zero-rails-adapter 0.2.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 15ffa084c77f3af139ecfc0e284d2b2d41265357ec3b3edafda78d5c7378c8b8
-  data.tar.gz: a6aaafe3bb4cca20cfd6544ad6fd63f49bca923ebd225edb0811069a31c3c778
+  metadata.gz: ab52c7684cc6471e482808ce5bcdb64b7aa63ccbf8c9ae736feb535683198204
+  data.tar.gz: f69fa8c3101e9f8fff279af69103f5980a323dc856a70dd6b436f8bb92a9b37c
 SHA512:
-  metadata.gz: cdb046e65aa33933cdb5e33ede0f484275e7734ad637cbe87d298846a5636d79c4a1b5188d390551224c9d660c7dc8ab3bd4a48dfd54571f61c54520a895a1f0
-  data.tar.gz: b3b4149d75a0519b307d7464fe48da60c77eca56a71283791f858151d518f164245e3027310347c342d57d18f03729afb9d2fc66a5a0e20d947ea2807d1d5195
+  metadata.gz: a8a68b2c6bc50703669edd95cf46e9b74c0a01c6b4414723a78b07c4158d8b37ef884ae4972e0c0bf5ae684f897c2416f4d2e1b1b8beb1a2d1fd967faa8a36f0
+  data.tar.gz: 8690225768276ff9ca61478486674f90b91f3b873ed190d95dc0bb7da5aea2f3a96d32f3c74ef24cc2d21fe54e731f03b136549638d3491dff3a354d1b7fc1d6

