permission_forge 0.14.1 → 0.15.0

data/lib/permission_forge/admin/effective_access.rb

@@ -17,18 +17,86 @@ module PermissionForge
       CRUD = %i[read_access create_access edit_access delete_access].freeze
       RESOURCE_FLAGS = (CRUD + %i[view_all modify_all]).freeze
 
-      # A permission outcome with the sets that caused it.
-      Outcome = Struct.new(:state, :granted_by, :blocked_by, keyword_init: true) do
+      # A permission outcome with the sets that caused it. `muted_on`: each
+      # blocking set => the Resource whose row blocks (a single-table-
+      # inheritance base or the resource itself; the row nearest the
+      # resource when the set has several), so a reason names the Resource
+      # the set acts through (LabelsHelper#pf_chain_set_name).
+      Outcome = Struct.new(:state, :granted_by, :blocked_by, :muted_on, keyword_init: true) do
+        # The outcome of the granting sets and the blocking ones (set => Resource).
+        def self.of(granted_by, muted_on)
+          state = if granted_by.empty? then :none
+                  elsif muted_on.any? then :blocked
+                  else :granted
+                  end
+          new(state: state, granted_by: granted_by, blocked_by: muted_on.keys, muted_on: muted_on)
+        end
+
         def granted? = state == :granted
         def blocked? = state == :blocked
       end
 
+      # What one Permission Set does to a field: its most open level (a
+      # granting set: masked, read or edit, with that row's mask strategy) or
+      # what it takes away (a muting set: mask, hide or no_edit) —
+      # Admin::FieldLevel names. `resource_name`: the Resource whose row
+      # does it — the deciding entry's for a grant, the muting row's (an STI
+      # base's or the resource's own) for a mute (field test round 8, B#38).
+      FieldSource = Struct.new(:permission_set, :level, :mask_strategy, :resource_name, keyword_init: true)
+
       # `implicit` — no set configures the field for this outcome: it is a
       # declared virtual field on the implicit read + edit grant
       # (extra_fields_default_access = :grant).
+      # `grants` / `mutes` — the FieldSources behind granted_by / blocked_by, same order:
+      # the sets credited with what they did to the entry that decides.
+      # `decided_by` — for a single-table-inheritance subclass, the base
+      # Resource whose entry decides the field (ResourceChain: the strictest
+      # entry along the chain); nil when the resource's own entry does.
+      # `unreadable` — that entry does not grant Read, so it hides every field.
+      # The level a field shows when a mute decides it (FieldSource#level of a
+      # mute => Admin::FieldLevel granting level): hide => Hidden, mask =>
+      # Masked, no_edit => Read-only.
+      MUTED_LEVELS = { 'hide' => 'hidden', 'mask' => 'masked', 'no_edit' => 'read' }.freeze
+
       FieldOutcome = Struct.new(:name, :level, :mask_strategy, :granted_by, :blocked_by, :blocked_level,
-                                :capped, :unconfigured, :virtual, :variant_of, :implicit, keyword_init: true) do
+                                :capped, :unconfigured, :virtual, :variant_of, :implicit, :grants, :mutes,
+                                :decided_by, :unreadable, keyword_init: true) do
         def visible? = level != 'hidden'
+        # Hidden because a Muting Permission Set takes it away, not because no set grants it.
+        def hidden_by_muting? = level == 'hidden' && blocked_by.any?
+
+        # The mutes that decide the field's level: the strongest mute's level
+        # (blocked_level) when it is the level the field shows
+        # (MUTED_LEVELS), and every set credited at it; none otherwise — a
+        # mute that took editing away from a field a grant shows masked
+        # changed the entry but does not decide what it shows. The row and
+        # "Explain for" name these sets (review of round 8, D1/D2).
+        #
+        # @return [Array<FieldSource>]
+        def deciding_mutes
+          return [] unless blocked_level && MUTED_LEVELS[blocked_level] == level
+
+          mutes.select { |source| source.level == blocked_level }
+        end
+
+        # Why the field is at its level: the one decision a person's
+        # Effective access row, its Why panel and the field drawer's
+        # "Explain for" all word (field test round 8, B#39) —
+        # :muted (#deciding_mutes: a Muting Permission Set decides), :unconfigured, :granted,
+        # :implicit (a virtual field's default), :unreadable (the deciding
+        # entry does not grant Read), :inherited (an STI base's entry
+        # decides and shows it to nobody) or :none (no set shows it).
+        #
+        # @return [Symbol]
+        def reason
+          return :muted if deciding_mutes.any?
+          return :unconfigured if unconfigured
+          return :granted if granted_by.any?
+          return :implicit if implicit
+          return :unreadable if unreadable
+
+          decided_by ? :inherited : :none
+        end
       end
 
