current_scope 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb3cfaf17408e822d2ce269223bed45714e97dad48d68ad68826cb398c39434f
-  data.tar.gz: 20729feebd795748b0898e62d4934b1ca3ed490ee585fcf911ad37d5d500e2a5
+  metadata.gz: b43df7725417ffd6088533edb72032fd26a4bad9e8eefb6a56fa52d9a63a29e3
+  data.tar.gz: b77bb0cdb38b19efd19ac754666d23abe14220ae3a0b70566f217eda26b016cf
 SHA512:
-  metadata.gz: 7b6ede764a4924731f2a92c118dd0a2c018de8a808ddbd8d9010eacd862e0e57e972dcf3fe56a4337b239e052039dc0e022a1ef0bd7113c1fa1835e5d4c55f7a
-  data.tar.gz: 9b8823b93863c93d01eecb46a2773ad7fa3dd7fe0b9908f9a5f50137492ffb7ad4a10cbddc8207aaab0f4ed4ba27f572d5624b8687da6069878abff6465838e3
+  metadata.gz: dedf447ca858342304bbd1dddeff2187291bd78780271f01328e9d328b090081f3c1bc293639dc4e2855b719ba9a61f4d49befac17673cb7f44dca10d2405037
+  data.tar.gz: 56cd899f391607a79bf550fb416f961911b9c192e6a430bceedc3a92fabcab251bb0cad7aeabce20f4b10c9463939f0bd6afa6e55d7b535d6fbd047ea9fc426d

data/app/assets/stylesheets/current_scope/application.css

@@ -659,6 +659,8 @@ input[type="checkbox"], input[type="radio"] {
    host might place in the sidebar or topbar. */
 .cs-main form p { margin: 0 0 1rem; max-width: 30rem; }
 
+/* Non-control captions (bulk subjects line) share form-label type. */
+.cs-main form p > .cs-label,
 .cs-main form p > label {
   display: block;
   font-size: 0.7rem;

data/app/controllers/current_scope/role_assignments_controller.rb

@@ -16,16 +16,35 @@ module CurrentScope
       # only the subjects that ACTUALLY changed so the notice can't over-report
       # (a re-set to the same role, or a clear on a subject with no role, is a
       # no-op and shouldn't be counted).
+      #
+      # Lock full-access holders inside the same transaction as the writes so
+      # concurrent clears cannot both observe "another holder remains" and then
+      # both proceed to zero holders.
       changed = 0
+      refused = false
       RoleAssignment.transaction do
-        subjects.each do |subject|
-          assignment = RoleAssignment.find_or_initialize_by(subject: subject)
-          prior_role = assignment.role # nil for a brand-new assignment
-          did = clearing ? clear_org_role(subject, assignment, prior_role) : set_org_role(subject, assignment, prior_role)
-          changed += 1 if did
+        lock_full_access_org_holders!
+
+        if would_remove_last_full_access_holders?(subjects, clearing: clearing)
+          refused = true
+        else
+          subjects.each do |subject|
+            assignment = RoleAssignment.find_or_initialize_by(subject: subject)
+            prior_role = assignment.role # nil for a brand-new assignment
+            did = clearing ? clear_org_role(subject, assignment, prior_role) : set_org_role(subject, assignment, prior_role)
+            changed += 1 if did
+          end
         end
       end
 
+      if refused
+        redirect_back_or_to subjects_path,
+                            alert: "Refusing to remove the last full-access org-wide assignment — " \
+                                   "it would lock everyone out of this UI. Grant full access to " \
+                                   "another subject first, then retry."
+        return
+      end
+
       # Return to wherever the action was invoked (the subjects page or a role's
       # members page); falls back to subjects when there's no referrer.
       redirect_back_or_to subjects_path, notice: org_notice(clearing, changed)
@@ -37,14 +56,32 @@ module CurrentScope
     # clean up an orphaned assignment whose subject was deleted (the subject-keyed
     # clear on `create` can't target a subject that no longer resolves).
     def destroy
-      assignment = RoleAssignment.find(params[:id])
-      subject = resolve_subject(assignment)
-      role_name = assignment.role.name
-
+      refused = false
       RoleAssignment.transaction do
-        assignment.destroy!
-        Event.record!(event: "org_role.removed", target: subject || assignment, details: { role: role_name })
+        # Lock FA state BEFORE the target assignment so order matches create/
+        # role demote/delete (FA roles → FA holders → target row). Locking the
+        # assignment first inverted that order and could deadlock.
+        lock_full_access_org_holders!
+        assignment = RoleAssignment.lock.find(params[:id])
+        subject = resolve_subject(assignment)
+        role_name = assignment.role.name
+
+        if last_full_access_org_assignment?(assignment)
+          refused = true
+        else
+          assignment.destroy!
+          Event.record!(event: "org_role.removed", target: subject || assignment, details: { role: role_name })
+        end
       end
+
+      if refused
+        redirect_back_or_to subjects_path,
+                            alert: "Refusing to remove the last full-access org-wide assignment — " \
+                                   "it would lock everyone out of this UI. Grant full access to " \
+                                   "another subject first, then retry."
+        return
+      end
+
       redirect_back_or_to subjects_path, notice: "Org-wide role removed."
     rescue ActiveRecord::RecordNotFound
       redirect_back_or_to subjects_path, notice: "That org-wide role was already removed."
@@ -68,6 +105,54 @@ module CurrentScope
       count == 1 ? "Org-wide role #{verb}." : "Org-wide role #{verb} for #{count} subjects."
     end
 
