permission_forge 0.14.1 → 0.15.0

data/lib/permission_forge/admin/change_set_parts/new_fields.rb

@@ -4,7 +4,10 @@ module PermissionForge
   module Admin
     module ChangeSetParts
       # New fields: columns without a ResourceField row, picked one by one or
-      # through a bulk selection.
+      # through a bulk selection. Only the model's managed fields
+      # (PermissionForge::ManagedFields — the names the presets, Sync and the
+      # generator write rows for) can be added: a posted `id`, an ignored
+      # field or a name the model does not have is no row.
       class NewFields < Base
         def call
           explicit = section('new_fields').flat_map { |resource_id, columns| explicit_new_fields(resource_id, columns) }
@@ -20,7 +23,7 @@ module PermissionForge
           existing = existing_names(resource)
           columns.filter_map do |column, attrs|
             name = column.to_s
-            next if existing.include?(name) || !attrs.is_a?(Hash)
+            next if existing.include?(name) || !attrs.is_a?(Hash) || !addable?(resource, name)
 
             build_new_field(resource, name, attrs['level'].to_s)
           end
@@ -36,7 +39,21 @@ module PermissionForge
 
         # Bulk-selected columns that have neither a field nor an explicit pick.
         def bulk_columns(resource)
-          Array(bulk['keys']).map(&:to_s).uniq - existing_names(resource) - explicit_columns(resource)
+          (Array(bulk['keys']).map(&:to_s).uniq & addable_names(resource)) - existing_names(resource) - explicit_columns(resource)
+        end
+
+        def addable?(resource, name)
+          addable_names(resource).include?(name)
+        end
+
+        # The model's managed fields; none when the Resource names no model
+        # this app can load.
+        def addable_names(resource)
+          @addable_names ||= {}
+          @addable_names[resource.id] ||= begin
+            model = PermissionForge::ModelLookup.model_for(resource.name)
+            model ? PermissionForge::ManagedFields.new(model).names : []
+          end
         end
 
         def existing_names(resource)
@@ -47,15 +64,25 @@ module PermissionForge
           (params.dig('new_fields', resource.id.to_s) || {}).keys.map(&:to_s)
         end
 
+        # The row comes from the one row builder (ResourceFieldGenerator::
+        # RowBuilder: privacy defaults, timestamps, the recommended strategy),
+        # so the change records the level the row really gets — Masked for a
+        # sensitive column added Read-only under gdpr_defaults, Read-only for
+        # a timestamp added Editable. A blank name is no row.
         def build_new_field(resource, column, level)
-          return nil unless valid_level?(level) && level != 'leave'
-
-          level = Values.effective_level(level, resource, muting: muting?)
-          field = resource.resource_fields.build(name: column, label: column.humanize, is_active: true, is_editable: true)
-          field.assign_attributes(flags_for(level))
-          field.mask_strategy = sensitive.match(column)&.strategy || 'full'
-          change(kind: :new_field, record: field, attribute: 'level', from: nil, to: [level, field.mask_strategy],
-                 resource: resource)
+          return nil unless valid_level?(level) && FieldLevel.row?(level, muting: muting?)
+
+          attrs = rows_of(resource).attrs(column, level)
+          return nil unless attrs
+
+          field = resource.resource_fields.build(attrs)
+          change(kind: :new_field, record: field, attribute: 'level', from: nil,
+                 to: [FieldLevel.level_of(field, muting: muting?), field.mask_strategy], resource: resource)
+        end
+
+        def rows_of(resource)
+          @rows_of ||= {}
+          @rows_of[resource.id] ||= Services::ResourceFieldGenerator.rows(resource, muting: muting?, sensitive: sensitive)
         end
       end
     end

data/lib/permission_forge/admin/change_set_parts/resource_edit.rb

@@ -10,9 +10,12 @@ module PermissionForge
         TEXT = %w[label description].freeze
         READ_DEPENDENT = %w[edit_access delete_access view_all modify_all].freeze
 