       RuleSource = Struct.new(:rule, :permission_set, keyword_init: true)
@@ -39,8 +107,25 @@ module PermissionForge
       end
 
       # One resource name with its [permission_set, resource] pairs from the
-      # granting and muting sets, and the resulting resource flag outcomes.
-      ResourceSources = Struct.new(:name, :grants, :mutes, :flags, keyword_init: true)
+      # granting and muting sets, the resulting resource flag outcomes and
+      # the record rules that apply (its own entry's and, for a
+      # single-table-inheritance subclass, its bases' — ResourceChain.rules).
+      ResourceSources = Struct.new(:name, :grants, :mutes, :flags, :rules, keyword_init: true) do
+        # View All / Modify All on this entry skips its own rules (ResourceChain.rules).
+        def bypassed? = flags[:view_all].granted? || flags[:modify_all].granted?
+
+        # :all when View All is granted and no rule applies (a base entry's
+        # may, past the subclass's own bypass); :rules otherwise.
+        def records
+          return :none unless flags[:read_access].granted?
+
+          flags[:view_all].granted? && rules.empty? ? :all : :rules
+        end
+
+        def outcome(fields:, actions:)
+          ResourceOutcome.new(name: name, flags: flags, records: records, rules: rules, fields: fields, actions: actions)
+        end
+      end
 
       attr_reader :live_sets, :conditional_sets
 
@@ -59,17 +144,20 @@ module PermissionForge
         granting, muting = @live_sets.partition(&:granting?)
 
         names = granting.flat_map { |ps| active_resources(ps).map(&:name) }.uniq
-        names.map { |name| build_resource(sources_for(name, granting, muting)) }
+        names.map { |name| outcome_for_name(name, granting, muting) }
       end
 
       private
 
       # Same selection as PermissionCacheAccessor#active_non_expired_permission_sets
-      # minus the request-context filter.
+      # minus the request-context filter — a granting set whose condition
+      # nobody can judge never passes it, so it is left out
+      # (ActivationConditions#never_grants?).
       def select_live_sets
         ids = PermissionForge::PermissionSetUser.where(user_id: @user.id).active_assignments.select(:permission_set_id)
-        sets = PermissionForge::PermissionSet.active.where(id: ids).order(:created_at, :id)
-                                             .includes(resources: %i[resource_fields resource_actions permission_set_rules]).to_a
+        sets = PermissionForge::PermissionSet.active.where(id: ids).in_hash_order
+                                             .includes(resources: %i[resource_fields resource_actions permission_set_rules])
+                                             .reject(&:never_grants?)
         # Same row order as the hash builder (a variant tie goes to the older row).
         sets.each { |permission_set| PermissionForge::Services::PermissionHashBuilder.sort_rows(permission_set) }
       end
@@ -79,13 +167,26 @@ module PermissionForge
       end
 
       # [permission_set, resource] for every active row of the sets named by
-      # one of `names`, in set order then row order.
+      # one of `names`, in set order, then in the order of `names` (a muting
+      # set's row nearest the resource first), then row order.
       def pairs_for(permission_sets, names)
         permission_sets.flat_map do |ps|
-          active_resources(ps).select { |r| names.include?(r.name) }.map { |resource| [ps, resource] }
+          ChainEntries.in_chain_order(active_resources(ps), names).map { |resource| [ps, resource] }
         end
       end
 
