argus-trail 0.1.0

data/app/views/argus/trail/audit_entries/index.html.erb

@@ -0,0 +1,94 @@
+<div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
+  <div class="flex items-center justify-between mb-8">
+    <div>
+      <h1 class="text-2xl font-bold text-gray-900">Audit Log</h1>
+      <p class="text-sm text-gray-500 mt-1">Every role assignment and permission grant/revoke, in order</p>
+    </div>
+  </div>
+
+  <% if params[:subject_type].present? || params[:subject_id].present? || params[:role_id].present? %>
+    <div class="mb-4 flex items-center gap-2 bg-blue-50 border border-blue-200 rounded-lg px-4 py-2.5 text-sm text-blue-800">
+      Filtered view.
+      <%= link_to "Clear filter", audit_entries_path, class: "ml-2 text-blue-600 hover:underline font-medium" %>
+    </div>
+  <% end %>
+
+  <div class="grid grid-cols-2 sm:grid-cols-3 gap-4 mb-6">
+    <div class="bg-white rounded-xl border border-gray-200 p-4 text-center shadow-sm">
+      <p class="text-2xl font-bold text-gray-900"><%= Argus::Trail::AuditEntry.count %></p>
+      <p class="text-xs text-gray-500 mt-0.5">Total Events</p>
+    </div>
+    <div class="bg-white rounded-xl border border-gray-200 p-4 text-center shadow-sm">
+      <p class="text-2xl font-bold text-blue-600"><%= Argus::Trail::AuditEntry.where("created_at >= ?", Time.zone.today.beginning_of_day).count %></p>
+      <p class="text-xs text-gray-500 mt-0.5">Today</p>
+    </div>
+    <div class="bg-white rounded-xl border border-gray-200 p-4 text-center shadow-sm">
+      <p class="text-2xl font-bold text-gray-900"><%= Argus::Trail::AuditEntry.select(:subject_type, :subject_id).distinct.count %></p>
+      <p class="text-xs text-gray-500 mt-0.5">Distinct Subjects</p>
+    </div>
+  </div>
+
+  <div class="bg-white rounded-xl shadow-sm border border-gray-200 overflow-hidden">
+    <% if @pages.any? %>
+      <table class="min-w-full divide-y divide-gray-200">
+        <thead class="bg-gray-50">
+          <tr>
+            <th class="px-6 py-3 text-left text-xs font-semibold text-gray-500 uppercase tracking-wider">Event</th>
+            <th class="px-6 py-3 text-left text-xs font-semibold text-gray-500 uppercase tracking-wider">Subject</th>
+            <th class="px-6 py-3 text-left text-xs font-semibold text-gray-500 uppercase tracking-wider">Change</th>
+            <th class="px-6 py-3 text-left text-xs font-semibold text-gray-500 uppercase tracking-wider">Changed By</th>
+            <th class="px-6 py-3 text-left text-xs font-semibold text-gray-500 uppercase tracking-wider">When</th>
+          </tr>
+        </thead>
+        <tbody class="bg-white divide-y divide-gray-100">
+          <% @pages.each do |entry| %>
+            <tr class="hover:bg-gray-50 transition-colors">
+              <td class="px-6 py-4 whitespace-nowrap">
+                <span class="inline-flex items-center px-2 py-0.5 rounded-full text-xs font-semibold bg-gray-100 text-gray-700">
+                  <%= event_type_label(entry.event_type) %>
+                </span>
+              </td>
+
+              <td class="px-6 py-4 text-sm text-gray-800">
+                <%= link_to entry.subject_label, audit_entries_path(subject_type: entry.subject_type, subject_id: entry.subject_id), class: "text-blue-600 hover:underline" %>
+              </td>
+
+              <td class="px-6 py-4">
+                <% if %w[role_assigned role_revoked].include?(entry.event_type) %>
+                  <div class="flex items-center gap-2 text-sm text-gray-700">
+                    <span class="<%= entry.event_type == 'role_assigned' ? 'text-green-700' : 'text-red-700' %> font-medium">
+                      <%= entry.event_type == "role_assigned" ? "Assigned" : "Revoked" %>
+                    </span>
+                    <span class="inline-flex items-center px-2 py-0.5 rounded-full text-xs font-semibold <%= role_badge_class(entry.role_name) %>"><%= entry.role_name %></span>
+                  </div>
+                <% else %>
+                  <div class="text-sm text-gray-700">
+                    <span class="<%= entry.event_type == 'permission_granted' ? 'text-green-700' : 'text-red-700' %> font-medium">
+                      <%= entry.event_type == "permission_granted" ? "Granted" : "Revoked" %>
+                    </span>
+                    “<%= entry.permission_name&.humanize %>” on role <%= entry.role_name %>
+                  </div>
+                <% end %>
+              </td>
+
+              <td class="px-6 py-4 text-sm text-gray-600"><%= entry.changed_by_label %></td>
+
+              <td class="px-6 py-4 whitespace-nowrap">
+                <p class="text-sm text-gray-700"><%= entry.created_at.strftime("%d %b %Y") %></p>
+                <p class="text-xs text-gray-400"><%= entry.created_at.strftime("%I:%M %p") %></p>
+              </td>
+            </tr>
+          <% end %>
+        </tbody>
+      </table>
+
+      <div class="px-6 py-4 border-t border-gray-100 flex justify-center">
+        <%= argus_trail_paginate(@pages) %>
+      </div>
+    <% else %>
+      <div class="text-center py-16">
+        <p class="text-gray-500 text-sm">No audit events recorded yet.</p>
+      </div>
+    <% end %>
+  </div>
+</div>

