tenanting 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 7c494dc26510302cd4f4697c66378a0c889d8cd7d544acd941e8aa3b8ae46e12
+  data.tar.gz: 791f00f6e957ff10fe42c98496c2af5b039ab6ebd04d34520b63881c71be6756
+SHA512:
+  metadata.gz: ca16cac52ab1f0661e29c98f4c1629ef4313a9551a16338db83a99c6d82a6722adf47b40ddbd0990fbc71f828d3d04d14b087a3387857ada49090f4d4a95112b
+  data.tar.gz: 453179c1d8227ed0f8f0843e77c3ed13a2ee88f51345e3d0661f2ed4870eacc99abff983707e7210dbed043df5437ae47d6500e9c46aedb08eaea7b29c0ef372

data/CHANGELOG.md

@@ -0,0 +1,7 @@
+# Changelog
+
+## 0.1.0 (2026-09-21)
+
+- Initial release: `bin/rails generate tenanting`
+- `scoped_to_account` in models, with `through:` for models scoped by a parent and `optional:`
+  for records that can exist outside of an account

data/MIT-LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2026 Chris Oliver
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,490 @@
+# Tenanting
+
+Multitenancy for Rails, generated into your app the same way `bin/rails generate authentication`
+generates authentication.
+
+```sh
+bin/rails generate tenanting
+```
+
+Tenanting isn't a library you call at runtime. The generator writes a small amount of plain
+Rails code into your app: `Current.account`, a model concern, a controller concern, a
+middleware, and test helpers. You own that code, can read all of it in a few minutes, and can
+change it when your app needs something different.
+
+It's built for row-level multitenancy: every account-owned table has an `account_id` column,
+and every query on those tables is scoped to the current account.
+
+## Contents
+
+- [Installation](#installation)
+- [What gets generated](#what-gets-generated)
+- [Scoping models](#scoping-models)
+- [The current account](#the-current-account)
+- [Controllers and URLs](#controllers-and-urls)
+- [Background jobs, mailers, and broadcasts](#background-jobs-mailers-and-broadcasts)
+- [Console, seeds, and data migrations](#console-seeds-and-data-migrations)
+- [Testing](#testing)
+- [Customizing](#customizing)
+- [Security model](#security-model)
+- [Migrating from ActsAsTenant](#migrating-from-actsastenant)
+- [Development](#development)
+
+## Installation
+
+Tenanting requires Rails 8.0 or newer. The gem only contains the generator, so it only needs
+to be in the development group:
+
+```sh
+bundle add tenanting --group development
+```
+
+If you want users who can belong to accounts, run the Rails authentication generator first.
+Tenanting detects it and also adds memberships and an account picker.
+
+```sh
+bin/rails generate authentication   # optional
+bin/rails generate tenanting
+bin/rails db:migrate
+```
+
+Then scope your models to an account:
+
+```ruby
+class Project < ApplicationRecord
+  scoped_to_account
+end
+```
+
+## What gets generated
+
+| File | What it does |
+| --- | --- |
+| `app/models/account.rb` | The tenant. `#slug` returns its URL prefix, `/123` |
+| `app/models/current.rb` | Adds `attribute :account, :all_accounts` (created if it doesn't exist) |
+| `app/models/concerns/account_scoping.rb` | `scoped_to_account`, included in `ApplicationRecord` |
+| `app/controllers/concerns/tenanting.rb` | Sets `Current.account` for each request, included in `ApplicationController` |
+| `config/initializers/tenanting.rb` | URL prefix middleware, plus the account for jobs, broadcasts, and the console |
+| `db/migrate/*_create_accounts.rb` | The `accounts` table |
+| `test/test_helpers/account_test_helper.rb` | `switch_to_account` for tests |
+| `test/fixtures/accounts.yml` | Two accounts, `one` and `two` |
+
+When the authentication generator has been run, you also get:
+
+| File | What it does |
+| --- | --- |
+| `app/models/membership.rb` | Joins users to accounts. `User has_many :accounts, through: :memberships` |
+| `app/controllers/accounts_controller.rb` | An account picker, at `/accounts` |
+| `db/migrate/*_create_memberships.rb` | The `memberships` table, unique on user and account |
+| `test/fixtures/memberships.yml` | Users `one` and `two` in accounts `one` and `two` |
+
+The generator also includes `AccountScoping` in `ApplicationRecord`, adds `allow_accountless_access`
+to the sessions and passwords controllers, and prefixes URLs in `ApplicationMailer` with the account.
+
+## Scoping models
+
+Call `scoped_to_account` in any model that belongs to an account. There are three ways to
+connect a model to its account.
+
+### Models with an `account_id` column
+
+```sh
+bin/rails generate model Project name:string account:references
+```
+
+```ruby
+class Project < ApplicationRecord
+  scoped_to_account
+
+  has_many :tasks, dependent: :destroy
+
+  validates :name, uniqueness: { scope: :account_id }
+end
+```
+
+This adds `belongs_to :account` and a default scope on `Current.account`:
+
+```ruby
+Current.account = basecamp
+
+Project.all               # SELECT * FROM projects WHERE account_id = 1
