nquery 0.1.0

data/app/models/nquery/chart.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Nquery
+  class Chart < ApplicationRecord
+    CHART_TYPES = %w[table number bar line area pie scatter].freeze
+
+    belongs_to :query, class_name: "Nquery::Query", optional: true
+    belongs_to :collection, class_name: "Nquery::Collection", optional: true
+    belongs_to :creator, class_name: "Nquery::User", optional: true
+    has_many :dashboard_cards, class_name: "Nquery::DashboardCard", dependent: :destroy
+    has_many :embed_tokens, -> { where(resource_type: "Nquery::Chart") },
+             class_name: "Nquery::EmbedToken", foreign_key: :resource_id, dependent: :destroy
+
+    accepts_nested_attributes_for :query
+
+    scope :active, -> { where(archived_at: nil) }
+    scope :archived, -> { where.not(archived_at: nil) }
+
+    validates :name, presence: true
+
+    def archived?
+      archived_at.present?
+    end
+
+    def archive!
+      update!(archived_at: Time.current)
+    end
+
+    def unarchive!
+      update!(archived_at: nil)
+    end
+
+    def chart_type
+      visualization["type"] || "bar"
+    end
+  end
+end

data/app/models/nquery/collection.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Nquery
+  class Collection < ApplicationRecord
+    KINDS = %w[root personal standard].freeze
+
+    belongs_to :parent, class_name: "Nquery::Collection", optional: true
+    belongs_to :owner, class_name: "Nquery::User", optional: true
+    has_many :children, class_name: "Nquery::Collection", foreign_key: :parent_id, dependent: :destroy
+    has_many :collection_permissions, class_name: "Nquery::CollectionPermission", dependent: :destroy
+    has_many :queries, class_name: "Nquery::Query", dependent: :nullify
+    has_many :charts, class_name: "Nquery::Chart", dependent: :nullify
+    has_many :dashboards, class_name: "Nquery::Dashboard", dependent: :nullify
+
+    validates :name, presence: true
+    validates :kind, inclusion: { in: KINDS }
+
+    scope :roots, -> { where(kind: "root") }
+    scope :shared, -> { where(kind: %w[root standard]) }
+    scope :active, -> { where(archived_at: nil) }
+    scope :archived, -> { where.not(archived_at: nil) }
+
+    def archived?
+      archived_at.present?
+    end
+
+    def archive!
+      update!(archived_at: Time.current)
+    end
+
+    def unarchive!
+      update!(archived_at: nil)
+    end
+  end
+end

data/app/models/nquery/collection_permission.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Nquery
+  class CollectionPermission < ApplicationRecord
+    ACCESS_LEVELS = %w[no_access view curate].freeze
+
+    belongs_to :group, class_name: "Nquery::Group"
+    belongs_to :collection, class_name: "Nquery::Collection"
+
+    validates :access_level, inclusion: { in: ACCESS_LEVELS }
+  end
+end

data/app/models/nquery/csv_upload.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Nquery
+  class CsvUpload < ApplicationRecord
+    STATUSES = %w[pending processing completed failed].freeze
+
+    belongs_to :creator, class_name: "Nquery::User", optional: true
+
+    validates :status, inclusion: { in: STATUSES }
+  end
+end

data/app/models/nquery/dashboard.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Nquery
+  class Dashboard < ApplicationRecord
+    belongs_to :collection, class_name: "Nquery::Collection", optional: true
+    belongs_to :creator, class_name: "Nquery::User", optional: true
+    has_many :dashboard_cards, class_name: "Nquery::DashboardCard", dependent: :destroy
+    has_many :charts, through: :dashboard_cards, class_name: "Nquery::Chart"
+
+    scope :active, -> { where(archived_at: nil) }
+    scope :archived, -> { where.not(archived_at: nil) }
+
+    validates :name, presence: true
+
+    def archived?
+      archived_at.present?
+    end
+
+    def archive!
+      update!(archived_at: Time.current)
+    end
+
+    def unarchive!
+      update!(archived_at: nil)
+    end
+  end
+end