data/app/views/argus/trail/pagination/_simple_pager.html.erb

@@ -0,0 +1,9 @@
+<% if pages.respond_to?(:total_pages) && pages.total_pages > 1 %>
+  <div class="flex items-center justify-center gap-3 text-sm py-2">
+    <%= link_to "← Prev", url_for(request.query_parameters.merge(page: [ pages.current_page - 1, 1 ].max)),
+        class: "px-3 py-1.5 rounded-md border border-gray-300 hover:bg-gray-50 #{'pointer-events-none opacity-40' if pages.current_page <= 1}" %>
+    <span class="text-gray-500">Page <%= pages.current_page %> of <%= pages.total_pages %></span>
+    <%= link_to "Next →", url_for(request.query_parameters.merge(page: [ pages.current_page + 1, pages.total_pages ].min)),
+        class: "px-3 py-1.5 rounded-md border border-gray-300 hover:bg-gray-50 #{'pointer-events-none opacity-40' if pages.current_page >= pages.total_pages}" %>
+  </div>
+<% end %>

data/app/views/argus/trail/permissions/_form.html.erb

@@ -0,0 +1,29 @@
+<%= form_with model: permission, url: (permission.persisted? ? permission_path(permission) : permissions_path), class: "space-y-6" do |f| %>
+  <% if permission.errors.any? %>
+    <div class="bg-red-50 border-l-4 border-red-400 p-4 rounded-lg">
+      <p class="text-sm font-semibold text-red-700 mb-1"><%= pluralize(permission.errors.count, "error") %> prevented saving:</p>
+      <ul class="list-disc list-inside space-y-0.5">
+        <% permission.errors.full_messages.each do |msg| %>
+          <li class="text-sm text-red-600"><%= msg %></li>
+        <% end %>
+      </ul>
+    </div>
+  <% end %>
+
+  <div>
+    <label class="block text-sm font-semibold text-gray-700 mb-1">Permission Name <span class="text-red-500">*</span></label>
+    <%= f.text_field :name, placeholder: "e.g. manage_users",
+        class: "block w-full px-3 py-2 border border-gray-300 rounded-lg text-sm shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500" %>
+  </div>
+
+  <div>
+    <label class="block text-sm font-semibold text-gray-700 mb-1">Description <span class="text-red-500">*</span></label>
+    <%= f.text_area :description, rows: 2,
+        class: "block w-full px-3 py-2 border border-gray-300 rounded-lg text-sm shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500 resize-none" %>
+  </div>
+
+  <div class="flex items-center gap-3 pt-2 border-t border-gray-100">
+    <%= f.submit class: "px-5 py-2 bg-blue-600 text-white text-sm font-semibold rounded-lg hover:bg-blue-700 cursor-pointer" %>
+    <%= link_to "Cancel", permissions_path, class: "px-5 py-2 bg-white text-gray-700 text-sm font-semibold border border-gray-300 rounded-lg hover:bg-gray-50" %>
+  </div>
+<% end %>

