current_scope 0.5.0

data/app/views/current_scope/roles/edit.html.erb

@@ -0,0 +1,229 @@
+<h1>Edit role: <%= @role.name %></h1>
+
+<p><%= link_to "See who holds this role →", members_role_path(@role) %></p>
+
+<%= form_with model: @role do |f| %>
+  <% if @role.errors.any? %>
+    <p class="cs-alert" role="alert"><%= @role.errors.full_messages.to_sentence %></p>
+  <% end %>
+
+  <p><%= f.label :name %> <%= f.text_field :name %></p>
+  <p>
+    <%= f.label :description %>
+    <%= f.text_area :description, rows: 2, placeholder: "What is this role for? (optional)" %>
+  </p>
+  <p>
+    <%= f.label :full_access do %>
+      <%= f.check_box :full_access %> Full access — every permission, present and future. Does not cascade to child records through current_scope_parent.
+      (the grid below is ignored while this is on)
+    <% end %>
+  </p>
+
+  <h2>Permission grid</h2>
+  <%# The injected break-glass action's bare name (nil when break-glass is
+      off) — the hint below and the per-row exemption check both read it. The
+      CATALOG owns the parse: its split("#", -1) + blank-raise catches a
+      malformed "reports#" that a loose split here would silently turn into a
+      believable wrong action name. (#79 review, qodo) %>
+  <% bypass_action = CurrentScope.config.allow_sod_bypass ? CurrentScope.catalog.bypass_action : nil %>
+  <p class="cs-hint">
+    One row per controller, one checkbox per action group — derived from the
+    app's routes, so new controllers appear here automatically. Columns are
+    fixed: a blank cell means the controller doesn't route that action.
+    <%# The break-glass column is the one thing here that is NOT an action you
+        can route, so the "derived from the app's routes" line above would
+        otherwise make it look like a mistake. %>
+    <% if CurrentScope.config.allow_sod_bypass %>
+      Break-glass is on, so controllers with a separation-of-duties action also
+      show a <code><%= bypass_action %></code>
+      column: granting it lets that role's holder override the four-eyes veto on
+      their own record, where the record allows it. Every use is audited.
+    <% end %>
+  </p>
+  <%# Unconditional on purpose (R9): the limit of the mark must be stated even
+      when nothing is marked — an unmarked row is a non-answer, not a proof. %>
+  <p class="cs-hint cs-ungated-hint">
+    Rows tagged "gate not run" are controllers provably never gated — the tag
+    appears only when the callback chain proves it. An unmarked row is not
+    proof the gate runs there (a conditional skip, for example, is unprovable
+    and renders unmarked).
+  </p>
+
+  <% grid = CurrentScope::PermissionGrid.new %>
+  <% granted = @role.permission_keys.to_set %>
+  <%= hidden_field_tag "role[permission_keys][]", "" %>
+  <%= hidden_field_tag "role[permission_groups][]", "" %>
+  <div class="cs-grid-wrap">
+    <table class="cs-grid">
+      <thead>
+        <tr>
+          <th scope="col" class="cs-grid-corner">Controller</th>
+          <% grid.columns.each do |column| %>
+            <th scope="col"><%= column.label %></th>
+          <% end %>
+        </tr>
+      </thead>
+      <tbody>
+        <% grid.controllers.each do |controller| %>
+          <%# A broken controller body's NameError deliberately propagates out
+              of the reflection (KTD-2) — but ONE broken controller must not
+              take down the whole role editor for every other row. The view
+              renders that row as explicitly uninspectable (a visible state,
+              never silence, never "gated"); the rake task keeps propagating,
+              because its output makes proof claims a partial walk can't. %>
+          <% ungated = begin
+               grid.ungated?(controller)
+             rescue NameError
+               :uninspectable
+             end %>
+          <%# #76: a declared skip carries its reason. Only ungated rows can be
+              declared, so this is the one constantize an ungated row needs. %>
+          <% skip_reason = begin
+               grid.declared_skip_reason(controller)
+             rescue NameError
+               nil
+             end if ungated == true %>
+          <%# #43: only badge missing controllers on ROUTE-backed rows.
