current_scope 0.2.0

data/app/models/current_scope/event.rb

@@ -0,0 +1,117 @@
+module CurrentScope
+  # Append-only authorization event ledger. Design rules:
+  #
+  #   - Append-only: there is no updated_at; persisted rows are never mutated.
+  #   - Identities and target are stored as GlobalID strings, alongside a
+  #     denormalized `target_label`, so the history outlives the records it
+  #     names (a deleted role still renders in the ledger).
+  #   - `actor` and `subject` are ALWAYS present. subject == actor unless
+  #     impersonating; impersonated rows are exactly the ones where
+  #     subject <> actor.
+  #   - NORMATIVE target mapping: assignment events (org_role.*, scoped_role.*)
+  #     target the GRANTEE (the subject being granted); role.* events target the
+  #     role. Role/resource ride in `details`.
+  #
+  # The AR-level `readonly?` ceiling is honest but NOT total. These BYPASS it:
+  #   update_all / delete_all / update_column(s) / insert_all / raw SQL.
+  # The sandbox reset job (a later unit) is the one sanctioned `delete_all`
+  # caller. DB-level hardening is adapter-honest: REVOKE UPDATE/DELETE covers
+  # PostgreSQL and MySQL hosts; SQLite hosts get file permissions only.
+  # Hash-chain tamper-evidence is deferred.
+  class Event < ApplicationRecord
+    # Once written, a row is immutable — blocks update / save / destroy at the
+    # AR layer. See the class header for the operations that bypass this.
+    def readonly? = persisted?
+
+    class << self
+      # The ONE recording entry point. Reads the ambient actor/subject from
+      # CurrentScope::Current, serializes actor/subject/target as GlobalID
+      # strings, denormalizes a human label for the target, and — when
+      # config.audit is on — appends exactly one row.
+      #
+      #   CurrentScope::Event.record!(event: "role.created", target: role,
+      #                               details: { name: "Owner" })
+      #
+      # Raises ConfigurationError (loud, matching the SoD posture) when there is
+      # no ambient actor. Silent no-op (returns nil) when config.audit is false.
+      def record!(event:, target:, details: nil)
+        return unless CurrentScope.config.audit
+
+        actor = CurrentScope::Current.actor
+        if actor.nil?
+          raise CurrentScope::ConfigurationError,
+                "CurrentScope::Event.record! has no actor — CurrentScope::Current.actor is nil. " \
+                "Set the ambient context (the controller hook, or with_current_user in tests) before recording."
+        end
+
+        # Current.user is the effective subject; fall back to actor so subject
+        # is never nil (it equals actor whenever not impersonating).
+        subject = CurrentScope::Current.user || actor
+
+        create!(
+          event: event.to_s,
+          actor: actor.to_gid.to_s,
+          subject: subject.to_gid.to_s,
+          target: target.to_gid.to_s,
+          target_label: label_for(target),
+          details: details,
+          request_id: CurrentScope::Current.request_id
+        )
+      rescue ActiveRecord::StatementInvalid => e
+        raise unless missing_events_table?(e)
+
+        # :strict — an audit-mandatory host refuses to commit a mutation with no
+        # audit row. Re-raise so the enclosing (mutation-wrapping) transaction
+        # rolls back rather than silently degrading. Checked as `== :strict`, not
+        # `!= true`, so the tri-state can't be flattened by a future refactor.
+        # (Impersonation-boundary events have no DB mutation to roll back, so a
+        # raise there is simply a loud 500 on a mis-migrated host.)
+        raise if CurrentScope.config.audit == :strict
+
+        # true (default) — an existing host that upgrades the gem without running
+        # the new migration must not break on its first mutation. Degrade
+        # gracefully: skip recording and warn once (not on every call), naming
+        # the fix. A host that wants audit runs the migration; one that doesn't
+        # can set config.audit = false to silence it, or :strict to fail loud.
+        warn_missing_events_table_once
+        nil
+      end
+
+      private
+
+      def warn_missing_events_table_once
+        return if @missing_events_table_warned
+
+        @missing_events_table_warned = true
+        Rails.logger&.warn(
+          "[CurrentScope] audit is on but the current_scope_events table is missing — " \
+          "skipping audit recording. Run `rails current_scope:install:migrations` and " \
+          "migrate to enable it, or set `CurrentScope.config.audit = false` to silence this."
+        )
+      end
+
+      # Prefer a record's own view-agnostic label; then the AR default; then
+      # a plain to_s for anything else.
+      def label_for(record)
+        return record.current_scope_label if record.respond_to?(:current_scope_label)
+        return "#{record.model_name.human} ##{record.id}" if record.respond_to?(:model_name)
+
+        record.to_s
+      end
+
+      # Recognizes "table is missing" across adapters and Rails' own schema
+      # reflection: SQLite ("no such table" / "Could not find table"),
+      # PostgreSQL ("relation ... does not exist"), MySQL ("Unknown table" /
+      # "doesn't exist"). The `column` exclusion keeps a missing-COLUMN error
+      # (e.g. "column ... of relation current_scope_events does not exist" after
+      # a partial migration) from being misreported as a missing table, which
+      # would point operators at the wrong fix.
+      def missing_events_table?(error)
+        message = error.message
+        message.include?("current_scope_events") &&
+          !message.match?(/\bcolumn\b/i) &&
+          message.match?(/no such table|could not find table|does(?:n't| not) exist|unknown table|undefined table/i)
+      end
+    end
+  end
+end