data/app/models/nquery/dashboard_card.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Nquery
+  class DashboardCard < ApplicationRecord
+    belongs_to :dashboard, class_name: "Nquery::Dashboard"
+    belongs_to :chart, class_name: "Nquery::Chart"
+  end
+end

data/app/models/nquery/data_permission.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Nquery
+  class DataPermission < ApplicationRecord
+    PERMISSION_TYPES = %w[view_data create_queries download_results manage_database].freeze
+
+    belongs_to :group, class_name: "Nquery::Group"
+    belongs_to :data_source, class_name: "Nquery::DataSource"
+
+    validates :permission_type, inclusion: { in: PERMISSION_TYPES }
+    validates :access_level, presence: true
+  end
+end

data/app/models/nquery/data_source.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Nquery
+  class DataSource < ApplicationRecord
+    ADAPTERS = %w[rails postgresql mysql sqlite].freeze
+
+    has_many :data_permissions, class_name: "Nquery::DataPermission", dependent: :destroy
+    has_many :queries, class_name: "Nquery::Query", dependent: :nullify
+
+    validates :name, presence: true
+    validates :adapter, inclusion: { in: ADAPTERS }
+
+    scope :active, -> { all }
+
+    def connection_config_hash
+      return {} if connection_config.blank?
+
+      JSON.parse(connection_config)
+    rescue JSON::ParserError
+      {}
+    end
+
+    def connection_config_hash=(hash)
+      self.connection_config = hash.to_json
+    end
+  end
+end

data/app/models/nquery/embed_token.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Nquery
+  class EmbedToken < ApplicationRecord
+    belongs_to :creator, class_name: "Nquery::User", optional: true
+
+    validates :token, presence: true, uniqueness: true
+    validates :resource_type, presence: true
+    validates :resource_id, presence: true
+
+    scope :active, -> { where(active: true).where("expires_at IS NULL OR expires_at > ?", Time.current) }
+
+    def resource
+      resource_type.constantize.find_by(id: resource_id)
+    end
+
+    def expired?
+      expires_at.present? && expires_at <= Time.current
+    end
+  end
+end

data/app/models/nquery/group.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Nquery
+  class Group < ApplicationRecord
+    SYSTEM_GROUPS = %w[administrators all_users custom].freeze
+
+    has_many :group_memberships, class_name: "Nquery::GroupMembership", dependent: :destroy
+    has_many :users, through: :group_memberships, class_name: "Nquery::User"
+    has_many :data_permissions, class_name: "Nquery::DataPermission", dependent: :destroy
+    has_many :collection_permissions, class_name: "Nquery::CollectionPermission", dependent: :destroy
+    has_many :application_permissions, class_name: "Nquery::ApplicationPermission", dependent: :destroy
+
+    validates :name, presence: true
+    validates :system_group, inclusion: { in: SYSTEM_GROUPS }
+
+    scope :custom, -> { where(system_group: "custom") }
+    scope :system, -> { where.not(system_group: "custom") }
+
+    def system?
+      system_group != "custom"
+    end
+
+    def deletable?
+      system_group == "custom"
+    end
+  end
+end

data/app/models/nquery/group_membership.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Nquery
+  class GroupMembership < ApplicationRecord
+    belongs_to :user, class_name: "Nquery::User"
+    belongs_to :group, class_name: "Nquery::Group"
+
+    validates :user_id, uniqueness: { scope: :group_id }
+  end
+end

data/app/models/nquery/query.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Nquery
+  class Query < ApplicationRecord
+    belongs_to :data_source, class_name: "Nquery::DataSource", optional: true
+    belongs_to :creator, class_name: "Nquery::User", optional: true
+    belongs_to :collection, class_name: "Nquery::Collection", optional: true
+    has_one :chart, class_name: "Nquery::Chart", dependent: :destroy
+    has_many :audits, class_name: "Nquery::Audit", dependent: :nullify
+
+    validates :name, presence: true, on: :update
+
+    before_validation :set_default_name, on: :create
+
+    def set_default_name
+      self.name ||= "Untitled query"
+    end
+  end
+end

