rbacan 0.3.1 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4c7c83e7614f1a076cad01e548331f8955bccd3c766ccec2ef6d25efdb0513fa
-  data.tar.gz: 6508cbb415d83cb6f46b03fdd978e19e0e95b41aa7aa63d363e42d79af88fd25
+  metadata.gz: 066e77f9b2f426249a569e679c9c1348e28b2f3af5f19f480a9059ce237b5258
+  data.tar.gz: 83cb20bd2b2e97c558f0f97f2c0452417f01668f73cc3bccbf48eddde3e7cd81
 SHA512:
-  metadata.gz: 1ad7859a4ec5a84c5c03e15e7c87192ce13f98dbef56ba79235fd9fbf30e4d077bfae8929e85722ca276d0233a2cdd9f229bd0026b4c0a0a189343f3bf6acede
-  data.tar.gz: 20475109b9d14d6ecce15b23bbf153fb5482f8a241ec3d7284e96a7798e0068565cb9e9a72405242a4d289806f58f3f501bc2ba911ae5692a36e1d2fd0cb5356
+  metadata.gz: 5b2c8e3ac69a2fc9ea125022eb1d8ac2fd63ee702c2b6e8b1300e6c5dc317ae9db8b5dc1fd96167ea418b1a1cded3f2b7282edd6f09a2ec4fd19783556b4eb4d
+  data.tar.gz: f1a0312c57018c184383266dfeab2b9c2fe216431e63558996d14162e1c56291c85edee0ab00bab716498da4bd34f7d3dd56232ded31e48947b1c932078ac72a

data/.gitignore

@@ -9,3 +9,6 @@
 
 # rspec failure tracking
 .rspec_status
+
+# Built gem files
+*.gem

data/CHANGELOG.md

@@ -2,6 +2,34 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.4.0] - 2026-04-13
+
+### Added
+
+- `primary_key_type` config option — auto-detects host app's primary key type (supports `:uuid` and `:bigint`)
+- `tenant_scoped` config option — when `true`, adds `tenant_id` to `roles` and `user_roles` tables
+- `tenant_class` config option — configurable tenant model class name (default: `"Tenant"`)
+- `Rbacan.resolve_primary_key_type` — helper to resolve the effective PK type at runtime
+- Tenant-aware methods on `Permittable`:
+  - `roles_for_tenant(tenant_id)` — returns roles assigned in a specific tenant (+ global)
+  - `has_role_in_tenant?(role_name, tenant_id)` — checks role in tenant context
+  - `can_in_tenant?(permission_name, tenant_id)` — checks permission in tenant context
+- `assign_role` now accepts optional `tenant_id:` keyword argument for tenant-scoped assignments
+- `remove_role` now accepts optional `tenant_id:` keyword argument
+- `Role` scopes: `.global` (where tenant_id IS NULL), `.for_tenant(tenant_id)` (tenant + global roles)
+- `Role` model: conditional `belongs_to :tenant` when `tenant_scoped` is enabled
+- `UserRole` model: conditional `belongs_to :tenant` when `tenant_scoped` is enabled
+- Initializer template now documents all new configuration options
+- Migration templates now use explicit `type:` on `t.references` for FK columns
+
+### Fixed
+
+- `t.bigint :user_id` was hardcoded in `create_user_roles` migration — now uses `t.references :user` with proper type detection matching the host app's PK type
+- Migration templates now conditionally pass `id: :uuid` to `create_table` based on host app configuration
+- `create_role_permissions` migration now specifies explicit `type:` on foreign key references
+
+---
+
 ## [0.3.0] - 2026-03-31
 
 ### Added

data/CLAUDE.md

@@ -0,0 +1,51 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Commands
+
+```bash
+bin/setup          # install dependencies
+rake spec          # run all tests
+bundle exec rspec spec/rbacan_spec.rb   # run a single spec file
+bundle exec rake install   # install gem locally
+bundle exec rake release   # tag, push commits/tags, push .gem to RubyGems
+gem build rbacan.gemspec   # build .gem file manually
+gem push rbacan-<version>.gem           # push to RubyGems manually
+```
+
+## Architecture
+
+This is a Rails engine gem that provides Role-Based Access Control (RBAC).
+
+**Data model** — four tables managed by the gem's migrations:
+- `roles` / `permissions` — named entities
+- `role_permissions` — join table linking roles to permissions
+- `user_roles` — join table linking the host app's user model to roles
+
+**Entry points:**
+- `lib/rbacan.rb` — main module; holds `mattr_accessor` config accessors and a `configure` block. All class names and table names are configurable here (defaults to `User`, `Rbacan::Role`, etc.).
+- `lib/rbacan/permittable.rb` — `ActiveSupport::Concern` included in the host app's user model via `include Rbacan::Permittable`. Adds `assign_role`, `remove_role`, and `can?` instance methods.
+- `lib/rbacan/roles_and_permissions.rb` — utility module (`RolesAndPermissions`) used in seeds to bulk-create roles/permissions and assign permissions to roles.
+- `lib/rbacan/engine.rb` — Rails engine that auto-loads `app/models`.
+
+**Generator** (`rails generate rbacan:install`) copies four migration files, `db/copy_to_seeds.rb`, and `config/initializers/rbacan.rb` into the host app.
+
+**Configuration** (host app's `config/initializers/rbacan.rb`):
+```ruby
+Rbacan.configure do |config|
+  config.permittable_class = "User"  # change if your user model has a different name
+end
+```
+
+## Releasing a new version
+
+1. Bump `lib/rbacan/version.rb`
+2. `gem build rbacan.gemspec`
+3. `gem push rbacan-<version>.gem`
+
+RubyGems push host is `https://rubygems.org`. GitHub repo: `https://github.com/hamdi777/RBACan`.
+
+## Known state
+
+The spec suite has a placeholder test (`expect(false).to eq(true)`) in `spec/rbacan_spec.rb` that intentionally fails — it was never replaced with real tests.

