permission_forge 0.14.1 → 0.15.0

data/lib/permission_forge/services/rls_operator_sql.rb

@@ -20,6 +20,23 @@ module PermissionForge
     module RlsOperatorSql
       # `current_user` in a policy: the SQL the session user's id is read with.
       SessionUser = Struct.new(:sql)
+      # A value the policy computes when it runs (a relative date): its SQL.
+      Dynamic = Struct.new(:sql)
+
+      # PostgreSQL's relative date and time words, as the expression each
+      # stands for when a statement runs. Quoted into a policy, PostgreSQL
+      # resolves the word once, when it parses CREATE POLICY: the policy kept
+      # the sync's date while the app layer, which sends the word with every
+      # query, reads it anew. So the policy computes it per statement instead.
+      RELATIVE_VALUES = {
+        'now' => 'now()', 'today' => 'CURRENT_DATE', 'tomorrow' => '(CURRENT_DATE + 1)', 'yesterday' => '(CURRENT_DATE - 1)'
+      }.freeze
+      # A relative word anywhere in the text (`today 10:00`, `tomorrow UTC`):
+      # no exact per-statement form is built for those — the rule is FALSE in
+      # the policy (narrower than the app layer).
+      RELATIVE_WORD = /\b(?:#{RELATIVE_VALUES.keys.join('|')})\b/i
+      # The column types PostgreSQL reads those words for.
+      TEMPORAL_TYPES = %i[date time datetime timestamp timestamptz].freeze
 
       UNUSABLE = Operators::ValueTyping::UNUSABLE
 
@@ -44,48 +61,51 @@ module PermissionForge
       }.freeze
 
       # The operators whose app-layer strategy adds the NULL rows under
-      # include_nulls. The others ignore the flag, and so does the policy.
-      NULL_INCLUDING = [
-        Operators::Constants::EQUAL, Operators::Constants::NOT_EQUAL,
-        Operators::Constants::IN, Operators::Constants::NOT_IN
-      ].freeze
-
-      # The column types PostgreSQL has ILIKE for. On a column of any other
-      # type the app layer's LIKE query raises, so the rule compiles to FALSE.
-      LIKE_TYPES = %i[string text citext].freeze
+      # include_nulls (Operators::Registry::NULL_INCLUDING, the one list). The
+      # others ignore the flag, and so does the policy.
+      NULL_INCLUDING = Operators::Registry::NULL_INCLUDING
 
       # How the session user's id is read for a comparison, by the caster the
       # column's type has in the app layer: the id itself where the column is
-      # a number or of a type nothing is known about, its text on a string
-      # column. A column of any other type (a boolean, a date) cannot equal an
-      # id — the rule is UNUSABLE there, as it is in the app layer.
+      # a number (or a uuid) the id is one of, or of a type nothing is known
+      # about, its text on a string column. A column of any other type (a
+      # boolean, a date, an address, a json or array column, a native enum)
+      # cannot equal an id — the rule is UNUSABLE there, as it is in the app
+      # layer.
+      # The database a policy is written for.
+      POLICY_ADAPTER = 'PostgreSQL'
+
       SESSION_USER_SQL = {
         Operators::ValueCasters::UNTYPED => :uid_sql,
         Operators::ValueCasters::NUMBER => :numeric_uid_sql,
         Operators::ValueCasters::Number::SINGLE_PRECISION => :numeric_uid_sql,
+        Operators::ValueCasters::PostgresqlTypes::UUID => :uuid_uid_sql,
         Operators::ValueCasters::TEXT => :uid_text_sql
       }.freeze
 
-      # A rule's value as the app layer compares it with the column.
+      # A rule's value as the app layer compares it with the column. A column
+      # that holds ciphertext (ValueTyping.encrypted?) takes no value, the
+      # user's id included.
       #
       # @param target [Operators::RuleColumn] the column the rule names
       # @return [Object] a typed literal, an Array of them, a SessionUser, or UNUSABLE
       def typed_value(operator, value, target)
-        return UNUSABLE if target.malformed? || unmatchable?(operator, target.column)
+        return UNUSABLE if Operators::ValueTyping.no_column?(operator, target) || unmatchable?(operator, target) ||
+                           Operators::ValueTyping.encrypted?(operator, target)
         return session_user(operator, target) if Operators::ValueTyping.current_user?(operator, value)
 