data/app/views/argus/trail/permissions/edit.html.erb

@@ -0,0 +1,10 @@
+<div class="max-w-3xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
+  <div class="flex items-center gap-4 mb-8">
+    <%= link_to "← Back", permission_path(@permission), class: "text-gray-400 hover:text-gray-600" %>
+    <h1 class="text-2xl font-bold text-gray-900">Edit Permission: <%= @permission.name.humanize %></h1>
+  </div>
+
+  <div class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
+    <%= render "form", permission: @permission %>
+  </div>
+</div>

data/app/views/argus/trail/permissions/index.html.erb

@@ -0,0 +1,47 @@
+<div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
+  <div class="flex items-center justify-between mb-8">
+    <div>
+      <h1 class="text-2xl font-bold text-gray-900">Permissions</h1>
+      <p class="text-sm text-gray-500 mt-1">Manage the permissions roles can be granted</p>
+    </div>
+    <%= link_to "New Permission", new_permission_path, class: "inline-flex items-center px-4 py-2 bg-blue-600 text-white text-sm font-medium rounded-lg hover:bg-blue-700 transition-colors" %>
+  </div>
+
+  <div class="bg-white rounded-xl shadow-sm border border-gray-200 overflow-hidden">
+    <% if @permissions.any? %>
+      <table class="min-w-full divide-y divide-gray-200">
+        <thead class="bg-gray-50">
+          <tr>
+            <th class="px-6 py-3 text-left text-xs font-semibold text-gray-500 uppercase tracking-wider">Permission</th>
+            <th class="px-6 py-3 text-left text-xs font-semibold text-gray-500 uppercase tracking-wider">Description</th>
+            <th class="px-6 py-3 text-left text-xs font-semibold text-gray-500 uppercase tracking-wider">Roles</th>
+            <th class="px-6 py-3 text-right text-xs font-semibold text-gray-500 uppercase tracking-wider">Actions</th>
+          </tr>
+        </thead>
+        <tbody class="bg-white divide-y divide-gray-200">
+          <% @permissions.each do |permission| %>
+            <tr class="hover:bg-gray-50 transition-colors">
+              <td class="px-6 py-4 whitespace-nowrap text-sm font-medium text-gray-900"><%= permission.name.humanize %></td>
+              <td class="px-6 py-4 text-sm text-gray-600"><%= permission.description %></td>
+              <td class="px-6 py-4 text-sm text-gray-600"><%= permission.roles.count %></td>
+              <td class="px-6 py-4 whitespace-nowrap text-right text-sm font-medium">
+                <div class="flex items-center justify-end gap-3">
+                  <%= link_to "View", permission_path(permission), class: "text-blue-600 hover:text-blue-800" %>
+                  <%= link_to "Edit", edit_permission_path(permission), class: "text-yellow-600 hover:text-yellow-800" %>
+                  <%= button_to "Delete", permission_path(permission), method: :delete,
+                      data: { turbo_confirm: "Delete permission '#{permission.name}'?" },
+                      class: "text-red-600 hover:text-red-800 bg-transparent border-0 p-0 cursor-pointer font-medium" %>
+                </div>
+              </td>
+            </tr>
+          <% end %>
+        </tbody>
+      </table>
+    <% else %>
+      <div class="text-center py-16">
+        <p class="text-gray-500 text-sm">No permissions yet.</p>
+        <%= link_to "Create Permission", new_permission_path, class: "mt-4 inline-block text-blue-600 hover:underline text-sm font-medium" %>
+      </div>
+    <% end %>
+  </div>
+</div>

