permission_forge 0.14.1 → 0.15.0

data/app/views/permission_forge/home/_ending_card.html.erb

@@ -19,11 +19,17 @@
         <span class="pf-fs-13"><%= pf_expiry_tag(assignment.expires_at) %></span>
       </div>
       <div class="pf-actions">
-        <%= form_with url: permission_forge.assignment_path(assignment), method: :patch, class: 'pf-reason-form' do %>
-          <input type="hidden" name="expiry" value="extend30">
-          <input type="hidden" name="return_to" value="<%= permission_forge.root_path %>">
-          <button type="submit" class="pf-btn pf-btn--sm"><%= t('.extend') %></button>
-          <%= render 'permission_forge/shared/reason_field', compact: true, id: "pf-extend-reason-#{assignment.id}" %>
+        <%# Only where the lock lets it through: extending a locked granting set widens access. %>
+        <% extend_key = PermissionForge::Admin::ExpiryPresets::EXTEND_KEY %>
+        <% if PermissionForge::Admin::EditableLock.expiry_choices(assignment, keys: [extend_key]).any? %>
+          <%= form_with url: permission_forge.assignment_path(assignment), method: :patch, class: 'pf-reason-form' do %>
+            <input type="hidden" name="expiry" value="<%= extend_key %>">
+            <input type="hidden" name="return_to" value="<%= permission_forge.root_path %>">
+            <button type="submit" class="pf-btn pf-btn--sm"><%= t('.extend') %></button>
+            <%= render 'permission_forge/shared/reason_field', compact: true, id: "pf-extend-reason-#{assignment.id}" %>
+          <% end %>
+        <% else %>
+          <%= pf_lock_badge %>
         <% end %>
         <%= link_to t('permission_forge.ui.open_person'), permission_forge.person_path(assignment.user_id), class: 'pf-btn pf-btn--ghost' %>
       </div>

data/app/views/permission_forge/home/_expired_card.html.erb

@@ -15,7 +15,7 @@
         <span class="pf-eyebrow"><%= t('.dry_run') %></span>
         <ul class="pf-stack pf-stack--tight pf-fs-13">
           <% items.each do |a| %>
-            <li><%= t('.item', person: pf_person_name(a.user), set: a.permission_set.name) %>
+            <li><%= t('.item', person: pf_person_name(a.user), set: pf_record_name(a.permission_set)) %>
               <span class="pf-text-3">· <%= pf_expiry(a.expires_at).first %></span></li>
           <% end %>
         </ul>

data/app/views/permission_forge/home/_mask_strategies_card.html.erb

@@ -0,0 +1,27 @@
+<% items = @attention.unknown_mask_strategies %>
+<section class="pf-card" aria-labelledby="pf-card-mask-strategies">
+  <div class="pf-card__header">
+    <div class="pf-stack pf-stack--tight pf-grow">
+      <div class="pf-row">
+        <span class="pf-text-warn" aria-hidden="true">⚠</span>
+        <h2 class="pf-h2" id="pf-card-mask-strategies"><%= t('.title') %></h2>
+        <span class="pf-count-pill pf-count-pill--warn"><%= items.size %></span>
+      </div>
+      <p class="pf-card__desc"><%= t('.description') %></p>
+    </div>
+  </div>
+  <% items.each do |item| %>
+    <% field = item.field %>
+    <% set = item.permission_set %>
+    <div class="pf-card__row pf-card__row--top">
+      <div class="pf-stack pf-stack--tight pf-grow">
+        <strong><%= t('.field', field: pf_field_label_text(item.resource.name, field.name), resource: pf_resource_label(item.resource), set: pf_record_name(set)) %></strong>
+        <%# The stored name is shown as written: it names no strategy, so it has no label. %>
+        <span class="pf-fs-13 pf-text-2"><%= t('.strategy_html', strategy: content_tag(:code, field.mask_strategy.to_s)) %></span>
+        <span class="pf-fs-13 pf-text-2"><%= t('.people', count: item.people_count) %></span>
+      </div>
+      <%= pf_modal_link t('.fix'), permission_forge.permission_set_resource_field_path(set, item.resource.name, field.name),
+                        kind: 'drawer', class: 'pf-btn pf-btn--sm' %>
+    </div>
+  <% end %>
+</section>

