permission_forge 0.14.1 → 0.15.0

data/app/models/permission_forge/permission_set_user.rb

@@ -8,6 +8,7 @@ module PermissionForge
 
     include PermissionForge::Concerns::HasUuid
     include PermissionForge::Concerns::ValidatesColumnLengths
+    include PermissionForge::Concerns::ValidatesRequiredColumns
     include PermissionForge::Concerns::HasAuditTrail
     include PermissionForge::Concerns::HasTenantScoping
     include PermissionForge::Concerns::InvalidatesInBatch
@@ -24,7 +25,8 @@ module PermissionForge
     # a RecordNotUnique 500 (and prevents silent duplicate rows on schemas that
     # predate the index). BulkPermissionSetAssignment already de-dupes; this
     # covers the single-assignment controller/API paths.
-    validates :user_id, uniqueness: { scope: :permission_set_id }
+    validates :user_id, uniqueness: { scope: :permission_set_id,
+                                      message: ->(*) { I18n.t('permission_forge.validations.permission_set_user.taken') } }
 
     # An integer user_id column would store a UUID or string user key as its
     # leading digits, handing this assignment to every user who shares them.
@@ -39,8 +41,14 @@ module PermissionForge
     # (InvalidatesInBatch#note_previous_value).
     after_save { note_previous_value('user_id') }
 
+    # The window of "ending soon": Home's card, the People page filter and
+    # the end-date cell ("ends in N days") all read it.
+    ENDING_SOON_DAYS = 7
+
     scope :active_assignments, -> { where(expires_at: nil).or(where(expires_at: Time.current..)) }
     scope :expired, -> { where.not(expires_at: nil).where(expires_at: ...Time.current) }
+    # Assignments that end within `days` from now (today's included, ended ones not).
+    scope :ending_within, ->(days = ENDING_SOON_DAYS) { where(expires_at: Time.current..days.days.from_now.end_of_day) }
 
     # Permanent assignments last reviewed before `cutoff` — the access
     # review list and StaleAssignmentAuditor. Reviewed means a "Keep"
@@ -51,9 +59,18 @@ module PermissionForge
 
     apply_tenant_scoping! # from the configuration, as the class loads (HasTenantScoping)
 
+    # Whether an end date has passed: the one comparison behind #expired?,
+    # the `expired` scope and the admin's end-date cell.
+    #
+    # @param expires_at [Time, nil]
+    # @return [Boolean]
+    def self.ended?(expires_at)
+      expires_at.present? && expires_at < Time.current
+    end
+
     # The review columns exist (bin/rails generate permission_forge:upgrade).
     def self.review_supported?
-      column_names.include?('reviewed_at')
+      PermissionForge::SchemaRead.column?(self, 'reviewed_at', ignored: false)
     end
 
     # Arel for "when this assignment was last reviewed" (see stale_before).
@@ -97,7 +114,25 @@ module PermissionForge
     end
 
     def expired?
-      expires_at.present? && expires_at < Time.current
+      self.class.ended?(expires_at)
+    end
+
+    # Whether the assignment ends within `days` (see .ending_within).
+    #
+    # @param days [Integer]
+    # @return [Boolean]
+    def ending_soon?(days = ENDING_SOON_DAYS)
+      expires_at.present? && !expired? && expires_at <= days.days.from_now.end_of_day
+    end
+
+    # Whether a permanent assignment is due for review: last reviewed more
+    # than `days` ago (see .stale_before; Admin::AttentionItems.stale_days
+    # is the threshold the admin uses).
+    #
+    # @param days [Integer]
+    # @return [Boolean]
+    def stale?(days)
+      expires_at.nil? && last_reviewed_at < days.days.ago
     end
 
     def active_assignment?

data/app/models/permission_forge/resource.rb

@@ -9,6 +9,9 @@ module PermissionForge
     include PermissionForge::Concerns::HasActiveScope
     include PermissionForge::Concerns::HasUuid
     include PermissionForge::Concerns::ValidatesColumnLengths
+    include PermissionForge::Concerns::RequiresName # name present, on create or rename
+    include PermissionForge::Concerns::NormalizesLabel # a blank label is stored as nil
+    include PermissionForge::Concerns::ValidatesRequiredColumns
     include PermissionForge::Concerns::HasAuditTrail
     include PermissionForge::Concerns::HasTenantScoping
     include PermissionForge::Concerns::HasPermissionSetUsers
@@ -17,6 +20,10 @@ module PermissionForge
     include PermissionForge::Concerns::InvalidatesManagedActions
     include PermissionForge::Concerns::RecordsAuditEvents
 