data/app/models/current_scope/role.rb

@@ -0,0 +1,55 @@
+module CurrentScope
+  # A named, editable bundle of permissions — a row, not a class. The same
+  # role means the same permission set whether held org-wide or scoped to a
+  # single record; only the reach differs.
+  class Role < ApplicationRecord
+    has_many :role_permissions, dependent: :delete_all
+    has_many :role_assignments, dependent: :destroy
+    has_many :scoped_role_assignments, dependent: :destroy
+
+    validates :name, presence: true, uniqueness: true
+
+    after_save :persist_permission_keys
+
+    # The grid diff computed by the last save: { added: [...], removed: [...] }.
+    # Empty arrays on a no-op save; nil when no grid was staged (a programmatic
+    # save that never set permission_keys). Controllers read this to record the
+    # change — the model itself records nothing (seeds must stay silent).
+    attr_reader :permission_keys_change
+
+    def grants?(permission_key)
+      role_permissions.exists?(permission_key: permission_key)
+    end
+
+    def permission_keys
+      @pending_permission_keys || role_permissions.pluck(:permission_key)
+    end
+
+    # Stages a replacement permission set, dropping keys that aren't in the
+    # catalog (stale keys from removed controllers). Persisted on save, like
+    # any other attribute — never before validations pass.
+    def permission_keys=(keys)
+      @pending_permission_keys = Array(keys).uniq.select { |k| CurrentScope.catalog.include?(k) }
+    end
+
+    def reload(...)
+      @pending_permission_keys = nil
+      super
+    end
+
+    private
+
+    def persist_permission_keys
+      return if @pending_permission_keys.nil?
+
+      # Capture the prior keys BEFORE delete_all so the diff survives the swap.
+      previous = role_permissions.pluck(:permission_key)
+      staged = @pending_permission_keys
+      @permission_keys_change = { added: staged - previous, removed: previous - staged }
+
+      role_permissions.delete_all
+      role_permissions.insert_all(staged.map { |k| { permission_key: k } }) if staged.any?
+      @pending_permission_keys = nil
+    end
+  end
+end