data/CHANGELOG.md

@@ -0,0 +1,150 @@
+# Changelog
+
+All notable changes to `zero-rails-adapter` are documented in this file.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+Because the project is still below 1.0, minor releases may contain breaking
+changes; those changes are called out explicitly below.
+
+## [Unreleased]
+
+## [0.3.1] - 2026-07-29
+
+### Security
+
+- Changed request verification, authentication, and global mutation
+  authorization defaults to fail closed. Applications must now configure every
+  gate explicitly.
+- Custom mutators without an `authorize_with` callback are rejected instead of
+  executing implicitly. The mutator generator scaffolds an explicit
+  deny-by-default callback.
+- Generated initializers now require `ZERO_MUTATE_API_KEY` with `ENV.fetch`
+  instead of silently disabling request verification when the variable is
+  absent.
+- Internal and database `PushFailed` responses no longer expose raw exception
+  messages. Full errors remain available to the configured server logger.
+
+### Fixed
+
+- Persist only explicit application and validation failures before advancing
+  LMID. Database failures and unexpected Ruby exceptions now roll back the
+  mutation completely and return a retry-safe `PushFailed`, allowing the same
+  mutation ID to succeed after the underlying problem is fixed.
+
+### Changed
+
+- Expanded the Zero 1.8 integration contract to use PostgreSQL UUID primary
+  keys and foreign keys and to cover request verification, authentication,
+  global and mutator authorization, sanitized internal failures, unchanged
+  LMID state, and successful same-ID replay.
+- Updated the contract's direct `ws` dependency from 8.18.3 to 8.21.1.
+
+### Upgrade notes
+
+Configure `request_verifier`, `authenticator`, and `authorizer` explicitly
+before accepting mutation traffic. Add `authorize_with` to every custom
+mutator, including mutators that intentionally rely only on the global
+authorizer. Regenerate the initializer if the application still conditionally
+configures `ZERO_MUTATE_API_KEY`.
+
+## [0.3.0] - 2026-07-29
+
+### Breaking changes
+
+- Changed model and column exposure from permissive to fail-closed. The adapter
+  no longer discovers and publishes every Active Record model by default.
+  Applications must define `published_schema` with both the models and columns
+  that Zero may replicate.
+- Split the former `model_provider` responsibility into `published_schema` for
+  replicated data and `crud_model_provider` for generic writes.
+- Made generic CRUD fully opt-in. `crud_model_provider` now defaults to an empty
+  list and `crud_authorizer` denies every operation by default. Publishing a
+  model does not make it writable.
+- Changed integer-backed Active Record enum generation from a string
+  enumeration to `number()`. String-backed Active Record enums generate
+  `string()`, while only PostgreSQL native enums generate Zero enumerations.
+
+### Upgrade notes
+
+Before upgrading an application from 0.2.0:
+
+1. Replace `model_provider` with an explicit `published_schema` table-and-column
+   allowlist.
+2. If generic CRUD is required, configure both `crud_model_provider` and
+   `crud_authorizer`. Keep them closed and use custom mutators for domain
+   operations that enforce application invariants.
+3. Regenerate `schema.ts` and `mutators.ts`.
+4. Generate and review the column-limited PostgreSQL publication SQL, apply it
+   through the application's normal database process, and point zero-cache at
+   that publication.
+5. Confirm that timestamp consumers treat Zero values as Unix epoch
+   milliseconds and update any code that assumed string-valued Rails enums.
+
+See the [README](README.md#explicit-publication-schema) for configuration
+examples.
+
+### Added
+
+- Added a table-and-column publication schema with validation for primary keys,
+  sensitive credentials, framework-internal tables, unknown columns, and
+  unsupported PostgreSQL types.
+- Added a generator for reviewable, column-limited PostgreSQL publication SQL.
+- Added `zero_key` for stable synchronization identifiers that differ from the
+  Active Record primary key, including composite keys. Separate keys must be
+  published and backed by exact unique, non-null database indexes.
+- Added explicit one-hop and two-hop relationship definitions for delegated,
+  polymorphic, through, custom-key, and other associations Rails cannot safely
+  infer.
+- Added an exact Zero 1.8 integration contract using PostgreSQL logical
+  replication, zero-cache, a Rails custom-mutator endpoint, and a real Zero
+  client.
+- Added coverage for replication queries, LMID advancement, duplicate
+  mutations, failed-mutation skipping, and `_zero_cleanupResults`.
+
+### Changed
+
+- Generic update and destroy now locate records through the configured Zero
+  key. Generic updates cannot change either the Zero key or the Active Record
+  primary key.
+- TypeScript generation now uses `published_schema` for tables and columns and
+  generates CRUD mutators only for models returned by `crud_model_provider`.
+- Timestamps are explicitly documented and generated as Unix epoch
+  milliseconds on the Zero side.
+- Manual relationships override inferred relationships with the same source
+  and name.
+
+### Security
+
+- Added default rejection for known credential columns such as password hashes
+  and token digests, authentication tables, Active Storage internals, and
+  Action Mailbox internals.
+- Publication validation rejects unsupported PostgreSQL types, including
+  `citext`; applications must exclude those columns or publish a supported safe
+  mirror column.
+- Prevented schema generation and PostgreSQL publication generation from
+  silently exposing newly discovered Active Record models or columns.
+
+## [0.2.0] - 2026-07-28
+
+### Added
+
+- Initial public release.
+- Added a mountable Rails Engine with Zero mutation endpoints.
+- Added generic Active Record create, update, and destroy operations using
+  validations, callbacks, associations, database constraints, and Rails
+  transactions.
+- Added explicit custom mutators through a Ruby DSL, base class, registry, and
+  Rails generator.
+- Added configurable request verification, authentication, authorization,
+  model resolution, writable-attribute policies, and transaction storage.
+- Added atomic Zero LMID tracking, mutation ordering, duplicate detection,
+  structured application errors, failed-mutation skipping, and cleanup-result
+  handling.
+- Added TypeScript schema and mutator generation from Active Record models.
+- Added Active Support mutation notifications and Rails/PostgreSQL test
+  coverage.
+
+[Unreleased]: https://github.com/mechiland/zero_rails_adapter/compare/v0.3.1...HEAD
+[0.3.1]: https://github.com/mechiland/zero_rails_adapter/compare/v0.3.0...v0.3.1
+[0.3.0]: https://github.com/mechiland/zero_rails_adapter/releases/tag/v0.3.0
+[0.2.0]: https://rubygems.org/gems/zero-rails-adapter/versions/0.2.0

data/README.md

@@ -3,6 +3,8 @@
 `zero-rails-adapter` is a mountable Rails Engine that maps Rocicorp Zero custom
 mutations directly to existing Active Record models.
 
