current_scope 0.2.0 → 0.3.1

data/app/models/current_scope/role.rb

@@ -8,13 +8,17 @@ module CurrentScope
     has_many :scoped_role_assignments, dependent: :destroy
 
     validates :name, presence: true, uniqueness: true
+    validate :permission_keys_in_catalog
 
     after_save :persist_permission_keys
 
-    # The grid diff computed by the last save: { added: [...], removed: [...] }.
-    # Empty arrays on a no-op save; nil when no grid was staged (a programmatic
-    # save that never set permission_keys). Controllers read this to record the
-    # change — the model itself records nothing (seeds must stay silent).
+    # The grid diff computed by the last save:
+    # { added: [...], removed: [...], rejected: [...] }. Empty arrays on a no-op
+    # save; nil when no grid was staged (a programmatic save that never set
+    # permission_keys). `added`/`removed` describe what actually persisted;
+    # `rejected` names keys the scrub path threw away, so a caller that opted
+    # into silence can still log it. Controllers read this to record the change
+    # — the model itself records nothing (seeds must stay silent).
     attr_reader :permission_keys_change
 
     def grants?(permission_key)
@@ -25,31 +29,78 @@ module CurrentScope
       @pending_permission_keys || role_permissions.pluck(:permission_key)
     end
 
-    # Stages a replacement permission set, dropping keys that aren't in the
-    # catalog (stale keys from removed controllers). Persisted on save, like
-    # any other attribute — never before validations pass.
+    # Stages a replacement permission set. STRICT: a key that isn't in the
+    # route-derived catalog makes the record invalid rather than disappearing.
+    # This is the mass-assignment writer (update!, strong params, the role
+    # grid), so it is deliberately the strict one — the scrub escape hatch must
+    # never be reachable from form params.
     def permission_keys=(keys)
-      @pending_permission_keys = Array(keys).uniq.select { |k| CurrentScope.catalog.include?(k) }
+      assign_permission_keys(keys, scrub: false)
+    end
+
+    # ponytail: one implementation, two intents — the setter is the strict
+    # front door, this is the same staging with the scrub opt-in named at the
+    # call site.
+    #
+    # `scrub: true` is the ONLY sanctioned silent drop, and it exists for one
+    # real case: a controller was removed, so a role still holds keys that no
+    # longer route. Cleaning those up is legitimate and shouldn't require the
+    # operator to name every dead key. Everything else — typos, unrouted
+    # programmatic grants, the never-routed break-glass permission — is a
+    # mistake, and a security-grant API must not swallow mistakes.
+    def assign_permission_keys(keys, scrub: false)
+      # Literal `true` only. Ruby truthiness would let the string "false" — or
+      # any params/config value that found its way here — silently disable the
+      # strict path, which is the exact hole this API exists to close. The
+      # escape hatch opens for a caller that means it, not for one that passed
+      # something along.
+      @scrub_permission_keys = scrub == true
+      # Blank entries are the grid's hidden-field padding, not typos (R2).
+      @pending_permission_keys = Array(keys).map(&:to_s).reject(&:blank?).uniq
     end
 
     def reload(...)
       @pending_permission_keys = nil
+      @scrub_permission_keys = false
       super
     end
 
     private
 
+    def permission_keys_in_catalog
+      return if @pending_permission_keys.nil? || @scrub_permission_keys
+
+      unknown = @pending_permission_keys.reject { |k| CurrentScope.catalog.include?(k) }
+      return if unknown.empty?
+
+      errors.add(
+        :permission_keys,
+        "not in the permission catalog: #{unknown.join(', ')} — check for typos, or use " \
+        "assign_permission_keys(..., scrub: true) to drop stale keys deliberately"
+      )
+    end
+
     def persist_permission_keys
       return if @pending_permission_keys.nil?
 
