permission_forge 0.14.1 → 0.15.0

data/lib/permission_forge/admin/field_chain.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # The field entry tables a resource's fields are composed from, its own
+    # first, then those of the single-table-inheritance bases the person has
+    # an entry for — composed as ResourceChain.compose_field composes them
+    # for the attribute guard: one entry decides alone; among several, one
+    # that does not grant read hides every configured field, else the
+    # strictest field entry decides (the first in chain order at its level;
+    # at Hidden or Read-only, one no mute brought there first). A muting set
+    # is credited with hiding the field, or taking its editing away, only
+    # when the granting sets alone, composed the same way, would show it,
+    # or let it be edited (review R4 P1-2).
+    # Admin::EffectiveFields builds it; FieldProvenance words the entry that
+    # decides.
+    #
+    # @example
+    #   chain = FieldChain.new([FieldChain::Table.new(sources, entries, nil)])
+    #   chain.attributes('email', virtual: false, editable: true) # => { level: 'masked', ... } or nil
+    class FieldChain
+      # One entry table (`fields`: name => Admin::EffectiveFields entry): the
+      # resource's own (decided_by nil) or a base's (decided_by: the base
+      # Resource's name).
+      Table = Struct.new(:sources, :fields, :decided_by) do
+        def readable? = sources.flags[:read_access].granted?
+        # Whether a granting set grants read, muted later or not.
+        def granted_readable? = sources.flags[:read_access].granted_by.any?
+        def rank_of(name) = PermissionForge::FieldLevel.rank(PermissionForge::FieldLevel.effective_level(fields[name]))
+        def provenance(name) = FieldProvenance.new(fields[name], decided_by: decided_by)
+        # The field's flags as the granting sets alone left them.
+        def granted(name) = fields[name][:before] || fields[name]
+        # Whether a muting set brought the field to its level.
+        def muted?(name) = provenance(name).mutes.any?
+
+        # A field hidden because this entry does not grant read (ResourceChain::HIDDEN_ENTRY).
+        def hidden_attributes = FieldProvenance.hidden_by(sources.flags[:read_access].muted_on, decided_by: decided_by)
+      end
+
+      # @param tables [Array<Table>] the resource's first, then its bases' nearest first
+      def initialize(tables)
+        @tables = tables
+      end
+
+      # Every field name an entry along the chain has.
+      #
+      # @return [Array<String>]
+      def names = @tables.flat_map { |table| table.fields.keys }
+
+      # The FieldOutcome attributes but its name, from the entry that decides;
+      # nil when no entry configures the field.
+      #
+      # @return [Hash, nil]
+      def attributes(name, virtual:, editable:)
+        configured = @tables.select { |table| table.fields.key?(name) }
+        return if configured.empty?
+        return chain_mutes(hiding.hidden_attributes.merge(virtual: virtual), configured, name) if hiding
+
+        chain_mutes(deciding(configured, name).provenance(name).attributes(virtual: virtual, editable: editable), configured, name)
+      end
+
+      # Mutes that hide the field, or take its editing away, which the
+      # granting sets alone (composed along the chain) never showed, or never
+      # let be edited, are not credited. One entry: FieldProvenance did it.
+      CHAIN_MUTE_EFFECTS = {
+        'hide' => ->(granted) { granted[:read_access] == true },
+        'no_edit' => ->(granted) { granted[:edit_access] == true }
+      }.freeze
+      private_constant :CHAIN_MUTE_EFFECTS
+
+      private
+
+      def chain_mutes(attributes, configured, name)
+        return attributes if @tables.size <= 1
+
+        granted = granted_composition(configured, name)
+        mutes = attributes[:mutes].select { |mute| CHAIN_MUTE_EFFECTS.fetch(mute.level, ->(_) { true }).call(granted) }
+        attributes.merge(mutes: mutes, blocked_by: mutes.map(&:permission_set), blocked_level: mutes.first&.level)
+      end
+
+      # The field as the granting sets alone compose it (ResourceChain.compose_field).
+      def granted_composition(configured, name)
+        return ResourceChain::HIDDEN_ENTRY unless @tables.all?(&:granted_readable?)
+
+        ResourceChain.strictest(configured.map { |table| table.granted(name) })
+      end
+
+      # Among several entries, the first that does not grant read.
+      def hiding
+        return @hiding if defined?(@hiding)
+
+        @hiding = (@tables.find { |table| !table.readable? } if @tables.size > 1)
+      end
+
+      # The strictest entry; at one level the first in chain order, but at
+      # Hidden or Read-only one no mute brought there first (the masked
+      # strategy is the first masking entry's, as the engine takes it).
+      def deciding(configured, name)
+        configured.each_with_index.min_by do |table, index|
+          rank = table.rank_of(name)
+          [rank, rank == MASKED_RANK || !table.muted?(name) ? 0 : 1, index]
+        end.first
+      end
+
+      MASKED_RANK = PermissionForge::FieldLevel.rank('masked')
+      private_constant :MASKED_RANK
+    end
+  end
+end

