current_scope 0.3.1 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b43df7725417ffd6088533edb72032fd26a4bad9e8eefb6a56fa52d9a63a29e3
-  data.tar.gz: b77bb0cdb38b19efd19ac754666d23abe14220ae3a0b70566f217eda26b016cf
+  metadata.gz: 12a83f4dca4237516e79cd7b518eb943b6ba5ba8cd296b49e287859d5d7cc62d
+  data.tar.gz: 1a1d2cfcefbdee379195f6fd37140b7df0037fa578f9452a11043e71719f2df3
 SHA512:
-  metadata.gz: dedf447ca858342304bbd1dddeff2187291bd78780271f01328e9d328b090081f3c1bc293639dc4e2855b719ba9a61f4d49befac17673cb7f44dca10d2405037
-  data.tar.gz: 56cd899f391607a79bf550fb416f961911b9c192e6a430bceedc3a92fabcab251bb0cad7aeabce20f4b10c9463939f0bd6afa6e55d7b535d6fbd047ea9fc426d
+  metadata.gz: 8f163e65876ed8a70eed33f4839b7d46827e73541c17543a67747ae4c35c6d3d9da281e023b83b8a733ca60d501f25c073d2bce3db7611cdfcc3f3d6b43e800b
+  data.tar.gz: 56fc9d5aab6a9babc3e8d9d0163274768c747a51e5378c625da34435a2e2ac6d00ba170cb2e6f50fa10f236b42c2a02fa68d23fc02a98e9bd9f2a40064083267

data/README.md

@@ -23,7 +23,12 @@
 > Kick the tyres, build a spike, tell us what breaks. Don't put it in front of
 > real users yet.
 
-**Website:** [davidteren.github.io/current_scope](https://davidteren.github.io/current_scope/) — overview, the resolver, and quickstart at a glance.
+**Website:** [davidteren.github.io/current_scope](https://davidteren.github.io/current_scope/) —
+overview, quickstart, the
+[separation-of-duties guide](https://davidteren.github.io/current_scope/separation-of-duties.html),
+the security checklist, and
+[copy-paste prompts for AI agents](https://davidteren.github.io/current_scope/ai-agents.html).
+Source lives in [`docs/site/`](docs/site/).
 
 **Authorization as data you edit in a UI, not rules you hardcode and redeploy —
 with one ambient context that makes `allowed_to?` work identically in
@@ -120,6 +125,9 @@ end
 > — callback ordering vs. your authentication, the Devise recipe, the
 > `skip_before_action` fail-open trap, hybrid HTML+API grants, and a rollout
 > ladder. The short version is below.
+>
+> **Shipping?** Read the [Security & production checklist](docs/SECURITY-CHECKLIST.md)
+> first — excluded controllers, the 403/404 record oracle, and the pre-ship tick list.
 
 
 The gate is fail-closed, so the line you just added denies **everything** until
@@ -158,8 +166,9 @@ Total: 457 would-be denials across 2 subject(s).
 
 That *is* your grant-seeding work, in the shape of the role grid you need to
 build: every subject who'd have been refused, what they were missing, and how
-badly. Seed the roles it names, watch the list empty out, then flip to
-`:enforce`. Each step is one line back, and nobody gets a 403 while you learn.
+badly. Seed the roles it names, re-exercise, and flip to `:enforce` once newly
+exercised requests stop adding rows (the report reads the append-only
+ledger, so historical rows do not clear). Each step is one line back, and nobody gets a 403 while you learn.
 
 The rows are ordinary ledger events, so query them directly if you want
 something the task doesn't show:
@@ -176,7 +185,7 @@ else still refuses:
 | Still enforced in `:report` | Why it can't be relaxed |
 |---|---|
 | Separation-of-duties veto | Lifting it lets an initiator really approve their own record — a fraud action executed, not a role gap surfaced. |
-| SoD actions the veto *couldn't* run on | If an SoD action is gated without a record, the veto has no initiator to measure and is skipped — so the refusal that comes back says "not granted", not "SoD approved". Report mode won't speak for a rule nobody asked, and still refuses. (`config.warn_on_nil_sod_record` surfaces the misconfiguration behind it.) |
+| SoD actions the veto *couldn't* run on | If an SoD action is gated without a record, the veto has no initiator to measure and is skipped — so the refusal that comes back says "not granted", not "SoD approved". Report mode won't speak for a rule nobody asked, and still refuses — but it **logs the blind spot and records `access.sod_blind_spot`** (not `access.would_deny`; granting will not clear the 403). `rails current_scope:report` lists them separately. |
 | The management console | It's where grants are made. An observation flag that opened it would be a privilege escalation. |
 | Impersonation read-only gate | Runs before the permission check and answers to its own rule. |
 
@@ -380,6 +389,13 @@ class ReportsController < ApplicationController
 end
 ```
 
+The same hook has two foot-guns worth knowing before you ship: returning **nil**
+on an SoD member action silently skips the veto
+([§ Separation of duties](#separation-of-duties-opt-in)), and loading with
+`Model.find` means an unauthorized caller sees **403** for an existing id vs
+**404** for a missing one — a record-existence oracle
+([security checklist mitigation](docs/SECURITY-CHECKLIST.md#2-403-vs-404-leaks-which-records-exist)).
+
 ### Scopeable models
 
 `include CurrentScope::Scopeable` in a host model to list it in the scoped-role
@@ -487,7 +503,9 @@ Holding `bypass_sod` on a flagged, self-initiated record **is** the
 authorization for the SoD action — the bypass grants the action, it doesn't
 merely lift the veto and then re-check for a separate `approve` grant.
 `bypass_sod` must **not** appear in `sod_actions` (it isn't an SoD action); the
-engine raises if it does, to prevent a re-entrant loop.
+engine raises **at boot** if it does (and again at decision time as defense in
+depth), so a re-entrant pairing fails the deploy instead of 500ing on the first
+real break-glass attempt.
 
 When a bypass lifts the veto, the engine records exactly one append-only
 `sod.bypassed` audit event at the enforcement gate (never on advisory
@@ -556,10 +574,16 @@ additions. Members normalize to strings on assignment, so `%i[index]` works.
 
 The **audit ledger** is controlled by `config.audit` — tri-state
 `false | true | :strict`. `false` records nothing; `true` (the default) records
-every authorization change and degrades gracefully (skip + warn once) if the
-events table isn't migrated; `:strict` **raises** on a missing events table so
-an audit-mandatory app never commits an unaudited change (the mutation rolls
-back).
+authorization changes made through the **management UI**, the **impersonation
+boundary**, and **`CurrentScope.grant!`** (including the rake task and seeds
+bootstrap path — self-attributed, `details.source = "bootstrap"`), and degrades
+gracefully (skip + warn once) if the events table isn't migrated; `:strict`
+**raises** on a missing events table so an audit-mandatory app never commits an
+unaudited change (the mutation rolls back). Direct `RoleAssignment` /
+`ScopedRoleAssignment` writes and the test helpers (`grant_role!` /
+`grant_scoped_role!`) are **not** recorded — use `grant!` for bootstrap
+paths that need a ledger trail. UI events stamp `request_id` from
+`ActionDispatch::RequestId` via the Context hook.
 
 > **Note on the `!`:** despite the bang, `Event.record!` only guarantees
 > raise-on-failure under `:strict` (and for a missing actor). In the default
@@ -764,8 +788,16 @@ class ImpersonationsController < ApplicationController
 end
 ```
 
