permission_forge 0.14.1 → 0.15.0

data/lib/permission_forge/services/permission_set_cloner.rb

@@ -22,9 +22,11 @@ module PermissionForge
         new(permission_set, attrs, unlock: unlock).call
       end
 
+      # Without a name the copy is named "<name> (copy)", numbered when taken
+      # (names are unique per tenant: PermissionSet.copy_name).
       def initialize(permission_set, attrs, unlock: false)
         @permission_set = permission_set
-        @attrs = attrs
+        @attrs = attrs.key?(:name) || attrs.key?('name') ? attrs : attrs.merge(name: PermissionForge::PermissionSet.copy_name(permission_set.name))
         @unlock = unlock
       end
 
@@ -42,29 +44,51 @@ module PermissionForge
 
       private
 
+      # The rows in the order the hash builder merges them
+      # (PermissionHashBuilder.sort_rows, the one definition of row order).
       def clone_resources(target_set)
-        @permission_set.resources.includes(:resource_fields, :resource_actions, :permission_set_rules).find_each do |resource|
-          clone_resource(target_set, resource)
-        end
+        @skipped = []
+        @permission_set.resources.includes(:resource_fields, :resource_actions, :permission_set_rules).load
+        PermissionForge::Services::PermissionHashBuilder.sort_rows(@permission_set)
+        @permission_set.resources.each { |resource| clone_resource(target_set, resource) }
+        log_skipped
       end
 
+      # A field or action row with a blank name (written before the names
+      # were checked) cannot be created again: the copy leaves it out —
+      # such a row names no column and no action — and the log says so,
+      # once per copy, instead of refusing the whole copy.
       def clone_resource(target_set, resource)
         cloned_resource = copy(resource, permission_set: target_set)
 
-        resource.resource_fields.each { |field| copy(field, resource: cloned_resource) }
+        copyable(resource.resource_fields).each { |field| copy(field, resource: cloned_resource) }
         clone_actions(resource, cloned_resource)
         resource.permission_set_rules.each { |rule| copy(rule, permission_set: target_set, resource: cloned_resource) }
       end
 
       # One copy per action name. Rows that share a name (possible only on a
-      # table without the unique index) are OR-ed when permissions are built,
-      # so the copy is the single row they amount to.
+      # table without the unique index) are OR-ed when permissions are built
+      # (PermissionHashBuilder#merge_resource_actions: the active rows'
+      # is_permitted, ||=), so the copy is the single row they amount to.
       def clone_actions(resource, cloned_resource)
-        resource.resource_actions.group_by(&:name).each_value do |rows|
+        copyable(resource.resource_actions).group_by(&:name).each_value do |rows|
           copy(rows.first, resource: cloned_resource, **combined_action_flags(rows))
         end
       end
 
+      def copyable(rows)
+        kept, skipped = rows.partition { |row| !refused_for_blank_name?(row) }
+        @skipped.concat(skipped)
+        kept
+      end
+
+      def log_skipped
+        return if @skipped.empty?
+
+        kinds = @skipped.map { |row| row.class.name.demodulize }.tally.map { |kind, count| "#{count} #{kind}" }.join(', ')
+        Rails.logger&.warn("[PermissionForge] copying #{@permission_set.name}: skipped #{@skipped.size} row(s) with a blank name (#{kinds})")
+      end
+
       def combined_action_flags(rows)
         return {} if rows.one?
 

data/lib/permission_forge/services/permission_set_condition_evaluator.rb

@@ -6,6 +6,12 @@ module PermissionForge
     # Returns true if the set is active for the given context (all conditions pass).
     # A nil/blank condition always passes (unconditional).
     #
+    # The conditions are read through PermissionForge::ActivationConditions
+    # (the one parser of the IP list and the hour window). A condition nobody
+    # can judge — an IP entry that is not an address, a list of separators,
+    # one hour of the two, the same hour twice, an hour outside 0..23 — never
+    # passes (.broken?); ConditionalSets applies a muting set with one.
+    #
     # @example
     #   PermissionSetConditionEvaluator.call(
     #     permission_set: ps,
@@ -22,22 +28,35 @@ module PermissionForge
         new(permission_set, context).call
       end
 
