plutonium 0.62.2 → 0.63.0

data/lib/plutonium/attachments.rb

@@ -0,0 +1,254 @@
+# frozen_string_literal: true
+
+module Plutonium
+  # Staging and revival for attachments that travel as PLAIN STRINGS —
+  # backend-agnostic and model-free.
+  #
+  # Two subsystems need this and neither has a model to hang an attachment off
+  # while the work is in flight: a wizard stages a file across steps, and an
+  # async interaction has to carry one from the request into a job. Both hold a
+  # bare `attribute :photo, :string`, so the value has to BE a string.
+  #
+  # Two shapes exist, and they are distinguishable — ActiveStorage's **signed_id**
+  # is opaque, Shrine's **cached-file data** parses as JSON — so each revives
+  # through its own backend with no model and no per-field configuration.
+  #
+  # Revival is deliberately separate from staging. {stage_upload} runs in the
+  # request, where the file is; {resolve} runs wherever the value is read, which
+  # may be a render or a job. Assigning a token straight to a model attachment
+  # (both backends accept one) needs neither.
+  #
+  # Backend objects answer DIFFERENT method names (`filename`/`content_type` vs
+  # `original_filename`/`mime_type`), so a resolved token is wrapped in
+  # {Resolved}, a uniform view over both.
+  module Attachments
+    # Options on a file input that are consumed SERVER-SIDE to stage the upload,
+    # and are never form or HTML concerns.
+    #
+    # They have to be kept out of what the form renders: Phlex rejects a
+    # Class-valued +uploader:+ as an attribute outright, and +backend:+ would
+    # leak as a stray one. Both the wizard (Wizard::StepAdapter) and an
+    # interaction's form read this list, so the two cannot drift.
+    STAGING_ONLY_INPUT_OPTIONS = %i[backend uploader].freeze
+
+    module_function
+
+    # Resolve a staged attachment token (or array of them) into uniform
+    # {Resolved} view(s).
+    #
+    # @param value [String, Array, nil] the staged token(s).
+    # @return [Array<Resolved>] resolved attachments; blank, tampered, or
+    #   unrecognized tokens are dropped (never raised), so a bad token can't 500
+    #   the form or the review.
+    def resolve(value)
+      Array(value).filter_map { |token| resolve_token(token) }
+    end
+
+    # SERVER-SIDE staging: turn a submitted attachment value into a token string
+    # to stage in `data`, minting one from an uploaded file when needed.
+    #
+    # Handles every shape a step POST can carry for an attachment field:
+    # - an already-minted token String (direct upload, or the hidden preview field
+    #   on re-submit) → kept verbatim;
+    # - an uploaded file (IO-like) → uploaded to the backend's cache, returning its
+    #   token (an AS signed_id, or Shrine cached-file JSON);
+    # - blank / no selection → nil (the caller drops the key so the previously
+    #   staged token survives a Back/re-submit);
+    # - an Array (multiple) → each element mapped, blanks dropped.
+    #
+    # @param backend [Symbol, nil] per-field override; nil → the configured default.
+    # @param uploader [Class, String, nil] a Shrine uploader to cache through
+    #   (`:shrine` backend only) — its cache-stage plugins (mime/dimension
+    #   extraction, `generate_location`, validations) run instead of base Shrine's.
+    #   The minted token stays uploader-agnostic, so display + `execute` promotion
+    #   are unaffected. Ignored shape for ActiveStorage (raises if given).
+    def stage_upload(value, backend: nil, uploader: nil)
+      if value.is_a?(Array)
+        value.filter_map { |v| stage_upload(v, backend:, uploader:) }.presence
+      elsif value.is_a?(String)
+        value.presence
+      elsif value.respond_to?(:read)
+        upload_to_cache(value, backend || default_backend, uploader:)
+      end
+    end
+
+    # The default staging backend when a caller names none: the globally
+    # configured one, else auto-detected (active_shrine loaded → Shrine, else
+    # ActiveStorage).
+    #