       # Capture the prior keys BEFORE delete_all so the diff survives the swap.
       previous = role_permissions.pluck(:permission_key)
-      staged = @pending_permission_keys
-      @permission_keys_change = { added: staged - previous, removed: previous - staged }
+      # Defense in depth: on the strict path validation already proved every key
+      # is in the catalog, so this filter is a no-op. It is what the scrub path
+      # relies on, and it means no future code path that skips validations
+      # (insert_all, update_column, a bare `save(validate: false)`) can smuggle
+      # an unknown key into the table.
+      staged = @pending_permission_keys.select { |k| CurrentScope.catalog.include?(k) }
+      @permission_keys_change = {
+        added: staged - previous,
+        removed: previous - staged,
+        rejected: @pending_permission_keys - staged
+      }
 
       role_permissions.delete_all
       role_permissions.insert_all(staged.map { |k| { permission_key: k } }) if staged.any?
       @pending_permission_keys = nil
+      @scrub_permission_keys = false
     end
   end
 end

data/app/views/current_scope/roles/edit.html.erb

@@ -4,7 +4,7 @@
 
 <%= form_with model: @role do |f| %>
   <% if @role.errors.any? %>
-    <p class="cs-alert"><%= @role.errors.full_messages.to_sentence %></p>
+    <p class="cs-alert" role="alert"><%= @role.errors.full_messages.to_sentence %></p>
   <% end %>
 
   <p><%= f.label :name %> <%= f.text_field :name %></p>
@@ -20,10 +20,33 @@
   </p>
 
   <h2>Permission grid</h2>
+  <%# The injected break-glass action's bare name (nil when break-glass is
+      off) — the hint below and the per-row exemption check both read it. The
+      CATALOG owns the parse: its split("#", -1) + blank-raise catches a
+      malformed "reports#" that a loose split here would silently turn into a
+      believable wrong action name. (#79 review, qodo) %>
+  <% bypass_action = CurrentScope.config.allow_sod_bypass ? CurrentScope.catalog.bypass_action : nil %>
   <p class="cs-hint">
     One row per controller, one checkbox per action group — derived from the
     app's routes, so new controllers appear here automatically. Columns are
     fixed: a blank cell means the controller doesn't route that action.
+    <%# The break-glass column is the one thing here that is NOT an action you
+        can route, so the "derived from the app's routes" line above would
+        otherwise make it look like a mistake. %>
+    <% if CurrentScope.config.allow_sod_bypass %>
+      Break-glass is on, so controllers with a separation-of-duties action also
+      show a <code><%= bypass_action %></code>
+      column: granting it lets that role's holder override the four-eyes veto on
+      their own record, where the record allows it. Every use is audited.
+    <% end %>
+  </p>
+  <%# Unconditional on purpose (R9): the limit of the mark must be stated even
+      when nothing is marked — an unmarked row is a non-answer, not a proof. %>
+  <p class="cs-hint cs-ungated-hint">
+    Rows tagged "gate not run" are controllers provably never gated — the tag
+    appears only when the callback chain proves it. An unmarked row is not
+    proof the gate runs there (a conditional skip, for example, is unprovable
+    and renders unmarked).
   </p>
 