data/lib/permission_forge/admin/field_detail.rb

@@ -49,15 +49,26 @@ module PermissionForge
       # Locked when the field, its Resource or its Permission Set is (is_editable: false).
       def locked? = !EditableLock.locked_record(field, resource).nil?
 
-      # The mask strategy the select starts on: the saved one, else the
+      # The mask strategy the select starts on: the saved one — also one this
+      # app does not know (unknown_strategy?), which stays as stored unless
+      # the admin picks another and is masked fully meanwhile — else the
       # recommended one for a sensitive column, else 'full'.
       def strategy
-        field&.mask_strategy || row.match&.strategy || DEFAULT_STRATEGY
+        field&.mask_strategy.presence || row.match&.strategy || DEFAULT_STRATEGY
       end
 
-      # Other columns that follow this one (`_id` → `_uuid`, `_cents` → base name).
+      # The choices of the strategy select (MaskStrategyChoices): the saved
+      # one this app does not know is offered as stored, so saving the drawer
+      # with another change never rewrites it.
+      def strategy_choices = @strategy_choices ||= MaskStrategyChoices.new(field)
+
+      # The saved strategy is none this app knows: masked fully until fixed.
+      def unknown_strategy? = strategy_choices.unknown?
+
+      # Other names of the model that follow this one (`_id` → `_uuid`,
+      # `_cents` → base name), as the engine applies them (FieldVariants).
       def variants
-        @variants ||= @configuration.field_variants_for(key)
+        @variants ||= FieldVariants.new(resource.name, @configuration).call(key)
       end
 
       # The edit level needs edit access on the Resource, except in a muting set.
@@ -67,19 +78,21 @@ module PermissionForge
 
       # The note under the level control while no setting is in force, as the
       # suffix of a locale key under `resource_fields.show` — or nil.
+      # In a Muting Permission Set a field without a setting takes nothing
+      # away (no strategy applies), so its note says that instead.
       def unconfigured_note
         return nil if row.in_force?
 
-        implicit = row.implicit_grant
-        if row.configured?
-          implicit ? :turned_off_implicit : :turned_off
-        else
-          implicit ? :not_configured_implicit : :not_configured
-        end
+        base = row.configured? ? :turned_off : :not_configured
+        return :"#{base}_muting" if muting?
+
+        row.implicit_grant ? :"#{base}_implicit" : base
       end
 
-      # Setting the note links to.
+      # Setting the note links to; nil in a Muting Permission Set (no setting decides it).
       def unconfigured_setting
+        return nil if muting?
+
         row.implicit_grant ? 'extra_fields_default_access' : 'unconfigured_field_strategy'
       end
 

