current_scope 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb3cfaf17408e822d2ce269223bed45714e97dad48d68ad68826cb398c39434f
-  data.tar.gz: 20729feebd795748b0898e62d4934b1ca3ed490ee585fcf911ad37d5d500e2a5
+  metadata.gz: 12a83f4dca4237516e79cd7b518eb943b6ba5ba8cd296b49e287859d5d7cc62d
+  data.tar.gz: 1a1d2cfcefbdee379195f6fd37140b7df0037fa578f9452a11043e71719f2df3
 SHA512:
-  metadata.gz: 7b6ede764a4924731f2a92c118dd0a2c018de8a808ddbd8d9010eacd862e0e57e972dcf3fe56a4337b239e052039dc0e022a1ef0bd7113c1fa1835e5d4c55f7a
-  data.tar.gz: 9b8823b93863c93d01eecb46a2773ad7fa3dd7fe0b9908f9a5f50137492ffb7ad4a10cbddc8207aaab0f4ed4ba27f572d5624b8687da6069878abff6465838e3
+  metadata.gz: 8f163e65876ed8a70eed33f4839b7d46827e73541c17543a67747ae4c35c6d3d9da281e023b83b8a733ca60d501f25c073d2bce3db7611cdfcc3f3d6b43e800b
+  data.tar.gz: 56fc9d5aab6a9babc3e8d9d0163274768c747a51e5378c625da34435a2e2ac6d00ba170cb2e6f50fa10f236b42c2a02fa68d23fc02a98e9bd9f2a40064083267

data/README.md

@@ -23,7 +23,12 @@
 > Kick the tyres, build a spike, tell us what breaks. Don't put it in front of
 > real users yet.
 
-**Website:** [davidteren.github.io/current_scope](https://davidteren.github.io/current_scope/) — overview, the resolver, and quickstart at a glance.
+**Website:** [davidteren.github.io/current_scope](https://davidteren.github.io/current_scope/) —
+overview, quickstart, the
+[separation-of-duties guide](https://davidteren.github.io/current_scope/separation-of-duties.html),
+the security checklist, and
+[copy-paste prompts for AI agents](https://davidteren.github.io/current_scope/ai-agents.html).
+Source lives in [`docs/site/`](docs/site/).
 
 **Authorization as data you edit in a UI, not rules you hardcode and redeploy —
 with one ambient context that makes `allowed_to?` work identically in
@@ -120,6 +125,9 @@ end
 > — callback ordering vs. your authentication, the Devise recipe, the
 > `skip_before_action` fail-open trap, hybrid HTML+API grants, and a rollout
 > ladder. The short version is below.
+>
+> **Shipping?** Read the [Security & production checklist](docs/SECURITY-CHECKLIST.md)
+> first — excluded controllers, the 403/404 record oracle, and the pre-ship tick list.
 
 
 The gate is fail-closed, so the line you just added denies **everything** until
@@ -158,8 +166,9 @@ Total: 457 would-be denials across 2 subject(s).
 
 That *is* your grant-seeding work, in the shape of the role grid you need to
 build: every subject who'd have been refused, what they were missing, and how
-badly. Seed the roles it names, watch the list empty out, then flip to
-`:enforce`. Each step is one line back, and nobody gets a 403 while you learn.
+badly. Seed the roles it names, re-exercise, and flip to `:enforce` once newly
+exercised requests stop adding rows (the report reads the append-only
+ledger, so historical rows do not clear). Each step is one line back, and nobody gets a 403 while you learn.
 
 The rows are ordinary ledger events, so query them directly if you want
 something the task doesn't show:
@@ -176,7 +185,7 @@ else still refuses:
 | Still enforced in `:report` | Why it can't be relaxed |
 |---|---|
 | Separation-of-duties veto | Lifting it lets an initiator really approve their own record — a fraud action executed, not a role gap surfaced. |
-| SoD actions the veto *couldn't* run on | If an SoD action is gated without a record, the veto has no initiator to measure and is skipped — so the refusal that comes back says "not granted", not "SoD approved". Report mode won't speak for a rule nobody asked, and still refuses. (`config.warn_on_nil_sod_record` surfaces the misconfiguration behind it.) |
+| SoD actions the veto *couldn't* run on | If an SoD action is gated without a record, the veto has no initiator to measure and is skipped — so the refusal that comes back says "not granted", not "SoD approved". Report mode won't speak for a rule nobody asked, and still refuses — but it **logs the blind spot and records `access.sod_blind_spot`** (not `access.would_deny`; granting will not clear the 403). `rails current_scope:report` lists them separately. |
 | The management console | It's where grants are made. An observation flag that opened it would be a privilege escalation. |
 | Impersonation read-only gate | Runs before the permission check and answers to its own rule. |
 