data/app/views/permission_forge/home/_privacy_card.html.erb

@@ -19,21 +19,29 @@
       <% if findings.any?(&:unconfigured?) %>
         <p class="pf-card__desc"><%= t('.per_set_note') %></p>
       <% end %>
+      <%# Detection reads column names only: say so where the admin can confirm a field, and
+          name the button only when a row offers it (a locked set's rows do not). %>
+      <% if can_ack && unmasked.positive? %>
+        <p class="pf-card__desc">
+          <%= t('.by_name_note') %>
+          <%= t('.intended_note') if shown.any?(&:acknowledgeable?) %>
+        </p>
+      <% end %>
     </div>
   </div>
   <% shown.each do |finding| %>
     <% resource = finding.resource %>
-    <% field_label = finding.field&.label.presence || resource.name.safe_constantize&.human_attribute_name(finding.name) || finding.name.humanize %>
+    <% field_label = pf_field_label_for(resource.name, finding.name, row: finding.field) %>
     <div class="pf-card__row pf-card__row--top">
       <div class="pf-stack pf-stack--tight pf-grow">
         <div class="pf-row pf-row--tight">
-          <strong><%= field_label %></strong>
+          <% unless field_label.verbatim? %><strong data-pf-host-data><%= field_label.text %></strong><% end %>
           <code class="pf-mono-key"><%= finding.name %></code>
           <%# A row that is turned off is not "not configured": the engine skips it, and Fix opens it. %>
           <% if finding.turned_off? %>
             <%= pf_off_badge %>
           <% elsif finding.unconfigured? %>
-            <%= pf_badge(t('permission_forge.ui.badges.not_configured'), variant: :unconfigured,
+            <%= pf_badge(pf_state(:field_level, :none).word, variant: :unconfigured,
                          href: pf_setting_path(finding.implicit_grant? ? 'extra_fields_default_access' : 'unconfigured_field_strategy')) %>
           <% end %>
         </div>
@@ -41,14 +49,20 @@
           <% where = finding.implicit_grant? ? '.where_virtual' : '.where_unconfigured' %>
           <% where = finding.implicit_grant? ? '.where_turned_off_virtual' : '.where_turned_off' if finding.turned_off? %>
           <%= t(finding.unconfigured? ? where : '.where',
-                resource: pf_resource_label(resource), set: finding.permission_set.name,
+                resource: pf_resource_label(resource), set: pf_record_name(finding.permission_set),
                 people: pf_people_text(finding.people_count)) %>
         </span>
       </div>
       <div class="pf-actions">
-        <%= pf_modal_link t('.fix'), permission_forge.permission_set_resource_field_path(finding.permission_set, resource.name, finding.name),
-                          kind: 'drawer', class: 'pf-btn pf-btn--sm' %>
-        <% if can_ack && !finding.unconfigured? && !pf_locked_record?(finding.field) %>
+        <% field_path = permission_forge.permission_set_resource_field_path(finding.permission_set, resource.name, finding.name) %>
+        <%# A locked set refuses every change to its fields (the drawer is read-only): no Fix, no "This is intended". %>
+        <% if finding.locked? %>
+          <%= pf_lock_badge %>
+          <%= pf_modal_link t('.view'), field_path, kind: 'drawer', class: 'pf-btn pf-btn--ghost' %>
+        <% else %>
+          <%= pf_modal_link t('.fix'), field_path, kind: 'drawer', class: 'pf-btn pf-btn--sm' %>
+        <% end %>
+        <% if can_ack && finding.acknowledgeable? %>
           <%= form_with url: permission_forge.acknowledge_permission_set_resource_field_path(finding.permission_set, resource.name, finding.name),
                         method: :post, class: 'pf-reason-form' do %>
             <input type="hidden" name="return_to" value="<%= permission_forge.root_path %>">

data/app/views/permission_forge/home/_rules_card.html.erb

@@ -13,7 +13,7 @@
   <% items.each do |item| %>
     <div class="pf-card__row">
       <div class="pf-stack pf-stack--tight pf-grow">
-        <strong><%= t('.rules', count: item.rule_count, resource: pf_resource_label(item.resource), name: item.permission_set.name) %></strong>
+        <strong><%= t('.rules', count: item.rule_count, resource: pf_resource_label(item.resource), name: pf_record_name(item.permission_set)) %></strong>
         <span class="pf-fs-13 pf-text-2"><%= t('.people', count: item.people_count) %></span>
       </div>
       <%= link_to t('.open'), permission_forge.permission_set_resource_path(item.permission_set, item.resource.name, tab: 'rules'),

data/app/views/permission_forge/home/_secret_rules_card.html.erb

@@ -0,0 +1,33 @@
+<% items = @attention.secret_rules %>
+<section class="pf-card" aria-labelledby="pf-card-secret-rules">
+  <div class="pf-card__header">
+    <div class="pf-stack pf-stack--tight pf-grow">
+      <div class="pf-row">
+        <span class="pf-text-warn" aria-hidden="true">⚠</span>
+        <h2 class="pf-h2" id="pf-card-secret-rules"><%= t('.title') %></h2>
+        <span class="pf-count-pill pf-count-pill--warn"><%= items.size %></span>
+      </div>
+      <p class="pf-card__desc"><%= t('.description') %></p>
+    </div>
+  </div>
+  <% items.each do |item| %>
+    <% set = item.permission_set %>
+    <% resource = item.resource %>
+    <div class="pf-card__row pf-card__row--top">
+      <div class="pf-stack pf-stack--tight pf-grow">
+        <div class="pf-row pf-row--tight">
+          <strong><%= t('.rule', rule: pf_record_name(item.rule), resource: pf_resource_label(resource), set: pf_record_name(set)) %></strong>
+          <%= pf_lock_badge if item.locked? %>
+        </div>
+        <span class="pf-fs-13 pf-text-2"><%= t('.column_html', column: content_tag(:code, item.rule.field_name.to_s)) %></span>
+        <span class="pf-fs-13 pf-text-2"><%= t('.people', count: item.people_count) %></span>
+      </div>
+      <% if item.locked? %>
+        <%= link_to t('.open'), permission_forge.permission_set_resource_path(set, resource.name, tab: 'rules'), class: 'pf-btn pf-btn--ghost' %>
+      <% else %>
+        <%= pf_modal_link t('.fix'), permission_forge.edit_permission_set_resource_rule_path(set, resource.name, item.rule),
+                          kind: 'drawer', class: 'pf-btn pf-btn--sm' %>
+      <% end %>
+    </div>
+  <% end %>
+</section>