-        Operators::ValueTyping.call(operator, value, target)
+        relative(Operators::ValueTyping.call(operator, value, target), temporal_sql_type(target.column))
       end
 
       def value_sql(value)
         case value
-        when SessionUser then value.sql
+        when SessionUser, Dynamic then value.sql
         else connection.quote(value)
         end
       end
 
       def list_sql(values, separator = ', ')
-        values.map { |value| connection.quote(value) }.join(separator)
+        values.map { |value| value_sql(value) }.join(separator)
       end
 
       def like_sql(col, value, prefix:, suffix:)
@@ -99,12 +119,39 @@ module PermissionForge
 
       private
 
-      # A LIKE operator on a column PostgreSQL cannot match a pattern with. (A
-      # column the model does not have fails the sync, as it fails the query.)
-      def unmatchable?(operator, column)
-        return false unless column && Operators::ValueTyping::SHAPES[operator] == :pattern
+      # A typed value (or each of a list's) with PostgreSQL's relative words
+      # (RELATIVE_VALUES) as the expression PostgreSQL computes per statement,
+      # cast to the column's type; text with such a word that is not the
+      # word alone is UNUSABLE (FALSE). Only on a date or time column: on
+      # any other a word is text, or was refused by the read back.
+      def relative(value, sql_type)
+        return value unless sql_type
+        return relative_one(value, sql_type) unless value.is_a?(Array)
+
+        typed = value.map { |element| relative_one(element, sql_type) }
+        typed.any? { |element| element.equal?(UNUSABLE) } ? UNUSABLE : typed
+      end
+
+      # The column's SQL type when it is a date or time column, else nil.
+      def temporal_sql_type(column)
+        column.sql_type if column && TEMPORAL_TYPES.include?(column.type)
+      end
+
+      def relative_one(value, sql_type)
+        return value unless value.is_a?(String) && value.match?(RELATIVE_WORD)
 
-        column.try(:array?) || LIKE_TYPES.exclude?(column.type)
+        expression = RELATIVE_VALUES[value.strip.downcase]
+        expression ? Dynamic.new("CAST(#{expression} AS #{sql_type})") : UNUSABLE
+      end
+
+      # A LIKE operator on a column PostgreSQL cannot match a pattern with
+      # (ValueCasters.pattern? for PostgreSQL, the database every policy is
+      # for — as the app layer decides on PostgreSQL). A column the model
+      # does not have is UNUSABLE, as in the app layer.
+      def unmatchable?(operator, target)
+        return false unless target.column && Operators::ValueTyping::SHAPES[operator] == :pattern
+
+        !Operators::ValueCasters.pattern?(target.caster, POLICY_ADAPTER)
       end
 
       # A comparison takes the id as the column's type lets it. A LIKE pattern
@@ -123,8 +170,20 @@ module PermissionForge
 
       # An id that is not a number (a uuid) is never the value of a number column.
       def numeric_uid_sql
-        column = PermissionForge::PermissionSetUser.columns_hash['user_id']
-        uid_sql if column.nil? || Operators::ValueCasters.for(column).equal?(Operators::ValueCasters::NUMBER)
+        uid_sql if user_id_caster.nil? || user_id_caster.equal?(Operators::ValueCasters::NUMBER)
+      end
+
+      # A uuid column equals the id only where user ids are uuids: compared
+      # with the text of any other id, PostgreSQL raises (or the app layer,
+      # with an id that is no uuid, matches nothing). A user_id column of
+      # text that holds uuids is narrower here than in the app layer: FALSE.
+      def uuid_uid_sql
+        uid_sql if user_id_caster.equal?(Operators::ValueCasters::PostgresqlTypes::UUID)
+      end
+
+      def user_id_caster
+        column = PermissionForge::SchemaRead.column(PermissionForge::PermissionSetUser, 'user_id')
+        column && Operators::ValueCasters.for(column)
       end
     end
   end

