permission_forge 0.14.1 → 0.15.0

data/lib/permission_forge/services/attribute_access_guard.rb

@@ -84,14 +84,27 @@ module PermissionForge
       end
 
       # Without a user there is no entry to decide by:
-      # config.masked_attributes_nil_user_strategy says whether every
-      # attribute passes (:bypass, the default) or is hidden (:hide) — except
-      # on the user model, which sign-in reads before anyone is signed in.
-      # The model is the record's class, or else the one the first name of the
-      # chain names (an anonymous subclass answers as its base).
+      # config.masked_attributes_nil_user_strategy says whether the attribute
+      # passes (:bypass, the default), is hidden (:hide), or is hidden inside
+      # a web request only (:hide_in_requests) — never on the user model,
+      # which sign-in reads before anyone is signed in
+      # (Configuration#masked_attributes_without_user_for). A read returned
+      # as stored inside a web request under :bypass is recorded
+      # (Audit::UnmaskedWithoutUser). The model is the record's class, or
+      # else the one the first name of the chain names (an anonymous
+      # subclass answers as its base).
       def without_user
-        model = @model || @resource_name.to_s.safe_constantize
-        PermissionForge.configuration.hide_masked_attributes_without_user_for?(model) ? hidden : bypass
+        model = @model || PermissionForge::ModelLookup.model_for(@resource_name)
+        case PermissionForge.configuration.masked_attributes_without_user_for(model)
+        when :hide then hidden
+        when :record then unmasked_in_request(model)
+        else bypass
+        end
+      end
+
+      def unmasked_in_request(model)
+        PermissionForge::Audit::UnmaskedWithoutUser.note(model || @resource_name, @attribute)
+        bypass
       end
 
       def bypass
@@ -116,13 +129,8 @@ module PermissionForge
       end
 
       def unconfigured
-        strategy_key = PermissionForge.configuration.unconfigured_field_strategy
-        # Unknown strategy keys fall back to :block (fail closed), never pass-through.
-        strategy = FiltersResponseAttributes::UNCONFIGURED_FIELD_STRATEGIES.fetch(
-          strategy_key,
-          FiltersResponseAttributes::UNCONFIGURED_FIELD_STRATEGIES[:block]
-        )
-        include_field, value = strategy.call(@resource_name.to_s, @attribute, @raw_value)
+        # FiltersResponseAttributes.unconfigured_strategy: the one lookup (an unknown key blocks).
+        include_field, value = FiltersResponseAttributes.unconfigured_strategy.call(@resource_name.to_s, @attribute, @raw_value)
         notify(:unconfigured)
         [include_field, value]
       end

data/lib/permission_forge/services/bulk_permission_set_assignment.rb

@@ -1,3 +1,5 @@
+require_relative '../cache/report'
+
 module PermissionForge
   module Services
     # Assigns or revokes a permission set for multiple users in a single
@@ -10,7 +12,7 @@ module PermissionForge
     #   result = BulkPermissionSetAssignment.call(
     #     permission_set: ps, user_ids: [1, 2, 3], action: :assign
     #   )
-    #   # => { assigned: 3, revoked: 0, invalidated: 3 }
+    #   # => { assigned: 3, revoked: 0, invalidated: 3, cache: { confirmed: true, process_local: false, unconfirmed: 0 } }
     #
     # `invalidated` counts the users assigned or revoked whose invalidation
     # the cache store confirmed. Fewer means the store failed for the rest
@@ -18,7 +20,11 @@ module PermissionForge
     # may live until cache_ttl. A user who already held the set (assign) or
     # never did (revoke) changed nothing and is not invalidated. Inside a
     # transaction of the caller the invalidations happen at its commit, after
-    # this returns: `invalidated` is then nil (not known).
+    # this returns: `invalidated` is then nil (not known). `cache` is the one
+    # Cache::Outcome every cache-touching operation answers (Cache::Report):
+    # `confirmed` (nil inside the caller's transaction), `process_local`
+    # (the store lives in this process only, so other processes kept their
+    # entries), `unconfirmed`.
     #
     # Every row is created or destroyed through its callbacks, so each person
     # gets an assignment.granted / assignment.revoked audit event, all with
@@ -35,7 +41,7 @@ module PermissionForge
       VALID_ACTIONS = ACTION_STRATEGIES.keys.freeze
 
       # Assigns or revokes a Permission Set for many users in one transaction.
-      # @return [Hash] `{ assigned:, revoked:, invalidated: }`
+      # @return [Hash] `{ assigned:, revoked:, invalidated:, cache: }`
       def self.call(...) = new(...).call
 
       # @raise [ArgumentError] unless `action` is one of VALID_ACTIONS
@@ -59,17 +65,19 @@ module PermissionForge
         @changed_user_ids = []
       end
 
-      # @return [Hash] `{ assigned:, revoked:, invalidated: }`
+      # @return [Hash] `{ assigned:, revoked:, invalidated:, cache: }`
       def call
         validate_action!
 