+    # Its name is configuration, not personal data: #inspect shows it even
+    # when filter_parameters (the GDPR patterns) hide a `name` (InspectionFilters).
+    PermissionForge::InspectionFilters.show_configuration_names(self)
+
     # A Ruby constant path: Resource#name is resolved to a model class.
     NAME_FORMAT = PermissionForge::RESOURCE_NAME_FORMAT
 
@@ -40,16 +47,13 @@ module PermissionForge
     has_many :permission_set_rules, class_name: 'PermissionForge::PermissionSetRule', dependent: :destroy,
                                     extend: Concerns::AuditedCollection
 
-    validates :name, presence: true
-    validates :name, uniqueness: { scope: :permission_set_id, message: 'already exists in this permission set' }
+    validates :name, uniqueness: { scope: :permission_set_id,
+                                   message: ->(*) { I18n.t('permission_forge.validations.resource.name_taken') } }
     # Resource#name is resolved to a model class via safe_constantize (e.g. by
     # ResourceFieldGenerator and MaskedAttributes auto-apply), so constrain it to
     # a Ruby constant path. Prevents naming a resource after arbitrary strings.
-    validates :name, format: {
-      with: NAME_FORMAT,
-      message: I18n.t('permission_forge.validations.resource.invalid_name',
-                      default: 'must be a valid model class name (e.g. Customer or Admin::Report)')
-    }, allow_blank: true
+    validates :name, format: { with: NAME_FORMAT, message: ->(*) { I18n.t('permission_forge.validations.resource.invalid_name') } },
+                     allow_blank: true
 
     validates_dependency :edit_access, requires: :read_access
     validates_dependency :delete_access, requires: :read_access
@@ -72,7 +76,9 @@ module PermissionForge
       view_all || modify_all
     end
 
-    # Grants full CRUD access + all field access for a resource on a permission set.
+    # Grants full CRUD access + read and edit on every field, unmasked (also
+    # the columns that look like personal data, which GdprFieldAuditor and the
+    # admin's privacy audit still report), for a resource on a permission set.
     # Intended for seeds, migrations, or console use only.
     def self.grant_full_access!(permission_set:, resource_name:)
       PermissionForge::Services::ResourceWithFieldsBuilder.call(
@@ -82,6 +88,10 @@ module PermissionForge
 
     private
 
+    # A blank label is stored as no label (NormalizesLabel): the admin names
+    # the model from the host's translation (Admin::ModelLabel).
+    def generated_label = nil
+
     def note_newly_named_model
       @pf_newly_named = true if previously_new_record? || saved_change_to_name?
     end

data/app/models/permission_forge/resource_action.rb

@@ -9,6 +9,9 @@ module PermissionForge
     include PermissionForge::Concerns::HasActiveScope
     include PermissionForge::Concerns::HasUuid
     include PermissionForge::Concerns::ValidatesColumnLengths
+    include PermissionForge::Concerns::RequiresName # name present, on create or rename
+    include PermissionForge::Concerns::NormalizesLabel # a blank label is stored as the name
+    include PermissionForge::Concerns::ValidatesRequiredColumns
     include PermissionForge::Concerns::HasAuditTrail
     include PermissionForge::Concerns::HasTenantScoping
     include PermissionForge::Concerns::HasPermissionSetUsers
@@ -16,6 +19,10 @@ module PermissionForge
     include PermissionForge::Concerns::InvalidatesManagedActions
     include PermissionForge::Concerns::RecordsAuditEvents
 
+    # Its name is configuration, not personal data: #inspect shows it even
+    # when filter_parameters (the GDPR patterns) hide a `name` (InspectionFilters).
+    PermissionForge::InspectionFilters.show_configuration_names(self)
+
     permission_set_user_lookup :via_resource
 
     # optional: as declared since 0.13 (the foreign key holds); stated, so the
@@ -28,10 +35,6 @@ module PermissionForge
     # instead of a RecordNotUnique 500. Checked when a row is created, renamed
     # or moved, so duplicates that predate the index stay editable; the
     # security audit lists them (`duplicate_actions`).
-    # Checked for a new row and on a rename only: a row whose name was
-    # blank before 0.14 stays editable in its other attributes.
-    validates :name, presence: { message: ->(*) { I18n.t('permission_forge.validations.name_blank') } },
-                     if: -> { new_record? || will_save_change_to_name? }
     validates :name, uniqueness: { scope: :resource_id,
                                    message: ->(*) { I18n.t('permission_forge.errors.admin.action_taken') } },
                      if: -> { new_record? || will_save_change_to_name? || will_save_change_to_resource_id? }
@@ -50,9 +53,15 @@ module PermissionForge
       is_active && resource.in_effect?
     end
 