@@ -380,6 +389,13 @@ class ReportsController < ApplicationController
 end
 ```
 
+The same hook has two foot-guns worth knowing before you ship: returning **nil**
+on an SoD member action silently skips the veto
+([§ Separation of duties](#separation-of-duties-opt-in)), and loading with
+`Model.find` means an unauthorized caller sees **403** for an existing id vs
+**404** for a missing one — a record-existence oracle
+([security checklist mitigation](docs/SECURITY-CHECKLIST.md#2-403-vs-404-leaks-which-records-exist)).
+
 ### Scopeable models
 
 `include CurrentScope::Scopeable` in a host model to list it in the scoped-role
@@ -487,7 +503,9 @@ Holding `bypass_sod` on a flagged, self-initiated record **is** the
 authorization for the SoD action — the bypass grants the action, it doesn't
 merely lift the veto and then re-check for a separate `approve` grant.
 `bypass_sod` must **not** appear in `sod_actions` (it isn't an SoD action); the
-engine raises if it does, to prevent a re-entrant loop.
+engine raises **at boot** if it does (and again at decision time as defense in
+depth), so a re-entrant pairing fails the deploy instead of 500ing on the first
+real break-glass attempt.
 
 When a bypass lifts the veto, the engine records exactly one append-only
 `sod.bypassed` audit event at the enforcement gate (never on advisory
@@ -556,10 +574,16 @@ additions. Members normalize to strings on assignment, so `%i[index]` works.
 
 The **audit ledger** is controlled by `config.audit` — tri-state
 `false | true | :strict`. `false` records nothing; `true` (the default) records
-every authorization change and degrades gracefully (skip + warn once) if the
-events table isn't migrated; `:strict` **raises** on a missing events table so
-an audit-mandatory app never commits an unaudited change (the mutation rolls
-back).
+authorization changes made through the **management UI**, the **impersonation
+boundary**, and **`CurrentScope.grant!`** (including the rake task and seeds
+bootstrap path — self-attributed, `details.source = "bootstrap"`), and degrades
+gracefully (skip + warn once) if the events table isn't migrated; `:strict`
+**raises** on a missing events table so an audit-mandatory app never commits an
+unaudited change (the mutation rolls back). Direct `RoleAssignment` /
+`ScopedRoleAssignment` writes and the test helpers (`grant_role!` /
+`grant_scoped_role!`) are **not** recorded — use `grant!` for bootstrap
+paths that need a ledger trail. UI events stamp `request_id` from
+`ActionDispatch::RequestId` via the Context hook.
 
 > **Note on the `!`:** despite the bang, `Event.record!` only guarantees
 > raise-on-failure under `:strict` (and for a missing actor). In the default
@@ -764,8 +788,16 @@ class ImpersonationsController < ApplicationController
 end
 ```
 
-Denials carry a machine-readable reason on `AccessDenied#reason`, surfaced on
-the response as the `X-Current-Scope-Reason` header:
+Denials raise `CurrentScope::AccessDenied` with stable accessors for branded
+403 pages and error trackers (prefer `#permission` over parsing `#message`):
+
+| Accessor | Meaning |
+|---|---|
+| `#permission` | denied `controller#action` key — the stable API. Defaults to the positional message when `permission:` is omitted |
+| `#message` | `StandardError` message. Gem raise sites pass the key as both message and permission; they can diverge if a caller passes an explicit `permission:` keyword |
+| `#reason` | machine-readable cause (also on `X-Current-Scope-Reason`) |
+| `#record` | the record under decision when the gate had one; **nil** on collection / impersonation-gate denials |
+| `#subject` | effective subject when known |
 
 | Reason | Means |
 |---|---|
@@ -776,12 +808,57 @@ the response as the `X-Current-Scope-Reason` header:
 | `impersonation_gate` | a mutation while impersonating, which is read-only |
 | `not_full_access` | the management UI, which only full-access subjects enter |
 