+      # The outcome for one resource name: its sources, the rules along its
+      # chain (ResourceChain.names_for), then the fields — composed with the
+      # entries of its bases the person has (ResourceChain.fields) — and
+      # actions.
+      def outcome_for_name(name, granting, muting)
+        chain = PermissionForge::ResourceChain.names_for(name).map(&:to_s)
+        sources = sources_for(name, granting, muting)
+        sources.rules = rules_along(chain, granting, muting)
+        bases = chain.drop(1).map { |base| sources_for(base, granting, muting) }.select { |base| base.grants.any? }
+        build_resource(sources, bases)
+      end
+
       # A granting set's row for the resource; a muting set's rows for the
       # resource and for the STI bases of the model it names — the engine's
       # cascade (PermissionHashBuilder#apply_muting_permission_set): a muted
@@ -93,44 +194,45 @@ module PermissionForge
       def sources_for(name, granting, muting)
         grants = pairs_for(granting, [name])
         mutes = pairs_for(muting, PermissionForge::ResourceChain.names_for(name).map(&:to_s))
-        flags = RESOURCE_FLAGS.index_with { |flag| outcome_for(grants, mutes) { |r| r.public_send(flag) } }
+        flags = RESOURCE_FLAGS.index_with { |flag| flag_outcome(grants, mutes, flag) }
         ResourceSources.new(name: name, grants: grants, mutes: mutes, flags: flags)
       end
 
-      def build_resource(sources)
-        grants = sources.grants
-        ResourceOutcome.new(
-          name: sources.name, flags: sources.flags,
-          records: records_state(sources.flags),
-          rules: rules_for(grants),
-          fields: EffectiveFields.new(sources, configuration: @configuration, catalog: @catalog).call,
-          actions: action_outcomes(grants, sources.mutes)
-        )
-      end
-
-      # Granted by every granting set whose resource matches; muting sets only
-      # block what some set granted.
-      def outcome_for(grants, mutes, &)
-        granted_by = sets_matching(grants, &)
-        blocked_by = granted_by.any? ? sets_matching(mutes, &) : []
-        Outcome.new(state: outcome_state(granted_by, blocked_by), granted_by: granted_by, blocked_by: blocked_by)
+      # The rules that apply to records of `chain.first` (ResourceChain.rules):
+      # of every entry along the chain without a bypass of its own.
+      def rules_along(chain, granting, muting)
+        chain.flat_map do |name|
+          sources = sources_for(name, granting, muting)
+          sources.bypassed? ? [] : rules_for(sources.grants)
+        end
       end
 
-      # Each set once: a muting set may reach an entry through two rows.
-      def sets_matching(pairs)
-        pairs.select { |_, resource| yield resource }.map(&:first).uniq
+      # `bases`: the ResourceSources of the base entries the person has
+      # (a granting row names them — the engine's entries), nearest first.
+      def build_resource(sources, bases)
+        fields = EffectiveFields.new(sources, configuration: @configuration, catalog: @catalog, bases: bases).call
+        sources.outcome(fields: fields, actions: action_outcomes(sources))
       end
 
-      def outcome_state(granted_by, blocked_by)
-        return :none if granted_by.empty?
-
-        blocked_by.any? ? :blocked : :granted
+      # A resource flag: granted by the granting rows that grant it as the
+      # engine reads them (PermissionHashBuilder.granted_flags — edit and
+      # delete only with read, Modify All only with View All), blocked by the
+      # muting rows that carry it.
+      def flag_outcome(grants, mutes, flag)
+        outcome_for(grants, mutes) do |resource, granting|
+          granting ? PermissionForge::Services::PermissionHashBuilder.granted_flags(resource).fetch(flag) : resource.public_send(flag) == true
+        end
       end
 
-      def records_state(flags)
-        return :none unless flags[:read_access].granted?
-
-        flags[:view_all].granted? ? :all : :rules
+      # Granted by every granting set whose resource matches; muting sets only
+      # block what some set granted, each set once (a muting set may reach an
+      # entry through two rows: its first that blocks is named, pairs_for
+      # puts the one nearest the resource first). The block gets the row and
+      # whether it is a granting one.
+      def outcome_for(grants, mutes)
+        granted_by = grants.select { |_, resource| yield resource, true }.map(&:first).uniq
+        blocking = granted_by.any? ? mutes.select { |_, resource| yield resource, false } : []
+        Outcome.of(granted_by, blocking.group_by(&:first).transform_values { |rows| rows.first.last.name })
       end
 