-      # Whether a condition of the set cannot be judged in `context`: it
+      # Whether a condition of the set cannot be judged in `context`: the
+      # set holds a broken condition (.broken?, whatever the context), it
       # restricts the IP and the context has none, or it requires a session
       # flag and the context says nothing about flags (no :session_flags at
       # all — an empty list is an answer). The hours are always judged (the
-      # time defaults to now). Under config.conditional_sets_strict_mode a
-      # conditional muting set applies then (ConditionalSets#passing).
+      # time defaults to now). A conditional muting set applies then under
+      # config.conditional_sets_strict_mode — and with a broken condition in
+      # every mode (ConditionalSets::Member#applies?).
       #
       # @return [Boolean]
       def self.unjudgeable?(permission_set:, context:)
         context ||= {}
-        (permission_set.allowed_ips.present? && context[:ip].blank?) ||
+        broken?(permission_set: permission_set) ||
+          (permission_set.allowed_ips.present? && context[:ip].blank?) ||
           (permission_set.requires_session_flag.present? && context[:session_flags].nil?)
       end
 
+      # Whether the set holds a condition nobody can judge
+      # (ActivationConditions#conditions_broken?): such a set never passes.
+      #
+      # @param permission_set [PermissionSet, #allowed_ips]
+      # @return [Boolean]
+      def self.broken?(permission_set:)
+        PermissionForge::ActivationConditions.of(permission_set).conditions_broken?
+      end
+
       def initialize(permission_set, context)
         @permission_set = permission_set
+        @conditions = PermissionForge::ActivationConditions.of(permission_set)
         @context = context || {}
       end
 
@@ -57,45 +76,28 @@ module PermissionForge
       end
 
       # IP restriction: set only active when request IP matches allowed CIDRs.
-      # The IP may be a String or an IPAddr; anything that is not an address
-      # fails the condition.
+      # The IP may be a String or an IPAddr (ActivationConditions.request_address:
+      # an IPv4-mapped IPv6 address is read as its IPv4 address); anything
+      # that is not an address fails the condition, as does a list that
+      # cannot be judged.
       def ip_passes?
-        allowed = @permission_set.allowed_ips
-        return true if allowed.blank?
+        return true if @permission_set.allowed_ips.blank?
+        return false if @conditions.ip_list_broken?
 
-        request_ip = @context[:ip]
-        return false if request_ip.blank?
+        address = PermissionForge::ActivationConditions.request_address(@context[:ip])
+        return false unless address
 
-        address = request_ip.is_a?(IPAddr) ? request_ip : IPAddr.new(request_ip.to_s)
-        parse_ip_ranges(allowed).any? { |range| range.include?(address) }
-      rescue IPAddr::Error
-        false
+        @conditions.allowed_ip_ranges.any? { |range| range.include?(address) }
       end
 
-      # Login hours: set only active during allowed hour window.
+      # Login hours: set only active during the allowed hour window; a
+      # broken window (one hour, the same hour twice, out of range) includes
+      # no hour.
       def hours_pass?
-        start_hour = @permission_set.allowed_hours_start
-        end_hour = @permission_set.allowed_hours_end
-        return true if start_hour.nil? || end_hour.nil?
-
-        hour_in_range?((@context[:time] || Time.current).hour, start_hour, end_hour)
-      end
-
-      def hour_in_range?(hour, start_hour, end_hour)
-        if start_hour <= end_hour
-          hour >= start_hour && hour < end_hour
-        else
-          # Wraps midnight (e.g., 22-06 means 22:00 to 05:59)
-          hour >= start_hour || hour < end_hour
-        end
-      end
+        window = @conditions.hours_window
+        return true unless window.set?
 