-Every denial routes through one method, so a refusal can't reach a client
-without its reason. A **host** denial is a bodyless `403` — the reason header is
-the signal, and the gem won't render into your app's response contract. The
-engine's own management UI is the exception: it renders a short page saying a
-full-access role is required, because the person reading that one is an admin
-looking at a browser.
+Guard and MutationGuard denials route through one method
+(`current_scope_denied`), so by default a refusal on a Guard-wrapped controller
+gets its reason header (and the denial log line below). "By default" matters: a
+host `rescue_from CurrentScope::AccessDenied` registered after the include
+**replaces** that method, and with it the header and the log line (see the last
+example in this section). A **host** denial is a
+bodyless `403` by default — the reason header is the signal, and the gem won't
+render into your app's response contract. The engine's own management UI is the
+exception: it overrides the body seam to render a short page saying a full-access
+role is required, because the person reading that one is an admin looking at a
+browser.
+
+The engine also registers `CurrentScope::AccessDenied → :forbidden` in
+`ActionDispatch` rescue responses (only if the host has not already mapped that
+class), so a denial that **escapes** Guard (PORO re-raise, Context-only
+controller) is still HTTP **403**, not 500. That path is status-only — no
+`X-Current-Scope-Reason` header and no denial log line unless something in your
+stack writes them. On the Guard path, rescued denials log one INFO line
+mirroring the header:
+
+```
+[CurrentScope] denied reports#approve (no_grant) → 403
+```
+
+INFO is intentional so production captures denials without raising the log
+level; high-volume anonymous probes will grow the log — filter
+`[CurrentScope] denied` if that is noise for your operators.
+
+**Branded host 403 — prefer the body seam** so the header and log stay intact:
+
+```ruby
+# Keeps X-Current-Scope-Reason + the denial log; only the body changes.
+def current_scope_render_denied(reason)
+  render "errors/forbidden", status: :forbidden, locals: { reason: reason }
+end
+```
+
+Need `#permission` / `#record` / `#subject` on the page? A host `rescue_from`
+registered **after** `include CurrentScope::Guard` wins and **replaces**
+`current_scope_denied` — set the header yourself (or you lose it), and note
+this example restores only the header; write your own log line if you need
+the denial telemetry:
+
+```ruby
+rescue_from CurrentScope::AccessDenied do |e|
+  response.headers["X-Current-Scope-Reason"] = e.reason.to_s if e.reason
+  render "errors/forbidden",
+         status: :forbidden,
+         locals: { permission: e.permission, reason: e.reason, record: e.record }
+end
+```
 
 **View/gate disagreement is by design.** `allowed_to?` is HTTP-ignorant: it
 still returns `true` for a permission the subject genuinely holds, even though

data/app/assets/stylesheets/current_scope/application.css

@@ -619,6 +619,30 @@ input[type="checkbox"], input[type="radio"] {
 .cs-chip-label { padding: 0.125rem 0.25rem 0.125rem 0.6875rem; align-self: center; }
 .cs-chip form { display: flex; margin: 0; }
 
+/* #90 — orphaned scoped grants (resource deleted) still list as chips/rows but
+   open nothing on collection reads since #65. Mark them so operators do not
+   trust the grant. Use .cs-inert-badge — NOT .cs-badge (topbar "full access"). */
+.cs-chip--inert {
+  border-style: dashed;
+  opacity: 0.85;
+  background: var(--cs-surface-2);
+}
+.cs-row--inert td { color: var(--cs-muted); }
+.cs-inert-badge {
+  display: inline-block;
+  font-size: 0.6875rem;
+  font-weight: 600;
+  letter-spacing: 0.02em;
+  text-transform: uppercase;
+  padding: 0.05rem 0.35rem;
+  border-radius: 0.25rem;
+  margin-left: 0.35rem;
+  vertical-align: middle;
+  color: var(--cs-danger, oklch(0.45 0.14 25));
+  background: color-mix(in oklch, var(--cs-danger, oklch(0.55 0.18 25)) 12%, transparent);
+  border: 1px solid color-mix(in oklch, var(--cs-danger, oklch(0.55 0.18 25)) 35%, transparent);
+}
+
 /* Revoke control — a clear, labeled × with a divider so it reads as a button. */
 .cs-chip-remove {
   border: none;
@@ -659,6 +683,8 @@ input[type="checkbox"], input[type="radio"] {
    host might place in the sidebar or topbar. */
 .cs-main form p { margin: 0 0 1rem; max-width: 30rem; }
 