-        def initialize(resource, muting:)
+        # @param refused [Array] collects a ChangeSet::Refusal for each flag
+        #   the request turns on and the cascades keep off
+        def initialize(resource, muting:, refused: [])
           @resource = resource
           @muting = muting
+          @refused = refused
         end
 
         def changes(attrs)
@@ -29,6 +32,7 @@ module PermissionForge
         # part of) the request.
         def flag_changes(requested)
           wanted = wanted_flags(requested)
+          note_refused(requested, wanted)
           FLAGS.filter_map do |flag|
             to = wanted[flag]
             change(flag, to, kind: :resource_flag, cascaded: requested.fetch(flag, :absent) != to).assign
@@ -41,6 +45,18 @@ module PermissionForge
           wanted
         end
 
+        # A flag the request turns on that the cascades keep off (Edit without
+        # Read, say: a form the UI never sends) is not a change, so the review
+        # would say nothing about it. Noted, with what it needs.
+        def note_refused(requested, wanted)
+          requested.each do |flag, value|
+            next unless value && !wanted[flag] && !@resource.public_send(flag)
+
+            needs = flag == 'modify_all' && wanted['read_access'] ? :view_all_and_edit : :read
+            @refused << ChangeSet::Refusal.new(resource: @resource, attribute: flag, needs: needs)
+          end
+        end
+
         def cascade!(flags)
           READ_DEPENDENT.each { |flag| flags[flag] = false } unless flags['read_access']
           flags['modify_all'] = false unless flags['edit_access'] && flags['view_all']

data/lib/permission_forge/admin/change_set_parts/resource_flags.rb

@@ -10,7 +10,7 @@ module PermissionForge
             resource = unlocked_resource(id)
             next [] unless resource && attrs.is_a?(Hash)
 
-            ResourceEdit.new(resource, muting: muting?).changes(attrs)
+            ResourceEdit.new(resource, muting: muting?, refused: refused).changes(attrs)
           end
         end
       end

data/lib/permission_forge/admin/change_set_parts/set_attrs.rb

@@ -6,6 +6,7 @@ module PermissionForge
       # Set header: name, description, active, group.
       class SetAttrs < Base
         SET_ATTRS = %w[name description is_active permission_set_group_id].freeze
+        TEXT_ATTRS = %w[name description].freeze
         # A group id that is neither blank (no group) nor digits.
         NOT_A_GROUP = Object.new.freeze
         TEXT_CAST = ->(value) { value.to_s.strip.presence if value.is_a?(String) || value.is_a?(Numeric) }
@@ -36,7 +37,10 @@ module PermissionForge
           EditableLock.locked_group_for_move(from: permission_set.permission_set_group_id, to: group_id).present?
         end
 
+        # A blank name over a generated one, or a blank description over
+        # none, is no change (Prefill.posted).
         def cast(attr, value)
+          value = Prefill.posted(permission_set, attr, value) if TEXT_ATTRS.include?(attr)
           CASTS.fetch(attr, TEXT_CAST).call(value)
         end
       end

data/lib/permission_forge/admin/change_set_parts/values.rb

@@ -5,14 +5,20 @@ module PermissionForge
     module ChangeSetParts
       # Stateless value rules shared by the ChangeSet collaborators.
       module Values
+        # A flag of the change set's params (`pf[...]`), read as every
+        # admin and API flag is (ParamShapes.boolean: the forms post "0" and
+        # "1"); nil is false.
+        #
+        # @raise [ParamShapes::InvalidFlag] for anything else: ActiveModel's
+        #   cast read "nope" as true (the admin answers with a flash)
         def self.truthy?(value)
-          ActiveModel::Type::Boolean.new.cast(value) == true
+          value.nil? ? false : ParamShapes.flag('pf', value)
         end
 