+Project.find(other_id)    # Raises ActiveRecord::RecordNotFound for another account's project
+Project.create!(name: "Launch").account  # => basecamp
+```
+
+### Models that belong to a scoped model: `through:`
+
+Tables like `tasks` don't need their own `account_id` when their parent already has one. Scope
+them through the parent's `belongs_to` association instead:
+
+```ruby
+class Task < ApplicationRecord
+  belongs_to :project
+  scoped_to_account through: :project
+end
+
+class Comment < ApplicationRecord
+  belongs_to :task
+  scoped_to_account through: :task
+end
+```
+
+Queries filter on the parent's own scope, so chains of any depth work:
+
+```sql
+-- Task.all
+SELECT * FROM tasks WHERE project_id IN (SELECT id FROM projects WHERE account_id = 1)
+
+-- Comment.all
+SELECT * FROM comments WHERE task_id IN (
+  SELECT id FROM tasks WHERE project_id IN (SELECT id FROM projects WHERE account_id = 1))
+```
+
+Through models get `account` and `account_id` from their parent, and can't be created under,
+or moved to, another account's parent. They can move to another parent in the same account.
+
+An `account_id` column is still worth adding to large, frequently queried tables, because it
+makes the scope a single indexed comparison instead of a subquery.
+
+### Records that can exist outside of an account: `optional:`
+
+```ruby
+class Tag < ApplicationRecord
+  scoped_to_account optional: true
+end
+```
+
+The `account_id` column can be `NULL`, for records you create outside of any account, such as in
+seeds or an admin area:
+
+```ruby
+AccountScoping.across_accounts { Tag.create!(name: "Urgent") }  # No account
+```
+
+Inside an account, records without an account are hidden, and new records always belong to the
+current account. That keeps `Tag.delete_all` in one account from deleting records every account
+shares. When an account should also see the shared records, ask for them explicitly:
+
+```ruby
+AccountScoping.across_accounts { Tag.where(account: [ Current.account, nil ]) }
+```
+
+`optional:` is for models with an `account_id` column. For a through model whose parent is
+optional, make the `belongs_to` optional instead.
+
+### Protections
+
+The default scope uses `all_queries: true`, so it also applies to updating, deleting, and
+reloading individual records, not just to reads. Scoped models also get three validations:
+
+- **The account must be the current one.** Mass-assigning an `account_id`, like a scaffold's
+  `params.expect(project: [ :name, :account_id ])`, can't create a record in another account.
+  The same goes for a through model's parent, like a `project_id` from another account.
+- **The account can't change** once a record is saved, including by moving a through model to a
+  parent in another account.
+- **`belongs_to` records must be in the same account.** `Task.create!(tag_id: params[:tag_id])`
+  fails when the tag belongs to another account, whether it's assigned by ID or as a record.
+
+Uniqueness validations are not scoped automatically. Add `scope: :account_id` where values only
+need to be unique within an account.
+
+## The current account
+
+`Current.account` is an `ActiveSupport::CurrentAttributes` attribute, so it's isolated per
+request, per job, and per thread, and reset automatically afterwards.
+
+### Scoped models raise without an account
+
+Querying a scoped model when `Current.account` isn't set raises
+`AccountScoping::MissingAccountError`:
+
+```ruby
+Project.count
+# => AccountScoping::MissingAccountError: Project is scoped to an account, but Current.account
+#    isn't set. Use Current.set(account: account) { ... } or AccountScoping.across_accounts { ... }.
+```
+
+This is intentional. A job, rake task, or mailer that forgot to set an account fails loudly in
+development instead of silently reading or writing every account's data in production. The same
+applies to building records with `Project.new`, and to associations: `account.projects` raises
+too, because the default scope still runs inside associations.
+
+### Acting on behalf of an account
+
+Set the account for a block. The previous value is restored afterwards:
+
+```ruby
+Current.set(account: account) do
+  Project.create!(name: "Launch")
+end
+```
+
+### Querying across accounts
+
+When you mean to work with every account, say so:
+
+```ruby
+AccountScoping.across_accounts do
+  Project.where(archived: true).delete_all
+end
+```
+
+`across_accounts` only turns off account scoping. Unlike `unscoped`, other default scopes on the
+model, such as a soft-delete scope, still apply. Both are easy to search for when reviewing code
+that crosses accounts.
+
+## Controllers and URLs
+
+### Account URLs
+
+Account URLs are prefixed with the account ID:
+
+```
+/123/projects/1
+```
+
+The `AccountSlug` middleware moves the `/123` prefix from `PATH_INFO` to `SCRIPT_NAME`, the same
