permission_forge 0.14.1 → 0.15.0

data/app/controllers/permission_forge/permission_sets_controller.rb

@@ -5,7 +5,10 @@ module PermissionForge
   # @api private
   class PermissionSetsController < ApplicationController
     include PermissionSetEditor
+    include PermissionForge::ChangeReview
     include PermissionForge::AuditLogGate
+    include PermissionForge::CopyRefusal
+    include PermissionForge::CacheConfirmation
 
     FILTERS = %w[all granting muting conditional off].freeze
     TABS = %w[resources assignments conditions audit].freeze
@@ -47,7 +50,10 @@ module PermissionForge
       return render(:new, status: :unprocessable_entity) if @error
 
       set = build_set
-      redirect_to permission_forge.permission_set_path(set), notice: t('permission_forge.flash.permission_sets.created', name: set.name)
+      redirect_to permission_forge.permission_set_path(set), notice: t('permission_forge.flash.permission_sets.created', name: pf_record_name(set))
+    rescue ActiveRecord::RecordInvalid => e
+      @error = pf_copy_refused_message(e, @name)
+      render :new, status: :unprocessable_entity
     end
 
     def show
@@ -72,7 +78,7 @@ module PermissionForge
       @change_set = change_set
       if @change_set.empty?
         return redirect_to(pf_back_or(permission_forge.permission_set_path(@permission_set)),
-                           notice: t('permission_forge.flash.permission_sets.no_changes'))
+                           pf_nothing_to_save_flash(@change_set))
       end
 
       load_editor
@@ -81,25 +87,22 @@ module PermissionForge
     end
 
     def apply
-      changes = change_set.apply!
-      redirect_to back_to_set, notice: t('permission_forge.flash.permission_sets.saved',
-                                         count: changes.size, people: helpers.pf_people_text(pf_people_count(@permission_set)))
+      applied = change_set
+      outcome = cache_outcome { applied.apply! }
+      redirect_to back_to_set, **pf_applied_flash(applied, outcome)
     rescue PermissionForge::Admin::ChangeSet::Invalid => e
       redirect_to back_to_set, alert: t('permission_forge.flash.permission_sets.save_failed', errors: e.message)
     end
 
     def duplicate
-      name = PermissionForge::Admin::PermissionSetFactory.unique_name(
-        t('permission_forge.permission_sets.copy_name', name: @permission_set.name)
-      )
-      copy = PermissionForge::Admin::PermissionSetFactory.duplicate(@permission_set, name: name)
+      copy = PermissionForge::Admin::PermissionSetFactory.duplicate(@permission_set)
       group = @permission_set.permission_set_group
-      notice = if group && copy.permission_set_group_id.nil?
-                 t('permission_forge.flash.permission_sets.duplicated_outside_group', name: @permission_set.name, group: group.name)
-               else
-                 t('permission_forge.flash.permission_sets.duplicated', name: @permission_set.name)
-               end
-      redirect_to permission_forge.permission_set_path(copy), notice: notice
+      key = group && copy.permission_set_group_id.nil? ? 'duplicated_outside_group' : 'duplicated'
+      redirect_to permission_forge.permission_set_path(copy),
+                  notice: t("permission_forge.flash.permission_sets.#{key}", name: pf_record_name(@permission_set),
+                                                                             group: (pf_record_name(group) if group))
+    rescue ActiveRecord::RecordInvalid => e
+      redirect_to permission_forge.permission_set_path(@permission_set), alert: pf_copy_refused_message(e, pf_record_name(@permission_set))
     end
 
     def confirm_destroy
@@ -107,7 +110,7 @@ module PermissionForge
     end
 
     def destroy
-      name = @permission_set.name
+      name = pf_record_name(@permission_set)
       @permission_set.destroy!
       redirect_to permission_forge.permission_sets_path, notice: t('permission_forge.flash.permission_sets.deleted', name: name)
     end
@@ -121,23 +124,19 @@ module PermissionForge
       @permission_set.update!(is_muting: !@permission_set.is_muting)
       key = @permission_set.is_muting ? 'switched_muting' : 'switched_granting'
       redirect_to permission_forge.permission_set_path(@permission_set),
-                  notice: t("permission_forge.flash.permission_sets.#{key}", name: @permission_set.name)
+                  notice: t("permission_forge.flash.permission_sets.#{key}", name: pf_record_name(@permission_set))
     end
 
     def conditions
       @conditions_form = PermissionForge::Admin::ConditionsForm.new(params) # the re-render reads it back
       attrs = @conditions_form.attributes
       @condition_errors = @conditions_form.errors
-      if @condition_errors.empty? && @permission_set.update(attrs)
+      if @condition_errors.empty? && pf_save_changed(@permission_set, attrs, &:save) # unchanged: not saved (SaveNotice)
         return redirect_to permission_forge.permission_set_path(@permission_set, tab: 'conditions'),
-                           notice: t('permission_forge.flash.permission_sets.conditions_saved')
+                           **pf_save_flash(@permission_set) { t('permission_forge.flash.permission_sets.conditions_saved') }
       end
 