+    # True when this assignment is a live full_access org holder and no other
+    # full_access org assignment exists. Orphan rows (deleted subject → nil)
+    # must not permanently block cleanup of the last FA assignment.
+    def last_full_access_org_assignment?(assignment)
+      return false unless assignment.role&.full_access?
+      return false if resolve_subject(assignment).nil?
+
+      !full_access_org_assignments.where.not(id: assignment.id).exists?
+    end
+
+    # True when applying clear (or reassign to a non-full_access role) to these
+    # subjects would leave zero full_access org holders.
+    def would_remove_last_full_access_holders?(subjects, clearing:)
+      holders = full_access_org_assignments.to_a
+      return false if holders.empty?
+
+      affected_ids = holders.select { |a| subjects.any? { |s| same_subject?(a, s) } }.map(&:id)
+      return false if affected_ids.empty?
+
+      unless clearing
+        new_role = Role.find_by(id: params[:role_id])
+        return false if new_role&.full_access?
+      end
+
+      remaining = holders.reject { |a| affected_ids.include?(a.id) }
+      remaining.empty?
+    end
+
+    def full_access_org_assignments
+      RoleAssignment.joins(:role).where(current_scope_roles: { full_access: true })
+    end
+
+    # Lock full-access holder rows (and their roles) so concurrent remove/demote
+    # paths serialize on the same set the precheck reads. Call only inside a
+    # transaction. Prefer locking by id after a join pluck — FOR UPDATE with
+    # joins is adapter-fragile.
+    def lock_full_access_org_holders!
+      Role.where(full_access: true).lock.load
+      ids = full_access_org_assignments.pluck(:id)
+      RoleAssignment.where(id: ids).lock.load if ids.any?
+    end
+
+    def same_subject?(assignment, subject)
+      # Match the polymorphic storage name the subjects page uses (not only
+      # base_class.name — hosts can customize polymorphic_name).
+      assignment.subject_type == subject.class.polymorphic_name && assignment.subject_id == subject.id
+    end
+
     # Returns true when a role was actually cleared, false when there was nothing
     # to clear (so the caller's count stays accurate). Atomicity comes from
     # create's outer bulk transaction — only called from inside it. (No inner

data/app/controllers/current_scope/roles_controller.rb

@@ -1,7 +1,8 @@
 module CurrentScope
   class RolesController < ApplicationController
     def index
-      @roles = Role.order(:name)
+      # Includes for delete-confirm holder counts (cascade warning).
+      @roles = Role.order(:name).includes(:role_assignments, :scoped_role_assignments)
     end
 
     def new
@@ -55,12 +56,36 @@ module CurrentScope
     end
 
     def update
-      @role = Role.find(params[:id])
-      previous_name = @role.name
+      permitted = role_params
+      previous_name = nil
       saved = false
+      refused = false
+
+      # Lock full-access roles + holders inside the write transaction so two
+      # concurrent demotions of the last held full-access roles cannot both pass
+      # a pre-transaction check and then both commit.
       Role.transaction do
-        saved = @role.update(role_params)
-        record_role_update(@role, previous_name) if saved
+        # Lock FA console state before the target role so concurrent demote/delete
+        # of two FA roles cannot invert lock order (roles first, then assignments).
+        lock_full_access_console_state!
+        @role = Role.lock.find(params[:id])
+
+        if demoting_would_lock_console?(@role, permitted)
+          refused = true
+        else
+          previous_name = @role.name
+          previous_full_access = @role.full_access?
+          saved = @role.update(permitted)
+          record_role_update(@role, previous_name, previous_full_access) if saved
+        end
+      end
+
+      if refused
+        redirect_to edit_role_path(@role),
+                    alert: "Refusing to remove full access — this is the last full-access role " \
+                           "any subject holds and would lock everyone out of this UI. Grant " \
+                           "full access to another subject first, then retry."
+        return
       end
 
