permission_forge 0.14.1 → 0.15.0

data/lib/permission_forge/services/security_audit/rule_check.rb

@@ -4,18 +4,29 @@ module PermissionForge
   module Services
     module SecurityAuditChecks
       # Record (row-level) rules: whether the app's query scoping applies them,
-      # rules whose value makes them match nothing, rules View All makes
-      # pointless, and likely misconfigurations.
+      # rules that match nothing (Operators::RuleProblem, the one taxonomy —
+      # each kind lands in one finding), rules naming a table of another
+      # model, rules View All makes pointless, and likely misconfigurations.
       class RuleCheck < BaseCheck
         TEXT_OPERATORS = %w[contains starts_with ends_with].freeze
-        # What `current_user` is typed as here: an id is a number or its text,
-        # whoever the user is, and never a boolean or a date.
-        ANY_USER_ID = 0
+
+        # The kinds of Operators::RuleProblem each finding reports: one
+        # finding per kind. A new kind goes in exactly one list (the
+        # taxonomy guard fails for a kind no finding names).
+        FINDING_KINDS = {
+          missing_rule_columns: %i[missing_column unknown_association unjoinable_association unknown_table],
+          unknown_rule_operators: %i[unknown_operator unknown_join_type],
+          unusable_rule_values: %i[unusable_value],
+          foreign_table_filter_rules: %i[foreign_table],
+          encrypted_rule_columns: %i[encrypted_column],
+          non_text_pattern_rules: %i[pattern_on_non_text]
+        }.freeze
 
         def call
           return [no_rules] unless active_rules.exists?
 
-          [unenforced, unusable_values, bypassed, text_operator_on_ids].compact
+          [unenforced, missing_columns, unknown_operators, unusable_values, foreign_table_filters, encrypted_columns,
+           non_text_patterns, secret_columns, foreign_table_names, bypassed, text_operator_on_ids].compact
         end
 
         private
@@ -24,14 +35,26 @@ module PermissionForge
           PermissionForge::PermissionSetRule.active
         end
 
+        # The advice follows the setting: with auto_query_scoping on, rules
+        # are all that is missing.
         def no_rules
+          advice = if configuration.auto_query_scoping_enabled?
+                     'otherwise add rules (auto_query_scoping is on, so a filter rule applies to every query).'
+                   else
+                     'otherwise add rules and enable auto_query_scoping.'
+                   end
           finding(:info, :no_rules, 'No record rules are in use',
                   'Anyone with read access to a resource sees every record of it. That is fine if your app ' \
-                  'limits records itself; otherwise add rules and enable auto_query_scoping.')
+                  "limits records itself; #{advice}")
+        end
+
+        # What the admin's Home shows: the same rules (AttentionItems).
+        def attention
+          @attention ||= PermissionForge::Admin::AttentionItems.new(configuration: configuration)
         end
 
         def unenforced
-          findings = PermissionForge::Admin::AttentionItems.new(configuration: configuration).unenforced_rules
+          findings = attention.unenforced_rules
           return if findings.empty?
 
           held = findings.any? { |item| item.people_count.positive? }
@@ -55,65 +78,172 @@ module PermissionForge
             "#{people_label(item.people_count)}"
         end
 