data/lib/permission_forge/admin/field_label.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # The one definition of the label the admin shows for a stored field,
+    # column or association name: the host application's own translation
+    # when it has one (`activerecord.attributes.<model>.<name>`, read
+    # through `human_attribute_name` with a sentinel default), else the label
+    # an admin wrote on the ResourceField row — a label the gem generated
+    # (PermissionForge::GeneratedText.label?: blank, the name, the name
+    # humanized, 'Untitled Field') is no label — else, on an English page,
+    # Rails' own English for the name (`human_attribute_name`: "Created at",
+    # what an English host saw before 0.15; #english), else the name
+    # verbatim (`verbatim?`: the view draws it in <code>; an admin looks for
+    # the stored name). Rails' English is never shown on a page in another
+    # language (release_readiness/inflection_guard_test.rb). A column with
+    # no row and one with a generated label read the same (field test round
+    # 7, B#26).
+    #
+    # @example
+    #   FieldLabel.for(Customer, 'full_address').text          # => "Adresa" (host translation); on sq "full_address", on en "Full address"
+    #   FieldLabel.for('Customer', 'email', row: field).text   # => the label an admin wrote, when the host has no translation
+    #
+    # @api private
+    class FieldLabel
+      # What `human_attribute_name` / `model_name.human` answer when the host
+      # has no translation (their `default:`): a value never shown.
+      MISSING = "\u0000permission_forge:missing\u0000"
+
+      # A label and whether it is the stored name itself.
+      Label = Data.define(:text, :verbatim) do
+        def verbatim? = verbatim
+        def to_s = text
+      end
+
+      class << self
+        # @param model [Class, ModelCatalog::ModelInfo, String, nil] the model the name belongs to
+        # @param name [String, Symbol] the stored name
+        # @param row [#label, nil] the ResourceField (anything with a `label`) for the name
+        # @return [Label]
+        def for(model, name, row: nil)
+          name = name.to_s
+          translated = host_translation(model, name)
+          return Label.new(text: translated, verbatim: false) if translated
+
+          label = written_label(row, name)
+          return Label.new(text: label, verbatim: false) if label
+
+          fallback(klass_of(model), name)
+        end
+
+        # The label an admin wrote on `row`, or nil for none — a label the
+        # gem generated (GeneratedText.label?) is none.
+        #
+        # @return [String, nil]
+        def written_label(row, name)
+          label = row.respond_to?(:label) ? row.label.to_s.strip : ''
+          label unless PermissionForge::GeneratedText.label?(label, name)
+        end
+
+        # A name with no translation and no label of the admin's: Rails' own
+        # English on an English page (#english), the name verbatim elsewhere
+        # — and wherever the model cannot be loaded (the stored name is what
+        # the admin looks for).
+        #
+        # @param klass [Class, nil] the model the name belongs to, when known
+        # @return [Label]
+        def fallback(klass, name)
+          text = english(name) { klass.human_attribute_name(name) if klass.respond_to?(:human_attribute_name) }
+          text ? Label.new(text: text, verbatim: false) : Label.new(text: name.to_s, verbatim: true)
+        end
+
+        # Rails' English for a name, only while the page is English: what
+        # the block answers (a model's `human_attribute_name`: "Created at"),
+        # or without a block Rails' humanization of the name (an action key,
+        # which belongs to no attribute: "Export csv"). nil on any other
+        # page, and for a blank name.
+        #
+        # @return [String, nil]
+        def english(name)
+          return nil if name.blank? || !I18n.locale.to_s.start_with?('en')
+
+          block_given? ? yield : ActiveSupport::Inflector.humanize(name)
+        end
+
+        # The host's translation of `name` on `model`, or nil. An empty name
+        # (a doubled dot in a path) is no attribute: never asked.
+        #
+        # @return [String, nil]
+        def host_translation(model, name)
+          klass = klass_of(model)
+          return nil if name.blank? || !klass.respond_to?(:human_attribute_name)
+
+          value = klass.human_attribute_name(name, default: MISSING)
+          value == MISSING ? nil : value
+        end
+
+        # The model class behind a Class, a ModelCatalog::ModelInfo or a
+        # stored Resource name (validated by Resource::NAME_FORMAT).
+        def klass_of(model)
+          return model.klass if model.respond_to?(:klass)
+          return PermissionForge::ModelLookup.model_for(model) if model.is_a?(String) || model.is_a?(Symbol)
+
+          model
+        end
+      end
+    end
+  end
+end