-      def parse_ip_ranges(allowed_ips)
-        allowed_ips.split(',').filter_map do |cidr|
-          IPAddr.new(cidr.strip)
-        rescue IPAddr::Error
-          nil
-        end
+        window.include?((@context[:time] || Time.current).hour)
       end
     end
   end

data/lib/permission_forge/services/permission_set_group_cloner.rb

@@ -37,7 +37,8 @@ module PermissionForge
 
       def clone_permission_sets(cloned_group)
         @group.permission_sets.each do |ps|
-          attrs = { name: ps.name, permission_set_group: cloned_group }
+          # Names are unique per tenant: each copy is "<name> (copy)", numbered when taken.
+          attrs = { name: PermissionForge::PermissionSet.copy_name(ps.name), permission_set_group: cloned_group }
           attrs[:is_editable] = true if @unlock
           PermissionSetCloner.call(permission_set: ps, attrs: attrs, unlock: @unlock)
         end

data/lib/permission_forge/services/permits_attributes/result.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Services
+    class PermitsAttributes
+      # What `PermitsAttributes.call(..., report: true)` answers: the filtered
+      # params and what was dropped from them.
+      #
+      # @!attribute [r] params
+      #   @return [Hash] the filtered params, as `call` without `report:` returns them
+      # @!attribute [r] dropped
+      #   @return [Array<String>] the paths of the dropped keys, in order, without
+      #     repeats: `status`, `supplier_attributes.secret`,
+      #     `lines_attributes.*.price`, `lines_attributes.*` (an element that is
+      #     no record, or one whose id the user may not reach); never values
+      #
+      # @api public
+      Result = Data.define(:params, :dropped) do
+        # @return [Boolean] whether any key was dropped
+        def dropped? = dropped.any?
+
+        # The top-level keys behind the dropped paths (`lines_attributes`
+        # for `lines_attributes.*.price`), for a message such as
+        # "Not saved: status, notes".
+        #
+        # @return [Array<String>]
+        def dropped_fields = dropped.map { |path| path.split('.', 2).first }.uniq
+      end
+    end
+  end
+end

data/lib/permission_forge/services/permits_attributes.rb

@@ -31,8 +31,16 @@ module PermissionForge
     # `lines_attributes.*` for an element that is no record — never their
     # values. Without a user every key is dropped (reason nil_user).
     #
+    # With `report: true` the call answers a {Result} instead: the same
+    # filtered hash plus the paths of the dropped keys, so a controller can
+    # tell the user what was not saved (the default return is unchanged).
+    #
     # @example
     #   filtered = PermitsAttributes.call(resource: customer, permitted_params: params)
+    # @example Telling the user what was not saved
+    #   result = PermitsAttributes.call(resource: customer, permitted_params: params, report: true)
+    #   customer.update(result.params)
+    #   flash[:alert] = "Not saved: #{result.dropped_fields.join(', ')}" if result.dropped?
     #
     # @api public
     class PermitsAttributes
@@ -46,49 +54,61 @@ module PermissionForge
       DESTROY_KEY = '_destroy'.freeze
 
       # Filters incoming params by the user's field-level edit access (does not mutate them).
-      # @param resource [String] the model name
+      # @param resource [ActiveRecord::Base, Class] the record or model class whose Resource rows decide
       # @param permitted_params [Hash]
-      # @return [Hash]
-      def self.call(resource:, permitted_params:)
-        new(resource: resource, permitted_params: permitted_params).call
+      # @param report [Boolean] answer a {Result} (filtered params and dropped paths)
+      # @return [Hash, Result] the filtered hash; a {Result} with `report: true`
+      def self.call(resource:, permitted_params:, report: false)
+        new(resource: resource, permitted_params: permitted_params, report: report).call
       end
 