data/app/views/permission_forge/home/_stale_card.html.erb

@@ -1,5 +1,5 @@
 <% items = @attention.stale %>
-<% granters = pf_granters(items) %>
+<% creations = pf_audit_creations(items) %>
 <section class="pf-card" aria-labelledby="pf-card-stale">
   <div class="pf-card__header">
     <div class="pf-stack pf-stack--tight pf-grow">
@@ -20,7 +20,7 @@
           </div>
           <span class="pf-row pf-row--tight pf-fs-13">
             <%= pf_reviewed(assignment) %>
-            <span class="pf-text-3">· <%= t('.assigned', date: pf_date(assignment.created_at), by: pf_granted_by(assignment, granters)) %></span>
+            <span class="pf-text-3">· <%= t('.assigned', date: pf_date(assignment.created_at), by: pf_audit_creator(assignment, creations)) %></span>
           </span>
         </div>
         <div class="pf-actions">
@@ -29,9 +29,11 @@
             <button type="submit" class="pf-btn pf-btn--sm"><%= t('permission_forge.ui.keep') %></button>
             <%= render 'permission_forge/shared/reason_field', compact: true, id: "pf-keep-reason-#{assignment.id}" %>
           <% end %>
-          <%= pf_lock_badge if pf_locked_record?(assignment.permission_set) %>
-          <%= pf_modal_link t('permission_forge.ui.remove'), permission_forge.remove_assignment_path(assignment, return_to: permission_forge.root_path),
-                            class: 'pf-btn pf-btn--ghost-danger' %>
+          <%= pf_lock_badge(assignment) %>
+          <% if PermissionForge::Admin::EditableLock.permits?(assignment, :revoke) %>
+            <%= pf_modal_link t('permission_forge.ui.remove'), permission_forge.remove_assignment_path(assignment, return_to: permission_forge.root_path),
+                              class: 'pf-btn pf-btn--ghost-danger' %>
+          <% end %>
         </div>
       </div>
     <% end %>

data/app/views/permission_forge/home/_tidy_card.html.erb

@@ -9,7 +9,7 @@
   <% items.each do |item| %>
     <div class="pf-card__row">
       <div class="pf-stack pf-stack--tight pf-grow">
-        <strong><%= t(".#{item.kind}", name: item.permission_set.name, count: item.people_count) %></strong>
+        <strong><%= t(".#{item.kind}", name: pf_record_name(item.permission_set), count: item.people_count) %></strong>
         <span class="pf-fs-13 pf-text-2"><%= t(".#{item.kind}_hint") %></span>
       </div>
       <%= link_to t('.open'), permission_forge.permission_set_path(item.permission_set), class: 'pf-btn pf-btn--sm' %>

data/app/views/permission_forge/home/index.html.erb

@@ -17,10 +17,11 @@
     <svg class="pf-search-field__icon" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.6"
          aria-hidden="true" focusable="false"><circle cx="7" cy="7" r="4.5"/><path d="m10.5 10.5 3 3"/></svg>
     <input id="pf-home-q" class="pf-input pf-search-field__input" type="search" name="q" autocomplete="off"
-           placeholder="<%= t('.search_placeholder') %>">
+           placeholder="<%= t('.search_placeholder') %>" aria-describedby="pf-home-q-help">
   <% end %>
   <%= pf_modal_link t('permission_forge.ui.field_lookup'), permission_forge.field_lookup_path, kind: 'drawer',
                     class: 'pf-btn', title: t('.field_lookup_title') %>
+  <p id="pf-home-q-help" class="pf-hint pf-toolbar__help"><%= t('.search_help') %></p>
 </div>
 
 <% if @first_run %>
@@ -54,11 +55,9 @@
   </section>
 <% else %>
   <%# Two independent stacks (no shared grid rows), so a tall card never leaves
-      a gap in the other column. Cards alternate in priority order. %>
-  <% cards = { 'audit_card' => @attention.audit_findings, 'privacy_card' => @attention.privacy_findings, 'rules_card' => @attention.unenforced_rules,
-               'ending_card' => @attention.ending_soon,
-               'expired_card' => @attention.expired, 'stale_card' => @attention.stale,
-               'tidy_card' => @attention.tidy }.select { |_, items| items.any? }.keys %>
+      a gap in the other column. Cards alternate in priority order
+      (Admin::AttentionItems::CARDS). %>
+  <% cards = @attention.cards %>
   <div class="pf-masonry">
     <% cards.partition.with_index { |_, i| i.even? }.reject(&:empty?).each do |column| %>
       <div class="pf-masonry__col">