data/app/models/current_scope/role_assignment.rb

@@ -0,0 +1,21 @@
+module CurrentScope
+  # A subject's single org-wide role. One per subject by design — the "which
+  # role granted this?" ambiguity of multi-role systems is deliberately
+  # avoided; per-record needs are covered by scoped roles instead.
+  class RoleAssignment < ApplicationRecord
+    belongs_to :role
+    belongs_to :subject, polymorphic: true
+
+    validates :subject_id, uniqueness: { scope: :subject_type }
+
+    # Bust the per-request org-role memo (CurrentScope::Current) whenever an
+    # assignment changes, so a grant/clear and a later gate check in the SAME
+    # request never disagree. after_save/after_destroy fire inside the
+    # transaction, so this is correct under transactional tests too. The role's
+    # own permission edits don't route through here, but they can't change which
+    # role a subject holds — only the role_permissions, which the memo doesn't
+    # cache (org_role caches the role object, whose grants? reads live).
+    after_save    { CurrentScope::Current.reset_org_role_cache }
+    after_destroy { CurrentScope::Current.reset_org_role_cache }
+  end
+end

data/app/models/current_scope/role_permission.rb

@@ -0,0 +1,9 @@
+module CurrentScope
+  # One granted controller#action for a role. The key mirrors a permission
+  # auto-derived from the host's routes — there is no permissions table.
+  class RolePermission < ApplicationRecord
+    belongs_to :role
+
+    validates :permission_key, presence: true, uniqueness: { scope: :role_id }
+  end
+end

data/app/models/current_scope/scoped_role_assignment.rb

@@ -0,0 +1,14 @@
+module CurrentScope
+  # A role held on ONE specific record: "Editor of Project #7" grants nothing
+  # on Project #8. Never touches the subject's org-wide role — the two are
+  # independent axes.
+  class ScopedRoleAssignment < ApplicationRecord
+    belongs_to :role
+    belongs_to :subject, polymorphic: true
+    belongs_to :resource, polymorphic: true
+
+    validates :role_id, uniqueness: {
+      scope: [ :subject_type, :subject_id, :resource_type, :resource_id ]
+    }
+  end
+end

data/app/views/current_scope/events/index.html.erb

@@ -0,0 +1,41 @@
+<h1>Events</h1>
+<p class="cs-lede">
+  The append-only authorization ledger, newest first. Every string here is
+  host- or visitor-controlled, so it renders escaped.
+</p>
+
+<div class="cs-card cs-card--flush">
+<table class="cs-table">
+  <thead>
+    <tr>
+      <th>When</th><th>Event</th><th>Actor</th><th>Target</th><th>Details</th>
+    </tr>
+  </thead>
+  <tbody>
+    <% @events.each do |event| %>
+      <tr>
+        <td><%= event.created_at.strftime("%Y-%m-%d %H:%M:%S") %></td>
+        <td><%= event.event %></td>
+        <td>
+          <%= current_scope_gid_label(event.actor) %>
+          <% if event.subject != event.actor %>
+            <span class="cs-chip">as <%= current_scope_gid_label(event.subject) %></span>
+          <% end %>
+        </td>
+        <td><%= event.target_label %></td>
+        <td>
+          <% (event.details || {}).each do |key, value| %>
+            <span class="cs-chip"><%= key %>: <%= Array(value).join(", ") %></span>
+          <% end %>
+        </td>
+      </tr>
+    <% end %>
+  </tbody>
+</table>
+</div>
+
+<nav class="cs-pagination" aria-label="Events pagination">
+  <% if @page > 1 %><%= link_to "← Previous", events_path(page: @page - 1) %><% end %>
+  <span>Page <%= @page %></span>
+  <% if @has_next_page %><%= link_to "Next →", events_path(page: @page + 1) %><% end %>
+</nav>