-Denials carry a machine-readable reason on `AccessDenied#reason`, surfaced on
-the response as the `X-Current-Scope-Reason` header:
+Denials raise `CurrentScope::AccessDenied` with stable accessors for branded
+403 pages and error trackers (prefer `#permission` over parsing `#message`):
+
+| Accessor | Meaning |
+|---|---|
+| `#permission` | denied `controller#action` key — the stable API. Defaults to the positional message when `permission:` is omitted |
+| `#message` | `StandardError` message. Gem raise sites pass the key as both message and permission; they can diverge if a caller passes an explicit `permission:` keyword |
+| `#reason` | machine-readable cause (also on `X-Current-Scope-Reason`) |
+| `#record` | the record under decision when the gate had one; **nil** on collection / impersonation-gate denials |
+| `#subject` | effective subject when known |
 
 | Reason | Means |
 |---|---|
@@ -776,12 +808,57 @@ the response as the `X-Current-Scope-Reason` header:
 | `impersonation_gate` | a mutation while impersonating, which is read-only |
 | `not_full_access` | the management UI, which only full-access subjects enter |
 
-Every denial routes through one method, so a refusal can't reach a client
-without its reason. A **host** denial is a bodyless `403` — the reason header is
-the signal, and the gem won't render into your app's response contract. The
-engine's own management UI is the exception: it renders a short page saying a
-full-access role is required, because the person reading that one is an admin
-looking at a browser.
+Guard and MutationGuard denials route through one method
+(`current_scope_denied`), so by default a refusal on a Guard-wrapped controller
+gets its reason header (and the denial log line below). "By default" matters: a
+host `rescue_from CurrentScope::AccessDenied` registered after the include
+**replaces** that method, and with it the header and the log line (see the last
+example in this section). A **host** denial is a
+bodyless `403` by default — the reason header is the signal, and the gem won't
+render into your app's response contract. The engine's own management UI is the
+exception: it overrides the body seam to render a short page saying a full-access
+role is required, because the person reading that one is an admin looking at a
+browser.
+
+The engine also registers `CurrentScope::AccessDenied → :forbidden` in
+`ActionDispatch` rescue responses (only if the host has not already mapped that
+class), so a denial that **escapes** Guard (PORO re-raise, Context-only
+controller) is still HTTP **403**, not 500. That path is status-only — no
+`X-Current-Scope-Reason` header and no denial log line unless something in your
+stack writes them. On the Guard path, rescued denials log one INFO line
+mirroring the header:
+
+```
+[CurrentScope] denied reports#approve (no_grant) → 403
+```
+
+INFO is intentional so production captures denials without raising the log
+level; high-volume anonymous probes will grow the log — filter
+`[CurrentScope] denied` if that is noise for your operators.
+
+**Branded host 403 — prefer the body seam** so the header and log stay intact:
+
+```ruby
+# Keeps X-Current-Scope-Reason + the denial log; only the body changes.
+def current_scope_render_denied(reason)
+  render "errors/forbidden", status: :forbidden, locals: { reason: reason }
+end
+```
+
+Need `#permission` / `#record` / `#subject` on the page? A host `rescue_from`
+registered **after** `include CurrentScope::Guard` wins and **replaces**
+`current_scope_denied` — set the header yourself (or you lose it), and note
+this example restores only the header; write your own log line if you need
+the denial telemetry:
+
+```ruby
+rescue_from CurrentScope::AccessDenied do |e|
+  response.headers["X-Current-Scope-Reason"] = e.reason.to_s if e.reason
+  render "errors/forbidden",
+         status: :forbidden,
+         locals: { permission: e.permission, reason: e.reason, record: e.record }
+end
+```
 
 **View/gate disagreement is by design.** `allowed_to?` is HTTP-ignorant: it
 still returns `true` for a permission the subject genuinely holds, even though

data/app/assets/stylesheets/current_scope/application.css

@@ -619,6 +619,30 @@ input[type="checkbox"], input[type="radio"] {
 .cs-chip-label { padding: 0.125rem 0.25rem 0.125rem 0.6875rem; align-self: center; }
 .cs-chip form { display: flex; margin: 0; }
 
+/* #90 — orphaned scoped grants (resource deleted) still list as chips/rows but
+   open nothing on collection reads since #65. Mark them so operators do not
+   trust the grant. Use .cs-inert-badge — NOT .cs-badge (topbar "full access"). */
+.cs-chip--inert {
+  border-style: dashed;
+  opacity: 0.85;
+  background: var(--cs-surface-2);
+}
+.cs-row--inert td { color: var(--cs-muted); }
+.cs-inert-badge {
+  display: inline-block;
+  font-size: 0.6875rem;
+  font-weight: 600;
+  letter-spacing: 0.02em;
+  text-transform: uppercase;
+  padding: 0.05rem 0.35rem;
+  border-radius: 0.25rem;
+  margin-left: 0.35rem;
+  vertical-align: middle;
+  color: var(--cs-danger, oklch(0.45 0.14 25));
+  background: color-mix(in oklch, var(--cs-danger, oklch(0.55 0.18 25)) 12%, transparent);
+  border: 1px solid color-mix(in oklch, var(--cs-danger, oklch(0.55 0.18 25)) 35%, transparent);
+}
+
 /* Revoke control — a clear, labeled × with a divider so it reads as a button. */
 .cs-chip-remove {
   border: none;

data/app/controllers/current_scope/application_controller.rb

@@ -32,8 +32,12 @@ module CurrentScope
     def require_full_access!
       return if CurrentScope.resolver.full_access?(CurrentScope::Current.user)
 