+              Break-glass can inject a synthetic "reports" row that no path
+              routes (admin-only SoD); that row is not a 500 risk and must not
+              wear the phantom badge. Also skip the constantize when the row
+              is already proven ungated (qodo). %>
+          <% uninspectable = ungated == :uninspectable
+             ungated = ungated == true
+             declared = ungated && skip_reason.present?
+             has_routed = grid.actions_for(controller).any? { |a|
+               CurrentScope.catalog.routed?("#{controller}##{a}")
+             }
+             missing = if uninspectable || ungated || !has_routed
+                         false
+                       else
+                         begin
+                           grid.missing_controller?(controller)
+                         rescue NameError
+                           false
+                         end
+                       end %>
+          <%# Mutually exclusive by construction: `declared` implies ungated,
+              `missing` is only computed when NOT ungated. Order states from
+              most specific to least. %>
+          <% badge_id = if declared
+                          "cs_declared_skip_#{controller.parameterize(separator: '_')}"
+                        elsif ungated
+                          "cs_ungated_#{controller.parameterize(separator: '_')}"
+                        elsif missing
+                          "cs_missing_controller_#{controller.parameterize(separator: '_')}"
+                        end %>
+          <tr>
+            <th scope="row">
+              <%# Per-row master: enable/disable every action in this controller at once.
+                  Progressive enhancement — with JS off, each cell checkbox still works. %>
+              <label class="cs-row-all" title="Enable all <%= controller %> permissions">
+                <input type="checkbox" data-cs-row-all
+                       aria-label="Enable all <%= controller %> permissions"<% if badge_id %>
+                       aria-describedby="<%= badge_id %>"<% end %>>
+                <span><%= controller %></span>
+              </label>
+              <% if uninspectable %>
+                <%# Not a badge and not silence: the gate state is UNKNOWN here,
+                    and rendering nothing would read as "checked, and gated"
+                    under the hint's own rules. %>
+                <span class="cs-uninspectable-note" id="cs_uninspectable_<%= controller.parameterize(separator: '_') %>">
+                  could not inspect — this controller raised while loading, so its
+                  gate state is unknown. Fix the load error, then reload.
+                </span>
+              <% end %>
+              <% if missing %>
+                <%# #43: route exists, controller class does not. Granting still
+                    works (catalog is a route mirror); hitting the path is a
+                    MissingController 500. Flag, do not remove. %>
+                <span class="cs-missing-controller-badge" id="<%= badge_id %>">
+                  <strong>no controller</strong> — this route has no controller
+                  class (stale or typo route). Granting is allowed, but a request
+                  will 500 with <code>ActionDispatch::MissingController</code>.
+                  Remove the route or add the controller.
+                </span>
+              <% end %>
+              <% if declared %>
+                <%# #76 — intentional skip with a reason. Not alarming: a reviewer
+                    can read why the gate is off. Bare skips keep the warning. %>
+                <span class="cs-declared-skip-badge" id="<%= badge_id %>">
+                  <strong>skipped</strong> — <%= skip_reason %>.
+                  Ticking its routed actions still grants nothing until the gate
+                  runs; this declaration only records intent.
+                </span>
+              <% elsif ungated %>
+                <%# Advisory only — marking is not disabling (KTD-8/R5): nothing
+                    here is grayed or disabled. Same remediation vocabulary as
+                    GatingTripwire's message. The claim is scoped to ROUTED
+                    actions because the injected break-glass cell is live even
+                    on a marked row (KTD-9) and carries its own note below. %>
+                <%# Each remedy names its cause: re-including Guard on a subclass
+                    that inherited a skip is a NO-OP (the Concern short-circuits;
+                    the skip already removed the callback the include would add),
+                    so the inherited-skip host — the #62 shape this badge exists
+                    for — must be pointed at re-assertion, not at include. %>
+                <span class="cs-ungated-badge" id="<%= badge_id %>">
+                  <strong>gate not run</strong> — this controller does not run the
+                  gate; ticking its routed actions grants nothing until it does.