   <% grid = CurrentScope::PermissionGrid.new %>
@@ -42,15 +65,58 @@
       </thead>
       <tbody>
         <% grid.controllers.each do |controller| %>
+          <%# A broken controller body's NameError deliberately propagates out
+              of the reflection (KTD-2) — but ONE broken controller must not
+              take down the whole role editor for every other row. The view
+              renders that row as explicitly uninspectable (a visible state,
+              never silence, never "gated"); the rake task keeps propagating,
+              because its output makes proof claims a partial walk can't. %>
+          <% ungated = begin
+               grid.ungated?(controller)
+             rescue NameError
+               :uninspectable
+             end %>
+          <% uninspectable = ungated == :uninspectable
+             ungated = ungated == true %>
+          <% badge_id = "cs_ungated_#{controller.parameterize(separator: '_')}" if ungated %>
           <tr>
             <th scope="row">
               <%# Per-row master: enable/disable every action in this controller at once.
                   Progressive enhancement — with JS off, each cell checkbox still works. %>
               <label class="cs-row-all" title="Enable all <%= controller %> permissions">
                 <input type="checkbox" data-cs-row-all
-                       aria-label="Enable all <%= controller %> permissions">
+                       aria-label="Enable all <%= controller %> permissions"<% if ungated %>
+                       aria-describedby="<%= badge_id %>"<% end %>>
                 <span><%= controller %></span>
               </label>
+              <% if uninspectable %>
+                <%# Not a badge and not silence: the gate state is UNKNOWN here,
+                    and rendering nothing would read as "checked, and gated"
+                    under the hint's own rules. %>
+                <span class="cs-uninspectable-note" id="cs_uninspectable_<%= controller.parameterize(separator: '_') %>">
+                  could not inspect — this controller raised while loading, so its
+                  gate state is unknown. Fix the load error, then reload.
+                </span>
+              <% end %>
+              <% if ungated %>
+                <%# Advisory only — marking is not disabling (KTD-8/R5): nothing
+                    here is grayed or disabled. Same remediation vocabulary as
+                    GatingTripwire's message. The claim is scoped to ROUTED
+                    actions because the injected break-glass cell is live even
+                    on a marked row (KTD-9) and carries its own note below. %>
+                <%# Each remedy names its cause: re-including Guard on a subclass
+                    that inherited a skip is a NO-OP (the Concern short-circuits;
+                    the skip already removed the callback the include would add),
+                    so the inherited-skip host — the #62 shape this badge exists
+                    for — must be pointed at re-assertion, not at include. %>
+                <span class="cs-ungated-badge" id="<%= badge_id %>">
+                  <strong>gate not run</strong> — this controller does not run the
+                  gate; ticking its routed actions grants nothing until it does.
+                  If it inherited a skip, re-assert
+                  <code>before_action :current_scope_check!</code>; if it never had
+                  the gate, include CurrentScope::Guard.
+                </span>
+              <% end %>
             </th>
             <% grid.columns.each do |column| %>
               <% cell = grid.cell(controller, column, granted) %>
@@ -60,13 +126,35 @@
                     readers; the "·" marker is decorative CSS. %>
                 <td class="cs-cell-blank"></td>
               <% else %>
-                <td>
+                <%# column.actions covers both shapes — an ungrouped column is
+                    [action], and a permission_grid_groups entry containing the
+                    bypass action must not defeat the exemption. The two guards:
+                    the INJECTED key must actually sit on this controller (a
+                    grouped cell can be non-blank via its other actions), and
+                    routed? excludes the collision — a REAL routed action merely
+                    named like the bypass permission is ordinary and inert on a
+                    marked row; only the catalog-injected key stays live. (#79) %>
+                <% bypass_exempt = ungated && bypass_action &&
+                     column.actions.include?(bypass_action) &&
+                     CurrentScope.catalog.grouped[controller]&.include?(bypass_action) &&
+                     !CurrentScope.catalog.routed?("#{controller}##{bypass_action}") %>
+                <% note_id = "cs_bypass_exempt_#{controller.parameterize(separator: '_')}" if bypass_exempt %>
+                <td<% if bypass_exempt %> class="cs-cell-bypass"<% end %>>
                   <label>
                     <%= check_box_tag cell.name, cell.value, cell.checked,
                           id: "perm_#{cell.value.parameterize(separator: '_')}",
                           data: { cs_partial: cell.partial },
-                          "aria-label": "#{controller} #{column.label}" %>
+                          "aria-label": "#{controller} #{column.label}",
+                          "aria-describedby": (bypass_exempt ? "#{badge_id} #{note_id}" : badge_id) %>
                   </label>
+                  <% if bypass_exempt %>
+                    <%# KTD-9: break-glass is decided by GATED controllers acting
+                        on the record type, so this grant is live despite the
+                        row's badge — the one cell exempt from its claim. The
+                        class is also the CSS hook that keeps the real granted
+                        wash here while sibling cells are muted. %>
+                    <span class="cs-bypass-exempt" id="<%= note_id %>">exempt — stays live</span>
+                  <% end %>
                   <%# Partial group: preserve the exact granted actions so a no-op
                       save can't promote the group to a full grant. Interacting with
                       the checkbox disables these (JS) so the group control takes over. %>