+    # Subsystems layer their own override on top of this rather than replacing
+    # it — see Wizard::Attachments.attachment_backend.
+    def default_backend
+      Plutonium.configuration.attachment_backend ||
+        (defined?(ActiveShrine) ? :shrine : :active_storage)
+    end
+
+    # Run the EFFECTIVE Shrine uploader's attacher validations against a staged
+    # token (or array of them), returning the validation messages — so a file that
+    # violates the uploader's `validate_*` rules is rejected at the STEP (stage
+    # phase), not deferred to `execute`'s model assignment.
+    #
+    # The effective uploader is the field's `uploader:` if given, else base
+    # `Shrine` — both of which may carry `Attacher.validate` rules. Returns `[]`
+    # when the field isn't Shrine-backed (ActiveStorage has no attacher here), when
+    # nothing is staged, or when the effective uploader declares no validations.
+    #
+    # @param value [String, Array, nil] the staged token(s).
+    # @param backend [Symbol, nil] per-field override; nil → the configured default.
+    # @param uploader [Class, String, nil] the field's `uploader:` option.
+    # @return [Array<String>] validation messages (empty ⇒ valid).
+    def validation_errors(value, backend: nil, uploader: nil)
+      return [] unless (backend || default_backend).to_sym == :shrine
+
+      klass = shrine_uploader(uploader)
+      # Shrine's `validation` plugin is OPTIONAL — without it (or `validation_helpers`)
+      # the Attacher has no `#errors` and nothing to enforce. Detect it up front so a
+      # plugin-less app is a clean no-op, not a per-step rescued NoMethodError.
+      return [] unless klass::Attacher.method_defined?(:errors)
+
+      Array(value).flat_map { |token| token_validation_errors(klass, token) }
+    end
+
+    # Validate one cached token through an uploader's attacher. A broad rescue
+    # (like {resolve_token}) — a tampered/expired token shouldn't 500 the step; it
+    # surfaces at `execute` instead, where it's caught as a RecordInvalid.
+    def token_validation_errors(uploader_class, token)
+      return [] if token.blank?
+
+      attacher = uploader_class::Attacher.new
+      attacher.assign(token)
+      Array(attacher.errors)
+    rescue => e
+      Rails.logger.warn { "[Plutonium] attachment validation skipped: #{e.class}: #{e.message}" }
+      []
+    end
+    private_class_method :token_validation_errors
+
+    # Upload a file to the backend's CACHE and return its re-postable token. The
+    # file lives in cache until `execute` assigns the token to a real attachment
+    # (which promotes it); an abandoned upload is reaped by the backend's own
+    # unattached-cache cleanup.
+    def upload_to_cache(file, backend, uploader: nil)
+      case backend.to_sym
+      when :shrine
+        shrine_uploader(uploader).upload(file, :cache).to_json
+      when :active_storage
+        raise ArgumentError, "`uploader:` is only supported for the :shrine backend" if uploader
+        ActiveStorage::Blob.create_and_upload!(
+          io: file, filename: file.original_filename, content_type: file.content_type
+        ).signed_id
+      else
+        raise ArgumentError, "unknown attachment backend: #{backend.inspect}"
+      end
+    end
+    private_class_method :upload_to_cache
+
+    # Resolve an `uploader:` option to the Shrine uploader class to cache through.
+    # nil → base `Shrine`; a class is used as-is; a String/Symbol is constantized.
+    # Anything that isn't a Shrine subclass is a configuration error (fail loud).
+    def shrine_uploader(uploader)
+      return Shrine if uploader.nil?
+
+      klass = uploader.is_a?(Class) ? uploader : uploader.to_s.safe_constantize
+      unless klass.is_a?(Class) && klass <= Shrine
+        raise ArgumentError, "`uploader:` must be a Shrine uploader class, got #{uploader.inspect}"
+      end
+      klass
+    end
+    private_class_method :shrine_uploader
+
+    # Revive one token through whichever backend owns it, wrapped in {Resolved}. A
