permission_forge 0.14.1 → 0.15.0

data/lib/permission_forge/api/serializers/base_serializer.rb

@@ -4,19 +4,48 @@ module PermissionForge
   # @api private
   module Api
     module Serializers
+      # The JSON API's built-in serializers: `attributes` lists the keys of
+      # an answer, in order; each is the serializer's own (private) method
+      # of that name, else the record's.
+      #
+      # A key that refers to another PermissionForge record is declared with
+      # {.reference}: the record's numeric id (`permission_set_id`, as
+      # through 0.14.1) followed by its uuid (`permission_set_uuid`), so a
+      # client that only knows uuids — `api_record_identifier = :uuid`, the
+      # identifier the URLs take — can follow it (field test round 8, D#29).
+      # Both keys are always there, whatever the identifier setting. The uuid
+      # key is answer-only: no endpoint takes it (the `_id` key changes a
+      # reference, and takes the uuid under `:uuid`), so a whole answer sent
+      # back is ignored there. A collection looks the uuids up in one query
+      # per reference.
       class BaseSerializer
         def initialize(record)
           @record = record
         end
 
+        # @return [Hash{Symbol => Object}] the record's keys, in order
         def as_json(*)
           self.class.attribute_names.to_h do |attr|
             [attr, respond_to?(attr, true) ? send(attr) : @record.public_send(attr)]
           end
         end
 
+        # The uuids of the records the references name, as {.reference_uuids}
+        # answers them (a collection passes the lookup of all its records).
+        #
+        # @param uuids [Hash{Symbol => Hash{Integer => String}}]
+        # @return [self]
+        def with_reference_uuids(uuids)
+          @reference_uuids = uuids
+          self
+        end
+
+        # @param records [Enumerable<ActiveRecord::Base>]
+        # @return [Array<Hash>]
         def self.collection(records)
-          records.map { |r| new(r).as_json }
+          records = records.to_a
+          uuids = reference_uuids(records)
+          records.map { |r| new(r).with_reference_uuids(uuids).as_json }
         end
 
         def self.attributes(*attrs)
@@ -27,9 +56,66 @@ module PermissionForge
           @attribute_names || []
         end
 
+        # The two keys of a reference to another PermissionForge record, for
+        # `attributes`: `<association>_id` (its numeric id) and
+        # `<association>_uuid` (its uuid, read through the association's
+        # model; nil when the id is nil or names no record).
+        #
+        # @param association [Symbol] a belongs_to of the serialized model
+        # @return [Array(Symbol, Symbol)]
+        def self.reference(association)
+          id_key, uuid_key = reference_keys(association)
+          own_references << association
+          define_method(uuid_key) { reference_uuid(association, id_key) }
+          private uuid_key
+          [id_key, uuid_key]
+        end
+
+        # The one naming of a reference's keys: the id key and the uuid key.
+        #
+        # @param association [Symbol, String]
+        # @return [Array(Symbol, Symbol)]
+        def self.reference_keys(association)
+          [:"#{association}_id", :"#{association}_uuid"]
+        end
+
+        # @return [Array<Symbol>] the associations declared with {.reference}, a superclass's too
+        def self.references
+          inherited = superclass.respond_to?(:references) ? superclass.references : []
+          inherited | own_references
+        end
+
+        # The uuid of every record the references of `records` name, one
+        # query per reference (the referenced model's default scope, the
+        # tenant's, applies as it does to the association).
+        #
+        # @param records [Array<ActiveRecord::Base>]
+        # @return [Hash{Symbol => Hash{Integer => String}}] association => { id => uuid }
+        def self.reference_uuids(records)
+          references.to_h { |association| [association, uuids_named(records, association)] }
+        end
+
+        def self.own_references
+          @own_references ||= []
+        end
+
+        def self.uuids_named(records, association)
+          id_key, = reference_keys(association)
+          ids = records.filter_map { |record| record.public_send(id_key) }.uniq
+          return {} if ids.empty?
+
+          records.first.class.reflect_on_association(association).klass.where(id: ids).pluck(:id, :uuid).to_h
+        end
+        private_class_method :own_references, :uuids_named
+
         private
 
         attr_reader :record
+
+        def reference_uuid(association, id_key)
+          @reference_uuids ||= self.class.reference_uuids([record])
+          @reference_uuids.fetch(association, {})[record.public_send(id_key)]
+        end
       end
     end
   end

data/lib/permission_forge/api/serializers/permission_set_group_user_serializer.rb