data/app/views/argus/trail/permissions/new.html.erb

@@ -0,0 +1,10 @@
+<div class="max-w-3xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
+  <div class="flex items-center gap-4 mb-8">
+    <%= link_to "← Back", permissions_path, class: "text-gray-400 hover:text-gray-600" %>
+    <h1 class="text-2xl font-bold text-gray-900">New Permission</h1>
+  </div>
+
+  <div class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
+    <%= render "form", permission: @permission %>
+  </div>
+</div>

data/app/views/argus/trail/permissions/show.html.erb

@@ -0,0 +1,27 @@
+<div class="max-w-3xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
+  <div class="flex items-center justify-between mb-8">
+    <div class="flex items-center gap-4">
+      <%= link_to "← Back", permissions_path, class: "text-gray-400 hover:text-gray-600" %>
+      <div>
+        <h1 class="text-2xl font-bold text-gray-900"><%= @permission.name.humanize %></h1>
+        <p class="text-sm text-gray-500 mt-0.5"><%= @permission.description %></p>
+      </div>
+    </div>
+    <%= link_to "Edit", edit_permission_path(@permission), class: "inline-flex items-center px-4 py-2 bg-yellow-500 text-white text-sm font-medium rounded-lg hover:bg-yellow-600" %>
+  </div>
+
+  <div class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
+    <h2 class="text-base font-semibold text-gray-900 mb-4">Roles with this permission (<%= @permission.roles.count %>)</h2>
+    <% if @permission.roles.any? %>
+      <div class="flex flex-wrap gap-2">
+        <% @permission.roles.order(:name).each do |role| %>
+          <%= link_to role_path(role), class: "#{role_badge_class(role.name)} inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-semibold" do %>
+            <%= role.name %>
+          <% end %>
+        <% end %>
+      </div>
+    <% else %>
+      <p class="text-sm text-gray-400 italic">No roles have this permission yet.</p>
+    <% end %>
+  </div>
+</div>