-        deferred = PermissionForge::OpenTransaction.current
-        failures = PermissionForge::Cache::Failure.collect do
+        # what the store confirmed (Cache::Report) — not what a host's override of invalidate_permissions returns;
+        # pending inside a caller's transaction (Report#deferred?)
+        report = PermissionForge::Cache::Report.measure do
           ActiveRecord::Base.transaction { send(ACTION_STRATEGIES.fetch(@action)) }
         end
+        outcome = report.outcome(user_ids: @changed_user_ids)
 
-        # what the store confirmed (Cache::Failure) — not what a host's override of invalidate_permissions returns
-        { assigned: @assigned_count, revoked: @revoked_count, invalidated: deferred ? nil : failures.confirmed(@changed_user_ids).size }
+        { assigned: @assigned_count, revoked: @revoked_count,
+          invalidated: report.deferred? ? nil : @changed_user_ids.size - outcome.unconfirmed, cache: outcome.to_h }
       end
 
       private

data/lib/permission_forge/services/concerns/clonable.rb

@@ -24,6 +24,15 @@ module PermissionForge
       def reset_on_copy(record)
         RESET_ON_COPY.select { |column| record.has_attribute?(column) }.index_with(nil)
       end
+
+      # A row whose blank name the validations would refuse on a new record
+      # (ResourceField, ResourceAction: `validates :name, presence`), so a
+      # copy of it can never be saved.
+      def refused_for_blank_name?(record)
+        return false unless record.respond_to?(:name) && record.name.to_s.strip.empty?
+
+        record.class.validators_on(:name).any? { |validator| validator.kind == :presence }
+      end
     end
   end
 end

data/lib/permission_forge/services/concerns/settles_cache.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Services
+    module Concerns
+      # For an operation whose summary event is written in its transaction,
+      # before its cache work (erasure.performed, consent.withdrawn record
+      # `cache_confirmed: nil`): one `cache.settled` event, on the
+      # operation's correlation id, says what the cache store answered once
+      # the work ran.
+      #
+      # Outside a transaction that is the outcome the operation just
+      # measured. Inside a caller's one (Cache::Report#deferred?) the work is
+      # only done for everybody at its commit: it runs again there, measured,
+      # and the event is written then, in the context of the operation
+      # (OpenTransaction#after_commit: never after a rollback). The work
+      # always runs, also with auditing off; a failure there is reported,
+      # never raised out of the commit, and a store failure is what the event
+      # records (`cache_confirmed: false`).
+      #
+      # @api private
+      module SettlesCache
+        EVENT = 'cache.settled'
+
+        private
+
+        # @param operation [String] the operation's name in the event's data ('erasure')
+        # @param subject [Object] the person whose cached permissions it cleared
+        # @param report [Cache::Report] the operation's measured report
+        # @yield the cache work, run again after a caller's commit
+        def settle_cache(operation, subject, report, &work)
+          transaction = PermissionForge::OpenTransaction.current if report.deferred?
+          return record_settled(operation, subject, report.outcome) unless transaction
+
+          context = PermissionForge::Audit::Context.current
+          transaction.after_commit do
+            PermissionForge::Audit::Context.with(**context) do
+              record_settled(operation, subject, PermissionForge::Cache::Report.of(&work))
+            end
+          rescue StandardError => e
+            PermissionForge::Cache::Failure.report(operation: :invalidate, user_id: subject.id, error: e)
+          end
+        end
+
+        # Written after the operation's transaction: like Audit::Detached, a
+        # failure to store it is reported (or logged), never raised — the
+        # operation has happened.
+        def record_settled(operation, subject, outcome)
+          PermissionForge::Audit.record(EVENT, subject_user_id: subject.id,
+                                               data: { 'operation' => operation, **outcome.event_data })
+        rescue StandardError => e
+          strategy = PermissionForge.configuration.audit_hook_failure_strategy
+          PermissionForge::Audit::Failure.handle(e, strategy: strategy == :raise ? :report : strategy, operation: :store, event: EVENT)
+        end
+      end
+    end
+  end
+end