data/lib/permission_forge/admin/field_level.rb

@@ -2,73 +2,9 @@
 
 module PermissionForge
   module Admin
-    # Maps the admin UI's single "access level" choice to ResourceField flags
-    # and back. Granting sets offer Hidden / Masked / Read-only / Editable;
-    # muting sets offer Unchanged / Force mask / Hide, where the same flags mean
-    # "remove" (see PermissionHashBuilder#mute_single_field).
-    module FieldLevel
-      GRANTING = {
-        'hidden' => { read_access: false, edit_access: false, mask_access: false },
-        'masked' => { read_access: true, edit_access: false, mask_access: true },
-        'read' => { read_access: true, edit_access: false, mask_access: false },
-        'edit' => { read_access: true, edit_access: true, mask_access: false }
-      }.freeze
-
-      MUTING = {
-        'leave' => { read_access: false, edit_access: false, mask_access: false },
-        'mask' => { read_access: false, edit_access: false, mask_access: true },
-        'hide' => { read_access: true, edit_access: true, mask_access: false }
-      }.freeze
-
-      # Ordered from most closed to most open (granting) — used to rank levels.
-      GRANTING_ORDER = %w[hidden masked read edit].freeze
-
-      module_function
-
-      def levels_for(muting:)
-        muting ? MUTING.keys : GRANTING.keys
-      end
-
-      def flags_for(level, muting:)
-        (muting ? MUTING : GRANTING).fetch(level.to_s) { raise ArgumentError, "Unknown field level: #{level.inspect}" }
-      end
-
-      def valid?(level, muting:)
-        (muting ? MUTING : GRANTING).key?(level.to_s)
-      end
-
-      # Derives the level from a field's flags. Flag combinations the UI never
-      # writes (e.g. edit + mask) collapse to the closest level.
-      def level_of(field, muting:)
-        read = field.read_access
-        edit = field.edit_access
-        mask = field.mask_access
-        return muting_level(read, edit, mask) if muting
-
-        return 'hidden' unless read
-        return 'masked' if mask
-
-        edit ? 'edit' : 'read'
-      end
-
-      def muting_level(read, edit, mask)
-        return 'hide' if read || edit
-
-        mask ? 'mask' : 'leave'
-      end
-
-      # Level an engine field-permission entry resolves to
-      # ({ read_access:, edit_access:, mask_access: } from the permissions hash).
-      def effective_level(entry)
-        return 'hidden' if entry.nil? || !entry[:read_access]
-        return 'masked' if entry[:mask_access]
-
-        entry[:edit_access] ? 'edit' : 'read'
-      end
-
-      def rank(level)
-        GRANTING_ORDER.index(level.to_s) || -1
-      end
-    end
+    # The level tables moved to PermissionForge::FieldLevel in 0.15.0 (the
+    # row builder in lib/ reads them too). Internal API: the old name is
+    # the same module, kept for the views and tests that spell it out.
+    FieldLevel = PermissionForge::FieldLevel
   end
 end