data/lib/permission_forge/services/rls_policy_generator.rb

@@ -32,14 +32,19 @@ module PermissionForge
     #     resource row's is_active; the membership EXISTS reads both states
     #     per statement, so switching a set or a resource off or on needs no
     #     re-sync and the policy is never wider than the app layer in between.
-    #   - A user in no rule-bearing set sees all rows (rules only restrict).
+    #   - A user in no rule-bearing set sees all rows (rules only restrict),
+    #     under no_read_access_strategy :rules_only (the default). Under :deny
+    #     a signed-in user sees a row only with read access to the model's
+    #     Resource chain, as RecordReadAccess decides it (RlsReadAccessSql,
+    #     read per statement); the strategy is part of the digest.
     #   - Muting sets contribute no rules; conditional sets' rules are included
     #     (more restrictive than the app, never less — documented).
     #   - Missing session variable follows nil_user_strategy: :bypass allows,
     #     :deny/:raise hides every row.
     #   - A rule's value is typed for its column by the app layer's own
-    #     Operators::ValueTyping; a value the column cannot hold compiles to
-    #     FALSE, as the app layer matches nothing for it (see RlsOperatorSql).
+    #     Operators::ValueTyping; a value the column cannot hold, or a column
+    #     the table does not have, compiles to FALSE, as the app layer matches
+    #     nothing for it (see RlsOperatorSql).
     #   - Join-type rules and dotted field names are NOT translatable — they are
     #     reported in :skipped_rules, never silently dropped. So are the rules
     #     of a Resource named after an STI subclass of the model: a policy is
@@ -70,9 +75,22 @@ module PermissionForge
       # 5: a rule set's membership EXISTS joins its resource row and needs it
       # active; the rules are compiled whatever the row's — or the set's —
       # state (the set's is_active was already read live).
-      GENERATOR_VERSION = 5
+      # 6: a rule naming a column the table does not have compiles to FALSE
+      # (the sync failed on it), as the app layer matches nothing for it.
+      # 7: every Operators::RuleProblem kind compiles to FALSE (an unknown
+      # operator, join type or table, a path no join is built through); a
+      # value is typed for a uuid, inet, cidr, json/jsonb, array or native
+      # enum column (one it cannot hold is FALSE); an assignment counts until
+      # its expires_at, that instant included (`>= now()`); and only a set
+      # without an activation condition as PermissionSet.unconditional reads
+      # it (a text of blanks is none, one hour of the two is one) grants the
+      # view_all bypass. Under no_read_access_strategy :deny, a session user
+      # without read access to the model's Resource chain sees no row
+      # (RlsReadAccessSql; the strategy is part of the digest).
+      GENERATOR_VERSION = 7
 
       include RlsOperatorSql
+      include RlsReadAccessSql
 
       def self.call(model_class:, configuration: PermissionForge.configuration)
         new(model_class: model_class, configuration: configuration).call
@@ -81,7 +99,10 @@ module PermissionForge
       def initialize(model_class:, configuration: PermissionForge.configuration)
         @model_class = model_class
         @configuration = configuration
-        @conn = model_class.connection
+        # The pool's lease, never the model's `connection` (it raises under
+        # Rails 7.2+ `permanent_connection_checkout = :disallowed`).
+        pool = model_class.connection_pool
+        @conn = pool.respond_to?(:lease_connection) ? pool.lease_connection : pool.connection
         @skipped_rules = []
       end
 