+      key = "#{controller_path}##{action_name}"
       raise CurrentScope::AccessDenied.new(
-        "#{controller_path}##{action_name}", reason: :not_full_access
+        key,
+        reason: :not_full_access,
+        permission: key,
+        subject: CurrentScope::Current.user
       )
     end
 

data/app/controllers/current_scope/roles_controller.rb

@@ -41,11 +41,12 @@ module CurrentScope
 
     def members
       @role = Role.find(params[:id])
-      # No polymorphic includes: eager-loading a stale/renamed subject_type or
-      # resource_type raises NameError. Lazy-load per row and label defensively
-      # in the view (current_scope_holder_* helpers), like the audit ledger does.
+      # No blanket polymorphic includes: stale subject_type/resource_type
+      # NameErrors at preload. Org holders stay lazy; scoped resources use the
+      # safe per-type preload (unresolvable types stay unloaded → inert label).
       @org_holders = RoleAssignment.where(role: @role).to_a
-      @scoped_holders = ScopedRoleAssignment.where(role: @role).to_a
+      @scoped_holders = ScopedRoleAssignment.where(role: @role).includes(:role).to_a
+      ScopedRoleAssignment.preload_resolvable_resources!(@scoped_holders)
 
       # Exclude via a subquery, not a plucked Ruby array, so a role with many
       # holders doesn't build a huge NOT IN bind list.

data/app/controllers/current_scope/subjects_controller.rb

@@ -19,9 +19,12 @@ module CurrentScope
       @roles = Role.order(:name)
       @assignments = RoleAssignment.where(subject: @subjects)
                                    .index_by { |a| [ a.subject_type, a.subject_id ] }
-      @scoped = ScopedRoleAssignment.where(subject: @subjects)
-                                    .includes(:role, :resource)
-                                    .group_by { |a| [ a.subject_type, a.subject_id ] }
+      # Safe polymorphic resource preload (resolvable types only) — full
+      # includes(:resource) NameErrors on a stale resource_type and 500s the
+      # page; skip-unresolvable + label as inert instead (#90 / PR #104).
+      scoped_rows = ScopedRoleAssignment.where(subject: @subjects).includes(:role).to_a
+      ScopedRoleAssignment.preload_resolvable_resources!(scoped_rows)
+      @scoped = scoped_rows.group_by { |a| [ a.subject_type, a.subject_id ] }
     end
 
     private

data/app/helpers/current_scope/application_helper.rb

@@ -89,8 +89,14 @@ module CurrentScope
     end
 
     def current_scope_holder_resource_label(scoped_assignment)
+      if scoped_assignment.respond_to?(:orphaned_resource?) && scoped_assignment.orphaned_resource?
+        return "#{scoped_assignment.resource_type} ##{scoped_assignment.resource_id} (unavailable — inert)"
+      end
+
       current_scope_label(scoped_assignment.resource)
     rescue NameError, ActiveRecord::RecordNotFound
+      # Labeler failed — not proof the resource is orphaned. Raw type#id only
+      # (orphaned_resource? above owns the inert wording) — PR #104 review.
       "#{scoped_assignment.resource_type} ##{scoped_assignment.resource_id}"
     end
 

data/app/models/current_scope/event.rb

@@ -33,30 +33,45 @@ module CurrentScope
       #                               details: { name: "Owner" })
       #
       # Raises ConfigurationError (loud, matching the SoD posture) when there is
-      # no ambient actor. Silent no-op (returns nil) when config.audit is false.
-      def record!(event:, target:, details: nil)
+      # no ambient actor and no explicit actor: override. Silent no-op (returns
+      # nil) when config.audit is false.
+      #
+      # Optional actor:/subject: overrides (#30): when non-nil they replace the
+      # ambient reads so bootstrap paths (grant!, rake, seeds) can self-attribute
+      # without a controller. Omit both for byte-for-byte ambient behavior.
+      # Pin BOTH on a self-attributed grant so an ambient Current.user cannot
+      # leak into subject and mis-record the row as impersonation.
+      def record!(event:, target:, details: nil, actor: nil, subject: nil)
         return unless CurrentScope.config.audit
 
-        actor = CurrentScope::Current.actor
+        actor ||= CurrentScope::Current.actor
         if actor.nil?
           raise CurrentScope::ConfigurationError,
                 "CurrentScope::Event.record! has no actor — CurrentScope::Current.actor is nil. " \
                 "Set the ambient context (the controller hook, or with_current_user in tests) before recording."
         end
 
-        # Current.user is the effective subject; fall back to actor so subject
-        # is never nil (it equals actor whenever not impersonating).
-        subject = CurrentScope::Current.user || actor
+        # Explicit subject wins; else Current.user; else actor (never nil when
+        # actor is set, equals actor when not impersonating).
+        subject ||= CurrentScope::Current.user || actor
 
-        create!(
-          event: event.to_s,
-          actor: actor.to_gid.to_s,
-          subject: subject.to_gid.to_s,
-          target: target.to_gid.to_s,
-          target_label: label_for(target),
-          details: details,
-          request_id: CurrentScope::Current.request_id
-        )
+        # requires_new: on PostgreSQL a StatementInvalid aborts the *whole*
+        # open transaction even if rescued — so a missing events table would
+        # poison grant!/controller mutation transactions that wrap record!.
+        # A savepoint isolates the audit write: default audit=true degrades
+        # and the assignment commits; :strict re-raises and rolls the outer
+        # mutation back (PR #102 review).
+        Event.transaction(requires_new: true) do
+          create!(
+            event: event.to_s,
+            actor: actor.to_gid.to_s,
+            subject: subject.to_gid.to_s,
+            target: target.to_gid.to_s,
+            target_label: label_for(target),
+            details: details,
+            request_id: CurrentScope::Current.request_id
+          )
+        end
       rescue ActiveRecord::StatementInvalid => e
         raise unless missing_events_table?(e)
 