data/app/views/permission_forge/people/_access_tab.html.erb

@@ -1,5 +1,5 @@
 <% first_name = pf_person(@person).first_name %>
-<% granters = pf_granters(@assignments) %>
+<% creations = pf_audit_creations(@assignments) %>
 <div class="pf-stack pf-stack--loose">
   <div class="pf-card">
     <% if @assignments.empty? %>
@@ -10,32 +10,36 @@
       <div class="pf-assignment">
         <div class="pf-assignment__main">
           <div class="pf-row pf-row--tight"><%= pf_set_chip(set, large: true, expired: assignment.expired?) %></div>
-          <% if set.description.present? %><span class="pf-fs-13 pf-text-2"><%= set.description %></span><% end %>
+          <% if set.description.present? %><span class="pf-fs-13 pf-text-2" data-pf-host-data><%= set.description %></span><% end %>
           <% if set.conditional? %>
-            <span class="pf-row pf-row--tight pf-fs-13 pf-text-accent">◷ <%= pf_condition_sentence(set) %> <%= pf_fail_open_badge if pf_fail_open? %></span>
+            <span class="pf-row pf-row--tight pf-fs-13 pf-text-accent">◷ <%= pf_condition_sentence(set, markup: true) %> <%= pf_fail_open_badge if pf_fail_open? %></span>
           <% end %>
           <% unless set.is_active %>
             <span class="pf-fs-13 pf-text-3">○ <%= t('.set_off') %></span>
           <% end %>
-          <span class="pf-fs-12 pf-text-3"><%= t('.assigned', date: pf_date(assignment.created_at), by: pf_granted_by(assignment, granters)) %></span>
+          <span class="pf-fs-12 pf-text-3"><%= t('.assigned', date: pf_date(assignment.created_at), by: pf_audit_creator(assignment, creations)) %></span>
         </div>
         <div class="pf-assignment__when">
           <%= pf_expiry_tag(assignment.expires_at) %>
           <%= pf_reviewed(assignment) %>
         </div>
         <div class="pf-assignment__actions">
-          <%= pf_lock_badge if pf_locked_record?(set) %>
-          <%= form_with url: permission_forge.assignment_path(assignment), method: :patch, class: 'pf-row pf-row--tight' do %>
-            <input type="hidden" name="return_to" value="<%= permission_forge.person_path(@person) %>">
-            <label class="pf-sr-only" for="pf-exp-<%= assignment.id %>"><%= t('.change_end') %></label>
-            <select id="pf-exp-<%= assignment.id %>" name="expiry" class="pf-select pf-select--sm pf-select--auto" data-pf-autosubmit>
-              <option value="" selected><%= t('.change_end') %>…</option>
-              <% PermissionForge::Admin::ExpiryPresets::CHANGE_KEYS.each do |key| %>
-                <option value="<%= key %>"><%= t("permission_forge.ui.expiry_change.#{key}") %></option>
-              <% end %>
-            </select>
-            <button type="submit" class="pf-btn pf-btn--xs" data-pf-js-hide><%= t('permission_forge.ui.apply') %></button>
-            <%= render 'permission_forge/shared/reason_field', compact: true, id: "pf-exp-reason-#{assignment.id}" %>
+          <%= pf_lock_badge(assignment) %>
+          <%# Only the end dates the lock lets through: a locked set never offers a choice it then refuses. %>
+          <% choices = PermissionForge::Admin::EditableLock.expiry_choices(assignment) %>
+          <% if choices.any? %>
+            <%= form_with url: permission_forge.assignment_path(assignment), method: :patch, class: 'pf-row pf-row--tight' do %>
+              <input type="hidden" name="return_to" value="<%= permission_forge.person_path(@person) %>">
+              <label class="pf-sr-only" for="pf-exp-<%= assignment.id %>"><%= t('.change_end') %></label>
+              <select id="pf-exp-<%= assignment.id %>" name="expiry" class="pf-select pf-select--sm pf-select--auto" data-pf-autosubmit>
+                <option value="" selected><%= t('.change_end') %>…</option>
+                <% choices.each do |key| %>
+                  <option value="<%= key %>"><%= t("permission_forge.ui.expiry_change.#{key}") %></option>
+                <% end %>
+              </select>
+              <button type="submit" class="pf-btn pf-btn--xs" data-pf-js-hide><%= t('permission_forge.ui.apply') %></button>
+              <%= render 'permission_forge/shared/reason_field', compact: true, id: "pf-exp-reason-#{assignment.id}" %>
+            <% end %>
           <% end %>
           <% if pf_stale?(assignment) %>
             <%= form_with url: permission_forge.keep_assignment_path(assignment), method: :post, class: 'pf-reason-form' do %>
@@ -44,15 +48,18 @@
               <%= render 'permission_forge/shared/reason_field', compact: true, id: "pf-keep-reason-#{assignment.id}" %>
             <% end %>
           <% end %>
-          <%= pf_modal_link t('permission_forge.ui.remove'), permission_forge.remove_assignment_path(assignment, return_to: permission_forge.person_path(@person)),
-                            class: 'pf-btn pf-btn--ghost-danger' %>
+          <%# Removing a holder of a locked Muting Permission Set gives access back: refused, so not offered (EditableLock.permits?). %>
+          <% if PermissionForge::Admin::EditableLock.permits?(assignment, :revoke) %>
+            <%= pf_modal_link t('permission_forge.ui.remove'), permission_forge.remove_assignment_path(assignment, return_to: permission_forge.person_path(@person)),
+                              class: 'pf-btn pf-btn--ghost-danger' %>
+          <% end %>
         </div>
       </div>
     <% end %>
   </div>
   <% if @groups.any? %>
     <p class="pf-fs-13 pf-text-2">
-      <%= t('.groups_html', groups: safe_join(@groups.map { |g| link_to(g.permission_set_group.name, permission_forge.group_path(g.permission_set_group)) }, ', ')) %>
+      <%= t('.groups_html', groups: safe_join(@groups.map { |g| link_to(pf_record_name(g.permission_set_group), permission_forge.group_path(g.permission_set_group)) }, ', ')) %>
     </p>
   <% end %>
 </div>