-      @tab = 'conditions'
-      @ip_text = params[:allowed_ips].to_s
-      load_editor
-      load_conditions_tab
-      render :show, status: :unprocessable_entity
+      render_conditions_refused
     end
 
     private

data/app/controllers/permission_forge/resource_actions_controller.rb

@@ -33,10 +33,14 @@ module PermissionForge
       @people_count = pf_people_count(@permission_set)
     end
 
+    # A blank label over a generated one, or a blank over nothing, is no
+    # change (Admin::Prefill.posted); an unchanged action is not saved, and
+    # says so (SaveNotice).
     def update
-      @action_record.assign_attributes(action_params.except(:name))
-      @action_record.save!
-      redirect_to pf_back_or(resource_path), notice: t('permission_forge.flash.actions.updated', action: @action_record.display_name)
+      attrs = PermissionForge::Admin::Prefill.posted_attributes(@action_record, action_params.except(:name), :label, :description)
+      pf_save_changed(@action_record, attrs, &:save!)
+      redirect_to pf_back_or(resource_path),
+                  **pf_save_flash(@action_record) { t('permission_forge.flash.actions.updated', action: @action_record.display_name) }
     end
 
     def confirm_destroy; end
@@ -58,9 +62,9 @@ module PermissionForge
       @action_record = @resource.resource_actions.find(params[:id])
     end
 
+    # The action's chain (action, Resource, Permission Set), or the Resource's for a new action.
     def reject_locked
-      locked = [@permission_set, @resource].find { |r| pf_locked?(r) }
-      pf_reject_locked!(locked, resource_path) if locked
+      pf_reject_locked!(@action_record || @resource, resource_path)
     end
 
     def resource_path
@@ -68,7 +72,8 @@ module PermissionForge
     end
 
     def action_params
-      pf_require_hash(:resource_action).permit(:name, :label, :description, :is_permitted, :is_active)
+      pf_boolean_attributes(pf_require_hash(:resource_action).permit(:name, :label, :description, :is_permitted, :is_active),
+                            :is_permitted, :is_active)
     end
 
     # "Export CSV " => "export_csv"

data/app/controllers/permission_forge/resource_fields_controller.rb

@@ -5,6 +5,8 @@ module PermissionForge
   # @api private
   class ResourceFieldsController < ApplicationController
     include PermissionForge::ActingAdmin
+    include PermissionForge::CacheConfirmation
+    include PermissionForge::ChangeReview
 
     before_action :load_field
     before_action :reject_locked, only: %i[update acknowledge apply_recommendation]
@@ -21,10 +23,14 @@ module PermissionForge
     end
 
     def update
-      attrs = pf_require_hash(:field).permit(:level, :mask_strategy, :label, :description, :is_active).to_h
-      changes = apply_field_changes(attrs)
-      finish_new_field(attrs) unless @field
-      redirect_to pf_back_or(resource_path), notice: saved_notice(changes)
+      attrs = pf_boolean_attributes(pf_require_hash(:field).permit(:level, :mask_strategy, :label, :description, :is_active).to_h,
+                                    :is_active)
+      applied = nil
+      outcome = cache_outcome do
+        applied = apply_field_changes(attrs)
+        finish_new_field(attrs) unless @field
+      end
+      redirect_to pf_back_or(resource_path), **pf_applied_flash(applied, outcome)
     rescue PermissionForge::Admin::ChangeSet::Invalid => e
       redirect_to field_path, alert: t('permission_forge.flash.permission_sets.save_failed', errors: e.message)
     end
@@ -43,12 +49,13 @@ module PermissionForge
 
     # Applies the recommended mask for a sensitive column.
     def apply_recommendation
-      match = PermissionForge::Admin::SensitiveColumns.new.match(@key)
+      match = PermissionForge::SensitiveColumns.new.match(@key)
       return redirect_to(field_path) unless match
 
       level = @permission_set.is_muting ? 'mask' : 'masked'
-      apply_field_changes('level' => level, 'mask_strategy' => match.strategy)
-      redirect_to pf_back_or(field_path), notice: t('permission_forge.flash.fields.recommendation_applied', field: @key)
+      applied = apply_field_changes('level' => level, 'mask_strategy' => match.strategy)
+      redirect_to pf_back_or(field_path),
+                  **pf_save_flash(applied.changes.any?) { t('permission_forge.flash.fields.recommendation_applied', field: @key) }
     end
 
     private
@@ -68,13 +75,15 @@ module PermissionForge
 
     # Applies `attrs` to this field through a ChangeSet; an unconfigured column
     # is created at attrs['level'].
+    #
+    # @return [PermissionForge::Admin::ChangeSet] the applied change set
     def apply_field_changes(attrs)
       change_params = if @field
                         { fields: { @field.id.to_s => attrs } }
                       else
                         { new_fields: { @resource.id.to_s => { @key => { 'level' => attrs['level'] } } } }
                       end
-      PermissionForge::Admin::ChangeSet.new(permission_set: @permission_set, params: change_params).apply!
+      PermissionForge::Admin::ChangeSet.new(permission_set: @permission_set, params: change_params).tap(&:apply!)
     end
 
