permission_forge 0.14.1 → 0.15.0

data/app/controllers/permission_forge/assignments_controller.rb

@@ -9,6 +9,7 @@ module PermissionForge
   class AssignmentsController < ApplicationController
     include PermissionForge::AssignmentAuthorization
     include PermissionForge::ActingAdmin
+    include PermissionForge::CacheConfirmation
 
     # What config.admin_assignment_authorization is asked for each member action.
     CHANGE_ACTIONS = { update: :change_expiry, destroy: :revoke, keep: :review }.freeze
@@ -30,21 +31,24 @@ module PermissionForge
       back = pf_back_or(permission_forge.person_path(@person))
       return if pf_assignment_refused?(@chosen_sets, @person.id, :grant, back)
 
-      created = assign_chosen_sets
-      pf_redirect back, notice: assigned_notice(created), undo: assign_undo(created, back)
+      created = nil
+      outcome = cache_outcome { created = assign_chosen_sets }
+      pf_redirect back, undo: assign_undo(created, back), **cache_flash_text(outcome, assigned_notice(created))
     end
 
     # Change the end date (presets) or extend by 30 days. On a locked
     # Permission Set only a change that narrows access passes
     # (EditableLock.widening_lock): for a granting set an end date set or
     # moved earlier, for a Muting Permission Set one cleared or moved later.
+    # Nothing chosen (the select's own first entry), or the end date the
+    # assignment has, changes nothing and says so (SaveNotice).
     def update
       expires_at = new_expiry(params[:expiry].to_s)
-      return redirect_to(return_path) if expires_at == :invalid
+      return redirect_to(return_path, **pf_save_flash(false)) if expires_at == :invalid
       return if widening_refused?(expires_at)
 
-      @assignment.update!(expires_at: expires_at)
-      redirect_to return_path, notice: end_changed_notice(expires_at)
+      outcome = cache_outcome { pf_save_changed(@assignment, { expires_at: expires_at }, &:save!) }
+      redirect_to return_path, **pf_save_flash(@assignment) { cache_flash_text(outcome, end_changed_notice(expires_at)) }
     end
 
     def confirm_destroy
@@ -56,19 +60,19 @@ module PermissionForge
     # is allowed (EditableLock.widening_lock).
     def destroy
       name = person_name(@assignment.user)
-      set_name = @assignment.permission_set.name
+      set_name = pf_record_name(@assignment.permission_set)
       undo = restore_undo
-      @assignment.destroy!
-      pf_redirect return_path, notice: t('permission_forge.flash.assignments.removed', name: name, set: set_name), undo: undo
+      outcome = cache_outcome { @assignment.destroy! }
+      pf_redirect return_path, undo: undo, **cache_flash_text(outcome, t('permission_forge.flash.assignments.removed', name: name, set: set_name))
     end
 
     # Access review "Keep": records the reviewer and the date
     # (PermissionSetUser#mark_reviewed!, one assignment.reviewed event);
     # staleness is measured from the last review.
     def keep
-      @assignment.mark_reviewed!(reviewer: pf_acting_admin_record)
-      redirect_to return_path, notice: t('permission_forge.flash.assignments.kept',
-                                         name: person_name(@assignment.user), set: @assignment.permission_set.name)
+      outcome = cache_outcome { @assignment.mark_reviewed!(reviewer: pf_acting_admin_record) }
+      redirect_to return_path, **cache_flash_text(outcome, t('permission_forge.flash.assignments.kept',
+                                                             name: person_name(@assignment.user), set: pf_record_name(@assignment.permission_set)))
     end
 
     # Undo for "Remove": recreates the assignment.
@@ -77,8 +81,9 @@ module PermissionForge
       set, user = restore_target
       return if pf_widening_refused?(pf_widening_lock(set, :grant), return_path) || pf_assignment_refused?(set, user.id, :grant, return_path)
 
-      restore_assignment(set, user, expires_at)
-      redirect_to return_path, notice: t('permission_forge.flash.assignments.restored', name: person_name(user), set: set.name)
+      outcome = cache_outcome { restore_assignment(set, user, expires_at) }
+      redirect_to return_path,
+                  **cache_flash_text(outcome, t('permission_forge.flash.assignments.restored', name: person_name(user), set: pf_record_name(set)))
     end
 