data/app/views/permission_forge/people/_audit_tab.html.erb

@@ -3,7 +3,7 @@
 <% else %>
 <% first_name = pf_person(@person).first_name %>
 <% total = @changes.values.sum(&:size) %>
-<% granters = pf_granters(@assignments) %>
+<% creations = pf_audit_creations(@assignments.to_a + @groups.to_a) %>
 <div class="pf-stack pf-stack--loose">
   <% unless PermissionForge.configuration.audit_trail_enabled %>
     <div class="pf-banner pf-banner--warn" role="note">
@@ -16,7 +16,7 @@
   <%= render 'permission_forge/shared/audit_timeline',
              title: t('.timeline', name: first_name), description: t('.timeline_desc', name: first_name),
              page: @timeline, lookups: @timeline_lookups,
-             path: ->(number) { permission_forge.person_path(@person, tab: 'audit', views: params[:views].presence, page: number) },
+             path: ->(number) { permission_forge.person_path(@person, tab: 'audit', views: @views, page: number) },
              views_path: (permission_forge.person_path(@person, tab: 'audit', views: 1) unless @timeline_log.include_views?),
              links: [[t('.events_about', name: first_name), pf_audit_log_path(subject_user_id: @person.id)],
                      [t('.events_by', name: first_name), pf_audit_log_path(actor_type: 'user', actor_id: @person.id)]] %>
@@ -29,9 +29,9 @@
     <% @assignments.each do |a| %>
       <div class="pf-card__row pf-card__row--top">
         <span class="pf-stack pf-stack--tight pf-grow">
-          <span><b><%= a.permission_set.name %></b> <span class="pf-fs-12 pf-text-3"><%= t(a.permission_set.is_muting ? '.kind_muting' : '.kind_set') %></span></span>
-          <span class="pf-fs-12 pf-text-3"><%= t('.assigned_by', who: pf_granted_by(a, granters), date: pf_date(a.created_at)) %></span>
-          <% if a.try(:reason).present? %><span class="pf-fs-12 pf-text-3"><%= t('permission_forge.audit_log.reason_inline', reason: a.reason) %></span><% end %>
+          <span><b><%= pf_record_name(a.permission_set) %></b> <span class="pf-fs-12 pf-text-3"><%= t(a.permission_set.is_muting ? '.kind_muting' : '.kind_set') %></span></span>
+          <span class="pf-fs-12 pf-text-3"><%= t('.assigned_by', who: pf_audit_creator(a, creations), date: pf_date(a.created_at)) %></span>
+          <% if (reason = pf_audit_reason(a)) %><span class="pf-fs-12 pf-text-3"><%= t('permission_forge.audit_log.reason_inline', reason: reason) %></span><% end %>
         </span>
         <span class="pf-stack pf-stack--tight pf-fs-12">
           <%= pf_expiry_tag(a.expires_at) %>
@@ -42,8 +42,8 @@
     <% @groups.each do |m| %>
       <div class="pf-card__row">
         <span class="pf-stack pf-stack--tight pf-grow">
-          <span><b><%= m.permission_set_group.name %></b> <span class="pf-fs-12 pf-text-3"><%= t('.kind_group') %></span></span>
-          <span class="pf-fs-12 pf-text-3"><%= t('.assigned_by', who: pf_person_name(m.try(:created_by)), date: pf_date(m.created_at)) %></span>
+          <span><b><%= pf_record_name(m.permission_set_group) %></b> <span class="pf-fs-12 pf-text-3"><%= t('.kind_group') %></span></span>
+          <span class="pf-fs-12 pf-text-3"><%= t('.assigned_by', who: pf_audit_creator(m, creations), date: pf_date(m.created_at)) %></span>
         </span>
       </div>
     <% end %>
@@ -79,7 +79,7 @@
                   <% if where %><span class="pf-fs-12 pf-text-3"><%= where %></span><% end %>
                 </span>
                 <span class="pf-stack pf-stack--tight pf-option__aside">
-                  <span><%= t('.created', value: pf_audit_who_when(entry.created_by, entry.created_at)) %></span>
+                  <span><%= t('.created', value: pf_audit_created(entry)) %></span>
                   <span><%= t('.edited', value: pf_audit_edited(entry)) %></span>
                 </span>
               <% end %>

data/app/views/permission_forge/people/_effective_field_source.html.erb

@@ -1,11 +1,17 @@
-<% if field.blocked_by.any? %>
-  <%= t('.muted_by', set: field.blocked_by.map(&:name).to_sentence) %>
-<% elsif field.unconfigured %>
-  <%= t('.unconfigured', behaviour: t("permission_forge.ui.unconfigured.#{PermissionForge.configuration.unconfigured_field_strategy}", default: t('permission_forge.ui.unconfigured.block'))) %>
-<% elsif field.granted_by.any? %>
-  <%= t('.from', set: field.granted_by.first.name) %><%= t('.and_more', count: field.granted_by.size - 1) if field.granted_by.size > 1 %>
-<% elsif field.implicit %>
+<%# Locals: field (EffectiveAccess::FieldOutcome), res_name (the Resource the row is about).
+    The row words FieldOutcome#reason, the decision the Why panel and "Explain for" word too (B#39);
+    every set is named with the Resource whose row it credits (B#35, B#38). %>
+<% case field.reason %>
+<% when :muted %>
+  <%= pf_field_muted_by(field, res_name) %>
+<% when :unconfigured %>
+  <%= t('.unconfigured', state: pf_state(:field_level, :none).word, behaviour: t("permission_forge.ui.unconfigured.#{PermissionForge.configuration.unconfigured_field_strategy}", default: t('permission_forge.ui.unconfigured.block'))) %>
+<% when :granted %>
+  <%= pf_t_markup(set: pf_field_source_set_name(field.grants.first, res_name)) { |held| t('.from', **held) } %><%= t('.and_more', count: field.grants.size - 1) if field.grants.size > 1 %>
+<% when :implicit %>
   <%= t('.virtual') %>
+<% when :unreadable, :inherited %>
+  <%= pf_field_chain_reason(field).last %>
 <% else %>
   <%= t('.none') %>
 <% end %>