     # Filter rules (no relationship) on this field.
@@ -82,9 +91,9 @@ module PermissionForge
       @resource.permission_set_rules.select { |rule| rule.field_name == @key && rule.field_accessor_path.blank? }
     end
 
+    # The field's chain (field, Resource, Permission Set), or the Resource's for a column with no row.
     def reject_locked
-      locked = [@permission_set, @resource, @field].compact.find { |r| pf_locked?(r) }
-      pf_reject_locked!(locked, field_path) if locked
+      pf_reject_locked!(@field || @resource, field_path)
     end
 
     def resource_path
@@ -104,15 +113,10 @@ module PermissionForge
       field.update!(extra) if extra.any?
     end
 
-    def saved_notice(changes)
-      return t('permission_forge.flash.permission_sets.no_changes') if changes.empty?
-
-      t('permission_forge.flash.permission_sets.saved', count: changes.size,
-                                                        people: helpers.pf_people_text(pf_people_count(@permission_set)))
-    end
-
+    # People holding a set with this Resource, or one of the STI bases its
+    # records answer to (ResourceChain: a base's rows reach the subclass).
     def explain_candidates
-      set_ids = PermissionForge::Resource.where(name: @resource.name).select(:permission_set_id)
+      set_ids = PermissionForge::Resource.where(name: chain_names).select(:permission_set_id)
       user_ids = PermissionForge::PermissionSetUser.active_assignments.where(permission_set_id: set_ids)
                                                    .distinct.limit(200).pluck(:user_id)
       PermissionForge::Admin::PeopleDirectory.new.find_all(user_ids)
@@ -122,8 +126,22 @@ module PermissionForge
       user = PermissionForge::Admin::PeopleDirectory.new.find(user_id)
       return nil unless user
 
-      outcome = PermissionForge::Admin::EffectiveAccess.call(user: user).find { |r| r.name == @resource.name }
+      outcome = nearest_outcome(PermissionForge::Admin::EffectiveAccess.call(user: user))
       { user: user, field: outcome&.fields&.find { |field| field.name == @key } }
     end
+
+    def chain_names
+      PermissionForge::ResourceChain.names_for(@resource.name).map(&:to_s)
+    end
+
+    # The person's outcome for this model: its own entry, else the nearest
+    # base's (a subclass without an entry of its own is its base).
+    def nearest_outcome(outcomes)
+      chain_names.each do |name|
+        outcome = outcomes.find { |r| r.name == name }
+        return outcome if outcome
+      end
+      nil
+    end
   end
 end

data/app/controllers/permission_forge/resources_controller.rb

@@ -4,6 +4,9 @@ module PermissionForge
   #
   # @api private
   class ResourcesController < ApplicationController
+    include PermissionForge::ChangeReview
+    include PermissionForge::CacheConfirmation
+
     TABS = %w[fields actions rules].freeze
     GRANTING_PRESETS = %w[full read nothing].freeze
     MUTING_PRESETS = %w[hide_sensitive block_changes leave].freeze
@@ -15,7 +18,6 @@ module PermissionForge
     }.freeze
     # Field level each preset gives the model's columns (nil = no fields).
     PRESET_LEVELS = { 'full' => 'edit', 'read' => 'read', 'nothing' => 'hidden', 'hide_sensitive' => 'hide_sensitive' }.freeze
-
     before_action :set_permission_set
     before_action :set_resource, except: %i[new create]
     before_action :reject_locked_set, only: %i[new create review apply sync destroy confirm_destroy]
@@ -42,7 +44,7 @@ module PermissionForge
 
     def review
       @change_set = change_set
-      return redirect_to(resource_path, notice: t('permission_forge.flash.permission_sets.no_changes')) if @change_set.empty?
+      return redirect_to(resource_path, pf_nothing_to_save_flash(@change_set)) if @change_set.empty?
 