     # Undo for "Assign": removes the assignments just created (narrows
@@ -88,8 +93,8 @@ module PermissionForge
       assignments = undo_assignments
       return if undo_refused?(assignments)
 
-      PermissionForge::Audit.correlate { assignments.each(&:destroy!) }
-      redirect_to return_path, notice: t('permission_forge.flash.assignments.undone')
+      outcome = cache_outcome { PermissionForge::Audit.correlate { assignments.each(&:destroy!) } }
+      redirect_to return_path, **cache_flash_text(outcome, t('permission_forge.flash.assignments.undone'))
     end
 
     private
@@ -104,8 +109,9 @@ module PermissionForge
     def restore_undo
       return if pf_widening_lock(@assignment.permission_set, :grant)
 
+      # Microseconds: end_of_day is 23:59:59.999999, and IsoTime reads up to 9 fraction digits.
       restore = { 'permission_set_id' => @assignment.permission_set_id, 'user_id' => @assignment.user_id,
-                  'expires_at' => @assignment.expires_at&.iso8601, 'return_to' => return_path }
+                  'expires_at' => @assignment.expires_at&.iso8601(6), 'return_to' => return_path }
       { path: permission_forge.restore_assignments_path, method: 'post', params: restore }
     end
 
@@ -173,7 +179,9 @@ module PermissionForge
       load_sets
       @people_counts = PermissionForge::PermissionSetUser.active_assignments.group(:permission_set_id).count
       pf_load_expiry
-      @chosen_sets = @sets.select { |set| @selected_ids.include?(set.id) && !@existing_ids.include?(set.id) }
+      @chosen_sets = @sets.select do |set|
+        @selected_ids.include?(set.id) && !@existing_ids.include?(set.id) && !@locked_ids.include?(set.id)
+      end
     end
 
     def load_person
@@ -192,22 +200,24 @@ module PermissionForge
       @set_query = pf_text_param(:set_q)
       @preset_set = PermissionForge::PermissionSet.find_by(id: params[:permission_set_id])
       @selected_ids = (pf_id_list(:set_ids) + [@preset_set&.id]).compact.uniq
-      @sets = assignable_sets
+      @sets = listed_sets
+      @locked_ids = @sets.select { |set| pf_widening_lock(set, :grant) }.to_set(&:id)
     end
 
     def picker_limit
       @person ? 0 : 8
     end
 
-    # The sets a holder can be added to: not those where that widens access
-    # on a locked set (a locked Muting Permission Set takes holders).
-    def assignable_sets
+    # Every set matching the filter. Those a holder cannot be added to (that
+    # widens access on a locked set; a locked Muting Permission Set takes
+    # holders) are listed as locked (@locked_ids) and never chosen.
+    def listed_sets
       scope = PermissionForge::PermissionSet.order(:is_muting, :name)
       unless @set_query.empty?
         needle = "%#{ActiveRecord::Base.sanitize_sql_like(@set_query.downcase)}%"
         scope = scope.where('LOWER(name) LIKE ?', needle).or(scope.where(id: @selected_ids))
       end
-      scope.reject { |set| pf_widening_lock(set, :grant) }
+      scope.to_a
     end
 
     def validate_form
@@ -226,7 +236,7 @@ module PermissionForge
 
     def end_changed_notice(expires_at)
       t('permission_forge.flash.assignments.end_changed', name: person_name(@assignment.user),
-                                                          set: @assignment.permission_set.name,
+                                                          set: pf_record_name(@assignment.permission_set),
                                                           when: helpers.pf_expiry(expires_at).first)
     end
 
@@ -235,7 +245,7 @@ module PermissionForge
     def restored_expiry = pf_time_param(:expires_at)
 
     def assigned_notice(created)
-      sets = created.map { |assignment| assignment.permission_set.name }.to_sentence
+      sets = helpers.pf_to_sentence(created.map { |assignment| pf_record_name(assignment.permission_set) })
       return t('permission_forge.flash.assignments.assigned', name: person_name(@person), sets: sets) if @expires_at.nil?
 
       t('permission_forge.flash.assignments.assigned_until', name: person_name(@person), sets: sets,
@@ -244,15 +254,7 @@ module PermissionForge
 