data/app/views/current_scope/roles/index.html.erb

@@ -30,9 +30,23 @@
         </td>
         <td>
           <%= link_to "Members", members_role_path(role), class: "cs-btn" %>
+          <%
+            org_n = role.role_assignments.size
+            scoped_n = role.scoped_role_assignments.size
+            parts = []
+            parts << "#{org_n} org-wide #{"holder".pluralize(org_n)}" if org_n.positive?
+            parts << "#{scoped_n} scoped #{"holder".pluralize(scoped_n)}" if scoped_n.positive?
+            delete_prompt = if parts.empty?
+              "Delete role #{role.name}?"
+            else
+              "Delete role #{role.name}? This also removes it from #{parts.to_sentence}."
+            end
+          %>
           <%= button_to "Delete", role_path(role), method: :delete,
-                form: { data: { cs_confirm: "Delete role #{role.name}?" } },
-                data: { turbo_confirm: "Delete role #{role.name}?" } %>
+                class: "cs-btn cs-btn-danger",
+                form: { data: { cs_confirm: delete_prompt } },
+                aria: { label: "Delete role #{role.name}" },
+                data: { turbo_confirm: delete_prompt } %>
         </td>
       </tr>
     <% end %>

data/app/views/current_scope/roles/members.html.erb

@@ -11,7 +11,7 @@
 
 <h2>Add org-wide members</h2>
 <% if @candidates.any? %>
-  <%= form_with url: role_assignment_path, method: :post do %>
+  <%= form_with url: role_assignments_path, method: :post do %>
     <%= hidden_field_tag :role_id, @role.id %>
     <p>
       <%= label_tag "subject_gids", "Subjects" %>
@@ -46,7 +46,7 @@
             <td>
               <% if subject_gid %>
                 <%# Removing = clearing this subject's org-wide role (blank role_id). %>
-                <%= form_with url: role_assignment_path, method: :post,
+                <%= form_with url: role_assignments_path, method: :post,
                       data: { cs_confirm: "Remove #{who} from #{@role.name}?" } do %>
                   <%= hidden_field_tag :subject_gid, subject_gid %>
                   <%= hidden_field_tag :role_id, "" %>
@@ -54,7 +54,7 @@
                 <% end %>
               <% else %>
                 <%# Orphaned assignment (subject deleted): remove it by id. %>
-                <%= button_to "Remove", remove_role_assignment_path(assignment), method: :delete,
+                <%= button_to "Remove", role_assignment_path(assignment), method: :delete,
                       class: "cs-btn", form: { data: { cs_confirm: "Remove this orphaned org-wide assignment?" } } %>
                 <span class="cs-subtle">subject unavailable</span>
               <% end %>

data/app/views/current_scope/roles/new.html.erb

@@ -2,7 +2,7 @@
 
 <%= form_with model: @role do |f| %>
   <% if @role.errors.any? %>
-    <p class="cs-alert"><%= @role.errors.full_messages.to_sentence %></p>
+    <p class="cs-alert" role="alert"><%= @role.errors.full_messages.to_sentence %></p>
   <% end %>
 