       def rules_for(grants)
@@ -141,17 +243,14 @@ module PermissionForge
 
       # --- Actions ----------------------------------------------------------
 
-      def action_outcomes(grants, mutes)
-        names = grants.flat_map { |_, r| active_actions(r).map(&:name) }.uniq
-        names.map { |action| [action, outcome_for(grants, mutes) { |r| permitted?(r, action) }] }
-      end
-
-      def active_actions(resource)
-        resource.resource_actions.select(&:is_active)
+      def action_outcomes(sources)
+        grants = sources.grants
+        names = grants.flat_map { |_, r| r.resource_actions.select(&:is_active).map(&:name) }.uniq
+        names.map { |action| [action, outcome_for(grants, sources.mutes) { |r, _granting| permitted?(r, action) }] }
       end
 
       def permitted?(resource, action)
-        active_actions(resource).select(&:is_permitted).map(&:name).include?(action)
+        resource.resource_actions.any? { |row| row.is_active && row.is_permitted && row.name == action }
       end
     end
   end

data/lib/permission_forge/admin/effective_fields.rb

@@ -10,6 +10,12 @@ module PermissionForge
     # Extra fields follow the engine: after every granting set is merged, each
     # declared name that nothing configured gets the implicit entry
     # (ExtraFieldDefaults). A row in any set wins, whatever the set order.
+    #
+    # The explanation comes from the entry that decides (EX): each set is
+    # credited with what it did to the final entry (FieldProvenance). A
+    # subclass's field is composed along its single-table-inheritance chain
+    # as ResourceChain composes it (`bases`, FieldChain): the strictest entry
+    # decides, and the outcome says which (FieldOutcome#decided_by).
     class EffectiveFields
       FieldOutcome = EffectiveAccess::FieldOutcome
 
@@ -18,56 +24,91 @@ module PermissionForge
       UNCONFIGURED_LEVELS = { 'pass_through' => 'read', 'warn' => 'read', 'mask_all' => 'masked' }.freeze
 
       # @param sources [EffectiveAccess::ResourceSources]
-      def initialize(sources, configuration:, catalog:)
+      # @param bases [Array<EffectiveAccess::ResourceSources>] the entries the
+      #   user has for the model's STI bases, nearest first (ResourceChain)
+      def initialize(sources, configuration:, catalog:, bases: [])
         @sources = sources
         @configuration = configuration
         @catalog = catalog
-        # entry: { read_access:, edit_access:, mask_access:, mask_strategy:, sources: [[set, level]], variant_of: }
+        @bases = bases
+        # entry: { read_access:, edit_access:, mask_access:, mask_strategy:, sources: [[set, level, strategy, resource]],
+        #          variant_of:, before: (the flags before muting), mutes: [[set, level, resource]] }
+        # (resource: the name of the Resource whose row it is)
         @entries = {}
       end
 
       # @return [Array<EffectiveAccess::FieldOutcome>]
       def call
+        chain = FieldChain.new(chain_tables)
+        model = @catalog.find(@sources.name)
+        (chain.names + Array(model&.managed_field_names)).uniq.map do |field|
+          composed_outcome(chain, field, model.present? && model.virtual_field?(field))
+        end
+      end
+
+      # The resource's own field entries, merged and muted as the engine does.
+      #
+      # @return [Hash{String => Hash}]
+      def entries
+        return @entries if @merged
+
+        @merged = true
         merge_granting_fields
         apply_muting_fields
+        @entries
+      end
 
-        model = @catalog.find(@sources.name)
-        (@entries.keys + Array(model&.managed_field_names)).uniq.map do |field|
-          field_outcome(field, model.present? && model.virtual_field?(field))
+      private
+
+      # The resource's FieldChain::Table, then each base's along its chain.
+      def chain_tables
+        [FieldChain::Table.new(@sources, entries, nil)] + @bases.map do |base|
+          FieldChain::Table.new(base, self.class.new(base, configuration: @configuration, catalog: @catalog).entries, base.name)
         end
       end
 
-      private
+      def composed_outcome(chain, name, virtual)
+        attributes = chain.attributes(name, virtual: virtual, editable: @sources.flags[:edit_access].granted?)
+        attributes ? FieldOutcome.new(name: name, unconfigured: false, **attributes) : unconfigured_outcome(name, virtual)
+      end
 
       def active_fields(resource)
         resource.resource_fields.select(&:is_active)
       end
 
+      # The engine's variants (FieldVariants): only names the model has.
       def variants_of(name)
-        @configuration.field_variants_for(name)
+        variants.call(name)
       end
 