-      def initialize(resource:, permitted_params:)
+      def initialize(resource:, permitted_params:, report: false)
         @user = PermissionForge.current_user
         @resource = resource
         @permitted_params = permitted_params
+        @report = report
       end
 
-      # @return [Hash] a new hash holding only the fields the user may edit
+      # @return [Hash, Result] a new hash holding only the fields the user may
+      #   edit; with `report: true`, a {Result} holding it and the dropped paths
       def call
-        if @user.blank?
-          report_dropped('nil_user') { each_pair(@permitted_params) { |key, _| dropped(key) } } if nil_user_report?
-          return {}
-        end
-        return {} if resource_class.nil?
+        filtered = filter
+        @report ? Result.new(params: filtered, dropped: (@dropped || []).uniq) : filtered
+      end
+
+      private
+
+      def filter
+        return drop_everything if resource_class.nil? || @user.blank?
         return {} if @permitted_params.blank?
 
         report_dropped('field_access') { filter_for(resource_class, @permitted_params) }
       end
 
-      private
+      # Every key is dropped: nobody is signed in (published as nil_user), or
+      # there is no model to filter for (reported only: params.filtered
+      # names the model).
+      def drop_everything
+        if @permitted_params.present? && (@report || PermissionForge::Audit.instrument?(EVENT))
+          report_dropped('nil_user') { @permitted_params.each_pair { |key, _| dropped(key) } }
+        end
+        {}
+      end
 
       # Runs the filter, collecting the dropped paths in @dropped only when
-      # params.filtered is stored or heard, and publishes them.
+      # the caller asked for a report or params.filtered is stored or heard,
+      # and publishes them to the latter.
       def report_dropped(reason)
-        return yield unless PermissionForge::Audit.instrument?(EVENT)
+        instrumented = !resource_class.nil? && PermissionForge::Audit.instrument?(EVENT)
+        return yield unless instrumented || @report
 
         @dropped = []
         @path = []
         result = yield
-        publish_dropped(reason) unless @dropped.empty?
+        publish_dropped(reason) if instrumented && !@dropped.empty?
         result
       end
 
-      def nil_user_report?
-        !resource_class.nil? && @permitted_params.present? && PermissionForge::Audit.instrument?(EVENT)
-      end
-
       def publish_dropped(reason)
         dropped = @dropped.uniq
         record = @resource.is_a?(Class) ? nil : @resource
@@ -130,7 +150,7 @@ module PermissionForge
         fields = editable_fields_for(klass)
         result = {}
 
-        each_pair(params) do |key, value|
+        params.each_pair do |key, value|
           if (association = nested_association(klass, key))
             filtered = within(key) { filter_nested(klass, association, value) }
             filtered.nil? ? dropped(key) : result[key] = filtered
@@ -230,7 +250,7 @@ module PermissionForge
 
       def filter_indexed(target, records)
         result = {}
-        each_pair(records) do |index, record|
+        records.each_pair do |index, record|
           filtered = within(EACH) { filter_record(target, record) }
           filtered.nil? ? dropped(EACH) : result[index] = filtered
         end
@@ -251,15 +271,16 @@ module PermissionForge
         @user.respond_to?(:permissions_hash) && PermissionForge::ResourceChain.entries(@user, resource_names(klass)).any?
       end
 
+      # A key is editable where the field is readable AND editable: the hash
+      # the builder writes says so already (FieldPermissionMerger counts edit
+      # only with read), but a hash another version cached may still say
+      # `edit_access: true, read_access: false` — a field nobody may read is
+      # not one they may write.
       def editable_fields_for(klass)
         return {} unless @user.respond_to?(:permissions_hash)
 