data/app/models/nquery/user.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Nquery
+  class User < ApplicationRecord
+    has_secure_password validations: false
+
+    has_many :group_memberships, class_name: "Nquery::GroupMembership", dependent: :destroy
+    has_many :groups, through: :group_memberships, class_name: "Nquery::Group"
+    has_many :queries, class_name: "Nquery::Query", foreign_key: :creator_id, inverse_of: :creator, dependent: :nullify
+    has_many :charts, class_name: "Nquery::Chart", foreign_key: :creator_id, inverse_of: :creator, dependent: :nullify
+    has_many :dashboards, class_name: "Nquery::Dashboard", foreign_key: :creator_id, inverse_of: :creator, dependent: :nullify
+    has_many :audits, class_name: "Nquery::Audit", dependent: :nullify
+    has_many :csv_uploads, class_name: "Nquery::CsvUpload", foreign_key: :creator_id, inverse_of: :creator, dependent: :nullify
+    has_many :embed_tokens, class_name: "Nquery::EmbedToken", foreign_key: :creator_id, inverse_of: :creator, dependent: :nullify
+    has_one :personal_collection, -> { where(kind: "personal") },
+            class_name: "Nquery::Collection", foreign_key: :owner_id, inverse_of: :owner, dependent: :destroy
+
+    validates :email, presence: true, uniqueness: true
+    validates :password, length: { minimum: 8 }, if: -> { password.present? }
+
+    scope :active, -> { where(deactivated_at: nil) }
+
+    def name
+      [first_name, last_name].compact_blank.join(" ").presence || email
+    end
+
+    def active?
+      deactivated_at.nil?
+    end
+
+    def deactivate!
+      update!(deactivated_at: Time.current)
+    end
+
+    def admin?
+      Permissions::Resolver.new(self).admin?
+    end
+
+    def self.find_or_create_from_sso!(host_user)
+      external_id = host_user.id.to_s
+      find_or_create_by!(external_id: external_id) do |user|
+        user.email = host_user.try(:email) || "#{external_id}@sso.local"
+        user.first_name = host_user.try(:first_name) || host_user.try(:name)
+      end.tap(&:ensure_all_users_membership!)
+    end
+
+    def ensure_all_users_membership!
+      all_users = Group.find_by!(system_group: "all_users")
+      group_memberships.find_or_create_by!(group: all_users)
+    end
+
+    def ensure_personal_collection!
+      return personal_collection if personal_collection
+
+      create_personal_collection!(name: "#{name}'s Personal Collection", kind: "personal")
+    end
+  end
+end

data/app/views/layouts/nquery/application.html.erb

@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <title>nquery</title>
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <%= csrf_meta_tags %>
+    <%= csp_meta_tag %>
+    <%= stylesheet_link_tag "nquery/application", "data-turbo-track": "reload" %>
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/codemirror@5.65.16/lib/codemirror.min.css">
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/codemirror@5.65.16/theme/eclipse.min.css">
+    <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.1/dist/chart.umd.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/codemirror@5.65.16/lib/codemirror.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/codemirror@5.65.16/mode/sql/sql.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/sql-formatter@15.4.2/dist/sql-formatter.min.js"></script>
+    <%= javascript_include_tag "nquery/application", defer: true %>
+  </head>
+  <body class="nq-body">
+    <div class="nq-layout">
+      <%= render "nquery/shared/sidebar" %>
+      <div class="nq-main">
+        <%= render "nquery/shared/topbar" %>
+        <main class="nq-content" id="main_content">
+          <%= render "nquery/shared/breadcrumbs" %>
+          <%= yield %>
+        </main>
+      </div>
+    </div>
+    <div id="flash" class="nq-toast-stack" aria-live="polite" aria-atomic="false">
+      <%= render "nquery/shared/flash" %>
+    </div>
+  </body>
+</html>