+      # The engine's own targets (FieldPermissionMerger.targets_of): a
+      # resource's rows under their own names, then the derived variants of
+      # the names no row of the resource has.
       def merge_granting_fields
         @sources.grants.each do |ps, resource|
-          active_fields(resource).each { |field| merge_granting_field(ps, field) }
+          Services::FieldPermissionMerger.targets_of(active_fields(resource), variants).each do |name, field, variant_of|
+            merge_into(entry_for(name, variant_of), field, ps)
+          end
         end
         implicit_names.each { |name| @entries[name] ||= implicit_entry }
       end
 
-      def merge_granting_field(permission_set, field)
-        name = field.name
-        variants_of(name).each { |variant| merge_into(entry_for(variant, name), field, permission_set) }
-        merge_into(entry_for(name, nil), field, permission_set)
+      # An explicit row for the name (variant_of nil) makes the entry a field
+      # of its own, whichever set wrote the derived entry first.
+      def entry_for(key, variant_of)
+        entry = (@entries[key] ||= { sources: [], variant_of: variant_of })
+        entry[:variant_of] = nil if variant_of.nil?
+        entry
       end
 
-      def entry_for(key, variant_of)
-        @entries[key] ||= { sources: [], variant_of: variant_of }
+      def variants
+        @variants ||= FieldVariants.new(@sources.name, @configuration)
       end
 
       # The engine's own merge (FieldPermissionMerger.merge_row), plus provenance.
       def merge_into(entry, field, permission_set)
         Services::FieldPermissionMerger.merge_row(entry, field)
-        entry[:sources] << [permission_set, FieldLevel.level_of(field, muting: false), field.mask_strategy]
+        entry[:sources] << [permission_set, FieldLevel.level_of(field, muting: false), field.mask_strategy, @sources.name]
       end
 
       # Declared names that get the implicit read + edit entry; none under
@@ -75,7 +116,7 @@ module PermissionForge
       # unconfigured virtual fields instead). Read for any constant, like the
       # engine does, not only for the models the catalog lists.
       def implicit_names
-        PermissionForge::VirtualFields.new(@sources.name.to_s.safe_constantize, @configuration).implicit
+        PermissionForge::VirtualFields.new(PermissionForge::ModelLookup.model_for(@sources.name), @configuration).implicit
       end
 
       # The engine's entry for the resource flags as the granting sets merged
@@ -86,86 +127,53 @@ module PermissionForge
       end
 
       def apply_muting_fields
+        @entries.each_value { |entry| entry[:before] = entry.slice(:read_access, :edit_access, :mask_access) }
         @sources.mutes.each do |ps, resource|
-          active_fields(resource).each { |field| apply_muting_field(ps, field) }
-          hide_every_field(ps) if resource.read_access
+          active_fields(resource).each { |field| apply_muting_field(ps, field, resource.name) }
+          hide_every_field(ps, resource.name) if resource.read_access
         end
       end
 
       # A muting set that revokes the resource's read hides every field, as
       # the engine does (PermissionHashBuilder#mute_fields_of_resource). One
-      # that revokes its edit caps every field to read: level_attrs does that
+      # that revokes its edit caps every field to read: FieldProvenance does that
       # from the resource's edit outcome.
-      def hide_every_field(permission_set)
-        @entries.each_value { |entry| hide_entry(entry, permission_set) }
+      def hide_every_field(permission_set, resource_name)
+        @entries.each_value { |entry| hide_entry(entry, permission_set, resource_name) }
       end
 
-      def hide_entry(entry, permission_set)
+      def hide_entry(entry, permission_set, resource_name)
         entry[:read_access] = false
         entry[:edit_access] = false
-        (entry[:mutes] ||= []) << [permission_set, 'hide']
+        (entry[:mutes] ||= []) << [permission_set, 'hide', resource_name]
       end
 
-      def apply_muting_field(permission_set, field)
+      def apply_muting_field(permission_set, field, resource_name)
         name = field.name
         ([name] + variants_of(name)).each do |key|
           entry = @entries[key]
-          mute_field(entry, field, permission_set) if entry
+          mute_field(entry, field, [permission_set, resource_name]) if entry
         end
       end
 