+way Rails handles an app mounted at a sub-path. This means:
+
+- **Routes don't change.** No `scope ":account_id"` and no `:account_id` parameter to pass around.
+- **URL helpers keep the prefix.** `project_path(@project)` returns `/123/projects/1`, and
+  `redirect_to @project` stays inside the account.
+- **Pages outside an account work unchanged**, like `/session/new` or `/accounts`.
+
+To link into an account from outside it, pass its slug as the `script_name`:
+
+```erb
+<%= link_to account.name, root_url(script_name: account.slug) %>
+```
+
+To link out of an account, pass an empty `script_name`:
+
+```ruby
+redirect_to accounts_url(script_name: "")
+```
+
+### Requiring an account
+
+`Tenanting` adds a `require_account` before action to `ApplicationController`. It reads the
+account ID from the URL and sets `Current.account`. It works like the `Authentication` concern:
+
+```ruby
+class HomeController < ApplicationController
+  allow_accountless_access only: :index
+end
+```
+
+With authentication, the account is looked up through `Current.user.accounts`, so users can only
+reach accounts they're members of. A URL for any other account returns 404 Not Found. A request
+without an account prefix redirects to the account picker, which goes straight into the account
+when the user only has one.
+
+Without authentication, any account ID in the URL is accepted, and requests without one return
+404. Add your own authorization in `find_account_by_slug`.
+
+## Background jobs, mailers, and broadcasts
+
+### Jobs
+
+Every Active Job remembers the account it was enqueued in and runs in that account. This
+includes mailers delivered with `deliver_later` and jobs that don't inherit from `ApplicationJob`:
+
+```ruby
+Current.set(account: account) do
+  ExportJob.perform_later(project)  # Runs with Current.account = account
+end
+```
+
+The account is serialized as a GlobalID in the job's `current_account` key. Arguments are
+deserialized inside the account, so scoped records can be passed as arguments. A job enqueued
+without an account raises `MissingAccountError` as soon as it queries a scoped model.
+
+### Mailers
+
+`ApplicationMailer#default_url_options` adds the account prefix, so links in emails point into
+the account the email was sent from. Set `config.action_mailer.default_url_options` with your
+host as usual.
+
+### Turbo Stream broadcasts
+
+If your app uses `turbo-rails`, broadcasts render with the account prefix, so links in broadcast
+partials point into the account. Broadcasts made with `broadcast_*_later` run as jobs, so they
+pick up the account like any other job.
+
+## Console, seeds, and data migrations
+
+In the console, switch into an account before working with scoped models:
+
+```ruby
+>> switch_to_account 123
+Switched to account 123 (Basecamp)
+>> Project.count
+=> 12
+```
+
+In seeds, data migrations, and rake tasks, wrap the work in `Current.set` or `across_accounts`:
+
+```ruby
+# db/seeds.rb
+account = Account.create!(name: "Basecamp")
+
+Current.set(account: account) do
+  Project.create!(name: "Launch")
+end
+```
+
+## Testing
+
+Fixtures work as usual. Reference the account in each scoped fixture:
+
+```yaml
+# test/fixtures/projects.yml
+one:
+  name: Launch
+  account: one
+```
+
+Fixture accessors like `projects(:one)` load records without the default scope, so they work
+without an account. Call `switch_to_account` before running anything else that queries scoped
+models:
+
+```ruby
+class ProjectTest < ActiveSupport::TestCase
+  setup { switch_to_account accounts(:one) }
+
+  test "names are unique within an account" do
+    assert_not Project.new(name: projects(:one).name).valid?
+  end
+end
+```
+
+In integration tests, `switch_to_account` also prefixes generated URLs with the account, so each
+request finds its account from the URL just like in production. It restores `Current.account`
+after each request, because Rails resets `Current` around requests:
+
+```ruby
+class ProjectsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in_as users(:one)
+    switch_to_account accounts(:one)
+  end
+
+  test "create" do
+    assert_difference -> { Project.count } do
+      post projects_url, params: { project: { name: "Launch" } }  # POST /123/projects
+    end
+    assert_redirected_to project_url(Project.last)
+  end
+
+  test "another account's projects are not found" do
+    get project_url(projects(:two))
+    assert_response :not_found
+  end
+end
+```
+
+## Customizing
+
+The generated code is yours to change. Some common changes:
+
+### Subdomains or custom domains instead of a path prefix
+
+Remove the `AccountSlug` middleware from `config/initializers/tenanting.rb`, add a column to
+accounts, and look the account up from the request in the `Tenanting` concern:
+
+```ruby
+def find_account_by_slug
+  Current.user&.accounts&.find_by(subdomain: request.subdomain)
+end