@@ -105,8 +126,8 @@ module PermissionForge
       def digest
         parts = [
           GENERATOR_VERSION,
-          @configuration.nil_user_strategy,
-          @configuration.rls_session_variable,
+          *strategy_fingerprint,
+          read_access_sql,
           table_name,
           tenant_predicate_sql,
           rule_sets.map { |set| [set[:id], set[:resource_id], set[:rules].map { |r| rule_fingerprint(r) }.sort] }.sort
@@ -116,6 +137,11 @@ module PermissionForge
 
       private
 
+      # The settings the policy is generated from.
+      def strategy_fingerprint
+        [@configuration.nil_user_strategy, @configuration.no_read_access_strategy, @configuration.rls_session_variable]
+      end
+
       # Adapter connection used for quoting by RlsOperatorSql helpers too.
       def connection
         @conn
@@ -150,11 +176,17 @@ module PermissionForge
 
       # :bypass  -> uid IS NULL OR (view_all OR rules)
       # :deny/:raise -> uid IS NOT NULL AND (view_all OR rules)
+      # Under no_read_access_strategy :deny the signed-in branch is
+      # (read_access AND (view_all OR rules)) — RlsReadAccessSql, checked
+      # before the rules as RecordReadAccess is: View All never stands in
+      # for read.
       # The explicit uid guard matters: with a NULL uid every membership EXISTS
       # is false, which would make the rules conjunction vacuously TRUE — the
       # deny strategies must therefore hide rows before that branch is reached.
       def using_expression
-        guarded = "(#{view_all_bypass_sql} OR #{rules_conjunction_sql})"
+        rows = "(#{view_all_bypass_sql} OR #{rules_conjunction_sql})"
+        read = read_access_sql
+        guarded = read ? "(#{read} AND #{rows})" : rows
         if @configuration.nil_user_strategy == :bypass
           "((#{uid_sql}) IS NULL OR #{guarded})"
         else
@@ -171,11 +203,12 @@ module PermissionForge
       end
 
       def user_id_cast_type
-        PermissionForge::PermissionSetUser.columns_hash['user_id']&.sql_type || 'bigint'
+        PermissionForge::SchemaRead.column(PermissionForge::PermissionSetUser, 'user_id')&.sql_type || 'bigint'
       end
 
-      # Granting-set view_all/modify_all bypasses rules; a muting set with
-      # view_all/modify_all cancels the bypass. Both checked dynamically.
+      # A granting set's View All bypasses the rules (bypass_flags_sql); a
+      # muting set with View All or Modify All cancels the bypass. Both
+      # checked dynamically.
       #
       # GDPR/consent guard: activation conditions (session flag / IP / login
       # hours) cannot be evaluated inside a database policy, so only
@@ -187,41 +220,41 @@ module PermissionForge
         "(#{view_all_exists_sql(muting: false)} AND NOT #{view_all_exists_sql(muting: true)})"
       end
 
+      # Built without squish: the condition SQL quotes a newline, a carriage
+      # return and a tab (PermissionSet.conditions_present_sql), which squish
+      # would turn into spaces.
       def view_all_exists_sql(muting:)
-        <<~SQL.squish
-          EXISTS (
-            SELECT 1 FROM #{psu_table} psu
-            JOIN #{ps_table} ps ON ps.id = psu.permission_set_id
-            JOIN #{resources_table} r ON r.permission_set_id = ps.id
-            WHERE psu.user_id = (#{uid_sql})
-              AND #{assignment_active_sql}
-              AND ps.is_active = TRUE AND ps.is_muting = #{muting ? 'TRUE' : 'FALSE'}
-              #{"AND #{unconditional_set_sql}" unless muting}
-              AND r.name = #{@conn.quote(resource_name)}
-              AND r.is_active = TRUE
-              #{tenant_predicate_sql}
-              AND (r.view_all = TRUE OR r.modify_all = TRUE)
-          )
-        SQL
+        resource_row_exists_sql(muting: muting, names: [resource_name],
+                                extra: [(unconditional_set_sql unless muting), bypass_flags_sql(muting)])
+      end
+
+      # A granting row bypasses the rules with View All alone: the app layer
+      # grants Modify All only together with View All
+      # (PermissionHashBuilder.granted_flags), so Modify All without it — a
+      # row written past the validation — bypasses nothing. A muting row
+      # cancels the bypass with either flag (narrower than the app layer,
+      # whose muting Modify All leaves View All standing).
+      def bypass_flags_sql(muting)
+        muting ? '(r.view_all = TRUE OR r.modify_all = TRUE)' : 'r.view_all = TRUE'
       end
 