-        # Edit on a resource without Edit is downgraded to Read (muting sets
-        # have inverted semantics, so Edit is always available there).
+        # Edit on a resource without Edit is downgraded to Read
+        # (FieldLevel.capped, the one definition).
         def self.effective_level(level, resource, muting:)
-          level == 'edit' && !(muting || resource.edit_access) ? 'read' : level
+          FieldLevel.capped(level, resource_edit: resource.edit_access, muting: muting)
         end
       end
     end

data/lib/permission_forge/admin/column_fields.rb

@@ -2,18 +2,28 @@
 
 module PermissionForge
   module Admin
-    # Creates ResourceFields for model columns and virtual fields at one level,
-    # applying privacy defaults: sensitive names start Masked when gdpr_defaults
-    # is on, and the muting 'hide_sensitive' level hides only sensitive names.
+    # Creates ResourceFields for model columns and virtual fields at one
+    # level: the admin's presets ("Add resource"), "Add all new" and "Sync
+    # fields". The rows themselves come from the one row builder
+    # (Services::ResourceFieldGenerator::RowBuilder): privacy defaults,
+    # timestamps, the recommended strategy, the label. This class only turns
+    # a preset into a level per column — the muting 'hide_sensitive' preset
+    # hides the sensitive names and leaves the others alone — and skips the
+    # levels that are no row (Unchanged, a level the set's kind lacks).
+    #
+    # @api private
     class ColumnFields
+      # The muting preset that hides the sensitive names and leaves the others.
+      HIDE_SENSITIVE = 'hide_sensitive'
+
       def initialize(resource, muting:, sensitive: SensitiveColumns.new, configuration: PermissionForge.configuration)
         @resource = resource
         @muting = muting
         @sensitive = sensitive
-        @configuration = configuration
+        @rows = Services::ResourceFieldGenerator.rows(resource, muting: muting, configuration: configuration, sensitive: sensitive)
       end
 
-      # @return [Integer] number of fields created (columns whose level resolves to nil are skipped)
+      # @return [Integer] number of fields created (columns whose level resolves to nil, and blank names, are skipped)
       def create(columns, level)
         columns.filter_map { |column| create_field(column, level) }.size
       end
@@ -21,27 +31,18 @@ module PermissionForge
       private
 
       def create_field(column, level)
-        match = @sensitive.match(column)
-        column_level = @muting ? muting_level(level, match) : granting_level(level, match)
+        column_level = column_level(column, level)
         return unless column_level
 
-        attrs = FieldLevel.flags_for(column_level, muting: @muting)
-        @resource.resource_fields.create!(attrs.merge(name: column, label: column.humanize, is_active: true, is_editable: true,
-                                                      mask_strategy: match&.strategy || 'full'))
-      end
-
-      def muting_level(level, match)
-        return 'hide' if level == 'hide_sensitive' && match
-        return nil if %w[hide_sensitive leave].include?(level) || level.blank?
-
-        FieldLevel.valid?(level, muting: true) ? level : nil
+        attrs = @rows.attrs(column, column_level)
+        @resource.resource_fields.create!(attrs) if attrs
       end
 
-      def granting_level(level, match)
-        return nil unless FieldLevel.valid?(level, muting: false)
-        return 'masked' if match && %w[read edit].include?(level) && @configuration.gdpr_defaults
+      # @return [String, nil] the level the column's row gets, nil for no row
+      def column_level(column, level)
+        return level if FieldLevel.row?(level, muting: @muting)
 