data/lib/permission_forge/services/consent_withdrawal_handler.rb

@@ -1,3 +1,5 @@
+require_relative '../cache/report'
+
 module PermissionForge
   module Services
     # Handles consent withdrawal by removing a user from all permission sets
@@ -9,11 +11,20 @@ module PermissionForge
     #     user: user,
     #     consent_flag: 'marketing_consent'
     #   )
-    #   # => { revoked_sets: 2, invalidated: true }
+    #   # => { revoked_sets: 2, invalidated: true, affected_sets: ["Marketing Access", "Newsletter"],
+    #   #      affected_assignment_count: 2, dry_run: false,
+    #   #      cache: { confirmed: true, process_local: false, unconfirmed: 0 } }
     #
     # `invalidated` is false when nothing was revoked, and when the cache
     # store did not confirm the invalidation (reported through
-    # `config.on_cache_failure`).
+    # `config.on_cache_failure`). `cache` is the one Cache::Outcome every
+    # cache-touching operation answers (Cache::Report): `confirmed` (true
+    # also when nothing had to be invalidated), `process_local` (the store
+    # lives in this process only: other processes kept their entries),
+    # `unconfirmed`. A dry run and a real run answer the same keys:
+    # `affected_sets` (the names of the sets gated on the flag),
+    # `affected_assignment_count` (this person's assignments to them),
+    # `dry_run`; a dry run's `revoked_sets` is 0 and its `invalidated` false.
     #
     # @example Dry run (inspect without revoking)
     #   result = ConsentWithdrawalHandler.call(
@@ -21,7 +32,8 @@ module PermissionForge
     #     consent_flag: 'marketing_consent',
     #     dry_run: true
     #   )
-    #   # => { revoked_sets: 0, affected_sets: ["Marketing Access"], dry_run: true }
+    #   # => { revoked_sets: 0, invalidated: false, affected_sets: ["Marketing Access"],
+    #   #      affected_assignment_count: 1, dry_run: true, cache: { confirmed: nil, work: false, ... } }
     #
     # The audit log: assignments are destroyed through their callbacks (one
     # `assignment.revoked` each), then ONE `consent.withdrawn` event names the
@@ -32,8 +44,10 @@ module PermissionForge
     # The revocations and `consent.withdrawn` happen in ONE transaction, like
     # DataSubjectErasure: if the summary cannot be written under
     # audit_change_failure_strategy :raise, no assignment is removed. The
-    # cache invalidation runs after the commit (so the summary does not say
-    # whether the store confirmed it; the result's `invalidated` does).
+    # cache invalidation runs after the commit, so the summary records the
+    # outcome as pending (`cache_confirmed: nil`, the store's scope in
+    # `process_local`); the result's `invalidated` and `cache` say what the
+    # store confirmed.
     #
     # Tenants: with a tenant ambient, the person's assignments in that
     # tenant. With none (a platform task) in every tenant — also under
@@ -46,6 +60,7 @@ module PermissionForge
     class ConsentWithdrawalHandler
       include Concerns::AuditedOperation
       include Concerns::AcrossTenants
+      include Concerns::SettlesCache
 
       # Removes a user from every Permission Set gated on the consent flag.
       # @return [Hash] see {#call}
@@ -59,27 +74,31 @@ module PermissionForge
         @reason = reason
       end
 
-      # @return [Hash] `{ revoked_sets:, invalidated: }` (plus `affected_sets:` and `dry_run:` for a dry run)
+      # @return [Hash] `{ revoked_sets:, invalidated:, affected_sets:, affected_assignment_count:, dry_run:, cache: }`
       def call
         validate!
 
         across_tenants do
           affected_sets = consent_gated_sets
           affected_assignments = user_assignments_for(affected_sets)
-          next dry_run_result(affected_sets, affected_assignments) if @dry_run
+          found = found(affected_sets, affected_assignments)
+          next found.merge(revoked_sets: 0, invalidated: false, cache: PermissionForge::Cache::Report.none.to_h) if @dry_run
 