       # Ties the resource row to the protected row's tenant, when tenancy is
-      # on and both tables have the tenant column: `AND r.account_id =
+      # on and both tables have the tenant column (SchemaRead: read again once
+      # before "no"): `AND r.account_id =
       # "customers"."account_id"`. A NULL tenant on either side matches
       # nothing. Empty otherwise (no tenant to compare).
       def tenant_predicate_sql
         column = @configuration.tenant_enabled? && @configuration.resolved_tenant_column.to_s
-        return '' unless column && [@model_class, PermissionForge::Resource].all? { |klass| klass.column_names.include?(column) }
+        return '' unless column && [@model_class, PermissionForge::Resource].all? { |klass| SchemaRead.column?(klass, column, ignored: false) }
 
         quoted = @conn.quote_column_name(column)
         "AND r.#{quoted} = #{quoted_table}.#{quoted}"
       end
 
-      # Mirrors PermissionSet.unconditional (activation conditions absent).
+      # PermissionSet.unconditional, on the `ps` alias: the one definition of
+      # "no activation condition".
       def unconditional_set_sql
-        "(ps.requires_session_flag IS NULL OR ps.requires_session_flag = '') " \
-          "AND (ps.allowed_ips IS NULL OR ps.allowed_ips = '') " \
-          'AND ps.allowed_hours_start IS NULL'
+        "NOT #{PermissionForge::PermissionSet.conditions_present_sql(table: 'ps')}"
       end
 
       # One conjunct per rule-bearing granting set:
@@ -255,9 +288,11 @@ module PermissionForge
         SQL
       end
 
+      # PermissionSetUser.active_assignments: an assignment counts until its
+      # expires_at, that instant included.
       def assignment_active_sql
-        clauses = ['(psu.expires_at IS NULL OR psu.expires_at > now())']
-        clauses << 'psu.is_active = TRUE' if PermissionForge::PermissionSetUser.column_names.include?('is_active')
+        clauses = ['(psu.expires_at IS NULL OR psu.expires_at >= now())']
+        clauses << 'psu.is_active = TRUE' if PermissionForge::SchemaRead.column?(PermissionForge::PermissionSetUser, 'is_active', ignored: false)
         clauses.join(' AND ')
       end
 
@@ -273,9 +308,14 @@ module PermissionForge
         @conn.quote_table_name(PermissionForge::Resource.table_name)
       end
 
-      # A value the column cannot hold makes the rule FALSE — the app layer
-      # matches nothing for it, NULL rows included.
+      # A rule the app layer matches nothing for (Operators::RuleProblem: the
+      # one taxonomy — a join type or operator this version does not know, a
+      # path no join is built through, a qualifier naming no table, a column
+      # the table does not have, a value it cannot hold) makes the rule FALSE
+      # — NULL rows included.
       def rule_sql(rule)
+        return 'FALSE' if Operators::RuleProblem.for(rule)
+
         operator, field_name = rule.values_at(:operator, :field_name)
         value = typed_value(operator, rule.field_value, Operators::RuleColumn.find(field_name, [@model_class]))
         return 'FALSE' if value.equal?(UNUSABLE)
@@ -343,10 +383,14 @@ module PermissionForge
         PermissionForge::PermissionSetRule.active.where(resource_id: resources.select(:id)).includes(:permission_set)
       end
 