+/* Non-control captions (bulk subjects line) share form-label type. */
+.cs-main form p > .cs-label,
 .cs-main form p > label {
   display: block;
   font-size: 0.7rem;

data/app/controllers/current_scope/application_controller.rb

@@ -32,8 +32,12 @@ module CurrentScope
     def require_full_access!
       return if CurrentScope.resolver.full_access?(CurrentScope::Current.user)
 
+      key = "#{controller_path}##{action_name}"
       raise CurrentScope::AccessDenied.new(
-        "#{controller_path}##{action_name}", reason: :not_full_access
+        key,
+        reason: :not_full_access,
+        permission: key,
+        subject: CurrentScope::Current.user
       )
     end
 

data/app/controllers/current_scope/role_assignments_controller.rb

@@ -16,16 +16,35 @@ module CurrentScope
       # only the subjects that ACTUALLY changed so the notice can't over-report
       # (a re-set to the same role, or a clear on a subject with no role, is a
       # no-op and shouldn't be counted).
+      #
+      # Lock full-access holders inside the same transaction as the writes so
+      # concurrent clears cannot both observe "another holder remains" and then
+      # both proceed to zero holders.
       changed = 0
+      refused = false
       RoleAssignment.transaction do
-        subjects.each do |subject|
-          assignment = RoleAssignment.find_or_initialize_by(subject: subject)
-          prior_role = assignment.role # nil for a brand-new assignment
-          did = clearing ? clear_org_role(subject, assignment, prior_role) : set_org_role(subject, assignment, prior_role)
-          changed += 1 if did
+        lock_full_access_org_holders!
+
+        if would_remove_last_full_access_holders?(subjects, clearing: clearing)
+          refused = true
+        else
+          subjects.each do |subject|
+            assignment = RoleAssignment.find_or_initialize_by(subject: subject)
+            prior_role = assignment.role # nil for a brand-new assignment
+            did = clearing ? clear_org_role(subject, assignment, prior_role) : set_org_role(subject, assignment, prior_role)
+            changed += 1 if did
+          end
         end
       end
 
+      if refused
+        redirect_back_or_to subjects_path,
+                            alert: "Refusing to remove the last full-access org-wide assignment — " \
+                                   "it would lock everyone out of this UI. Grant full access to " \
+                                   "another subject first, then retry."
+        return
+      end
+
       # Return to wherever the action was invoked (the subjects page or a role's
       # members page); falls back to subjects when there's no referrer.
       redirect_back_or_to subjects_path, notice: org_notice(clearing, changed)
@@ -37,14 +56,32 @@ module CurrentScope
     # clean up an orphaned assignment whose subject was deleted (the subject-keyed
     # clear on `create` can't target a subject that no longer resolves).
     def destroy
-      assignment = RoleAssignment.find(params[:id])
-      subject = resolve_subject(assignment)
-      role_name = assignment.role.name
-
+      refused = false
       RoleAssignment.transaction do
-        assignment.destroy!
-        Event.record!(event: "org_role.removed", target: subject || assignment, details: { role: role_name })
+        # Lock FA state BEFORE the target assignment so order matches create/
+        # role demote/delete (FA roles → FA holders → target row). Locking the
+        # assignment first inverted that order and could deadlock.
+        lock_full_access_org_holders!
+        assignment = RoleAssignment.lock.find(params[:id])
+        subject = resolve_subject(assignment)
+        role_name = assignment.role.name
+
+        if last_full_access_org_assignment?(assignment)
+          refused = true
+        else
+          assignment.destroy!
+          Event.record!(event: "org_role.removed", target: subject || assignment, details: { role: role_name })
+        end
       end
+
+      if refused
+        redirect_back_or_to subjects_path,
+                            alert: "Refusing to remove the last full-access org-wide assignment — " \
+                                   "it would lock everyone out of this UI. Grant full access to " \
+                                   "another subject first, then retry."
+        return
+      end
+
       redirect_back_or_to subjects_path, notice: "Org-wide role removed."
     rescue ActiveRecord::RecordNotFound
       redirect_back_or_to subjects_path, notice: "That org-wide role was already removed."
@@ -68,6 +105,54 @@ module CurrentScope
       count == 1 ? "Org-wide role #{verb}." : "Org-wide role #{verb} for #{count} subjects."
     end
 