   <p><%= f.label :name %> <%= f.text_field :name %></p>

data/app/views/current_scope/scoped_role_assignments/new.html.erb

@@ -24,15 +24,15 @@
 <%= form_with url: new_scoped_role_assignment_path, method: :get, id: "cs-cascade",
       data: { turbo_frame: "cascade" }, class: "cs-picker" do %>
   <p>
-    <label>Role</label>
+    <%= label_tag :role_id, "Role" %>
     <%= select_tag :role_id,
           options_from_collection_for_select(@roles, :id, :name, params[:role_id]),
           data: { current_scope_autosubmit: true } %>
   </p>
   <% if @bulk_subjects.any? %>
     <p>
-      <label>Subjects</label>
-      <span class="cs-hint">
+      <span class="cs-label" id="cs_bulk_subjects_label">Subjects</span>
+      <span class="cs-hint" aria-labelledby="cs_bulk_subjects_label">
         Granting to <strong><%= @bulk_subjects.size %></strong>:
         <%= @bulk_subjects.map { |s| current_scope_subject_label(s) }.to_sentence %>
       </span>
@@ -42,7 +42,7 @@
     </p>
   <% else %>
     <p>
-      <label>Subject</label>
+      <%= label_tag :subject_gid, "Subject" %>
       <%= select_tag :subject_gid,
             options_for_select(@subjects.map { |s| [ current_scope_subject_label(s), s.to_gid.to_s ] },
                                params[:subject_gid]),
@@ -67,7 +67,7 @@
       end
     %>
     <p>
-      <label>Resource type</label>
+      <%= label_tag :resource_type, "Resource type" %>
       <%= select_tag :resource_type,
             options_for_select(type_options, @resource_type&.name),
             include_blank: "— choose a type —", form: "cs-cascade",
@@ -82,13 +82,13 @@
       <% else %>
         <% if @searchable %>
           <p>
-            <label>Search records</label>
+            <%= label_tag :q, "Search records" %>
             <%= search_field_tag :q, params[:q], placeholder: "Filter by label",
                   form: "cs-cascade", data: { current_scope_autosubmit: true } %>
           </p>
         <% end %>
         <p>
-          <label>Record</label>
+          <%= label_tag :resource_gid, "Record" %>
           <%
             record_options = (@records || []).map { |record| [ current_scope_label(record), record.to_gid.to_s ] }
             # Keep a deep-linked record selectable even if it fell outside the
@@ -102,9 +102,18 @@
                 include_blank: "— choose a record —", form: "cs-cascade",
                 data: { current_scope_autosubmit: true } %>
           <% if @searchable && params[:q].present? %>
-            <span class="cs-hint">
-              Showing up to <%= CurrentScope::ScopedRoleAssignmentsController::DISPLAY_LIMIT %> matches — refine the search to narrow.
-            </span>
+            <%# Keyed off the raw SEARCH results, not record_options — a
+                deep-linked @resource is prepended to the options even when the
+                query matched nothing, and must not fake a "matches shown". %>
+            <% if @records.blank? %>
+              <span class="cs-hint cs-picker-empty">
+                No records match “<%= params[:q] %>” — try a different search.
+              </span>
+            <% else %>
+              <span class="cs-hint">
+                Showing up to <%= CurrentScope::ScopedRoleAssignmentsController::DISPLAY_LIMIT %> matches — refine the search to narrow.
+              </span>
+            <% end %>
           <% end %>
         </p>
       <% end %>

data/app/views/current_scope/shared/access_denied.html.erb

@@ -0,0 +1,30 @@
+<%# The engine's front-door 403. Deliberately NOT rendered in the console
+    layout: that layout is a sidebar of links to Roles / Subjects / Events, and
+    showing the console chrome to someone who cannot open any of it reads as
+    "you're in" while every link refuses. Standalone page, engine stylesheet, no
+    navigation offered that isn't there. %>
+<!DOCTYPE html>
+<html lang="en"<%= " data-cs-theme=\"#{cookies[:current_scope_theme]}\"".html_safe if %w[light dark].include?(cookies[:current_scope_theme]) %>>
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Access denied — CurrentScope</title>
+  <%= csp_meta_tag %>
+  <%= stylesheet_link_tag "current_scope/application", media: "all" %>
+</head>
+<body>
+  <main class="cs-card cs-denied">
+    <h1>This area needs a full-access role</h1>
+    <p>
+      The authorization console is where roles and permissions are granted, so it
+      can't be gated by a permission you could be granted — it's open only to
+      subjects holding a role marked <strong>full access</strong>.
+    </p>
+    <p class="cs-hint">
+      If you should have it, ask someone who already does to grant you a
+      full-access role. If nobody has one yet, it's granted from the console or a
+      rake task — see the CurrentScope README's bootstrap section.
+    </p>
+  </main>
+</body>
+</html>

data/app/views/current_scope/subjects/index.html.erb

@@ -14,7 +14,10 @@
 </div>
 <% if @query.present? %>
   <p class="cs-hint">Showing matches for “<%= @query %>” across all subjects. Narrow the list below per page; selection applies to the current page.</p>
-<% elsif @page > 1 || @has_next_page %>
+<% else %>
+  <%# Always shown (not just on multi-page lists): the one input drives TWO
+      mechanisms — typing live-filters this page, Search queries every subject —
+      and nothing but this line says so. %>
   <p class="cs-hint">Type to filter this page, or Search to find anyone by email or name across every subject.</p>
 <% end %>
 