-      # A field_name that is not a name is translated, whatever the rule is:
-      # to FALSE, as the app layer matches nothing for it.
+      # nil for a rule that is compiled, else why it is skipped (reported in
+      # :skipped_rules). A rule the app layer matches nothing for
+      # (Operators::RuleProblem) is compiled whatever it is — to FALSE
+      # (rule_sql) — never skipped, which would leave the policy wider than
+      # the app layer. An operator the app layer has (a custom one registered
+      # in Operators::Registry) but this module has no SQL for is skipped.
       def untranslatable_reason(rule)
-        return unless Operators::RuleColumn.name?(rule.field_name)
+        return if Operators::RuleProblem.for(rule)
         return :join_rule if rule.join_rule?
         return :dotted_field_name if rule.field_name.to_s.include?('.')
         return :unknown_operator unless OPERATOR_SQL.key?(rule.operator)

data/lib/permission_forge/services/rls_read_access_sql.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Services
+    # The read-access gate of an RLS policy under
+    # `config.no_read_access_strategy = :deny`: the session user sees a row
+    # only when RecordReadAccess would let them read the model's records at
+    # all (ResourceChain.readable?) — an entry along the model's Resource
+    # chain, and every entry there grants read_access. Nothing under
+    # :rules_only (the policy applies the rules alone, as the app layer
+    # does). Extracted from {RlsPolicyGenerator} for SRP; it calls back into
+    # the generator's quoting, session-user and table helpers.
+    #
+    # Read per statement, as the app layer's hash is built from the rows:
+    #   - an entry for a name: an active, unexpired assignment to an active
+    #     granting set with an active Resource row of that name (with tenancy
+    #     on, of the protected row's tenant, as the view_all bypass);
+    #   - it grants read: such a row with read_access, in a set without an
+    #     activation condition (PermissionSet.unconditional: a condition
+    #     cannot be judged in a policy, so a conditional set never grants
+    #     read there — its row counts as an entry without read);
+    #   - read taken: an active Resource row with read_access in an active
+    #     muting set the user holds (conditional or not) naming the entry's
+    #     name or an ancestor's — a muting row reaches every entry whose
+    #     chain names it (PermissionHashBuilder's muting phase).
+    # Each difference is narrower than the app layer, never wider.
+    #
+    # Single-table inheritance: the policy is per table and compiled for the
+    # class that includes the concern, so every row needs that class's chain
+    # readable; a row of a loaded STI subclass (its inheritance column holds
+    # the subclass's sti_name) also needs each entry of the subclass's own
+    # names to grant read when the user has one. That is the subclass's
+    # chain rule, never wider than a read through the base class or through
+    # the subclass (narrower than the subclass's when only its own Resource
+    # grants read: the base class's reads see nothing then).
+    #
+    # @api private
+    module RlsReadAccessSql
+      private
+
+      # The gate, or nil under :rules_only. Part of the digest: switching the
+      # strategy makes the policy stale.
+      def read_access_sql
+        return unless @configuration.deny_record_reads_without_read_access?
+
+        own = ResourceChain.names(@model_class)
+        gates = [chain_readable_sql(own), *sti_subclasses.map { |klass| subclass_readable_sql(klass, own) }]
+        "(#{gates.join(' AND ')})"
+      end
+
+      # ResourceChain.readable?: an entry along the chain, none without read.
+      # One name: its entry grants read (an entry that grants read exists).
+      def chain_readable_sql(names)
+        return readable_entry_sql(names.first, names) if names.one?
+
+        any_entry = names.map { |name| entry_exists_sql(name) }.join(' OR ')
+        "((#{any_entry}) AND #{entries_readable_sql(names, names)})"
+      end
+
+      # A row of the subclass: each of its own names (those the compiled
+      # class does not answer to) grants read when the user has an entry.
+      def subclass_readable_sql(klass, own)
+        chain = ResourceChain.names(klass)
+        "(#{inheritance_column_sql} IS DISTINCT FROM #{connection.quote(klass.sti_name)} " \
+          "OR #{entries_readable_sql(chain - own, chain)})"
+      end
+
+      # For each name: no entry, or an entry that grants read.
+      def entries_readable_sql(names, chain)
+        checks = names.map do |name|
+          "(NOT #{entry_exists_sql(name)} OR #{readable_entry_sql(name, chain)})"
+        end
+        "(#{checks.join(' AND ')})"
+      end
+
+      # The entry of the name grants read and no muting row takes it: one
+      # naming it or a name after it along the chain (an ancestor's).
+      def readable_entry_sql(name, chain)
+        "(#{entry_exists_sql(name, read: true)} AND NOT #{read_muted_sql(chain.drop(chain.index(name)))})"
+      end
+
+      def entry_exists_sql(name, read: false)
+        resource_row_exists_sql(
+          muting: false, names: [name],
+          extra: read ? [unconditional_set_sql, 'r.read_access = TRUE'] : []
+        )
+      end
+
+      def read_muted_sql(names)
+        resource_row_exists_sql(muting: true, names: names, extra: ['r.read_access = TRUE'])
+      end
+
+      # The loaded STI subclasses on the table (a subclass with a table of
+      # its own is another policy's business), each with a name the compiled
+      # class does not answer to, in name order (the digest is stable).
+      # None without an inheritance column.
+      def sti_subclasses
+        return [] unless SchemaRead.column?(@model_class, @model_class.inheritance_column, ignored: false)
+
+        own = ResourceChain.names(@model_class).map(&:to_s)
+        @model_class.descendants.select { |klass| klass.table_name == table_name && klass.name && own.exclude?(klass.name) }
+                    .sort_by(&:name)
+      end
+
+      # Whether the session user holds, through an active, unexpired
+      # assignment, an active granting (or muting) set with an active
+      # Resource row of one of the names — of the protected row's tenant
+      # when tenancy is on — meeting the extra conditions. The read-access
+      # gate reads it, and so does the generator's view_all bypass.
+      def resource_row_exists_sql(muting:, names:, extra: [])
+        conditions = [
+          "psu.user_id = (#{uid_sql})", assignment_active_sql,
+          "ps.is_active = TRUE AND ps.is_muting = #{muting ? 'TRUE' : 'FALSE'}",
+          resource_names_sql(names), 'r.is_active = TRUE',
+          tenant_predicate_sql.delete_prefix('AND ').presence,
+          *extra
+        ]
+        "EXISTS ( SELECT 1 FROM #{psu_table} psu JOIN #{ps_table} ps ON ps.id = psu.permission_set_id " \
+          "JOIN #{resources_table} r ON r.permission_set_id = ps.id WHERE #{conditions.compact.join(' AND ')} )"
+      end
+
+      def resource_names_sql(names)
+        "r.name IN (#{names.map { |name| connection.quote(name.to_s) }.join(', ')})"
+      end
+
+      def inheritance_column_sql
+        "#{quoted_table}.#{connection.quote_column_name(@model_class.inheritance_column)}"
+      end
+    end
+  end
+end