-        level
+        'hide' if @muting && level == HIDE_SENSITIVE && @sensitive.sensitive?(column)
       end
     end
   end

data/lib/permission_forge/admin/conditions_form.rb

@@ -1,13 +1,16 @@
 # frozen_string_literal: true
 
-require 'ipaddr'
-
 module PermissionForge
   module Admin
     # Activation conditions form (Conditions tab): turns the posted IP list,
     # hour window and session flag into PermissionSet attributes, collecting
-    # per-input errors (:ips => [messages], :flag => message).
+    # per-input errors (:ips => [messages], :hours => message, :flag =>
+    # message). What it refuses is what ActivationConditions cannot judge,
+    # for the same reason: an entry ActivationConditions.ip_range does not
+    # read as an address, a window whose HoursWindow#problem is not nil.
     class ConditionsForm
+      # The hours the tab shows before anything is chosen.
+      DEFAULT_HOURS = { from: 8, to: 18 }.freeze
       FLAG_FORMAT = /\A[\w.:-]{1,100}\z/
 
       attr_reader :errors
@@ -18,25 +21,41 @@ module PermissionForge
         @errors = {}
       end
 
-      # Evaluated in order, so errors are keyed :ips before :flag.
+      # Evaluated in order, so errors are keyed :ips, then :hours, then :flag.
       def attributes
         @attributes ||= {
           allowed_ips: ips.join(',').presence,
           allowed_hours_start: hour(:allowed_hours_start),
           allowed_hours_end: hour(:allowed_hours_end),
           requires_session_flag: session_flag
-        }
+        }.tap { check_hours }
       end
 
       private
 
+      # The entries as the engine reads them (ActivationConditions.entries:
+      # commas, newlines or spaces between them); an entry
+      # ActivationConditions.ip_range does not read as an address is refused.
       def ips
-        list = @params[:allowed_ips].to_s.split(/[\n,]/).map(&:strip).reject(&:empty?)
-        bad = list.each_with_index.reject { |ip, _| valid_ip?(ip) }
+        list = PermissionForge::ActivationConditions.entries(@params[:allowed_ips])
+        bad = list.each_with_index.reject { |ip, _| PermissionForge::ActivationConditions.ip_range(ip) }
         @errors[:ips] = bad.map { |ip, i| I18n.t('permission_forge.errors.admin.ip', line: i + 1, ip: ip) } if bad.any?
         list
       end
 
+      # A window nobody can judge (HoursWindow#problem: one hour of the two,
+      # an hour outside 0–23, the same hour twice) is refused by the model
+      # (PermissionSet#hours_window_is_judgeable); said here too, keyed
+      # :hours, so the form shows it next to the selects.
+      def check_hours
+        problem = posted_window.problem
+        @errors[:hours] = I18n.t("permission_forge.errors.admin.#{problem}") if problem
+      end
+
+      def posted_window
+        PermissionForge::ActivationConditions::HoursWindow.new(from: hour(:allowed_hours_start), to: hour(:allowed_hours_end))
+      end
+
       public
 
       # Whether the hour window was switched on in the posted form.
@@ -50,6 +69,27 @@ module PermissionForge
         RecordId.cast(@params[key])
       end
 
+      # The hour window the Conditions tab shows: the posted hours of a
+      # refused form (`form`), else the set's (HoursWindow; the tab asks it
+      # whether it is set, wraps midnight or is broken, never compares the
+      # hours itself).
+      #
+      # @param set [PermissionSet]
+      # @param form [ConditionsForm, nil]
+      # @return [ActivationConditions::HoursWindow]
+      def self.window(set, form)
+        stored = set.hours_window
+        return stored unless form
+
+        PermissionForge::ActivationConditions::HoursWindow.new(from: form.submitted_hour(:allowed_hours_start) || stored.from,
+                                                               to: form.submitted_hour(:allowed_hours_end) || stored.to)
+      end
+
+      # Whether the tab shows the hour window switched on: as posted, else as stored.
+      def self.hours_on?(set, form)
+        form ? form.hours_enabled? : set.hours_window.set?
+      end
+
       private
 