+        # The rules in effect Home lists as matching nothing
+        # (AttentionItems#broken_rules), of the kinds one finding reports.
+        def broken(code)
+          attention.broken_rules.select { |item| FINDING_KINDS.fetch(code).include?(item.problem.kind) }
+        end
+
+        # The finding's severity: the first while people hold one of the rules, else the second.
+        def weight(findings, held, unheld)
+          findings.any? { |item| item.people_count.positive? } ? held : unheld
+        end
+
+        # Rules saved before PermissionSetRule checked the column, the table
+        # and the path, or written past the model (the tables are shared with
+        # other applications).
+        def missing_columns
+          findings = broken(:missing_rule_columns)
+          return if findings.empty?
+
+          finding(weight(findings, :high, :medium), :missing_rule_columns,
+                  'Rules naming a column, table or association that does not exist',
+                  'The field name of these rules is not a column of their table (or not a name: a trailing or doubled ' \
+                  'dot), names a table this database does not have, or their association path names an association ' \
+                  'their model does not have (or an empty segment) or one a join cannot be built through ' \
+                  '(polymorphic, a scope that takes the record — also along a :through —, a :through, :source or ' \
+                  'inverse_of naming nothing, a class that cannot be loaded) — a typo, or a column or association ' \
+                  'since renamed or removed. Such a rule ' \
+                  'matches nothing: everyone it applies to is denied every record of the resource. Correct the rule ' \
+                  'or remove it (see "Using the wrong field name" in docs/row-level-rules.md).',
+                  items: findings.map { |item| rule_item(item.rule) })
+        end
+
+        # Rules whose operator or join type this version does not have:
+        # written by a newer version (a rolling deploy), by another
+        # application on the shared tables, or past the model.
+        def unknown_operators
+          findings = broken(:unknown_rule_operators)
+          return if findings.empty?
+
+          finding(weight(findings, :high, :medium), :unknown_rule_operators,
+                  'Rules with an operator or join type this version does not know',
+                  'The operator or join type of these rules is none this version of PermissionForge has — written ' \
+                  'by a newer version (a rolling deploy), by another application on the shared tables, or past the ' \
+                  'model. Such a rule matches nothing: everyone it applies to is denied every record of the resource ' \
+                  '(never an error). Finish the upgrade, or correct the rule.',
+                  items: findings.map { |item| unknown_operator_item(item) })
+        end
+
+        def unknown_operator_item(item)
+          rule = item.rule
+          note = " (join type #{rule.join_type.inspect})" if item.problem.kind == :unknown_join_type
+          rule_item(rule, note)
+        end
+
         def unusable_values
-          rules = rules_in_effect.select { |rule| unusable_value?(rule) }
-          return if rules.empty?
+          findings = broken(:unusable_rule_values)
+          return if findings.empty?
 
-          held = rules.any? { |rule| people_counts.fetch(rule.resource.permission_set_id, 0).positive? }
-          finding(held ? :medium : :low, :unusable_rule_values, 'Rules that match nothing',
+          finding(weight(findings, :medium, :low), :unusable_rule_values, 'Rules that match nothing',
                   'The value of these rules is not one their column can hold: text on a number column, a word that ' \
                   'is no boolean, an unknown enum label, a date that is not ISO 8601 (on MySQL and SQLite), a list ' \
-                  'or range with the wrong number of values — or the field name is not a name (a trailing or ' \
-                  'doubled dot). Such a rule matches nothing: everyone it applies to is denied every record of ' \
-                  'the resource. Correct the rule or remove it (see "How Values Are Compared" in ' \
-                  'docs/row-level-rules.md).',
-                  items: rules.map { |rule| unusable_item(rule) })
+                  'or range with the wrong number of values. Such a rule matches nothing: everyone it applies to is ' \
+                  'denied every record of the resource. Correct the rule or remove it (see "How Values Are ' \
+                  'Compared" in docs/row-level-rules.md).',
+                  items: findings.map { |item| rule_item(item.rule) })
         end
 
-        # Active rules of active resources in active granting sets: the rules
-        # that are applied right now (a muting set's rules never are). Not the
-        # ones View All skips — nobody is denied by those; they are listed
-        # under bypassed_rules.
-        def rules_in_effect
-          resources = PermissionForge::Resource.in_effect.merge(PermissionForge::PermissionSet.granting)
-          active_rules.where(resource_id: resources.select(:id)).includes(resource: :permission_set).order(:resource_id, :id)
-                      .reject { |rule| rule.resource.rules_bypassed? }
+        # Filter rules qualified with another model's table (RuleProblem
+        # :foreign_table): a filter rule compares its model's own table, so
+        # such a rule matches nothing (it raised in every query of its holders).
+        def foreign_table_filters
+          findings = broken(:foreign_table_filter_rules).presence or return
+
+          finding(weight(findings, :high, :medium), :foreign_table_filter_rules,
+                  'Filter rules naming a table of another model',
+                  'The field name of these filter rules is qualified with the table of another model. A filter rule ' \
+                  'compares its own model\'s table, so such a rule matches nothing: everyone it applies to is denied ' \
+                  'every record of the resource. For a column of another table, use a join rule (a join type and the ' \
+                  'relationship path in field_accessor_path).', items: findings.map { |item| rule_item(item.rule) })
+        end
+
+        # Rules comparing a value with an encrypted attribute (RuleProblem
+        # :encrypted_column): the column holds ciphertext, so such a rule
+        # matches nothing. Saved before the host encrypted the attribute, or
+        # written past the model.
+        def encrypted_columns
+          findings = broken(:encrypted_rule_columns).presence or return
+
+          finding(weight(findings, :high, :medium), :encrypted_rule_columns,
+                  'Rules comparing an encrypted attribute',
+                  'These rules compare a value with an attribute the model declares with `encrypts` (Active Record ' \
+                  'encryption): the column holds its ciphertext, so the comparison never matches and everyone the rule ' \
+                  'applies to is denied every record of the resource. Only is_null / is_not_null can be asked of such a ' \
+                  'column. Compare another column, or remove the rule (see "Encrypted attributes" in ' \
+                  'docs/row-level-rules.md).', items: findings.map { |item| rule_item(item.rule) })
         end
 