+    # broad rescue is warranted here (unlike elsewhere): the token is arbitrary,
+    # user-supplied input reconstituted at a render boundary, and the two backends
+    # raise different error classes for a tampered/expired token — none of which
+    # should take down the page.
+    def resolve_token(token)
+      return if token.blank?
+
+      source = shrine_uploaded_file(token) || active_storage_blob(token)
+      source && Resolved.new(source, token)
+    rescue => e
+      Rails.logger.warn { "[Plutonium] could not resolve attachment token: #{e.class}: #{e.message}" }
+      nil
+    end
+    private_class_method :resolve_token
+
+    # A Shrine cached-file token is JSON (`{"id":…,"storage":"cache",…}`); an AS
+    # signed_id isn't. Parse-success → Shrine materializes it from the globally
+    # registered storages (no model, no per-field uploader needed for a `.url`).
+    def shrine_uploaded_file(token)
+      return unless defined?(Shrine)
+
+      data = begin
+        JSON.parse(token)
+      rescue JSON::ParserError, TypeError
+        nil
+      end
+      return unless data.is_a?(Hash)
+
+      Shrine.uploaded_file(data)
+    end
+    private_class_method :shrine_uploaded_file
+
+    def active_storage_blob(token)
+      ActiveStorage::Blob.find_signed(token) if defined?(ActiveStorage::Blob)
+    end
+    private_class_method :active_storage_blob
+
+    # A uniform view over a resolved attachment so the review display + the uppy
+    # preview don't care whether the source is an ActiveStorage `Blob`
+    # (`filename`/`content_type`/`representable?`) or a Shrine `UploadedFile`
+    # (`original_filename`/`mime_type`, none of the AS-only methods). Exposes
+    # exactly what those components call.
+    class Resolved
+      # @param source the backend object (AS Blob or Shrine UploadedFile).
+      # @param token  [String] the ORIGINAL staged token — what the hidden preview
+      #   field re-posts to preserve the upload across a Back/re-submit, and what
+      #   `execute` assigns to the model attachment.
+      def initialize(source, token)
+        @source = source
+        @token = token
+      end
+
+      # `url` is lazy (called at render, inside a request, where AS url options
+      # exist) — never eager at resolve time.
+      def url(*args) = @source.url(*args)
+
+      # The re-postable token, surfaced under the name the uppy input reads.
+      def signed_id = @token
+
+      def filename = (@source.try(:filename) || @source.try(:original_filename)).to_s
+
+      def content_type = @source.try(:content_type) || @source.try(:mime_type)
+
+      def representable? = @source.try(:representable?) || content_type.to_s.start_with?("image/")
+
+      def extension = @source.try(:extension).presence || File.extname(filename).delete(".").presence
+
+      # Yields the attachment as an open file, cleaned up afterwards.
+      #
+      # {url} is enough for a wizard, which only ever renders a staged
+      # attachment. Work that RUNS on one — an import parsing the rows, a job
+      # promoting the file onto a model — has to read it, and in a job there is
+      # no request to build a URL against anyway.
+      #
+      # @yieldparam [File, Tempfile] an IO positioned at the start
+      # @return the block's value
+      def open(&) = @source.open(&)
+
+      # The bytes, as a String.
+      #
+      # Routed through {open} rather than the backends' own +download+, because
+      # that is one of the names they disagree on: ActiveStorage's returns the
+      # bytes, Shrine's returns a Tempfile. Papering over exactly that kind of
+      # divergence is what this class is for, so a caller can read a staged file
+      # without knowing which backend minted its token.
+      # Explicit receiver: a bare `open` here is indistinguishable from
+      # `Kernel#open` to a reader (and to the linter), which is a very different
+      # and much more dangerous method.
+      def download = self.open(&:read)
+
+      def present? = true
+    end
+  end
+end