+    # True when this assignment is a live full_access org holder and no other
+    # full_access org assignment exists. Orphan rows (deleted subject → nil)
+    # must not permanently block cleanup of the last FA assignment.
+    def last_full_access_org_assignment?(assignment)
+      return false unless assignment.role&.full_access?
+      return false if resolve_subject(assignment).nil?
+
+      !full_access_org_assignments.where.not(id: assignment.id).exists?
+    end
+
+    # True when applying clear (or reassign to a non-full_access role) to these
+    # subjects would leave zero full_access org holders.
+    def would_remove_last_full_access_holders?(subjects, clearing:)
+      holders = full_access_org_assignments.to_a
+      return false if holders.empty?
+
+      affected_ids = holders.select { |a| subjects.any? { |s| same_subject?(a, s) } }.map(&:id)
+      return false if affected_ids.empty?
+
+      unless clearing
+        new_role = Role.find_by(id: params[:role_id])
+        return false if new_role&.full_access?
+      end
+
+      remaining = holders.reject { |a| affected_ids.include?(a.id) }
+      remaining.empty?
+    end
+
+    def full_access_org_assignments
+      RoleAssignment.joins(:role).where(current_scope_roles: { full_access: true })
+    end
+
+    # Lock full-access holder rows (and their roles) so concurrent remove/demote
+    # paths serialize on the same set the precheck reads. Call only inside a
+    # transaction. Prefer locking by id after a join pluck — FOR UPDATE with
+    # joins is adapter-fragile.
+    def lock_full_access_org_holders!
+      Role.where(full_access: true).lock.load
+      ids = full_access_org_assignments.pluck(:id)
+      RoleAssignment.where(id: ids).lock.load if ids.any?
+    end
+
+    def same_subject?(assignment, subject)
+      # Match the polymorphic storage name the subjects page uses (not only
+      # base_class.name — hosts can customize polymorphic_name).
+      assignment.subject_type == subject.class.polymorphic_name && assignment.subject_id == subject.id
+    end
+
     # Returns true when a role was actually cleared, false when there was nothing
     # to clear (so the caller's count stays accurate). Atomicity comes from
     # create's outer bulk transaction — only called from inside it. (No inner

data/app/controllers/current_scope/roles_controller.rb

@@ -1,7 +1,8 @@
 module CurrentScope
   class RolesController < ApplicationController
     def index
-      @roles = Role.order(:name)
+      # Includes for delete-confirm holder counts (cascade warning).
+      @roles = Role.order(:name).includes(:role_assignments, :scoped_role_assignments)
     end
 
     def new
@@ -40,11 +41,12 @@ module CurrentScope
 
     def members
       @role = Role.find(params[:id])
-      # No polymorphic includes: eager-loading a stale/renamed subject_type or
-      # resource_type raises NameError. Lazy-load per row and label defensively
-      # in the view (current_scope_holder_* helpers), like the audit ledger does.
+      # No blanket polymorphic includes: stale subject_type/resource_type
+      # NameErrors at preload. Org holders stay lazy; scoped resources use the
+      # safe per-type preload (unresolvable types stay unloaded → inert label).
       @org_holders = RoleAssignment.where(role: @role).to_a
-      @scoped_holders = ScopedRoleAssignment.where(role: @role).to_a
+      @scoped_holders = ScopedRoleAssignment.where(role: @role).includes(:role).to_a
+      ScopedRoleAssignment.preload_resolvable_resources!(@scoped_holders)
 