-        # Typed the way the application layer types it (Operators::ValueTyping).
-        # A model that is not there, or cannot be read, says nothing about the
-        # value — that is the integrity check's finding, not one of this check.
-        def unusable_value?(rule)
-          target = rule_column(rule)
-          return false unless target
+        # LIKE rules on a column no pattern can be matched against (RuleProblem
+        # :pattern_on_non_text): a json column, or on PostgreSQL any column
+        # that is not text. Reported as unusable_rule_values before 0.15.
+        def non_text_patterns
+          findings = broken(:non_text_pattern_rules).presence or return
 
-          operator = rule.operator
-          value = rule.field_value
-          value = ANY_USER_ID if Operators::ValueTyping.current_user?(operator, value)
-          Operators::ValueTyping.call(operator, value, target).equal?(Operators::ValueTyping::UNUSABLE)
-        rescue ActiveRecord::ActiveRecordError, NameError, ArgumentError
-          false
+          finding(weight(findings, :medium, :low), :non_text_pattern_rules,
+                  'Pattern rules on a column that is not text',
+                  'These rules use contains, not_contains, starts_with or ends_with on a column that holds no text ' \
+                  '(a number, a date, a boolean, a uuid or a json document on PostgreSQL; a json column everywhere): such ' \
+                  'a rule matches nothing, so everyone it applies to is denied every record of the resource. Use a ' \
+                  'condition that compares values (equal, in, between), or remove the rule.',
+                  items: findings.map { |item| rule_item(item.rule) })
         end
 
-        # The column the rule names, found the way PermissionRuleApplier finds
-        # it. A rule whose association path cannot be followed is left out: the
-        # engine raises for it, it does not match nothing. Tables are checked
-        # first: asking a missing one for its columns fails the statement, and
-        # with it a transaction the audit may run in.
-        def rule_column(rule)
-          model = rule.resource.name.safe_constantize
-          return unless model.is_a?(Class) && model < ActiveRecord::Base
+        # Rules in effect comparing a column that holds a secret
+        # (PermissionForge::SecretColumns) — what Home lists
+        # (AttentionItems#secret_rules). Stored before the model refused them;
+        # they still apply. The item leaves the value out: it is a guess at the secret.
+        def secret_columns
+          findings = attention.secret_rules.presence or return
 
