permission_forge 0.14.1 → 0.15.0

data/lib/permission_forge/admin/mask_strategy_choices.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # The choices of a field's mask-strategy select (the field drawer): the
+    # strategies this app knows, after the saved one when this app does not
+    # know it — a row written past the model, or a custom strategy since
+    # removed from config.custom_mask_strategies (Services::MaskValue.known?).
+    # The saved name is offered as it is stored, selected, so a save that
+    # changes something else never rewrites the strategy (field test round 6:
+    # the select showed nothing selected and a label change saved `full`);
+    # it masks fully until the admin picks one this app knows.
+    #
+    # @example
+    #   choices = MaskStrategyChoices.new(field)   # field.mask_strategy == 'emial'
+    #   choices.unknown?   # => true
+    #   choices.names      # => ['emial', 'full', 'email', 'last4', 'first1_last4']
+    #   choices.options    # => [['emial', :unknown_strategy], ['full', nil], ...]
+    class MaskStrategyChoices
+      # @param field [PermissionForge::ResourceField, nil] the saved row, nil for a column with none
+      def initialize(field)
+        @field = field
+      end
+
+      # The saved strategy is none this app knows, and the row masks.
+      def unknown?
+        !@field.nil? && @field.mask_access == true && !Services::MaskValue.known?(@field.mask_strategy)
+      end
+
+      # The names the select offers, the saved unknown one first.
+      #
+      # @return [Array<String>]
+      def names
+        known = Services::MaskValue.strategies.keys.map(&:to_s)
+        unknown? && @field.mask_strategy.present? ? [@field.mask_strategy] + known : known
+      end
+
+      # [name, note] per choice. The note is the key under
+      # `resource_fields.show` shown after the label: :unknown_strategy for
+      # the saved name this app does not know, :custom for a configured
+      # custom strategy, nil for a built-in.
+      #
+      # @return [Array<Array(String, Symbol, nil)>]
+      def options
+        names.map { |name| [name, self.class.note(name)] }
+      end
+
+      # @param name [String] a strategy name
+      # @return [Symbol, nil] :unknown_strategy, :custom or nil (built-in)
+      def self.note(name)
+        return :unknown_strategy unless Services::MaskValue.known?(name)
+
+        :custom unless Services::MaskValue::BUILT_IN_STRATEGIES.key?(name.to_s)
+      end
+    end
+  end
+end

data/lib/permission_forge/admin/model_catalog.rb

@@ -5,6 +5,15 @@ module PermissionForge
     # Read-only reflection over the host app's ActiveRecord models, so the
     # admin UI only ever offers real models, columns and associations (no
     # free-text names that silently do nothing when misspelled).
+    #
+    # Columns are read through PermissionForge::SchemaRead: a model's column
+    # list is compared with the database once per catalog (a column a
+    # migration added while the process was up is offered, a removed one
+    # flagged), and a name that is not a column is asked again once before
+    # it is called virtual. Associations are the ones a rule's path can
+    # follow (Operators::RulePath.unjoinable_cause): the builder never offers
+    # one the applier refuses to join. Labels are Admin::FieldLabel's and
+    # Admin::ModelLabel's.
     class ModelCatalog
       Column = Struct.new(:name, :label, :type, :enum_values, :user_reference, :virtual, keyword_init: true) do
         def user_reference? = user_reference
@@ -16,8 +25,8 @@ module PermissionForge
         # @param target [Class] the reflection's resolved class
         # @param owner [Class] the model declaring the association
         def self.from(reflection, target, owner)
-          name = reflection.name
-          new(name: name.to_s, label: owner.human_attribute_name(name), class_name: target.name,
+          name = reflection.name.to_s
+          new(name: name, label: FieldLabel.for(owner, name).text, class_name: target.name,
               foreign_key: reflection.foreign_key.to_s, macro: reflection.macro)
         end
       end
@@ -31,27 +40,35 @@ module PermissionForge
         # read + edit entry from ExtraFieldDefaults right now.
         delegate :implicit_grant?, to: :virtual_fields
 