data/Gemfile.lock

@@ -1,8 +1,8 @@
 PATH
   remote: .
   specs:
-    rbacan (0.3.1)
-      rails (>= 5.2)
+    rbacan (0.4.0)
+      rails (>= 5.2, < 9)
 
 GEM
   remote: https://rubygems.org/
@@ -82,7 +82,7 @@ GEM
       tzinfo (~> 2.0, >= 2.0.5)
       uri (>= 0.13.1)
     base64 (0.3.0)
-    bigdecimal (4.1.0)
+    bigdecimal (4.1.1)
     builder (3.3.0)
     concurrent-ruby (1.3.6)
     connection_pool (3.0.2)
@@ -118,8 +118,7 @@ GEM
       net-smtp
     marcel (1.1.0)
     mini_mime (1.1.5)
-    mini_portile2 (2.8.9)
-    minitest (6.0.2)
+    minitest (6.0.3)
       drb (~> 2.0)
       prism (~> 1.5)
     net-imap (0.6.3)
@@ -132,11 +131,22 @@ GEM
     net-smtp (0.5.1)
       net-protocol
     nio4r (2.7.5)
-    nokogiri (1.19.2)
-      mini_portile2 (~> 2.8.2)
+    nokogiri (1.19.2-aarch64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.2-aarch64-linux-musl)
+      racc (~> 1.4)
+    nokogiri (1.19.2-arm-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.2-arm-linux-musl)
+      racc (~> 1.4)
+    nokogiri (1.19.2-arm64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.2-x86_64-darwin)
       racc (~> 1.4)
     nokogiri (1.19.2-x86_64-linux-gnu)
       racc (~> 1.4)
+    nokogiri (1.19.2-x86_64-linux-musl)
+      racc (~> 1.4)
     pp (0.6.3)
       prettyprint
     prettyprint (0.2.0)
@@ -146,7 +156,7 @@ GEM
       stringio
     racc (1.8.1)
     rack (3.2.6)
-    rack-session (2.1.1)
+    rack-session (2.1.2)
       base64 (>= 0.1.0)
       rack (>= 3.0.0)
     rack-test (2.2.0)
@@ -204,9 +214,14 @@ GEM
       rspec-support (~> 3.13.0)
     rspec-support (3.13.7)
     securerandom (0.4.1)
-    sqlite3 (2.9.2)
-      mini_portile2 (~> 2.8.0)
+    sqlite3 (2.9.2-aarch64-linux-gnu)
+    sqlite3 (2.9.2-aarch64-linux-musl)
+    sqlite3 (2.9.2-arm-linux-gnu)
+    sqlite3 (2.9.2-arm-linux-musl)
+    sqlite3 (2.9.2-arm64-darwin)
+    sqlite3 (2.9.2-x86_64-darwin)
     sqlite3 (2.9.2-x86_64-linux-gnu)
+    sqlite3 (2.9.2-x86_64-linux-musl)
     stringio (3.2.0)
     thor (1.5.0)
     timeout (0.6.1)
@@ -222,18 +237,24 @@ GEM
     zeitwerk (2.7.5)
 
 PLATFORMS
-  ruby
-  x86_64-linux
+  aarch64-linux-gnu
+  aarch64-linux-musl
+  arm-linux-gnu
+  arm-linux-musl
+  arm64-darwin
+  x86_64-darwin
+  x86_64-linux-gnu
+  x86_64-linux-musl
 
 DEPENDENCIES
-  activerecord (>= 5.2)
+  activerecord (>= 5.2, < 9)
   bundler (>= 2.0)
   generator_spec (~> 0.9.4)
-  railties (>= 5.2)
+  railties (>= 5.2, < 9)
   rake (~> 13.0)
   rbacan!
   rspec (~> 3.0)
-  sqlite3 (>= 1.4)
+  sqlite3
 