-          path = rule.join_rule? ? rule.field_accessor_path.to_s.split('.') : []
-          models = Operators::RuleColumn.models_along(model, path)
-          Operators::RuleColumn.find(rule.field_name, models) if models.any? && models.all?(&:table_exists?)
+          finding(:medium, :secret_rule_columns, 'Rules comparing a column that holds a secret',
+                  'These rules compare a password digest, a token, an `encrypted_*` column or a secret ' \
+                  '(config.rule_secret_column_patterns; an attribute declared with `encrypts` is ' \
+                  'encrypted_rule_columns). They still apply, but who can read which record tells the ' \
+                  'secret apart, and the rule value is stored and shown in the admin and the API. Compare another ' \
+                  'column, or remove the rule; a new rule on such a column is refused.',
+                  items: findings.map { |item| secret_rule_item(item.rule) })
+        end
+
+        def secret_rule_item(rule)
+          resource = rule.resource
+          path = rule.field_accessor_path.presence if rule.join_rule?
+          "#{resource.permission_set.name} › #{[resource.name, path, rule.field_name].compact.join('.')}: #{rule.name} · " \
+            "#{people(resource.permission_set_id)}"
+        end
+
+        # Join rules in effect whose field name is qualified with a real table
+        # that is none of the rule's (Operators::RuleColumn::FOREIGN): the
+        # query has to join that table itself (a default scope's join) — the
+        # value is compared untyped, and where the query does not join it the
+        # rule matches nothing. (A filter rule's is a RuleProblem.)
+        def foreign_table_names
+          rules = rules_in_effect.select { |rule| foreign_table?(rule) }
+          return if rules.empty?
+
+          finding(:info, :foreign_table_names, 'Join rules naming a table of another model',
+                  'The field name of these rules is qualified with a table that is none of the rule\'s — not the ' \
+                  'model\'s, nor one along its relationship path — so it is left to the database: the query has to ' \
+                  'join that table itself (where it does not, the rule matches nothing), and the value is compared as ' \
+                  'text. Name the relationship in field_accessor_path instead, so the column is checked and the value ' \
+                  'typed.', items: rules.map { |rule| rule_item(rule) })
+        end
+
+        def foreign_table?(rule)
+          rule.join_rule? && Operators::RuleColumn.for_rule(rule)&.foreign?
+        end
+
+        # The rules applied right now (AttentionItems#rules_in_effect).
+        def rules_in_effect
+          attention.rules_in_effect
         end
 
-        def unusable_item(rule)
+        # "Sales › Customer.supplier.owner_id equal "no": Off · 1 person"
+        def rule_item(rule, note = nil)
           resource = rule.resource
           path = rule.field_accessor_path.presence if rule.join_rule?
           field = [resource.name, path, rule.field_name].compact.join('.')
-          "#{resource.permission_set.name} › #{field} #{rule.operator} #{rule.field_value.inspect}: #{rule.name} · " \
+          "#{resource.permission_set.name} › #{field} #{rule.operator} #{rule.field_value.inspect}: #{rule.name}#{note} · " \
             "#{people(resource.permission_set_id)}"
         end
 

data/lib/permission_forge/services/security_audit/text_report.rb

@@ -5,8 +5,11 @@ module PermissionForge
     module SecurityAuditChecks
       # Plain-text rendering of a SecurityAudit::Report for terminals and logs.
       class TextReport
-        def initialize(report)
+        # @param logged [Boolean, nil] whether the audit log records this run
+        #   (report.generated); nil asks Audit.enabled?
+        def initialize(report, logged: nil)
           @report = report
+          @logged = logged
         end
 
         def to_s
@@ -38,7 +41,16 @@ module PermissionForge
         def footer
           return 'No findings.' if @report.findings.empty?
 
-          'Read-only: nothing was changed. FORMAT=json for machine output; FAIL_ON=high to fail CI.'
+          "#{unchanged} FORMAT=json for machine output; FAIL_ON=high to fail CI."
+        end
+
+        # The report changes no permission data, but its run is an audit
+        # event (RakeAudit.reporting) whenever the log records.
+        def unchanged
+          logged = @logged.nil? ? PermissionForge::Audit.enabled? : @logged
+          return 'No permission data was changed.' unless logged
+
+          'No permission data was changed; this run is recorded in the audit log (report.generated).'
         end
       end
     end