data/app/views/argus/trail/roles/_form.html.erb

@@ -0,0 +1,50 @@
+<%= form_with model: role, url: (role.persisted? ? role_path(role) : roles_path), class: "space-y-6" do |f| %>
+  <% if role.errors.any? %>
+    <div class="bg-red-50 border-l-4 border-red-400 p-4 rounded-lg">
+      <p class="text-sm font-semibold text-red-700 mb-1"><%= pluralize(role.errors.count, "error") %> prevented saving:</p>
+      <ul class="list-disc list-inside space-y-0.5">
+        <% role.errors.full_messages.each do |msg| %>
+          <li class="text-sm text-red-600"><%= msg %></li>
+        <% end %>
+      </ul>
+    </div>
+  <% end %>
+
+  <div>
+    <label class="block text-sm font-semibold text-gray-700 mb-1">Role Name <span class="text-red-500">*</span></label>
+    <%= f.text_field :name, class: "block w-full px-3 py-2 border border-gray-300 rounded-lg text-sm shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500" %>
+  </div>
+
+  <div>
+    <label class="block text-sm font-semibold text-gray-700 mb-1">Description <span class="text-red-500">*</span></label>
+    <%= f.text_area :description, rows: 2,
+        class: "block w-full px-3 py-2 border border-gray-300 rounded-lg text-sm shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500 resize-none" %>
+  </div>
+
+  <div>
+    <label class="block text-sm font-semibold text-gray-700 mb-3">Permissions</label>
+    <div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
+      <% @permissions.each do |permission| %>
+        <label class="flex items-start gap-3 p-3 border border-gray-200 rounded-lg hover:border-indigo-300 hover:bg-indigo-50/50 cursor-pointer">
+          <input type="checkbox" name="permission_ids[]" value="<%= permission.id %>"
+                 <%= "checked" if role.permission_ids.include?(permission.id) %>
+                 class="mt-0.5 h-4 w-4 rounded border-gray-300 text-indigo-600 focus:ring-indigo-500">
+          <div>
+            <p class="text-sm font-medium text-gray-800"><%= permission.name.humanize %></p>
+            <p class="text-xs text-gray-500 mt-0.5"><%= permission.description %></p>
+          </div>
+        </label>
+      <% end %>
+    </div>
+    <% if @permissions.empty? %>
+      <p class="text-sm text-gray-400 italic mt-2">
+        No permissions exist yet. <%= link_to "Create one first", new_permission_path %>.
+      </p>
+    <% end %>
+  </div>
+
+  <div class="flex items-center gap-3 pt-2 border-t border-gray-100">
+    <%= f.submit class: "px-5 py-2 bg-blue-600 text-white text-sm font-semibold rounded-lg hover:bg-blue-700 cursor-pointer" %>
+    <%= link_to "Cancel", roles_path, class: "px-5 py-2 bg-white text-gray-700 text-sm font-semibold border border-gray-300 rounded-lg hover:bg-gray-50" %>
+  </div>
+<% end %>

data/app/views/argus/trail/roles/edit.html.erb

@@ -0,0 +1,10 @@
+<div class="max-w-3xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
+  <div class="flex items-center gap-4 mb-8">
+    <%= link_to "← Back", role_path(@role), class: "text-gray-400 hover:text-gray-600" %>
+    <h1 class="text-2xl font-bold text-gray-900">Edit Role: <%= @role.name %></h1>
+  </div>
+
+  <div class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
+    <%= render "form", role: @role %>
+  </div>
+</div>