       # nil unless the hour window is enabled.
@@ -65,14 +105,6 @@ module PermissionForge
         @errors[:flag] = I18n.t('permission_forge.errors.admin.flag')
         nil
       end
-
-      # IPAddr::Error is an ArgumentError.
-      def valid_ip?(value)
-        IPAddr.new(value)
-        true
-      rescue ArgumentError
-        false
-      end
     end
   end
 end

data/lib/permission_forge/admin/controller_catalog.rb

@@ -8,10 +8,11 @@ module PermissionForge
     #
     # Reads the route table once per instance. Routes without a static
     # controller and action (mounted engines and Rack apps, redirects, dynamic
-    # segments), internal routes, excluded controllers and actions whose name
-    # cannot be a ResourceAction key are skipped. A
-    # controller that fails to load, or a host resolver that raises, drops
-    # that one entry instead of the whole catalog.
+    # segments), internal routes and excluded controllers are skipped; actions
+    # whose name cannot be a ResourceAction key are left out of #entries (no
+    # row can manage them) but kept in #mapped_entries, since the guard still
+    # checks them. A controller that fails to load, or a host resolver that
+    # raises, drops that one entry instead of the whole catalog.
     #
     # @example
     #   catalog = ControllerCatalog.new
@@ -26,11 +27,16 @@ module PermissionForge
       # One mapped controller action. `key` is the action key the guard asks
       # for; `crud` is :read / :create / :edit / :delete when the action means
       # a CRUD permission, nil for a custom action. `guarded` is whether the
-      # controller runs the guard (ControllerActions.guarded?).
+      # controller runs the guard (ControllerActions.guarded?). `manageable`
+      # is whether a row can manage it (Mapping::Target#manageable?).
       Entry = Struct.new(:controller_path, :action_name, :verbs, :paths, :resource, :key, :crud, :guarded,
-                         keyword_init: true) do
+                         :manageable, keyword_init: true) do
         def crud? = !crud.nil?
         def guarded? = guarded == true
+        def manageable? = manageable == true
+
+        # ['Customer', 'export']: what a ResourceAction row of that resource and name manages
+        def pair = [resource, key]
 
         # 'customers#export'
         def endpoint = "#{controller_path}##{action_name}"
@@ -82,13 +88,23 @@ module PermissionForge
         # controller_path => conventional resource, filled by Mapping: one
         # lookup per controller instead of one per route.
         @conventions = {}
+        @skipped = []
       end
 
-      # @return [Array<Entry>] one per mapped (controller_path, action_name),
-      #   sorted by resource, key, controller and action
+      # @return [Array<Entry>] one per mapped (controller_path, action_name)
+      #   a row can manage, sorted by resource, key, controller and action
       def entries
-        @entries ||= routed_actions.filter_map { |(path, action), route| build_entry(path, action, route) }
-                                   .sort_by(&:sort_key).freeze
+        @entries ||= mapped_entries.select(&:manageable?).freeze
+      end
+
+      # Every mapped controller action, those whose name cannot be an action
+      # key included: the guard checks them too (with no row possible, the
+      # strategy for unmanaged actions decides).
+      #
+      # @return [Array<Entry>] sorted as #entries
+      def mapped_entries
+        @mapped_entries ||= routed_actions.filter_map { |(path, action), route| build_entry(path, action, route) }
+                                          .sort_by(&:sort_key).freeze
       end
 
       # @param resource_name [String, Symbol] e.g. 'Customer'
@@ -104,6 +120,17 @@ module PermissionForge
         for_resource(resource_name).map(&:key).uniq
       end
 
+      # What reading the routes could not judge: a controller that fails to
+      # load (listed, but whether it runs the guard is unknown) and a
+      # controller action dropped because its controller, the resolver or the
+      # mapping raised. The log has the first error.
+      #
+      # @return [Array<String>] "customers#export: RuntimeError", "broken: NameError"
+      def skipped
+        mapped_entries
+        @skipped.dup.freeze
+      end
+
       # @return [Boolean] whether any listed controller runs the guard (see
       #   ControllerActions.guarded?). When false, permitting or blocking an
       #   action changes nothing at runtime.
@@ -130,11 +157,11 @@ module PermissionForge
         klass = controller_class(path)
         target = ControllerActions::Mapping.call(controller_path: path, action_name: action, controller_class: klass,
                                                  configuration: @configuration, conventions: @conventions)
-        return nil unless target&.manageable?
+        return nil unless target
 