data/lib/permission_forge/services/security_audit/unmanaged_actions.rb

@@ -0,0 +1,145 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Services
+    module SecurityAuditChecks
+      # The guarded controller actions no Permission Set manages, as the
+      # ActionCheck lists them: the ones the guard hands to
+      # unconfigured_action_strategy (ControllerActions::Authorizer rows 4 and 8).
+      #
+      # "Managed" is per tenant (ManagedIndex): with tenancy, an action is
+      # listed with the tenants that do not manage it, among those that have
+      # an active Permission Set.
+      #
+      #   UnmanagedActions.new(entries: catalog.mapped_entries, managed: { nil => { 'Customer' => Set['export'] } }).items
+      #   # => ["Invoice (resource not managed): invoices#index, invoices#show",
+      #   #     "Customer › archive: customers#archive"]
+      #   # with tenants: [3, 4, 9]
+      #   # => ["Customer (resource not managed in 2 of 3 tenants: 3, 9): customers#index, customers#archive",
+      #   #     "Customer › archive (not managed in 1 of 3 tenants: 4): customers#archive"]
+      class UnmanagedActions
+        # Tenant ids named in one item; the count says how many there are.
+        TENANT_LIMIT = 10
+
+        class << self
+          # Reads what is managed in each tenant from the rows in effect
+          # (Resource.in_effect, ResourceAction.in_effect: what ManagedIndex
+          # reads, for every tenant at once). The tenants judged are those
+          # with an active Permission Set; with none, every action is listed
+          # without a tenant.
+          #
+          # @return [UnmanagedActions]
+          def build(entries:, configuration:)
+            tenant = configuration.resolved_tenant_column
+            new(entries: entries, managed: managed_index(tenant), tenants: tenant && tenants_with_sets(tenant))
+          end
+
+          # Who the guard refuses them to: signed-out requests follow
+          # action_guard_nil_user_strategy (else nil_user_strategy) before the
+          # strategy is asked.
+          #
+          # @return [String]
+          def refused_to(configuration)
+            signed_out = if configuration.action_guard_nil_user_bypass?
+                           ' (signed-out requests run them: action_guard_nil_user_strategy, else nil_user_strategy, is :bypass)'
+                         else
+                           ', and to signed-out visitors'
+                         end
+            "to every signed-in user action_guard_bypass does not let through#{signed_out}"
+          end
+
+          private
+
+          # A resource row is [tenant, name], an action row [tenant, name, key].
+          def managed_index(tenant)
+            (resource_rows(tenant) + action_rows(tenant)).each_with_object({}) do |(id, name, key), index|
+              keys = ((index[id] ||= {})[name] ||= Set.new)
+              keys << key if key
+            end
+          end
+
+          def resource_rows(tenant)
+            PermissionForge::Resource.in_effect.distinct.pluck(tenant_of(PermissionForge::Resource, tenant), resource_name)
+          end
+
+          def action_rows(tenant)
+            PermissionForge::ResourceAction.in_effect.distinct
+                                           .pluck(tenant_of(PermissionForge::Resource, tenant), resource_name,
+                                                  PermissionForge::ResourceAction.arel_table[:name])
+          end
+
+          def resource_name = PermissionForge::Resource.arel_table[:name]
+
+          def tenants_with_sets(tenant)
+            ids = PermissionForge::PermissionSet.active.distinct.pluck(tenant_of(PermissionForge::PermissionSet, tenant))
+            (ids.compact.sort + ids.select(&:nil?)).presence
+          end
+
+          def tenant_of(model, tenant)
+            tenant ? model.arel_table[tenant] : Arel.sql('NULL')
+          end
+        end
+
+        # @param entries [Array<PermissionForge::Admin::ControllerCatalog::Entry>]
+        #   every mapped controller action (ControllerCatalog#mapped_entries)
+        # @param managed [Hash{Object => Hash{String => Set<String>}}] tenant id
+        #   (nil without tenancy) => the managed action keys of each resource
+        #   some Permission Set of that tenant manages (ManagedIndex's shape)
+        # @param tenants [Array, nil] the tenants to judge, nil without tenancy
+        def initialize(entries:, managed:, tenants: nil)
+          @entries = entries.select(&:guarded?)
+          @managed = managed
+          @tenants = tenants
+        end
+
+        # @return [Array<String>] one item per resource some tenant does not
+        #   manage, then one per custom action of a resource a tenant manages
+        #   without managing the action
+        def items
+          resource_items + action_items
+        end
+
+        private
+
+        def judged = @tenants || [nil]
+
+        def index(tenant) = @managed.fetch(tenant, {})
+
+        def resource_items
+          @entries.group_by(&:resource).filter_map do |resource, group|
+            missing = judged.reject { |tenant| index(tenant).key?(resource) }
+            "#{resource} (resource not managed#{where(missing)}): #{endpoints(group)}" unless missing.empty?
+          end
+        end
+
+        # An action whose name is not a valid key can never get a row: it says so.
+        def action_items
+          @entries.reject(&:crud?).group_by(&:pair).filter_map do |(resource, key), group|
+            missing = judged.select { |tenant| index(tenant).fetch(resource, nil)&.exclude?(key) }
+            action_item(group, missing) unless missing.empty?
+          end
+        end
+
+        def action_item(group, missing)
+          first = group.first
+          note = ' (not a valid action key)' unless first.manageable?
+          "#{first.resource} › #{first.key}#{" (not managed#{where(missing)})" if @tenants}: #{endpoints(group)}#{note}"
+        end
+
+        # " in 2 of 5 tenants: 3, 9", or nothing without tenancy.
+        def where(missing)
+          return '' unless @tenants
+
+          shown = missing.first(TENANT_LIMIT).map { |tenant| tenant_label(tenant) }
+          " in #{missing.size} of #{@tenants.size} tenants: #{shown.join(', ')}#{', …' if missing.size > TENANT_LIMIT}"
+        end
+
+        def tenant_label(tenant) = tenant.nil? ? 'none' : tenant.to_s
+
+        def endpoints(group)
+          group.map(&:endpoint).uniq.join(', ')
+        end
+      end
+    end
+  end
+end