       load_page
       @changes = @change_set.changes
@@ -50,10 +52,9 @@ module PermissionForge
     end
 
     def apply
-      changes = change_set.apply!
-      redirect_to pf_back_or(resource_path),
-                  notice: t('permission_forge.flash.permission_sets.saved', count: changes.size,
-                                                                            people: helpers.pf_people_text(pf_people_count(@permission_set)))
+      applied = change_set
+      outcome = cache_outcome { applied.apply! }
+      redirect_to pf_back_or(resource_path), **pf_applied_flash(applied, outcome)
     rescue PermissionForge::Admin::ChangeSet::Invalid => e
       redirect_to resource_path, alert: t('permission_forge.flash.permission_sets.save_failed', errors: e.message)
     end
@@ -77,7 +78,7 @@ module PermissionForge
       label = helpers.pf_resource_label(@resource)
       @resource.destroy!
       redirect_to permission_forge.permission_set_path(@permission_set),
-                  notice: t('permission_forge.flash.resources.removed', resource: label, set: @permission_set.name)
+                  notice: t('permission_forge.flash.resources.removed', resource: label, set: pf_record_name(@permission_set))
     end
 
     private
@@ -138,7 +139,7 @@ module PermissionForge
 
     def load_new_form
       load_models
-      @sensitive = PermissionForge::Admin::SensitiveColumns.new
+      @sensitive = PermissionForge::SensitiveColumns.new
       @existing = @permission_set.resources.pluck(:name)
       @presets = @permission_set.is_muting ? MUTING_PRESETS : GRANTING_PRESETS
       preset = params[:preset]
@@ -161,8 +162,7 @@ module PermissionForge
     end
 
     def added_notice(resource)
-      t('permission_forge.flash.resources.added', resource: helpers.pf_resource_label(resource),
-                                                  count: resource.resource_fields.size)
+      helpers.pf_added_resource_notice(resource, muting: @permission_set.is_muting)
     end
 
     def build_resource(model, preset)
@@ -181,7 +181,8 @@ module PermissionForge
     end
 
     # Creates ResourceFields for columns and virtual fields at a level, applying
-    # privacy defaults (sensitive names start Masked when gdpr_defaults is on).
+    # privacy defaults (see Admin::ColumnFields: under gdpr_defaults sensitive
+    # names start Masked, except at full access).
     def create_fields(columns, level, resource: @resource)
       PermissionForge::Admin::ColumnFields.new(resource, muting: @permission_set.is_muting).create(columns, level)
     end

data/app/frontend/permission_forge/pf_admin.css

@@ -14,9 +14,11 @@
   --pf-mono: "IBM Plex Mono", ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
 
   --pf-radius-xs: 4px;
+  --pf-scroll-shadow: rgba(16, 18, 22, .16);
   --pf-radius-sm: 6px;
   --pf-radius: 8px;
   --pf-radius-lg: 12px;
+  --pf-sidebar-width: 248px;
 
   --pf-space-1: 4px;
   --pf-space-2: 8px;
@@ -70,6 +72,7 @@
   --pf-bg: #111214;
   --pf-surface: #18191c;
   --pf-surface-2: #212327;
+  --pf-scroll-shadow: rgba(0, 0, 0, .55);
   --pf-border: #2c2e33;
   --pf-border-strong: #3c3f45;
   --pf-text: #ececee;
@@ -105,6 +108,7 @@
     --pf-bg: #111214;
     --pf-surface: #18191c;
     --pf-surface-2: #212327;
+    --pf-scroll-shadow: rgba(0, 0, 0, .55);
     --pf-border: #2c2e33;
     --pf-border-strong: #3c3f45;
     --pf-text: #ececee;
@@ -212,7 +216,7 @@
 