data/app/models/current_scope/scoped_role_assignment.rb

@@ -2,6 +2,10 @@ module CurrentScope
   # A role held on ONE specific record: "Editor of Project #7" grants nothing
   # on Project #8. Never touches the subject's org-wide role — the two are
   # independent axes.
+  #
+  # Rows survive host resource destruction by design (polymorphic, no
+  # dependent:). Since #65 those orphan grants open nothing (empty list = 403)
+  # but still rendered like live access until labeled (#90).
   class ScopedRoleAssignment < ApplicationRecord
     belongs_to :role
     belongs_to :subject, polymorphic: true
@@ -10,5 +14,52 @@ module CurrentScope
     validates :role_id, uniqueness: {
       scope: [ :subject_type, :subject_id, :resource_type, :resource_id ]
     }
+
+    # Batch-load polymorphic resources for resolvable types only. A global
+    # includes(:resource) NameErrors when any resource_type is stale; this
+    # constantizes per type and skips unresolvable ones so they stay lazy
+    # and orphaned_resource? labels them inert (#90 / PR #104 review).
+    def self.preload_resolvable_resources!(assignments)
+      list = Array(assignments)
+      return list if list.empty?
+
+      list.group_by(&:resource_type).each do |type, rows|
+        next if type.blank?
+
+        klass =
+          begin
+            type.constantize
+          rescue NameError
+            next
+          end
+        next unless klass.respond_to?(:where)
+
+        records = klass.where(id: rows.map(&:resource_id).uniq).index_by { |r| r.id }
+        rows.each do |row|
+          assoc = row.association(:resource)
+          assoc.target = records[row.resource_id]
+          assoc.loaded!
+        end
+      end
+
+      list
+    end
+
+    # True when the pointed-at resource is gone (deleted row or unresolvable
+    # type). The grant is inert for authorization (#65) but still a console row.
+    # Memoized: views call this plus the label helper once each; a reset-every-
+    # call would re-query the resource twice per row (PR #104 cubic follow-up).
+    def orphaned_resource?
+      return @orphaned_resource if defined?(@orphaned_resource)
+
+      @orphaned_resource =
+        if resource_id.blank?
+          false
+        else
+          resource.nil?
+        end
+    rescue NameError, ActiveRecord::RecordNotFound
+      @orphaned_resource = true
+    end
   end
 end

data/app/views/current_scope/roles/members.html.erb

@@ -77,12 +77,24 @@
         <% @scoped_holders.each do |sra| %>
           <% who = current_scope_holder_subject_label(sra) %>
           <% what = current_scope_holder_resource_label(sra) %>
-          <tr>
+          <% orphaned = sra.orphaned_resource? %>
+          <tr id="scoped_holder_<%= sra.id %>"
+              class="cs-scoped-holder<%= ' cs-row--inert' if orphaned %>">
             <td><%= who %></td>
-            <td><%= what %></td>
             <td>
-              <% revoke_prompt = "Revoke #{@role.name} on #{what} from #{who}?" %>
-              <%= button_to "Revoke", scoped_role_assignment_path(sra), method: :delete,
+              <%= what %>
+              <% if orphaned %>
+                <span class="cs-inert-badge"
+                      title="This resource no longer resolves; the grant opens nothing on collection reads">inert</span>
+              <% end %>
+            </td>
+            <td>
+              <% revoke_prompt = orphaned ?
+                    "Remove inert scoped grant (resource unavailable) for #{who}?" :
+                    "Revoke #{@role.name} on #{what} from #{who}?" %>
+              <%= button_to (orphaned ? "Remove inert" : "Revoke"),
+                    scoped_role_assignment_path(sra), method: :delete,
+                    id: "scoped_revoke_#{sra.id}",
                     class: "cs-btn", form: { data: { cs_confirm: revoke_prompt } },
                     data: { turbo_confirm: revoke_prompt } %>
             </td>

data/app/views/current_scope/subjects/index.html.erb

@@ -63,7 +63,9 @@
           <select> listing all role names, which would match every query. %>
       <% org_role_name = @roles.find { |r| r.id == @assignments[key]&.role_id }&.name %>
       <% filter_text = [ label, org_role_name,
-                         *(@scoped[key] || []).map { |sra| "#{sra.role.name} #{current_scope_label(sra.resource)}" } ].compact.join(" ") %>
+                         *(@scoped[key] || []).map { |sra|
+                           "#{sra.role.name} #{current_scope_holder_resource_label(sra)}"
+                         } ].compact.join(" ") %>
       <tr data-cs-row data-cs-filter-text="<%= filter_text %>">
         <td class="cs-select-cell">
           <input type="checkbox" data-cs-select value="<%= subject.to_gid %>"
@@ -85,14 +87,22 @@
         </td>
         <td>
           <% (@scoped[key] || []).each do |sra| %>
-            <span class="cs-chip">
-              <span class="cs-chip-label"><%= sra.role.name %> of <%= current_scope_label(sra.resource) %></span>
-              <% revoke_prompt = "Revoke #{sra.role.name} on #{current_scope_label(sra.resource)}?" %>
+            <% resource_label = current_scope_holder_resource_label(sra) %>
+            <% orphaned = sra.orphaned_resource? %>
+            <span class="cs-chip cs-scoped-chip<%= ' cs-chip--inert' if orphaned %>" id="scoped_chip_<%= sra.id %>">
+              <span class="cs-chip-label">
+                <%= sra.role.name %> of <%= resource_label %>
+                <% if orphaned %><span class="cs-inert-badge">inert</span><% end %>
+              </span>
+              <% revoke_prompt = orphaned ?
+                    "Remove inert scoped grant (#{resource_label})?" :
+                    "Revoke #{sra.role.name} on #{resource_label}?" %>
               <%= button_to "×", scoped_role_assignment_path(sra), method: :delete,
                     class: "cs-chip-remove",
-                    title: "Revoke this scoped role",
+                    id: "scoped_chip_revoke_#{sra.id}",
+                    title: (orphaned ? "Remove inert scoped grant" : "Revoke this scoped role"),
                     form: { data: { cs_confirm: revoke_prompt } },
-                    aria: { label: "Revoke #{sra.role.name} on #{current_scope_label(sra.resource)}" },
+                    aria: { label: (orphaned ? "Remove inert #{sra.role.name} grant on #{resource_label}" : "Revoke #{sra.role.name} on #{resource_label}") },
                     data: { turbo_confirm: revoke_prompt } %>
             </span>
           <% end %>

data/lib/current_scope/configuration.rb

@@ -106,6 +106,8 @@ module CurrentScope
     # controllers out of the permission grid. An excluded controller cannot be
     # granted, so it must also skip the gate
     # (skip_before_action :current_scope_check!) — Guard raises otherwise.
+    # Skipping the gate leaves the controller ungated by CurrentScope — protect
+    # it with your own authorization (e.g. require_admin!). See docs/SECURITY-CHECKLIST.md.
     attr_accessor :excluded_controllers
 