-        def initialize(klass, configuration)
+        # @param verify [Boolean] compare the column list with the database
+        #   (one metadata query per model and catalog); false for the
+        #   catalogs that only count (Home and the navigation's attention
+        #   items)
+        def initialize(klass, configuration, verify: true)
           @klass = klass
           @configuration = configuration
+          @verify = verify
         end
 
         def name = @klass.name
-        def label = @klass.model_name.human
-        def plural_label = @klass.model_name.human(count: 2)
-
-        def column_names
-          @column_names ||= @klass.column_names
+        def label = ModelLabel.for(@klass).text
+        def plural_label = ModelLabel.plural(@klass)
+
+        # The model's columns (ignored_columns excluded), compared with the
+        # database once for this catalog unless it only counts
+        # (PermissionForge::SchemaRead).
+        def column_names = managed_fields.column_names
+
+        # Whether `name` is a column of the model, asked again once after the
+        # schema is read again before "no" (PermissionForge::SchemaRead).
+        def column?(name)
+          PermissionForge::SchemaRead.column?(@klass, name.to_s, ignored: false)
         end
 
         # Columns PermissionForge manages (ignored_fields removed).
-        def managed_column_names
-          column_names - ignored_column_names
-        end
+        def managed_column_names = managed_fields.managed_column_names
 
-        def ignored_column_names
-          column_names & Array(@configuration.ignored_fields).map(&:to_s)
-        end
+        def ignored_column_names = managed_fields.ignored_column_names
 
         # Virtual fields the model declares through extra_fields_method.
         def declared_virtual_field_names
@@ -64,10 +81,10 @@ module PermissionForge
           virtual_fields.names
         end
 
-        # Every field the admin configures: managed columns, then virtual fields.
-        def managed_field_names
-          managed_column_names + virtual_field_names
-        end
+        # Every field the admin configures: managed columns, then virtual
+        # fields (PermissionForge::ManagedFields, the names every path that
+        # creates rows writes rows for).
+        def managed_field_names = managed_fields.names
 
         def virtual_field?(name)
           virtual_fields.include?(name)
@@ -87,9 +104,9 @@ module PermissionForge
 
         def column(name)
           name = name.to_s
-          return virtual_column(name) unless column_names.include?(name)
+          return virtual_column(name) unless column?(name)
 
-          Column.new(name: name, label: @klass.human_attribute_name(name), type: column_type(name),
+          Column.new(name: name, label: FieldLabel.for(@klass, name).text, type: column_type(name),
                      enum_values: enum_values(name), user_reference: user_reference?(name), virtual: false)
         end
 
@@ -103,18 +120,26 @@ module PermissionForge
 
         private
 
-        def virtual_fields
-          @virtual_fields ||= PermissionForge::VirtualFields.new(@klass, @configuration)
+        def virtual_fields = managed_fields.virtual_fields
+
+        def managed_fields
+          @managed_fields ||= PermissionForge::ManagedFields.new(@klass, configuration: @configuration, verify: @verify)
         end
 
-        # nil for polymorphic or unresolvable associations.
+        # nil for an association a rule's path cannot follow
+        # (Operators::RulePath.unjoinable_cause: polymorphic, a
+        # record-dependent scope, a broken :through or inverse_of, a class
+        # that cannot be loaded): the applier refuses to join it.
         def build_association(ref)
-          target = safe_klass(ref) unless ref.polymorphic?
-          Association.from(ref, target, @klass) if target
+          return if PermissionForge::Operators::RulePath.unjoinable_cause(ref)
+
+          Association.from(ref, ref.klass, @klass)
+        rescue *PermissionForge::Operators::RuleColumn::UNTELLABLE
+          nil
         end
 
         def virtual_column(name)
-          Column.new(name: name, label: @klass.human_attribute_name(name), type: :string,
+          Column.new(name: name, label: FieldLabel.for(@klass, name).text, type: :string,
                      enum_values: nil, user_reference: false, virtual: true)
         end
 
@@ -144,13 +169,16 @@ module PermissionForge
         end
       end
 
-      def initialize(configuration: PermissionForge.configuration)
+      # @param verify [Boolean] whether the column lists are compared with
+      #   the database (ModelInfo); false for a catalog that only counts
+      def initialize(configuration: PermissionForge.configuration, verify: true)
         @configuration = configuration
+        @verify = verify
       end
 