 /* ------------------------------------------------------------------ layout */
 .pf-app { min-height: 100vh; display: flex; flex-wrap: wrap; align-content: flex-start; background: var(--pf-bg); }
-.pf-sidebar { flex: 0 0 248px; align-self: stretch; border-right: 1px solid var(--pf-border); background: var(--pf-surface); }
+.pf-sidebar { flex: 0 0 var(--pf-sidebar-width); align-self: stretch; border-right: 1px solid var(--pf-border); background: var(--pf-surface); }
 .pf-sidebar__inner { position: sticky; top: 0; height: 100vh; overflow: auto; display: flex; flex-direction: column; gap: 2px; padding: 20px 12px; }
 .pf-brand { display: flex; flex-direction: column; align-items: flex-start; gap: 8px; padding: 4px 8px 18px; }
 .pf-brand__home { display: inline-block; }
@@ -306,11 +310,17 @@
 .pf-root .pf-input:focus, .pf-root .pf-textarea:focus { outline: none; border-color: var(--pf-accent); box-shadow: 0 0 0 3px var(--pf-accent-soft); }
 .pf-input--sm, .pf-select--sm { padding: 6px 10px; font-size: 13px; }
 .pf-input--lg { padding: 10px 12px; font-size: 15px; }
-.pf-input--auto, .pf-select--auto { display: inline-block; width: auto; max-width: 100%; }
+.pf-input--auto, .pf-select--auto { display: inline-block; width: auto; min-width: 0; max-width: 100%; }
 .pf-textarea { min-height: 72px; resize: vertical; }
 .pf-textarea--mono { font-family: var(--pf-mono); font-size: 13px; max-width: 360px; }
 .pf-input[aria-invalid="true"], .pf-select[aria-invalid="true"], .pf-textarea[aria-invalid="true"] { border-color: var(--pf-block); }
 .pf-input::placeholder, .pf-textarea::placeholder { color: var(--pf-text-3); }
+/* Read-only (a locked record): a filled box that does not light up on hover, so it
+   does not read as editable. It stays focusable (announced "read only") with a
+   visible, neutral focus ring. */
+.pf-root .pf-input[readonly], .pf-root .pf-textarea[readonly] { background: var(--pf-surface-2); border-color: var(--pf-border); color: var(--pf-text-2); cursor: default; resize: none; }
+.pf-root .pf-input[readonly]:hover, .pf-root .pf-textarea[readonly]:hover { border-color: var(--pf-border); }
+.pf-root .pf-input[readonly]:focus, .pf-root .pf-textarea[readonly]:focus { border-color: var(--pf-border-strong); box-shadow: 0 0 0 3px var(--pf-border); }
 .pf-label { display: block; font-size: 13px; font-weight: 600; color: var(--pf-text); margin-bottom: 6px; }
 .pf-form-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(min(100%, 220px), 1fr)); gap: 12px 16px; align-items: end; }
 .pf-field { display: flex; flex-direction: column; gap: 6px; min-width: 0; }
@@ -322,9 +332,19 @@
 .pf-title-input { width: 100%; font-size: 24px; line-height: 1.25; font-weight: 600; letter-spacing: -0.01em; border: 1px solid transparent; border-radius: var(--pf-radius-sm); background: transparent; margin-left: -8px; padding: 4px 8px; }
 .pf-title-input:hover { border-color: var(--pf-border); }
 .pf-title-input:focus { border-color: var(--pf-border-strong); background: var(--pf-surface); }
-.pf-desc-input { width: 100%; font-size: 14px; color: var(--pf-text-2); border: 1px solid transparent; border-radius: var(--pf-radius-sm); background: transparent; margin-left: -8px; padding: 3px 8px; }
+.pf-desc-input { width: 100%; font-size: 14px; color: var(--pf-text-2); border: 1px solid transparent; border-radius: var(--pf-radius-sm); background: transparent; margin-left: -8px; padding: 3px 8px; text-overflow: ellipsis; }
 .pf-desc-input:hover { border-color: var(--pf-border); }
 .pf-desc-input:focus { border-color: var(--pf-border-strong); background: var(--pf-surface); color: var(--pf-text); }
+/* A locked record's name and description: plain text that does not invite an edit. */
+/* The title shows "Untitled …" as its placeholder only while the name is blank; on a phone the
+   title is smaller, and a name or placeholder longer than the box ends in an ellipsis. */
+.pf-title-input { text-overflow: ellipsis; }
+@media (max-width: 640px) { .pf-title-input { font-size: 20px; } }
+.pf-title-input[readonly], .pf-desc-input[readonly] { cursor: default; }
+.pf-title-input[readonly]:hover, .pf-desc-input[readonly]:hover { border-color: transparent; }
+.pf-title-input[readonly]:focus, .pf-desc-input[readonly]:focus { background: transparent; }
+.pf-desc-input[readonly]:focus { color: var(--pf-text-2); }
+.pf-desc-input[readonly]::placeholder { color: transparent; }
 
 /* switch: <label class="pf-switch"><input type="checkbox" role="switch"><span class="pf-switch__track"></span>Text</label> */
 .pf-switch { display: inline-flex; align-items: center; gap: 8px; padding: 6px 12px; border: 1px solid var(--pf-border-strong); border-radius: var(--pf-radius-sm); background: var(--pf-surface); font-size: 13px; font-weight: 500; cursor: pointer; white-space: nowrap; }
@@ -363,8 +383,19 @@
 .pf-masonry__col { flex: 1 1 min(100%, 460px); min-width: 0; display: flex; flex-direction: column; gap: 16px; }
 .pf-grid-2 { display: grid; grid-template-columns: repeat(auto-fit, minmax(min(100%, 340px), 1fr)); gap: 16px; align-items: start; }
 .pf-grid-3 { display: grid; grid-template-columns: repeat(auto-fit, minmax(min(100%, 250px), 1fr)); gap: 12px; align-items: start; }
-.pf-scroll-x { overflow-x: auto; }
-.pf-scroll-y { max-height: 260px; overflow-y: auto; }
+/* A frame that scrolls sideways when a grid is wider than the page (pf_scroll_frame: a tab
+   stop with a name). It is the containing block of what it clips (position: relative): an
+   absolutely positioned descendant (a .pf-sr-only header cell) would otherwise sit at its
+   static position in the page, outside the frame's clipping, and widen the document instead
+   of scrolling with the grid. The shadows at its edges are the cue that there is more: covers
+   that move with the content (`local`) hide them on a side with nothing left to scroll to.
+   Every scroll container is positioned for the same reason (layout_lint_test.rb). */
+.pf-scroll-x { position: relative; overflow-x: auto; background-color: var(--pf-surface);
+  background-image: linear-gradient(90deg, var(--pf-surface) 50%, transparent), linear-gradient(270deg, var(--pf-surface) 50%, transparent),
+    linear-gradient(90deg, var(--pf-scroll-shadow), transparent), linear-gradient(270deg, var(--pf-scroll-shadow), transparent);
+  background-position: left center, right center, left center, right center; background-repeat: no-repeat;
+  background-size: 32px 100%, 32px 100%, 12px 100%, 12px 100%; background-attachment: local, local, scroll, scroll; }
+.pf-scroll-y { position: relative; max-height: 260px; overflow-y: auto; }
 .pf-count-pill { display: inline-flex; align-items: center; min-width: 22px; padding: 0 8px; border-radius: 999px; font-size: 12px; font-weight: 600; line-height: 20px; justify-content: center; background: var(--pf-surface-2); color: var(--pf-text-2); border: 1px solid var(--pf-border); }
 .pf-count-pill--warn { background: var(--pf-warn-soft); color: var(--pf-warn); border-color: var(--pf-warn-border); }
 