+                  If it inherited a skip, re-assert
+                  <code>before_action :current_scope_check!</code>; if it never had
+                  the gate, include CurrentScope::Guard. Prefer
+                  <code>current_scope_skip_gate!(reason: "…")</code> for deliberate
+                  skips so the reason shows here.
+                </span>
+              <% end %>
+            </th>
+            <% grid.columns.each do |column| %>
+              <% cell = grid.cell(controller, column, granted) %>
+              <% if cell.blank %>
+                <%# Not routed here — an empty cell. Kept in the a11y tree (no
+                    aria-hidden) so column/row alignment stays intact for screen
+                    readers; the "·" marker is decorative CSS. %>
+                <td class="cs-cell-blank"></td>
+              <% else %>
+                <%# column.actions covers both shapes — an ungrouped column is
+                    [action], and a permission_grid_groups entry containing the
+                    bypass action must not defeat the exemption. The two guards:
+                    the INJECTED key must actually sit on this controller (a
+                    grouped cell can be non-blank via its other actions), and
+                    routed? excludes the collision — a REAL routed action merely
+                    named like the bypass permission is ordinary and inert on a
+                    marked row; only the catalog-injected key stays live. (#79) %>
+                <% bypass_exempt = ungated && bypass_action &&
+                     column.actions.include?(bypass_action) &&
+                     CurrentScope.catalog.grouped[controller]&.include?(bypass_action) &&
+                     !CurrentScope.catalog.routed?("#{controller}##{bypass_action}") %>
+                <% note_id = "cs_bypass_exempt_#{controller.parameterize(separator: '_')}" if bypass_exempt %>
+                <td<% if bypass_exempt %> class="cs-cell-bypass"<% end %>>
+                  <label>
+                    <%= check_box_tag cell.name, cell.value, cell.checked,
+                          id: "perm_#{cell.value.parameterize(separator: '_')}",
+                          data: { cs_partial: cell.partial },
+                          "aria-label": "#{controller} #{column.label}",
+                          "aria-describedby": (bypass_exempt ? "#{badge_id} #{note_id}" : badge_id) %>
+                  </label>
+                  <% if bypass_exempt %>
+                    <%# KTD-9: break-glass is decided by GATED controllers acting
+                        on the record type, so this grant is live despite the
+                        row's badge — the one cell exempt from its claim. The
+                        class is also the CSS hook that keeps the real granted
+                        wash here while sibling cells are muted. %>
+                    <span class="cs-bypass-exempt" id="<%= note_id %>">exempt — stays live</span>
+                  <% end %>
+                  <%# Partial group: preserve the exact granted actions so a no-op
+                      save can't promote the group to a full grant. Interacting with
+                      the checkbox disables these (JS) so the group control takes over. %>
+                  <% cell.granted_keys.each do |key| %>
+                    <%= hidden_field_tag "role[permission_keys][]", key, id: nil, data: { cs_preserve: true } %>
+                  <% end %>
+                </td>
+              <% end %>
+            <% end %>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  </div>
+
+  <p><%= f.submit "Save role" %></p>
+<% end %>

data/app/views/current_scope/roles/index.html.erb

@@ -0,0 +1,55 @@
+<h1>Roles</h1>
+<p class="cs-lede">A role is an editable bundle of permissions. Edit one to tick
+  its controller&times;action grid; grants take effect on the subject's next request.</p>
+
+<div class="cs-toolbar">
+  <span class="cs-spacer"></span>
+  <%= link_to "New role", new_role_path, class: "cs-btn cs-btn-primary" %>
+</div>
+
+<div class="cs-card cs-card--flush">
+<table class="cs-table">
+  <thead>
+    <tr><th>Name</th><th>Access</th><th></th></tr>
+  </thead>
+  <tbody>
+    <% @roles.each do |role| %>
+      <tr>
+        <td>
+          <%= link_to role.name, edit_role_path(role) %>
+          <% if role.description.present? %>
+            <div class="cs-subtle"><%= role.description %></div>
+          <% end %>
+        </td>
+        <td>
+          <% if role.full_access? %>
+            full access (all current and future permissions)
+          <% else %>
+            <%= pluralize(role.role_permissions.size, "permission") %>
+          <% end %>
+        </td>
+        <td>
+          <%= link_to "Members", members_role_path(role), class: "cs-btn" %>
+          <%
+            org_n = role.role_assignments.size
+            scoped_n = role.scoped_role_assignments.size
+            parts = []
+            parts << "#{org_n} org-wide #{"holder".pluralize(org_n)}" if org_n.positive?