@@ -4,7 +4,7 @@ module PermissionForge
   module Api
     module Serializers
       class PermissionSetGroupUserSerializer < BaseSerializer
-        attributes :id, :uuid, :permission_set_group_id, :user_id, :created_at, :updated_at
+        attributes :id, :uuid, *reference(:permission_set_group), :user_id, :created_at, :updated_at
       end
     end
   end

data/lib/permission_forge/api/serializers/permission_set_rule_serializer.rb

@@ -6,7 +6,7 @@ module PermissionForge
       class PermissionSetRuleSerializer < BaseSerializer
         REDACTED_PLACEHOLDER = '[REDACTED]'
 
-        attributes :id, :uuid, :permission_set_id, :resource_id,
+        attributes :id, :uuid, *reference(:permission_set), *reference(:resource),
                    :name, :failure_message, :join_type,
                    :field_name, :field_value, :field_accessor_path,
                    :operator, :include_nulls, :is_active, :is_editable,

data/lib/permission_forge/api/serializers/permission_set_serializer.rb

@@ -3,10 +3,13 @@
 module PermissionForge
   module Api
     module Serializers
+      # `allowed_ips` is the stored text (commas between the entries since
+      # 0.15); `allowed_ip_list` the entries as the engine reads them
+      # (ActivationConditions) — what a client should write back.
       class PermissionSetSerializer < BaseSerializer
         attributes :id, :uuid, :name, :description, :is_active, :is_editable, :is_muting,
-                   :requires_session_flag, :allowed_ips, :allowed_hours_start, :allowed_hours_end,
-                   :permission_set_group_id, :created_at, :updated_at
+                   :requires_session_flag, :allowed_ips, :allowed_ip_list, :allowed_hours_start, :allowed_hours_end,
+                   *reference(:permission_set_group), :created_at, :updated_at
       end
     end
   end

data/lib/permission_forge/api/serializers/permission_set_user_serializer.rb

@@ -4,7 +4,7 @@ module PermissionForge
   module Api
     module Serializers
       class PermissionSetUserSerializer < BaseSerializer
-        attributes :id, :uuid, :permission_set_id, :user_id, :expires_at, :created_at, :updated_at
+        attributes :id, :uuid, *reference(:permission_set), :user_id, :expires_at, :created_at, :updated_at
       end
     end
   end

data/lib/permission_forge/api/serializers/resource_action_serializer.rb

@@ -4,7 +4,7 @@ module PermissionForge
   module Api
     module Serializers
       class ResourceActionSerializer < BaseSerializer
-        attributes :id, :uuid, :resource_id, :name, :label, :description,
+        attributes :id, :uuid, *reference(:resource), :name, :label, :description,
                    :is_permitted, :is_active,
                    :created_at, :updated_at
       end

data/lib/permission_forge/api/serializers/resource_field_serializer.rb

@@ -4,7 +4,7 @@ module PermissionForge
   module Api
     module Serializers
       class ResourceFieldSerializer < BaseSerializer
-        attributes :id, :uuid, :resource_id, :name, :label, :description,
+        attributes :id, :uuid, *reference(:resource), :name, :label, :description,
                    :is_active, :is_editable,
                    :read_access, :edit_access, :mask_access, :mask_strategy,
                    :created_at, :updated_at

data/lib/permission_forge/api/serializers/resource_serializer.rb

@@ -4,7 +4,7 @@ module PermissionForge
   module Api
     module Serializers
       class ResourceSerializer < BaseSerializer
-        attributes :id, :uuid, :permission_set_id, :name, :description,
+        attributes :id, :uuid, *reference(:permission_set), :name, :description,
                    :is_active, :is_editable,
                    :read_access, :create_access, :edit_access, :delete_access,
                    :view_all, :modify_all,