       if saved
@@ -71,44 +96,81 @@ module CurrentScope
     end
 
     def destroy
-      role = Role.find(params[:id])
+      refused = false
+
+      Role.transaction do
+        lock_full_access_console_state!
+        role = Role.lock.find(params[:id])
+
+        if would_lock_console_by_removing_role?(role)
+          refused = true
+        else
+          # Snapshot WITHOUT polymorphic includes — includes(:subject)/:resource
+          # can raise NameError for stale types at preload (members page avoids
+          # this for the same reason). Resolve each row inside the helpers.
+          org_removed = role.role_assignments.to_a
+          scoped_revoked = role.scoped_role_assignments.to_a
+
+          role.destroy!
+          Event.record!(event: "role.deleted", target: role, details: { name: role.name })
+          org_removed.each do |a|
+            Event.record!(event: "org_role.removed", target: cascade_subject(a), details: { role: role.name })
+          end
+          scoped_revoked.each do |a|
+            Event.record!(event: "scoped_role.revoked", target: cascade_subject(a),
+                          details: { role: role.name, resource: cascade_resource_label(a) })
+          end
+        end
+      end
 
-      if last_full_access?(role)
+      if refused
         redirect_to roles_path,
-                    alert: "Refusing to delete the last full-access role — it would lock everyone out of this UI."
+                    alert: "Refusing to delete this full-access role — it is the last one held by any " \
+                           "subject and would lock everyone out of this UI. Grant full access to " \
+                           "another subject first, then retry."
         return
       end
 
-      # Snapshot the cascade BEFORE destroy! — dependent: :destroy takes the
-      # assignments with the role, so they can't be read afterwards.
-      org_removed = role.role_assignments.includes(:subject).to_a
-      scoped_revoked = role.scoped_role_assignments.includes(:subject, :resource).to_a
-
-      Role.transaction do
-        role.destroy!
-        Event.record!(event: "role.deleted", target: role, details: { name: role.name })
-        org_removed.each do |a|
-          Event.record!(event: "org_role.removed", target: a.subject, details: { role: role.name })
-        end
-        scoped_revoked.each do |a|
-          Event.record!(event: "scoped_role.revoked", target: a.subject,
-                        details: { role: role.name, resource: helpers.current_scope_label(a.resource) })
-        end
-      end
       redirect_to roles_path, notice: "Role deleted."
     end
 
     private
 
+    # Polymorphic subject/resource may be deleted or unresolvable — never 500
+    # the cascade audit. Deleted records return nil without raising (especially
+    # after includes preload), so use || assignment, not rescue-only.
+    def cascade_subject(assignment)
+      assignment.subject || assignment
+    rescue ActiveRecord::RecordNotFound, NameError
+      assignment
+    end
+
+    def cascade_resource_label(assignment)
+      resource = begin
+        assignment.resource
+      rescue ActiveRecord::RecordNotFound, NameError
+        nil
+      end
+      return "#{assignment.resource_type}##{assignment.resource_id}" if resource.nil?
+
+      helpers.current_scope_label(resource)
+    rescue StandardError
+      "#{assignment.resource_type}##{assignment.resource_id}"
+    end
+
     # One event per save: role.renamed when the name changed (carries old/new
-    # name AND the grid diff), else role.updated for a pure grid change. Emits
-    # nothing when neither the name nor the grid moved.
-    def record_role_update(role, previous_name)
+    # name AND the grid/full_access diff), else role.updated. Emits nothing on
+    # a pure no-op (same name, same grid, same full_access).
+    def record_role_update(role, previous_name, previous_full_access)
       diff = role.permission_keys_change || { added: [], removed: [], rejected: [] }
       renamed = previous_name != role.name
-      return unless renamed || diff[:added].any? || diff[:removed].any?
+      full_access_changed = previous_full_access != role.full_access?
+      return unless renamed || full_access_changed || diff[:added].any? || diff[:removed].any?
 
