seams 0.1.0 → 0.2.0

data/lib/generators/seams/accounts/accounts_generator.rb

@@ -77,6 +77,24 @@ module Seams
                                 engine_path("lib/accounts/concerns/authorization.rb")
       end
 
+      # Phase 4 — the one tenant-facing controller the engine ships:
+      # the memberships role picker. Scoped to Accounts::Current.account
+      # and guarded by membership.manage.accounts (see the controller).
+      def create_controllers
+        template_unless_ejected "app/controllers/memberships_controller.rb.tt",
+                                engine_path("app/controllers/accounts/memberships_controller.rb")
+      end
+
+      # Phase 4 — bare-bones view so the role picker renders out of the
+      # box. Plain semantic ERB: NO design-engine (ui_*) helpers, so the
+      # screen works whether or not the opt-in design engine is
+      # installed. Hosts override by dropping a file at
+      # app/views/accounts/memberships/index.html.erb in their own tree.
+      def create_views
+        template_unless_ejected "app/views/memberships/index.html.erb.tt",
+                                engine_path("app/views/accounts/memberships/index.html.erb")
+      end
+
       def create_migrations
         template "db/migrate/create_accounts.rb.tt",
                  engine_path("db/migrate/#{timestamp(0)}_create_accounts.rb")
@@ -154,9 +172,19 @@ module Seams
       end
 
       def create_runtime_specs
-        # Currently a single runtime boot spec covers events, schema,
-        # create_with_owner, and Accounts::Current. Split into multiple
-        # files in a later phase if the file grows past ~120 lines.
+        # The boot spec (written in create_dummy_app) covers events,
+        # schema, create_with_owner, and Accounts::Current. Phase 4 adds
+        # a request-style behavioural spec for the memberships role
+        # picker: the happy path plus each of the three escalation
+        # safeguards.
+        template "spec/runtime/memberships_flow_spec.rb.tt",
+                 engine_path("spec/runtime/accounts_memberships_flow_spec.rb")
+        # Wave 11B / #37 — request-layer regression for the permission
+        # tiers the Accounts::Authorization concern enforces:
+        # deny-by-role, allow-by-role, the platform-staff bypass, and the
+        # cross-tenant guarantee that the ACTIVE membership decides.
+        template "spec/runtime/authorization_spec.rb.tt",
+                 engine_path("spec/runtime/accounts_authorization_spec.rb")
       end
 
       def wire_into_host

data/lib/generators/seams/accounts/templates/app/controllers/memberships_controller.rb.tt

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+module Accounts
+  # Tenant-facing screen where an account admin changes a member's
+  # role. Both actions are scoped to `Accounts::Current.account` and
+  # guarded by the `membership.manage.accounts` ability — the
+  # Authorization concern resolves that against the current
+  # membership's role and applies the platform-staff bypass.
+  #
+  # `#update` enforces three hard safeguards against privilege
+  # escalation (see the guard chain). Each one redirects back with an
+  # alert rather than silently no-opping, so an admin who hits a wall
+  # is told why.
+  class MembershipsController < ApplicationController
+    include Accounts::Authorization
+
+    # owner > admin > member. The screen never assigns `owner` (it is
+    # protected — see safeguard 1) nor `system` (an internal,
+    # human-less actor), so the only roles a picker may offer are
+    # `admin` and `member`.
+    ROLE_RANK        = { "member" => 1, "admin" => 2, "owner" => 3 }.freeze
+    ASSIGNABLE_ROLES = %w[admin member].freeze
+
+    before_action -> { authorize_permission!("membership.manage.accounts") }
+    before_action :set_membership, only: %i[update]
+
+    helper_method :own_membership?, :assignable_roles
+
+    def index
+      @memberships = Accounts::Current.account.memberships.active.order(:created_at)
+    end
+
+    def update
+      violation = escalation_violation
+      return deny(violation) if violation
+
+      @membership.update!(role: requested_role)
+      redirect_to memberships_path, notice: "Role updated."
+    end
+
+    private
+
+    # The safeguard message that blocks this role change, or nil when
+    # the change is allowed. Ordered so each safeguard has a single,
+    # independently testable trigger:
+    #
+    #   2. a user cannot change their own role;
+    #   1a. an owner's role cannot be changed (no demotion);
+    #   --. `system` / unknown roles are never assignable;
+    #   3. a user cannot assign a role senior to their own (owner >
+    #      admin > member) — this is what stops an admin minting an
+    #      owner;
+    #   1b. `owner` is never assignable, even for an acting owner who
+    #      would otherwise clear the senior check.
+    def escalation_violation
+      return "You cannot change your own role." if own_membership?(@membership)
+      return "The owner's role cannot be changed through this screen." if @membership.owner?
+      return "That role cannot be assigned." unless ROLE_RANK.key?(requested_role)
+      return "You cannot assign a role senior to your own." unless actor_can_assign?(requested_role)
+      return "The owner role cannot be assigned here." unless ASSIGNABLE_ROLES.include?(requested_role)
+
+      nil
+    end
+
+    # Always scoped to the current account so an admin can never reach
+    # a membership in another tenant by guessing an id.
+    def set_membership
+      @membership = Accounts::Current.account.memberships.find(params[:id])
+    end
+
+    # Role extracted on its own (never via permit) so the params shape
+    # reads as "we coerce the role ourselves", the same Brakeman-safe
+    # convention the teams engine uses.
+    def requested_role
+      params.dig(:membership, :role).to_s
+    end
+
+    def own_membership?(membership)
+      actor = Accounts::Current.membership
+      actor.present? && actor.id == membership.id
+    end
+
+    # The acting role may assign a target role only when the target is
+    # not senior to the actor's own (owner > admin > member). An actor
+    # with no resolved membership (rank 0) can assign nothing.
+    def actor_can_assign?(role)
+      actor_rank  = ROLE_RANK[current_permission_role].to_i
+      target_rank = ROLE_RANK[role].to_i
+      target_rank.positive? && target_rank <= actor_rank
+    end
+
+    def assignable_roles
+      ASSIGNABLE_ROLES
+    end
+
+    def deny(message)
+      redirect_to memberships_path, alert: message
+    end
+  end
+end