-    # @return [String] the label, or the humanized name when there is none
+    # The action's name as the admin shows it (Admin::ActionLabel): the
+    # label an admin wrote; a label the gem generated (blank, the key, the
+    # key humanized: GeneratedText.label?) counts as none, and then, on an
+    # English page, Rails' English for the key ("Export csv"), else the key
+    # as stored ("export_csv").
+    #
+    # @return [String]
     def display_name
-      label.presence || name.humanize
+      PermissionForge::Admin::ActionLabel.for(self).text
     end
   end
 end

data/app/models/permission_forge/resource_field.rb

@@ -8,7 +8,11 @@ module PermissionForge
 
     include PermissionForge::Concerns::HasActiveScope
     include PermissionForge::Concerns::HasUuid
+    include PermissionForge::Concerns::KeepsCopiedValues
     include PermissionForge::Concerns::ValidatesColumnLengths
+    include PermissionForge::Concerns::RequiresName # name present, on create or rename
+    include PermissionForge::Concerns::NormalizesLabel # a blank label is stored as the name
+    include PermissionForge::Concerns::ValidatesRequiredColumns
     include PermissionForge::Concerns::HasAuditTrail
     include PermissionForge::Concerns::HasTenantScoping
     include PermissionForge::Concerns::HasPermissionSetUsers
@@ -16,8 +20,17 @@ module PermissionForge
     include PermissionForge::Concerns::PermissionsRegenerator
     include PermissionForge::Concerns::RecordsAuditEvents
 
+    # Its name is configuration, not personal data: #inspect shows it even
+    # when filter_parameters (the GDPR patterns) hide a `name` (InspectionFilters).
+    PermissionForge::InspectionFilters.show_configuration_names(self)
+
     permission_set_user_lookup :via_resource
 
+    # The install migration's column default for label: a row created
+    # without one (the API, the console) is labelled with its name instead
+    # (NormalizesLabel), never with this.
+    UNTITLED_LABEL = PermissionForge::GeneratedText::UNTITLED_FIELD
+
     # optional: as declared since 0.13 (the foreign key holds); stated, so the
     # host's belongs_to_required_by_default decides nothing here.
     belongs_to :resource, class_name: 'PermissionForge::Resource', optional: true
@@ -29,6 +42,69 @@ module PermissionForge
             .merge(PermissionForge::Resource.active).merge(PermissionForge::PermissionSet.active)
     }
 