+```
+
+Also change `Account#slug`, which is used as the URL prefix in mailers, broadcasts, and tests.
+Instead, set the `host` in those places, or set `subdomain:` in your URL helpers.
+
+### Public IDs instead of database IDs
+
+`AccountSlug::PATTERN` matches a numeric first path segment. To keep database IDs out of URLs,
+store a random public ID on each account, change the pattern to match it, look it up by that
+column in `find_account_by_slug`, and return it from `Account#slug`.
+
+Because any numeric first segment is treated as an account, avoid top-level routes whose path
+starts with a number, or use a longer format (Fizzy pads IDs to at least 7 digits).
+
+### Allowing unscoped queries
+
+If you'd rather have queries run unscoped without an account, like ActsAsTenant's default,
+replace the `raise` in `AccountScoping.scope_to_current_account` with `relation`. Consider
+requiring the account in production anyway.
+
+## Security model
+
+Tenanting stops:
+
+- Queries on scoped models from returning other accounts' records, including `update_all`,
+  `delete_all`, and updates, deletes, and reloads of single records.
+- Queries on scoped models from running when no account has been chosen.
+- Records from being created in, or moved to, another account through mass assignment.
+- `belongs_to` references to another account's records, by ID or by record.
+- Users from reaching accounts they aren't members of (with authentication).
+- Jobs from running in the wrong account, or in no account.
+
+It does not cover:
+
+- **Models without `scoped_to_account`.** Tables that aren't scoped, such as a join table that is
+  only reached through a scoped model, rely on that model being scoped. Consider `through:`.
+- **`unscoped`, raw SQL, and `across_accounts`.** These bypass scoping on purpose. Review them.
+- **Polymorphic `belongs_to`.** These aren't checked by the same-account validation.
+- **Cache keys.** Include the account in keys you build yourself, like
+  `Rails.cache.fetch([ Current.account, "stats" ])`. Record-based cache keys are already unique.
+- **Action Cable connections.** Identify the account in `ApplicationCable::Connection` yourself.
+- **Active Storage.** Attachments are served by signed URLs, which aren't scoped to an account.
+
+## Migrating from ActsAsTenant
+
+| ActsAsTenant | Tenanting |
+| --- | --- |
+| `acts_as_tenant :account` | `scoped_to_account` |
+| `acts_as_tenant :account, optional: true` | `scoped_to_account optional: true` |
+| `acts_as_tenant :account, through: :account_users` | A `has_many :through`, like `User#accounts`. See below |
+| `ActsAsTenant.current_tenant` | `Current.account` |
+| `ActsAsTenant.current_tenant = account` | `Current.account = account` |
+| `ActsAsTenant.with_tenant(account) { }` | `Current.set(account: account) { }` |
+| `ActsAsTenant.without_tenant { }` | `AccountScoping.across_accounts { }` |
+| `set_current_tenant_by_subdomain` | Path prefixes, or see [Subdomains](#subdomains-or-custom-domains-instead-of-a-path-prefix) |
+| `set_current_tenant_through_filter` | Edit `find_account_by_slug` |
+| `config.require_tenant = true` | Always on |
+| `validates_uniqueness_to_tenant :name` | `validates :name, uniqueness: { scope: :account_id }` |
+| `ActsAsTenant::ActiveJobExtensions` | Built in, for every Active Job |
+| `ActsAsTenant::TestTenantMiddleware` | `switch_to_account` |
+
+To migrate:
+
+1. Run `bin/rails generate tenanting`. If your tenant model already exists, delete the generated
+   `Account` model and migration and keep yours. Add `#slug` to it.
+2. Replace `acts_as_tenant :account` with `scoped_to_account` in each model. Models that only
+   reach their account through a parent can use `scoped_to_account through: :parent`.
+
+   ActsAsTenant's `through:` is different: it scopes a model like `User` to accounts through a
+   many-to-many join table. Records like that belong to several accounts, so they aren't scoped.
+   Reach them through an association instead, like `Current.account.users`.
+3. Replace `ActsAsTenant` calls using the table above.
+4. Remove your `set_current_tenant_*` calls. `Tenanting` sets `Current.account` from the URL, or
+   from wherever you change `find_account_by_slug` to look.
+5. Wrap code that ran without a tenant in `Current.set` or `across_accounts`. Your test suite will
+   point these out by raising `AccountScoping::MissingAccountError`.
+6. Remove the `acts_as_tenant` gem.
+
+## Development
+
+```sh
+bundle install
+bundle exec rake test              # Generator tests
+bundle exec rake test:integration  # Generates a Rails app and runs its tests
+```
+
+The integration task creates a new Rails app, runs the authentication and tenanting generators,
+adds the models and tests in `test/integration/app`, and runs the app's test suite.
+
+## License
+
+Tenanting is released under the [MIT License](MIT-LICENSE).