@@ -425,15 +456,44 @@
 .pf-table--sets { min-width: 560px; }
 .pf-table--sets .pf-table__head, .pf-table--sets .pf-table__row { grid-template-columns: minmax(0, 2fr) 56px 76px minmax(0, .8fr) auto; }
 .pf-table--assignments { min-width: 640px; }
-.pf-table--assignments .pf-table__head, .pf-table--assignments .pf-table__row { grid-template-columns: 24px minmax(0, 1.5fr) minmax(0, 1.2fr) minmax(0, 1fr) auto; }
+.pf-table--assignments .pf-table__head, .pf-table--assignments .pf-table__row { grid-template-columns: auto minmax(0, 1.5fr) minmax(0, 1.2fr) minmax(0, 1fr) auto; }
 .pf-table--audit { min-width: 640px; }
 .pf-table--audit .pf-table__head, .pf-table--audit .pf-table__row { grid-template-columns: 110px minmax(0, 1.6fr) minmax(0, 1fr) minmax(0, 1fr); }
+/* A table with an `auto` column (sized by its content) shares one grid between
+   its head and rows: each row on its own grid would size that column to its own
+   content, and the headers would drift off their cells. The edge tracks are
+   `auto` or `fr` (never a fixed width): a subgrid adds its padding to them. */
+@supports (grid-template-columns: subgrid) {
+  .pf-table--sets, .pf-table--assignments { display: grid; column-gap: 12px; }
+  .pf-table--sets { grid-template-columns: minmax(0, 2fr) 56px 76px minmax(0, .8fr) auto; }
+  .pf-table--assignments { grid-template-columns: auto minmax(0, 1.5fr) minmax(0, 1.2fr) minmax(0, 1fr) fit-content(40%); }
+  .pf-table--sets > .pf-table__head, .pf-table--sets > .pf-table__row,
+  .pf-table--assignments > .pf-table__head, .pf-table--assignments > .pf-table__row { grid-column: 1 / -1; grid-template-columns: subgrid; }
+}
+/* A narrow card (a phone) stacks each Assignments row instead of scrolling it
+   sideways: the checkbox, then the person, the dates and the actions one under
+   another, so the end-date menu, Reason and Remove wrap inside the row. The
+   card's width decides, not the window's (the sidebar takes room at desktop
+   widths); without container queries the card still scrolls. The head keeps
+   only its first two columns on screen (the rest stay for screen readers). */
+.pf-table-frame { container-type: inline-size; }
+@container (max-width: 639px) {
+  .pf-table-frame .pf-table--assignments { display: block; min-width: 0; }
+  .pf-table-frame .pf-table--assignments > .pf-table__head,
+  .pf-table-frame .pf-table--assignments > .pf-table__row { grid-template-columns: auto minmax(0, 1fr); padding: 10px 16px; }
+  .pf-table-frame .pf-table--assignments > * > :first-child { grid-column: 1; grid-row: 1; }
+  .pf-table-frame .pf-table--assignments > * > :not(:first-child) { grid-column: 2; }
+  .pf-table-frame .pf-table--assignments > .pf-table__head > :nth-child(n+3) {
+    position: absolute; width: 1px; height: 1px; margin: -1px; overflow: hidden; clip: rect(0, 0, 0, 0); white-space: nowrap;
+  }
+  .pf-table-frame .pf-table--assignments .pf-reason-form { max-width: 100%; }
+}
 .pf-cell-person { display: flex; align-items: center; gap: 10px; min-width: 0; }
 .pf-avatar { display: inline-grid; place-items: center; width: 30px; height: 30px; flex: 0 0 30px; border-radius: 999px; background: var(--pf-surface-2); border: 1px solid var(--pf-border); font-size: 11px; font-weight: 600; color: var(--pf-text-2); }
 .pf-avatar--sm { width: 28px; height: 28px; flex-basis: 28px; }
 .pf-avatar--lg { width: 48px; height: 48px; flex-basis: 48px; font-size: 16px; }
 .pf-person-name { font-weight: 600; }
-.pf-person-email { font-size: 12px; color: var(--pf-text-3); }
+.pf-person-email { font-size: 12px; color: var(--pf-text-3); overflow-wrap: anywhere; }
 