data/lib/permission_forge/services/security_audit/user_model_check.rb

@@ -37,15 +37,16 @@ module PermissionForge
                   'PermissionForge.without_permission_scope.')
         end
 
-        # :hide exempts the user model so sign-in can read it.
+        # :hide and :hide_in_requests exempt the user model so sign-in can read it.
         def user_model_unmasked_without_user
-          return unless configuration.hide_masked_attributes_without_user?
+          return unless configuration.hide_masked_attributes_without_user_in_requests?
 
           names = user_model_resource_names
           return if names.empty?
 
           finding(:low, :user_model_unmasked_without_user, 'The user model is not masked with nobody signed in',
-                  'masked_attributes_nil_user_strategy is :hide, but the user model is exempt so that sign-in ' \
+                  "masked_attributes_nil_user_strategy is :#{configuration.masked_attributes_nil_user_strategy}, " \
+                  'but the user model is exempt so that sign-in ' \
                   "can read it: with nobody signed in, #{user_model.name}'s columns — password digests and " \
                   'reset or confirmation tokens included — read as stored through its getters and as_json. ' \
                   'Do not render it with no current user. Another authenticatable model (a second Devise ' \

data/lib/permission_forge/services/security_audit.rb

@@ -9,8 +9,8 @@ module PermissionForge
     #
     # Each check is a class answering `#call` with an array of Finding,
     # listed by `SecurityAudit.checks` (config, privilege, assignment, rule,
-    # integrity, personal data, controller actions, the audit trail and the
-    # user model);
+    # integrity, activation conditions, personal data, controller actions,
+    # the audit trail and the user model);
     # add one by passing `checks:` to `call` or by overriding `.checks`
     # (OCP). Nothing is ever changed.
     #
@@ -35,20 +35,32 @@ module PermissionForge
       Report = Struct.new(:findings, :generated_at, :preset, keyword_init: true) do
         def counts = SEVERITIES.index_with { |severity| findings.count { |finding| finding.severity == severity } }
 
+        # Findings of `severity` or worse. The name is read in any case
+        # (:high, 'HIGH'); one that is not a severity counts as :info.
         def at_least(severity)
-          limit = SEVERITIES.index(severity.to_sym) || SEVERITIES.size
+          limit = SEVERITIES.index(SecurityAudit.severity_named(severity)) || SEVERITIES.size
           findings.select { |finding| finding.rank <= limit }
         end
 
         def to_h = { generated_at: generated_at.iso8601, preset: preset, counts: counts, findings: findings.map(&:to_h) }
       end
 
+      # The severity a name stands for, in any case and with surrounding
+      # blanks ignored (`FAIL_ON=HIGH`, `' medium'`).
+      #
+      # @param name [String, Symbol, nil]
+      # @return [Symbol, nil] one of SEVERITIES, nil for anything else
+      def self.severity_named(name)
+        wanted = name.to_s.strip.downcase
+        SEVERITIES.find { |severity| severity.to_s == wanted }
+      end
+
       # @return [Array<Class>] the check classes run by default
       def self.checks
         [
           SecurityAuditChecks::ConfigCheck, SecurityAuditChecks::PrivilegeCheck,
           SecurityAuditChecks::AssignmentCheck, SecurityAuditChecks::RuleCheck,
-          SecurityAuditChecks::IntegrityCheck, SecurityAuditChecks::PersonalDataCheck,
+          SecurityAuditChecks::IntegrityCheck, SecurityAuditChecks::ConditionsCheck, SecurityAuditChecks::PersonalDataCheck,
           SecurityAuditChecks::ActionCheck, SecurityAuditChecks::AuditTrailCheck,
           SecurityAuditChecks::UserModelCheck
         ]