data/lib/generators/tenanting/USAGE

@@ -0,0 +1,24 @@
+Description:
+    Generates multitenancy for the app: an Account model, Current.account, an
+    AccountScoping model concern, a Tenanting controller concern, account URL
+    prefixes (/123/projects), and account propagation to jobs, mailers, and the
+    console.
+
+    Run the authentication generator first to also get memberships between users
+    and accounts, and an account picker.
+
+Example:
+    bin/rails generate authentication
+    bin/rails generate tenanting
+    bin/rails db:migrate
+
+Then scope models to an account:
+
+class Project < ApplicationRecord
+  scoped_to_account
+end
+
+class Task < ApplicationRecord
+  belongs_to :project
+  scoped_to_account through: :project
+end

data/lib/generators/tenanting/templates/app/controllers/accounts_controller.rb.tt

@@ -0,0 +1,8 @@
+class AccountsController < ApplicationController
+  allow_accountless_access
+
+  def index
+    @accounts = Current.user.accounts.order(:name)
+    redirect_to root_url(script_name: @accounts.first.slug) if @accounts.one?
+  end
+end

data/lib/generators/tenanting/templates/app/controllers/concerns/tenanting.rb.tt

@@ -0,0 +1,44 @@
+module Tenanting
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :require_account
+  end
+
+  class_methods do
+    def allow_accountless_access(**options)
+      skip_before_action :require_account, **options
+    end
+  end
+
+  private
+    def require_account
+      resume_account || request_account
+    end
+
+    def resume_account
+      Current.account ||= find_account_by_slug
+    end
+
+    def find_account_by_slug
+      if account_id = request.env["account_slug.id"]
+<% if authentication? -%>
+        Current.user&.accounts&.find_by(id: account_id)
+<% else -%>
+        Account.find_by(id: account_id)
+<% end -%>
+      end
+    end
+
+    def request_account
+<% if authentication? -%>
+      if request.env["account_slug.id"]
+        head :not_found
+      else
+        redirect_to accounts_url(script_name: "")
+      end
+<% else -%>
+      head :not_found
+<% end -%>
+    end
+end

data/lib/generators/tenanting/templates/app/models/account.rb.tt

@@ -0,0 +1,14 @@
+class Account < ApplicationRecord
+<% if authentication? -%>
+  has_many :memberships, dependent: :destroy
+  has_many :users, through: :memberships
+
+<% end -%>
+  validates :name, presence: true
+
+  # The path prefix for this account's URLs. Pass it as the script_name to link into an
+  # account from outside of it, e.g. root_url(script_name: account.slug).
+  def slug
+    "/#{id}"
+  end
+end

data/lib/generators/tenanting/templates/app/models/concerns/account_scoping.rb.tt

@@ -0,0 +1,129 @@
+# Scopes models to Current.account. It's included in ApplicationRecord, so any model can call:
+#
+#   class Project < ApplicationRecord
+#     scoped_to_account                    # Has an account_id column
+#   end
+#
+#   class Task < ApplicationRecord
+#     belongs_to :project
+#     scoped_to_account through: :project  # Gets its account from a scoped parent
+#   end
+#
+#   class Tag < ApplicationRecord
+#     scoped_to_account optional: true     # Can also exist outside of any account
+#   end
+#
+# Querying a scoped model without Current.account raises, so a missing account is caught
+# instead of silently reading or writing across accounts. Be explicit instead:
+#
+#   Current.set(account: account) { Project.all }     # One account
+#   AccountScoping.across_accounts { Project.count }  # Every account
+module AccountScoping
+  extend ActiveSupport::Concern
+
+  class MissingAccountError < StandardError; end
+
+  def self.across_accounts(&)
+    Current.set(all_accounts: true, &)
+  end
+
+  def self.scope_to_current_account(relation) # :nodoc:
+    if Current.all_accounts
+      relation
+    elsif Current.account
+      if through = relation.model.account_scoping[:through]
+        # Relies on the parent's own scope, so chains of through models work at any depth.
+        parent = relation.model.reflect_on_association(through)
+        relation.where(parent.foreign_key => parent.klass.select(parent.association_primary_key))
+      else
+        relation.where(account: Current.account)
+      end
+    else
+      raise MissingAccountError, "#{relation.model.name} is scoped to an account, but Current.account isn't set. " \
+        "Use Current.set(account: account) { ... } or AccountScoping.across_accounts { ... }."
+    end
+  end
+
+  included do
+    class_attribute :account_scoping, instance_writer: false
+  end
+
+  class_methods do
+    # Scopes all queries to Current.account.
+    #
+    # [through]  A belongs_to association to a scoped model, for tables without an account_id column.
+    # [optional] Allows records without an account. They can be created and queried outside of any
+    #            account, but are hidden from, and can't be created in, an account.
+    def scoped_to_account(through: nil, optional: false)
+      if through && optional
+        raise ArgumentError, "optional: is for models with an account_id column. Make the #{through} association optional instead."
+      end
+
+      self.account_scoping = { through: through, optional: optional }.freeze
+
+      if through
+        delegate :account, :account_id, to: through, allow_nil: true
+      else
+        belongs_to :account, optional: optional, default: -> { Current.account }
+      end
+
+      default_scope(all_queries: true) { AccountScoping.scope_to_current_account(self) }
+
+      validate :account_is_current, if: -> { Current.account && !Current.all_accounts }
+      validate :account_is_unchanged, on: :update
+      validate :associations_belong_to_same_account
+    end
+
+    def scoped_to_account?
+      account_scoping.present?
+    end
+  end
+
+  private
+    def account_scoping_association
+      self.class.reflect_on_association(account_scoping[:through] || :account)
+    end
+
+    def changing_account?
+      will_save_change_to_attribute?(account_scoping_association.foreign_key)
+    end
+
+    # Guards against mass-assigning another account or parent, e.g. params.expect(project: [ :name, :account_id ])
+    def account_is_current
+      unless account_id == Current.account.id
+        errors.add(account_scoping_association.name, account_scoping[:through] ? "must belong to the current account" : "must be the current account")
+      end
+    end
+
+    def account_is_unchanged
+      if changing_account? && account_id != account_id_in_database_for_scoping
+        errors.add(account_scoping_association.name, account_scoping[:through] ? "must belong to the same account" : "can't be changed")
+      end
+    end
+
+    # Prevents pointing at another account's records by ID, e.g. Comment.create!(task_id: params[:task_id])
+    def associations_belong_to_same_account
+      self.class.reflect_on_all_associations(:belongs_to).each do |association|
+        next if association.polymorphic? || association.name == account_scoping_association.name
+        next unless association.klass.try(:scoped_to_account?)
+        next unless (id = self[association.foreign_key]) && (will_save_change_to_attribute?(association.foreign_key) || changing_account?)
+
+        if account_id_of(association, id) != account_id
+          errors.add(association.name, "must belong to the same account")
+        end
+      end
+    end
+
+    def account_id_in_database_for_scoping
+      if account_scoping[:through]
+        account_id_of(account_scoping_association, attribute_in_database(account_scoping_association.foreign_key))
+      else
+        attribute_in_database(:account_id)
+      end
+    end
+
+    # The account of the associated record with this ID, whichever account it's in.
+    def account_id_of(association, id)
+      AccountScoping.across_accounts { association.klass.find_by(association.association_primary_key => id)&.account_id } if id
+    end
+end