data/lib/permission_forge/admin/field_provenance.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # The outcome of one effective field entry, and which Permission Sets it
+    # credits (EX: the explanation comes from the entry that decides, never a
+    # second walk).
+    # The entry is Admin::EffectiveFields': the engine's own flags
+    # (FieldPermissionMerger.merge_row, then the muting phase), plus
+    # `sources` ([set, row level, row strategy, Resource] in merge order),
+    # `mutes` ([set, level, Resource] in muting order) and `before` (the
+    # flags before muting). Each FieldSource names the Resource whose row
+    # it credits (B#38).
+    #
+    # - grants: the sets that make the field readable, one each at its most
+    #   open level, most open first and, at one level, in merge order — the
+    #   first one is the entry's level and, masked, the row whose strategy
+    #   the entry took. A Hidden row grants nothing and has no say in the
+    #   mask; an implicit (virtual-field) entry credits no set.
+    # - mutes: the muting sets that changed the entry (MUTE_EFFECTS), each at
+    #   the strongest level it is credited with, the strongest first — the
+    #   first one is the level the entry shows (hide → Hidden, mask → Masked,
+    #   no_edit → Read-only). A mute that changed nothing (a field nobody
+    #   shows, editing nobody gave) is not listed.
+    #
+    # @example
+    #   FieldProvenance.new(entry, decided_by: nil).attributes(virtual: false, editable: true)
+    #   # => { level: 'masked', capped: false, mask_strategy: 'email', grants: [FieldSource], mutes: [], ... }
+    class FieldProvenance
+      FieldSource = EffectiveAccess::FieldSource
+
+      # What a muting set does to a field, strongest first (FieldSource#level).
+      MUTING_ORDER = %w[hide mask no_edit].freeze
+      # Whether a muting level changed the entry: (flags before muting, entry
+      # after) => true. Hide took a readable field away; mask leaves it
+      # masked; no_edit took editing away and left it readable.
+      MUTE_EFFECTS = {
+        'hide' => ->(before, after) { before[:read_access] == true && !after[:read_access] },
+        'mask' => ->(before, after) { before[:mask_access] != true && PermissionForge::FieldLevel.effective_level(after) == 'masked' },
+        'no_edit' => ->(before, after) { before[:edit_access] == true && after[:read_access] == true && !after[:edit_access] }
+      }.freeze
+
+      # The attributes of a field hidden because an entry does not grant
+      # read (ResourceChain::HIDDEN_ENTRY): no set grants it; the muting sets
+      # that took that entry's read away hide it.
+      #
+      # @param muted_on [Hash{PermissionForge::PermissionSet => String}] each
+      #   muting set => the Resource whose row takes the read away
+      #   (EffectiveAccess::Outcome#muted_on)
+      # @param decided_by [String, nil] the entry's Resource, for a base's
+      # @return [Hash] EffectiveAccess::FieldOutcome attributes but name and virtual
+      def self.hidden_by(muted_on, decided_by:)
+        mutes = muted_on.map { |set, resource_name| FieldSource.new(permission_set: set, level: 'hide', resource_name: resource_name) }
+        { level: 'hidden', capped: false, unconfigured: false, implicit: false, unreadable: true, decided_by: decided_by,
+          mask_strategy: ResourceChain::HIDDEN_ENTRY[:mask_strategy], granted_by: [], grants: [], blocked_by: muted_on.keys,
+          mutes: mutes, blocked_level: mutes.first&.level }
+      end
+
+      # @param entry [Hash] an Admin::EffectiveFields entry
+      # @param decided_by [String, nil] the base Resource whose entry it is
+      #   (single-table inheritance), nil for the resource's own
+      def initialize(entry, decided_by: nil)
+        @entry = entry
+        @decided_by = decided_by
+      end
+
+      # The entry's outcome and the sets it credits, as EffectiveAccess::FieldOutcome takes them.
+      #
+      # @param virtual [Boolean] the model declares the field (not a column)
+      # @param editable [Boolean] the resource grants Edit: an editable field
+      #   is capped to Read-only without it, and a mute that takes its
+      #   editing away changes nothing then (not credited; review of round 8, D3)
+      # @return [Hash] every FieldOutcome attribute but name and unconfigured
+      def attributes(virtual:, editable:)
+        granting = grants
+        muting = editable ? mutes : mutes.reject { |source| source.level == 'no_edit' }
+        { virtual: virtual || implicit?, implicit: implicit?, mask_strategy: @entry[:mask_strategy],
+          variant_of: @entry[:variant_of], decided_by: @decided_by, unreadable: false, **level(editable),
+          granted_by: granting.map(&:permission_set), grants: granting, blocked_by: muting.map(&:permission_set),
+          mutes: muting, blocked_level: muting.first&.level }
+      end
+
+      # An implicit (virtual-field) entry: no set configured the field.
+      def implicit? = @entry[:extra].present?
+
+      # @return [Array<EffectiveAccess::FieldSource>]
+      def grants
+        return [] if implicit?
+
+        rows = @entry[:sources].each_with_index.select { |(_, level), _| FieldLevel.rank(level) >= 1 }
+        rows.sort_by { |(_, level), index| [-FieldLevel.rank(level), index] }.map(&:first).uniq(&:first)
+            .map { |set, level, strategy, name| FieldSource.new(permission_set: set, level: level, mask_strategy: strategy, resource_name: name) }
+      end
+
+      # @return [Array<EffectiveAccess::FieldSource>]
+      def mutes
+        sources = credited_mutes.group_by(&:first).map { |set, rows| strongest(set, rows) }
+        sources.each_with_index.sort_by { |source, index| [MUTING_ORDER.index(source.level), index] }.map(&:first)
+      end
+
+      private
+
+      # [set, level, Resource] for each muting row or resource that changed the entry.
+      def credited_mutes
+        (@entry[:mutes] || []).select { |_, level| changed?(level) }
+      end
+
+      # The set at its strongest level, through its first row at that level.
+      def strongest(permission_set, rows)
+        _, level, resource_name = MUTING_ORDER.lazy.filter_map { |name| rows.find { |_, row_level| row_level == name } }.first
+        FieldSource.new(permission_set: permission_set, level: level, resource_name: resource_name)
+      end
+
+      # The entry's level (FieldLevel.effective_level); Edit is capped to
+      # Read-only when the resource does not grant Edit. Then a mute that
+      # took the field's editing away changed nothing (D3): the field is
+      # capped as the granting sets left its editing.
+      def level(editable)
+        level = FieldLevel.effective_level(editable ? @entry : @entry.merge(edit_access: granted_edit?))
+        capped = level == 'edit' && !editable
+        { level: capped ? 'read' : level, capped: capped }
+      end
+
+      # Whether the field is readable and the granting sets let it be edited.
+      def granted_edit? = @entry[:read_access] == true && (@entry[:before] || @entry)[:edit_access] == true
+
+      def changed?(level)
+        MUTE_EFFECTS.fetch(level).call(@entry[:before] || {}, @entry)
+      end
+    end
+  end
+end