       details = { added: diff[:added], removed: diff[:removed] }
+      if full_access_changed
+        details.merge!(full_access_from: previous_full_access, full_access_to: role.full_access?)
+      end
       event = "role.updated"
       if renamed
         event = "role.renamed"
@@ -117,8 +179,40 @@ module CurrentScope
       Event.record!(event: event, target: role, details: details)
     end
 
-    def last_full_access?(role)
-      role.full_access? && !Role.where(full_access: true).where.not(id: role.id).exists?
+    # True when removing/demoting this full_access role would leave zero
+    # full_access org holders. An unassigned full_access role is always safe
+    # to delete/demote (cubic). An empty spare full_access role must NOT
+    # authorize demoting the held Owner (CE) — check holders, not role rows.
+    def would_lock_console_by_removing_role?(role)
+      return false unless role.full_access?
+      return false unless RoleAssignment.where(role: role).exists?
+
+      !RoleAssignment.joins(:role)
+        .where(current_scope_roles: { full_access: true })
+        .where.not(role_id: role.id)
+        .exists?
+    end
+
+    # True when the update would turn off full_access and lock the console.
+    # Only treats an EXPLICIT full_access=false as demotion — a missing key
+    # would not change the column and must not false-positive refuse.
+    def demoting_would_lock_console?(role, permitted)
+      return false unless role.full_access?
+      return false unless permitted.key?(:full_access)
+      return false if ActiveModel::Type::Boolean.new.cast(permitted[:full_access])
+
+      would_lock_console_by_removing_role?(role)
+    end
+
+    # Serialize demote/delete against concurrent last-holder removal. Lock FA
+    # role rows and their org-wide holder assignments (by id — FOR UPDATE + join
+    # is adapter-fragile). Call only inside a transaction.
+    def lock_full_access_console_state!
+      Role.where(full_access: true).lock.load
+      ids = RoleAssignment.joins(:role)
+        .where(current_scope_roles: { full_access: true })
+        .pluck(:id)
+      RoleAssignment.where(id: ids).lock.load if ids.any?
     end
 
     def role_params

data/app/views/current_scope/roles/index.html.erb

@@ -30,9 +30,23 @@
         </td>
         <td>
           <%= link_to "Members", members_role_path(role), class: "cs-btn" %>
+          <%
+            org_n = role.role_assignments.size
+            scoped_n = role.scoped_role_assignments.size
+            parts = []
+            parts << "#{org_n} org-wide #{"holder".pluralize(org_n)}" if org_n.positive?
+            parts << "#{scoped_n} scoped #{"holder".pluralize(scoped_n)}" if scoped_n.positive?
+            delete_prompt = if parts.empty?
+              "Delete role #{role.name}?"
+            else
+              "Delete role #{role.name}? This also removes it from #{parts.to_sentence}."
+            end
+          %>
           <%= button_to "Delete", role_path(role), method: :delete,
-                form: { data: { cs_confirm: "Delete role #{role.name}?" } },
-                data: { turbo_confirm: "Delete role #{role.name}?" } %>
+                class: "cs-btn cs-btn-danger",
+                form: { data: { cs_confirm: delete_prompt } },
+                aria: { label: "Delete role #{role.name}" },
+                data: { turbo_confirm: delete_prompt } %>
         </td>
       </tr>
     <% end %>