 CHECKSUMS
   action_text-trix (2.1.18) sha256=3fdb83f8bff4145d098be283cdd47ac41caf5110bfa6df4695ed7127d7fb3642
@@ -249,7 +270,7 @@ CHECKSUMS
   activestorage (8.1.3) sha256=0564ce9309143951a67615e1bb4e090ee54b8befed417133cae614479b46384d
   activesupport (8.1.3) sha256=21a5e0dfbd4c3ddd9e1317ec6a4d782fa226e7867dc70b0743acda81a1dca20e
   base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
-  bigdecimal (4.1.0) sha256=6dc07767aa3dc456ccd48e7ae70a07b474e9afd7c5bc576f80bd6da5c8dd6cae
+  bigdecimal (4.1.1) sha256=1c09efab961da45203c8316b0cdaec0ff391dfadb952dd459584b63ebf8054ca
   builder (3.3.0) sha256=497918d2f9dca528fdca4b88d84e4ef4387256d984b8154e9d5d3fe5a9c8835f
   concurrent-ruby (1.3.6) sha256=6b56837e1e7e5292f9864f34b69c5a2cbc75c0cf5338f1ce9903d10fa762d5ab
   connection_pool (3.0.2) sha256=33fff5ba71a12d2aa26cb72b1db8bba2a1a01823559fb01d29eb74c286e62e0a
@@ -270,22 +291,27 @@ CHECKSUMS
   mail (2.9.0) sha256=6fa6673ecd71c60c2d996260f9ee3dd387d4673b8169b502134659ece6d34941
   marcel (1.1.0) sha256=fdcfcfa33cc52e93c4308d40e4090a5d4ea279e160a7f6af988260fa970e0bee
   mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef
-  mini_portile2 (2.8.9) sha256=0cd7c7f824e010c072e33f68bc02d85a00aeb6fce05bb4819c03dfd3c140c289
-  minitest (6.0.2) sha256=db6e57956f6ecc6134683b4c87467d6dd792323c7f0eea7b93f66bd284adbc3d
+  minitest (6.0.3) sha256=88ac8a1de36c00692420e7cb3cc11a0773bbcb126aee1c249f320160a7d11411
   net-imap (0.6.3) sha256=9bab75f876596d09ee7bf911a291da478e0cd6badc54dfb82874855ccc82f2ad
   net-pop (0.1.2) sha256=848b4e982013c15b2f0382792268763b748cce91c9e91e36b0f27ed26420dff3
   net-protocol (0.2.2) sha256=aa73e0cba6a125369de9837b8d8ef82a61849360eba0521900e2c3713aa162a8
   net-smtp (0.5.1) sha256=ed96a0af63c524fceb4b29b0d352195c30d82dd916a42f03c62a3a70e5b70736
   nio4r (2.7.5) sha256=6c90168e48fb5f8e768419c93abb94ba2b892a1d0602cb06eef16d8b7df1dca1
-  nokogiri (1.19.2) sha256=38fdd8b59db3d5ea9e7dfb14702e882b9bf819198d5bf976f17ebce12c481756
+  nokogiri (1.19.2-aarch64-linux-gnu) sha256=c34d5c8208025587554608e98fd88ab125b29c80f9352b821964e9a5d5cfbd19
+  nokogiri (1.19.2-aarch64-linux-musl) sha256=7f6b4b0202d507326841a4f790294bf75098aef50c7173443812e3ac5cb06515
+  nokogiri (1.19.2-arm-linux-gnu) sha256=b7fa1139016f3dc850bda1260988f0d749934a939d04ef2da13bec060d7d5081
+  nokogiri (1.19.2-arm-linux-musl) sha256=61114d44f6742ff72194a1b3020967201e2eb982814778d130f6471c11f9828c
+  nokogiri (1.19.2-arm64-darwin) sha256=58d8ea2e31a967b843b70487a44c14c8ba1866daa1b9da9be9dbdf1b43dee205
+  nokogiri (1.19.2-x86_64-darwin) sha256=7d9af11fda72dfaa2961d8c4d5380ca0b51bc389dc5f8d4b859b9644f195e7a4
   nokogiri (1.19.2-x86_64-linux-gnu) sha256=fa8feca882b73e871a9845f3817a72e9734c8e974bdc4fbad6e4bc6e8076b94f
+  nokogiri (1.19.2-x86_64-linux-musl) sha256=93128448e61a9383a30baef041bf1f5817e22f297a1d400521e90294445069a8
   pp (0.6.3) sha256=2951d514450b93ccfeb1df7d021cae0da16e0a7f95ee1e2273719669d0ab9df6