data/lib/permission_forge/admin/field_rows.rb

@@ -4,7 +4,10 @@ module PermissionForge
   module Admin
     # One row per field on a Resource page: configured ResourceFields, model
     # columns nobody configured yet, and virtual fields — with the flags the
-    # UI needs (sensitive, virtual, column missing, level).
+    # UI needs (sensitive, virtual, column missing, level). A row's label is
+    # Admin::FieldLabel's, the same for a configured row and a column with
+    # none (field test round 7, B#26): the host's translation, else the
+    # admin's label, else Rails' English on an English page, else the name.
     class FieldRows
       # `declared` — a virtual field the model lists in extra_fields_method
       # (a virtual row that is not declared was discovered). `implicit_grant` —
@@ -15,7 +18,12 @@ module PermissionForge
                        keyword_init: true) do
         def configured? = !field.nil?
         def sensitive? = !match.nil?
-        def locked? = field && field.is_editable == false
+        # The label is the name itself (FieldLabel: no translation, no label
+        # of the admin's, a page that is not English): the grid shows the
+        # name once, in <code>.
+        def verbatim? = label == name
+        # Locked when the row, its Resource or its Permission Set is (EditableLock).
+        def locked? = !field.nil? && EditableLock.locked?(field)
         def active? = field.nil? || field.is_active
 
         # A setting the engine applies: it exists and is turned on. A row that
@@ -25,7 +33,10 @@ module PermissionForge
       end
 
       GRANTING_FILTERS = %w[all hidden masked read edit sensitive unconfigured].freeze
-      MUTING_FILTERS = %w[all leave mask hide sensitive unconfigured].freeze
+      # No "Not configured" here: in a Muting Permission Set a column with no
+      # setting mutes nothing, which is what Unchanged means — one state, one
+      # name (its row starts on Unchanged, and saving it creates no row).
+      MUTING_FILTERS = %w[all leave mask hide sensitive].freeze
 
       attr_reader :resource, :model
 
@@ -78,6 +89,13 @@ module PermissionForge
         new_columns.any? || missing_fields.any?
       end
 
+      # Whether the sync panel is a warning. A column with no setting in a
+      # Muting Permission Set takes nothing away — the normal state, not a
+      # gap — so there only a configured field whose column is gone warns.
+      def sync_warning?
+        missing_fields.any? || (!@muting && new_columns.any?)
+      end
+
       private
 