+            parts << "#{scoped_n} scoped #{"holder".pluralize(scoped_n)}" if scoped_n.positive?
+            delete_prompt = if parts.empty?
+              "Delete role #{role.name}?"
+            else
+              "Delete role #{role.name}? This also removes it from #{parts.to_sentence}."
+            end
+          %>
+          <%= button_to "Delete", role_path(role), method: :delete,
+                class: "cs-btn cs-btn-danger",
+                form: { data: { cs_confirm: delete_prompt } },
+                aria: { label: "Delete role #{role.name}" },
+                data: { turbo_confirm: delete_prompt } %>
+        </td>
+      </tr>
+    <% end %>
+  </tbody>
+</table>
+</div>

data/app/views/current_scope/roles/members.html.erb

@@ -0,0 +1,114 @@
+<h1>Members: <%= @role.name %></h1>
+<p class="cs-lede">Who holds <strong><%= @role.name %></strong> — as their one org-wide
+  role, or on a specific record. Assigning the org-wide role here replaces a
+  subject's current one (each subject has exactly one org-wide role).</p>
+
+<div class="cs-toolbar">
+  <%= link_to "← All roles", roles_path %>
+  <span class="cs-spacer"></span>
+  <%= link_to "Edit permissions", edit_role_path(@role), class: "cs-btn" %>
+</div>
+
+<h2>Add org-wide members</h2>
+<% if @candidates.any? %>
+  <%= form_with url: role_assignments_path, method: :post do %>
+    <%= hidden_field_tag :role_id, @role.id %>
+    <p>
+      <%= label_tag "subject_gids", "Subjects" %>
+      <select name="subject_gids[]" id="subject_gids" multiple size="8"
+              aria-label="Subjects to grant this role org-wide">
+        <% @candidates.each do |subject| %>
+          <option value="<%= subject.to_gid %>"><%= current_scope_subject_label(subject) %></option>
+        <% end %>
+      </select>
+    </p>
+    <% if @more_candidates %>
+      <p class="cs-hint">Showing the first <%= @candidates.size %> subjects who don't
+        already hold this role. Use the Subjects page to reach the rest.</p>
+    <% end %>
+    <p><%= submit_tag "Add selected as org-wide members" %></p>
+  <% end %>
+<% else %>
+  <p class="cs-subtle">Every subject already holds this role org-wide.</p>
+<% end %>
+
+<h2>Org-wide holders <span class="cs-subtle">(<%= @org_holders.size %>)</span></h2>
+<% if @org_holders.any? %>
+  <div class="cs-card cs-card--flush">
+    <table class="cs-table">
+      <thead><tr><th>Subject</th><th></th></tr></thead>
+      <tbody>
+        <% @org_holders.each do |assignment| %>
+          <% who = current_scope_holder_subject_label(assignment) %>
+          <%# Through the canonical guard: a non-canonical stored subject_id must
+              not resolve to an unrelated live subject whose GID the Remove button
+              would then post to the org-clear path (#151). nil -> orphaned branch. %>
+          <% subject_gid = (assignment.current_scope_resolved_record("subject")&.to_gid rescue nil) %>
+          <tr>
+            <td><%= who %></td>
+            <td>
+              <% if subject_gid %>
+                <%# Removing = clearing this subject's org-wide role (blank role_id). %>
+                <%= form_with url: role_assignments_path, method: :post,
+                      data: { cs_confirm: "Remove #{who} from #{@role.name}?" } do %>
+                  <%= hidden_field_tag :subject_gid, subject_gid %>
+                  <%= hidden_field_tag :role_id, "" %>
+                  <%= submit_tag "Remove", name: nil, class: "cs-btn" %>
+                <% end %>
+              <% else %>