     # Class the management UI's controllers inherit from, so they pick up the
@@ -492,6 +494,43 @@ module CurrentScope
       @allow_mutations_while_impersonating = value
     end
 
+    # Action segment of sod_bypass_permission — bare name or "controller#action".
+    # Shared by boot validation and the resolver's recursion guard so the two
+    # never normalize differently (#40). Uses split("#", -1) like
+    # PermissionCatalog#bypass_action: plain split("#").last turns "reports#"
+    # into "reports" (trailing empty dropped) and multi-hash values into the
+    # wrong last segment — false conflicts or missed recursion guards.
+    # Malformed shapes return nil (no false conflict); the catalog still raises
+    # loudly when allow_sod_bypass is on and the key is malformed.
+    def sod_bypass_action
+      segments = sod_bypass_permission.to_s.split("#", -1)
+      return if segments.empty? || segments.size > 2 || segments.any?(&:blank?)
+
+      segments.last
+    end
+
+    # True when the break-glass bypass permission is also listed in sod_actions.
+    # That pairing would re-enter the SoD step on every bypass check and stack
+    # overflow. Never valid in any environment (#40).
+    def sod_bypass_permission_conflicts_with_sod_actions?
+      action = sod_bypass_action
+      action.present? && sod_actions.include?(action)
+    end
+
+    # Boot-time config invariants. Wired from Engine#after_initialize after the
+    # host initializer has finalized both fields. Extensible seam for future
+    # multi-field checks; today only the bypass-in-sod_actions recursion rule.
+    def validate!
+      return unless sod_bypass_permission_conflicts_with_sod_actions?
+
+      action = sod_bypass_action
+      raise ConfigurationError,
+            "config.sod_bypass_permission (#{sod_bypass_permission.inspect}) is the " \
+            "action #{action.inspect}, which is also in config.sod_actions. The bypass " \
+            "permission must not be an SoD action — it would recurse. Remove " \
+            "#{action.inspect} from sod_actions."
+    end
+
     private
 
     # The env var's VALUE means what it says — presence alone is not consent.

data/lib/current_scope/context.rb

@@ -23,6 +23,11 @@ module CurrentScope
       # falls back to the subject. Only resolve when the host opts in.
       actor_method = CurrentScope.config.actor_method
       CurrentScope::Current.actor = resolve_current_scope_subject(actor_method) if actor_method
+
+      # Correlation for the audit ledger (#30). ActionDispatch::RequestId runs
+      # ahead of app before_actions; job/console contexts never enter this hook
+      # and leave request_id nil by design.
+      CurrentScope::Current.request_id = request.request_id
     end
 
     def resolve_current_scope_subject(method)

data/lib/current_scope/engine.rb

@@ -2,6 +2,35 @@ module CurrentScope
   class Engine < ::Rails::Engine
     isolate_namespace CurrentScope
 
+    # An AccessDenied that escapes any Guard rescue (PORO, Context-only
+    # controller, re-raise) must 403, not 500. Never turns a deny into an
+    # allow — the exception already blocked the action (#39).
+    #
+    # ||= so a host that already set this mapping (e.g. :not_found to hide
+    # existence) in config/application.rb is not clobbered. before:
+    # action_dispatch.configure so ExceptionWrapper.rescue_responses picks the
+    # entry up when it merge!s the config hash.
+    initializer "current_scope.rescue_responses", before: "action_dispatch.configure" do |app|
+      app.config.action_dispatch.rescue_responses["CurrentScope::AccessDenied"] ||= :forbidden
+    end
+
+    # Belt for Rails upgrades: if action_dispatch.configure is renamed/reordered
+    # and the config merge is missed, still pin the class map. Use key? — the
+    # ExceptionWrapper hash defaults missing keys to :internal_server_error
+    # (truthy), so ||= would never write.
+    initializer "current_scope.rescue_responses_apply", after: "action_dispatch.configure" do
+      map = ActionDispatch::ExceptionWrapper.rescue_responses
+      map["CurrentScope::AccessDenied"] = :forbidden unless map.key?("CurrentScope::AccessDenied")
+    end
+
+    # Cross-field config invariants (e.g. bypass permission ∉ sod_actions) must
+    # run AFTER the host initializer has assigned every field — a writer on
+    # either attr alone is order-dependent. once, not on to_prepare (config
+    # does not change on code reload). #40.
+    config.after_initialize do
+      CurrentScope.config.validate!
+    end
+
     # Routes (and therefore the derived permission catalog) can change on
     # every code reload in development, and reloaded host models must re-register
     # as scopeable rather than pile up stale/duplicate entries. Both reset here,

data/lib/current_scope/guard.rb

@@ -115,7 +115,9 @@ module CurrentScope
         raise CurrentScope::ConfigurationError,
               "\"#{permission}\" is not in the permission catalog (excluded_controllers " \
               "or not routed). Either stop excluding it, or skip the gate here with " \
-              "skip_before_action :current_scope_check!."
+              "skip_before_action :current_scope_check!. Skipping the gate leaves this " \
+              "controller ungated by CurrentScope — protect it with your own " \
+              "authorization (e.g. require_admin!)."
       end
 
       record = resolve_current_scope_record
@@ -158,8 +160,19 @@ module CurrentScope
 
         return report_would_deny(permission, record) if report_only_denial?(reason, permission, record)
 
-
-        raise CurrentScope::AccessDenied.new(permission, reason: reason)
+        # Report mode still 403s the SoD blind spot (correct, fail-closed) but
+        # used to do so silently — no log, no ledger, invisible to
+        # current_scope:report. Diagnose before the raise so a retrofit host
+        # sees the mis-declared record hook they must fix (#73).
+        diagnose_report_sod_blind_spot(permission, record, reason)
+
+        raise CurrentScope::AccessDenied.new(
+          permission,
+          reason: reason,
+          permission: permission,
+          record: (record.equal?(NO_RECORD) ? nil : record),
+          subject: CurrentScope::Current.user
+        )
       end
 
       record_sod_bypass(permission, record) if reason == :sod_bypassed
@@ -233,6 +246,57 @@ module CurrentScope
       record_would_deny_event(permission, record)
     end
 