       # @return [Array<ModelInfo>] sorted by label
       def models
-        @models ||= model_classes.map { |k| ModelInfo.new(k, @configuration) }.sort_by(&:label)
+        @models ||= model_classes.map { |k| ModelInfo.new(k, @configuration, verify: @verify) }.sort_by(&:label)
       end
 
       # @return [ModelInfo, nil] for a model name, whether or not it is listed.
@@ -165,8 +193,8 @@ module PermissionForge
       private
 
       def build_info(name)
-        klass = name.safe_constantize
-        ModelInfo.new(klass, @configuration) if usable?(klass)
+        klass = PermissionForge::ModelLookup.model_for(name)
+        ModelInfo.new(klass, @configuration, verify: @verify) if klass && usable?(klass)
       end
 
       def model_classes
@@ -185,7 +213,7 @@ module PermissionForge
 
       def usable?(klass)
         klass.is_a?(Class) && klass < ActiveRecord::Base && !klass.abstract_class? &&
-          !klass.name.to_s.start_with?('PermissionForge::') && klass.table_exists?
+          !klass.name.to_s.start_with?('PermissionForge::') && PermissionForge::SchemaRead.table?(klass, klass.table_name)
       rescue StandardError
         false
       end
@@ -200,16 +228,32 @@ module PermissionForge
         true
       end
 
-      def eager_load_app_models
-        return unless defined?(Rails) && Rails.root && Rails.respond_to?(:autoloaders)
+      def eager_load_app_models = self.class.eager_load_app_models
+
+      class << self
+        # Loads the application's models (`app/models`, through its main
+        # autoloader), so `ActiveRecord::Base.descendants` lists them: the
+        # one definition for whatever must see every model in a process that
+        # does not eager-load — the admin's model list, and
+        # `rake permission_forge:audit` (a single-table subclass's `encrypts`
+        # or a model on a table a rule joins is seen only once loaded:
+        # PermissionForge::EncryptedAttributes). A failure is logged at debug
+        # and skipped: the caller sees the models already loaded.
+        #
+        # @return [void]
+        def eager_load_app_models
+          return unless defined?(Rails) && Rails.root && Rails.respond_to?(:autoloaders)
+
+          eager_load_dir(Rails.autoloaders.main, Rails.root.join('app', 'models').to_s)
+        rescue StandardError => e
+          Rails.logger&.debug("[PermissionForge] model eager load skipped: #{e.class}")
+        end
 
-        eager_load_dir(Rails.autoloaders.main, Rails.root.join('app', 'models').to_s)
-      rescue StandardError => e
-        Rails.logger&.debug("[PermissionForge] model eager load skipped: #{e.class}")
-      end
+        private
 
-      def eager_load_dir(loader, dir)
-        loader.eager_load_dir(dir) if File.directory?(dir) && loader.respond_to?(:eager_load_dir)
+        def eager_load_dir(loader, dir)
+          loader.eager_load_dir(dir) if File.directory?(dir) && loader.respond_to?(:eager_load_dir)
+        end
       end
     end
   end