data/lib/generators/seams/accounts/templates/app/views/memberships/index.html.erb.tt

@@ -0,0 +1,52 @@
+<%%# Members of the current account with a per-member role picker. %>
+<%%# Owners and the acting member's own row are locked — the controller %>
+<%%# enforces the same rules server-side; the view just doesn't offer a %>
+<%%# control it knows will be refused. %>
+<%%# %>
+<%%# Plain, semantic ERB on purpose: the design engine is opt-in and may %>
+<%%# not be installed, so this view must NOT call ui_* helpers (they would %>
+<%%# raise when design is absent). Sensible class names let the design %>
+<%%# system style it if present, with zero hard dependency. %>
+<h1 class="accounts-memberships__title">Members</h1>
+
+<%%= content_tag :p, flash[:notice], class: "accounts-memberships__notice" if flash[:notice] %>
+<%%= content_tag :p, flash[:alert],  class: "accounts-memberships__alert"  if flash[:alert] %>
+
+<table class="accounts-memberships">
+  <thead>
+    <tr>
+      <th scope="col">Member</th>
+      <th scope="col">Role</th>
+      <th scope="col">Change role</th>
+    </tr>
+  </thead>
+  <tbody>
+    <%% @memberships.each do |membership| %>
+      <tr class="accounts-memberships__row">
+        <td class="accounts-memberships__name"><%%= membership.name %></td>
+        <td class="accounts-memberships__role"><%%= membership.role.titleize %></td>
+        <td class="accounts-memberships__actions">
+          <%% if membership.owner? || own_membership?(membership) %>
+            <span class="accounts-memberships__locked">Locked</span>
+          <%% else %>
+            <%%= form_with url: membership_path(membership), method: :patch,
+                          class: "accounts-memberships__form" do %>
+              <label class="accounts-memberships__label"
+                     for="membership_role_<%%= membership.id %>">Role</label>
+              <select id="membership_role_<%%= membership.id %>"
+                      name="membership[role]"
+                      class="accounts-memberships__select">
+                <%% assignable_roles.each do |role| %>
+                  <option value="<%%= role %>" <%%= "selected" if membership.role == role %>>
+                    <%%= role.titleize %>
+                  </option>
+                <%% end %>
+              </select>
+              <button type="submit" class="accounts-memberships__submit">Update</button>
+            <%% end %>
+          <%% end %>
+        </td>
+      </tr>
+    <%% end %>
+  </tbody>
+</table>