data/lib/permission_forge/services/security_audit/action_check.rb

@@ -3,10 +3,12 @@
 module PermissionForge
   module Services
     module SecurityAuditChecks
-      # Controller actions as permissions: managed actions nobody is permitted
-      # to run, managed actions whose controller does not run the guard, rows
-      # whose name can never be an action key, rows that match no controller
-      # action, and discovery switched on while no controller includes the guard.
+      # Controller actions as permissions: guarded controller actions no
+      # Permission Set manages (refused under the default strategy, open under
+      # :allow), managed actions nobody is permitted to run, managed actions
+      # whose controller does not run the guard, rows whose name can never be
+      # an action key, rows that match no controller action, and discovery
+      # switched on while no controller includes the guard.
       class ActionCheck < BaseCheck
         # One action row in effect (PermissionForge::ResourceAction.in_effect).
         LiveRow = Struct.new(:tenant, :resource, :action, :permitted, :muting, :set) do
@@ -28,7 +30,8 @@ module PermissionForge
         end
 
         def call
-          [ungranted_actions, unguarded_actions, invalid_keys, unlinked_actions, guard_missing].compact
+          [unmanaged_actions, actions_not_checked, ungranted_actions, unguarded_actions, invalid_keys, unlinked_actions,
+           guard_missing].compact
         end
 
         private
@@ -70,6 +73,47 @@ module PermissionForge
           "#{resource} › #{action}: #{unguarded}" unless unguarded.empty?
         end
 