-          audited(actor: @actor, reason: @reason) { withdraw(affected_assignments) }
+          audited(actor: @actor, reason: @reason) { withdraw(affected_assignments).merge(found) }
         end
       end
 
       private
 
       def withdraw(affected_assignments)
+        @report = PermissionForge::Cache::Report.new
         revoked_count = ActiveRecord::Base.transaction { revoke_and_record(affected_assignments) }
-        # what the store confirmed — not what a host's override of the method returns
-        invalidated = revoked_count.positive? && PermissionForge::Cache::Failure.none? { @user.invalidate_permissions }
+        # what the store confirmed — not what a host's override of the method returns;
+        # pending inside a caller's transaction (Report#deferred?)
+        outcome = @report.measure { @user.invalidate_permissions if revoked_count.positive? }.outcome
+        settle_cache('consent_withdrawal', @user, @report) { @user.invalidate_permissions } if revoked_count.positive?
 
-        { revoked_sets: revoked_count, invalidated: invalidated }
+        { revoked_sets: revoked_count, invalidated: revoked_count.positive? && outcome.confirmed, cache: outcome.to_h }
       end
 
       def revoke_and_record(affected_assignments)
@@ -97,6 +116,7 @@ module PermissionForge
         end
       end
 
+      # The cache outcome is pending here: the invalidation follows the commit.
       def summary_data(sets, revoked_count)
         {
           'operation' => 'consent_withdrawal',
@@ -105,7 +125,8 @@ module PermissionForge
           'set_uuids' => sets.map(&:uuid).uniq,
           'set_names' => sets.map(&:name).uniq,
           'revoked' => revoked_count,
-          'dry_run' => false
+          'dry_run' => false,
+          **@report.pending.event_data
         }
       end
 
@@ -122,13 +143,10 @@ module PermissionForge
         PermissionForge::PermissionSetUser.where(user: @user, permission_set: sets)
       end
 
-      def dry_run_result(sets, assignments)
-        {
-          revoked_sets: 0,
-          affected_sets: sets.pluck(:name),
-          affected_assignment_count: assignments.count,
-          dry_run: true
-        }
+      # What the run found before it removed anything: the same keys for a
+      # dry run and a real one.
+      def found(sets, assignments)
+        { affected_sets: sets.pluck(:name), affected_assignment_count: assignments.count, dry_run: @dry_run ? true : false }
       end
     end
   end

data/lib/permission_forge/services/data_subject_erasure.rb

@@ -1,3 +1,5 @@
+require_relative '../cache/report'
+
 module PermissionForge
   module Services
     # Supports a GDPR Art. 17 (right to erasure) request for a host user.
@@ -26,7 +28,9 @@ module PermissionForge
     #
     # @example Full erasure
     #   result = DataSubjectErasure.call(user: user)
-    #   # => { assignments_removed: 3, group_assignments_removed: 1, cache_cleared: true, callback_invoked: true }
+    #   # => { assignments_removed: 3, group_assignments_removed: 1, permission_sets: ["Sales"], groups: [],
+    #   #      actor_labels_cleared: 2, record_labels_cleared: 6, events_scrubbed: 8, cache_cleared: true,
+    #   #      callback_invoked: true, cache: { confirmed: true, process_local: false, unconfirmed: 0 }, ... }
     #
     # `cache_cleared` is false when the cache store did not confirm the
     # removal (it is unreachable, say): the assignments are gone, but the
@@ -37,9 +41,22 @@ module PermissionForge
     # transaction has committed, and a failure then is reported through
     # `config.on_cache_failure` alone.
     #
+    # `cache` is the one Cache::Outcome every cache-touching operation
+    # answers (Cache::Report): `confirmed` (as `cache_cleared`),
+    # `process_local`, `unconfirmed`. `cache_cleared` speaks for the store
+    # this process reaches. When that store lives in this process only (an
+    # in-memory store, Cache::Base#process_local? — `cache_backend = :memory`,
+    # or `Rails.cache` a `:memory_store`), a run from a rake task or a console
+    # cleared nothing in the web and job processes: they keep the person's
+    # cached permissions until they restart or the entries expire
+    # (cache_ttl). `erasure.performed` then says `process_local: true`; its
+    # `cache_confirmed` is nil, because the event is written in the
+    # erasure's transaction and the cache work follows it.
+    #
     # @example Dry run (inspect without removing)
     #   result = DataSubjectErasure.call(user: user, dry_run: true)
-    #   # => { assignments_count: 3, group_assignments_count: 1, permission_sets: [...], dry_run: true }
+    #   # => { assignments_count: 3, group_assignments_count: 1, permission_sets: [...],
+    #   #      actor_labels_to_clear: 2, record_labels_to_clear: 4, dry_run: true }
     #
     # The audit log (docs/audit-log.md): the rows are destroyed through their
     # callbacks, so each assignment writes its own `assignment.revoked`
@@ -77,6 +94,10 @@ module PermissionForge
     class DataSubjectErasure
       include Concerns::AuditedOperation
       include Concerns::AcrossTenants
+      include Concerns::SettlesCache
+
+      # The name labels erasure clears, by the count they are reported under.
+      LABELS = { actor_labels: :actor_label, record_labels: :record_label }.freeze
 