       # The engine's own muting of a row (PermissionHashBuilder
       # #mute_single_field: a row that mutes read mutes edit too), plus
-      # provenance.
-      def mute_field(entry, field, permission_set)
-        level = FieldLevel.level_of(field, muting: true)
+      # provenance (`muting`: [set, the name of the Resource of the row]).
+      def mute_field(entry, field, muting)
+        level = FieldLevel.muting_provenance(field)
         return if level == 'leave'
 
         entry[:read_access] = false if field.read_access
         entry[:edit_access] = false if field.read_access || field.edit_access
         entry[:mask_access] = true if field.mask_access
-        (entry[:mutes] ||= []) << [permission_set, level]
-      end
-
-      def field_outcome(name, virtual)
-        entry = @entries[name]
-        return unconfigured_outcome(name, virtual) if entry.nil?
-
-        implicit = entry[:extra].present?
-        FieldOutcome.new(
-          name: name, mask_strategy: entry[:mask_strategy], granted_by: granting_sources(entry),
-          unconfigured: false, virtual: virtual || implicit, implicit: implicit, variant_of: entry[:variant_of],
-          **level_attrs(entry), **muting_attrs(entry)
-        )
-      end
-
-      # Editable fields are capped to Read when the resource's Edit is not granted.
-      def level_attrs(entry)
-        level = FieldLevel.effective_level(entry)
-        capped = level == 'edit' && !@sources.flags[:edit_access].granted?
-        { level: capped ? 'read' : level, capped: capped }
-      end
-
-      def muting_attrs(entry)
-        mutes = entry[:mutes] || []
-        { blocked_by: mutes.map(&:first).uniq, blocked_level: mutes.last&.last }
-      end
-
-      # Sets that make the field readable, most open first. A set that lists
-      # the field as Hidden grants nothing and, like the engine, has no say in
-      # the mask. An implicit entry exists only when no set configured the
-      # field, so no set is credited for it: the level comes from the
-      # virtual-field default.
-      def granting_sources(entry)
-        return [] if entry[:extra]
-
-        entry[:sources].select { |_, lvl, _| FieldLevel.rank(lvl) >= 1 }
-                       .sort_by { |_, lvl, _| -FieldLevel.rank(lvl) }.map(&:first).uniq
+        permission_set, resource_name = muting
+        (entry[:mutes] ||= []) << [permission_set, level, resource_name]
       end
 
       def unconfigured_outcome(name, virtual)
-        FieldOutcome.new(name: name, level: unconfigured_level, mask_strategy: 'full', granted_by: [],
-                         blocked_by: [], capped: false, unconfigured: true, virtual: virtual, implicit: false)
+        FieldOutcome.new(name: name, level: unconfigured_level, mask_strategy: 'full', granted_by: [], grants: [],
+                         blocked_by: [], mutes: [], capped: false, unconfigured: true, virtual: virtual, implicit: false,
+                         decided_by: nil, unreadable: false)
       end
 
       def unconfigured_level

data/lib/permission_forge/admin/error_sentence.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # A model's refusals as sentences in the page's language ("Name already
+    # exists in this permission set"), from the gem's own keys: Rails'
+    # `full_messages` reads `errors.format` and `human_attribute_name`,
+    # English in a host without rails-i18n. The attribute is named by
+    # `permission_forge.validations.attributes.<attribute>`, else by the
+    # attribute's stored name verbatim; the message is the validator's
+    # (every validator of the gem's models has a `permission_forge.validations.*` key).
+    #
+    # @example
+    #   ErrorSentence.all(record.errors)   # => ["Name already exists in this permission set"]
+    #
+    # @api private
+    module ErrorSentence
+      SCOPE = 'permission_forge.validations'
+
+      # @param errors [ActiveModel::Errors]
+      # @return [Array<String>]
+      def self.all(errors)
+        errors.map { |error| sentence(error.attribute, error.message) }
+      end
+
+      # @param errors [ActiveModel::Errors]
+      # @return [String, nil]
+      def self.first(errors)
+        all(errors).first
+      end
+
+      # @param attribute [Symbol, String]
+      # @param message [String] the validator's message
+      # @return [String]
+      def self.sentence(attribute, message)
+        return message.to_s if attribute.to_s == 'base'
+
+        I18n.t("#{SCOPE}.full_message", attribute: attribute_label(attribute), message: message)
+      end
+
+      # @return [String] the attribute's label, else its name as stored
+      def self.attribute_label(attribute)
+        I18n.t("#{SCOPE}.attributes.#{attribute}", default: attribute.to_s)
+      end
+    end
+  end
+end