+    # #73: report mode refuses to *downgrade* an SoD blind-spot denial (the
+    # veto never ran), but must not 403 *silently*. Log the cause/fix and
+    # record a distinct ledger row — never access.would_deny, because granting
+    # the permission will not clear this 403 (the hook is the fix).
+    def diagnose_report_sod_blind_spot(permission, record, reason)
+      return unless CurrentScope.config.report_only?
+      return unless reason == :no_grant
+      # Ask the resolver (#74) — no second copy of the skip condition.
+      return unless sod_veto_blind_spot?(permission, record)
+
+      Rails.logger&.warn(
+        "[CurrentScope] report-only: DENIED #{permission.inspect} because the " \
+        "separation-of-duties veto could not run (no usable record for this " \
+        "action). This is NOT a missing grant — granting will not clear the 403. " \
+        "Declare current_scope_record to return the AR record on this member " \
+        "action (or remove the action from config.sod_actions if it is not " \
+        "meant to be four-eyes gated). See also rails current_scope:report " \
+        "(access.sod_blind_spot events)."
+      )
+      record_sod_blind_spot_event(permission, record)
+    end
+
+    def record_sod_blind_spot_event(permission, record)
+      subject = CurrentScope::Current.user
+      return if subject.nil?
+
+      target = record.equal?(NO_RECORD) ? nil : record
+      # Non-records (String params[:id], etc.) are not GlobalID targets.
+      target = nil unless target.respond_to?(:to_gid)
+
+      CurrentScope::Event.record!(
+        event: "access.sod_blind_spot",
+        target: target || subject,
+        details: {
+          permission: permission,
+          reason: "no_grant",
+          blind_spot: true,
+          fix: "declare current_scope_record for this SoD member action"
+        }
+      )
+    rescue StandardError => e
+      # Blind-spot path returns 403 next — do not claim the request was allowed
+      # or that a would_deny row was lost (PR #103 review).
+      warn_ledger_failure_once(
+        e,
+        event: "access.sod_blind_spot",
+        request_outcome: "The request was DENIED (403) — only the access.sod_blind_spot row is missing."
+      )
+      nil
+    end
+
     # R3: report mode NEVER raises — that is its whole promise, and it has to hold
     # regardless of audit posture or the state of the ledger.
     #
@@ -267,7 +331,11 @@ module CurrentScope
     rescue StandardError => e
       # ponytail: swallow and warn ONCE. An unrecordable observation is a lost
       # log line; a raise here is a 500 on a request report mode promised to pass.
-      warn_ledger_failure_once(e)
+      warn_ledger_failure_once(
+        e,
+        event: "access.would_deny",
+        request_outcome: "The request WAS allowed through — only the access.would_deny row is missing."
+      )
       nil
     end
 
@@ -283,13 +351,18 @@ module CurrentScope
     # fix for a missing table and otherwise reports the real error, because
     # telling someone with a dead connection to run migrations sends them after
     # the wrong problem.
-    def warn_ledger_failure_once(error)
+    #
+    # `event` / `request_outcome` are path-specific: would_deny allows the
+    # request; sod_blind_spot still 403s — the operator-facing text must not
+    # claim the wrong outcome (PR #103).
+    def warn_ledger_failure_once(error, event:, request_outcome:)
       return if CurrentScope::Guard.ledger_warning_emitted?
 
       CurrentScope::Guard.ledger_warning_emitted!
-      Rails.logger&.warn("[CurrentScope] report-only: #{ledger_failure_hint(error)} " \
-                         "The request WAS allowed through — only the access.would_deny " \
-                         "row is missing. This warns once per process.")
+      Rails.logger&.warn(
+        "[CurrentScope] report-only: #{ledger_failure_hint(error, event: event)} " \
+        "#{request_outcome} This warns once per process."
+      )
     end
 
     # ASKS Event whether this is the un-migrated-table case rather than pattern-
@@ -298,14 +371,14 @@ module CurrentScope
     # says why: it "would point operators at the wrong fix". A looser test here
     # reintroduced exactly that, telling someone their table was missing while
     # they were looking right at it. (#59 review)
-    def ledger_failure_hint(error)
+    def ledger_failure_hint(error, event:)
       if CurrentScope::Event.missing_events_table?(error)
-        "the current_scope_events table is missing, so would-be denials are not being " \
-        "recorded and `rails current_scope:report` will be empty. Run " \
+        "the current_scope_events table is missing, so #{event} rows are not being " \
+        "recorded and `rails current_scope:report` will be incomplete. Run " \
         "`rails current_scope:install:migrations && rails db:migrate`, or set " \
         "config.audit = false if you don't want the ledger."
       else
-        "could not record a would-be denial (#{error.class}: #{error.message.to_s.truncate(120)})."
+        "could not record #{event} (#{error.class}: #{error.message.to_s.truncate(120)})."
       end
     end
 
@@ -386,9 +459,22 @@ module CurrentScope
       return unless CurrentScope.config.warn_on_inert_scoped_grant
       return unless reason == :no_grant
       return unless record.equal?(NO_RECORD)
-      return unless CurrentScope.resolver.scoped_grant_exists?(
-        subject: CurrentScope::Current.user, permission: permission
-      )
+
+      # Diagnostics must not 500 the request (#74): a transient DB error inside
+      # scoped_grant_exists? is log-only, matching record_would_deny_event.
+      has_grant =
+        begin
+          CurrentScope.resolver.scoped_grant_exists?(
+            subject: CurrentScope::Current.user, permission: permission
+          )
+        rescue StandardError => e
+          Rails.logger&.warn(
+            "[CurrentScope] warn_on_inert_scoped_grant could not check scoped grants " \
+            "(#{e.class}: #{e.message}); skipping diagnostic for \"#{permission}\"."
+          )
+          false
+        end
+      return unless has_grant
 
       # Says only what the predicate proves. scoped_grant_exists? has no resource
       # filter — it can't have one, the missing record IS the bug — so it
@@ -481,16 +567,23 @@ module CurrentScope
 
     def nudge_on_nil_sod_record(permission, record)
       return unless CurrentScope.config.warn_on_nil_sod_record
-      # NO_RECORD counts: it IS the member-action-with-no-record case this nudge
-      # exists to catch, so it must not go quiet just because the Guard now
-      # labels that case instead of passing a bare nil.
-      return unless record.nil? || record.equal?(NO_RECORD)
-      return unless CurrentScope.config.sod_actions.include?(permission.split("#").last)
+      # Ask the resolver (#74) — do not re-derive "did the veto skip?". A private
+      # nil/NO_RECORD copy missed the commonest mistake: a hook returning
+      # params[:id] (a String). sod_veto_skipped? is the single definition.
+      gate_record = record.equal?(NO_RECORD) ? nil : record
+      return unless CurrentScope.resolver.sod_veto_skipped?(permission: permission, record: gate_record)
+
+      shape_hint =
+        if gate_record.nil?
+          "a nil record"
+        else
+          "a non-record (#{gate_record.class.name}) — often a hook returning params[:id]"
+        end
 