data/app/views/current_scope/scoped_role_assignments/new.html.erb

@@ -24,15 +24,15 @@
 <%= form_with url: new_scoped_role_assignment_path, method: :get, id: "cs-cascade",
       data: { turbo_frame: "cascade" }, class: "cs-picker" do %>
   <p>
-    <label>Role</label>
+    <%= label_tag :role_id, "Role" %>
     <%= select_tag :role_id,
           options_from_collection_for_select(@roles, :id, :name, params[:role_id]),
           data: { current_scope_autosubmit: true } %>
   </p>
   <% if @bulk_subjects.any? %>
     <p>
-      <label>Subjects</label>
-      <span class="cs-hint">
+      <span class="cs-label" id="cs_bulk_subjects_label">Subjects</span>
+      <span class="cs-hint" aria-labelledby="cs_bulk_subjects_label">
         Granting to <strong><%= @bulk_subjects.size %></strong>:
         <%= @bulk_subjects.map { |s| current_scope_subject_label(s) }.to_sentence %>
       </span>
@@ -42,7 +42,7 @@
     </p>
   <% else %>
     <p>
-      <label>Subject</label>
+      <%= label_tag :subject_gid, "Subject" %>
       <%= select_tag :subject_gid,
             options_for_select(@subjects.map { |s| [ current_scope_subject_label(s), s.to_gid.to_s ] },
                                params[:subject_gid]),
@@ -67,7 +67,7 @@
       end
     %>
     <p>
-      <label>Resource type</label>
+      <%= label_tag :resource_type, "Resource type" %>
       <%= select_tag :resource_type,
             options_for_select(type_options, @resource_type&.name),
             include_blank: "— choose a type —", form: "cs-cascade",
@@ -82,13 +82,13 @@
       <% else %>
         <% if @searchable %>
           <p>
-            <label>Search records</label>
+            <%= label_tag :q, "Search records" %>
             <%= search_field_tag :q, params[:q], placeholder: "Filter by label",
                   form: "cs-cascade", data: { current_scope_autosubmit: true } %>
           </p>
         <% end %>
         <p>
-          <label>Record</label>
+          <%= label_tag :resource_gid, "Record" %>
           <%
             record_options = (@records || []).map { |record| [ current_scope_label(record), record.to_gid.to_s ] }
             # Keep a deep-linked record selectable even if it fell outside the

data/app/views/current_scope/subjects/index.html.erb

@@ -77,8 +77,10 @@
             <%= hidden_field_tag :subject_gid, subject.to_gid %>
             <%= select_tag :role_id,
                   options_from_collection_for_select(@roles, :id, :name, @assignments[key]&.role_id),
-                  include_blank: "— none —" %>
-            <%= submit_tag "Set", name: nil %>
+                  include_blank: "— none —",
+                  aria: { label: "Org-wide role for #{label}" } %>
+            <%= submit_tag "Set", name: nil,
+                  aria: { label: "Set org-wide role for #{label}" } %>
           <% end %>
         </td>
         <td>

data/lib/current_scope/configuration.rb

@@ -17,7 +17,11 @@ module CurrentScope
     # EMPTY BY DEFAULT — SoD is opt-in. The engine's baseline is scoped RBAC;
     # many hosts want nothing to do with four-eyes. Enable it by listing the
     # actions to gate, e.g. `config.sod_actions = %w[approve]`.
-    attr_accessor :sod_actions
+    #
+    # Matched as STRINGS against the key's action segment (see Resolver#sod_action?).
+    # Use the writer below — a plain Symbol list ([:approve]) used to silently
+    # disable the veto (#91). Same shape as collection_read_actions=.
+    attr_reader :sod_actions
 
     # Which identities the separation-of-duties veto weighs:
     #   :either  (default) — veto if the effective subject OR (while
@@ -32,6 +36,32 @@ module CurrentScope
 
     SOD_IDENTITY_MODES = %i[either subject].freeze
 
+    # Normalizing writer for sod_actions (#91). The resolver matches with
+    # include?(permission.split("#").last) — a String — so symbols never match
+    # and silently turn the fraud control off. Normalize symbols to strings,
+    # reject non-String/Symbol elements and full keys (same honesty as
+    # collection_read_actions=), freeze the list.
+    def sod_actions=(value)
+      elements = Array(value)
+
+      if (bad = elements.reject { |e| e.is_a?(String) || e.is_a?(Symbol) }).any?
+        raise ConfigurationError,
+              "config.sod_actions takes action NAMES (strings or symbols); got " \
+              "#{bad.map(&:inspect).join(', ')}. Write e.g. %w[approve] or [:approve]."
+      end
+
+      actions = elements.map(&:to_s)
+
+      if (keyed = actions.grep(/#/)).any?
+        raise ConfigurationError,
+              "config.sod_actions is matched on the ACTION segment of a key — " \
+              "#{keyed.map(&:inspect).join(', ')} can never match. Write \"approve\", " \
+              "not \"reports#approve\"."
+      end
+
+      @sod_actions = actions.freeze
+    end
+
     # Validating writer, same contract as enforcement=: the resolver compares
     # `== :either`, so a typo (`:both`, `:actor`) would otherwise silently
     # behave as :subject — narrowing the fraud control with no signal. Raise at
@@ -161,12 +191,11 @@ module CurrentScope
     # reads, so review the declaration like the record hook.
     attr_reader :collection_read_actions
 