data/app/views/argus/trail/roles/index.html.erb

@@ -0,0 +1,68 @@
+<div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
+  <div class="flex items-center justify-between mb-8">
+    <div>
+      <h1 class="text-2xl font-bold text-gray-900">Roles</h1>
+      <p class="text-sm text-gray-500 mt-1">Manage roles and their permissions</p>
+    </div>
+    <%= link_to "New Role", new_role_path, class: "inline-flex items-center px-4 py-2 bg-blue-600 text-white text-sm font-medium rounded-lg hover:bg-blue-700 transition-colors" %>
+  </div>
+
+  <div class="bg-white rounded-xl shadow-sm border border-gray-200 overflow-hidden">
+    <% if @roles.any? %>
+      <table class="min-w-full divide-y divide-gray-200">
+        <thead class="bg-gray-50">
+          <tr>
+            <th class="px-6 py-3 text-left text-xs font-semibold text-gray-500 uppercase tracking-wider">Role</th>
+            <th class="px-6 py-3 text-left text-xs font-semibold text-gray-500 uppercase tracking-wider">Description</th>
+            <th class="px-6 py-3 text-left text-xs font-semibold text-gray-500 uppercase tracking-wider">Permissions</th>
+            <th class="px-6 py-3 text-right text-xs font-semibold text-gray-500 uppercase tracking-wider">Actions</th>
+          </tr>
+        </thead>
+        <tbody class="bg-white divide-y divide-gray-200">
+          <% @roles.each do |role| %>
+            <tr class="hover:bg-gray-50 transition-colors">
+              <td class="px-6 py-4 whitespace-nowrap">
+                <span class="<%= role_badge_class(role.name) %> inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-semibold">
+                  <%= role.name %>
+                </span>
+              </td>
+              <td class="px-6 py-4 text-sm text-gray-600"><%= role.description %></td>
+              <td class="px-6 py-4">
+                <div class="flex flex-wrap gap-1">
+                  <% if role.permissions.any? %>
+                    <% role.permissions.first(3).each do |perm| %>
+                      <span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-indigo-50 text-indigo-700 border border-indigo-100">
+                        <%= perm.name.humanize %>
+                      </span>
+                    <% end %>
+                    <% if role.permissions.count > 3 %>
+                      <span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-gray-100 text-gray-600">
+                        +<%= role.permissions.count - 3 %> more
+                      </span>
+                    <% end %>
+                  <% else %>
+                    <span class="text-xs text-gray-400 italic">No permissions</span>
+                  <% end %>
+                </div>
+              </td>
+              <td class="px-6 py-4 whitespace-nowrap text-right text-sm font-medium">
+                <div class="flex items-center justify-end gap-3">
+                  <%= link_to "View", role_path(role), class: "text-blue-600 hover:text-blue-800" %>
+                  <%= link_to "Edit", edit_role_path(role), class: "text-yellow-600 hover:text-yellow-800" %>
+                  <%= button_to "Delete", role_path(role), method: :delete,
+                      data: { turbo_confirm: "Delete role '#{role.name}'? This cannot be undone." },
+                      class: "text-red-600 hover:text-red-800 bg-transparent border-0 p-0 cursor-pointer font-medium" %>
+                </div>
+              </td>
+            </tr>
+          <% end %>
+        </tbody>
+      </table>
+    <% else %>
+      <div class="text-center py-16">
+        <p class="text-gray-500 text-sm">No roles yet.</p>
+        <%= link_to "Create Role", new_role_path, class: "mt-4 inline-block text-blue-600 hover:underline text-sm font-medium" %>
+      </div>
+    <% end %>
+  </div>
+</div>

data/app/views/argus/trail/roles/new.html.erb

@@ -0,0 +1,10 @@
+<div class="max-w-3xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
+  <div class="flex items-center gap-4 mb-8">
+    <%= link_to "← Back", roles_path, class: "text-gray-400 hover:text-gray-600" %>
+    <h1 class="text-2xl font-bold text-gray-900">New Role</h1>
+  </div>
+
+  <div class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
+    <%= render "form", role: @role %>
+  </div>
+</div>

data/app/views/argus/trail/roles/show.html.erb

@@ -0,0 +1,52 @@
+<div class="max-w-4xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
+  <div class="flex items-center justify-between mb-8">
+    <div class="flex items-center gap-4">
+      <%= link_to "← Back", roles_path, class: "text-gray-400 hover:text-gray-600" %>
+      <div>
+        <h1 class="text-2xl font-bold text-gray-900"><%= @role.name %></h1>
+        <p class="text-sm text-gray-500 mt-0.5"><%= @role.description %></p>
+      </div>
+    </div>
+    <%= link_to "Edit Role", edit_role_path(@role), class: "inline-flex items-center px-4 py-2 bg-yellow-500 text-white text-sm font-medium rounded-lg hover:bg-yellow-600" %>
+  </div>
+
+  <div class="grid grid-cols-1 lg:grid-cols-2 gap-6">
+    <div class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
+      <h2 class="text-base font-semibold text-gray-900 mb-4">Permissions (<%= @role.permissions.count %>)</h2>
+      <% if @role.permissions.any? %>
+        <div class="space-y-2">
+          <% @role.permissions.order(:name).each do |perm| %>
+            <div class="p-3 bg-indigo-50 rounded-lg">
+              <p class="text-sm font-medium text-indigo-900"><%= perm.name.humanize %></p>
+              <p class="text-xs text-indigo-600 mt-0.5"><%= perm.description %></p>
+            </div>
+          <% end %>
+        </div>
+      <% else %>
+        <p class="text-sm text-gray-400 italic">No permissions assigned to this role.</p>
+      <% end %>
+    </div>
+
+    <div class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
+      <h2 class="text-base font-semibold text-gray-900 mb-4">Assigned (<%= @role.actors.count %>)</h2>
+      <% if @role.actors.any? %>
+        <div class="space-y-2">
+          <% @role.actors.limit(10).each do |actor| %>
+            <div class="p-2 rounded-lg hover:bg-gray-50 text-sm text-gray-800">
+              <%= actor.try(:argus_trail_display_name) || actor.try(:name) || actor.try(:email) || "##{actor.id}" %>
+            </div>
+          <% end %>
+          <% if @role.actors.count > 10 %>
+            <p class="text-xs text-gray-400 text-center pt-1">+ <%= @role.actors.count - 10 %> more</p>
+          <% end %>
+        </div>
+      <% else %>
+        <p class="text-sm text-gray-400 italic">No one has this role yet.</p>
+      <% end %>
+    </div>
+  </div>
+
+  <div class="mt-6">
+    <%= link_to "View audit history for this role", audit_entries_path(role_id: @role.id), class: "text-sm text-blue-600 hover:underline" %>
+  </div>
+</div>