   prettyprint (0.2.0) sha256=2bc9e15581a94742064a3cc8b0fb9d45aae3d03a1baa6ef80922627a0766f193
   prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
   psych (5.3.1) sha256=eb7a57cef10c9d70173ff74e739d843ac3b2c019a003de48447b2963d81b1974
   racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
   rack (3.2.6) sha256=5ed78e1f73b2e25679bec7d45ee2d4483cc4146eb1be0264fc4d94cb5ef212c2
-  rack-session (2.1.1) sha256=0b6dc07dea7e4b583f58a48e8b806d4c9f1c6c9214ebc202ec94562cbea2e4e9
+  rack-session (2.1.2) sha256=595434f8c0c3473ae7d7ac56ecda6cc6dfd9d37c0b2b5255330aa1576967ffe8
   rack-test (2.2.0) sha256=005a36692c306ac0b4a9350355ee080fd09ddef1148a5f8b2ac636c720f5c463
   rackup (2.3.1) sha256=6c79c26753778e90983761d677a48937ee3192b3ffef6bc963c0950f94688868
   rails (8.1.3) sha256=6d017ba5348c98fc909753a8169b21d44de14d2a0b92d140d1a966834c3c9cd3
@@ -293,7 +319,7 @@ CHECKSUMS
   rails-html-sanitizer (1.7.0) sha256=28b145cceaf9cc214a9874feaa183c3acba036c9592b19886e0e45efc62b1e89
   railties (8.1.3) sha256=913eb0e0cb520aac687ffd74916bd726d48fa21f47833c6292576ef6a286de22
   rake (13.3.1) sha256=8c9e89d09f66a26a01264e7e3480ec0607f0c497a861ef16063604b1b08eb19c
-  rbacan (0.3.1)
+  rbacan (0.4.0)
   rdoc (7.2.0) sha256=8650f76cd4009c3b54955eb5d7e3a075c60a57276766ebf36f9085e8c9f23192
   reline (0.6.3) sha256=1198b04973565b36ec0f11542ab3f5cfeeec34823f4e54cebde90968092b1835
   rspec (3.13.2) sha256=206284a08ad798e61f86d7ca3e376718d52c0bc944626b2349266f239f820587
@@ -302,8 +328,14 @@ CHECKSUMS
   rspec-mocks (3.13.8) sha256=086ad3d3d17533f4237643de0b5c42f04b66348c28bf6b9c2d3f4a3b01af1d47
   rspec-support (3.13.7) sha256=0640e5570872aafefd79867901deeeeb40b0c9875a36b983d85f54fb7381c47c
   securerandom (0.4.1) sha256=cc5193d414a4341b6e225f0cb4446aceca8e50d5e1888743fac16987638ea0b1
-  sqlite3 (2.9.2) sha256=86814150714b6b06a328d083f46408e7a4a83b5f0a9673ed934ee3a1cb7a73b1
+  sqlite3 (2.9.2-aarch64-linux-gnu) sha256=eeb86db55645b85327ba75129e3614658d974bf4da8fdc87018a0d42c59f6e42
+  sqlite3 (2.9.2-aarch64-linux-musl) sha256=4feff91fb8c2b13688da34b5627c9d1ed9cedb3ee87a7114ec82209147f07a6d
+  sqlite3 (2.9.2-arm-linux-gnu) sha256=1ee2eb06b5301aaf5ce343a6e88d99ac932d95202d7b350f0e7b6d8d588580d7
+  sqlite3 (2.9.2-arm-linux-musl) sha256=8ca0de6aceede968de0394e22e95d549834c4d8e318f69a92a52f049878a0057
+  sqlite3 (2.9.2-arm64-darwin) sha256=d15bd9609a05f9d54930babe039585efc8cadd57517c15b64ec7dfa75158a5e9
+  sqlite3 (2.9.2-x86_64-darwin) sha256=ed691b5021674d72582d03c5a38e89634b961902735fb6225273892805421d13
   sqlite3 (2.9.2-x86_64-linux-gnu) sha256=dce83ffcb7e72f9f7aeb6e5404f15d277a45332fe18ccce8a8b3ed51e8d23aee
+  sqlite3 (2.9.2-x86_64-linux-musl) sha256=e8dd906a613f13b60f6d47ae9dda376384d9de1ab3f7e3f2fdf2fd18a871a2d7
   stringio (3.2.0) sha256=c37cb2e58b4ffbd33fe5cd948c05934af997b36e0b6ca6fdf43afa234cf222e1
   thor (1.5.0) sha256=e3a9e55fe857e44859ce104a84675ab6e8cd59c650a49106a05f55f136425e73
   timeout (0.6.1) sha256=78f57368a7e7bbadec56971f78a3f5ecbcfb59b7fcbb0a3ed6ddc08a5094accb