data/app/views/permission_forge/people/_effective_tab.html.erb

@@ -4,10 +4,10 @@
   <div class="pf-row pf-row--between">
     <p class="pf-text-2"><%= t('.intro', name: first_name) %></p>
     <div class="pf-legend" aria-label="<%= t('.legend') %>">
-      <span><b>✓</b> <%= t('permission_forge.ui.states.granted') %></span>
-      <span><b>⊘</b> <%= t('.legend_muted') %></span>
-      <span><b>–</b> <%= t('.legend_none') %></span>
-      <span><b>••</b> <%= t('permission_forge.ui.levels.masked') %></span>
+      <%# The legend words each state as the cells do (Admin::StateLabel). %>
+      <% [%i[effective granted], %i[effective blocked], %i[effective none], %i[field_level masked]].each do |kind, state| %>
+        <span><%= pf_state_parts(pf_state(kind, state), glyph_tag: :b, separator: ' ') %></span>
+      <% end %>
     </div>
   </div>
 
@@ -15,7 +15,7 @@
     <div class="pf-banner">
       <span class="pf-banner__glyph" aria-hidden="true">◷</span>
       <div class="pf-banner__body">
-        <span><%= t('.conditional', sets: @conditional_sets.map(&:name).to_sentence) %></span>
+        <span><%= t('.conditional', sets: pf_to_sentence(@conditional_sets.map(&:name))) %></span>
       </div>
     </div>
   <% end %>
@@ -24,7 +24,7 @@
     <div class="pf-card"><p class="pf-empty"><%= t('permission_forge.people.access_tab.empty', name: first_name) %></p></div>
   <% else %>
     <div class="pf-split">
-      <div class="pf-split__main pf-card pf-scroll-x">
+      <%= pf_scroll_frame('aria-label': t('.grid_label'), class: 'pf-split__main pf-card') do %>
         <div class="pf-effective" role="table" aria-label="<%= t('.grid_label') %>">
           <div class="pf-matrix__head" role="row">
             <span role="columnheader"><%= t('permission_forge.ui.resource') %></span>
@@ -63,7 +63,7 @@
                     <% if res.records == :all %><span class="pf-text-2"><%= t('permission_forge.ui.view_all') %></span>
                     <% elsif res.records == :rules %>
                       <span class="pf-text-2"><%= t('permission_forge.ui.rules_count', count: res.rules.size) %></span>
-                      <% if res.rules.first %><span class="pf-fs-12 pf-text-3 pf-ellipsis"><%= pf_rule_summary(res.rules.first.rule, res.name) %></span><% end %>
+                      <% if (headline = pf_rule_headline(res.rules.map(&:rule))) %><span class="pf-fs-12 <%= pf_rule_problem(headline) ? 'pf-text-block' : 'pf-text-3' %> pf-state__summary"><%= pf_rule_summary(headline, res.name) %></span><% end %>
                     <% else %><span>–</span>
                     <% end %>
                   <% end %>
@@ -75,15 +75,14 @@
                   <%= link_to permission_forge.person_path(@person, tab: 'effective', why: key, open: (@open + [res.name]).uniq),
                               class: 'pf-effective__field', data: { pf_why: key }, 'aria-current': (@why == key ? 'true' : nil) do %>
                     <span class="pf-row pf-row--tight pf-grow">
-                      <span><%= res.name.safe_constantize&.human_attribute_name(field.name) || field.name.humanize %></span>
+                      <% field_label = pf_field_label_for(res.name, field.name) %>
+                      <% unless field_label.verbatim? %><span data-pf-host-data><%= field_label.text %></span><% end %>
                       <code class="pf-mono-key"><%= field.name %></code>
                       <% if field.virtual %><%= pf_badge(t('permission_forge.ui.badges.virtual')) %><% end %>
                     </span>
-                    <%= pf_level_badge(field.blocked_by.any? && field.level == 'hidden' ? 'muted' : field.level,
-                                       strategy: field.level == 'masked' ? field.mask_strategy : nil,
-                                       label: (t('.hidden_by_muting') if field.blocked_by.any? && field.level == 'hidden')) %>
-                    <span class="pf-fs-12 <%= field.blocked_by.any? ? 'pf-text-block' : (field.unconfigured ? 'pf-text-warn' : 'pf-text-3') %>">
-                      <%= render 'effective_field_source', field: field %>
+                    <%= pf_effective_field_badge(field) %>
+                    <span class="pf-fs-12 <%= { muted: 'pf-text-block', unconfigured: 'pf-text-warn' }.fetch(field.reason, 'pf-text-3') %>">
+                      <%= render 'effective_field_source', field: field, res_name: res.name %>
                     </span>
                   <% end %>
                 <% end %>
@@ -95,7 +94,9 @@
                       <%= link_to permission_forge.person_path(@person, tab: 'effective', why: key, open: (@open + [res.name]).uniq),
                                   class: "pf-state pf-state--#{outcome.state} pf-action-pill", data: { pf_why: key },
                                   'aria-current': (@why == key ? 'true' : nil) do %>
-                        <span aria-hidden="true"><%= PermissionForge::UiHelper::STATE_GLYPHS[outcome.state] %></span> <%= name.humanize %>
+                        <% state = pf_state(:effective, outcome.state) %>
+                        <span aria-hidden="true"><%= state.glyph %></span> <%= pf_action_label_text(nil, name) %>
+                        <span class="pf-fs-12">· <%= state.word %></span>
                       <% end %>
                     <% end %>
                   </div>
@@ -104,7 +105,7 @@
             </div>
           <% end %>
         </div>
-      </div>
+      <% end %>
 