+                <%# Orphaned assignment (subject deleted): remove it by id. %>
+                <%= button_to "Remove", role_assignment_path(assignment), method: :delete,
+                      class: "cs-btn", form: { data: { cs_confirm: "Remove this orphaned org-wide assignment?" } } %>
+                <span class="cs-subtle">subject unavailable</span>
+              <% end %>
+            </td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  </div>
+<% else %>
+  <p class="cs-subtle">No subject holds this as their org-wide role yet.</p>
+<% end %>
+
+<h2>Scoped holders <span class="cs-subtle">(<%= @scoped_holders.size %>)</span></h2>
+<% if @scoped_holders.any? %>
+  <div class="cs-card cs-card--flush">
+    <table class="cs-table">
+      <thead><tr><th>Subject</th><th>Record</th><th></th></tr></thead>
+      <tbody>
+        <% @scoped_holders.each do |sra| %>
+          <% who = current_scope_holder_subject_label(sra) %>
+          <% what = current_scope_holder_resource_label(sra) %>
+          <% orphaned = sra.orphaned_resource? %>
+          <tr id="scoped_holder_<%= sra.id %>"
+              class="cs-scoped-holder<%= ' cs-row--inert' if orphaned %>">
+            <td><%= who %></td>
+            <td>
+              <%= what %>
+              <% if orphaned %>
+                <span class="cs-inert-badge"
+                      title="This resource no longer resolves; the grant opens nothing on collection reads">inert</span>
+              <% end %>
+              <% if (diag = current_scope_grant_diagnosis_badge(sra)) %>
+                <span class="<%= diag[0] %>" title="<%= diag[2] %>"><%= diag[1] %><span class="cs-badge-note"> — <%= diag[2] %></span></span>
+              <% end %>
+            </td>
+            <td>
+              <% revoke_prompt = orphaned ?
+                    "Remove inert scoped grant (resource unavailable) for #{who}?" :
+                    "Revoke #{@role.name} on #{what} from #{who}?" %>
+              <%= button_to (orphaned ? "Remove inert" : "Revoke"),
+                    scoped_role_assignment_path(sra), method: :delete,
+                    id: "scoped_revoke_#{sra.id}",
+                    class: "cs-btn", form: { data: { cs_confirm: revoke_prompt } },
+                    data: { turbo_confirm: revoke_prompt } %>
+            </td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  </div>
+<% else %>
+  <p class="cs-subtle">No one holds this role on a specific record.</p>
+<% end %>

data/app/views/current_scope/roles/new.html.erb

@@ -0,0 +1,19 @@
+<h1>New role</h1>
+
+<%= form_with model: @role do |f| %>
+  <% if @role.errors.any? %>
+    <p class="cs-alert" role="alert"><%= @role.errors.full_messages.to_sentence %></p>
+  <% end %>
+
+  <p><%= f.label :name %> <%= f.text_field :name %></p>
+  <p>
+    <%= f.label :description %>
+    <%= f.text_area :description, rows: 2, placeholder: "What is this role for? (optional)" %>
+  </p>
+  <p>
+    <%= f.label :full_access do %>
+      <%= f.check_box :full_access %> Full access — every permission, present and future. Does not cascade to child records through current_scope_parent.
+    <% end %>
+  </p>
+  <p><%= f.submit "Create role" %></p>
+<% end %>

data/app/views/current_scope/scoped_role_assignments/new.html.erb

@@ -0,0 +1,144 @@
+<h1><%= @bulk_subjects.any? ? "Grant a scoped role to #{@bulk_subjects.size} #{'subject'.pluralize(@bulk_subjects.size)}" : "Grant a scoped role" %></h1>
+
+<p class="cs-hint">
+  A scoped role applies only when acting on the chosen record — it never
+  changes the subject's org-wide role.