+    # The rows that show a field in the clear — the SQL twin of
+    # #exposes_in_clear? (a test pins that they agree). The set's direction
+    # is the caller's: `in_effect.merge(PermissionSet.granting)` for the
+    # rows that reach someone's hash.
+    scope :exposing_in_clear, -> { active.where(read_access: true, mask_access: false) }
+
+    # The rows in the clear nobody marked "This is intended" in the admin's
+    # privacy audit (sensitive_acknowledged_at) — the SQL twin of
+    # #exposes_unacknowledged?, what the GDPR audit, the security audit,
+    # Home and the boot warning report.
+    scope :exposing_unacknowledged, lambda {
+      acknowledgement_supported? ? exposing_in_clear.where(sensitive_acknowledged_at: nil) : exposing_in_clear
+    }
+
+    # Whether the table has the column "This is intended" writes (added by
+    # the upgrade generator; an older install has none, and nothing is
+    # acknowledged there).
+    #
+    # @return [Boolean]
+    def self.acknowledgement_supported?
+      PermissionForge::SchemaRead.column?(self, 'sensitive_acknowledged_at', ignored: false)
+    rescue StandardError
+      false
+    end
+
+    # The rows in effect that mask with a strategy this app does not know
+    # (Services::MaskValue.known?): written past the model, or a custom
+    # strategy since removed. Masked fully until fixed. The one reading the
+    # security audit's unknown_mask_strategies and Home's card both take.
+    #
+    # @return [Array<ResourceField>] with their Resource and Permission Set loaded
+    def self.with_unknown_mask_strategy
+      in_effect.where(mask_access: true).includes(resource: :permission_set).order(:resource_id, :id)
+               .reject { |field| PermissionForge::Services::MaskValue.known?(field.mask_strategy) }
+    end
+
+    # The one definition of "readable in the clear": an active row that
+    # grants read and no mask. On a granting set's row only — a muting row
+    # takes access away, so the question does not arise there. The GDPR
+    # audit (unmasked_field, cross_set_unmasking), the security audit's
+    # personal_data check, Home's privacy card and the boot warning all ask
+    # this; a Hidden row (read off) is never in the clear, nor is a row
+    # written past the validation with mask on and read off.
+    #
+    # @return [Boolean]
+    def exposes_in_clear?
+      is_active && read_access && !mask_access
+    end
+
+    # In the clear and not marked "This is intended": the one definition of
+    # a personal-data exposure the four surfaces report (the field must
+    # also look like personal data: SensitiveColumns).
+    #
+    # @return [Boolean]
+    def exposes_unacknowledged?
+      exposes_in_clear? && !acknowledged_as_intended?
+    end
+
+    # @return [Boolean] an admin marked the field "This is intended"
+    def acknowledged_as_intended?
+      self.class.acknowledgement_supported? && has_attribute?(:sensitive_acknowledged_at) && sensitive_acknowledged_at.present?
+    end
+
     # A duplicate (resource_id, name) row would let a second field entry with
     # mask_access: false silently unmask the field via FieldPermissionMerger's
     # AND logic. Enforced by a DB unique index (idx_pf_resource_fields_unique)
@@ -37,26 +113,30 @@ module PermissionForge
     # collation does, and so the way the index does. On MySQL's default
     # (case-insensitive) collation "Email" collides with "email" in the index;
     # a forced case-sensitive check would let it through to a RecordNotUnique.
-    # Checked for a new row and on a rename only: a row whose name was
-    # blank before 0.14 stays editable in its other attributes.
-    validates :name, presence: { message: ->(*) { I18n.t('permission_forge.validations.name_blank') } },
-                     if: -> { new_record? || will_save_change_to_name? }
-    validates :name, uniqueness: { scope: :resource_id }
+    validates :name, uniqueness: { scope: :resource_id, message: ->(*) { I18n.t('permission_forge.validations.taken') } }
 
     validates_dependency :edit_access, requires: :read_access
     validates_dependency :mask_access, requires: :read_access
 
+    # The strategy is checked for a new row and when it, or mask_access,
+    # changes (mask_strategy_check_due?): a row whose strategy this app no
+    # longer knows — written past the model, or a custom strategy since
+    # removed from config.custom_mask_strategies — stays editable in its
+    # other attributes. Its values are masked fully until it is fixed
+    # (Services::MaskValue); `rake permission_forge:audit` lists it
+    # (unknown_mask_strategies), the field drawer flags it.
+    # A copy keeps its original's strategy (KeepsCopiedValues): it masks
+    # fully, as the original does.
+    keeps_copied :mask_access, :mask_strategy
     validates :mask_strategy, presence: {
-                                message: I18n.t('permission_forge.validations.resource_field.mask_strategy_required',
-                                                default: 'must be present when mask access is enabled')
+                                message: ->(*) { I18n.t('permission_forge.validations.resource_field.mask_strategy_required') }
                               },
-                              if: :mask_access?
+                              if: :mask_strategy_check_due?
     validates :mask_strategy, inclusion: {
                                 in: ->(_) { PermissionForge::Services::MaskValue.strategies.keys },
-                                message: I18n.t('permission_forge.validations.resource_field.invalid_mask_strategy',
-                                                default: 'is not a valid mask strategy')
+                                message: ->(*) { I18n.t('permission_forge.validations.resource_field.invalid_mask_strategy') }
                               },
-                              if: :mask_access?
+                              if: :mask_strategy_check_due?
 
     apply_tenant_scoping! # from the configuration, as the class loads (HasTenantScoping)
 
@@ -65,5 +145,11 @@ module PermissionForge
     def mask_access?
       mask_access == true
     end
+
+    def mask_strategy_check_due?
+      return false if copied_unchanged?(:mask_access, :mask_strategy)
+
+      mask_access? && (new_record? || will_save_change_to_mask_strategy? || will_save_change_to_mask_access?)
+    end
   end
 end