data/lib/permission_forge/api_authorizations.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  # The JSON API's authorization lambdas, and what the API refuses while one
+  # it needs is unset. `api_auth` proves identity only: while
+  # api_require_authorization is on (the default) a change needs
+  # api_action_authorization and an assignment api_assignment_authorization,
+  # and while api_stats_require_admin is on (the default) GET /api/stats
+  # needs api_stats_authorization. Without one, the API answers 403 and the
+  # answer names the option: it fails closed, but nothing said so before the
+  # first refused request (field test round 8, D#7). The boot note
+  # (BootChecks, :api_authorization_unset) and the audit finding
+  # (ConfigCheck#api_authorization_unset) both read `unset`.
+  #
+  # The stats note cannot see an api_auth that still sets the deprecated
+  # 0.14 `@admin = true` on the controller (Api::DashboardController
+  # #legacy_admin_flag?, until 0.16): that host is not refused, and the note
+  # says so.
+  #
+  # api_require_authorization = false with a lambda unset is another
+  # condition (every caller api_auth admits may change permissions: the
+  # api_authorization_gap warning, the api_mutations_unguarded finding).
+  #
+  # @api private
+  module ApiAuthorizations
+    # Each lambda => [the setting under which the API needs it, what the API
+    # refuses (403) while it is unset].
+    LAMBDAS = {
+      api_action_authorization: [:api_require_authorization, 'every create, update, delete and copy'],
+      api_assignment_authorization: [:api_require_authorization, 'every assignment and group membership change'],
+      api_stats_authorization: [:api_stats_require_admin,
+                                'GET /api/stats (or set api_stats_require_admin = false; an api_auth that sets the ' \
+                                'deprecated @admin = true still passes until 0.16)']
+    }.freeze
+
+    module_function
+
+    # The lambdas the API needs and does not have. None while the API is off
+    # or api_auth is unset (every request is then a 401).
+    #
+    # @param config [Configuration]
+    # @return [Hash{Symbol => String}] lambda option => what the API refuses without it
+    def unset(config)
+      return {} unless config.api_enabled && config.api_auth
+
+      LAMBDAS.each_with_object({}) do |(option, (required_by, refused)), unset|
+        unset[option] = refused if config.public_send(required_by) && !config.public_send(option)
+      end
+    end
+
+    # One line per unset lambda: "<option>: <what is refused>".
+    #
+    # @param config [Configuration]
+    # @return [Array<String>]
+    def lines(config)
+      unset(config).map { |option, refused| "#{option}: #{refused}" }
+    end
+  end
+end

data/lib/permission_forge/api_only_admin.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  # The admin screens in an API-only application (`rails new --api`,
+  # `config.api_only = true`). Rails then leaves ActionDispatch::Cookies, the
+  # session store and ActionDispatch::Flash out of the middleware stack, and
+  # every admin page that renders a form raises: NameError for `flash` (its
+  # request methods are loaded with the middleware), then
+  # ActionDispatch::Request::Session::DisabledSessionError for the CSRF
+  # token. The JSON API needs none of them. BootChecks warns through
+  # Warnings.emit (:api_only_admin), naming the middlewares
+  # config/application.rb must add, when the engine is mounted — once the
+  # routes are drawn (the engine's config.after_routes_loaded), and not when
+  # config.api_only_admin_warning is false (an app that uses only the API).
+  #
+  # @api private
+  module ApiOnlyAdmin
+    COOKIES = 'ActionDispatch::Cookies'
+    SESSION = 'ActionDispatch::Session::CookieStore'
+    FLASH = 'ActionDispatch::Flash'
+    # What each one is recognised by in the stack: any session store counts.
+    PRESENT = {
+      COOKIES => ->(name) { name == COOKIES },
+      SESSION => ->(name) { name.start_with?('ActionDispatch::Session::') },
+      FLASH => ->(name) { name == FLASH }
+    }.freeze
+
+    module_function
+
+    # @param application [Rails::Application]
+    # @return [Array<String>] the middlewares the admin needs that the stack
+    #   lacks; empty unless the application is api_only with the engine mounted
+    def missing_middlewares(application)
+      return [] unless api_only?(application) && mounted?(application)
+
+      names = middleware_names(application)
+      return [] if names.nil?
+
+      PRESENT.reject { |_name, present| names.any?(&present) }.keys
+    end
+
+    def api_only?(application)
+      application.respond_to?(:config) && application.config.respond_to?(:api_only) && application.config.api_only == true
+    end
+
+    # @param missing [Array<String>]
+    # @return [String] the warning
+    def message(missing)
+      'The application is API-only (config.api_only = true) and PermissionForge::Engine is mounted: the admin screens ' \
+        "need #{missing.join(', ')} in the middleware stack, which an API-only application leaves out. Every admin page " \
+        "that renders a form answers 500 until config/application.rb adds #{missing.map { |name| "config.middleware.use #{name}" }.join(', ')} " \
+        '(docs/admin-ui.md#api-only-applications). The JSON API works without them.'
+    end
+
+    # The names in the built stack (after initialize!); nil while it is still
+    # the configuration proxy, when nothing can be said yet.
+    def middleware_names(application)
+      stack = application.middleware
+      return nil unless stack.respond_to?(:middlewares)
+
+      stack.middlewares.map { |middleware| middleware.name.to_s }
+    rescue StandardError
+      nil
+    end
+
+    # Whether the engine is mounted in the routes as drawn. Asked once they
+    # are (after_routes_loaded: at boot, or at their first use where Rails 8
+    # draws them lazily); it never draws them itself — a draw at boot is
+    # undone and drawn again at the first request. When they cannot be read,
+    # yes (a warning too many beats a 500 nobody was told about).
+    def mounted?(application)
+      application.routes.routes.any? { |route| engine?(route.app) }
+    rescue StandardError
+      true
+    end
+
+    def engine?(app)
+      app == PermissionForge::Engine || (app.respond_to?(:app) && app.app == PermissionForge::Engine)
+    end
+  end
+end