data/app/views/current_scope/roles/edit.html.erb

@@ -0,0 +1,86 @@
+<h1>Edit role: <%= @role.name %></h1>
+
+<p><%= link_to "See who holds this role →", members_role_path(@role) %></p>
+
+<%= form_with model: @role do |f| %>
+  <% if @role.errors.any? %>
+    <p class="cs-alert"><%= @role.errors.full_messages.to_sentence %></p>
+  <% end %>
+
+  <p><%= f.label :name %> <%= f.text_field :name %></p>
+  <p>
+    <%= f.label :description %>
+    <%= f.text_area :description, rows: 2, placeholder: "What is this role for? (optional)" %>
+  </p>
+  <p>
+    <%= f.label :full_access do %>
+      <%= f.check_box :full_access %> Full access — every permission, present and future
+      (the grid below is ignored while this is on)
+    <% end %>
+  </p>
+
+  <h2>Permission grid</h2>
+  <p class="cs-hint">
+    One row per controller, one checkbox per action group — derived from the
+    app's routes, so new controllers appear here automatically. Columns are
+    fixed: a blank cell means the controller doesn't route that action.
+  </p>
+
+  <% grid = CurrentScope::PermissionGrid.new %>
+  <% granted = @role.permission_keys.to_set %>
+  <%= hidden_field_tag "role[permission_keys][]", "" %>
+  <%= hidden_field_tag "role[permission_groups][]", "" %>
+  <div class="cs-grid-wrap">
+    <table class="cs-grid">
+      <thead>
+        <tr>
+          <th scope="col" class="cs-grid-corner">Controller</th>
+          <% grid.columns.each do |column| %>
+            <th scope="col"><%= column.label %></th>
+          <% end %>
+        </tr>
+      </thead>
+      <tbody>
+        <% grid.controllers.each do |controller| %>
+          <tr>
+            <th scope="row">
+              <%# Per-row master: enable/disable every action in this controller at once.
+                  Progressive enhancement — with JS off, each cell checkbox still works. %>
+              <label class="cs-row-all" title="Enable all <%= controller %> permissions">
+                <input type="checkbox" data-cs-row-all
+                       aria-label="Enable all <%= controller %> permissions">
+                <span><%= controller %></span>
+              </label>
+            </th>
+            <% grid.columns.each do |column| %>
+              <% cell = grid.cell(controller, column, granted) %>
+              <% if cell.blank %>
+                <%# Not routed here — an empty cell. Kept in the a11y tree (no
+                    aria-hidden) so column/row alignment stays intact for screen
+                    readers; the "·" marker is decorative CSS. %>
+                <td class="cs-cell-blank"></td>
+              <% else %>
+                <td>
+                  <label>
+                    <%= check_box_tag cell.name, cell.value, cell.checked,
+                          id: "perm_#{cell.value.parameterize(separator: '_')}",
+                          data: { cs_partial: cell.partial },
+                          "aria-label": "#{controller} #{column.label}" %>
+                  </label>
+                  <%# Partial group: preserve the exact granted actions so a no-op
+                      save can't promote the group to a full grant. Interacting with
+                      the checkbox disables these (JS) so the group control takes over. %>
+                  <% cell.granted_keys.each do |key| %>
+                    <%= hidden_field_tag "role[permission_keys][]", key, id: nil, data: { cs_preserve: true } %>
+                  <% end %>
+                </td>
+              <% end %>
+            <% end %>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  </div>
+
+  <p><%= f.submit "Save role" %></p>
+<% end %>

data/app/views/current_scope/roles/index.html.erb

@@ -0,0 +1,41 @@
+<h1>Roles</h1>
+<p class="cs-lede">A role is an editable bundle of permissions. Edit one to tick
+  its controller&times;action grid; grants take effect on the subject's next request.</p>
+
+<div class="cs-toolbar">
+  <span class="cs-spacer"></span>
+  <%= link_to "New role", new_role_path, class: "cs-btn cs-btn-primary" %>
+</div>
+
+<div class="cs-card cs-card--flush">
+<table class="cs-table">
+  <thead>
+    <tr><th>Name</th><th>Access</th><th></th></tr>
+  </thead>
+  <tbody>
+    <% @roles.each do |role| %>
+      <tr>
+        <td>
+          <%= link_to role.name, edit_role_path(role) %>
+          <% if role.description.present? %>
+            <div class="cs-subtle"><%= role.description %></div>
+          <% end %>
+        </td>
+        <td>
+          <% if role.full_access? %>
+            full access (all current and future permissions)
+          <% else %>
+            <%= pluralize(role.role_permissions.size, "permission") %>
+          <% end %>
+        </td>
+        <td>
+          <%= link_to "Members", members_role_path(role), class: "cs-btn" %>
+          <%= button_to "Delete", role_path(role), method: :delete,
+                form: { data: { cs_confirm: "Delete role #{role.name}?" } },
+                data: { turbo_confirm: "Delete role #{role.name}?" } %>
+        </td>
+      </tr>
+    <% end %>
+  </tbody>
+</table>
+</div>