data/lib/generators/seams/accounts/templates/config/routes.rb.tt

@@ -1,8 +1,14 @@
 # frozen_string_literal: true
 
-# Intentionally empty. The Accounts engine ships no controllers in
-# Wave 9 — hosts wire their own account-creation flows; the engine
-# provides models + concerns. Future waves may add a thin controller
-# surface.
+# Wave 11 (Phase 4): the accounts engine ships a single tenant-facing
+# surface — the memberships role picker (index + update), scoped to
+# Accounts::Current.account and guarded by membership.manage.accounts.
+# Account-creation flows still live in the host.
 Accounts::Engine.routes.draw do
+  # Follow-up generators that add admin-only or token-only routes splice them here, ahead of the canonical memberships resource.
+  # seams:insertion-point accounts.routes.before_memberships
+  resources :memberships, only: %i[index update]
+
+  # Follow-up generators that add new top-level accounts routes splice them here.
+  # seams:insertion-point accounts.routes.after_memberships
 end

data/lib/generators/seams/accounts/templates/lib/concerns/authorization.rb.tt

@@ -85,8 +85,27 @@ module Accounts
     # bypass the per-account scope (e.g. impersonation, cross-account
     # search). Distinct from `ensure_admin`.
     def ensure_staff
-      identity = defined?(Auth::Current) ? Auth::Current.identity : nil
-      head :forbidden unless identity&.staff?
+      head :forbidden unless staff_actor?
+    end
+
+    # Per-account permission guard. Resolves the current membership's
+    # role for `Accounts::Current.account` and asks the gem registry
+    # whether that role holds the given ability code (the
+    # `resource.action.engine` strings each engine registers). Platform
+    # staff (`Auth::Identity#staff?`) are let through — the request-layer
+    # bypass `Seams::Permissions.can?` deliberately leaves to callers.
+    # Denies with 403 otherwise.
+    #
+    #   before_action -> { authorize_permission!("invoice.read.billing") }
+    #
+    # The role is read from the per-request membership, never a global,
+    # so the same Identity can hold different powers in different
+    # accounts.
+    def authorize_permission!(ability)
+      return if staff_actor?
+      return if Seams::Permissions.can?(role: current_permission_role, ability: ability)
+
+      head :forbidden
     end
 
     def redirect_existing_membership
@@ -101,5 +120,19 @@ module Accounts
     def authorization_redirect_path
       Accounts.configuration.after_account_create_url
     end
+
+    # Role of the membership resolved for the current account/identity,
+    # or nil when there is no current membership (which denies, since
+    # no role holds any ability).
+    def current_permission_role
+      Accounts::Current.membership&.role
+    end
+
+    # Platform-admin actor? (Identity#staff?). Shared by `ensure_staff`
+    # and the `authorize_permission!` bypass.
+    def staff_actor?
+      identity = defined?(Auth::Current) ? Auth::Current.identity : nil
+      identity&.staff? || false
+    end
   end
 end

data/lib/generators/seams/accounts/templates/lib/engine.rb.tt

@@ -18,6 +18,19 @@ module Accounts
       # seams:insertion-point accounts.engine.events
     end
 
+    initializer "accounts.register_abilities" do
+      # Ability codes this engine owns, registered exactly like events
+      # (resource.action.engine). `read` is the member-level view;
+      # `manage` is the admin-level mutate. Host grant maps reference
+      # these codes; see Seams::Permissions::DEFAULT_GRANTS.
+      Seams::PermissionRegistry.register("account.read.accounts",       owned_by: "Accounts")
+      Seams::PermissionRegistry.register("account.manage.accounts",     owned_by: "Accounts")
+      Seams::PermissionRegistry.register("membership.read.accounts",    owned_by: "Accounts")
+      Seams::PermissionRegistry.register("membership.manage.accounts",  owned_by: "Accounts")
+      # Follow-up generators that ship new accounts abilities register them here.
+      # seams:insertion-point accounts.engine.abilities
+    end
+
     initializer "accounts.append_migrations" do |app|
       unless app.root == root
         config.paths["db/migrate"].expanded.each do |expanded_path|

data/lib/generators/seams/accounts/templates/spec/runtime/authorization_spec.rb.tt