@@ -23,8 +26,11 @@
   <span class="cs-spacer"></span>
   <%# Org-wide role for the selection. JS injects the checked subjects as
       subject_gids[] on submit; blank role clears it for all. %>
-  <%= form_with url: role_assignment_path, method: :post, class: "cs-bulk-org",
-        data: { cs_bulk_org: true } do %>
+  <%# Setting REPLACES each subject's current org-wide role (blank clears it) —
+      as consequential as Remove, which confirms, so this does too. %>
+  <% bulk_prompt = "Change the org-wide role for the selected subjects? This replaces their current role." %>
+  <%= form_with url: role_assignments_path, method: :post, class: "cs-bulk-org",
+        data: { cs_bulk_org: true, cs_confirm: bulk_prompt, turbo_confirm: bulk_prompt } do %>
     <%= select_tag :role_id, options_from_collection_for_select(@roles, :id, :name),
           include_blank: "org role…", aria: { label: "Org-wide role for selected" } %>
     <%= submit_tag "Set for selected", name: nil, class: "cs-btn" %>
@@ -46,7 +52,11 @@
   </thead>
   <tbody>
     <% @subjects.each do |subject| %>
-      <% key = [ subject.class.name, subject.id ] %>
+      <%# Key by what the polymorphic association STORES (the base_class name),
+          not subject.class.name — an STI subject (AdminUser < User) is saved as
+          "User", and keying on the subclass name would show its roles as
+          "— none —" while the resolver happily enforces them. %>
+      <% key = [ subject.class.polymorphic_name, subject.id ] %>
       <% label = current_scope_subject_label(subject) %>
       <%# Filter against a precise text set — subject label, current org role, and
           scoped roles/records — NOT the row's textContent: every row embeds a
@@ -61,12 +71,16 @@
         </td>
         <td><%= label %></td>
         <td>
-          <%= form_with url: role_assignment_path, method: :post do %>
+          <% set_prompt = "Change the org-wide role for #{label}? This replaces their current role." %>
+          <%= form_with url: role_assignments_path, method: :post,
+                data: { cs_confirm: set_prompt, turbo_confirm: set_prompt } do %>
             <%= hidden_field_tag :subject_gid, subject.to_gid %>
             <%= select_tag :role_id,
                   options_from_collection_for_select(@roles, :id, :name, @assignments[key]&.role_id),
-                  include_blank: "— none —" %>
-            <%= submit_tag "Set", name: nil %>
+                  include_blank: "— none —",
+                  aria: { label: "Org-wide role for #{label}" } %>
+            <%= submit_tag "Set", name: nil,
+                  aria: { label: "Set org-wide role for #{label}" } %>
           <% end %>
         </td>
         <td>

data/app/views/layouts/current_scope/application.html.erb

@@ -15,6 +15,9 @@
   <%= javascript_include_tag "current_scope/application", defer: true %>
 </head>
 <body>
+  <%# WCAG 2.4.1: every page repeats the sidebar + topbar before its content —
+      keyboard users get a bypass. Visually hidden until focused. %>
+  <a class="cs-skip-link" href="#cs-main-content">Skip to content</a>
   <div class="cs-shell">
     <aside class="cs-sidebar">
       <div class="cs-brand"><span class="cs-brand-mark" aria-hidden="true"></span> CurrentScope</div>
@@ -44,7 +47,7 @@
       <% if notice.present? %><p class="cs-flash cs-flash--notice" role="status"><%= notice %></p><% end %>
       <% if alert.present? %><p class="cs-flash cs-flash--alert" role="alert"><%= alert %></p><% end %>
 
-      <main class="cs-content">
+      <main class="cs-content" id="cs-main-content" tabindex="-1">
         <%= yield %>
       </main>
     </div>

data/config/routes.rb

@@ -6,9 +6,8 @@ CurrentScope::Engine.routes.draw do
   end
   resources :subjects, only: :index
   resources :events, only: :index
-  resource :role_assignment, only: :create
-  # Remove one org-wide assignment by id (members page: clean up an orphan whose
-  # subject was deleted, which the subject-keyed clear on create can't target).
-  delete "role_assignments/:id" => "role_assignments#destroy", as: :remove_role_assignment
+  # create is subject-keyed (no id); destroy removes one assignment by id (the
+  # members page's cleanup path for an orphan whose subject was deleted).
+  resources :role_assignments, only: [ :create, :destroy ]
   resources :scoped_role_assignments, only: [ :new, :create, :destroy ]
 end