data/lib/permission_forge/admin/expiry_presets.rb

@@ -9,6 +9,9 @@ module PermissionForge
       DAYS = { '1d' => 1, '1w' => 7, '30d' => 30 }.freeze
       KEYS = %w[1d 1w 30d eom custom never].freeze
       CHANGE_KEYS = %w[1w 30d eom never].freeze
+      # Home's "Extend 30 days": 30 days past the current end date (or today).
+      EXTEND_KEY = 'extend30'
+      EXTEND_DAYS = 30
 
       class InvalidDate < StandardError; end
 
@@ -28,6 +31,20 @@ module PermissionForge
         date_for(key, today: today, custom: custom)&.in_time_zone&.end_of_day
       end
 
+      # The end date a change of an assignment's end date gives: a CHANGE_KEYS
+      # preset, or EXTEND_KEY (EXTEND_DAYS past `from`, or past today when
+      # `from` is earlier or nil). :invalid for any other key.
+      #
+      # @param from [Time, nil] the end date the assignment has
+      # @return [Time, nil, :invalid]
+      def change_to(key, from:, today: Time.zone.today)
+        key = key.to_s
+        return ([from&.to_date, today].compact.max + EXTEND_DAYS).in_time_zone.end_of_day if key == EXTEND_KEY
+        return :invalid unless CHANGE_KEYS.include?(key)
+
+        expires_at_for(key, today: today)
+      end
+
       def parse_custom(value, today)
         raise InvalidDate, :missing if value.blank?
 

data/lib/permission_forge/admin/exports/holdings.rb

@@ -7,7 +7,10 @@ module PermissionForge
       # Permission Set, when and by whom it was granted, when it ends, when
       # and by whom it was last reviewed, and the reason of its last change.
       # Granted by is the actor of the assignment.granted event when the
-      # audit log has one, else the created_by column.
+      # audit log has one — named as the admin names it (Admin::ActorLabel:
+      # a code such as an API client nobody named in the export's language;
+      # the actor's kind and id stay as stored, and the events export keeps
+      # the stored label) — else the created_by column.
       #
       # The rows are read while the file is written (batches of BATCH_SIZE,
       # the way the events export does), never all at once. `row_count` in the
@@ -59,7 +62,7 @@ module PermissionForge
 
         def each_batch(assignments)
           assignments.find_in_batches(batch_size: @batch_size) do |batch|
-            granted = LastChanges.new(batch, events: %w[assignment.granted])
+            granted = LastChanges.creations(batch)
             people = people_by_id(batch)
             batch.each { |assignment| yield row(assignment, granted[assignment], people) }
           end
@@ -87,7 +90,7 @@ module PermissionForge
         def granted_by(assignment, event, people)
           if event
             return { 'granted_by_type' => event.actor_type, 'granted_by_id' => event.actor_id,
-                     'granted_by' => event.actor_label }
+                     'granted_by' => ActorLabel.for(event) }
           end
 
           id = assignment.try(:created_by_id)

data/lib/permission_forge/admin/field_across_sets.rb

@@ -2,9 +2,11 @@
 
 module PermissionForge
   module Admin
-    # Every Permission Set containing a resource, with one field's row there
-    # (granting sets first, then by name) and the set's people count. Backs
-    # the field drawer's "In other sets" list and "Who can see …?".
+    # Every Permission Set containing a resource — or, for a
+    # single-table-inheritance subclass, one of the bases its records answer
+    # to (ResourceChain: a base's field row reaches the subclass) — with one
+    # field's row there (granting sets first, then by name) and the set's
+    # people count. Backs the field drawer's "In other sets" list and "Who can see …?".
     class FieldAcrossSets
       # @return [Array<Hash>] { resource:, set:, field: (ResourceField or nil), people:, in_effect: }
       #   in_effect is whether the row (or, without a row, the resource) counts
@@ -27,7 +29,8 @@ module PermissionForge
       private
 
       def resources
-        PermissionForge::Resource.where(name: @resource_name).includes(:permission_set, :resource_fields)
+        names = PermissionForge::ResourceChain.names_for(@resource_name).map(&:to_s)
+        PermissionForge::Resource.where(name: names).includes(:resource_fields, permission_set: :resources)
                                  .sort_by { |resource| sort_key(resource.permission_set) }
       end