data/app/views/permission_forge/assignments/confirm_destroy.html.erb

@@ -1,14 +1,14 @@
 <% person = pf_person_name(@assignment.user) %>
 <% set = @assignment.permission_set %>
-<% content_for :pf_title, t('.title', set: set.name, name: person) %>
-<%= pf_dialog_frame({ title: t('.title', set: set.name, name: person), danger: true,
+<% content_for :pf_title, t('.title', set: pf_record_name(set), name: person) %>
+<%= pf_dialog_frame({ title: t('.title', set: pf_record_name(set), name: person), danger: true,
                      breadcrumb: pf_breadcrumb([t('permission_forge.nav.people'), permission_forge.people_path], [person, permission_forge.person_path(@assignment.user_id)], t('.crumb')) }) do %>
   <p class="pf-text-2">
     <% first = pf_person(@assignment.user).first_name %>
     <% if set.is_muting %>
-      <%= t('.body_muting', name: first, set: set.name) %>
+      <%= t('.body_muting', name: first, set: pf_record_name(set)) %>
     <% elsif @lost.any? %>
-      <%= t('.body', name: first, resources: @lost.to_sentence) %>
+      <%= t('.body', name: first, resources: pf_to_sentence(@lost)) %>
     <% else %>
       <%= t('.body_nothing', name: first) %>
     <% end %>

data/app/views/permission_forge/assignments/new.html.erb

@@ -1,7 +1,7 @@
 <% content_for :pf_title, t('.title') %>
 <% errors = @errors || {} %>
 <% title = if @person then t('.title_person', name: pf_person_name(@person))
-           elsif @preset_set then t('.title_set', set: @preset_set.name)
+           elsif @preset_set then t('.title_set', set: pf_record_name(@preset_set))
            else t('.title') end %>
 <% close_path = pf_back_or(@person ? permission_forge.person_path(@person) : permission_forge.people_path) %>
 <%= form_with url: permission_forge.assignments_path, method: :post, id: 'pf-assign-form' do %>
@@ -11,7 +11,7 @@
       <% if errors.any? %>
         <% errors.each_value do |msg| %><span class="pf-error" role="alert"><%= msg %></span> <% end %>
       <% elsif @person && @chosen_sets.any? %>
-        <%= t('.summary', name: pf_person_name(@person), sets: @chosen_sets.map(&:name).to_sentence,
+        <%= t('.summary', name: pf_person_name(@person), sets: pf_to_sentence(@chosen_sets.map(&:name)),
                           until: (@expiry == 'never' ? t('.forever') : t('.until', date: pf_expiry_preset_date(@expiry) || @custom_date))) %>
       <% else %>
         <%= t('.applies_now') %>
@@ -63,16 +63,20 @@
           <% end %>
           <% @sets.each do |set| %>
             <% has = @existing_ids.include?(set.id) %>
+            <%# A locked set that would widen access by taking a holder is shown, but cannot be picked. %>
+            <% locked = !has && @locked_ids.include?(set.id) %>
             <label class="pf-option">
-              <input type="checkbox" name="set_ids[]" value="<%= set.id %>" <%= 'checked' if @selected_ids.include?(set.id) && !has %> <%= 'disabled' if has %>>
+              <input type="checkbox" name="set_ids[]" value="<%= set.id %>" <%= 'checked' if @selected_ids.include?(set.id) && !has && !locked %> <%= 'disabled' if has || locked %>>
               <span class="pf-option__main">
                 <span class="pf-row pf-row--tight">
-                  <span class="pf-fw-600"><%= set.name %></span>
+                  <span class="pf-fw-600"><%= pf_record_name(set) %></span>
                   <% if has %><%= pf_badge(t('.already')) %><% end %>
+                  <% if locked %><%= pf_lock_badge %><% end %>
                   <% if set.is_muting %><%= pf_badge("⊘ #{t('permission_forge.ui.badges.muting')}", variant: :muting) %><% end %>
                   <% unless set.is_active %><%= pf_off_badge %><% end %>
                 </span>
-                <% if set.description.present? %><span class="pf-fs-12 pf-text-3"><%= set.description %></span><% end %>
+                <% if set.description.present? %><span class="pf-fs-12 pf-text-3" data-pf-host-data><%= set.description %></span><% end %>
+                <% if locked %><span class="pf-fs-12 pf-text-3"><%= t('.locked_hint') %></span><% end %>
               </span>
               <span class="pf-option__aside"><%= pf_people_text(@people_counts.fetch(set.id, 0)) %></span>
             </label>
@@ -83,7 +87,7 @@
       <% if muting.any? %>
         <div class="pf-banner pf-banner--muting">
           <span class="pf-banner__glyph" aria-hidden="true">⊘</span>
-          <div class="pf-banner__body"><span><%= t('.muting_notice', sets: muting.map(&:name).to_sentence, name: @person ? pf_person(@person).first_name : t('.this_person')) %></span></div>
+          <div class="pf-banner__body"><span><%= t('.muting_notice', sets: pf_to_sentence(muting.map(&:name)), name: @person ? pf_person(@person).first_name : t('.this_person')) %></span></div>
         </div>
       <% end %>
     </section>