data/lib/permission_forge/admin/model_label.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # The one definition of the label the admin shows for a model (a
+    # Resource): the Resource row's own label when an admin gave it one,
+    # else the host application's translation (`activerecord.models.<model>`,
+    # through `model_name.human` — never its English fallback), else the
+    # constant's name verbatim ("Billing::Invoice"). The plural ("Only show
+    # [Customers] where …") is the host's plural translation when it has
+    # one, else `permission_forge.ui.resource_plural` around the label:
+    # Rails' `pluralize` is English whatever the page's language.
+    #
+    # @example
+    #   ModelLabel.for(resource).text        # => "Clients" (the row's label), "Kunde" (host), or "Customer"
+    #   ModelLabel.plural('Customer')        # => "Customers" (host translation), else "Customer records"
+    #
+    # @api private
+    class ModelLabel
+      class << self
+        # @param resource_or_name [Resource, #name, String, Class, ModelCatalog::ModelInfo]
+        # @return [FieldLabel::Label] verbatim when the text is the constant's name
+        def for(resource_or_name)
+          label = row_label(resource_or_name)
+          return FieldLabel::Label.new(text: label, verbatim: false) if label
+
+          name = name_of(resource_or_name)
+          translated = host_translation(name)
+          translated ? FieldLabel::Label.new(text: translated, verbatim: false) : FieldLabel::Label.new(text: name, verbatim: true)
+        end
+
+        # @param name [String, Class, #name] the model
+        # @return [String]
+        def plural(name)
+          host_translation(name_of(name), count: 2) ||
+            I18n.t('permission_forge.ui.resource_plural', name: self.for(name).text, count: 2)
+        end
+
+        # The host's translation of the model's name, or nil.
+        #
+        # @return [String, nil]
+        def host_translation(name, count: 1)
+          klass = FieldLabel.klass_of(name)
+          return nil unless klass.respond_to?(:model_name)
+
+          value = klass.model_name.human(count: count, default: FieldLabel::MISSING)
+          value == FieldLabel::MISSING ? nil : value
+        end
+
+        private
+
+        def row_label(resource)
+          return nil unless resource.respond_to?(:label) && !resource.is_a?(Class)
+
+          resource.label.to_s.strip.presence
+        end
+
+        def name_of(resource_or_name)
+          return resource_or_name.name.to_s if resource_or_name.respond_to?(:name) && !resource_or_name.is_a?(String)
+
+          resource_or_name.to_s
+        end
+      end
+    end
+  end
+end

data/lib/permission_forge/admin/people_candidates.rb

@@ -11,10 +11,14 @@ module PermissionForge
       end
 
       # SQL-backed: searches whichever of the usual name/email columns exist.
+      # A column the user model encrypts (PermissionForge::EncryptedAttributes)
+      # holds ciphertext, which a LIKE would match by its JSON (`iv` found
+      # everyone): it is left out, and a deterministically encrypted one
+      # matches the whole query exactly (`where(email: query)` encrypts it).
       class Relation
         # Common person columns; only those the user table has are searched.
-        SEARCH_COLUMNS = %w[name email full_name display_name first_name last_name firstname lastname
-                            username login].freeze
+        SEARCH_COLUMNS = (%w[name] + PersonLabel::EMAIL_ATTRIBUTES.map(&:to_s) +
+                          %w[full_name display_name first_name last_name firstname lastname username login]).freeze
         # A query of digits also matches the id — up to a bigint's length.
         NUMERIC = /\A\d{1,18}\z/
 
@@ -31,11 +35,12 @@ module PermissionForge
         end
 
         def search(query)
-          columns = SEARCH_COLUMNS & @relation.klass.column_names
+          model = @relation.klass
+          columns = PermissionForge::SchemaRead.columns_among(model, SEARCH_COLUMNS)
           id = query.to_i if query.match?(NUMERIC)
-          return Relation.new(@relation.none) if columns.empty? && id.nil?
-
-          Relation.new(@relation.where(word_conditions(columns, query.downcase, id)))
+          condition = word_conditions(PermissionForge::EncryptedAttributes.plain(model, columns), query.downcase, id)
+          scopes = [(@relation.where(condition) if condition), *exact_matches(model, columns, query)].compact
+          Relation.new(scopes.empty? ? @relation.none : scopes.reduce(:or))
         end
 
         def count
@@ -50,15 +55,22 @@ module PermissionForge
 
         # Every word must match some column, so "ana kras" finds Ana Krasniqi
         # whether the name lives in one column or in first/last name columns.
-        # A numeric query also matches the id.
+        # A numeric query also matches the id. nil when nothing can match.
         def word_conditions(columns, needle, id)
           words = needle.split
-          matched = words.map { |word| any_column(columns, word) }.compact.reduce(:and)
-          return table[:id].eq(id) if matched.nil?
+          matched = words.map { |word| any_column(columns, word) }.compact.reduce(:and) if columns.any?
+          return id && table[:id].eq(id) if matched.nil?
 