+See the [changelog](CHANGELOG.md) for release notes and upgrade instructions.
+
 The default CRUD path does not require a Ruby Mutator class for every model:
 
 | Zero mutation | Rails call |
@@ -25,7 +27,7 @@ mass-assignment policies are all configurable callable interfaces.
 - Ruby 4.0 or newer
 - Rails 8.0 or newer
 - PostgreSQL, the upstream database supported by Zero
-- Current `@rocicorp/zero` and `zero-cache` releases
+- `@rocicorp/zero` and `zero-cache` from the same supported release
 
 The Zero-managed `schema.clients` and `schema.mutations` tables and the
 application tables must use the same database connection. In a Rails
@@ -48,6 +50,10 @@ bundle install
 bin/rails generate zero_rails_adapter:install
 ```
 
+The generated initializer reads `ZERO_MUTATE_API_KEY` with `ENV.fetch`, so a
+missing key fails during application boot instead of disabling request
+verification.
+
 Mount the Engine:
 
 ```ruby
@@ -73,8 +79,64 @@ The adapter uses Zero's validated `schema` parameter to build schema-qualified
 Active Record classes for those tables, then writes application data and the
 LMID in the same transaction.
 
+## Explicit Publication Schema
+
+The adapter fails closed. No Active Record model or column is published, added
+to generated TypeScript, or exposed to generic CRUD by default.
+
+Declare both the tables and columns that may be replicated:
+
+```ruby
+ZeroRailsAdapter.configure do |config|
+  config.published_schema = lambda do
+    {
+      Article => %w[id title body author_id created_at updated_at],
+      Comment => %w[id article_id body author_id created_at updated_at]
+    }
+  end
+end
+```
+
+The callable is evaluated when code is generated, so it remains safe across
+Rails development reloads. Primary key columns must be present. Unknown
+columns, known credential columns such as `password_hash` and `token_digest`,
+Active Storage and Action Mailbox internal tables, and PostgreSQL types that
+Zero cannot replicate are rejected.
+
+By default, a model's Zero key is its Active Record primary key. Applications
+may use a separate stable synchronization key:
+
+```ruby
+config.zero_key = lambda do |model|
+  model == Article ? "sync_id" : model.primary_key
+end
+```
+
+A separate Zero key must be included in `published_schema` and backed by an
+exact unique, non-null database index. Composite Zero keys may be returned as
+an array. The database primary key must still be published because PostgreSQL
+uses it as the table's replica identity; it is not silently replaced by the
+Zero key.
+
+Generate a reviewable, column-limited PostgreSQL publication:
+
+```sh
+bin/rails generate zero_rails_adapter:publication zero_data
+```
+
+This writes `db/zero_publication.sql`; it does not execute DDL automatically.
+Apply the SQL through the application's normal migration or operations process,
+then configure:
+
+```sh
+ZERO_APP_PUBLICATIONS=zero_data
+```
+
 ## Generic Active Record CRUD
 
+Generic CRUD is a separate, opt-in capability. Publishing a model never makes
+it writable.
+
 This client-side mutation:
 
 ```ts
@@ -92,8 +154,9 @@ Article.create!(id: "...", title: "Rails and Zero")
 ```
 
 For `update` and `destroy`, the adapter first loads the record using the
-model's primary key, including composite primary keys, and then calls
-`update!` or `destroy!`. The bang methods are intentional: a validation,
+configured Zero key, including composite keys, and then calls `update!` or
+`destroy!`. Neither the Zero key nor the Active Record primary key can be
+changed by generic update. The bang methods are intentional: a validation,
 callback, or database-constraint failure rolls back the complete business
 transaction and produces a structured Zero application error.
 