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+require_relative "../rails_helper"
+
+# Request-layer regression for Accounts::Authorization#authorize_permission!
+# — the permission tiers the gem's role hierarchy resolves through at the
+# controller boundary. The role-picker behaviour (the escalation
+# safeguards) lives in accounts_memberships_flow_spec; this spec pins the
+# three authorisation tiers the concern enforces BEFORE the action runs:
+#
+#   1. deny-by-role: a membership whose role lacks the ability -> 403.
+#   2. allow-by-role: a membership whose role holds the ability -> through.
+#   3. staff bypass: a platform-staff Identity is let through regardless of
+#      the membership role (the request-layer bypass the gem deliberately
+#      leaves to the caller, not Seams::Permissions.can?).
+#
+# Cross-tenant isolation: the decision is read from the ACTIVE membership
+# (Accounts::Current.membership.role), never the Identity, so the same
+# person can be admin in one account and member in another and get
+# different powers per request. Flipping the active membership flips the
+# decision — pinned below.
+#
+# The memberships controller guards every action with
+# `authorize_permission!("membership.manage.accounts")`, so its index is a
+# faithful probe of the gate. As in accounts_memberships_flow_spec, the
+# per-request Current surface is stubbed with method stubs (they survive
+# the executor reset that clears CurrentAttributes values around requests).
+RSpec.describe "Accounts::Authorization permission tiers", type: :request do
+  def act_as(membership:, staff: false)
+    allow(Accounts::Current).to receive(:account).and_return(account)
+    allow(Accounts::Current).to receive(:membership).and_return(membership)
+    identity = staff ? Struct.new(:staff?).new(true) : nil
+    allow(Auth::Current).to receive(:identity).and_return(identity)
+  end
+
+  let(:owner_identity) do
+    Auth::Identity.create!(email: "owner-#{SecureRandom.hex(4)}@example.com", password: "verysecret")
+  end
+
+  let(:account) do
+    Accounts::Account.create_with_owner(
+      account: { name: "Acme #{SecureRandom.hex(2)}" },
+      owner:   Struct.new(:identity, :name).new(owner_identity, "Olive Owner")
+    )
+  end
+
+  let(:admin_membership)  { build_membership("admin",  "Adam Admin") }
+  let(:member_membership) { build_membership("member", "Mia Member") }
+
+  def build_membership(role, name)
+    identity = Auth::Identity.create!(
+      email: "#{role}-#{SecureRandom.hex(4)}@example.com", password: "verysecret"
+    )
+    account.memberships.create!(role: role, name: name, identity_id: identity.id, active: true)
+  end
+
+  def request_guarded_action
+    get "/accounts/memberships"
+  end
+
+  describe "tier 1: deny-by-role" do
+    it "forbids a plain member (member does not hold membership.manage.accounts)" do
+      act_as(membership: member_membership)
+
+      request_guarded_action
+
+      expect(response).to have_http_status(:forbidden)
+    end
+  end
+
+  describe "tier 2: allow-by-role" do
+    it "lets an admin through (admin holds membership.manage.accounts)" do
+      act_as(membership: admin_membership)
+
+      request_guarded_action
+
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe "tier 3: staff bypass" do
+    it "lets a platform-staff Identity through despite a member-role membership" do
+      act_as(membership: member_membership, staff: true)
+
+      request_guarded_action
+
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe "cross-tenant isolation: the active membership decides, not the identity" do
+    it "flips the decision when the active membership role changes" do
+      act_as(membership: member_membership)
+      request_guarded_action
+      expect(response).to have_http_status(:forbidden)
+
+      act_as(membership: admin_membership)
+      request_guarded_action
+      expect(response).to have_http_status(:ok)
+    end
+  end
+end

data/lib/generators/seams/accounts/templates/spec/runtime/memberships_flow_spec.rb.tt