data/app/views/layouts/argus/trail/application.html.erb

@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Role &amp; Permission Admin</title>
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <%= csrf_meta_tags %>
+  <%= csp_meta_tag %>
+
+  <%= yield :head %>
+
+  <!--
+    Self-contained by design so the engine's screens render correctly in any
+    host regardless of its asset pipeline/Tailwind setup. Override this
+    layout (or set config.layout to a host layout) via the `views` generator
+    if you'd rather ship your own compiled CSS.
+  -->
+  <script src="https://cdn.tailwindcss.com"></script>
+</head>
+<body class="bg-gray-50 min-h-screen">
+  <nav class="bg-white border-b border-gray-200">
+    <div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 flex items-center gap-6 h-14">
+      <%= link_to "Roles", roles_path, class: "text-sm font-semibold text-gray-700 hover:text-blue-600" %>
+      <%= link_to "Permissions", permissions_path, class: "text-sm font-semibold text-gray-700 hover:text-blue-600" %>
+      <%= link_to "Audit Log", audit_entries_path, class: "text-sm font-semibold text-gray-700 hover:text-blue-600" %>
+    </div>
+  </nav>
+
+  <% flash.each do |type, message| %>
+    <div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 mt-4">
+      <div class="rounded-lg px-4 py-2.5 text-sm <%= type.to_s == "alert" ? "bg-red-50 text-red-700 border border-red-200" : "bg-green-50 text-green-700 border border-green-200" %>">
+        <%= message %>
+      </div>
+    </div>
+  <% end %>
+
+  <%= yield %>
+</body>
+</html>

data/config/routes.rb

@@ -0,0 +1,7 @@
+Argus::Trail::Engine.routes.draw do
+  resources :roles
+  resources :permissions
+  resources :audit_entries, only: [ :index ]
+
+  root to: "roles#index"
+end