data/app/models/rbacan/role.rb

@@ -1,13 +1,26 @@
 module Rbacan
-    class Role < ApplicationRecord
-        self.table_name = Rbacan.role_table
+  class Role < ApplicationRecord
+    self.table_name = Rbacan.role_table
 
-        validates :name, presence: true, uniqueness: true
-        
-        has_many :role_permissions, class_name: Rbacan.role_permission_class, dependent: :destroy
-        has_many :permissions, class_name: Rbacan.permission_class, through: :role_permissions
+    validates :name, presence: true
+    validates :name, uniqueness: true, unless: -> { Rbacan.tenant_scoped && tenant_id.present? }
+    validates :name, uniqueness: { scope: :tenant_id }, if: -> { Rbacan.tenant_scoped && tenant_id.present? }
 
-        has_many :user_roles, class_name: Rbacan.user_role_class, dependent: :destroy
-        has_many :users, class_name: Rbacan.permittable_class, through: :user_roles
-    end
+    has_many :role_permissions, class_name: Rbacan.role_permission_class, dependent: :destroy
+    has_many :permissions, class_name: Rbacan.permission_class, through: :role_permissions
+
+    has_many :user_roles, class_name: Rbacan.user_role_class, dependent: :destroy
+    has_many :users, class_name: Rbacan.permittable_class, through: :user_roles
+
+    # Tenant association — only meaningful when tenant_scoped is enabled.
+    # The column must exist in the database; it is added by the migration
+    # when tenant_scoped is true.
+    belongs_to :tenant, class_name: Rbacan.tenant_class, optional: true if Rbacan.tenant_scoped
+
+    # Global roles have no tenant (tenant_id IS NULL).
+    scope :global, -> { where(tenant_id: nil) }
+
+    # Returns roles available for a specific tenant: its own roles plus global roles.
+    scope :for_tenant, ->(tenant_id) { where(tenant_id: [tenant_id, nil]) }
+  end
 end

data/app/models/rbacan/user_role.rb

@@ -1,8 +1,11 @@
 module Rbacan
-    class UserRole < ApplicationRecord
-        self.table_name = Rbacan.user_role_table
+  class UserRole < ApplicationRecord
+    self.table_name = Rbacan.user_role_table
 
-        belongs_to :role, class_name: Rbacan.role_class
-        belongs_to :user, class_name: Rbacan.permittable_class
-    end
+    belongs_to :role, class_name: Rbacan.role_class
+    belongs_to :user, class_name: Rbacan.permittable_class
+
+    # Tenant association — only meaningful when tenant_scoped is enabled.
+    belongs_to :tenant, class_name: Rbacan.tenant_class, optional: true if Rbacan.tenant_scoped
+  end
 end

data/lib/generators/install/templates/create_permissions.rb

@@ -1,6 +1,6 @@
 class CreatePermissions < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
   def change
-    create_table :permissions do |t|
+    create_table :permissions<%= ", id: :uuid" if primary_key_type == :uuid %> do |t|
       t.string :name, null: false
 
       t.timestamps

data/lib/generators/install/templates/create_role_permissions.rb

@@ -1,8 +1,8 @@
 class CreateRolePermissions < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
   def change
-    create_table :role_permissions do |t|
-      t.references :role,       null: false, index: true, foreign_key: { to_table: :roles,       on_delete: :cascade }
-      t.references :permission, null: false, index: true, foreign_key: { to_table: :permissions, on_delete: :cascade }
+    create_table :role_permissions<%= ", id: :uuid" if primary_key_type == :uuid %> do |t|
+      t.references :role,       null: false, type: :<%= primary_key_type %>, index: true, foreign_key: { to_table: :roles,       on_delete: :cascade }
+      t.references :permission, null: false, type: :<%= primary_key_type %>, index: true, foreign_key: { to_table: :permissions, on_delete: :cascade }
 
       t.timestamps
     end

data/lib/generators/install/templates/create_roles.rb

@@ -1,11 +1,20 @@
 class CreateRoles < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
   def change
-    create_table :roles do |t|
+    create_table :roles<%= ", id: :uuid" if primary_key_type == :uuid %> do |t|
       t.string :name, null: false
+<% if tenant_scoped? %>
+      t.references :tenant, null: true, type: :<%= primary_key_type %>, index: true
+<% end %>
 
       t.timestamps
     end
+<% if tenant_scoped? %>
+
+    add_index :roles, :name, unique: true, where: "tenant_id IS NULL", name: "index_roles_on_name_global"
+    add_index :roles, [:tenant_id, :name], unique: true, name: "index_roles_on_tenant_id_and_name"
+<% else %>
 
     add_index :roles, :name, unique: true
+<% end %>
   end
 end

data/lib/generators/install/templates/create_user_roles.rb

@@ -1,13 +1,20 @@
 class CreateUserRoles < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
   def change
-    create_table :user_roles do |t|
-      t.references :role, null: false, index: true, foreign_key: { to_table: :roles, on_delete: :cascade }
-      t.bigint :user_id,  null: false
+    create_table :user_roles<%= ", id: :uuid" if primary_key_type == :uuid %> do |t|
+      t.references :role, null: false, type: :<%= primary_key_type %>, index: true, foreign_key: { to_table: :roles, on_delete: :cascade }
+      t.references :user, null: false, type: :<%= primary_key_type %>, index: true
+<% if tenant_scoped? %>
+      t.references :tenant, null: true, type: :<%= primary_key_type %>, index: true
+<% end %>
 
       t.timestamps
     end
+<% if tenant_scoped? %>
+
+    add_index :user_roles, [:user_id, :role_id, :tenant_id], unique: true, name: "index_user_roles_unique"
+<% else %>
 
-    add_index :user_roles, :user_id
     add_index :user_roles, [:user_id, :role_id], unique: true
+<% end %>
   end
 end

data/lib/generators/install/templates/rbacan.rb

@@ -14,6 +14,21 @@ Rbacan.configure do |config|
   # config.user_role_table        = "user_roles"
   # config.role_permission_table  = "role_permissions"
 