     # :invalid for a blank or unknown key (CHANGE_KEYS has no blank entry).
     def new_expiry(key)
-      return extended_expiry if key == 'extend30'
-      return :invalid unless PermissionForge::Admin::ExpiryPresets::CHANGE_KEYS.include?(key)
-
-      PermissionForge::Admin::ExpiryPresets.expires_at_for(key)
-    end
-
-    def extended_expiry
-      base = [@assignment.expires_at&.to_date, Time.zone.today].compact.max
-      (base + 30).in_time_zone.end_of_day
+      PermissionForge::Admin::ExpiryPresets.change_to(key, from: @assignment.expires_at)
     end
 
     # What the person stops seeing when this (granting) assignment is removed.
@@ -260,7 +262,7 @@ module PermissionForge
       permission_set = @assignment.permission_set
       return [] if permission_set.is_muting
 
-      permission_set.resources.select(&:is_active).map { |r| helpers.pf_resource_plural(r.name) }
+      permission_set.resources.in_effect.map { |r| helpers.pf_resource_plural(r.name) }
     end
   end
 end

data/app/controllers/permission_forge/bulk_assignments_controller.rb

@@ -8,6 +8,7 @@ module PermissionForge
   class BulkAssignmentsController < ApplicationController
     include PermissionForge::AssignmentAuthorization
     include PermissionForge::ActingAdmin
+    include PermissionForge::CacheConfirmation
 
     before_action :set_permission_set
     # A locked set refuses what widens access (EditableLock.widening_lock):
@@ -34,9 +35,11 @@ module PermissionForge
       return render(:new, status: :unprocessable_entity) if @expiry_error || @nobody
       return if grant_refused?
 
-      outcome = assign(@result.to_assign)
+      result = assign(@result.to_assign)
+      # the service's one cache outcome: what the store confirmed, and its scope (CacheConfirmation)
       redirect_to assignments_path,
-                  notice: t('permission_forge.flash.bulk_assignments.assigned', count: outcome[:assigned], set: @permission_set.name)
+                  **cache_flash(result[:cache], { notice: :assigned, alert: :assigned_cache_kept },
+                                count: result[:assigned], set: pf_record_name(@permission_set))
     end
 
     def confirm_revoke
@@ -47,11 +50,12 @@ module PermissionForge
       ids = selected_people.map(&:id)
       return if pf_assignment_refused?(@permission_set, ids, :revoke, assignments_path)
 
-      outcome = PermissionForge::Services::BulkPermissionSetAssignment.call(
+      result = PermissionForge::Services::BulkPermissionSetAssignment.call(
         permission_set: @permission_set, user_ids: ids, action: :revoke
       )
       redirect_to assignments_path,
-                  notice: t('permission_forge.flash.bulk_assignments.revoked', count: outcome[:revoked], set: @permission_set.name)
+                  **cache_flash(result[:cache], { notice: :revoked, alert: :revoked_cache_kept },
+                                count: result[:revoked], set: pf_record_name(@permission_set))
     end
 
     private

data/app/controllers/permission_forge/field_lookups_controller.rb

@@ -32,7 +32,7 @@ module PermissionForge
     end
 
     def field_label(model, name)
-      model&.klass&.human_attribute_name(name) || name.humanize
+      PermissionForge::Admin::FieldLabel.for(model, name).text
     end
   end
 end

data/app/controllers/permission_forge/maintenance_controller.rb

@@ -3,11 +3,15 @@ module PermissionForge
   #
   # @api private
   class MaintenanceController < ApplicationController
-    # Removes expired assignments (the dry run is shown on Home first).
+    include PermissionForge::CacheConfirmation
+
+    # Removes expired assignments (the dry run is shown on Home first). The
+    # flash says what the cache store confirmed for the affected people, and
+    # when the store lives in this process only (CacheConfirmation).
     def cleanup
       result = PermissionForge::Services::ExpiredAssignmentCleaner.call
       redirect_to permission_forge.root_path,
-                  notice: t('permission_forge.flash.maintenance.cleaned', count: result[:removed])
+                  **cache_flash(result[:cache], { notice: :cleaned, alert: :cleaned_cache_kept }, count: result[:removed])
     end
   end
 end