data/lib/argus/trail/actor.rb

@@ -0,0 +1,67 @@
+module Argus
+  module Trail
+    # Include in your app's user/account model to opt it into role assignment
+    # and permission checks:
+    #
+    #   class User < ApplicationRecord
+    #     include Argus::Trail::Actor
+    #   end
+    #
+    # An actor can hold any number of roles (0..N) — there is no separate
+    # single-role mode. Assign a lone role by passing a single id to
+    # `sync_roles!`.
+    module Actor
+      extend ActiveSupport::Concern
+
+      included do
+        has_many :argus_trail_role_assignments,
+                 as: :actor, class_name: "Argus::Trail::RoleAssignment", dependent: :destroy
+        has_many :roles, through: :argus_trail_role_assignments, class_name: Argus::Trail.config.role_class_name
+
+        has_many :argus_trail_audit_entries_as_subject,
+                 as: :subject, class_name: "Argus::Trail::AuditEntry", dependent: :destroy
+        has_many :argus_trail_audit_entries_as_changer,
+                 as: :changed_by, class_name: "Argus::Trail::AuditEntry", dependent: :nullify
+      end
+
+      def has_permission?(permission_name)
+        roles.joins(:permissions).exists?(Argus::Trail.config.permission_class.table_name => { name: permission_name })
+      end
+
+      # Diffs the requested role ids against the actor's current ones and
+      # writes one AuditEntry per addition/removal, so the audit log captures
+      # exactly which roles were assigned or revoked (not just "something changed").
+      def sync_roles!(new_role_ids, changed_by: Argus::Trail.config.changed_by_resolver.call)
+        new_ids = Array(new_role_ids).map(&:to_i).reject(&:zero?)
+        current_ids = role_ids
+
+        added_ids   = new_ids - current_ids
+        removed_ids = current_ids - new_ids
+
+        transaction do
+          self.role_ids = new_ids
+
+          Argus::Trail.config.role_class.where(id: added_ids).find_each do |role|
+            argus_trail_record_role_change("role_assigned", role, changed_by)
+          end
+
+          Argus::Trail.config.role_class.where(id: removed_ids).find_each do |role|
+            argus_trail_record_role_change("role_revoked", role, changed_by)
+          end
+        end
+      end
+
+      private
+
+      def argus_trail_record_role_change(event_type, role, changed_by)
+        Argus::Trail::AuditEntry.create!(
+          event_type: event_type,
+          subject:    self,
+          role_id:    role.id,
+          changed_by: changed_by,
+          metadata:   { "role_name" => role.name }
+        )
+      end
+    end
+  end
+end

data/lib/argus/trail/configuration.rb

@@ -0,0 +1,46 @@
+module Argus
+  module Trail
+    class Configuration
+      class MissingAuthorization < StandardError
+        def message
+          "Argus::Trail could not determine how to authorize access to its admin screens. " \
+            "Either add Pundit to your Gemfile with Argus::Trail::Role/Permission policies, " \
+            "or set `config.authorize_with` in config/initializers/argus_trail.rb " \
+            "(e.g. `config.authorize_with = ->(controller, record) { controller.current_user&.admin? }`)."
+        end
+      end
+
+      attr_accessor :actor_class_name, :role_class_name, :permission_class_name,
+                    :role_permission_class_name, :changed_by_resolver, :authorize_with,
+                    :current_actor_method, :per_page, :layout
+
+      def initialize
+        @actor_class_name           = "User"
+        @role_class_name            = "Argus::Trail::Role"
+        @permission_class_name      = "Argus::Trail::Permission"
+        @role_permission_class_name = "Argus::Trail::RolePermission"
+        @changed_by_resolver = -> { Argus::Trail::Current.actor }
+        @authorize_with      = nil
+        @current_actor_method = :current_user
+        @per_page            = 30
+        @layout              = nil
+      end
+
+      def actor_class
+        actor_class_name.to_s.constantize
+      end
+
+      def role_class
+        role_class_name.to_s.constantize
+      end
+
+      def permission_class
+        permission_class_name.to_s.constantize
+      end
+
+      def role_permission_class
+        role_permission_class_name.to_s.constantize
+      end
+    end
+  end
+end

data/lib/argus/trail/current.rb

@@ -0,0 +1,7 @@
+module Argus
+  module Trail
+    class Current < ActiveSupport::CurrentAttributes
+      attribute :actor
+    end
+  end
+end

data/lib/argus/trail/engine.rb

@@ -0,0 +1,13 @@
+module Argus
+  module Trail
+    class Engine < ::Rails::Engine
+      isolate_namespace Argus::Trail
+
+      config.generators do |g|
+        g.test_framework false
+        g.assets false
+        g.helper false
+      end
+    end
+  end
+end