-        PermissionForge::ResourceChain.fields(@user, resource_names(klass)).select { |_, access| access[:edit_access] }
-      end
-
-      # Iterates key/value pairs of an ActionController::Parameters or a Hash.
-      def each_pair(params, &)
-        params.each_pair(&)
+        PermissionForge::ResourceChain.fields(@user, resource_names(klass))
+                                      .select { |_, access| access[:read_access] && access[:edit_access] }
       end
 
       def each_pair?(value)

data/lib/permission_forge/services/resource_field_generator/row_builder.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Services
+    class ResourceFieldGenerator
+      # The one definition of a generated field row: the attributes a
+      # ResourceField gets when a path creates rows for a model's columns at
+      # a level — ResourceFieldGenerator (the API's generate_fields,
+      # Resource.grant_full_access!, the console), the admin's presets and
+      # "Sync fields" (Admin::ColumnFields) and the Fields tab's bulk add
+      # (Admin::ChangeSetParts::NewFields). Three paths, one row
+      # (release_readiness/decision_parity_test.rb, part a):
+      #
+      # - the flags of the level (PermissionForge::FieldLevel), with the
+      #   privacy default: under gdpr_defaults, on a granting set, a column
+      #   that looks like personal data (PermissionForge::SensitiveColumns)
+      #   created Read-only starts Masked. Editable is full access and masks
+      #   nothing; Hidden stays Hidden (a privacy default never grants). A
+      #   Muting Permission Set gets the level chosen: there a row takes
+      #   access away, and the privacy default has nothing to add;
+      # - then Editable is Read-only on a Resource without Edit
+      #   (FieldLevel.capped): chosen Editable, a personal-data field is
+      #   Read-only there, not Masked;
+      # - Rails' timestamps at most Read-only on a granting set
+      #   (PermissionForge::TimestampFields);
+      # - the recommended mask strategy of a sensitive column, whether or not
+      #   the row is masked now, so masking it later uses the right one;
+      #   'full' otherwise;
+      # - the label (the name itself: never English made up from it — the
+      #   admin shows the host's translation, or the name), active, editable.
+      #
+      # A blank name (a host whose extra_fields_method lists one) is no row,
+      # nor is a level that is none (FieldLevel.row?: Unchanged on a Muting
+      # Permission Set mutes nothing, so no path writes a row for it).
+      #
+      # @api private
+      class RowBuilder
+        # Granting levels the privacy default turns into Masked for a column
+        # that looks like personal data.
+        MASKED_BY_PRIVACY_DEFAULTS = %w[read].freeze
+
+        # @param resource [Resource] the rows' Resource (its name resolves the model)
+        # @param muting [Boolean, nil] the rows are a Muting Permission Set's
+        #   (default: the Resource's set says)
+        # @param configuration [Configuration]
+        # @param sensitive [SensitiveColumns] the matcher (default: one on `configuration`)
+        def initialize(resource, muting: nil, configuration: PermissionForge.configuration, sensitive: nil)
+          @resource = resource
+          @muting = muting.nil? ? (resource.permission_set&.is_muting || false) : muting
+          @configuration = configuration
+          @sensitive = sensitive || PermissionForge::SensitiveColumns.new(configuration: configuration)
+        end
+
+        # @return [Boolean] the rows are a Muting Permission Set's
+        def muting? = @muting
+
+        # @param column [String, Symbol] the field name (a column or a virtual field)
+        # @param level [String] a FieldLevel of the set's kind
+        # @return [Hash, nil] the row's attributes (without the Resource), or
+        #   nil for a blank name or a level that is no row
+        # @raise [ArgumentError] a level the set's kind does not have
+        def attrs(column, level)
+          name = column.to_s
+          return if name.strip.empty?
+          return unless row_level?(level)
+
+          match = @sensitive.match(name)
+          level = PermissionForge::FieldLevel.capped(effective_level(level, match), resource_edit: @resource.edit_access, muting: @muting)
+          flags = PermissionForge::FieldLevel.flags_for(level, muting: @muting)
+          { name: name, label: name, is_active: true, is_editable: true, mask_strategy: match&.strategy || 'full' }
+            .merge(flags)
+            .merge(timestamps.overrides(name, read: flags[:read_access]))
+        end
+
+        private
+
+        def row_level?(level)
+          PermissionForge::FieldLevel.flags_for(level, muting: @muting) # raises for a level the kind lacks
+          PermissionForge::FieldLevel.row?(level, muting: @muting)
+        end
+
+        # The level after the privacy default.
+        def effective_level(level, match)
+          level = level.to_s
+          return level if @muting || match.nil? || !@configuration.gdpr_defaults
+
+          MASKED_BY_PRIVACY_DEFAULTS.include?(level) ? 'masked' : level
+        end
+
+        def timestamps
+          @timestamps ||= PermissionForge::TimestampFields.new(PermissionForge::ModelLookup.model_for(@resource.name), muting: @muting)
+        end
+      end
+    end
+  end
+end