       # Exclude via a subquery, not a plucked Ruby array, so a role with many
       # holders doesn't build a huge NOT IN bind list.
@@ -55,12 +57,36 @@ module CurrentScope
     end
 
     def update
-      @role = Role.find(params[:id])
-      previous_name = @role.name
+      permitted = role_params
+      previous_name = nil
       saved = false
+      refused = false
+
+      # Lock full-access roles + holders inside the write transaction so two
+      # concurrent demotions of the last held full-access roles cannot both pass
+      # a pre-transaction check and then both commit.
       Role.transaction do
-        saved = @role.update(role_params)
-        record_role_update(@role, previous_name) if saved
+        # Lock FA console state before the target role so concurrent demote/delete
+        # of two FA roles cannot invert lock order (roles first, then assignments).
+        lock_full_access_console_state!
+        @role = Role.lock.find(params[:id])
+
+        if demoting_would_lock_console?(@role, permitted)
+          refused = true
+        else
+          previous_name = @role.name
+          previous_full_access = @role.full_access?
+          saved = @role.update(permitted)
+          record_role_update(@role, previous_name, previous_full_access) if saved
+        end
+      end
+
+      if refused
+        redirect_to edit_role_path(@role),
+                    alert: "Refusing to remove full access — this is the last full-access role " \
+                           "any subject holds and would lock everyone out of this UI. Grant " \
+                           "full access to another subject first, then retry."
+        return
       end
 
       if saved
@@ -71,44 +97,81 @@ module CurrentScope
     end
 
     def destroy
-      role = Role.find(params[:id])
+      refused = false
+
+      Role.transaction do
+        lock_full_access_console_state!
+        role = Role.lock.find(params[:id])
+
+        if would_lock_console_by_removing_role?(role)
+          refused = true
+        else
+          # Snapshot WITHOUT polymorphic includes — includes(:subject)/:resource
+          # can raise NameError for stale types at preload (members page avoids
+          # this for the same reason). Resolve each row inside the helpers.
+          org_removed = role.role_assignments.to_a
+          scoped_revoked = role.scoped_role_assignments.to_a
+
+          role.destroy!
+          Event.record!(event: "role.deleted", target: role, details: { name: role.name })
+          org_removed.each do |a|
+            Event.record!(event: "org_role.removed", target: cascade_subject(a), details: { role: role.name })
+          end
+          scoped_revoked.each do |a|
+            Event.record!(event: "scoped_role.revoked", target: cascade_subject(a),
+                          details: { role: role.name, resource: cascade_resource_label(a) })
+          end
+        end
+      end
 
-      if last_full_access?(role)
+      if refused
         redirect_to roles_path,
-                    alert: "Refusing to delete the last full-access role — it would lock everyone out of this UI."
+                    alert: "Refusing to delete this full-access role — it is the last one held by any " \
+                           "subject and would lock everyone out of this UI. Grant full access to " \
+                           "another subject first, then retry."
         return
       end
 
-      # Snapshot the cascade BEFORE destroy! — dependent: :destroy takes the
-      # assignments with the role, so they can't be read afterwards.
-      org_removed = role.role_assignments.includes(:subject).to_a
-      scoped_revoked = role.scoped_role_assignments.includes(:subject, :resource).to_a
-
-      Role.transaction do
-        role.destroy!
-        Event.record!(event: "role.deleted", target: role, details: { name: role.name })
-        org_removed.each do |a|
-          Event.record!(event: "org_role.removed", target: a.subject, details: { role: role.name })
-        end
-        scoped_revoked.each do |a|
-          Event.record!(event: "scoped_role.revoked", target: a.subject,
-                        details: { role: role.name, resource: helpers.current_scope_label(a.resource) })
-        end
-      end
       redirect_to roles_path, notice: "Role deleted."
     end
 
     private
 
+    # Polymorphic subject/resource may be deleted or unresolvable — never 500
+    # the cascade audit. Deleted records return nil without raising (especially
+    # after includes preload), so use || assignment, not rescue-only.
+    def cascade_subject(assignment)
+      assignment.subject || assignment
+    rescue ActiveRecord::RecordNotFound, NameError
+      assignment
+    end
+
+    def cascade_resource_label(assignment)
+      resource = begin
+        assignment.resource
+      rescue ActiveRecord::RecordNotFound, NameError
+        nil
+      end
+      return "#{assignment.resource_type}##{assignment.resource_id}" if resource.nil?
+
+      helpers.current_scope_label(resource)
+    rescue StandardError
+      "#{assignment.resource_type}##{assignment.resource_id}"
+    end
+
     # One event per save: role.renamed when the name changed (carries old/new
-    # name AND the grid diff), else role.updated for a pure grid change. Emits
-    # nothing when neither the name nor the grid moved.
-    def record_role_update(role, previous_name)
+    # name AND the grid/full_access diff), else role.updated. Emits nothing on
+    # a pure no-op (same name, same grid, same full_access).
+    def record_role_update(role, previous_name, previous_full_access)
       diff = role.permission_keys_change || { added: [], removed: [], rejected: [] }
       renamed = previous_name != role.name
-      return unless renamed || diff[:added].any? || diff[:removed].any?
+      full_access_changed = previous_full_access != role.full_access?
+      return unless renamed || full_access_changed || diff[:added].any? || diff[:removed].any?
 