data/lib/permission_forge/audit/actor_codes.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Audit
+    # The actor labels the gem writes on an event itself, stored as codes
+    # (never English), each for one actor type: the admin names them from
+    # the locale (`permission_forge.audit_log.actor_codes.<code>`,
+    # Admin::ActorLabel). A label a person or the host chose is shown as
+    # stored; so is a code under another actor type (a person called "boot").
+    #
+    # @api private
+    module ActorCodes
+      # An API request nobody named (api_auth said yes, but not who): ActorResolver's fallback.
+      API_CLIENT = 'api_client'
+      # The settings observer, which records the audit settings as the application boots.
+      BOOT = 'boot'
+      # actor type => the codes it carries.
+      BY_TYPE = { 'api' => [API_CLIENT], 'system' => [BOOT] }.freeze
+      # A label stored before it was a code => the code.
+      LEGACY = { 'API client' => API_CLIENT }.freeze
+
+      # @param type [String, Symbol] the event's actor_type
+      # @param label [String, nil] the event's actor_label
+      # @return [String, nil] the code the label stands for, nil for any other label
+      def self.code(type, label)
+        code = label.to_s.strip
+        code = LEGACY.fetch(code, code)
+        code if BY_TYPE.fetch(type.to_s, []).include?(code)
+      end
+    end
+  end
+end

data/lib/permission_forge/audit/actor_resolver.rb

@@ -25,7 +25,6 @@ module PermissionForge
       # username it has just verified. Not reachable from a header (those are
       # HTTP_*).
       BASIC_AUTH_ENV = 'permission_forge.audit.basic_auth_user'
-      API_CLIENT_LABEL = 'API client'
 
       # The steps tried, in order, per request source; the first that names
       # someone wins.
@@ -37,7 +36,7 @@ module PermissionForge
       # Who acts when no step names anyone.
       FALLBACKS = {
         'admin_ui' => -> { Actor.unknown },
-        'api' => -> { Actor.new(type: 'api', label: API_CLIENT_LABEL) }
+        'api' => -> { Actor.new(type: 'api', label: ActorCodes::API_CLIENT) }
       }.freeze
 
       # @param controller [ActionController::Metal]

data/lib/permission_forge/audit/boot_warnings.rb

@@ -5,23 +5,34 @@ module PermissionForge
     # The audit boot warnings, written by the engine once the database is
     # reachable. The missing-table warning is logged by Audit (once per
     # process, by Audit.verify_table!) with the text of .missing_table; this
-    # adds auditing switched off and one shared login for every change.
+    # adds auditing switched off and one shared login for every change, each
+    # through PermissionForge::Warnings.emit.
+    #
+    # The table is not checked while a generator runs (`bin/rails generate
+    # permission_forge:install` boots the app before it writes the migration
+    # that creates the table): it is checked again, and the warning logged,
+    # the first time an event is recorded. The emitter writes nothing then.
     #
     # @api private
     module BootWarnings
-      def self.call(configuration = PermissionForge.configuration)
-        PermissionForge::Audit.verify_table!
+      # @param generating [Boolean] whether a Rails generator is running
+      def self.call(configuration = PermissionForge.configuration, generating: generator_running?)
+        PermissionForge::Audit.verify_table! unless generating
 
         if configuration.audit_events == false
-          Rails.logger&.warn '[PermissionForge] SECURITY warning: audit_events is false, so permission changes ' \
-                             'are not recorded. Set config.audit_events = :auto unless another system records them.'
+          PermissionForge::Warnings.emit(:audit_events_off,
+                                         'audit_events is false, so permission changes are not recorded. Set ' \
+                                         'config.audit_events = :auto unless another system records them.',
+                                         severity: :security)
         end
 
         return unless configuration.http_basic_auth_enabled && configuration.audit_actor_resolver.nil?
 