data/app/views/layouts/nquery/auth.html.erb

@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <title>nquery</title>
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <%= csrf_meta_tags %>
+    <%= stylesheet_link_tag "nquery/application" %>
+    <%= javascript_include_tag "nquery/application", defer: true %>
+  </head>
+  <body class="nq-body nq-auth-body">
+    <%= yield %>
+    <div id="flash" class="nq-toast-stack" aria-live="polite" aria-atomic="false">
+      <%= render "nquery/shared/flash" %>
+    </div>
+  </body>
+</html>

data/app/views/layouts/nquery/embed.html.erb

@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <title>nquery embed</title>
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <%= stylesheet_link_tag "nquery/application" %>
+    <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.1/dist/chart.umd.min.js"></script>
+  </head>
+  <body class="nq-embed-body">
+    <%= yield %>
+  </body>
+</html>

data/app/views/nquery/admin/data_sources/edit.html.erb

@@ -0,0 +1,8 @@
+<div class="nq-page-header"><h1>Edit data source</h1></div>
+<%= form_with model: @data_source, url: admin_data_source_path(@data_source), method: :patch, class: "nq-form nq-card" do |f| %>
+  <div class="nq-form-row"><%= f.label :name %><%= f.text_field :name, class: "nq-input" %></div>
+  <div class="nq-form-row"><%= f.label :adapter %><%= f.select :adapter, Nquery::DataSource::ADAPTERS, {}, class: "nq-input" %></div>
+  <div class="nq-form-row"><%= f.label :connection_config %><%= f.text_area :connection_config, class: "nq-textarea", rows: 4 %></div>
+  <div class="nq-form-row"><label><%= f.check_box :active %> Active</label></div>
+  <%= f.submit "Update", class: "nq-btn nq-btn-primary" %>
+<% end %>

data/app/views/nquery/admin/data_sources/index.html.erb

@@ -0,0 +1,21 @@
+<div class="nq-page-header"><h1>Data sources</h1><%= link_to "Add data source", new_admin_data_source_path, class: "nq-btn nq-btn-primary" %></div>
+
+<div class="nq-card nq-card-table">
+  <table class="nq-table">
+    <thead><tr><th>Name</th><th>Adapter</th><th>Active</th><th></th></tr></thead>
+    <tbody>
+      <% @data_sources.each do |ds| %>
+        <tr>
+          <td><%= ds.name %></td>
+          <td><%= ds.adapter %></td>
+          <td><%= ds.active? ? "Yes" : "No" %></td>
+          <td>
+            <div class="nq-actions">
+              <%= link_to "Edit", edit_admin_data_source_path(ds), class: "nq-btn" %>
+            </div>
+          </td>
+        </tr>
+      <% end %>
+    </tbody>
+  </table>
+</div>

data/app/views/nquery/admin/data_sources/new.html.erb

@@ -0,0 +1,7 @@
+<div class="nq-page-header"><h1>New data source</h1></div>
+<%= form_with model: @data_source, url: admin_data_sources_path, class: "nq-form nq-card" do |f| %>
+  <div class="nq-form-row"><%= f.label :name %><%= f.text_field :name, class: "nq-input" %></div>
+  <div class="nq-form-row"><%= f.label :adapter %><%= f.select :adapter, Nquery::DataSource::ADAPTERS, {}, class: "nq-input" %></div>
+  <div class="nq-form-row"><%= f.label :connection_config, "Connection (JSON)" %><%= f.text_area :connection_config, class: "nq-textarea", rows: 4, placeholder: '{"host":"localhost","database":"mydb"}' %></div>
+  <%= f.submit "Create", class: "nq-btn nq-btn-primary" %>
+<% end %>

data/app/views/nquery/admin/groups/edit.html.erb

@@ -0,0 +1,6 @@
+<div class="nq-page-header"><h1>Edit group</h1></div>
+<%= form_with model: @group, url: admin_group_path(@group), method: :patch, class: "nq-form nq-card" do |f| %>
+  <div class="nq-form-row"><%= f.label :name %><%= f.text_field :name, class: "nq-input", disabled: @group.system? %></div>
+  <div class="nq-form-row"><%= f.label :description %><%= f.text_area :description, class: "nq-textarea" %></div>
+  <%= f.submit "Update", class: "nq-btn nq-btn-primary" unless @group.system? && @group.system_group != "custom" %>
+<% end %>