data/app/views/current_scope/roles/members.html.erb

@@ -0,0 +1,96 @@
+<h1>Members: <%= @role.name %></h1>
+<p class="cs-lede">Who holds <strong><%= @role.name %></strong> — as their one org-wide
+  role, or on a specific record. Assigning the org-wide role here replaces a
+  subject's current one (each subject has exactly one org-wide role).</p>
+
+<div class="cs-toolbar">
+  <%= link_to "← All roles", roles_path %>
+  <span class="cs-spacer"></span>
+  <%= link_to "Edit permissions", edit_role_path(@role), class: "cs-btn" %>
+</div>
+
+<h2>Add org-wide members</h2>
+<% if @candidates.any? %>
+  <%= form_with url: role_assignment_path, method: :post do %>
+    <%= hidden_field_tag :role_id, @role.id %>
+    <p>
+      <%= label_tag "subject_gids", "Subjects" %>
+      <select name="subject_gids[]" id="subject_gids" multiple size="8"
+              aria-label="Subjects to grant this role org-wide">
+        <% @candidates.each do |subject| %>
+          <option value="<%= subject.to_gid %>"><%= current_scope_subject_label(subject) %></option>
+        <% end %>
+      </select>
+    </p>
+    <% if @more_candidates %>
+      <p class="cs-hint">Showing the first <%= @candidates.size %> subjects who don't
+        already hold this role. Use the Subjects page to reach the rest.</p>
+    <% end %>
+    <p><%= submit_tag "Add selected as org-wide members" %></p>
+  <% end %>
+<% else %>
+  <p class="cs-subtle">Every subject already holds this role org-wide.</p>
+<% end %>
+
+<h2>Org-wide holders <span class="cs-subtle">(<%= @org_holders.size %>)</span></h2>
+<% if @org_holders.any? %>
+  <div class="cs-card cs-card--flush">
+    <table class="cs-table">
+      <thead><tr><th>Subject</th><th></th></tr></thead>
+      <tbody>
+        <% @org_holders.each do |assignment| %>
+          <% who = current_scope_holder_subject_label(assignment) %>
+          <% subject_gid = (assignment.subject&.to_gid rescue nil) %>
+          <tr>
+            <td><%= who %></td>
+            <td>
+              <% if subject_gid %>
+                <%# Removing = clearing this subject's org-wide role (blank role_id). %>
+                <%= form_with url: role_assignment_path, method: :post,
+                      data: { cs_confirm: "Remove #{who} from #{@role.name}?" } do %>
+                  <%= hidden_field_tag :subject_gid, subject_gid %>
+                  <%= hidden_field_tag :role_id, "" %>
+                  <%= submit_tag "Remove", name: nil, class: "cs-btn" %>
+                <% end %>
+              <% else %>
+                <%# Orphaned assignment (subject deleted): remove it by id. %>
+                <%= button_to "Remove", remove_role_assignment_path(assignment), method: :delete,
+                      class: "cs-btn", form: { data: { cs_confirm: "Remove this orphaned org-wide assignment?" } } %>
+                <span class="cs-subtle">subject unavailable</span>
+              <% end %>
+            </td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  </div>
+<% else %>
+  <p class="cs-subtle">No subject holds this as their org-wide role yet.</p>
+<% end %>
+
+<h2>Scoped holders <span class="cs-subtle">(<%= @scoped_holders.size %>)</span></h2>
+<% if @scoped_holders.any? %>
+  <div class="cs-card cs-card--flush">
+    <table class="cs-table">
+      <thead><tr><th>Subject</th><th>Record</th><th></th></tr></thead>
+      <tbody>
+        <% @scoped_holders.each do |sra| %>
+          <% who = current_scope_holder_subject_label(sra) %>
+          <% what = current_scope_holder_resource_label(sra) %>
+          <tr>
+            <td><%= who %></td>
+            <td><%= what %></td>
+            <td>
+              <% revoke_prompt = "Revoke #{@role.name} on #{what} from #{who}?" %>
+              <%= button_to "Revoke", scoped_role_assignment_path(sra), method: :delete,
+                    class: "cs-btn", form: { data: { cs_confirm: revoke_prompt } },
+                    data: { turbo_confirm: revoke_prompt } %>
+            </td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  </div>
+<% else %>
+  <p class="cs-subtle">No one holds this role on a specific record.</p>
+<% end %>