@@ -101,14 +164,16 @@ Configure the models exposed to generic CRUD explicitly:
 
 ```ruby
 ZeroRailsAdapter.configure do |config|
-  config.model_provider = -> { [Article, Comment, Project] }
+  config.crud_model_provider = -> { [Article, Comment] }
 end
 ```
 
-`model_provider` is both the CRUD allowlist and the source used by the
-TypeScript generator. By default, the adapter eager-loads the Rails application
-and returns every named, non-abstract Active Record model outside the adapter
-itself. An explicit allowlist is recommended in production.
+Models absent from `crud_model_provider` cannot be resolved by generic CRUD.
+The default provider returns an empty list, and the default `crud_authorizer`
+also rejects every operation. Applications must opt into both model resolution
+and authorization. Applications with aggregate operations, tenant-scoped
+commands, soft deletion, or other domain behavior should leave the provider
+empty and use custom mutators.
 
 If a table cannot be resolved through Rails naming conventions, replace the
 resolver:
@@ -128,14 +193,13 @@ hand:
 bin/rails generate zero_rails_adapter:typescript app/javascript/zero
 ```
 
-The generator reflects on the models returned by `model_provider` in the Rails
-runtime and writes:
+The generator reflects on `published_schema` in the Rails runtime and writes:
 
-- `schema.ts`, containing tables, columns, nullability, primary keys, and
+- `schema.ts`, containing tables, columns, nullability, Zero keys, and
   safely inferred `belongs_to`, `has_one`, and `has_many` relationships.
-- `mutators.ts`, containing `create`, `update`, and `destroy` for every table,
-  using Zero's current `defineMutator` / `defineMutators` API and Zod argument
-  schemas.
+- `mutators.ts`, containing `create`, `update`, and `destroy` only for models
+  returned by `crud_model_provider`, using Zero's current `defineMutator` /
+  `defineMutators` API and Zod argument schemas.
 
 Run the generator again after changing Rails migrations or model associations.
 The output can live in Rails' JavaScript directory or be written directly into
@@ -145,6 +209,48 @@ an adjacent Next.js application:
 bin/rails generate zero_rails_adapter:typescript ../web/src/zero
 ```
 
+Rails cannot safely infer every Zero relationship. Add delegated-type,
+polymorphic, custom, or through relationships explicitly:
+
+```ruby
+config.relationship_provider = lambda do
+  [
+    {
+      source: Recording,
+      name: :task,
+      kind: :one,
+      source_fields: %w[recordable_id],
+      destination: Task,
+      destination_fields: %w[id]
+    },
+    {
+      source: Article,
+      name: :labels,
+      kind: :many,
+      through: [
+        {
+          source_fields: %w[id],
+          destination: ArticleLabel,
+          destination_fields: %w[article_id]
+        },
+        {
+          source_fields: %w[label_id],
+          destination: Label,
+          destination_fields: %w[id]
+        }
+      ]
+    }
+  ]
+end
+```
+
+Every model and field in a manual relationship must be published. Zero
+supports at most two relationship hops. A polymorphic or delegated-type
+relationship also needs an application invariant or a published discriminator
+or safe mirror column that prevents IDs belonging to another type from
+matching; the adapter does not guess that predicate. A manual definition with
+the same source and name replaces an inferred relationship.
+
 The default mappings follow Zero's PostgreSQL type conventions:
 
 - string/text/uuid → `string()`
@@ -152,10 +258,13 @@ The default mappings follow Zero's PostgreSQL type conventions:
 - boolean → `boolean()`
 - date/time/datetime/timestamp → `number()`
 - json/jsonb → `json()`
-- Active Record enum → `enumeration<...>()`
+- integer-backed Active Record enum → `number()`
+- string-backed Active Record enum → `string()`
+- PostgreSQL native enum → `enumeration<...>()`
 
 Nullable columns use `.optional()`. Rails timestamps use `Date.now()` for the
-optimistic client write and remain managed normally by Rails on the server.
+optimistic client write and are Unix epoch milliseconds in Zero. They remain
+managed normally by Rails on the server.
 The generator raises a descriptive error for a column that cannot be mapped
 reliably instead of emitting an incorrect type.
 