data/app/views/nquery/admin/groups/index.html.erb

@@ -0,0 +1,21 @@
+<div class="nq-page-header"><h1>Groups</h1><%= link_to "New group", new_admin_group_path, class: "nq-btn nq-btn-primary" %></div>
+
+<div class="nq-card nq-card-table">
+  <table class="nq-table">
+    <thead><tr><th>Name</th><th>Type</th><th>Members</th><th></th></tr></thead>
+    <tbody>
+      <% @groups.each do |group| %>
+        <tr>
+          <td><%= link_to group.name, admin_group_path(group) %></td>
+          <td><span class="nq-badge"><%= group.system_group %></span></td>
+          <td><%= group.users.count %></td>
+          <td>
+            <div class="nq-actions">
+              <%= link_to "Edit", edit_admin_group_path(group), class: "nq-btn" unless group.system? && group.system_group != "custom" %>
+            </div>
+          </td>
+        </tr>
+      <% end %>
+    </tbody>
+  </table>
+</div>

data/app/views/nquery/admin/groups/new.html.erb

@@ -0,0 +1,6 @@
+<div class="nq-page-header"><h1>New group</h1></div>
+<%= form_with model: @group, url: admin_groups_path, class: "nq-form nq-card" do |f| %>
+  <div class="nq-form-row"><%= f.label :name %><%= f.text_field :name, class: "nq-input" %></div>
+  <div class="nq-form-row"><%= f.label :description %><%= f.text_area :description, class: "nq-textarea" %></div>
+  <%= f.submit "Create", class: "nq-btn nq-btn-primary" %>
+<% end %>

data/app/views/nquery/admin/groups/show.html.erb

@@ -0,0 +1,24 @@
+<div class="nq-page-header"><h1><%= @group.name %></h1></div>
+<div class="nq-grid nq-grid-2">
+  <section class="nq-card">
+    <h2>Members</h2>
+    <ul class="nq-list">
+      <% @group.users.each do |user| %>
+        <li>
+          <%= user.name %> (<%= user.email %>)
+          <% unless @group.system_group == "all_users" %>
+            <%= button_to "Remove", remove_member_admin_group_path(@group, user_id: user.id), method: :delete, class: "nq-btn nq-btn-ghost" %>
+          <% end %>
+        </li>
+      <% end %>
+    </ul>
+  </section>
+  <% if @available_users.any? %>
+    <section class="nq-card">
+      <h2>Add member</h2>
+      <% @available_users.limit(10).each do |user| %>
+        <%= button_to "Add #{user.email}", add_member_admin_group_path(@group, user_id: user.id), method: :post, class: "nq-btn" %>
+      <% end %>
+    </section>
+  <% end %>
+</div>