data/lib/generators/tenanting/templates/app/models/current.rb.tt

@@ -0,0 +1,3 @@
+class Current < ActiveSupport::CurrentAttributes
+  attribute :account, :all_accounts
+end

data/lib/generators/tenanting/templates/app/models/membership.rb.tt

@@ -0,0 +1,6 @@
+class Membership < ApplicationRecord
+  belongs_to :user
+  belongs_to :account
+
+  validates :user, uniqueness: { scope: :account }
+end

data/lib/generators/tenanting/templates/app/views/accounts/index.html.erb.tt

@@ -0,0 +1,7 @@
+<h1>Choose an account</h1>
+
+<ul>
+  <%% @accounts.each do |account| %>
+    <li><%%= link_to account.name, root_url(script_name: account.slug) %></li>
+  <%% end %>
+</ul>

data/lib/generators/tenanting/templates/config/initializers/tenanting.rb.tt

@@ -0,0 +1,93 @@
+# Account URLs are prefixed with the account ID: /123/projects/1
+#
+# The middleware moves that prefix from PATH_INFO into SCRIPT_NAME, the same way a mounted
+# app is handled. Routes don't need an :account_id segment, and URL helpers generate
+# account-prefixed URLs for the current request automatically.
+module AccountSlug
+  PATTERN = %r{\A/(\d+)(?=/|\z)}
+
+  class Extractor
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      request = ActionDispatch::Request.new(env)
+
+      if match = PATTERN.match(request.path_info)
+        request.env["account_slug.id"] = match[1].to_i
+        request.script_name = request.script_name.to_s + match[0]
+        request.path_info = match.post_match.presence || "/"
+      end
+
+      @app.call(env)
+    end
+  end
+end
+
+Rails.application.config.middleware.use AccountSlug::Extractor
+
+# Jobs run in the account they were enqueued from. This covers every Active Job,
+# including deliver_later, not just jobs that inherit from ApplicationJob.
+module AccountScopedJob
+  attr_reader :current_account
+
+  def initialize(...)
+    super
+    @current_account = Current.account
+  end
+
+  def serialize
+    super.merge("current_account" => current_account&.to_global_id&.to_s)
+  end
+
+  def deserialize(job_data)
+    super
+    @current_account = GlobalID::Locator.locate(job_data["current_account"]) if job_data["current_account"]
+  end
+
+  def perform_now
+    if current_account
+      Current.set(account: current_account) { super }
+    else
+      super
+    end
+  end
+end
+
+ActiveSupport.on_load(:active_job) { prepend AccountScopedJob }
+
+# Adds switch_to_account(account_or_id) to the console, since scoped models raise until
+# an account is set.
+Rails.application.console do
+  require "irb/helper_method"
+
+  IRB::HelperMethod.register :switch_to_account, Class.new(IRB::HelperMethod::Base) {
+    description "Sets Current.account for the console session."
+
+    def execute(account)
+      Current.account = account.is_a?(Account) ? account : Account.find(account)
+      puts "Switched to account #{Current.account.id} (#{Current.account.name})"
+      Current.account
+    end
+  }
+end
+<% if turbo? -%>
+
+# Turbo Stream broadcasts render outside of a request, so render them with the account
+# prefix to keep links in broadcast partials pointing into the account.
+module AccountScopedTurboStreams
+  private
+    def render_format(format, **rendering)
+      if Current.account
+        ApplicationController.renderer.new(script_name: Current.account.slug).render(formats: [ format ], **rendering)
+      else
+        super
+      end
+    end
+end
+
+Rails.application.config.after_initialize do
+  Turbo::StreamsChannel.singleton_class.prepend AccountScopedTurboStreams
+end
+<% end -%>