+  # Primary key type for generated migrations.
+  # Set to :uuid if your app uses UUID primary keys.
+  # When nil, auto-detects from your Rails generator config (primary_key_type).
+  # config.primary_key_type = :uuid
+
+  # Enable tenant scoping for roles and user_roles.
+  # When true, adds tenant_id to the roles and user_roles tables,
+  # allowing tenant-specific roles and role assignments.
+  # Permissions always remain global regardless of this setting.
+  # config.tenant_scoped = false
+
+  # The name of your tenant model class (default: "Tenant").
+  # Only used when tenant_scoped is true.
+  # config.tenant_class = "Tenant"
+
   # Authorization failure handling:
   #   :raise    — raises Rbacan::NotAuthorized (default)
   #   :redirect — redirects to unauthorized_redirect_path

data/lib/generators/rbacan/install_generator.rb

@@ -5,8 +5,8 @@ module Rbacan
   module Generators
     class InstallGenerator < ::Rails::Generators::Base
       include Rails::Generators::Migration
-      source_root File.expand_path('../../install/templates', __FILE__)
-      desc "Add the migrations for roles and permissions"
+      source_root File.expand_path('../install/templates', __dir__)
+      desc 'Add the migrations for roles and permissions'
 
       def self.next_migration_number(path)
         next_migration_number = current_migration_number(path) + 1
@@ -14,19 +14,38 @@ module Rbacan
       end
 
       def copy_migrations
-        migration_template "create_permissions.rb", "db/migrate/create_permissions.rb"
-        migration_template "create_roles.rb", "db/migrate/create_roles.rb"
-        migration_template "create_role_permissions.rb", "db/migrate/create_role_permissions.rb"
-        migration_template "create_user_roles.rb", "db/migrate/create_user_roles.rb"
+        migration_template 'create_permissions.rb', 'db/migrate/create_permissions.rb'
+        migration_template 'create_roles.rb', 'db/migrate/create_roles.rb'
+        migration_template 'create_role_permissions.rb', 'db/migrate/create_role_permissions.rb'
+        migration_template 'create_user_roles.rb', 'db/migrate/create_user_roles.rb'
       end
 
       def copy_seed
-        copy_file 'copy_to_seeds.rb', "db/copy_to_seeds.rb"
+        copy_file 'copy_to_seeds.rb', 'db/copy_to_seeds.rb'
       end
 
       def copy_initializer
         copy_file 'rbacan.rb', 'config/initializers/rbacan.rb'
       end
+
+      private
+
+      # Resolves the primary key type for migration templates.
+      # Checks the explicit Rbacan config first, then the Rails generator config.
+      def primary_key_type
+        configured = Rbacan.primary_key_type
+        configured ||= begin
+          Rails.configuration.generators.options.dig(:active_record, :primary_key_type)
+        rescue StandardError
+          nil
+        end
+        configured || :bigint
+      end
+
+      # Whether tenant scoping is enabled.
+      def tenant_scoped?
+        Rbacan.tenant_scoped
+      end
     end
   end
 end

data/lib/rbacan/permittable.rb

@@ -7,72 +7,99 @@ module Rbacan
     included do
       has_many :user_roles,
                class_name: Rbacan.user_role_class,
-               dependent:  :destroy
+               dependent: :destroy
       accepts_nested_attributes_for :user_roles
       has_many :roles,
                class_name: Rbacan.role_class,
-               through:    :user_roles
+               through: :user_roles
 
       # Returns users that have the given role (by name).
-      scope :with_role, ->(role_name) {
+      scope :with_role, lambda { |role_name|
         joins(:roles).where(Rbacan.role_table => { name: role_name.to_s })
       }
 
       # Returns users that have the given permission via any of their roles.
-      scope :with_permission, ->(permission_name) {
+      scope :with_permission, lambda { |permission_name|
         joins(roles: { role_permissions: :permission })
           .where(Rbacan.permission_table => { name: permission_name.to_s })
       }
 
       # Assigns a role to the user. Idempotent — safe to call multiple times.
-      # Fix: was find_or_initialize_by (never persisted); now find_or_create_by.
-      def assign_role(role_name)
+      # When tenant_scoped is enabled, pass tenant_id: to scope the assignment.
+      def assign_role(role_name, tenant_id: nil)
         assigned_role = Rbacan.role_class.constantize.find_by_name(role_name.to_s)
         raise ArgumentError, "Role '#{role_name}' not found" unless assigned_role
 
-        self.user_roles.find_or_create_by(role_id: assigned_role.id)
+        attrs = { role_id: assigned_role.id }
+        attrs[:tenant_id] = tenant_id if Rbacan.tenant_scoped
+        user_roles.find_or_create_by(attrs)
       end
 
       # Removes a role from the user.
-      # Fix: was Rbacan::UserRole.where(user_id: ...) — now uses the scoped
-      # association so it respects the configured class and any FK setup.
-      def remove_role(role_name)
+      # When tenant_scoped is enabled, pass tenant_id: to remove from a specific tenant.
+      def remove_role(role_name, tenant_id: nil)
         removed_role = Rbacan.role_class.constantize.find_by_name(role_name.to_s)
         return unless removed_role
 
-        self.user_roles.where(role_id: removed_role.id).destroy_all
+        scope = user_roles.where(role_id: removed_role.id)
+        scope = scope.where(tenant_id: tenant_id) if Rbacan.tenant_scoped
+        scope.destroy_all
       end
 