       # Erases a user's permission data (GDPR Art. 17).
       # @return [Hash] see {#call}
@@ -104,22 +125,31 @@ module PermissionForge
       private
 
       def erase
+        @report = PermissionForge::Cache::Report.new
         removed = ActiveRecord::Base.transaction { remove_and_record }
-        cache_cleared = clear_cache
+        outcome = clear_cache
+        settle_cache('erasure', @user, @report) { remove_user_cache }
 
-        removed.merge(cache_cleared: cache_cleared, callback_invoked: run_callback)
+        removed.merge(cache_cleared: outcome.confirmed, callback_invoked: run_callback, cache: outcome.to_h)
       end
 
       def remove_and_record
         sets = permission_set_assignments.includes(:permission_set).filter_map(&:permission_set)
         groups = group_assignments.includes(:permission_set_group).filter_map(&:permission_set_group)
 
-        counts = { assignments_removed: remove_permission_set_assignments,
-                   group_assignments_removed: remove_group_assignments }
+        counts = { assignments_removed: remove_all(permission_set_assignments),
+                   group_assignments_removed: remove_all(group_assignments) }
         counts.merge!(remaining_elsewhere)
         scrubbed = scrub_labels
         record_summary(sets, groups, counts, scrubbed)
-        counts
+        counts.merge(result_details(sets, groups, scrubbed))
+      end
+
+      # The names removed and the labels cleared, as the result reports them.
+      def result_details(sets, groups, scrubbed)
+        { permission_sets: sets.map(&:name).uniq, groups: groups.map(&:name).uniq,
+          actor_labels_cleared: scrubbed[:actor_labels], record_labels_cleared: scrubbed[:record_labels],
+          events_scrubbed: scrubbed.values.sum }
       end
 
       # What the person still has in other tenants (nothing is removed there).
@@ -149,14 +179,24 @@ module PermissionForge
       # basic auth login that shares the id is somebody else), and recorded
       # in `erasure.performed`.
       def scrub_labels
-        events = scrubbed_events
-        id = @user.id.to_s
         {
-          actor_labels: events.where(actor_type: 'user', actor_id: id).where.not(actor_label: nil).update_all(actor_label: nil),
-          record_labels: events.where(subject_user_id: id).where.not(record_label: nil).update_all(record_label: nil)
+          actor_labels: labelled(:actor_labels).update_all(actor_label: nil),
+          record_labels: labelled(:record_labels).update_all(record_label: nil)
         }
       end
 
+      # The events whose label names the person: as the actor (an actor of
+      # type 'user', in actor_label) or as the subject (in record_label).
+      def labelled(kind)
+        id = @user.id.to_s
+        events = if kind == :actor_labels
+                   scrubbed_events.where(actor_type: 'user', actor_id: id)
+                 else
+                   scrubbed_events.where(subject_user_id: id)
+                 end
+        events.where.not(LABELS.fetch(kind) => nil)
+      end
+
       # With a tenant current (a tenant admin), that tenant's events only: a
       # tenant cannot reach another tenant's log. With none (the rake task, a
       # platform operator), every tenant's, and the events without a tenant.
@@ -172,12 +212,15 @@ module PermissionForge
                                                            data: summary_data(sets, groups, counts, scrubbed))
       end
 
+      # The cache outcome is pending here: the invalidation follows this
+      # transaction (@report.pending: the store's scope, nothing confirmed).
       def summary_data(sets, groups, counts, scrubbed)
         cleared = { 'events_scrubbed' => scrubbed.values.sum, 'actor_labels_cleared' => scrubbed[:actor_labels],
                     'record_labels_cleared' => scrubbed[:record_labels] }
         names(sets, 'set').merge(names(groups, 'group'), counts.transform_keys(&:to_s), cleared,
                                  'operation' => 'erasure', 'subject_user_id' => @user.id.to_s,
-                                 'callback_invoked' => !@on_erasure.nil?, 'dry_run' => false)
+                                 'callback_invoked' => !@on_erasure.nil?, 'dry_run' => false,
+                                 **@report.pending.event_data)
       end
 
       def names(records, kind)
@@ -196,42 +239,41 @@ module PermissionForge
         PermissionForge::PermissionSetGroupUser.where(user: @user)
       end
 