 /* ------------------------------------------------------------- matrices */
 .pf-matrix { min-width: 620px; }
@@ -441,7 +501,7 @@
 .pf-matrix__head { font-size: 12px; font-weight: 600; color: var(--pf-text-3); border-bottom: 1px solid var(--pf-border); }
 .pf-matrix__row { border-top: 1px solid var(--pf-border); }
 .pf-matrix__head + .pf-matrix__row { border-top: 0; }
-.pf-matrix__resource { display: flex; flex-direction: column; min-width: 0; }
+.pf-matrix__resource { display: flex; flex-direction: column; min-width: 0; overflow-wrap: anywhere; }
 .pf-matrix__resource a { font-weight: 600; color: var(--pf-text) !important; }
 .pf-matrix__chev { color: var(--pf-text-3) !important; font-size: 16px; text-align: center; text-decoration: none !important; }
 .pf-effective { min-width: 540px; }
@@ -485,6 +545,7 @@
 .pf-state[aria-current="true"], .pf-effective__field[aria-current="true"], .pf-action-pill[aria-current="true"] { box-shadow: 0 0 0 2px var(--pf-accent); }
 .pf-state .pf-cell__glyph { font-weight: 700; }
 .pf-state--records { flex-direction: column; align-items: flex-start; justify-content: center; gap: 0; min-width: 0; width: 100%; overflow: hidden; text-align: left; }
+.pf-state__summary { overflow-wrap: anywhere; }
 
 /* 4-level field control */
 .pf-levels { display: inline-flex; flex-wrap: wrap; gap: 2px; padding: 2px; border-radius: var(--pf-radius-sm); background: var(--pf-surface-2); border: 1px solid var(--pf-border); }
@@ -515,6 +576,10 @@
 .pf-root a.pf-fields__name:hover .pf-fields__label { text-decoration: underline; }
 .pf-fields__label { font-weight: 500; }
 .pf-mask-preview { font-size: 12px; color: var(--pf-mask); font-family: var(--pf-mono); white-space: nowrap; }
+/* The level control and, under it, the mask preview: the control alone sets the
+   width (the preview's own width does not count), so controls line up across rows. */
+.pf-fields__level { display: flex; flex-direction: column; align-items: stretch; gap: 2px; max-width: 100%; }
+.pf-fields__level > .pf-mask-preview { contain: inline-size; overflow: hidden; text-overflow: ellipsis; text-align: right; }
 .pf-bulk-bar { position: sticky; top: 8px; z-index: 5; display: flex; flex-wrap: wrap; align-items: center; gap: 8px 12px; padding: 10px 14px; border-radius: var(--pf-radius); background: var(--pf-text); color: var(--pf-surface); box-shadow: var(--pf-shadow); }
 .pf-bulk-bar .pf-btn { background: transparent; color: var(--pf-surface) !important; border-color: rgba(127, 127, 127, .55); }
 .pf-bulk-bar .pf-btn:hover { background: rgba(127, 127, 127, .25); }
@@ -562,7 +627,7 @@
 
 /* person picker / listbox rows */
 .pf-listbox { display: flex; flex-direction: column; border: 1px solid var(--pf-border); border-radius: var(--pf-radius); overflow: hidden; }
-.pf-listbox__scroll { max-height: 300px; overflow-y: auto; }
+.pf-listbox__scroll { position: relative; max-height: 300px; overflow-y: auto; }
 .pf-listbox--short .pf-listbox__scroll { max-height: 240px; }
 .pf-option { position: relative; display: flex; align-items: center; gap: 10px; padding: 8px 12px; border-top: 1px solid var(--pf-border); color: inherit !important; text-decoration: none !important; cursor: pointer; }
 .pf-option:first-child { border-top: 0; }
@@ -572,11 +637,14 @@
 .pf-option:has(input:disabled) { opacity: .6; cursor: not-allowed; }
 .pf-option__main { display: flex; flex-direction: column; min-width: 0; flex: 1 1 auto; }
 .pf-option__aside { font-size: 12px; color: var(--pf-text-3); white-space: nowrap; }
+/* On a phone a row's badge and count go to a second line rather than past the edge. */
+@media (max-width: 640px) { .pf-option { flex-wrap: wrap; row-gap: 4px; } }
 .pf-listbox__footer { padding: 8px 12px; background: var(--pf-surface-2); border-top: 1px solid var(--pf-border); font-size: 12px; color: var(--pf-text-2); }
 .pf-picked { display: flex; align-items: center; gap: 10px; padding: 10px 12px; border: 1px solid var(--pf-border); border-radius: var(--pf-radius); background: var(--pf-surface-2); }
 