data/app/controllers/permission_forge/people_controller.rb

@@ -55,15 +55,15 @@ module PermissionForge
       return if pf_assignment_refused?(sets, @person.id, :revoke, path)
 
       count = @removable.size
-      confirmed = cache_confirmed? { PermissionForge::Audit.correlate { @removable.each(&:destroy!) } }
+      outcome = cache_outcome { PermissionForge::Audit.correlate { @removable.each(&:destroy!) } }
       redirect_to permission_forge.person_path(@person),
-                  **cache_flash(confirmed, { notice: :removed_all, alert: :removed_all_cache_kept }, count: count, name: person_name)
+                  **cache_flash(outcome, { notice: :removed_all, alert: :removed_all_cache_kept }, count: count, name: person_name)
     end
 
     def refresh_cache
-      confirmed = cache_confirmed? { @person.invalidate_permissions if @person.respond_to?(:invalidate_permissions) }
+      outcome = cache_outcome { @person.invalidate_permissions if @person.respond_to?(:invalidate_permissions) }
       redirect_to permission_forge.person_path(@person, tab: pf_tab_param(TABS)),
-                  **cache_flash(confirmed, { notice: :cache_refreshed, alert: :cache_refresh_failed }, name: person_name)
+                  **cache_flash(outcome, { notice: :cache_refreshed, alert: :cache_refresh_failed }, name: person_name)
     end
 
     # --- consent withdrawal -------------------------------------------------------
@@ -78,11 +78,11 @@ module PermissionForge
       flag = params[:flag].to_s
       return redirect_to(permission_forge.person_path(@person)) unless consent_flags.include?(flag)
 
-      count, invalidated = consent_service(flag, dry_run: false).values_at(:revoked_sets, :invalidated)
-      # nothing revoked means nothing to clear: that is not a failure
+      result = consent_service(flag, dry_run: false)
+      # the service's one cache outcome (nothing revoked: nothing to clear, confirmed)
       redirect_to permission_forge.person_path(@person),
-                  **cache_flash(count.zero? || invalidated, { notice: :consent_withdrawn, alert: :consent_withdrawn_cache_kept },
-                                count: count, flag: flag)
+                  **cache_flash(result[:cache], { notice: :consent_withdrawn, alert: :consent_withdrawn_cache_kept },
+                                count: result[:revoked_sets], flag: flag)
     end
 
     # --- erasure ----------------------------------------------------------------------
@@ -99,10 +99,9 @@ module PermissionForge
       end
 
       result = erasure_service(dry_run: false)
-      # nil: erased inside a transaction of the host's, the cache follows at its commit
-      confirmed = result[:cache_cleared] != false
+      # the service's one cache outcome (confirmed nil: erased inside a transaction of the host's, the cache follows at its commit)
       redirect_to permission_forge.people_path,
-                  **cache_flash(confirmed, { notice: :erased, alert: :erased_cache_kept }, name: person_name)
+                  **cache_flash(result[:cache], { notice: :erased, alert: :erased_cache_kept }, name: person_name)
     end
 
     private
@@ -151,7 +150,8 @@ module PermissionForge
     def load_audit_tab
       @changes = audit.changes_by(@person.id, limit: CHANGES_SHOWN)
       @changes_capped = audit.capped?
-      @timeline_log = PermissionForge::Admin::AuditLog.new({ views: params[:views] },
+      @views = pf_text_param(:views).presence # a Hash or a list is no toggle (it would reach url_for)
+      @timeline_log = PermissionForge::Admin::AuditLog.new({ views: @views },
                                                            scope: PermissionForge::Admin::AuditLog.for_person(@person.id))
       @timeline = @timeline_log.page(params[:page], per_page: TIMELINE_PER_PAGE)
       @timeline_lookups = PermissionForge::Admin::AuditLookups.new(@timeline.events)
@@ -163,14 +163,14 @@ module PermissionForge
 
     def send_changes_csv
       entries = audit.changes_by(@person.id).values.flatten
-      csv = audit.to_csv(entries, describe: helpers.method(:pf_audit_describe), person: helpers.method(:pf_audit_people))
+      csv = audit.to_csv(entries, describe: helpers.method(:pf_audit_csv_describe), person: helpers.method(:pf_audit_people))
       response.headers['Cache-Control'] = 'no-store' # names of people, like the log's exports
       send_data csv, filename: "permission-forge-changes-#{@person.id}.csv", type: 'text/csv'
     end
 
     def lost_resource_labels(assignments)
       assignments.map(&:permission_set).reject(&:is_muting)
-                 .flat_map { |ps| ps.resources.select(&:is_active).map { |r| helpers.pf_resource_plural(r.name) } }.uniq
+                 .flat_map { |ps| ps.resources.in_effect.map { |r| helpers.pf_resource_plural(r.name) } }.uniq
     end
 