-      def remove_permission_set_assignments
-        records = permission_set_assignments
-        count = records.count
-        records.destroy_all
-        count
-      end
-
-      def remove_group_assignments
-        records = group_assignments
+      # Destroys the rows through their callbacks (one audit event each).
+      #
+      # @return [Integer] how many there were
+      def remove_all(records)
         count = records.count
         records.destroy_all
         count
       end
 
-      # Asks the gem's own failure bookkeeping, not the value of
-      # invalidate_permissions: a host app overrides that method.
+      # Measured by Cache::Report (the gem's own failure bookkeeping), not
+      # the value of invalidate_permissions: a host app overrides that method.
       #
       # An invalidation leaves the per-context variants of a user with
       # conditional sets to their TTL (unreachable). They hold the profile,
       # so they are removed as well (Cache::VariantRemoval) — inside the
-      # caller's transaction once it has committed, after the assignments'
-      # own invalidations: until then another request may still cache one
-      # from the rows as they were.
+      # caller's transaction once it has committed (SettlesCache runs the
+      # work again there, measured, and records cache.settled), after the
+      # assignments' own invalidations: until then another request may still
+      # cache one from the rows as they were.
       #
-      # @return [Boolean, nil] whether the store confirmed the removal; nil
-      #   inside an open transaction, where that is only known at its commit
+      # @return [PermissionForge::Cache::Outcome] confirmed nil inside an
+      #   open transaction, where that is only known at its commit
       def clear_cache
-        transaction = PermissionForge::OpenTransaction.current
-        cleared = PermissionForge::Cache::Failure.none? do
+        @report.measure do
           invalidate_user
-          PermissionForge::Cache::VariantRemoval.call(**variant_removal) unless transaction
+          PermissionForge::Cache::VariantRemoval.call(**variant_removal) unless @report.deferred?
         end
-        return cleared unless transaction
+        @report.outcome
+      end
 
-        remove_variants_after_commit(transaction)
-        nil
+      # The person's cache work after a caller's commit: the invalidation and
+      # every per-context variant.
+      def remove_user_cache
+        invalidate_user
+        PermissionForge::Cache::VariantRemoval.call(**variant_removal)
       end
 
       # The arguments of the person's Cache::VariantRemoval: the keys the
@@ -243,17 +285,6 @@ module PermissionForge
         { user_ids: [@user.id], indexed_only: false, **named }
       end
 
-      # Nothing raises out of the commit: a failure is reported, like every
-      # after-commit invalidation (Cache::Failure).
-      def remove_variants_after_commit(transaction)
-        removal = variant_removal
-        transaction.after_commit do
-          PermissionForge::Cache::VariantRemoval.call(**removal)
-        rescue StandardError => e
-          PermissionForge::Cache::Failure.report(operation: :invalidate, user_id: removal[:user_ids].first, error: e)
-        end
-      end
-
       def invalidate_user
         # invalidate_permissions (not a raw cache delete) so the ambient and
         # tenant-agnostic keys are both removed AND the process-wide memo
@@ -293,11 +324,18 @@ module PermissionForge
         Rails.error.report(e, handled: true, source: 'permission_forge.data_subject_erasure')
       end
 
+      # The label counts (actor_labels_to_clear, record_labels_to_clear) are of
+      # the events there now — none on an app whose audit table is not there
+      # yet; the events the erasure itself writes (assignment.revoked, ...) are
+      # cleared as well.
       def dry_run_result
+        table = PermissionForge::DatabaseReach.table_exists?(PermissionForge::AuditEvent)
         {
           assignments_count: permission_set_assignments.count,
           group_assignments_count: group_assignments.count,
           permission_sets: permission_set_assignments.includes(:permission_set).filter_map { |psu| psu.permission_set&.name },
+          **LABELS.keys.to_h { |kind| [:"#{kind}_to_clear", table ? labelled(kind).count : 0] },
+          cache: PermissionForge::Cache::Report.none.to_h,
           dry_run: true
         }
       end