-        Rails.logger&.warn '[PermissionForge] The admin UI uses HTTP Basic auth and audit_actor_resolver is not ' \
-                           'set: every change is attributed to the shared login. Set ' \
-                           'config.audit_actor_resolver to return the signed-in admin.'
+        PermissionForge::Warnings.emit(:audit_actor_shared_login,
+                                       'The admin UI uses HTTP Basic auth and audit_actor_resolver is not set: ' \
+                                       'every change is attributed to the shared login. Set ' \
+                                       'config.audit_actor_resolver to return the signed-in admin.',
+                                       audience: :server)
       end
 
       # The missing-table warning (Audit logs it once per process). Its
@@ -39,10 +50,19 @@ module PermissionForge
                  else
                    'its migration is generated and run (bin/rails generate permission_forge:upgrade, then bin/rails db:migrate)'
                  end
-        "[PermissionForge] audit_events is :auto but the table '#{table}' was not found: no audit events are " \
+        "audit_events is :auto but the table '#{table}' was not found: no audit events are " \
           "recorded until #{remedy}. Changes still work."
       end
 
+      # `bin/rails generate` or `bin/rails destroy` is booting the app
+      # (Warnings.generator_running?: its command class is loaded, not
+      # merely Rails::Generators, which a gem may load at boot).
+      #
+      # @return [Boolean]
+      def self.generator_running?
+        PermissionForge::Warnings.generator_running?
+      end
+
       # @return [Boolean] whether a permission_forge migration in the app's
       #   migration paths creates the audit events table
       def self.audit_migration_present?

data/lib/permission_forge/audit/event_catalog.rb

@@ -15,11 +15,17 @@ module PermissionForge
       class UnknownEventError < ArgumentError; end
 
       # `notification` is computed once: Audit.instrument asks for it on hot paths.
+      # `cache`: the event sums up an operation that invalidated, cleared or
+      # removed cached permissions, so its data carries the one Cache::Outcome
+      # (`cache_confirmed`, `process_local`, `unconfirmed`).
       #
       # @api private
-      Entry = Struct.new(:name, :category, :runtime_group, :notification, keyword_init: true) do
+      Entry = Struct.new(:name, :category, :runtime_group, :notification, :cache, keyword_init: true) do
         # Runtime events are published by Audit.instrument and stored per group.
         def runtime? = category == 'access'
+
+        # Whether the event's data carries a Cache::Outcome.
+        def cache? = cache == true
       end
 
       CATEGORIES = %w[change admin system access].freeze
@@ -34,10 +40,13 @@ module PermissionForge
         # @param category [String] change, admin, system or access
         # @param runtime_group [Symbol, nil] required for access events, refused
         #   for the others
+        # @param cache [Boolean] the event's data carries a Cache::Outcome (a
+        #   cache-touching operation's summary; test/permission_forge/audit/cache_scope_events_test.rb
+        #   runs every flagged event's operation)
         # @return [Entry]
-        def register(name, category:, runtime_group: nil)
+        def register(name, category:, runtime_group: nil, cache: false)
           entry = Entry.new(name: name.to_s, category: category.to_s, runtime_group: runtime_group&.to_sym,
-                            notification: "#{name}.permission_forge").freeze
+                            notification: "#{name}.permission_forge", cache: cache == true).freeze
           validate!(entry)
           REGISTRY_MUTEX.synchronize { @entries[entry.name] = entry }
         end
@@ -92,15 +101,16 @@ module PermissionForge
          group_membership.added group_membership.changed group_membership.removed field.sensitive_acknowledged]
         .each { |name| register(name, category: 'change') }
 
-      %w[erasure.performed consent.withdrawn cleanup.expired_assignments cache.cleared audit.purged audit.settings_observed
-         report.generated].each { |name| register(name, category: 'system') }
+      %w[erasure.performed consent.withdrawn cleanup.expired_assignments cache.cleared cache.settled]
+        .each { |name| register(name, category: 'system', cache: true) }
+      %w[audit.purged audit.settings_observed report.generated].each { |name| register(name, category: 'system') }
 