     # Flags gating sets this person has, plus configured flags.

data/app/controllers/permission_forge/permission_set_editor.rb

@@ -20,7 +20,7 @@ module PermissionForge
       live = @permission_set.permission_set_users.active_assignments.includes(:user).order(:created_at)
       @people_count = live.count
       @impact_people = live.limit(3).map(&:user).compact
-      @lost = @permission_set.is_muting ? [] : @permission_set.resources.select(&:is_active).map { |r| helpers.pf_resource_plural(r.name) }
+      @lost = @permission_set.is_muting ? [] : @permission_set.resources.in_effect.map { |r| helpers.pf_resource_plural(r.name) }
     end
 
     def load_resources_tab
@@ -31,6 +31,15 @@ module PermissionForge
       @assignments = @permission_set.permission_set_users.includes(:user).order(:created_at).to_a
     end
 
+    # The Conditions tab again, with the refused form's values and errors.
+    def render_conditions_refused
+      @tab = 'conditions'
+      @ip_text = params[:allowed_ips].to_s
+      load_editor
+      load_conditions_tab
+      render :show, status: :unprocessable_entity
+    end
+
     def load_conditions_tab
       @ip_text ||= helpers.pf_ip_list(@permission_set.allowed_ips).join("\n")
       configured = (PermissionForge.configuration.admin_session_flags || {}).keys.map(&:to_s)
@@ -48,22 +57,27 @@ module PermissionForge
 
     # The set's events, newest first (the log filtered by this set).
     def load_audit_timeline
-      @timeline_log = PermissionForge::Admin::AuditLog.new({ views: params[:views] },
+      @timeline_log = PermissionForge::Admin::AuditLog.new({ views: @views },
                                                            scope: PermissionForge::Admin::AuditLog.for_permission_set(@permission_set))
       @timeline = @timeline_log.page(params[:page], per_page: AUDIT_TIMELINE_PER_PAGE)
       @timeline_lookups = PermissionForge::Admin::AuditLookups.new(@timeline.events)
     end
 
+    # Typed like every admin parameter (ParamShapes): a Hash or a list in
+    # one of them is no filter, never a 500. Days are one of the offered
+    # counts (AuditTrail::DAY_FILTERS), else no filter.
     def load_audit_filters
-      @who = params[:who].presence
-      @type = params[:type].presence
-      @days = params[:days].presence
+      @who = pf_text_param(:who).presence
+      @type = pf_text_param(:type).presence
+      offered = PermissionForge::Admin::AuditTrail::DAY_FILTERS
+      @days = pf_integer_param(:days, default: nil, range: 1..offered.max).then { |days| days if offered.include?(days) }
       @sort = params[:sort] == 'asc' ? 'asc' : 'desc'
+      @views = pf_text_param(:views).presence
     end
 
     def send_audit_csv
       audit = PermissionForge::Admin::AuditTrail.new
-      csv = audit.to_csv(@entries, describe: helpers.method(:pf_audit_describe), person: helpers.method(:pf_audit_people))
+      csv = audit.to_csv(@entries, describe: helpers.method(:pf_audit_csv_describe), person: helpers.method(:pf_audit_people))
       response.headers['Cache-Control'] = 'no-store' # names of people, like the log's exports
       send_data csv, filename: "permission-forge-#{@permission_set.name.parameterize}-audit.csv", type: 'text/csv'
     end

data/app/controllers/permission_forge/permission_set_group_users_controller.rb

@@ -1,7 +1,9 @@
 module PermissionForge
   # Group membership. Organisational only: it never gives Permission Sets.
   # Adding and removing go through the model callbacks (group_membership.*
-  # audit events) after config.admin_assignment_authorization.
+  # audit events) after config.admin_assignment_authorization. No cached
+  # permissions change, so the toast reports no cache outcome (unlike an
+  # assignment: CacheConfirmation).
   #
   # @api private
   class PermissionSetGroupUsersController < ApplicationController

data/app/controllers/permission_forge/permission_set_groups_controller.rb

@@ -4,6 +4,8 @@ module PermissionForge
   #
   # @api private
   class PermissionSetGroupsController < ApplicationController
+    include PermissionForge::CopyRefusal
+
     before_action :set_group, except: %i[index create]
     before_action :reject_locked, only: %i[update destroy confirm_destroy add_set remove_set]
 