       # Every row counts, switched off or not: a field with a row cannot get a
@@ -93,16 +111,17 @@ module PermissionForge
       def configured_row(field)
         name = field.name
         virtual = virtual?(name)
-        Row.new(name: name, label: field.label.presence || human(name), field: field, match: @sensitive.match(name),
-                virtual: virtual, missing: @model.present? && !virtual && @model.column_names.exclude?(name),
+        Row.new(name: name, label: FieldLabel.for(@model, name, row: field).text, field: field, match: @sensitive.match(name),
+                virtual: virtual, missing: @model.present? && !virtual && !@model.column?(name),
                 level: FieldLevel.level_of(field, muting: @muting), declared: declared?(name),
                 implicit_grant: !field.is_active && implicit_grant?(name))
       end
 
       def unconfigured_rows
+        level = FieldLevel.unconfigured_level(muting: @muting)
         new_columns.map do |name|
-          Row.new(name: name, label: human(name), field: nil, match: @sensitive.match(name), virtual: virtual?(name),
-                  missing: false, level: nil, declared: declared?(name), implicit_grant: implicit_grant?(name))
+          Row.new(name: name, label: FieldLabel.for(@model, name).text, field: nil, match: @sensitive.match(name), virtual: virtual?(name),
+                  missing: false, level: level, declared: declared?(name), implicit_grant: implicit_grant?(name))
         end
       end
 
@@ -120,10 +139,6 @@ module PermissionForge
         @model.present? && @model.declared_virtual_field_names.include?(name)
       end
 
-      def human(name)
-        @model ? @model.klass.human_attribute_name(name) : name.to_s.humanize
-      end
-
       def match_filter?(row, filter)
         case filter
         when 'all' then true

data/lib/permission_forge/admin/last_changes.rb

@@ -9,12 +9,26 @@ module PermissionForge
     # an edit by nobody, by an HTTP Basic login or by an API client keeps the
     # previous editor — so wherever the admin shows "last edited by", an
     # event wins over the columns (see AuditTrail::Entry and the footer).
+    # The same holds for "created by" (.creations).
     #
     # Two queries per record type and slice: the newest event id per record
     # (the ids grow with every insert), then those events.
     class LastChanges
       SLICE = 500
 
+      # The creation event of each record — its model's `audit_event_name(:create)`:
+      # permission_set.created, assignment.granted, group_membership.added, ... —
+      # read with #[]. Who created a record is that event's actor wherever the
+      # admin shows it (AuditHelper#pf_audit_creator): an HTTP Basic login or an
+      # API client stamps no created_by, and the audit log still names them.
+      #
+      # @param records [Array<ActiveRecord::Base>] permission records
+      # @return [LastChanges]
+      def self.creations(records)
+        records = Array(records).compact
+        new(records, events: records.map { |record| record.class.audit_event_name(:create) }.uniq)
+      end
+
       # @param records [Array<ActiveRecord::Base>] permission records
       # @param events [Array<String>, nil] only these change events (e.g.
       #   %w[assignment.granted] — who granted it); nil: any change event

data/lib/permission_forge/admin/list_sentence.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # A list as a sentence ("Bob, Carol and Dan") with the connectors of the
+    # current locale, read from the gem's own keys
+    # (permission_forge.support.array.*): Array#to_sentence reads Rails'
+    # support.array keys, which an app without rails-i18n has in English only,
+    # so a Macedonian page would read "Bob and Carol". The admin joins every
+    # list through here (helper: pf_to_sentence); a test fails on a bare
+    # to_sentence in app/ or lib/.
+    #
+    # @api private
+    #
+    # @example
+    #   ListSentence.call(%w[Bob Carol Dan]) # => "Bob, Carol and Dan" (en)
+    module ListSentence
+      # @param items [Array<#to_s>]
+      # @param overrides [Hash] connectors that replace the locale's (e.g. "or")
+      # @return [String]
+      def self.call(items, **overrides)
+        Array(items).to_sentence(**connectors, **overrides)
+      end
+
+      def self.connectors
+        { words_connector: I18n.t('permission_forge.support.array.words_connector'),
+          two_words_connector: I18n.t('permission_forge.support.array.two_words_connector'),
+          last_word_connector: I18n.t('permission_forge.support.array.last_word_connector') }
+      end
+    end
+  end
+end