data/lib/generators/tenanting/templates/db/migrate/create_accounts.rb.tt

@@ -0,0 +1,9 @@
+class CreateAccounts < ActiveRecord::Migration<%= migration_version %>
+  def change
+    create_table :accounts do |t|
+      t.string :name, null: false
+
+      t.timestamps
+    end
+  end
+end

data/lib/generators/tenanting/templates/db/migrate/create_memberships.rb.tt

@@ -0,0 +1,12 @@
+class CreateMemberships < ActiveRecord::Migration<%= migration_version %>
+  def change
+    create_table :memberships do |t|
+      t.references :user, null: false, foreign_key: true, index: false
+      t.references :account, null: false, foreign_key: true
+
+      t.timestamps
+    end
+
+    add_index :memberships, %i[ user_id account_id ], unique: true
+  end
+end

data/lib/generators/tenanting/templates/test/fixtures/accounts.yml.tt

@@ -0,0 +1,5 @@
+one:
+  name: Account One
+
+two:
+  name: Account Two

data/lib/generators/tenanting/templates/test/fixtures/memberships.yml.tt

@@ -0,0 +1,7 @@
+one:
+  user: one
+  account: one
+
+two:
+  user: two
+  account: two

data/lib/generators/tenanting/templates/test/test_helpers/account_test_helper.rb.tt

@@ -0,0 +1,29 @@
+module AccountTestHelper
+  def switch_to_account(account)
+    Current.account = account
+  end
+end
+
+module AccountIntegrationTestHelper
+  # Also prefixes generated URLs with the account, so requests resolve it from the path.
+  def switch_to_account(account)
+    super
+    @switched_account = account
+    self.default_url_options = default_url_options.merge(script_name: account&.slug)
+  end
+
+  # Rails resets Current around each request, so restore the account for assertions afterwards.
+  %i[ get post patch put head delete follow_redirect! ].each do |method|
+    define_method(method) do |*args, **options|
+      super(*args, **options).tap { Current.account = @switched_account }
+    end
+  end
+end
+
+ActiveSupport.on_load(:active_support_test_case) do
+  include AccountTestHelper
+end
+
+ActiveSupport.on_load(:action_dispatch_integration_test) do
+  include AccountIntegrationTestHelper
+end