       <aside class="pf-split__side pf-card" aria-live="polite" aria-label="<%= t('.why_label') %>">
         <div class="pf-why" data-pf-why-empty <%= 'hidden' if @why.present? %>>

data/app/views/permission_forge/people/_effective_why.html.erb

@@ -4,17 +4,17 @@
   <% PermissionForge::Admin::EffectiveAccess::CRUD.each do |flag| %>
     <% outcome = res.op(flag) %>
     <% flag_label = t("permission_forge.ui.flags_short.#{flag}") %>
-    <%= render 'why_item', key: "#{res.name}.#{flag}", title: "#{flag_label} #{plural}",
-               badge: pf_state_cell(outcome.state, aria: "#{flag_label} #{plural}"),
-               reasons: outcome.granted_by.map { |ps| ['✓', t('.flag_granted', set: ps.name, flag: flag_label), ps] } +
-                        outcome.blocked_by.map { |ps| ['⊘', t('.flag_muted', set: ps.name, flag: flag_label), ps] } +
+    <%= render 'why_item', key: "#{res.name}.#{flag}", title: t('.flag_title', flag: flag_label, resource: plural),
+               badge: pf_state_cell(outcome.state, aria: t('.flag_title', flag: flag_label, resource: plural)),
+               reasons: outcome.granted_by.map { |ps| ['✓', pf_t_markup(set: pf_chain_set_name(ps, res.name)) { |held| t('.flag_granted', **held, flag: flag_label) }, ps] } +
+                        outcome.blocked_by.map { |ps| ['⊘', pf_t_markup(set: pf_muting_set_name(ps, outcome, res.name)) { |held| t('.flag_muted', **held, flag: flag_label) }, ps] } +
                         (outcome.granted_by.empty? ? [['–', t('.flag_none', flag: flag_label), nil]] : []),
                note: outcome.blocked? ? t('.note_muting') : t('.note_add_up') %>
   <% end %>
 
   <% records_reasons = case res.records
-                       when :all then res.op(:view_all).granted_by.map { |ps| ['✓', t('.view_all_from', set: ps.name), ps] }
-                       when :rules then res.rules.map { |src| ['◷', pf_rule_text(src.rule, res.name), src.permission_set] }.presence || [['✓', t('.no_rules'), nil]]
+                       when :all then res.op(:view_all).granted_by.map { |ps| ['✓', pf_t_markup(set: pf_chain_set_name(ps, res.name)) { |held| t('.view_all_from', **held) }, ps] }
+                       when :rules then res.rules.map { |src| [pf_rule_glyph(src.rule), pf_rule_text(src.rule, res.name), src.permission_set] }.presence || [['✓', t('.no_rules'), nil]]
                        else [['–', t('.records_none'), nil]]
                        end %>
   <%= render 'why_item', key: "#{res.name}.records", title: t('.records_title', resource: plural),
@@ -23,25 +23,29 @@
              note: res.records == :rules ? t('.note_rules') : nil %>
 
   <% res.fields.each do |field| %>
-    <% field_label = res.name.safe_constantize&.human_attribute_name(field.name) || field.name.humanize %>
-    <% reasons = field.granted_by.map { |ps| ['✓', t('.field_from', set: ps.name), ps] } %>
-    <% reasons += field.blocked_by.map { |ps| ['⊘', t('.field_muted', set: ps.name), ps] } %>
+    <% field_label = pf_field_label_text(res.name, field.name) %>
+    <%# Each set is named with the Resource whose row it credits: the deciding entry's for a grant, the muting row's for a mute (B#35, B#38). %>
+    <% reasons = field.grants.map { |src| ['✓', pf_field_source_sentence(src, set_name: pf_field_source_set_name(src, res.name)), src.permission_set] } %>
+    <% reasons += field.mutes.map { |src| ['⊘', pf_field_source_sentence(src, set_name: pf_field_source_set_name(src, res.name)), src.permission_set] } %>
     <% reasons << ['⚠', t('.field_unconfigured', behaviour: t("permission_forge.ui.unconfigured.#{PermissionForge.configuration.unconfigured_field_strategy}", default: t('permission_forge.ui.unconfigured.block'))), nil] if field.unconfigured %>
     <% reasons << ['–', t('.field_capped'), nil] if field.capped %>
     <% reasons << ['◇', t('.field_virtual'), nil] if field.implicit %>
     <% reasons << ['↳', t('.field_variant', base: field.variant_of), nil] if field.variant_of %>
+    <% chain = pf_field_chain_reason(field) %>
+    <% reasons << [*chain, nil] if chain %>
     <% reasons << ['–', t('.field_none'), nil] if reasons.empty? %>
-    <%= render 'why_item', key: "#{res.name}.field.#{field.name}", title: "#{pf_resource_label(res.name)} › #{field_label}",
-               badge: pf_level_badge(field.level, strategy: (field.mask_strategy if field.level == 'masked'), sample_for: (field.name if field.level == 'masked')),
+    <%= render 'why_item', key: "#{res.name}.field.#{field.name}", title: t('.field_title', resource: pf_resource_label(res.name), field: field_label),
+               badge: pf_effective_field_badge(field, sample: true),
                reasons: reasons,
-               note: field.blocked_by.any? ? t('.note_muting') : t('.note_fields') %>
+               note: field.reason == :muted ? t('.note_muting') : t('.note_fields') %>
   <% end %>
 