data/lib/permission_forge/services/resource_field_generator.rb

@@ -1,17 +1,56 @@
+require_relative 'resource_field_generator/row_builder'
+
 module PermissionForge
   module Services
-    # Creates a ResourceField for every column of a resource's model (and declared virtual fields
-    # under `extra_fields_default_access = :unconfigured`).
+    # Creates a ResourceField for every field of a resource's model that has none: its columns and its
+    # virtual fields (PermissionForge::ManagedFields, the names the admin's presets and Sync write rows for).
     #
     # @api public
     class ResourceFieldGenerator
+      # Every generated row is built by {RowBuilder}, the one definition the
+      # admin's presets, "Sync fields" and the Fields tab's bulk add share.
+      # With `grant_all` the caller asked for full access (Editable): every
+      # field readable and editable, unmasked — also the columns that look
+      # like personal data, which keep the recommended mask strategy for
+      # when someone masks them and are still reported as personal data
+      # (GdprFieldAuditor, the admin's privacy audit). Without it every
+      # field is Hidden; under `gdpr_defaults` the privacy default masks what
+      # is granted Read, and nothing is granted here. On a Muting Permission
+      # Set `grant_all` takes everything away (Hide); without it nothing is
+      # written — Unchanged is no row (FieldLevel.row?), as in the admin.
+      # On a Resource without Edit, Editable rows are Read-only
+      # (FieldLevel.capped). Rails' timestamps
+      # (created_at / updated_at) are at most read-only on a granting set
+      # (PermissionForge::TimestampFields).
+      #
       # @param resource [Resource]
-      # @param grant_all [Boolean] grant read and edit on the generated fields
+      # @param grant_all [Boolean] grant read and edit, unmasked, on the generated fields
       # @return [Array<ResourceField>] the fields created
       def self.call(resource:, grant_all: false)
         new(resource: resource, grant_all: grant_all).call
       end
 
+      # The attributes of one generated row — the one definition every path
+      # that creates rows for a model's columns uses ({RowBuilder#attrs}).
+      #
+      # @param resource [Resource] its Permission Set says whether the row is a muting one
+      # @param column [String, Symbol] a column or virtual field name
+      # @param level [String] a FieldLevel of the set's kind
+      # @return [Hash, nil] the row's attributes, nil for a blank name
+      def self.build(resource:, column:, level:)
+        rows(resource).attrs(column, level)
+      end
+
+      # A builder for several rows of one Resource (the model and the matcher
+      # are resolved once). Keywords as {RowBuilder#initialize}: `muting:`
+      # (default: the Resource's set says), `configuration:`, `sensitive:`.
+      #
+      # @param resource [Resource]
+      # @return [RowBuilder]
+      def self.rows(resource, **)
+        RowBuilder.new(resource, **)
+      end
+
       def initialize(resource:, grant_all: false)
         @resource = resource
         @grant_all = grant_all
@@ -19,9 +58,14 @@ module PermissionForge
 