       Rails.logger&.warn(
-        "[CurrentScope] \"#{permission}\" is a separation-of-duties action but was gated with a " \
-        "nil record, so the SoD veto was skipped. If this is a member action, current_scope_record " \
-        "must return the record; if it's a collection action, this is expected."
+        "[CurrentScope] \"#{permission}\" is a separation-of-duties action but was gated with " \
+        "#{shape_hint}, so the SoD veto was skipped. If this is a member action, " \
+        "current_scope_record must return the AR record; if it's a collection action, this is expected."
       )
     end
   end

data/lib/current_scope/mutation_guard.rb

@@ -31,8 +31,12 @@ module CurrentScope
       return if CurrentScope.config.allow_mutations_while_impersonating
       return unless current_scope_impersonating?
 
+      key = "#{controller_path}##{action_name}"
       raise CurrentScope::AccessDenied.new(
-        "#{controller_path}##{action_name}", reason: :impersonation_gate
+        key,
+        reason: :impersonation_gate,
+        permission: key,
+        subject: CurrentScope::Current.user
       )
     end
 
@@ -55,6 +59,12 @@ module CurrentScope
     def current_scope_denied(exception = nil)
       reason = exception.respond_to?(:reason) ? exception.reason : nil
       response.headers["X-Current-Scope-Reason"] = reason.to_s if reason
+      # Mirror the header into the server log so log-based triage can distinguish
+      # no_grant from sod_veto without reading response headers (#39).
+      permission = exception.respond_to?(:permission) ? exception.permission : nil
+      Rails.logger&.info(
+        "[CurrentScope] denied #{permission || '(unknown)'} (#{reason || 'unknown'}) → 403"
+      )
       current_scope_render_denied(reason)
     end
 

data/lib/current_scope/resolver.rb

@@ -266,15 +266,11 @@ module CurrentScope
 
       # Re-entrancy is bounded ONLY because the bypass permission isn't itself an
       # SoD action (KTD-5) — the inner allowed? below returns at the SoD step
-      # without recursing. Enforce that invariant loudly rather than trusting the
-      # host to honor the doc comment: a bypass action in sod_actions would
-      # recurse to a SystemStackError.
-      bypass_action = CurrentScope.config.sod_bypass_permission.to_s.split("#").last
-      if CurrentScope.config.sod_actions.include?(bypass_action)
-        raise ConfigurationError,
-              "config.sod_bypass_permission (#{CurrentScope.config.sod_bypass_permission.inspect}) is the " \
-              "action #{bypass_action.inspect}, which is also in config.sod_actions. The bypass permission " \
-              "must not be an SoD action — it would recurse. Remove #{bypass_action.inspect} from sod_actions."
+      # without recursing. Boot validate! is the primary gate (#40); this raise
+      # is defense in depth for runtime-mutated config (tests reassign live).
+      # The conflict test lives on Configuration so boot and decide cannot drift.
+      if CurrentScope.config.sod_bypass_permission_conflicts_with_sod_actions?
+        CurrentScope.config.validate!
       end
 
       # Absent hook ⇒ this type never breaks glass (fail-closed, no raise).

data/lib/current_scope/version.rb

@@ -1,3 +1,3 @@
 module CurrentScope
-  VERSION = "0.3.1"
+  VERSION = "0.4.0"
 end

data/lib/current_scope.rb

@@ -14,9 +14,20 @@ require "current_scope/engine"
 
 module  CurrentScope
   # Raised when the resolver denies an action gated by Guard (or when the
-  # management UI is accessed without a full-access role). Carries an optional
-  # machine-readable reason, surfaced on the response as X-Current-Scope-Reason
-  # by current_scope_denied:
+  # management UI is accessed without a full-access role). Accessors:
+  #
+  #   #permission — denied key (stable API for branded 403s). Defaults to the
+  #                 positional message when permission: is omitted so legacy
+  #                 raise sites still populate it. Prefer this over #message.
+  #   #message    — StandardError message (positional arg). Gem raise sites pass
+  #                 the key as both message and permission; they can diverge if
+  #                 a caller passes an explicit permission: keyword.
+  #   #reason     — machine-readable cause (also on X-Current-Scope-Reason)
+  #   #record     — the record under decision when the gate had one; nil for
+  #                 collection / impersonation-gate denials
+  #   #subject    — effective subject when known; nil if none was in scope
+  #
+  # Reasons surfaced by current_scope_denied:
   #
   #   :sod_veto           — the record's initiator can't perform an SoD action on it
   #   :no_grant           — nothing granted the permission (the default deny)
@@ -34,11 +45,16 @@ module  CurrentScope
   # denial cannot exist that forgets its reason. (:sod_bypassed is the one
   # audited ALLOW, so it is set by the Guard rather than raised here.)
   class AccessDenied < StandardError
-    attr_reader :reason
+    attr_reader :reason, :permission, :record, :subject
 
-    def initialize(message = nil, reason: nil)
+    def initialize(message = nil, reason: nil, permission: nil, record: nil, subject: nil)
       super(message)
       @reason = reason
+      # permission defaults to message so older raise sites and branded-403
+      # recipes that only pass the key positionally still populate #permission.
+      @permission = permission || message
+      @record = record
+      @subject = subject
     end
   end
 