data/app/views/current_scope/roles/new.html.erb

@@ -0,0 +1,19 @@
+<h1>New role</h1>
+
+<%= form_with model: @role do |f| %>
+  <% if @role.errors.any? %>
+    <p class="cs-alert"><%= @role.errors.full_messages.to_sentence %></p>
+  <% end %>
+
+  <p><%= f.label :name %> <%= f.text_field :name %></p>
+  <p>
+    <%= f.label :description %>
+    <%= f.text_area :description, rows: 2, placeholder: "What is this role for? (optional)" %>
+  </p>
+  <p>
+    <%= f.label :full_access do %>
+      <%= f.check_box :full_access %> Full access — every permission, present and future
+    <% end %>
+  </p>
+  <p><%= f.submit "Create role" %></p>
+<% end %>

data/app/views/current_scope/scoped_role_assignments/new.html.erb

@@ -0,0 +1,135 @@
+<h1><%= @bulk_subjects.any? ? "Grant a scoped role to #{@bulk_subjects.size} #{'subject'.pluralize(@bulk_subjects.size)}" : "Grant a scoped role" %></h1>
+
+<p class="cs-hint">
+  A scoped role applies only when acting on the chosen record — it never
+  changes the subject's org-wide role.
+</p>
+
+<%#
+  Two forms, on purpose:
+
+  * The cascade is a GET form (id "cs-cascade"). Each control re-renders the
+    downstream steps: with Turbo it swaps just the #cascade frame; without JS
+    or Turbo the "Show records" submit does a full-page GET (every selection is
+    preserved from params). A GET form carries NO CSRF token — a token in a GET
+    would leak into the URL (server logs, history, Referer).
+
+  * The grant is a state change, so it is a SEPARATE POST form (button_to)
+    rendered inside the frame once the selection is complete. button_to puts
+    the CSRF token in the request body, never a URL. It lives OUTSIDE the GET
+    form (nesting <form>s is invalid) and reaches the cascade's inputs via the
+    HTML `form:` attribute, which also lets the GET stay idempotent so the
+    picker still works while impersonating (read-only), where a POST would 403.
+%>
+<%= form_with url: new_scoped_role_assignment_path, method: :get, id: "cs-cascade",
+      data: { turbo_frame: "cascade" }, class: "cs-picker" do %>
+  <p>
+    <label>Role</label>
+    <%= select_tag :role_id,
+          options_from_collection_for_select(@roles, :id, :name, params[:role_id]),
+          data: { current_scope_autosubmit: true } %>
+  </p>
+  <% if @bulk_subjects.any? %>
+    <p>
+      <label>Subjects</label>
+      <span class="cs-hint">
+        Granting to <strong><%= @bulk_subjects.size %></strong>:
+        <%= @bulk_subjects.map { |s| current_scope_subject_label(s) }.to_sentence %>
+      </span>
+      <% @bulk_subjects.each do |s| %>
+        <%= hidden_field_tag "subject_gids[]", s.to_gid.to_s %>
+      <% end %>
+    </p>
+  <% else %>
+    <p>
+      <label>Subject</label>
+      <%= select_tag :subject_gid,
+            options_for_select(@subjects.map { |s| [ current_scope_subject_label(s), s.to_gid.to_s ] },
+                               params[:subject_gid]),
+            data: { current_scope_autosubmit: true } %>
+    </p>
+  <% end %>
+<% end %>
+
+<turbo-frame id="cascade">
+  <% if @scopeable.empty? %>
+    <p class="cs-alert cs-picker-empty">
+      No pickable resource types yet. Add
+      <code>include CurrentScope::Scopeable</code> to a host model to make its
+      records selectable here.
+    </p>
+  <% else %>
+    <%
+      type_options = @scopeable.map { |model| [ model.model_name.human, model.name ] }
+      # A deep-linked type may not itself be Scopeable — keep it selectable.