       # All or nothing, under one audit correlation id (an enclosing block's,
       # if any): a field that cannot be saved leaves no field and no event.
+      # A Resource named after no model this app can load
+      # (PermissionForge::ModelLookup: `Custmer`, `Kernel`, a model without
+      # its table) has no columns: no fields, a log line — never an error
+      # (the API answers 422 before it gets here; `rake permission_forge:audit`
+      # lists the Resource under unknown_models).
       def call
-        model_class = @resource.name.safe_constantize
-        return [] unless model_class
+        model_class = PermissionForge::ModelLookup.model_for(@resource.name)
+        return no_model unless model_class
 
         fields = PermissionForge::Audit.correlate { PermissionForge::ResourceField.transaction { generate_fields(model_class) } }
         PermissionForge.configuration.record_gdpr_pattern_checksum
@@ -42,51 +86,36 @@ module PermissionForge
 
       private
 
+      def no_model
+        Rails.logger&.warn("[PermissionForge] #{@resource.name} names no model this app can load: no fields generated")
+        []
+      end
+
       def generate_fields(model_class)
         existing_names = @resource.resource_fields.pluck(:name)
-        columns = model_class.column_names - ignored_fields + virtual_field_names(model_class) - existing_names
+        names = PermissionForge::ManagedFields.new(model_class).names
+        columns = self.class.without_blank_names(model_class, names) - existing_names
 
-        columns.map do |column_name|
-          attrs = build_field_attrs(column_name)
-          apply_gdpr_defaults(attrs, column_name) if PermissionForge.configuration.gdpr_defaults
-          PermissionForge::ResourceField.create!(attrs)
+        rows = RowBuilder.new(@resource, muting: muting?)
+        columns.filter_map do |column_name|
+          attrs = rows.attrs(column_name, level)
+          PermissionForge::ResourceField.create!(attrs.merge(resource: @resource)) if attrs
         end
       end
 
-      def build_field_attrs(column_name)
-        {
-          resource: @resource,
-          name: column_name,
-          label: column_name.humanize,
-          is_active: true,
-          is_editable: true,
-          read_access: @grant_all,
-          edit_access: @grant_all
-        }
+      def muting?
+        @resource.permission_set&.is_muting || false
       end
 
-      def ignored_fields
-        PermissionForge.configuration.ignored_fields
-      end
-
-      # Virtual fields get rows only under extra_fields_default_access =
-      # :unconfigured. Under :grant ExtraFieldDefaults already gives declared
-      # names read + edit, and a generated row (no access unless grant_all)
-      # would take that away from callers that rely on it.
-      def virtual_field_names(model_class)
-        configuration = PermissionForge.configuration
-        return [] if configuration.grant_extra_fields_by_default?
-
-        self.class.without_blank_names(model_class, PermissionForge::VirtualFields.new(model_class, configuration).names)
-      end
-
-      def apply_gdpr_defaults(attrs, column_name)
-        _pattern, strategy = PermissionForge.configuration.gdpr_field_patterns.find { |regex, _| column_name.match?(regex) }
-        return unless strategy
-
-        attrs[:read_access] = true
-        attrs[:mask_access] = true
-        attrs[:mask_strategy] = strategy
+      # The level generated rows get: full access or none; on a Muting
+      # Permission Set the level that takes everything away, or Unchanged,
+      # which the row builder writes no row for.
+      def level
+        if muting?
+          @grant_all ? 'hide' : 'leave'
+        else
+          @grant_all ? 'edit' : 'hidden'
+        end
       end
     end
   end

data/lib/permission_forge/services/resource_with_fields_builder.rb

@@ -1,6 +1,7 @@
 module PermissionForge
   module Services
-    # Creates a Resource with full CRUD access and its generated fields, all or nothing.
+    # Creates a Resource with full CRUD access and its generated fields (read and
+    # edit, unmasked: ResourceFieldGenerator with grant_all), all or nothing.
     #
     # @api public
     class ResourceWithFieldsBuilder