@@ -0,0 +1,145 @@
+# frozen_string_literal: true
+
+require_relative "../rails_helper"
+
+# Behavioural request specs for the tenant-facing memberships role
+# picker: the happy path plus each of the three privilege-escalation
+# safeguards the controller enforces.
+#
+# The Rack stack resets ActiveSupport::CurrentAttributes around every
+# request, so attribute values set in the spec would be wiped before
+# the controller ran. Instead we stub the per-request Current surface
+# (the account + the acting membership) and the Auth identity the staff
+# bypass reads — method stubs survive the executor reset that clears
+# attribute values.
+RSpec.describe "Accounts memberships role picker", type: :request do
+  def act_as(membership:, staff: false)
+    allow(Accounts::Current).to receive(:account).and_return(account)
+    allow(Accounts::Current).to receive(:membership).and_return(membership)
+    identity = staff ? Struct.new(:staff?).new(true) : nil
+    allow(Auth::Current).to receive(:identity).and_return(identity)
+  end
+
+  let(:owner_identity) do
+    Auth::Identity.create!(email: "owner-#{SecureRandom.hex(4)}@example.com", password: "verysecret")
+  end
+
+  let(:account) do
+    Accounts::Account.create_with_owner(
+      account: { name: "Acme #{SecureRandom.hex(2)}" },
+      owner:   Struct.new(:identity, :name).new(owner_identity, "Olive Owner")
+    )
+  end
+
+  let(:owner_membership)  { account.memberships.find_by(role: "owner") }
+  let(:admin_membership)  { build_membership("admin",  "Adam Admin") }
+  let(:member_membership) { build_membership("member", "Mia Member") }
+
+  def build_membership(role, name)
+    identity = Auth::Identity.create!(
+      email: "#{role}-#{SecureRandom.hex(4)}@example.com", password: "verysecret"
+    )
+    account.memberships.create!(role: role, name: name, identity_id: identity.id, active: true)
+  end
+
+  describe "index" do
+    it "lists the current account's active memberships" do
+      act_as(membership: admin_membership)
+      member_membership
+
+      get "/accounts/memberships"
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include("Mia Member")
+    end
+  end
+
+  describe "happy path" do
+    it "an admin promotes a member to admin" do
+      act_as(membership: admin_membership)
+      target = member_membership
+
+      patch "/accounts/memberships/#{target.id}", params: { membership: { role: "admin" } }
+
+      expect(response).to have_http_status(:found)
+      expect(flash[:notice]).to be_present
+      expect(target.reload.role).to eq("admin")
+    end
+
+    it "an admin demotes another admin to member" do
+      act_as(membership: admin_membership)
+      target = build_membership("admin", "Other Admin")
+
+      patch "/accounts/memberships/#{target.id}", params: { membership: { role: "member" } }
+
+      expect(response).to have_http_status(:found)
+      expect(target.reload.role).to eq("member")
+    end
+  end
+
+  describe "safeguard 1: the owner role cannot be changed" do
+    it "refuses to demote an owner" do
+      act_as(membership: admin_membership)
+
+      patch "/accounts/memberships/#{owner_membership.id}", params: { membership: { role: "member" } }
+
+      expect(flash[:alert]).to be_present
+      expect(owner_membership.reload.role).to eq("owner")
+    end
+
+    it "refuses to promote anyone to owner, even for an acting owner" do
+      act_as(membership: owner_membership)
+      target = member_membership
+
+      patch "/accounts/memberships/#{target.id}", params: { membership: { role: "owner" } }
+
+      expect(flash[:alert]).to be_present
+      expect(target.reload.role).to eq("member")
+    end
+  end
+
+  describe "safeguard 2: a user cannot change their own role" do
+    it "refuses to change the acting membership" do
+      act_as(membership: admin_membership)
+
+      patch "/accounts/memberships/#{admin_membership.id}", params: { membership: { role: "member" } }
+
+      expect(flash[:alert]).to match(/your own role/i)
+      expect(admin_membership.reload.role).to eq("admin")
+    end
+  end
+
+  describe "safeguard 3: a user cannot assign a role senior to their own" do
+    it "refuses an admin assigning owner (senior to admin)" do
+      act_as(membership: admin_membership)
+      target = member_membership
+
+      patch "/accounts/memberships/#{target.id}", params: { membership: { role: "owner" } }
+
+      expect(flash[:alert]).to match(/senior/i)
+      expect(target.reload.role).to eq("member")
+    end
+
+    it "never assigns the system role through the screen" do
+      act_as(membership: admin_membership)
+      target = member_membership
+
+      patch "/accounts/memberships/#{target.id}", params: { membership: { role: "system" } }
+
+      expect(flash[:alert]).to be_present
+      expect(target.reload.role).to eq("member")
+    end
+  end
+
+  describe "authorization" do
+    it "forbids a plain member from changing roles" do
+      act_as(membership: member_membership)
+      target = build_membership("member", "Another Member")
+
+      patch "/accounts/memberships/#{target.id}", params: { membership: { role: "admin" } }
+
+      expect(response).to have_http_status(:forbidden)
+      expect(target.reload.role).to eq("member")
+    end
+  end
+end