+      if @resource_type && type_options.none? { |(_, name)| name == @resource_type.name }
+        type_options.unshift([ @resource_type.model_name.human, @resource_type.name ])
+      end
+    %>
+    <p>
+      <label>Resource type</label>
+      <%= select_tag :resource_type,
+            options_for_select(type_options, @resource_type&.name),
+            include_blank: "— choose a type —", form: "cs-cascade",
+            data: { current_scope_autosubmit: true } %>
+    </p>
+
+    <% if @resource_type %>
+      <% if @records.blank? && params[:q].blank? %>
+        <p class="cs-hint cs-picker-empty">
+          No <%= @resource_type.model_name.human.pluralize.downcase %> to pick from yet.
+        </p>
+      <% else %>
+        <% if @searchable %>
+          <p>
+            <label>Search records</label>
+            <%= search_field_tag :q, params[:q], placeholder: "Filter by label",
+                  form: "cs-cascade", data: { current_scope_autosubmit: true } %>
+          </p>
+        <% end %>
+        <p>
+          <label>Record</label>
+          <%
+            record_options = (@records || []).map { |record| [ current_scope_label(record), record.to_gid.to_s ] }
+            # Keep a deep-linked record selectable even if it fell outside the
+            # scanned window.
+            if @resource && record_options.none? { |(_, gid)| gid == @resource.to_gid.to_s }
+              record_options.unshift([ current_scope_label(@resource), @resource.to_gid.to_s ])
+            end
+          %>
+          <%= select_tag :resource_gid,
+                options_for_select(record_options, params[:resource_gid] || @resource&.to_gid&.to_s),
+                include_blank: "— choose a record —", form: "cs-cascade",
+                data: { current_scope_autosubmit: true } %>
+          <% if @searchable && params[:q].present? %>
+            <span class="cs-hint">
+              Showing up to <%= CurrentScope::ScopedRoleAssignmentsController::DISPLAY_LIMIT %> matches — refine the search to narrow.
+            </span>
+          <% end %>
+        </p>
+      <% end %>
+    <% end %>
+
+    <p class="cs-picker-actions">
+      <%# No-JS / no-Turbo fallback: reload the cascade with the current picks. %>
+      <%= submit_tag "Show records", name: nil, form: "cs-cascade", class: "cs-picker-refresh" %>
+      <%# Grant only a complete selection. Every cascade control autosubmits, so
+          params mirror the live picks — the button never posts a stale value. %>
+      <% ready = params[:role_id].present? && params[:resource_gid].present? %>
+      <% if @bulk_subjects.any? %>
+        <% if ready %>
+          <%= button_to "Grant to #{@bulk_subjects.size} #{'subject'.pluralize(@bulk_subjects.size)}",
+                scoped_role_assignments_path, method: :post,
+                params: { role_id: params[:role_id], resource_gid: params[:resource_gid],
+                          subject_gids: @bulk_subjects.map { |s| s.to_gid.to_s } },
+                data: { turbo_frame: "_top" }, class: "cs-btn-primary" %>
+        <% end %>
+      <% elsif ready && params[:subject_gid].present? %>
+        <%= button_to "Grant scoped role", scoped_role_assignments_path, method: :post,
+              params: { role_id: params[:role_id], subject_gid: params[:subject_gid],
+                        resource_gid: params[:resource_gid] },
+              data: { turbo_frame: "_top" }, class: "cs-btn-primary" %>
+      <% end %>
+    </p>
+  <% end %>
+</turbo-frame>