data/app/views/nquery/admin/logs/index.html.erb

@@ -0,0 +1,74 @@
+<div class="nq-page-header">
+  <h1>Query logs</h1>
+  <p class="nq-muted">Search query execution history</p>
+</div>
+
+<section class="nq-card">
+  <%= form_with url: admin_logs_path, method: :get, class: "nq-form" do %>
+    <div class="nq-grid nq-grid-3">
+      <div class="nq-form-row">
+        <label for="user">User</label>
+        <%= text_field_tag :user, params[:user], class: "nq-input", placeholder: "Name or email" %>
+      </div>
+      <div class="nq-form-row">
+        <label for="collection">Collection</label>
+        <%= select_tag :collection,
+              options_from_collection_for_select(@collections, :id, :name, params[:collection]),
+              include_blank: "All collections",
+              class: "nq-input" %>
+      </div>
+      <div class="nq-form-row">
+        <label for="dashboard">Dashboard</label>
+        <%= select_tag :dashboard,
+              options_from_collection_for_select(@dashboards, :id, :name, params[:dashboard]),
+              include_blank: "All dashboards",
+              class: "nq-input" %>
+      </div>
+      <div class="nq-form-row">
+        <label for="from">From</label>
+        <%= date_field_tag :from, params[:from], class: "nq-input" %>
+      </div>
+      <div class="nq-form-row">
+        <label for="to">To</label>
+        <%= date_field_tag :to, params[:to], class: "nq-input" %>
+      </div>
+    </div>
+    <div style="display: flex; gap: 0.5rem;">
+      <%= submit_tag "Search", class: "nq-btn nq-btn-primary" %>
+      <%= link_to "Clear", admin_logs_path, class: "nq-btn nq-btn-ghost" %>
+    </div>
+  <% end %>
+</section>
+
+<section class="nq-card nq-mt">
+  <table class="nq-table">
+    <thead>
+      <tr>
+        <th>User</th>
+        <th>Query</th>
+        <th>Collection</th>
+        <th>Dashboard</th>
+        <th>Status</th>
+        <th>When</th>
+      </tr>
+    </thead>
+    <tbody>
+      <% if @audits.any? %>
+        <% @audits.each do |audit| %>
+          <tr>
+            <td><%= audit.user&.name || "—" %></td>
+            <td><%= truncate(audit.statement.to_s, length: 60) %></td>
+            <td><%= audit.query&.collection&.name || "—" %></td>
+            <td><%= audit.query&.chart&.dashboard_cards&.first&.dashboard&.name || "—" %></td>
+            <td><span class="nq-badge"><%= audit.status %></span></td>
+            <td><%= time_ago_in_words(audit.created_at) %> ago</td>
+          </tr>
+        <% end %>
+      <% else %>
+        <tr>
+          <td colspan="6" class="nq-muted">No query logs found.</td>
+        </tr>
+      <% end %>
+    </tbody>
+  </table>
+</section>

data/app/views/nquery/admin/permissions/_collection.html.erb

@@ -0,0 +1,25 @@
+<div class="nq-card nq-mt">
+  <form method="get" class="nq-form-row">
+    <label>Collection</label>
+    <select name="collection_id" class="nq-input" onchange="this.form.submit()">
+      <% @collections.each do |collection| %>
+        <option value="<%= collection.id %>" <%= "selected" if collection == @selected_collection %>><%= collection.name %></option>
+      <% end %>
+    </select>
+  </form>
+
+  <% if @selected_collection %>
+    <table class="nq-table">
+      <thead><tr><th>Group</th><th>Access</th></tr></thead>
+      <tbody>
+        <% @groups.each do |group| %>
+          <% perm = Nquery::CollectionPermission.find_by(group: group, collection: @selected_collection) %>
+          <tr>
+            <td><%= group.name %></td>
+            <td><span class="nq-badge"><%= perm&.access_level || "no_access" %></span></td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  <% end %>
+</div>

data/app/views/nquery/admin/permissions/_data_source.html.erb

@@ -0,0 +1,27 @@
+<div class="nq-card nq-mt">
+  <form method="get" class="nq-form-row">
+    <label>Data source</label>
+    <select name="data_source_id" class="nq-input" onchange="this.form.submit()">
+      <% @data_sources.each do |ds| %>
+        <option value="<%= ds.id %>" <%= "selected" if ds == @selected_data_source %>><%= ds.name %></option>
+      <% end %>
+    </select>
+  </form>
+
+  <% if @selected_data_source %>
+    <table class="nq-table">
+      <thead><tr><th>Group</th><th>View data</th><th>Create queries</th></tr></thead>
+      <tbody>
+        <% @groups.each do |group| %>
+          <% view = Nquery::DataPermission.find_by(group: group, data_source: @selected_data_source, permission_type: "view_data") %>
+          <% create = Nquery::DataPermission.find_by(group: group, data_source: @selected_data_source, permission_type: "create_queries") %>
+          <tr>
+            <td><%= group.name %></td>
+            <td><span class="nq-badge"><%= view&.access_level || "blocked" %></span></td>
+            <td><span class="nq-badge"><%= create&.access_level || "no" %></span></td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  <% end %>
+</div>