+        # Mapped controller actions, in controllers that run the guard, that
+        # some tenant's Permission Sets do not manage: the guard hands them to
+        # unconfigured_action_strategy. Read from the routes whether or not
+        # discovery is on, as the guard runs either way, so an app upgrading
+        # past the :allow default sees what now answers 403 before it deploys.
+        def unmanaged_actions
+          items = UnmanagedActions.build(entries: catalog.mapped_entries, configuration: configuration).items
+          return if items.empty?
+
+          if configuration.allow_unconfigured_actions?
+            finding(:info, :unmanaged_actions_allowed, 'Guarded actions no Permission Set manages run for everyone',
+                    'unconfigured_action_strategy is :allow, so every signed-in user can run these controller ' \
+                    'actions: no Permission Set manages them (unconfigured_actions_allowed rates the setting). ' \
+                    'Manage each one in a Permission Set before you switch the strategy back to :block, the default.',
+                    items: items)
+          else
+            finding(:low, :unmanaged_actions_refused, 'Guarded actions no Permission Set manages are refused',
+                    'These controller actions map to a Resource and run the guard, but no Permission Set manages ' \
+                    "them (with tenancy: in the tenants named), so the guard refuses them (403) #{UnmanagedActions.refused_to(configuration)} " \
+                    '(unconfigured_action_strategy :block, the default since 0.15) — unless the controller skips ' \
+                    'the guard for that action (skip_before_action :pf_authorize_action!, only: …), which the audit ' \
+                    'does not see. Give each one a row in the Permission Sets that should run it; an action whose ' \
+                    'name is not a valid action key needs a key first (permission_forge_actions actions: { ... }). ' \
+                    'Or set unconfigured_action_strategy = :allow to let every signed-in user run them, as before 0.15.',
+                    items: items)
+          end
+        end
+
+        # The routes the catalog could not judge: the lists above may miss them.
+        def actions_not_checked
+          skipped = catalog.skipped
+          count = skipped.size
+          return if count.zero?
+
+          finding(:low, :actions_not_checked, "#{count} #{'controller action'.pluralize(count)} could not be checked (see the log)",
+                  'A controller failed to load, or the controller_action_resolver or the mapping raised, so the ' \
+                  'audit could not tell whether these run the guard or what they map to. They are missing from ' \
+                  'unmanaged_actions_refused (and the other action findings); at run time the same error fails the ' \
+                  'request. Fix the error the log names and run the audit again.', items: skipped)
+        end
+
         # Managed (a row is in effect) but permitted by no granting set: the
         # guard and can? refuse everyone.
         def ungranted_actions

data/lib/permission_forge/services/security_audit/assignment_check.rb

@@ -19,8 +19,9 @@ module PermissionForge
           PermissionForge::PermissionSetUser.active_assignments
         end
 
+        # The admin's threshold (Admin::AttentionItems.stale_days, the one definition).
         def stale_days
-          configuration.try(:admin_stale_assignment_days) || 90
+          PermissionForge::Admin::AttentionItems.stale_days(configuration)
         end
 
         def stale

data/lib/permission_forge/services/security_audit/audit_trail_check.rb

@@ -29,9 +29,7 @@ module PermissionForge
         def table?
           return @table if defined?(@table)
 
-          @table = audit_events.table_exists?
-        rescue ActiveRecord::ConnectionNotEstablished, ActiveRecord::NoDatabaseError, ActiveRecord::StatementInvalid
-          @table = nil
+          @table = PermissionForge::DatabaseReach.table_exists?(audit_events) { return @table = nil }
         end
 
         def table_missing