   <% res.actions.each do |name, outcome| %>
-    <%= render 'why_item', key: "#{res.name}.action.#{name}", title: "#{name.humanize} · #{plural}",
-               badge: pf_state_cell(outcome.state, aria: name.humanize),
-               reasons: outcome.granted_by.map { |ps| ['✓', t('.action_granted', set: ps.name), ps] } +
-                        outcome.blocked_by.map { |ps| ['⊘', t('.action_muted', set: ps.name), ps] } +
+    <% action_label = pf_action_label_text(nil, name) %>
+    <%= render 'why_item', key: "#{res.name}.action.#{name}", title: t('.action_title', action: action_label, resource: plural),
+               badge: pf_state_cell(outcome.state, aria: action_label),
+               reasons: outcome.granted_by.map { |ps| ['✓', pf_t_markup(set: pf_chain_set_name(ps, res.name)) { |held| t('.action_granted', **held) }, ps] } +
+                        outcome.blocked_by.map { |ps| ['⊘', pf_t_markup(set: pf_muting_set_name(ps, outcome, res.name)) { |held| t('.action_muted', **held) }, ps] } +
                         (outcome.granted_by.empty? ? [['–', t('.action_none'), nil]] : []),
                note: outcome.blocked? ? t('.note_muting') : t('.note_add_up') %>
   <% end %>

data/app/views/permission_forge/people/_why_item.html.erb

@@ -9,7 +9,7 @@
         <span class="pf-stack pf-stack--tight">
           <span><%= text %></span>
           <% if set %>
-            <%= link_to t('.open_set', set: set.name), permission_forge.permission_set_path(set), class: 'pf-fs-12' %>
+            <%= link_to t('.open_set', set: pf_record_name(set)), permission_forge.permission_set_path(set), class: 'pf-fs-12' %>
           <% end %>
         </span>
       </li>

data/app/views/permission_forge/people/confirm_remove_all.html.erb

@@ -4,18 +4,18 @@
                      breadcrumb: pf_breadcrumb([t('permission_forge.nav.people'), permission_forge.people_path], [name, permission_forge.person_path(@person)], t('.crumb')) }) do %>
   <% if @removable.empty? %>
     <p class="pf-text-2"><%= t('.nothing', name: pf_person(@person).first_name) %></p>
-    <% if @kept.any? %><p class="pf-text-2"><%= t('.kept', sets: @kept.map { |a| a.permission_set.name }.to_sentence) %></p><% end %>
+    <% if @kept.any? %><p class="pf-text-2"><%= t('.kept', sets: pf_to_sentence(@kept.map { |a| pf_record_name(a.permission_set) })) %></p><% end %>
     <div class="pf-actions pf-row--right">
       <%= link_to t('permission_forge.ui.close'), permission_forge.person_path(@person), class: 'pf-btn', data: { pf_close: true } %>
     </div>
   <% else %>
     <p class="pf-text-2">
-      <%= @lost.any? ? t('.body', name: pf_person(@person).first_name, resources: @lost.to_sentence) : t('.body_no_resources', name: pf_person(@person).first_name) %>
+      <%= @lost.any? ? t('.body', name: pf_person(@person).first_name, resources: pf_to_sentence(@lost)) : t('.body_no_resources', name: pf_person(@person).first_name) %>
     </p>
     <ul class="pf-confirm__list">
       <% @removable.each do |a| %><li><%= pf_set_chip(a.permission_set, href: nil, expired: a.expired?) %></li><% end %>
     </ul>
-    <% if @kept.any? %><p class="pf-text-2"><%= t('.kept', sets: @kept.map { |a| a.permission_set.name }.to_sentence) %></p><% end %>
+    <% if @kept.any? %><p class="pf-text-2"><%= t('.kept', sets: pf_to_sentence(@kept.map { |a| pf_record_name(a.permission_set) })) %></p><% end %>
     <%= form_with url: permission_forge.remove_all_person_path(@person), method: :delete, class: 'pf-confirm-form' do %>
       <%= render 'permission_forge/shared/reason_field' %>
       <div class="pf-actions pf-row--right">

data/app/views/permission_forge/people/erasure_preview.html.erb

@@ -10,7 +10,7 @@
                        groups: t('.groups', count: @preview[:group_assignments_count].to_i)) %>
     </span>
     <% if @preview[:permission_sets].present? %>
-      <ul class="pf-confirm__list"><% @preview[:permission_sets].each do |name| %><li><%= name %></li><% end %></ul>
+      <ul class="pf-confirm__list"><% @preview[:permission_sets].each do |name| %><li><%= pf_record_name_text(name, :permission_set) %></li><% end %></ul>
     <% end %>
     <span class="pf-fs-12 pf-text-3"><%= t('.untouched') %></span>
   </div>