@@ -180,6 +289,17 @@ and writable-attribute interfaces below.
 The generated initializer supports `ZERO_MUTATE_API_KEY` and verifies
 zero-cache's `X-Api-Key` header using a constant-time comparison.
 
+All mutation security gates fail closed by default:
+
+- `request_verifier` returns `false`.
+- `authenticator` raises `UnauthorizedError`.
+- The global `authorizer` returns `false`.
+- The generic CRUD `crud_authorizer` returns `false`.
+
+Applications must configure each gate they use explicitly. An application that
+intentionally permits anonymous identities must still install an authenticator
+that returns `ZeroRailsAdapter::Identity.new`.
+
 The authentication interface receives the Rails request. It can integrate with
 Devise/Warden, any JWT library, a session, or an application-specific
 authentication system:
@@ -204,6 +324,10 @@ authorizer then receives the model class as `target` for create, or the loaded
 record for update and destroy:
 
 ```ruby
+config.authorizer = lambda do |context, mutation|
+  MutationPolicy.allowed?(context.current_user, mutation.name)
+end
+
 config.crud_authorizer = lambda do |context, action, target, attributes|
   MutationPolicy.new(
     context.current_user,
@@ -267,6 +391,10 @@ available:
 ZeroRailsAdapter.define_mutator "projects.archive" do
   attribute :id, :string
 
+  authorize_with do |context|
+    context.current_user.present?
+  end
+
   perform do
     Project.find(id).archive!(actor: context.current_user)
   end
@@ -274,7 +402,9 @@ end
 ```
 
 Mutators use Active Model attributes and validations and share a transaction
-with application writes and LMID tracking.
+with application writes and LMID tracking. A custom mutator without an
+`authorize_with` callback is rejected. To rely intentionally on the global
+authorizer alone, the mutator must still declare `authorize_with { true }`.
 
 ## Mutation Ordering and Transaction Semantics
 
@@ -286,11 +416,19 @@ For each `(schema, clientGroupID, clientID)`, the adapter:
 4. Executes the authorized Active Record operation inside a transaction.
 5. Updates the LMID atomically.
 
-When a business validation or callback fails, the first transaction rolls
-back. A second transaction advances the LMID and stores a structured `app`
-result so that a bad mutation is not retried forever and later mutations can
-continue. If the second transaction also fails, the adapter returns a
-retry-safe `PushFailed` response.
+When an explicit `ApplicationError`, argument validation error, or supported
+Active Model/Active Record validation or lifecycle error occurs, the first
+transaction rolls back. A second transaction advances the LMID and stores a
+structured `app` result so that a bad mutation is not retried forever and later
+mutations can continue.
+
+Database failures and unexpected Ruby exceptions do not advance LMID or store
+a mutation result. They return a retry-safe `PushFailed`, so the same mutation
+ID can be retried after the underlying problem is fixed. Public database and
+internal failure messages are fixed and sanitized; the configured server
+logger receives the original exception and backtrace. If persisting an
+application failure also fails, the adapter likewise returns `PushFailed`
+without advancing LMID.
 