data/lib/generators/seams/admin/admin_generator.rb

@@ -51,7 +51,7 @@ module Seams
     # extra column.
     #
     # Run with: bin/rails generate seams:admin
-    # rubocop:disable Metrics/ClassLength
+    # rubocop:disable-next Metrics/ClassLength
     class AdminGenerator < Rails::Generators::Base
       include Seams::Generators::HostInjector
       include Seams::Generators::EjectAware
@@ -69,7 +69,7 @@ module Seams
       #
       # The order here is the order routes + dashboards appear in
       # the generated files; Identity comes first so the engine root
-      # (`root to: "admin/identities#index"`) lands on something
+      # (`root to: "/admin/identities#index"`) lands on something
       # meaningful.
       DASHBOARD_MODELS = [
         # [dashboard_basename, model_class, owning_engine]
@@ -87,8 +87,11 @@ module Seams
         ["lifetime_pass",           "Billing::LifetimePass",                "billing"]
       ].freeze
 
+      # The base engine would mount `Admin::Engine` and write an
+      # `Admin.configure` initializer, but this engine's constants live
+      # under `Seams::Admin`. wire_into_host mounts the real class.
       def create_base_engine
-        EngineGenerator.start([ENGINE_NAME], destination_root: destination_root)
+        EngineGenerator.start([ENGINE_NAME, "--skip-host-wiring"], destination_root: destination_root)
       end
 
       def overwrite_engine_entry_point
@@ -186,6 +189,29 @@ module Seams
         end
       end
 
+      # Administrate partial overrides: navigation built from this
+      # engine's routes, and an index header whose New link does not
+      # depend on the dashboard class name. See each partial's header.
+      def create_view_overrides
+        %w[_navigation _index_header].each do |partial|
+          template_unless_ejected(
+            "app/views/seams/admin/application/#{partial}.html.erb.tt",
+            engine_path("app/views/seams/admin/application/#{partial}.html.erb")
+          )
+        end
+      end
+
+      # Association fields that name their dashboard explicitly; see
+      # templates/app/fields/admin/fields/dashboard_option.rb.tt.
+      def create_fields
+        %w[dashboard_option belongs_to has_many].each do |field|
+          template_unless_ejected(
+            "app/fields/admin/fields/#{field}.rb.tt",
+            engine_path("app/fields/admin/fields/#{field}.rb")
+          )
+        end
+      end
+
       # Phase 2: emit one dashboard + one controller per entry in
       # DASHBOARD_MODELS. `template_unless_ejected` so a host that
       # ejects an individual dashboard (e.g. to restyle the Identity
@@ -221,6 +247,7 @@ module Seams
         write_auth_current_stub
         write_accounts_current_stub
         write_dummy_model_stubs
+        write_dummy_ability_registrations
         amend_dummy_application_rb
         rewrite_dummy_routes_for_namespaced_engine
       end
@@ -424,6 +451,27 @@ module Seams
       # `class Foo < ApplicationRecord; self.table_name = "..."; end`
       # — no associations, no validations, no callbacks. The dummy
       # schema (see #dummy_schema) ships the matching tables.
+      # The tenant policies resolve through Seams::Permissions.can?, which
+      # raises for an ability no engine registered. In a host the owning
+      # engines register them at boot; the dummy app only stubs those
+      # engines' models, so register their default abilities here.
+      def write_dummy_ability_registrations
+        path = File.join(destination_root, "engines", ENGINE_NAME,
+                         "spec/dummy/config/initializers/seams_abilities.rb")
+        FileUtils.mkdir_p(File.dirname(path))
+        File.write(path, <<~RUBY)
+          # frozen_string_literal: true
+
+          # Stand-in for the ability registrations the auth, accounts,
+          # teams, billing, and notifications engines make at boot.
+          Seams::Permissions::DEFAULT_GRANTS.values.flatten.uniq.each do |ability|
+            next if Seams::PermissionRegistry.registered?(ability)
+
+            Seams::PermissionRegistry.register(ability, owned_by: ability.split(".").last.capitalize)
+          end
+        RUBY
+      end
+
       def write_dummy_model_stubs
         DUMMY_MODEL_STUBS.each do |relative_path, body|
           full = File.join(destination_root, "engines", ENGINE_NAME,
@@ -847,6 +895,5 @@ module Seams
         SCHEMA
       end
     end
-    # rubocop:enable Metrics/ClassLength
   end
 end