       details = { added: diff[:added], removed: diff[:removed] }
+      if full_access_changed
+        details.merge!(full_access_from: previous_full_access, full_access_to: role.full_access?)
+      end
       event = "role.updated"
       if renamed
         event = "role.renamed"
@@ -117,8 +180,40 @@ module CurrentScope
       Event.record!(event: event, target: role, details: details)
     end
 
-    def last_full_access?(role)
-      role.full_access? && !Role.where(full_access: true).where.not(id: role.id).exists?
+    # True when removing/demoting this full_access role would leave zero
+    # full_access org holders. An unassigned full_access role is always safe
+    # to delete/demote (cubic). An empty spare full_access role must NOT
+    # authorize demoting the held Owner (CE) — check holders, not role rows.
+    def would_lock_console_by_removing_role?(role)
+      return false unless role.full_access?
+      return false unless RoleAssignment.where(role: role).exists?
+
+      !RoleAssignment.joins(:role)
+        .where(current_scope_roles: { full_access: true })
+        .where.not(role_id: role.id)
+        .exists?
+    end
+
+    # True when the update would turn off full_access and lock the console.
+    # Only treats an EXPLICIT full_access=false as demotion — a missing key
+    # would not change the column and must not false-positive refuse.
+    def demoting_would_lock_console?(role, permitted)
+      return false unless role.full_access?
+      return false unless permitted.key?(:full_access)
+      return false if ActiveModel::Type::Boolean.new.cast(permitted[:full_access])
+
+      would_lock_console_by_removing_role?(role)
+    end
+
+    # Serialize demote/delete against concurrent last-holder removal. Lock FA
+    # role rows and their org-wide holder assignments (by id — FOR UPDATE + join
+    # is adapter-fragile). Call only inside a transaction.
+    def lock_full_access_console_state!
+      Role.where(full_access: true).lock.load
+      ids = RoleAssignment.joins(:role)
+        .where(current_scope_roles: { full_access: true })
+        .pluck(:id)
+      RoleAssignment.where(id: ids).lock.load if ids.any?
     end
 
     def role_params

data/app/controllers/current_scope/subjects_controller.rb

@@ -19,9 +19,12 @@ module CurrentScope
       @roles = Role.order(:name)
       @assignments = RoleAssignment.where(subject: @subjects)
                                    .index_by { |a| [ a.subject_type, a.subject_id ] }
-      @scoped = ScopedRoleAssignment.where(subject: @subjects)
-                                    .includes(:role, :resource)
-                                    .group_by { |a| [ a.subject_type, a.subject_id ] }
+      # Safe polymorphic resource preload (resolvable types only) — full
+      # includes(:resource) NameErrors on a stale resource_type and 500s the
+      # page; skip-unresolvable + label as inert instead (#90 / PR #104).
+      scoped_rows = ScopedRoleAssignment.where(subject: @subjects).includes(:role).to_a
+      ScopedRoleAssignment.preload_resolvable_resources!(scoped_rows)
+      @scoped = scoped_rows.group_by { |a| [ a.subject_type, a.subject_id ] }
     end
 
     private

data/app/helpers/current_scope/application_helper.rb

@@ -89,8 +89,14 @@ module CurrentScope
     end
 
     def current_scope_holder_resource_label(scoped_assignment)
+      if scoped_assignment.respond_to?(:orphaned_resource?) && scoped_assignment.orphaned_resource?
+        return "#{scoped_assignment.resource_type} ##{scoped_assignment.resource_id} (unavailable — inert)"
+      end
+
       current_scope_label(scoped_assignment.resource)
     rescue NameError, ActiveRecord::RecordNotFound
+      # Labeler failed — not proof the resource is orphaned. Raw type#id only
+      # (orphaned_resource? above owns the inert wording) — PR #104 review.
       "#{scoped_assignment.resource_type} ##{scoped_assignment.resource_id}"
     end