@@ -17,7 +19,7 @@ module PermissionForge
       return render_blank_name if @group.name.blank?
 
       @group.save!
-      redirect_to permission_forge.group_path(@group), notice: t('permission_forge.flash.groups.created', name: @group.name)
+      redirect_to permission_forge.group_path(@group), notice: t('permission_forge.flash.groups.created', name: pf_record_name(@group))
     end
 
     def show
@@ -28,12 +30,16 @@ module PermissionForge
       @people_counts = PermissionForge::PermissionSetUser.active_assignments.group(:permission_set_id).count
     end
 
+    # "Group saved. No one's access changed." for a change; an unchanged
+    # group is not saved, and says so (SaveNotice).
     def update
       attrs = group_params
-      return redirect_to(permission_forge.group_path(@group), alert: t('permission_forge.errors.admin.group_blank')) if blank_name?(attrs)
+      return redirect_to(group_page, alert: t('permission_forge.errors.admin.group_blank')) if blank_name?(attrs)
+
+      saved = pf_save_changed(@group, attrs, &:save)
+      return redirect_to(group_page, alert: PermissionForge::Admin::ErrorSentence.first(@group.errors)) unless saved
 
-      @group.update!(attrs)
-      redirect_to permission_forge.group_path(@group), notice: t('permission_forge.flash.groups.updated')
+      redirect_to group_page, **pf_save_flash(@group) { t('permission_forge.flash.groups.updated') }
     end
 
     def duplicate
@@ -41,13 +47,15 @@ module PermissionForge
         permission_set_group: @group, attrs: { name: t('permission_forge.permission_sets.copy_name', name: @group.name), is_editable: true },
         unlock: true
       )
-      redirect_to permission_forge.group_path(copy), notice: t('permission_forge.flash.groups.duplicated', name: @group.name)
+      redirect_to permission_forge.group_path(copy), notice: t('permission_forge.flash.groups.duplicated', name: pf_record_name(@group))
+    rescue ActiveRecord::RecordInvalid => e
+      redirect_to permission_forge.group_path(@group), alert: pf_copy_refused_message(e, pf_record_name(@group))
     end
 
     def confirm_destroy; end
 
     def destroy
-      name = @group.name
+      name = pf_record_name(@group)
       @group.destroy!
       redirect_to permission_forge.groups_path, notice: t('permission_forge.flash.groups.deleted', name: name)
     end
@@ -61,7 +69,7 @@ module PermissionForge
       return if pf_reject_locked!([set, leaving], permission_forge.group_path(@group))
 
       set.update!(permission_set_group: @group)
-      redirect_to permission_forge.group_path(@group), notice: t('permission_forge.flash.groups.set_added', set: set.name)
+      redirect_to permission_forge.group_path(@group), notice: t('permission_forge.flash.groups.set_added', set: pf_record_name(set))
     end
 
     def remove_set
@@ -69,7 +77,7 @@ module PermissionForge
       return if pf_reject_locked!(set, permission_forge.group_path(@group))
 
       set.update!(permission_set_group: nil)
-      redirect_to permission_forge.group_path(@group), notice: t('permission_forge.flash.groups.set_removed', set: set.name)
+      redirect_to permission_forge.group_path(@group), notice: t('permission_forge.flash.groups.set_removed', set: pf_record_name(set))
     end
 
     private
@@ -78,6 +86,8 @@ module PermissionForge
       @group = PermissionForge::PermissionSetGroup.find(params[:id])
     end
 
+    def group_page = permission_forge.group_path(@group)
+
     def load_index
       @groups = PermissionForge::PermissionSetGroup.includes(:permission_sets, :permission_set_group_users).order(:name)
       @ungrouped = PermissionForge::PermissionSet.where(permission_set_group_id: nil).order(:name)
@@ -91,8 +101,12 @@ module PermissionForge
       render(:index, status: :unprocessable_entity)
     end
 