       # Returns true if the user has the named permission via any of their roles.
-      # Fix: was two queries; now a single EXISTS query via association joins.
       def can?(permission_name)
-        self.roles
-            .joins(role_permissions: :permission)
-            .where(Rbacan.permission_table => { name: permission_name.to_s })
-            .exists?
+        roles
+          .joins(role_permissions: :permission)
+          .where(Rbacan.permission_table => { name: permission_name.to_s })
+          .exists?
+      end
+
+      # Returns true if the user has the named permission in a specific tenant context.
+      # Checks both global role assignments (tenant_id NULL) and tenant-specific ones.
+      def can_in_tenant?(permission_name, tenant_id)
+        roles
+          .joins(role_permissions: :permission)
+          .where(Rbacan.permission_table => { name: permission_name.to_s })
+          .where(Rbacan.user_role_table => { tenant_id: [tenant_id, nil] })
+          .exists?
       end
 
       # Returns true if the user has the named role.
       def has_role?(role_name)
-        self.roles.where(name: role_name.to_s).exists?
+        roles.where(name: role_name.to_s).exists?
+      end
+
+      # Returns true if the user has the named role in a specific tenant context.
+      # Checks both global role assignments (tenant_id NULL) and tenant-specific ones.
+      def has_role_in_tenant?(role_name, tenant_id)
+        user_roles
+          .joins(:role)
+          .where(Rbacan.role_table => { name: role_name.to_s })
+          .where(Rbacan.user_role_table => { tenant_id: [tenant_id, nil] })
+          .exists?
       end
 
       # Returns true if the user has ANY of the listed roles.
       def has_any_role?(*role_names)
-        self.roles.where(name: role_names.map(&:to_s)).exists?
+        roles.where(name: role_names.map(&:to_s)).exists?
       end
 
       # Returns true if the user has ALL of the listed permissions.
-      # Uses a single query: counts distinct matching permissions and compares
-      # to the requested set size.
       def can_all?(*permission_names)
         names = permission_names.map(&:to_s)
-        self.roles
-            .joins(role_permissions: :permission)
-            .where(Rbacan.permission_table => { name: names })
-            .select("#{Rbacan.permission_table}.name")
-            .distinct
-            .count == names.uniq.size
+        roles
+          .joins(role_permissions: :permission)
+          .where(Rbacan.permission_table => { name: names })
+          .select("#{Rbacan.permission_table}.name")
+          .distinct
+          .count == names.uniq.size
+      end
+
+      # Returns roles assigned to this user for a specific tenant.
+      # Includes global role assignments (tenant_id NULL).
+      def roles_for_tenant(tenant_id)
+        roles
+          .where(Rbacan.user_role_table => { tenant_id: [tenant_id, nil] })
       end
     end
   end

data/lib/rbacan/version.rb

@@ -1,3 +1,3 @@
 module Rbacan
-  VERSION = "0.3.1"
+  VERSION = '0.4.0'
 end

data/lib/rbacan.rb

@@ -1,11 +1,11 @@
-require "rbacan/version"
-require "rbacan/not_authorized"
-require "rbacan/permittable"
-require "rbacan/engine"
-require "rbacan/roles_and_permissions"
-require "rbacan/authorization"
-require "rbacan/view_helpers"
-require "rbacan/route_constraint"
+require 'rbacan/version'
+require 'rbacan/not_authorized'
+require 'rbacan/permittable'
+require 'rbacan/engine'
+require 'rbacan/roles_and_permissions'
+require 'rbacan/authorization'
+require 'rbacan/view_helpers'
+require 'rbacan/route_constraint'
 
 module Rbacan
   mattr_accessor :permittable_class
@@ -39,6 +39,33 @@ module Rbacan
   mattr_accessor :unauthorized_redirect_path
   @@unauthorized_redirect_path = '/'
 
+  # Primary key type for generated migrations.
+  # nil = auto-detect from Rails generator config (primary_key_type).
+  # Set to :uuid for UUID primary keys, or :bigint for standard integer keys.
+  mattr_accessor :primary_key_type
+  @@primary_key_type = nil
+
+  # When true, adds tenant_id to roles and user_roles tables,
+  # enabling tenant-scoped roles and role assignments.
+  # Permissions remain global (no tenant_id) regardless of this setting.
+  mattr_accessor :tenant_scoped
+  @@tenant_scoped = false
+
+  # The name of your tenant model class (default: "Tenant").
+  # Only used when tenant_scoped is true.
+  mattr_accessor :tenant_class
+  @@tenant_class = 'Tenant'
+
+  # Resolves the effective primary key type.
+  # Checks the explicit config first, then falls back to the Rails generator config.
+  def self.resolve_primary_key_type
+    return primary_key_type if primary_key_type.present?
+
+    Rails.configuration.generators.options.dig(:active_record, :primary_key_type)
+  rescue StandardError
+    nil
+  end
+
   def self.create_role(role_name)
     @@role_class.constantize.create(name: role_name)
   end
@@ -51,12 +78,12 @@ module Rbacan
     chosen_role      = @@role_class.constantize.find_by_name(role_name)
     given_permission = @@permission_class.constantize.find_by_name(permission_name)
     @@role_permission_class.constantize.create(
-      role_id:       chosen_role.id,
+      role_id: chosen_role.id,
       permission_id: given_permission.id
     )
   end
 