           id ? matched.or(table[:id].eq(id)) : matched
         end
 
+        # The whole query against each deterministically encrypted column, as
+        # typed and lower-cased.
+        def exact_matches(model, columns, query)
+          values = [query, query.downcase].uniq
+          PermissionForge::EncryptedAttributes.deterministic(model, columns).map { |column| @relation.where(column => values) }
+        end
+
         def any_column(columns, word)
           like = "%#{ActiveRecord::Base.sanitize_sql_like(word)}%"
           columns.map { |column| table[column].lower.matches(like) }.reduce(:or)

data/lib/permission_forge/admin/people_directory.rb

@@ -9,7 +9,6 @@ module PermissionForge
     # (see PeopleCandidates).
     class PeopleDirectory
       FILTERS = %w[all ending expired muting no_access].freeze
-      ENDING_WINDOW_DAYS = 7
       DEFAULT_PER_PAGE = 25
       # Beyond this the offset overflows the database's integer; the page is
       # empty long before.
@@ -19,9 +18,7 @@ module PermissionForge
 
       # Assignments whose people a filter keeps ('no_access' keeps everyone else).
       FILTER_ASSIGNMENTS = {
-        'ending' => lambda {
-          PermissionForge::PermissionSetUser.where(expires_at: Time.current..ENDING_WINDOW_DAYS.days.from_now.end_of_day)
-        },
+        'ending' => -> { PermissionForge::PermissionSetUser.ending_within },
         'expired' => -> { PermissionForge::PermissionSetUser.expired },
         'muting' => lambda {
           PermissionForge::PermissionSetUser.active_assignments.where(permission_set_id: PermissionForge::PermissionSet.muting.select(:id))
@@ -55,7 +52,8 @@ module PermissionForge
       def search(query: nil, filter: 'all', **paging)
         filter = 'all' unless FILTERS.include?(filter.to_s)
         candidates = apply_query(apply_filter(base_candidates, filter.to_s), query)
-        paginate(candidates, paging[:page].to_s.to_i.clamp(1, MAX_PAGE), paging.fetch(:per_page, DEFAULT_PER_PAGE))
+        page = ParamShapes.integer(paging[:page], default: 1, range: 1..).clamp(1, MAX_PAGE) # the one reader: "2abc" is page 1
+        paginate(candidates, page, paging.fetch(:per_page, DEFAULT_PER_PAGE))
       end
 
       # Counts for the filter chips (respecting the search query).
@@ -109,6 +107,26 @@ module PermissionForge
           (ids.is_a?(Array) ? ids : [ids]).filter_map { |id| cast_one(id, type) }.uniq
         end
 
+        # The request values that name none of `found` (cast ids, e.g. the
+        # people #find_all returned): each cast to the key type when it can
+        # be (99, not "99"), else as sent, trimmed and without NUL bytes.
+        # Blanks and values that are no id at all (an object, a list) are
+        # left out.
+        #
+        # @return [Array] distinct, in order
+        def self.unmatched(ids, found, configuration: PermissionForge.configuration)
+          model = configuration.user_model
+          type = model.type_for_attribute(model.primary_key)
+          (ids.is_a?(Array) ? ids : [ids]).filter_map do |id|
+            next unless id.is_a?(String) || id.is_a?(Integer)
+
+            cast = cast_one(id, type)
+            next id.to_s.delete("\0").strip.presence if cast.nil?
+
+            cast unless found.include?(cast)
+          end.uniq
+        end
+
         def self.cast_one(id, type)
           return nil unless id.is_a?(String) || id.is_a?(Integer)
 

data/lib/permission_forge/admin/permission_set_factory.rb

@@ -14,29 +14,20 @@ module PermissionForge
         PermissionForge::PermissionSet.create!(attrs.merge(is_active: true, is_editable: true))
       end
 
-      # An editable copy. A source in a locked Permission Set Group is copied
+      # An editable copy, named "<name> (copy)" (numbered when taken) unless
+      # a name is given. A source in a locked Permission Set Group is copied
       # outside it: the copy would change the locked group's list of sets.
-      def self.duplicate(source, name:)
+      def self.duplicate(source, name: PermissionForge::PermissionSet.copy_name(source.name))
         attrs = { name: name, is_editable: true }
         attrs[:permission_set_group] = nil if EditableLock.locked?(source.permission_set_group)
         clone_unlocked(source, attrs)
       end
 