data/lib/permission_forge/services/stale_assignment_auditor.rb

@@ -1,8 +1,10 @@
 module PermissionForge
   module Services
     # Audits permanent permission set assignments that haven't been reviewed
-    # within a configurable threshold (default: 90 days). Reviewed means the
-    # last access review "Keep" (reviewed_at), else the grant (created_at) —
+    # within a threshold (default: config.admin_stale_assignment_days, the
+    # threshold of the admin's Stale list; when that is nil,
+    # Configuration::AdminUiSettings::DEFAULT_STALE_ASSIGNMENT_DAYS, 90).
+    # Reviewed means the last access review "Keep" (reviewed_at), else the grant (created_at) —
     # PermissionSetUser.stale_before; editing an assignment is not a review.
     # Supports GDPR Art. 5(1)(e) — Storage Limitation.
     #
@@ -21,12 +23,13 @@ module PermissionForge
     class StaleAssignmentAuditor
       include Concerns::AcrossTenants
 
-      # @param threshold_days [Integer] how long a permanent assignment may go unreviewed
+      # @param threshold_days [Integer, nil] how long a permanent assignment may go
+      #   unreviewed; nil: config.admin_stale_assignment_days
       # @return [Hash] see {#call}
       def self.call(...) = new(...).call
 
-      def initialize(threshold_days: 90)
-        @threshold_days = threshold_days
+      def initialize(threshold_days: nil, configuration: PermissionForge.configuration)
+        @threshold_days = threshold_days || PermissionForge::Admin::AttentionItems.stale_days(configuration)
       end
 
       # @return [Hash] `{ stale_count:, affected_user_ids:, assignments: }`

data/lib/permission_forge/timestamp_fields.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  # Rails' own timestamps (created_at / updated_at, created_on / updated_on)
+  # in the field rows the gem generates: ResourceFieldGenerator (also
+  # Resource.grant_full_access! and the API's generate_fields) and the
+  # admin's presets and "Sync fields" (Admin::ColumnFields).
+  #
+  # They are metadata a reader of the record may see and nobody edits, so on
+  # a granting Permission Set a generated timestamp row is at most Read-only:
+  # a level that grants read (Masked, Read-only, Editable) gives it read on,
+  # edit off and no mask; a level that grants nothing (Hidden, "No access",
+  # the generator without grant_all) leaves it hidden like every other column
+  # (a granting row adds access, so a readable timestamp there would widen
+  # what the set's holders see). On a Muting Permission Set read on means
+  # "take read away": its rows are left as the level says.
+  #
+  # Rows written one by one (the admin's field editor, the API, the console)
+  # are not changed.
+  #
+  # @api private
+  class TimestampFields
+    # Rails' default names (ActiveRecord::Timestamp); only those the model has
+    # as columns count (PermissionForge::SchemaRead: a timestamp a migration
+    # just added is read-only too).
+    NAMES = %w[created_at created_on updated_at updated_on].freeze
+
+    READ_ONLY = { read_access: true, edit_access: false, mask_access: false }.freeze
+
+    # When the columns cannot be read (no table, a database that cannot be
+    # asked) every name counts: a generated row of one is then at most
+    # Read-only, never Editable (fail closed — the names that are not
+    # columns get no row anyway).
+    #
+    # @param model_class [Class, nil]
+    # @return [Array<String>] the timestamp columns of the model
+    def self.names(model_class)
+      return [] unless model_class.respond_to?(:column_names)
+
+      SchemaRead.columns_among(model_class, NAMES)
+    rescue ActiveRecord::ActiveRecordError
+      NAMES
+    end
+
+    # @param model_class [Class, nil] the Resource's model
+    # @param muting [Boolean] the rows are a Muting Permission Set's
+    def initialize(model_class, muting:)
+      @names = muting ? [] : self.class.names(model_class)
+    end
+
+    # What a generated row of `name` gets over the flags of its level.
+    #
+    # @param name [String] the field name
+    # @param read [Boolean] the level gives the row read_access
+    # @return [Hash] Read-only for a readable timestamp of a granting set, else nothing
+    def overrides(name, read:)
+      read && @names.include?(name.to_s) ? READ_ONLY : {}
+    end
+  end
+end