove old assets
 ## [0.39.2] - 2026-01-27
 
 ### 🐛 Bug Fixes