 Each mutation owns an independent transaction. A later failure in the same
 HTTP batch does not roll back earlier committed mutations.
@@ -333,6 +471,23 @@ Run the complete contract suite against a dedicated PostgreSQL test database:
 DATABASE_URL=postgres://localhost/zero_rails_adapter_test bundle exec rake test
 ```
 
+The repository also locks `@rocicorp/zero` and the `zero-cache` CLI to the
+exact same `1.8.0` package in `test/contract/package-lock.json`. Run the full
+wire and replication contract with Node 24+ and Docker:
+
+```sh
+bundle exec rake contract
+```
+
+That task compiles the generated TypeScript, starts PostgreSQL with logical
+replication, starts the real zero-cache and Rails mutation endpoint, then uses
+a Zero client to mutate and query replicated rows. The generated fixture uses
+UUID primary and foreign keys and includes a separate Zero key and a two-hop
+relationship. The task also verifies request verification, authentication,
+global and mutator authorization, sanitized retry-safe failures, same-ID
+replay, LMID advancement, duplicate-mutation handling, failure skipping, and
+`_zero_cleanupResults`. The contract runs as its own CI job.
+
 See [`examples/nextjs`](examples/nextjs) for a Next.js integration fixture.
 
 ## References
@@ -340,5 +495,6 @@ See [`examples/nextjs`](examples/nextjs) for a Next.js integration fixture.
 - [Zero custom mutators](https://zero.rocicorp.dev/docs/mutators)
 - [Zero schema](https://zero.rocicorp.dev/docs/schema)
 - [Zero PostgreSQL support](https://zero.rocicorp.dev/docs/postgres-support)
+- [Zero 1.8 release notes](https://zero.rocicorp.dev/docs/release-notes/1.8)
 - [Zero `process-mutations.ts`](https://github.com/rocicorp/mono/blob/main/packages/zero-server/src/process-mutations.ts)
 - [Server implementation plan](https://jeremykreutzbender.com/blog/server-implementation-plan-rocicorp-zero-custom-mutators)

data/app/controllers/zero_rails_adapter/mutations_controller.rb

@@ -27,7 +27,11 @@ module ZeroRailsAdapter
       ZeroRailsAdapter.configuration.logger&.error(
         "ZeroRailsAdapter request failed: #{error.class}: #{error.message}"
       )
-      render json: push_failed("internal", error.message, []), status: :internal_server_error
+      render json: push_failed(
+        "internal",
+        Processor::INTERNAL_ERROR_MESSAGE,
+        []
+      ), status: :internal_server_error
     end
 
     private

data/examples/nextjs/README.md

@@ -25,5 +25,7 @@ ZERO_MUTATE_API_KEY=development-secret
 ```
 
 The Rails application must mount the Engine at `/zero`, use the generated API
-key verifier, and expose `Book` through `config.model_provider`. No Ruby
-mutator class is needed for `books.create/update/destroy`.
+key verifier, publish explicit `Book` columns through
+`config.published_schema`, and opt `Book` into
+`config.crud_model_provider`. No Ruby mutator class is needed for
+`books.create/update/destroy`.

data/lib/generators/zero_rails_adapter/install/templates/initializer.rb

@@ -6,11 +6,9 @@ ZeroRailsAdapter.configure do |config|
 
   # Verify that calls came from your zero-cache instance.
   # Configure zero-cache with ZERO_MUTATE_API_KEY using the same value.
-  if ENV["ZERO_MUTATE_API_KEY"].present?
-    config.request_verifier = ZeroRailsAdapter::RequestVerifiers::ApiKey.new(
-      key: ENV.fetch("ZERO_MUTATE_API_KEY")
-    )
-  end
+  config.request_verifier = ZeroRailsAdapter::RequestVerifiers::ApiKey.new(
+    key: ENV.fetch("ZERO_MUTATE_API_KEY")
+  )
 
   # Return an Identity from any authentication system (Devise, JWT, cookies, etc.).
   # config.authenticator = lambda do |request|
@@ -26,10 +24,31 @@ ZeroRailsAdapter.configure do |config|
   # Raise ZeroRailsAdapter::ForbiddenError to reject a mutation.
   # config.authorizer = ->(context, mutation) { YourPolicy.authorize!(context, mutation) }
 
-  # Generic CRUD resolves "articles.create", "articles.update", and
-  # "articles.destroy" against this allowlist. The default is every named,
-  # non-abstract Active Record model; an explicit list is recommended.
-  # config.model_provider = -> { [Article, Comment] }
+  # Fail-closed table and column allowlist used by schema.ts and publication
+  # SQL generation. No tables or columns are published by default.
+  # config.published_schema = lambda do
+  #   {
+  #     Article => %w[id title body author_id created_at updated_at],
+  #     Comment => %w[id article_id body author_id created_at updated_at]
+  #   }
+  # end
+
+  # Generic CRUD is independently opt-in. Publishing a model does not make it
+  # writable. The default crud_authorizer below also rejects every operation.
+  # Keep this empty when writes require domain-specific mutators.
+  # config.crud_model_provider = -> { [Article, Comment] }
+
+  # Zero uses this stable key in generated schemas and CRUD update/destroy
+  # lookups. A non-Active Record key must be published and backed by an exact
+  # unique, non-null database index. Composite keys may return an array.
+  # config.zero_key = lambda do |model|
+  #   model == Article ? "sync_id" : model.primary_key
+  # end
+
+  # Add relationships that Rails reflection cannot express safely, including
+  # polymorphic, delegated-type, and through relationships. Definitions may
+  # contain one direct hop or a maximum of two entries under `through`.
+  # config.relationship_provider = -> { [] }
 