-      # Case-insensitive.
-      def self.name_taken?(name)
-        PermissionForge::PermissionSet.where('LOWER(name) = ?', name.downcase).exists?
-      end
+      # Case-insensitive, in the current tenant (PermissionSet.name_taken?).
+      def self.name_taken?(name) = PermissionForge::PermissionSet.name_taken?(name)
 
       # `base`, else "`base` 2", "`base` 3", ... — the first free name.
-      def self.unique_name(base)
-        candidate = base
-        suffix = 2
-        while name_taken?(candidate)
-          candidate = "#{base} #{suffix}"
-          suffix += 1
-        end
-        candidate
-      end
+      def self.unique_name(base) = PermissionForge::PermissionSet.unique_name(base)
 
       # Every copied row is created unlocked, so its create event holds the
       # state it has (no second, unaudited write).

data/lib/permission_forge/admin/person_label.rb

@@ -5,24 +5,70 @@ module PermissionForge
     # Display name / email / initials for a host-app user in the admin UI.
     #
     # Honors config.user_label_formatter for the name. Otherwise tries :name,
-    # :full_name, :display_name, then composes first_name/last_name (or firstname/lastname). Attribute
+    # :full_name, :display_name, then composes first_name/last_name (or firstname/lastname), then
+    # the email (EMAIL_ATTRIBUTES: `email`, or Rails 8's `email_address`). Attribute
     # reads go raw-column-first (read_attribute_before_type_cast) so
     # MaskedAttributes on the User model never garbles admin lists; virtual
-    # attributes and blank columns fall back to the public reader.
+    # attributes and blank columns fall back to the public reader. A column
+    # the model encrypts (`encrypts :email`) is read decrypted through its
+    # attribute type (PermissionForge::EncryptedAttributes), never as the
+    # ciphertext it stores — for the admin's display, which is never cached.
+    # `decrypt: false` (the default profile_builder, whose profile is cached
+    # with the permission hash in the cache store) reads such a column as
+    # nil instead: neither its ciphertext nor its plaintext. Nor does it ask
+    # a public reader for a name or an email ({LABEL_ATTRIBUTES}) while the
+    # model encrypts any of them: a `name` composed from encrypted columns
+    # would hand over their plaintext.
     class PersonLabel
       NAME_METHODS = %i[name full_name display_name].freeze
-
-      def initialize(user, configuration: PermissionForge.configuration)
+      # The one definition of "the user's email attribute", in order: `email`,
+      # then `email_address` (the column Rails 8's authentication generator
+      # creates). Labels, people search, bulk matching and the default
+      # profile_builder all read it from here.
+      EMAIL_ATTRIBUTES = %i[email email_address].freeze
+      # The split name attributes composed into a name.
+      NAME_PARTS = %i[first_name last_name firstname lastname].freeze
+      # Every attribute a name or an email is read from.
+      LABEL_ATTRIBUTES = (NAME_METHODS + NAME_PARTS + EMAIL_ATTRIBUTES).freeze
+
+      # @param user [Object]
+      # @param configuration [PermissionForge::Configuration]
+      # @param decrypt [Boolean] false: an encrypted column reads as nil
+      def initialize(user, configuration: PermissionForge.configuration, decrypt: true)
         @user = user
         @configuration = configuration
+        @decrypt = decrypt
+      end
+
+      # A user attribute read raw-column-first (read_attribute_before_type_cast,
+      # past MaskedAttributes), the public reader for a virtual attribute or a
+      # blank column; nil when the user has neither. The one definition for the
+      # admin's labels (pf_raw_user_attribute) and the default profile_builder.
+      #
+      # @param user [Object]
+      # @param attr [Symbol, String]
+      # @return [Object, nil]
+      def self.raw_value(user, attr)
+        new(user).raw_value(attr)
+      end
+
+      # @see .raw_value
+      def raw_value(attr)
+        attr_name = attr.to_s
+        if readable_column?(attr_name)
+          value = column_value(attr_name)
+          return value if value.to_s.strip.present? || encrypted?(attr_name)
+        end
+        @user.try(attr) unless withheld_reader?(attr_name)
       end
 
       def name
         @name ||= formatted_name || default_name || email || fallback
       end
 