+</p>
+
+<%#
+  Two forms, on purpose:
+
+  * The cascade is a GET form (id "cs-cascade"). Each control re-renders the
+    downstream steps: with Turbo it swaps just the #cascade frame; without JS
+    or Turbo the "Show records" submit does a full-page GET (every selection is
+    preserved from params). A GET form carries NO CSRF token — a token in a GET
+    would leak into the URL (server logs, history, Referer).
+
+  * The grant is a state change, so it is a SEPARATE POST form (button_to)
+    rendered inside the frame once the selection is complete. button_to puts
+    the CSRF token in the request body, never a URL. It lives OUTSIDE the GET
+    form (nesting <form>s is invalid) and reaches the cascade's inputs via the
+    HTML `form:` attribute, which also lets the GET stay idempotent so the
+    picker still works while impersonating (read-only), where a POST would 403.
+%>
+<%= form_with url: new_scoped_role_assignment_path, method: :get, id: "cs-cascade",
+      data: { turbo_frame: "cascade" }, class: "cs-picker" do %>
+  <p>
+    <%= label_tag :role_id, "Role" %>
+    <%= select_tag :role_id,
+          options_from_collection_for_select(@roles, :id, :name, params[:role_id]),
+          data: { current_scope_autosubmit: true } %>
+  </p>
+  <% if @bulk_subjects.any? %>
+    <p>
+      <span class="cs-label" id="cs_bulk_subjects_label">Subjects</span>
+      <span class="cs-hint" aria-labelledby="cs_bulk_subjects_label">
+        Granting to <strong><%= @bulk_subjects.size %></strong>:
+        <%= @bulk_subjects.map { |s| current_scope_subject_label(s) }.to_sentence %>
+      </span>
+      <% @bulk_subjects.each do |s| %>
+        <%= hidden_field_tag "subject_gids[]", s.to_gid.to_s %>
+      <% end %>
+    </p>
+  <% else %>
+    <p>
+      <%= label_tag :subject_gid, "Subject" %>
+      <%= select_tag :subject_gid,
+            options_for_select(@subjects.map { |s| [ current_scope_subject_label(s), s.to_gid.to_s ] },
+                               params[:subject_gid]),
+            data: { current_scope_autosubmit: true } %>
+    </p>
+  <% end %>
+<% end %>
+
+<turbo-frame id="cascade">
+  <% if @scopeable.empty? %>
+    <p class="cs-alert cs-picker-empty">
+      No pickable resource types yet. Add
+      <code>include CurrentScope::Scopeable</code> to a host model to make its
+      records selectable here.
+    </p>
+  <% else %>
+    <%
+      type_options = @scopeable.map { |model| [ model.model_name.human, model.name ] }
+      # A deep-linked type may not itself be Scopeable — keep it selectable.
+      if @resource_type && type_options.none? { |(_, name)| name == @resource_type.name }
+        type_options.unshift([ @resource_type.model_name.human, @resource_type.name ])
+      end
+    %>
+    <p>
+      <%= label_tag :resource_type, "Resource type" %>
+      <%= select_tag :resource_type,
+            options_for_select(type_options, @resource_type&.name),
+            include_blank: "— choose a type —", form: "cs-cascade",
+            data: { current_scope_autosubmit: true } %>
+    </p>
+
+    <% if @resource_type %>
+      <% if @records.blank? && params[:q].blank? %>
+        <p class="cs-hint cs-picker-empty">
+          No <%= @resource_type.model_name.human.pluralize.downcase %> to pick from yet.
+        </p>
+      <% else %>
+        <% if @searchable %>
+          <p>
+            <%= label_tag :q, "Search records" %>
+            <%= search_field_tag :q, params[:q], placeholder: "Filter by label",
+                  form: "cs-cascade", data: { current_scope_autosubmit: true } %>
+          </p>
+        <% end %>
+        <p>
+          <%= label_tag :resource_gid, "Record" %>
+          <%
+            record_options = (@records || []).map { |record| [ current_scope_label(record), record.to_gid.to_s ] }
+            # Keep a deep-linked record selectable even if it fell outside the
+            # scanned window.