data/lib/generators/tenanting/tenanting_generator.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+# Generates multitenancy into an app the same way `bin/rails generate authentication`
+# generates authentication: plain application code built on Current attributes,
+# concerns, and a middleware, which the app owns and can edit.
+class TenantingGenerator < Rails::Generators::Base
+  include ActiveRecord::Generators::Migration
+
+  source_root File.expand_path("templates", __dir__)
+
+  def create_tenanting_files
+    template "app/models/account.rb"
+    template "app/models/concerns/account_scoping.rb"
+    template "app/controllers/concerns/tenanting.rb"
+    template "config/initializers/tenanting.rb"
+
+    if authentication?
+      template "app/models/membership.rb"
+      template "app/controllers/accounts_controller.rb"
+      template "app/views/accounts/index.html.erb"
+    end
+  end
+
+  def configure_current
+    if exist?("app/models/current.rb")
+      inject_into_class "app/models/current.rb", "Current", "  attribute :account, :all_accounts\n"
+    else
+      template "app/models/current.rb"
+    end
+  end
+
+  def configure_application_record
+    if read("app/models/application_record.rb").include?("  primary_abstract_class\n")
+      inject_into_file "app/models/application_record.rb", "\n  include AccountScoping\n", after: "  primary_abstract_class\n"
+    else
+      inject_into_class "app/models/application_record.rb", "ApplicationRecord", "  include AccountScoping\n"
+    end
+  end
+
+  def configure_user
+    if authentication?
+      inject_into_file "app/models/user.rb", <<~RUBY.indent(2), after: "has_many :sessions, dependent: :destroy\n"
+        has_many :memberships, dependent: :destroy
+        has_many :accounts, through: :memberships
+      RUBY
+    end
+  end
+
+  def configure_controllers
+    if authentication?
+      # Tenanting has to run after Authentication so it can check the user's memberships.
+      inject_into_file "app/controllers/application_controller.rb", "  include Tenanting\n", after: "  include Authentication\n"
+
+      %w[ sessions passwords ].each do |name|
+        path = "app/controllers/#{name}_controller.rb"
+        inject_into_class path, "#{name.camelize}Controller", "  allow_accountless_access\n" if exist?(path)
+      end
+    else
+      inject_into_class "app/controllers/application_controller.rb", "ApplicationController", "  include Tenanting\n"
+    end
+  end
+
+  def configure_mailers
+    if exist?("app/mailers/application_mailer.rb")
+      inject_into_class "app/mailers/application_mailer.rb", "ApplicationMailer", <<~RUBY.indent(2)
+        # Links in emails point into the account they were sent from, including with deliver_later.
+        def default_url_options
+          super.merge(script_name: Current.account&.slug)
+        end
+
+      RUBY
+    end
+  end
+
+  def configure_routes
+    route "resources :accounts, only: :index" if authentication?
+  end
+
+  def add_migrations
+    migration_template "db/migrate/create_accounts.rb", File.join(db_migrate_path, "create_accounts.rb")
+    migration_template "db/migrate/create_memberships.rb", File.join(db_migrate_path, "create_memberships.rb") if authentication?
+  end
+
+  def create_test_files
+    return unless exist?("test/test_helper.rb")
+
+    template "test/fixtures/accounts.yml"
+    template "test/fixtures/memberships.yml" if authentication?
+    template "test/test_helpers/account_test_helper.rb"
+    inject_into_file "test/test_helper.rb", "require_relative \"test_helpers/account_test_helper\"\n", after: "require \"rails/test_help\"\n"
+  end
+
+  private
+    def authentication?
+      exist?("app/controllers/concerns/authentication.rb") && exist?("app/models/user.rb")
+    end
+
+    def turbo?
+      exist?("Gemfile") && read("Gemfile").match?(/^\s*gem ["']turbo-rails["']/)
+    end
+
+    def migration_version
+      "[#{ActiveRecord::Migration.current_version}]"
+    end
+
+    def exist?(path)
+      File.exist?(File.join(destination_root, path))
+    end
+
+    def read(path)
+      File.read(File.join(destination_root, path))
+    end
+end

data/lib/tenanting.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+# Tenanting is a generator: `bin/rails generate tenanting` copies the multitenancy code into
+# your app, where you own it. This file intentionally defines no constants, so the gem can't
+# shadow the Tenanting controller concern it generates.

metadata

@@ -0,0 +1,92 @@
+--- !ruby/object:Gem::Specification
+name: tenanting
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Chris Oliver
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: railties
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+- !ruby/object:Gem::Dependency
+  name: activerecord
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+description: 'Generates account-based multitenancy into your Rails app: Current.account,
+  scoped models that fail closed, account URL prefixes, and account-aware jobs, mailers,
+  and tests.'
+email:
+- excid3@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- MIT-LICENSE
+- README.md
+- lib/generators/tenanting/USAGE
+- lib/generators/tenanting/templates/app/controllers/accounts_controller.rb.tt
+- lib/generators/tenanting/templates/app/controllers/concerns/tenanting.rb.tt
+- lib/generators/tenanting/templates/app/models/account.rb.tt
+- lib/generators/tenanting/templates/app/models/concerns/account_scoping.rb.tt
+- lib/generators/tenanting/templates/app/models/current.rb.tt
+- lib/generators/tenanting/templates/app/models/membership.rb.tt
+- lib/generators/tenanting/templates/app/views/accounts/index.html.erb.tt
+- lib/generators/tenanting/templates/config/initializers/tenanting.rb.tt
+- lib/generators/tenanting/templates/db/migrate/create_accounts.rb.tt
+- lib/generators/tenanting/templates/db/migrate/create_memberships.rb.tt
+- lib/generators/tenanting/templates/test/fixtures/accounts.yml.tt
+- lib/generators/tenanting/templates/test/fixtures/memberships.yml.tt
+- lib/generators/tenanting/templates/test/test_helpers/account_test_helper.rb.tt
+- lib/generators/tenanting/tenanting_generator.rb
+- lib/tenanting.rb
+homepage: https://github.com/excid3/tenanting
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://github.com/excid3/tenanting
+  changelog_uri: https://github.com/excid3/tenanting/blob/main/CHANGELOG.md
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.21
+specification_version: 4
+summary: A multitenancy generator for Rails, in the style of the authentication generator
+test_files: []