data/app/views/permission_forge/audit_events/index.html.erb

@@ -92,7 +92,7 @@
       <select id="pf-audit-set" class="pf-select pf-select--sm" name="permission_set" <%= invalid.('permission_set') %>>
         <option value=""><%= t('.filters.any_set') %></option>
         <% sets.each do |id, name| %>
-          <option value="<%= id %>" <%= 'selected' if value.('permission_set') == id.to_s %>><%= name %></option>
+          <option value="<%= id %>" <%= 'selected' if value.('permission_set') == id.to_s %>><%= pf_record_name_text(name, :permission_set) %></option>
         <% end %>
         <% if value.('permission_set').present? && sets.none? { |id, _| id.to_s == value.('permission_set') } %>
           <option value="<%= value.('permission_set') %>" selected><%= t('.filters.deleted_set', id: value.('permission_set')) %></option>

data/app/views/permission_forge/audit_events/show.html.erb

@@ -21,17 +21,24 @@
     <dl class="pf-card__body pf-kv">
       <dt><%= t('.actor') %></dt>
       <dd>
+        <% unknown = pf_audit_unknown_actor?(event) %>
         <span class="pf-fw-600"><%= pf_audit_actor_name(event) %></span>
-        <span class="pf-text-3">· <%= pf_audit_actor_type_label(event.actor_type) %><% if d.actor_id? %> · <%= t('.id', id: event.actor_id) %><% end %></span>
+        <%# An unknown actor's name is its type already: "Unknown · Unknown" said nothing twice. %>
+        <% unless unknown %>
+          <span class="pf-text-3">· <%= pf_audit_actor_type_label(event.actor_type) %><% if d.actor_id? %> · <%= t('.id', id: event.actor_id) %><% end %></span>
+        <% end %>
+        <%# The actor line above already reads "Unknown": the explanation does not start with it again. %>
+        <% if unknown %><p class="pf-fs-13 pf-text-2"><%= pf_audit_unknown_actor_hint %></p><% end %>
         <div class="pf-row pf-row--tight pf-fs-12">
-          <%= link_to t('.all_by_actor'), pf_audit_log_path(actor_type: event.actor_type, actor_id: event.actor_id) %>
+          <%# With no actor named, the link lists every event without one, and says so. %>
+          <%= link_to (unknown ? t('.all_unknown_actor') : t('.all_by_actor')), pf_audit_log_path(actor_type: event.actor_type, actor_id: event.actor_id) %>
           <% if d.actor_user %>· <%= link_to t('.open_person'), permission_forge.person_path(d.actor_user) %><% end %>
         </div>
       </dd>
       <dt><%= t('.source') %></dt>
       <dd><%= pf_audit_source_label(event.source) %> <span class="pf-mono-key"><%= event.source %></span></dd>
       <dt><%= t('.reason') %></dt>
-      <dd><%= event.reason.presence || t('.no_reason') %></dd>
+      <dd><%= pf_audit_reason(event) || t('.no_reason') %></dd>
       <dt><%= t('.request_id') %></dt>
       <dd class="pf-audit-code"><%= event.request_id.presence || t('permission_forge.audit_log.no_value') %></dd>
       <dt><%= t('.ip') %></dt>
@@ -90,7 +97,7 @@
 </div>
 
 <% if d.changes? %>
-  <section class="pf-card pf-scroll-x" aria-labelledby="pf-event-changes">
+  <%= pf_scroll_frame(tag: :section, 'aria-labelledby': 'pf-event-changes', class: 'pf-card') do %>
     <div class="pf-card__header">
       <h2 class="pf-h2" id="pf-event-changes"><%= t('.changes') %></h2>
       <span class="pf-card__desc"><%= t('.changes_desc', count: d.changes_count) %></span>
@@ -107,11 +114,11 @@
         <% end %>
       </tbody>
     </table>
-  </section>
+  <% end %>
 <% end %>
 
 <% if d.snapshot? %>
-  <section class="pf-card pf-scroll-x" aria-labelledby="pf-event-snapshot">
+  <%= pf_scroll_frame(tag: :section, 'aria-labelledby': 'pf-event-snapshot', class: 'pf-card') do %>
     <div class="pf-card__header">
       <h2 class="pf-h2" id="pf-event-snapshot"><%= t('.snapshot') %></h2>
       <span class="pf-card__desc"><%= d.snapshot_of_removed? ? t('.snapshot_destroyed') : t('.snapshot_desc') %></span>
@@ -124,11 +131,11 @@
         <% end %>
       </tbody>
     </table>
-  </section>
+  <% end %>
 <% end %>
 