+    # A blank name over a generated one, or a blank description over none,
+    # is no change (Admin::Prefill.posted).
     def group_params
-      pf_require_hash(:group).permit(:name, :description, :is_active).tap { |attrs| strip_name!(attrs) }
+      attrs = pf_require_hash(:group).permit(:name, :description, :is_active).tap { |permitted| strip_name!(permitted) }
+      PermissionForge::Admin::Prefill.posted_attributes(@group, attrs, :name, :description)
+      pf_boolean_attributes(attrs, :is_active)
     end
 
     def strip_name!(attrs)

data/app/controllers/permission_forge/permission_set_rules_controller.rb

@@ -23,7 +23,7 @@ module PermissionForge
     end
 
     def update
-      @form = PermissionForge::Admin::RuleForm.new(resource: @resource, params: rule_params)
+      @form = PermissionForge::Admin::RuleForm.new(resource: @resource, params: rule_params, rule: @rule)
       save_rule(:edit, 'updated')
     end
 
@@ -34,16 +34,26 @@ module PermissionForge
       render(@rule ? :edit : :new)
     end
 
+    # The rule being built as the save would answer it (Admin::RulePreview:
+    # the first error the save would show, else the sentence the Rules tab
+    # draws): the fragment pf_admin.js fetches as the value inputs change;
+    # without JS a page of its own. Changes nothing.
+    def preview
+      stored = @resource.permission_set_rules.find_by(id: params[:rule_id]) if params[:rule_id].present?
+      @form = PermissionForge::Admin::RuleForm.new(resource: @resource, params: rule_params, rule: stored)
+      @preview = PermissionForge::Admin::RulePreview.new(form: @form, resource: @resource, stored: stored)
+    end
+
     def toggle
       @rule.update!(is_active: !@rule.is_active)
       key = @rule.is_active ? 'turned_on' : 'turned_off'
-      redirect_to rules_path, notice: t("permission_forge.flash.rules.#{key}", rule: @rule.name)
+      redirect_to rules_path, notice: t("permission_forge.flash.rules.#{key}", rule: pf_record_name(@rule))
     end
 
     def confirm_destroy; end
 
     def destroy
-      name = @rule.name
+      name = pf_record_name(@rule)
       @rule.destroy!
       redirect_to rules_path, notice: t('permission_forge.flash.rules.deleted', rule: name)
     end
@@ -52,7 +62,8 @@ module PermissionForge
 
     # What the builder page draws: built here, read by the template.
     def rule_builder
-      @rule_builder ||= PermissionForge::Admin::RuleBuilder.new(form: @form, resource: @resource, model_errors: @model_errors)
+      @rule_builder ||= PermissionForge::Admin::RuleBuilder.new(form: @form, resource: @resource, model_errors: @model_errors,
+                                                                rule: @rule)
     end
 
     def set_resource
@@ -64,9 +75,9 @@ module PermissionForge
       @rule = @resource.permission_set_rules.find(params[:id])
     end
 
+    # The rule's chain (rule, Resource, Permission Set), or the Resource's for a new rule.
     def reject_locked
-      locked = [@permission_set, @resource, @rule].compact.find { |r| pf_locked?(r) }
-      pf_reject_locked!(locked, rules_path) if locked
+      pf_reject_locked!(@rule || @resource, rules_path)
     end
 
     def rules_path
@@ -85,11 +96,10 @@ module PermissionForge
         return render(template, status: :unprocessable_entity)
       end
 
-      @rule.assign_attributes(@form.attributes)
-      if @rule.save
-        redirect_to rules_path, notice: t("permission_forge.flash.rules.#{flash_key}", rule: @rule.name)
+      if pf_save_changed(@rule, @form.attributes, &:save) # an unchanged rule is not saved (SaveNotice)
+        redirect_to rules_path, **pf_save_flash(@rule) { t("permission_forge.flash.rules.#{flash_key}", rule: pf_record_name(@rule)) }
       else
-        @model_errors = @rule.errors.full_messages
+        @model_errors = @rule.errors
         render template, status: :unprocessable_entity
       end
     end