data/lib/plutonium/configuration.rb

@@ -25,8 +25,21 @@ module Plutonium
     attr_reader :assets
 
     # @return [Plutonium::Wizard::Configuration] wizard subsystem configuration
+    # @return [Symbol, nil] the storage backend used to stage an attachment that
+    #   travels as a plain string — `:active_storage` or `:shrine`. `nil`
+    #   auto-detects (active_shrine loaded → `:shrine`, else `:active_storage`).
+    #
+    #   The shared default. Wizards and async interactions each layer their own
+    #   override on top, so setting this once covers both, and setting one of
+    #   theirs narrows it to that subsystem.
+    attr_accessor :attachment_backend
+
     attr_reader :wizards
 
+    # @return [Plutonium::Interaction::Async::Configuration] persisted interaction
+    #   runs configuration — gates the runs subsystem and its migrations
+    attr_reader :async_interactions
+
     # @return [Float] the current defaults version
     attr_reader :defaults_version
 
@@ -47,10 +60,74 @@ module Plutonium
     #   change the default, or `false` (or `""`) for no symbol application-wide.
     attr_accessor :default_currency_unit
 
+    # @return [Symbol] the default width for detail-style pages — the show
+    #   page, resource forms and wizard steps. One of
+    #   {Plutonium::UI::PageWidth::VALID_SIZES}; `:full` opts out of any
+    #   constraint. Definitions override per-resource via `page_width`
+    #   (and `form_width` / `display_width` for one surface only).
+    #
+    #   Index and table pages are NOT affected — they want every pixel.
+    attr_accessor :default_page_width
+
+    # @return [Boolean] whether a rendered collection — an index page, a kanban
+    #   board, a CSV export — eager-loads the associations and attachments it is
+    #   about to show. On by default.
+    #
+    #   The rendered field set is declared, not discovered: it is resolved from
+    #   the policy before the collection loads, so the framework already knows
+    #   which associations will be touched and can preload exactly those. Turn it
+    #   off globally here, or per controller via `auto_eager_load_collections?`.
+    attr_accessor :auto_eager_load_collections
+
     # @return [String, nil] the default country (ISO2 code, e.g. "gh") for phone
     #   (`as: :phone`) inputs that don't set their own `initial_country:`. `nil`
     #   (default) leaves it to the intl-tel-input library (no country preselected).
-    attr_accessor :default_phone_country
+    #   Stored verbatim — read it back exactly as set. Consumers that feed
+    #   intl-tel-input should use {#normalized_default_phone_country}.
+    attr_reader :default_phone_country
+
+    # @return [String, nil] {#default_phone_country} downcased to the lowercase
+    #   ISO2 form intl-tel-input expects, so callers can set "GH" or "gh"
+    #   interchangeably. `nil` stays `nil`. Computed once on assignment.
+    attr_reader :normalized_default_phone_country
+
+    def default_phone_country=(value)
+      @default_phone_country = value
+      @normalized_default_phone_country = value&.downcase
+    end
+
+    # Valid values for {#nested_association_routes}.
+    NESTED_ASSOCIATION_ROUTE_MODES = %i[detected declared].freeze
+
+    # @return [Symbol] where a resource's nested routes come from.
+    #
+    #   `:detected` (default) draws one for every `has_many` and `has_one` whose
+    #   child is a registered resource, which is how Plutonium has always behaved.
+    #
+    #   `:declared` draws only what `register_resource` names:
+    #
+    #     register_resource ::Post, associations: %i[comments post_detail]
+    #
+    #   A resource that names none then gets no nested routes at all. Naming
+    #   associations works in either mode; the mode only decides what silence means.
+    #
+    #   Note that a policy's `permitted_associations` renders a panel on the show
+    #   page that links to the nested route, so an association permitted there and
+    #   omitted here has a panel with nowhere to point.
+    attr_reader :nested_association_routes
+
+    # @param value [Symbol] one of {NESTED_ASSOCIATION_ROUTE_MODES}
+    # @raise [ArgumentError] on any other value, rather than silently drawing
+    #   the wrong route table for a typo.
+    def nested_association_routes=(value)
+      value = value.to_sym
+      unless NESTED_ASSOCIATION_ROUTE_MODES.include?(value)
+        raise ArgumentError, "unknown nested_association_routes #{value.inspect}. " \
+          "Valid modes: #{NESTED_ASSOCIATION_ROUTE_MODES.map(&:inspect).join(", ")}"
+      end
+
+      @nested_association_routes = value
+    end
 
     # Map of version numbers to their default configurations
     VERSION_DEFAULTS = {
@@ -70,12 +147,16 @@ module Plutonium
       @defaults_version = nil
       @assets = AssetConfiguration.new
       @wizards = Plutonium::Wizard::Configuration.new
+      @async_interactions = Plutonium::Interaction::Async::Configuration.new
 
       @development = parse_boolean_env("PLUTONIUM_DEV")
       @cache_discovery = !Rails.env.development?
       @enable_hotreload = Rails.env.development?
       @shell = :modern
       @navii_host_url = "https://api.navii.dev"
+      @auto_eager_load_collections = true
+      @default_page_width = :md
+      @nested_association_routes = :detected
     end
 