 <% if d.other? %>
-  <section class="pf-card pf-scroll-x" aria-labelledby="pf-event-data">
+  <%= pf_scroll_frame(tag: :section, 'aria-labelledby': 'pf-event-data', class: 'pf-card') do %>
     <div class="pf-card__header"><h2 class="pf-h2" id="pf-event-data"><%= t('.data') %></h2></div>
     <table class="pf-audit-table">
       <thead><tr><th scope="col"><%= t('.key') %></th><th scope="col"><%= t('.value') %></th></tr></thead>
@@ -138,7 +145,7 @@
         <% end %>
       </tbody>
     </table>
-  </section>
+  <% end %>
 <% end %>
 
 <% if d.no_data? %>

data/app/views/permission_forge/bulk_assignments/confirm_revoke.html.erb

@@ -1,8 +1,8 @@
 <% set = @permission_set %>
 <% back = permission_forge.permission_set_path(set, tab: 'assignments') %>
-<% content_for :pf_title, t('.title', count: @people.size, set: set.name) %>
-<%= pf_dialog_frame({ title: t('.title', count: @people.size, set: set.name), danger: true,
-                     breadcrumb: pf_breadcrumb([t('permission_forge.nav.permission_sets'), permission_forge.permission_sets_path], [set.name, back], t('.crumb')) }) do %>
+<% content_for :pf_title, t('.title', count: @people.size, set: pf_record_name(set)) %>
+<%= pf_dialog_frame({ title: t('.title', count: @people.size, set: pf_record_name(set)), danger: true,
+                     breadcrumb: pf_breadcrumb([t('permission_forge.nav.permission_sets'), permission_forge.permission_sets_path], [pf_record_name(set), back], t('.crumb')) }) do %>
   <% if @people.empty? %>
     <p class="pf-text-2"><%= t('.none') %></p>
     <div class="pf-actions pf-row--right"><%= link_to t('permission_forge.ui.close'), back, class: 'pf-btn', data: { pf_close: true } %></div>

data/app/views/permission_forge/bulk_assignments/new.html.erb

@@ -1,5 +1,5 @@
 <% set = @permission_set %>
-<% content_for :pf_title, t('.title', set: set.name) %>
+<% content_for :pf_title, t('.title', set: pf_record_name(set)) %>
 <% close_path = permission_forge.permission_set_path(set, tab: 'assignments') %>
 <%= form_with url: permission_forge.permission_set_bulk_assignment_path(set), method: :post do %>
   <% footer = capture do %>
@@ -15,8 +15,8 @@
       <%= @result ? t('.assign_count', count: @result.to_assign.size) : t('.assign') %>
     </button>
   <% end %>
-  <%= pf_sheet_frame({ title: t('.title', set: set.name), close_path: close_path, footer: footer,
-                       breadcrumb: pf_breadcrumb([t('permission_forge.nav.permission_sets'), permission_forge.permission_sets_path], [set.name, close_path], t('.crumb')) }) do %>
+  <%= pf_sheet_frame({ title: t('.title', set: pf_record_name(set)), close_path: close_path, footer: footer,
+                       breadcrumb: pf_breadcrumb([t('permission_forge.nav.permission_sets'), permission_forge.permission_sets_path], [pf_record_name(set), close_path], t('.crumb')) }) do %>
     <div class="pf-field">
       <label class="pf-label" for="pf-bulk-text"><%= t('.paste') %></label>
       <textarea id="pf-bulk-text" name="identifiers" rows="5" class="pf-textarea pf-textarea--mono" placeholder="<%= t('.paste_placeholder') %>"><%= @text %></textarea>