+      # The first EMAIL_ATTRIBUTES value present, stripped.
       def email
-        @email ||= raw_value(:email).to_s.strip.presence
+        @email ||= first_present(EMAIL_ATTRIBUTES)
       end
 
       # Email shown under the name — omitted when the name already is the email.
@@ -30,8 +76,17 @@ module PermissionForge
         email unless email == name
       end
 
+      # Two letters for the avatar: the first and last word of a name ("AK"),
+      # or the first two letters of a single word. A label that is the email
+      # takes them from its local part ("dave@acme.test" => "DA"), never from
+      # the domain.
       def initials
-        initial_letters(name.to_s.scan(/[[:alnum:]]+/)).join.upcase.presence || '?'
+        initial_letters(initials_source.scan(/[[:alnum:]]+/)).join.upcase.presence || '?'
+      end
+
+      # Whether the label is the "User #<id>" fallback: neither a name nor an email.
+      def fallback?
+        name == fallback
       end
 
       # Lower-cased "name email" for in-memory search.
@@ -39,12 +94,29 @@ module PermissionForge
         "#{name} #{email}".downcase
       end
 
+      # The first word of a person's name, for sentences ("What Ana can do").
+      # A label that is not a name (the email, or the "User #2" fallback) is
+      # used whole: its first word would read as a placeholder ("User").
       def first_name
+        return name unless personal_name?
+
         name.to_s.split(/\s+/).first.presence || name
       end
 
       private
 
+      # Whether the label comes from a name (formatter or name attributes),
+      # not from the email or the id fallback.
+      def personal_name?
+        label = name
+        label != email && label != fallback
+      end
+
+      def initials_source
+        label = name.to_s
+        label == email ? label.split('@').first.to_s : label
+      end
+
       # First letters of the first and last word, or the first two letters of a single word.
       def initial_letters(words)
         words.size > 1 ? [words.first[0], words.last[0]] : [words.first.to_s[0, 2]]
@@ -58,11 +130,15 @@ module PermissionForge
       end
 
       def default_name
-        NAME_METHODS.each do |method|
-          value = raw_value(method).to_s.strip
+        first_present(NAME_METHODS) || composed(*NAME_PARTS.first(2)) || composed(*NAME_PARTS.last(2))
+      end
+
+      def first_present(attrs)
+        attrs.each do |attr|
+          value = raw_value(attr).to_s.strip
           return value unless value.empty?
         end
-        composed(:first_name, :last_name) || composed(:firstname, :lastname)
+        nil
       end
 
       def composed(first, last)
@@ -73,13 +149,26 @@ module PermissionForge
         I18n.t('permission_forge.shared.user_fallback', id: @user.id)
       end
 
-      def raw_value(attr)
-        attr_name = attr.to_s
-        if readable_column?(attr_name)
-          value = @user.read_attribute_before_type_cast(attr_name)
-          return value if value.to_s.strip.present?
-        end
-        @user.try(attr)
+      # The stored value; decrypted for an encrypted column (nil when this
+      # application cannot decrypt it: the reader would raise), nil for one
+      # under `decrypt: false`.
+      def column_value(attr_name)
+        value = @user.read_attribute_before_type_cast(attr_name)
+        return value if value.nil? || !encrypted?(attr_name)
+
+        PermissionForge::EncryptedAttributes.decrypt(@user.class, attr_name, value) if @decrypt
+      end
+
+      def encrypted?(attr_name)
+        PermissionForge::EncryptedAttributes.encrypted?(@user.class, attr_name)
+      end
+
+      # Under `decrypt: false`, a name or email attribute's public reader is
+      # not asked while the model encrypts any LABEL_ATTRIBUTES: the reader
+      # may read them decrypted.
+      def withheld_reader?(attr_name)
+        !@decrypt && LABEL_ATTRIBUTES.include?(attr_name.to_sym) &&
+          LABEL_ATTRIBUTES.any? { |attribute| encrypted?(attribute) }
       end
 
       # True when attr_name is a loaded column on an AR-like user (guards