     # Load default configuration for a specific version

data/lib/plutonium/core/controller.rb

@@ -40,7 +40,8 @@ module Plutonium
 
         helper Plutonium::Helpers
         helper_method :make_page_title, :resource_url_for,
-          :resource_url_args_for, :root_path, :app_name, :route_options_to_url
+          :resource_url_args_for, :root_path, :app_name, :route_options_to_url,
+          :current_page_path, :current_page_url
 
         append_view_path File.expand_path("app/views", Plutonium.root)
         layout -> { turbo_frame_request? ? false : "resource" }
@@ -140,7 +141,7 @@ module Plutonium
 
         if wizard
           raise ArgumentError, "cannot pass both `wizard:` and `action:`" if action
-          action = wizard_action_type_for(element, step: kwargs[:step])
+          action = wizard_action_type_for(element, step: kwargs[:step], wizard_action: kwargs.delete(:wizard_action))
           kwargs[:wizard_name] = wizard
         end
 
@@ -171,6 +172,24 @@ module Plutonium
         build_top_level_resource_url_args(element, action: action, **kwargs)
       end
 
+      # The path/URL of the PAGE this render belongs to.
+      #
+      # Almost always the current request — but not always. An action that
+      # answers a turbo_stream on behalf of a page the user is already looking
+      # at (the reposition drop POST, for one) renders that page's components
+      # from a DIFFERENT request path, and every URL those components build —
+      # sort links, the search form action, filter-pill removals, pagination,
+      # a row action's return_to — must point at the page, not at the POST
+      # endpoint. Reading them off `request` directly would bake the endpoint
+      # path into all of those links (a GET of the POST-only route → 404).
+      #
+      # Overriding these two is therefore the single seam for "render this
+      # collection as the index request would have rendered it"; see
+      # Plutonium::Resource::Controllers::PositionActions.
+      def current_page_path = request.path
+
+      def current_page_url = request.original_url
+
       def resource_url_for(*args, package: nil, **kwargs)
         url_args = resource_url_args_for(*args, package: package, **kwargs)
         url_helpers = route_url_helpers_for(package)
@@ -204,12 +223,24 @@ module Plutonium
       # classes/symbols/nil → collection (wizards have no bulk variant). With no
       # `step:`, target the bare LAUNCH action (which resolves the run and redirects
       # to its current step); with a `step:`, target the stepped show action.
-      def wizard_action_type_for(element, step: nil)
+      #
+      # `wizard_action: :cancel` targets the DELETE action that abandons the run.
+      # A run is cancelled as a whole, so that route carries no `:step` segment and
+      # `step:` is ignored for it.
+      def wizard_action_type_for(element, step: nil, wizard_action: nil)
         member = !(element.is_a?(Class) || element.is_a?(Symbol) || element.nil?)
-        if step.nil?
-          member ? :launch_wizard_record_action : :launch_wizard_resource_action
+
+        case wizard_action
+        when nil
+          if step.nil?
+            member ? :launch_wizard_record_action : :launch_wizard_resource_action
+          else
+            member ? :wizard_record_action : :wizard_resource_action
+          end
+        when :cancel
+          member ? :cancel_wizard_record_action : :cancel_wizard_resource_action
         else
-          member ? :wizard_record_action : :wizard_resource_action
+          raise ArgumentError, "unknown `wizard_action:` #{wizard_action.inspect} (expected :cancel or nil)"
         end
       end
 
@@ -257,7 +288,19 @@ module Plutonium
           "#{scoped_entity_param_key}_"
         end
 
-        helper_name = :"#{helper_suffix}#{entity_prefix}#{helper_base}_path"
+        # For association names that singularize to themselves ("comment_series",
+        # "news", anything ending in an uncountable word), the member and
+        # collection helpers above resolve to the same string. Rails breaks that
+        # tie by suffixing the collection route with _index, exactly as it does
+        # for top-level resources — without matching it here the helper named
+        # does not exist, url_for falls back to param recall, and a collection
+        # link comes back as a member action with no id.
+        uncountable_index_suffix = if is_collection_action && !is_singular &&
+            nested_resource_name.pluralize == nested_resource_name.singularize
+          "_index"
+        end
+
+        helper_name = :"#{helper_suffix}#{entity_prefix}#{helper_base}#{uncountable_index_suffix}_path"
 
         # Build the arguments for the helper
         helper_args = []

data/lib/plutonium/core/controllers/authorizable.rb

@@ -48,6 +48,22 @@ module Plutonium
           @current_scoped_entity if scoped_to_entity?
         end
 