@@ -190,12 +206,43 @@ module  CurrentScope
     # Seeds the default Owner/Member roles ONLY on the default path — the name
     # promises "assign a role", so a caller granting an explicit role must not
     # get a full-access Owner row created in their roles table as a side effect.
+    #
+    # Audit (#30): when the org role actually changes, records one
+    # `org_role.assigned` / `org_role.changed` event, self-attributed to the
+    # grantee with `details.source = "bootstrap"`. Same-role re-grants are a
+    # no-op event-wise. Direct model writes and TestHelpers do not go through
+    # this path and are not recorded (documented intentionally).
     def grant!(subject, role: nil)
       role ||= begin
         seed_defaults!
         Role.find_by!(name: "Owner")
       end
-      RoleAssignment.find_or_initialize_by(subject: subject).tap { |a| a.update!(role: role) }
+
+      RoleAssignment.transaction do
+        assignment = RoleAssignment.find_or_initialize_by(subject: subject)
+        prior_role = assignment.persisted? ? assignment.role : nil
+        assignment.update!(role: role)
+
+        if prior_role.nil?
+          Event.record!(
+            event: "org_role.assigned",
+            target: subject,
+            details: { role: role.name, source: "bootstrap" },
+            actor: subject,
+            subject: subject
+          )
+        elsif prior_role.id != role.id
+          Event.record!(
+            event: "org_role.changed",
+            target: subject,
+            details: { from: prior_role.name, to: role.name, source: "bootstrap" },
+            actor: subject,
+            subject: subject
+          )
+        end
+
+        assignment
+      end
     end
 
     private

data/lib/generators/current_scope/install/templates/initializer.rb

@@ -110,8 +110,10 @@ CurrentScope.configure do |config|
 
   # Audit ledger — tri-state: false | true (default) | :strict.
   #   false   — no audit rows recorded.
-  #   true    — record every authorization change; if the events table hasn't
-  #             been migrated yet, degrade gracefully (skip + warn once).
+  #   true    — record management-UI mutations, impersonation boundary events,
+  #             and grant!/rake/seeds bootstrap grants; if the events table
+  #             hasn't been migrated yet, degrade gracefully (skip + warn once).
+  #             Direct model writes and test helpers are not recorded.
   #   :strict — a missing events table RAISES (rolling the mutation back), so an
   #             audit-mandatory app never commits an unaudited change.
   # config.audit = true
@@ -159,6 +161,9 @@ CurrentScope.configure do |config|
   # Controller paths (regexps) excluded from the permission grid. Excluded
   # controllers can't be granted, so they must also skip the gate with
   # skip_before_action :current_scope_check! — Guard raises otherwise.
+  # Skipping the gate leaves the controller ungated by CurrentScope — protect
+  # it with your own authorization (e.g. require_admin!). See
+  # https://github.com/davidteren/current_scope/blob/main/docs/SECURITY-CHECKLIST.md
   # config.excluded_controllers += [%r{\Awebhooks/}]
 
   # Controller the management UI inherits from (for host auth + before_actions).

data/lib/tasks/current_scope_tasks.rake

@@ -9,6 +9,14 @@ namespace :current_scope do
     subject = klass.find_by(id: id)
     abort "No #{klass} with id=#{id}" if subject.nil?
 
+    # grant! seeds Owner on the default path — warn on replacement even when
+    # the Owner row does not exist yet (first-time Owner creation).
+    prior = CurrentScope::RoleAssignment.find_by(subject: subject)&.role
+    if prior && prior.name != "Owner"
+      warn "WARNING: #{klass}##{subject.id} already held the #{prior.name.inspect} role — " \
+           "replacing it with full-access Owner."
+    end
+
     CurrentScope.grant!(subject)
     puts "Granted the full-access Owner role to #{klass}##{subject.id}."
   end
@@ -32,6 +40,10 @@ namespace :current_scope do
     begin
       rows = CurrentScope::Event.where(event: "access.would_deny")
                                 .pluck(:subject, :target_label, :details)
+      # #73: SoD blind-spot 403s are NOT would_deny (granting won't fix them).
+      # Surface them as a separate section so the survey is complete.
+      blind_rows = CurrentScope::Event.where(event: "access.sod_blind_spot")
+                                      .pluck(:subject, :target_label, :details)
     rescue ActiveRecord::StatementInvalid => e
       # Report mode without the migration records nothing (the ledger degrades and
       # warns once). Reaching for this summary is exactly how a host discovers
@@ -42,7 +54,7 @@ namespace :current_scope do
             "Run: bin/rails current_scope:install:migrations && bin/rails db:migrate"
     end
 
-    if rows.empty?
+    if rows.empty? && blind_rows.empty?
       # "No output" is indistinguishable from "the task is broken", and the two
       # likeliest causes are both SILENT: report mode never on, or audit off.
       # Name them — this is the first thing a host runs, and an unexplained blank
@@ -61,25 +73,42 @@ namespace :current_scope do
     # ponytail: group in Ruby, not SQL. `details` is a JSON column and querying
     # into it is adapter-specific; this is a rollout aid run by hand over a
     # transitional table, so portability beats a smarter query.
-    grouped = rows.group_by { |subject, _label, _details| subject }
-
-    puts "Would-be denials — grant these to stop them (most-denied first):"
-    puts
-
-    grouped.each do |subject_gid, subject_rows|
-      label = subject_rows.first[1].presence || subject_gid
-      puts "  #{label}#{org_role_suffix.call(subject_gid)}"
-
-      subject_rows
+    #
+    # Shared tally so would_deny and sod_blind_spot sections cannot drift on
+    # ordering / unknown-permission handling (PR #103 review).
+    print_permission_counts = lambda do |event_rows|
+      event_rows
         .group_by { |_s, _l, details| details.is_a?(Hash) ? details["permission"] : nil }
         .transform_values(&:count)
         .sort_by { |permission, count| [ -count, permission.to_s ] }
         .each { |permission, count| puts "    #{count.to_s.rjust(5)}x  #{permission || '(unknown)'}" }
+    end
+
+    unless rows.empty?
+      grouped = rows.group_by { |subject, _label, _details| subject }
 
+      puts "Would-be denials — grant these to stop them (most-denied first):"
       puts
+
+      grouped.each do |subject_gid, subject_rows|
+        label = subject_rows.first[1].presence || subject_gid
+        puts "  #{label}#{org_role_suffix.call(subject_gid)}"
+        print_permission_counts.call(subject_rows)
+        puts
+      end
+
+      puts "Total: #{rows.count} would-be denials across #{grouped.size} subject(s)."
     end
 
-    puts "Total: #{rows.count} would-be denials across #{grouped.size} subject(s)."
+    unless blind_rows.empty?
+      puts if rows.any?
+      puts "SoD blind-spot denials — NOT fixed by granting (declare current_scope_record):"
+      puts
+      print_permission_counts.call(blind_rows)
+      puts
+      puts "Total: #{blind_rows.count} blind-spot 403(s). Granting these permissions will not " \
+           "clear them — fix the record hook (or remove the action from config.sod_actions)."
+    end
   end
 
   desc "Inventory the routed controllers that provably never run the gate — the static " \

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: current_scope
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.4.0
 platform: ruby
 authors:
 - David Teren