data/app/views/permission_forge/field_lookups/show.html.erb

@@ -7,7 +7,7 @@
       <select id="pf-lookup-resource" name="resource" class="pf-select" data-pf-autosubmit>
         <option value=""><%= t('.pick_resource') %></option>
         <% @resource_names.each do |name| %>
-          <option value="<%= name %>" <%= 'selected' if name == @resource_name %>><%= pf_resource_label(name) %> (<%= name %>)</option>
+          <option value="<%= name %>" <%= 'selected' if name == @resource_name %> data-pf-host-data><%= pf_resource_label(name) %> (<%= name %>)</option>
         <% end %>
       </select>
     </div>
@@ -16,7 +16,7 @@
       <select id="pf-lookup-field" name="field" class="pf-select" data-pf-autosubmit <%= 'disabled' unless @resource_name %>>
         <option value=""><%= t('.pick_field') %></option>
         <% @field_options.each do |name, label| %>
-          <option value="<%= name %>" <%= 'selected' if name == @field %>><%= label %> (<%= name %>)</option>
+          <option value="<%= name %>" <%= 'selected' if name == @field %> data-pf-host-data><%= label %> (<%= name %>)</option>
         <% end %>
       </select>
     </div>

data/app/views/permission_forge/home/_broken_rules_card.html.erb

@@ -0,0 +1,35 @@
+<% items = @attention.broken_rules %>
+<section class="pf-card" aria-labelledby="pf-card-broken-rules">
+  <div class="pf-card__header">
+    <div class="pf-stack pf-stack--tight pf-grow">
+      <div class="pf-row">
+        <span class="pf-text-block" aria-hidden="true">⊘</span>
+        <h2 class="pf-h2" id="pf-card-broken-rules"><%= t('.title') %></h2>
+        <span class="pf-count-pill pf-count-pill--warn"><%= items.size %></span>
+      </div>
+      <p class="pf-card__desc"><%= t('.description') %></p>
+    </div>
+  </div>
+  <% items.each do |item| %>
+    <% set = item.permission_set %>
+    <% resource = item.resource %>
+    <div class="pf-card__row pf-card__row--top">
+      <div class="pf-stack pf-stack--tight pf-grow">
+        <div class="pf-row pf-row--tight">
+          <strong><%= t('.rule', rule: pf_record_name(item.rule), resource: pf_resource_label(resource), set: pf_record_name(set)) %></strong>
+          <%= pf_lock_badge if item.locked? %>
+        </div>
+        <span class="pf-fs-13 pf-text-block"><%= pf_rule_problem_line(item.problem) %></span>
+        <span class="pf-fs-13 pf-text-2"><%= t('.people', count: item.people_count) %></span>
+        <%# A locked rule cannot be fixed here (its page offers only a copy): say where it can be. %>
+        <% if item.locked? %><span class="pf-fs-13 pf-text-2"><%= t('.locked_fix_html', flag: content_tag(:code, 'is_editable: false')) %></span><% end %>
+      </div>
+      <% if item.locked? %>
+        <%= link_to t('.open'), permission_forge.permission_set_resource_path(set, resource.name, tab: 'rules'), class: 'pf-btn pf-btn--ghost' %>
+      <% else %>
+        <%= pf_modal_link t('.fix'), permission_forge.edit_permission_set_resource_rule_path(set, resource.name, item.rule),
+                          kind: 'drawer', class: 'pf-btn pf-btn--sm' %>
+      <% end %>
+    </div>
+  <% end %>
+</section>

data/app/views/permission_forge/home/_conditions_card.html.erb

@@ -0,0 +1,28 @@
+<% items = @attention.broken_conditions %>
+<section class="pf-card" aria-labelledby="pf-card-conditions">
+  <div class="pf-card__header">
+    <div class="pf-stack pf-stack--tight pf-grow">
+      <div class="pf-row">
+        <span class="pf-text-warn" aria-hidden="true">⚠</span>
+        <h2 class="pf-h2" id="pf-card-conditions"><%= t('.title') %></h2>
+        <span class="pf-count-pill pf-count-pill--warn"><%= items.size %></span>
+      </div>
+      <p class="pf-card__desc"><%= t('.description') %></p>
+    </div>
+  </div>
+  <% items.each do |item| %>
+    <% set = item.permission_set %>
+    <div class="pf-card__row pf-card__row--top">
+      <div class="pf-stack pf-stack--tight pf-grow">
+        <div class="pf-row pf-row--tight">
+          <strong><%= pf_record_name(set) %></strong>
+          <%= pf_set_badges(set) %>
+        </div>
+        <%# The effect as the set's Conditions tab words it (pf_condition_effect). %>
+        <span class="pf-fs-13 pf-text-2"><%= pf_condition_effect(set) %></span>
+        <span class="pf-fs-13 pf-text-2"><%= t('.people', count: item.people_count) %></span>
+      </div>
+      <%= link_to t('.open'), permission_forge.permission_set_path(set, tab: 'conditions'), class: 'pf-btn pf-btn--sm' %>
+    </div>
+  <% end %>
+</section>