+        # Drops ActionPolicy's per-request authorization context memo.
+        #
+        # ActionPolicy builds the context once and memoizes it for the whole request.
+        # Our entity_scope resolves lazily, and the very first authorization of the
+        # request is the scoped entity's own read? check — which runs while
+        # @current_scoped_entity is still nil (see entity_scope_for_authorize above).
+        # That freezes `entity_scope: nil` into the memo, so every later
+        # `policy_for(record:)` / `allowed_to?` that does not pass an explicit
+        # `context:` builds its policy with no entity scope.
+        #
+        # Callers that resolve the scoped entity must invalidate the memo so the
+        # next policy build picks the entity up.
+        def reset_authorization_context!
+          @_authorization_context = nil
+        end
+
         def verify_authorized
           # we don't use action policy's inbuilt checks, so ensure they are neutered,
           # also ensures pundit checks are disabled.

data/lib/plutonium/core/controllers/entity_scoping.rb

@@ -77,8 +77,18 @@ module Plutonium
           # this method might be invoked even when not authenticated.
           # so let's guard against that.
           return unless current_user.present?
-
-          @current_scoped_entity ||= fetch_current_scoped_entity
+          return @current_scoped_entity if @current_scoped_entity
+
+          @current_scoped_entity = fetch_current_scoped_entity
+          # fetch_current_scoped_entity authorizes while @current_scoped_entity is
+          # still nil, which memoizes `entity_scope: nil` into ActionPolicy's
+          # per-request context. Drop it now that the entity is available.
+          #
+          # Only when we actually resolved one: a strategy that yields nil leaves
+          # the memo correct as-is, and since nil is not memoized above, resetting
+          # here would re-run the fetch and rebuild the context on every call.
+          reset_authorization_context! if @current_scoped_entity
+          @current_scoped_entity
         end
 
         # Fetches the current scoped entity based on the scoping strategy.

data/lib/plutonium/definition/base.rb

@@ -31,11 +31,16 @@ module Plutonium
       include Actions
       include Wizards
       include Sorting
+      # After Actions and Sorting: `position_on` expands into `action`,
+      # `sort` and `default_sort`, so those must already be defined.
+      include Positioning
       include Scoping
       include Search
       include NestedInputs
       include StructuredInputs
       include FormLayout
+      include DisplayLayout
+      include PageWidths
       include IndexViews
       include Metadata
 
@@ -145,6 +150,52 @@ module Plutonium
         self.show_in_config = value
       end
 
+      # The model this definition describes — the inverse of the
+      # `"#{resource_class}Definition"` lookup controllers do
+      # (Plutonium::Resource::Controller#resource_definition).
+      #
+      # A definition is frequently namespaced under a package or portal that
+      # the model is NOT (`AdminPortal::Blogging::TutorialDefinition` describes
+      # `Blogging::Tutorial`), so leading namespace segments are dropped one at
+      # a time until an ActiveRecord model resolves.
+      #
+      # One case is genuinely unresolvable by name alone: `Admin::UserDefinition`
+      # where BOTH `Admin::User` and `::User` are models. Innermost wins, since a
+      # namespaced definition most often describes the namespaced model — if that
+      # is the wrong guess, override `model_class` on the definition.
+      #
+      # Resolved lazily and memoized: it constantizes the model, and a
+      # definition class body must stay loadable without forcing that.
+      def self.model_class
+        @model_class ||= infer_model_class
+      end
+
+      def self.infer_model_class
+        raise NameError, "cannot infer a model class for an anonymous definition; define `model_class` on it" if name.nil?
+
+        segments = name.split("::")
+        base = segments.pop.delete_suffix("Definition")
+        if base.empty?
+          raise NameError, "#{name} does not follow the `<Model>Definition` naming convention; define `model_class` on it"
+        end
+
+        # Only an ActiveRecord model can be the answer, so a namespace module, a
+        # stdlib constant (Set, Process) or a same-named PORO is skipped rather
+        # than accepted — the search continues outward to the model that
+        # actually exists. Without this the first constant that merely *resolves*
+        # wins, and `Billing::OrderDefinition` in an app with no `Billing::Order`
+        # would silently memoize something that is not a model at all.
+        segments.size.downto(0) do |i|
+          klass = (segments.last(i) + [base]).join("::").safe_constantize
+          return klass if klass.is_a?(Class) && klass < ActiveRecord::Base
+        end
+
+        raise NameError, "could not infer a model class from #{name}; define `model_class` on it"
+      end
+      private_class_method :infer_model_class
+
+      def model_class = self.class.model_class
+
       def initialize
         super
       end