         Entry.new(controller_path: path, action_name: action, verbs: route[:verbs].sort, paths: route[:paths].sort,
                   resource: target.resource, key: target.action, crud: target.crud,
-                  guarded: ControllerActions.guarded?(klass))
+                  guarded: ControllerActions.guarded?(klass), manageable: target.manageable?)
       rescue StandardError => e
         log_skipped("#{path}##{action}", e)
         nil
@@ -153,9 +180,10 @@ module PermissionForge
         nil
       end
 
-      # Logged once per catalog: a raising resolver would otherwise repeat the
-      # same line for every route.
+      # Kept for #skipped; logged once per catalog: a raising resolver would
+      # otherwise repeat the same line for every route.
       def log_skipped(what, error)
+        @skipped << "#{what}: #{error.class}"
         return if @logged
 
         @logged = true

data/lib/permission_forge/admin/editable_lock.rb

@@ -23,10 +23,20 @@ module PermissionForge
     # those changes goes the other way: adding a holder or keeping them
     # longer narrows, removing one or ending their assignment sooner widens.
     #
+    # "Locked" has one definition, here, for the controllers, the API, the
+    # read models and the views alike: .locked?(record) walks the chain, and
+    # .permits?(record, action) says whether the admin may offer an action
+    # on a record — the one table the controllers' refusals and the views'
+    # "show, disable or leave out" both read (html/locked_pages_test.rb
+    # checks every control of every page rendered for a locked record
+    # against it).
+    #
     # @example
     #   EditableLock.locked_record(field)          # => the locked Resource or Permission Set, or nil
+    #   EditableLock.locked?(field)                # => true when the field, its Resource or its set is locked
     #   EditableLock.chain(rule)                   # => [rule, resource, permission_set]
     #   EditableLock.widening_lock(set, :revoke)   # => the set when it is locked and muting, else nil
+    #   EditableLock.permits?(assignment, :revoke) # => false on a locked Muting Permission Set
     module EditableLock
       # What each record belongs to, for the lock: the first that is present.
       PARENTS = {
@@ -42,6 +52,13 @@ module PermissionForge
       # locked container refuses the deletion (a set in a locked group).
       CONTAINERS = { 'PermissionForge::PermissionSet' => :permission_set_group }.freeze
 
+      # The changes to who holds a set (.widens_access?): judged by direction,
+      # on the set the record is or belongs to.
+      HOLDER_CHANGES = %i[grant revoke change_expiry].freeze
+      # Actions a lock never refuses: a copy is editable, a review changes no
+      # access, offboarding and a cache refresh narrow or change nothing.
+      ALWAYS_PERMITTED = %i[duplicate review revoke_all refresh consent erasure].freeze
+
       module_function
 
       # @param record [ActiveRecord::Base, nil]
@@ -59,17 +76,47 @@ module PermissionForge
       # @return [ActiveRecord::Base, nil] the first locked record in their chains
       def locked_record(*records)
         records.flatten.compact.each do |record|
-          locked = chain(record).find { |link| locked?(link) }
+          locked = chain(record).find { |link| flagged?(link) }
           return locked if locked
         end
         nil
       end
 
-      # @return [Boolean] whether the record itself is flagged is_editable: false
+      # Whether the record is locked: itself, or what it belongs to (its
+      # chain) flagged is_editable: false. The one answer for a view's
+      # "locked" and a controller's refusal.
+      #
+      # @param record [ActiveRecord::Base, nil]
+      # @return [Boolean]
       def locked?(record)
+        !locked_record(record).nil?
+      end
+
+      # @return [Boolean] whether the record itself carries the flag (is_editable: false)
+      def flagged?(record)
         record.respond_to?(:is_editable) && record.is_editable == false
       end
 