-    # Normalizing writer, unlike sod_actions' plain accessor (that footgun is
-    # grandfathered, not precedent): the list is matched as STRINGS, so
-    # [:index] matching nothing would silently un-fix #65. Normalize rather
-    # than raise for shape (nil ⇒ [], symbols ⇒ strings — unambiguous), but
-    # two inputs get a voice, because a silently-inert or silently-widened
-    # security knob is the failure this writer exists to prevent:
+    # Normalizing writer: the list is matched as STRINGS, so [:index] matching
+    # nothing would silently un-fix #65. Normalize rather than raise for shape
+    # (nil ⇒ [], symbols ⇒ strings — unambiguous), but two inputs get a voice,
+    # because a silently-inert or silently-widened security knob is the failure
+    # this writer exists to prevent:
     #
     #   - a full KEY ("reports#index") RAISES — the list is matched on the
     #     action segment and applies to every controller, so a keyed member
@@ -213,9 +242,11 @@ module CurrentScope
       @collection_read_actions = actions.freeze
     end
 
-    # The three canonical Rails write actions — the unambiguous slice of the
-    # mutating-action space the writer above warns about.
-    MUTATING_ACTION_NAMES = %w[create update destroy].freeze
+    # Canonical mutating / bulk-write action names the collection_read writer
+    # warns about. Includes destroy_all/update_all — the docs' escalation
+    # examples — so those cannot reintroduce #49 via config with no signal.
+    # Custom names still evade any partial blocklist; that ceiling is deliberate.
+    MUTATING_ACTION_NAMES = %w[create update destroy destroy_all update_all].freeze
 
     # Tri-state: false | true (default) | :strict — controls
     # CurrentScope::Event.record!.
@@ -407,7 +438,7 @@ module CurrentScope
     def initialize
       @user_method = :current_user
       @actor_method = nil
-      @sod_actions = []
+      @sod_actions = [].freeze
       @sod_identity = :either
       @allow_sod_bypass = false
       @sod_bypass_permission = "bypass_sod"

data/lib/current_scope/guard.rb

@@ -134,8 +134,10 @@ module CurrentScope
       CurrentScope::Current.collection_model = record.equal?(NO_RECORD) ? nil : model
       CurrentScope::Current.collection_model_path = controller_path
 
-      # The real actor (Current.actor) enters here explicitly — the resolver
-      # never reads Current itself (PDP purity). It only matters under SoD
+      # Decision *inputs* (subject, permission, record, model, actor) are
+      # explicit — the resolver does not read ambient identity for the allow/
+      # deny answer. Org-role *lookup* may use Current.memoized_org_role (a
+      # per-request cache, not a decision input). Actor only widens SoD under
       # :either while impersonating; otherwise actor == subject.
       allowed, reason = CurrentScope.resolver.decide(
         subject: CurrentScope::Current.user, permission: permission,

data/lib/current_scope/permissions.rb

@@ -60,17 +60,6 @@ module CurrentScope
     # default — the class form allowed_to?(:index, Report) is how you ask about
     # another controller, and it binds from its argument (R5). (KTD-6)
     #
-    # The match keys on the KEY's controller, not just the controller: kwarg: a
-    # full "reports#index" key from a projects view names "reports" and must NOT
-    # borrow the projects ambient (a Project grant answering a reports key). A
-    # bare action uses the resolved controller. (#50 review, cubic)
-    def ambient_collection_model(action, controller)
-      key_controller = action.to_s.include?("#") ? action.to_s.split("#").first : controller
-      return nil unless key_controller && key_controller == CurrentScope::Current.collection_model_path
-
-      CurrentScope::Current.collection_model
-    end
-
     def current_scope_user
       CurrentScope::Current.user
     end
@@ -87,5 +76,19 @@ module CurrentScope
     def impersonating?
       CurrentScope::Current.impersonating?
     end
+
+    private
+
+    # Internal binding for gate/view agreement (#50 KTD-6) — not host API.
+    # Private so it does not appear in controller action_methods. Matches on
+    # the KEY's controller, not just the controller: kwarg: a full
+    # "reports#index" key from a projects view must not borrow the projects
+    # ambient. A bare action uses the resolved controller. (#50 review, cubic)
+    def ambient_collection_model(action, controller)
+      key_controller = action.to_s.include?("#") ? action.to_s.split("#").first : controller
+      return nil unless key_controller && key_controller == CurrentScope::Current.collection_model_path
+
+      CurrentScope::Current.collection_model
+    end
   end
 end

data/lib/current_scope/version.rb

@@ -1,3 +1,3 @@
 module CurrentScope
-  VERSION = "0.3.0"
+  VERSION = "0.3.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: current_scope
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - David Teren