-  def self.configure(&block)
+  def self.configure
     yield self
   end
 

data/rbacan.gemspec

@@ -1,42 +1,39 @@
-
-lib = File.expand_path("../lib", __FILE__)
+lib = File.expand_path('lib', __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
-require "rbacan/version"
+require 'rbacan/version'
 
 Gem::Specification.new do |spec|
-  spec.name          = "rbacan"
+  spec.name          = 'rbacan'
   spec.version       = Rbacan::VERSION
-  spec.authors       = ["hamdi"]
-  spec.email         = ["hamdi_amiche@outlook.fr"]
+  spec.authors       = ['hamdi']
+  spec.email         = ['hamdi_amiche@outlook.fr']
 
-  spec.summary       = %q{A gem to give permission access to users based on their roles}
-  spec.description   = %q{RBACan is a Role-Based Access Control tool to control user access to the functionalities of your application}
-  spec.homepage      = "https://github.com/hamdi777/RBACan"
-  spec.licenses      = ["MIT"]
+  spec.summary       = 'A gem to give permission access to users based on their roles'
+  spec.description   = 'RBACan is a Role-Based Access Control tool to control user access to the functionalities of your application'
+  spec.homepage      = 'https://github.com/hamdi777/RBACan'
+  spec.licenses      = ['MIT']
 
-  if spec.respond_to?(:metadata)
-    spec.metadata["allowed_push_host"] = "https://rubygems.org"
-    spec.metadata["homepage_uri"]      = spec.homepage
-    spec.metadata["changelog_uri"]     = "https://github.com/hamdi777/RBACan/blob/master/CHANGELOG.md"
-  else
-    raise "RubyGems 2.0 or newer is required to protect against public gem pushes."
-  end
+  raise 'RubyGems 2.0 or newer is required to protect against public gem pushes.' unless spec.respond_to?(:metadata)
+
+  spec.metadata['allowed_push_host'] = 'https://rubygems.org'
+  spec.metadata['homepage_uri']      = spec.homepage
+  spec.metadata['changelog_uri']     = 'https://github.com/hamdi777/RBACan/blob/master/CHANGELOG.md'
 
-  spec.files         = Dir.chdir(File.expand_path('..', __FILE__)) do
+  spec.files = Dir.chdir(File.expand_path(__dir__)) do
     `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
   end
-  spec.bindir        = "exe"
+  spec.bindir        = 'exe'
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
-  spec.require_paths = ["lib"]
-  spec.required_ruby_version = ">= 3.0"
+  spec.require_paths = ['lib']
+  spec.required_ruby_version = '>= 3.0'
 
-  spec.add_dependency 'rails', '~> 5.2'
+  spec.add_dependency 'rails', '>= 5.2', '< 9'
 
-  spec.add_development_dependency "bundler",      "~> 2.0"
-  spec.add_development_dependency "rake",         "~> 13.0"
-  spec.add_development_dependency "rspec",        "~> 3.0"
-  spec.add_development_dependency "generator_spec", "~> 0.9.4"
-  spec.add_development_dependency "railties",     "~> 5.2"
-  spec.add_development_dependency "activerecord", "~> 5.2"
-  spec.add_development_dependency "sqlite3",      "~> 1.4"
+  spec.add_development_dependency 'activerecord', '>= 5.2', '< 9'
+  spec.add_development_dependency 'bundler', '>= 2.0'
+  spec.add_development_dependency 'generator_spec', '~> 0.9.4'
+  spec.add_development_dependency 'railties', '>= 5.2', '< 9'
+  spec.add_development_dependency 'rake', '~> 13.0'
+  spec.add_development_dependency 'rspec', '~> 3.0'
+  spec.add_development_dependency 'sqlite3'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rbacan
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.4.0
 platform: ruby
 authors:
 - hamdi
@@ -13,114 +13,132 @@ dependencies:
   name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '5.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '5.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
 - !ruby/object:Gem::Dependency
-  name: bundler
+  name: activerecord
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '5.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '5.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
 - !ruby/object:Gem::Dependency
-  name: rake
+  name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '13.0'
+        version: '2.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '13.0'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
-  name: rspec
+  name: generator_spec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: 0.9.4
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: 0.9.4
 - !ruby/object:Gem::Dependency
-  name: generator_spec
+  name: railties
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.9.4
+        version: '5.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.9.4
+        version: '5.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
 - !ruby/object:Gem::Dependency
-  name: railties
+  name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.2'
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.2'
+        version: '13.0'
 - !ruby/object:Gem::Dependency
-  name: activerecord
+  name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.2'
+        version: '3.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.2'
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.4'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.4'
+        version: '0'
 description: RBACan is a Role-Based Access Control tool to control user access to
   the functionalities of your application
 email:
@@ -133,6 +151,7 @@ files:
 - ".rspec"
 - ".travis.yml"
 - CHANGELOG.md
+- CLAUDE.md
 - CODE_OF_CONDUCT.md
 - Gemfile
 - Gemfile.lock
@@ -184,7 +203,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.8
+rubygems_version: 3.6.9
 specification_version: 4
 summary: A gem to give permission access to users based on their roles
 test_files: []