+            if @resource && record_options.none? { |(_, gid)| gid == @resource.to_gid.to_s }
+              record_options.unshift([ current_scope_label(@resource), @resource.to_gid.to_s ])
+            end
+          %>
+          <%= select_tag :resource_gid,
+                options_for_select(record_options, params[:resource_gid] || @resource&.to_gid&.to_s),
+                include_blank: "— choose a record —", form: "cs-cascade",
+                data: { current_scope_autosubmit: true } %>
+          <% if @searchable && params[:q].present? %>
+            <%# Keyed off the raw SEARCH results, not record_options — a
+                deep-linked @resource is prepended to the options even when the
+                query matched nothing, and must not fake a "matches shown". %>
+            <% if @records.blank? %>
+              <span class="cs-hint cs-picker-empty">
+                No records match “<%= params[:q] %>” — try a different search.
+              </span>
+            <% else %>
+              <span class="cs-hint">
+                Showing up to <%= CurrentScope::ScopedRoleAssignmentsController::DISPLAY_LIMIT %> matches — refine the search to narrow.
+              </span>
+            <% end %>
+          <% end %>
+        </p>
+      <% end %>
+    <% end %>
+
+    <p class="cs-picker-actions">
+      <%# No-JS / no-Turbo fallback: reload the cascade with the current picks. %>
+      <%= submit_tag "Show records", name: nil, form: "cs-cascade", class: "cs-picker-refresh" %>
+      <%# Grant only a complete selection. Every cascade control autosubmits, so
+          params mirror the live picks — the button never posts a stale value. %>
+      <% ready = params[:role_id].present? && params[:resource_gid].present? %>
+      <% if @bulk_subjects.any? %>
+        <% if ready %>
+          <%= button_to "Grant to #{@bulk_subjects.size} #{'subject'.pluralize(@bulk_subjects.size)}",
+                scoped_role_assignments_path, method: :post,
+                params: { role_id: params[:role_id], resource_gid: params[:resource_gid],
+                          subject_gids: @bulk_subjects.map { |s| s.to_gid.to_s } },
+                data: { turbo_frame: "_top" }, class: "cs-btn-primary" %>
+        <% end %>
+      <% elsif ready && params[:subject_gid].present? %>
+        <%= button_to "Grant scoped role", scoped_role_assignments_path, method: :post,
+              params: { role_id: params[:role_id], subject_gid: params[:subject_gid],
+                        resource_gid: params[:resource_gid] },
+              data: { turbo_frame: "_top" }, class: "cs-btn-primary" %>
+      <% end %>
+    </p>
+  <% end %>
+</turbo-frame>

data/app/views/current_scope/shared/access_denied.html.erb

@@ -0,0 +1,30 @@
+<%# The engine's front-door 403. Deliberately NOT rendered in the console
+    layout: that layout is a sidebar of links to Roles / Subjects / Events, and
+    showing the console chrome to someone who cannot open any of it reads as
+    "you're in" while every link refuses. Standalone page, engine stylesheet, no
+    navigation offered that isn't there. %>
+<!DOCTYPE html>
+<html lang="en"<%= " data-cs-theme=\"#{cookies[:current_scope_theme]}\"".html_safe if %w[light dark].include?(cookies[:current_scope_theme]) %>>
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Access denied — CurrentScope</title>
+  <%= csp_meta_tag %>
+  <%= stylesheet_link_tag "current_scope/application", media: "all" %>
+</head>
+<body>
+  <main class="cs-card cs-denied">
+    <h1>This area needs a full-access role</h1>
+    <p>
+      The authorization console is where roles and permissions are granted, so it
+      can't be gated by a permission you could be granted — it's open only to
+      subjects holding a role marked <strong>full access</strong>.
+    </p>
+    <p class="cs-hint">
+      If you should have it, ask someone who already does to grant you a
+      full-access role. If nobody has one yet, it's granted from the console or a
+      rake task — see the CurrentScope README's bootstrap section.
+    </p>
+  </main>
+</body>
+</html>