       %w[admin.effective_access_viewed audit.viewed audit.exported admin.auth_failed api.auth_failed admin.lock_refused]
         .each { |name| register(name, category: 'admin') }
 
       {
         'access.denied' => :denied, 'action.denied' => :denied,
-        'rule.bypassed' => :bypass, 'query.unscoped' => :bypass,
+        'rule.bypassed' => :bypass, 'query.unscoped' => :bypass, 'field.unmasked_without_user' => :bypass,
         'field.access' => :field_read,
         'params.filtered' => :params_filtered, 'write.masked_skipped' => :params_filtered,
         'permissions.rebuilt' => :cache, 'permissions.invalidated' => :cache

data/lib/permission_forge/audit/event_query.rb

@@ -60,10 +60,10 @@ module PermissionForge
         problem(name, :invalid)
       end
 
-      # Rails' own validation messages (errors.messages.<kind>), like the
-      # 422 bodies of the other endpoints.
+      # The gem's own validation messages (permission_forge.validations.<kind>:
+      # blank, invalid), like the 422 bodies of the other endpoints.
       def problem(name, kind)
-        @errors[name] << I18n.t("errors.messages.#{kind}")
+        @errors[name] << I18n.t("permission_forge.validations.#{kind}")
       end
 
       # A parameter's value as a String, nil when absent; an array or hash

data/lib/permission_forge/audit/reason_codes.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Audit
+    # The reasons the gem records on an event itself, stored as codes (never
+    # English): the admin renders a code from the locale
+    # (`permission_forge.audit_log.reason_codes.<code>`, helper
+    # `pf_audit_reason`) and any other reason as it was typed. The CSV export
+    # and the API keep the stored value.
+    #
+    # @api private
+    module ReasonCodes
+      # ExpiredAssignmentCleaner's reason when nobody gave one (rake, the admin's Clean up).
+      EXPIRED = 'expired'
+      # Every code.
+      ALL = [EXPIRED].freeze
+
+      # @param reason [String, nil] an event's (or a row's) stored reason
+      # @return [Boolean] whether it is one of the gem's codes
+      def self.code?(reason)
+        ALL.include?(reason.to_s.strip)
+      end
+    end
+  end
+end

data/lib/permission_forge/audit/runtime.rb

@@ -102,9 +102,16 @@ module PermissionForge
         end
 
         # permissions.invalidated (the `cache` group): a user's cached hash
-        # was removed, for which tenant, and whether the store confirmed it.
+        # was removed, for which tenant, whether the store confirmed it, and
+        # the scope of the store (Cache::Report: `process_local`, and
+        # `in_request` — which processes kept their entries when the store
+        # lives in each process).
         def invalidated(user, tenant_id:, confirmed:)
-          cache_event('permissions.invalidated', user, 'tenant_id' => tenant_id, 'confirmed' => confirmed)
+          return unless Audit.instrument?('permissions.invalidated')
+
+          scope = PermissionForge::Cache::Report.new
+          cache_event('permissions.invalidated', user, 'tenant_id' => tenant_id, 'confirmed' => confirmed,
+                                                       'process_local' => scope.process_local?, 'in_request' => scope.in_request?)
         end
 
         # Whether this is the first time in this request that `key` was

data/lib/permission_forge/audit/settings_observer.rb

@@ -27,12 +27,12 @@ module PermissionForge
         # @return [AuditEvent, nil] the new event; nil when nothing changed,
         #   the table is missing, auditing is off or recording failed
         def call(configuration: PermissionForge.configuration)
-          return unless PermissionForge::AuditEvent.table_exists?
+          return unless PermissionForge::DatabaseReach.table_exists?(PermissionForge::AuditEvent)
 
           settings = fingerprint(configuration)
           return if last_observed == settings
 
-          payload = { data: { 'settings' => settings }, actor: { type: 'system', label: 'boot' }, source: 'service' }
+          payload = { data: { 'settings' => settings }, actor: { type: 'system', label: ActorCodes::BOOT }, source: 'service' }
           return PermissionForge::Audit.record(EVENT, **payload) unless configuration.audit_events == false
 
           # Auditing is off: Audit.record would store nothing, yet "was auditing