+      # Whether the admin may offer `action` on `record`: a change to the
+      # holders of a set (:grant, :revoke, :change_expiry with from:/to:)
+      # goes by direction (.widening_lock); ALWAYS_PERMITTED actions always
+      # may; :delete also asks the record's container (.container_of); any
+      # other action (:edit, :add, :toggle, :sync, :acknowledge, ...) changes
+      # what the record holds and is refused while the record is locked.
+      #
+      # @param record [ActiveRecord::Base] the record the action is on (an
+      #   assignment or its set for a holder change)
+      # @param action [Symbol]
+      # @param expiry [Hash] from:, to: for :change_expiry
+      # @return [Boolean]
+      def permits?(record, action, **expiry)
+        return true if ALWAYS_PERMITTED.include?(action)
+        return holder_change_permitted?(record, action, **expiry) if HOLDER_CHANGES.include?(action)
+        return false if locked?(record)
+
+        action != :delete || !flagged?(container_of(record))
+      end
+
       # Moving a set from one Permission Set Group to another changes both
       # groups' lists of sets: refused when either is locked (the group
       # page's add/remove set refuses the same).
@@ -81,7 +128,7 @@ module PermissionForge
         to = RecordId.cast(to)
         return nil if to == from
 
-        PermissionForge::PermissionSetGroup.where(id: [from, to].compact).detect { |group| locked?(group) }
+        PermissionForge::PermissionSetGroup.where(id: [from, to].compact).detect { |group| flagged?(group) }
       end
 
       # The container whose list deleting `record` would change, or nil.
@@ -92,6 +139,21 @@ module PermissionForge
         association && record.public_send(association)
       end
 
+      # The set a holder change is on: the record when it is one, else the
+      # set an assignment belongs to; nil for a group or its membership.
+      def permission_set_of(record)
+        set = record.respond_to?(:permission_set) ? record.permission_set : record
+        set if set.is_a?(PermissionForge::PermissionSet)
+      end
+
+      # A holder change on a set goes by direction (.widening_lock); one on a
+      # Permission Set Group (a membership, or the group) has none — a
+      # locked group freezes its members both ways.
+      def holder_change_permitted?(record, action, **expiry)
+        set = permission_set_of(record)
+        set ? widening_lock(set, action, **expiry).nil? : !locked?(record)
+      end
+
       # How a change moves a person's holding of a set: +1 they hold it more
       # (added, or kept longer), -1 less (removed, or ended sooner), 0 not at
       # all (the same end date again).
@@ -127,6 +189,24 @@ module PermissionForge
         locked_record(permission_set)
       end
 
+      # The end-date changes a "Change end date" menu (or Home's "Extend 30
+      # days", ExpiryPresets::EXTEND_KEY) offers for `assignment`: those the
+      # lock lets through (.widening_lock), so a locked set never offers a
+      # choice that would be refused.
+      #
+      # @param assignment [PermissionForge::PermissionSetUser]
+      # @param keys [Array<String>] the changes to choose from (ExpiryPresets.change_to keys)
+      # @return [Array<String>]
+      def expiry_choices(assignment, keys: ExpiryPresets::CHANGE_KEYS, today: Time.zone.today)
+        set = assignment.permission_set
+        return keys unless locked_record(set)
+
+        keys.reject do |key|
+          to = ExpiryPresets.change_to(key, from: assignment.expires_at, today: today)
+          widening_lock(set, :change_expiry, from: assignment.expires_at, to: to)
+        end
+      end
+
       # +1 when the end date moves later or is cleared, -1 when it moves
       # earlier or is set where there was none, 0 when it stays. Compared at
       # the column's precision (microseconds): a preset computes its end with