   # Authorize generic CRUD independently of Devise/JWT/Pundit/etc. target is
   # the model class for create, and the loaded record for update/destroy.

data/lib/generators/zero_rails_adapter/mutator/templates/mutator.rb

@@ -7,8 +7,11 @@ class <%= class_name %> < ZeroRailsAdapter::Mutator
   # attribute :title, :string
   # validates :title, presence: true
 
+  authorize_with do |_context|
+    false
+  end
+
   def perform
-    # Use context.current_user, context.user_id, and context.claims for authorization.
     raise NotImplementedError
   end
 end

data/lib/generators/zero_rails_adapter/publication/publication_generator.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "zero_rails_adapter"
+
+module ZeroRailsAdapter
+  module Generators
+    class PublicationGenerator < Rails::Generators::Base
+      argument :publication_name,
+        type: :string,
+        default: ZeroRailsAdapter::PostgreSQL::PublicationGenerator::DEFAULT_NAME
+
+      def create_publication_sql
+        sql = ZeroRailsAdapter::PostgreSQL::PublicationGenerator.new(
+          name: publication_name
+        ).sql
+        create_file "db/zero_publication.sql", sql
+      end
+    end
+  end
+end

data/lib/zero_rails_adapter/configuration.rb

@@ -5,18 +5,24 @@ module ZeroRailsAdapter
     attr_accessor :authenticator, :request_verifier, :authorizer, :logger,
       :transaction_class, :storage_provider, :crud_authorizer,
       :writable_attributes, :generated_attributes, :model_resolver,
-      :model_provider
+      :published_schema, :crud_model_provider, :zero_key,
+      :relationship_provider
 
     def initialize
-      @authenticator = ->(_request) { Identity.new }
-      @request_verifier = ->(_request) { true }
-      @authorizer = ->(_context, _mutation) { true }
-      @crud_authorizer = ->(_context, _action, _target, _attributes) { true }
+      @authenticator = lambda do |_request|
+        raise UnauthorizedError, "Authentication is not configured"
+      end
+      @request_verifier = ->(_request) { false }
+      @authorizer = ->(_context, _mutation) { false }
+      @crud_authorizer = ->(_context, _action, _target, _attributes) { false }
       @logger = defined?(Rails) ? Rails.logger : nil
       @transaction_class = ActiveRecord::Base
-      @model_provider = -> { default_models }
+      @published_schema = -> { {} }
+      @crud_model_provider = -> { [] }
+      @zero_key = ->(model) { model.primary_key }
+      @relationship_provider = -> { [] }
       @model_resolver = lambda do |resource|
-        allowed_models = Array(model_provider.call).select do |model|
+        allowed_models = Array(crud_model_provider.call).select do |model|
           active_record_model?(model)
         end
         candidate = resource.to_s.classify.safe_constantize
@@ -32,16 +38,6 @@ module ZeroRailsAdapter
 
     private
 
-    def default_models
-      application = Rails.application if defined?(Rails) && Rails.respond_to?(:application)
-      application&.eager_load!
-      ActiveRecord::Base.descendants.select do |model|
-        active_record_model?(model) &&
-          model.name.present? &&
-          !model.name.start_with?("ZeroRailsAdapter::")
-      end
-    end
-
     def default_writable_attributes(model)
       model.column_names -
         model.readonly_attributes.to_a -