 /* home search toolbar */
 .pf-toolbar { display: flex; flex-wrap: wrap; align-items: stretch; gap: 8px; }
+.pf-toolbar__help { flex: 1 1 100%; }
 .pf-search-field { position: relative; flex: 1 1 320px; min-width: 0; }
 .pf-search-field__icon { position: absolute; left: 12px; top: 50%; width: 16px; height: 16px; transform: translateY(-50%); color: var(--pf-text-3); pointer-events: none; }
 .pf-root .pf-search-field__input { padding: 9px 12px 9px 36px; font-size: 14px; }
@@ -616,21 +684,23 @@
 /* ------------------------------------------------------------- settings */
 .pf-setting { display: flex; flex-wrap: wrap; gap: 10px 20px; padding: 12px 16px; border-top: 1px solid var(--pf-border); scroll-margin-top: 80px; }
 .pf-setting:target, .pf-setting[data-pf-focus="true"] { background: var(--pf-accent-soft); }
-.pf-setting__about { flex: 2 1 300px; display: flex; flex-direction: column; gap: 4px; min-width: 0; }
-.pf-setting__value { flex: 1 1 240px; display: flex; flex-direction: column; align-items: flex-start; gap: 6px; min-width: 0; }
+.pf-setting__about { flex: 2 1 300px; display: flex; flex-direction: column; gap: 4px; min-width: 0; overflow-wrap: anywhere; }
+.pf-setting__value { flex: 1 1 240px; display: flex; flex-direction: column; align-items: flex-start; gap: 6px; min-width: 0; overflow-wrap: anywhere; }
+/* A value's pill wraps inside its column (a long translation must not widen the page). */
+.pf-setting__value .pf-pill { white-space: normal; max-width: 100%; }
 .pf-setting__how { flex: 0 0 auto; display: flex; flex-direction: column; align-items: flex-end; gap: 10px; }
-.pf-setting__how[open] { flex: 1 1 100%; }
+.pf-setting__how[open] { flex: 1 1 100%; min-width: 0; }
 .pf-setting__how > summary { list-style: none; }
 .pf-setting__how > summary::-webkit-details-marker { display: none; }
-.pf-setting__panel { flex: 1 1 100%; display: flex; flex-direction: column; gap: 8px; padding: 12px 14px; border-radius: var(--pf-radius); background: var(--pf-surface-2); border: 1px solid var(--pf-border); }
+.pf-setting__panel { flex: 1 1 100%; align-self: stretch; min-width: 0; display: flex; flex-direction: column; gap: 8px; padding: 12px 14px; border-radius: var(--pf-radius); background: var(--pf-surface-2); border: 1px solid var(--pf-border); }
 .pf-setting-section > summary { list-style: none; display: flex; align-items: center; gap: 10px; padding: 14px 16px; cursor: pointer; }
 .pf-setting-section > summary::-webkit-details-marker { display: none; }
 .pf-setting-section + .pf-setting-section { border-top: 1px solid var(--pf-border); }
 .pf-pill { display: inline-flex; align-items: center; gap: 4px; padding: 1px 8px; border-radius: 999px; font-size: 12px; font-weight: 600; border: 1px solid var(--pf-border); background: var(--pf-surface-2); color: var(--pf-text-2); white-space: nowrap; }
 .pf-pill--on { background: var(--pf-grant-soft); color: var(--pf-grant); border-color: var(--pf-grant-border); }
-.pf-pill--opt { font-family: var(--pf-mono); font-weight: 500; background: transparent; }
+.pf-pill--opt { font-family: var(--pf-mono); font-weight: 500; background: transparent; white-space: normal; overflow-wrap: anywhere; }
 .pf-pill--current { background: var(--pf-text); color: var(--pf-surface); border-color: var(--pf-text); }
-.pf-code { margin: 0; padding: 12px 14px; border-radius: var(--pf-radius); background: var(--pf-surface); border: 1px solid var(--pf-border); font-family: var(--pf-mono); font-size: 12.5px; line-height: 1.6; overflow-x: auto; white-space: pre; }
+.pf-code { position: relative; margin: 0; padding: 12px 14px; border-radius: var(--pf-radius); background: var(--pf-surface); border: 1px solid var(--pf-border); font-family: var(--pf-mono); font-size: 12.5px; line-height: 1.6; overflow-x: auto; white-space: pre; }
 .pf-ladder { display: grid; grid-template-columns: repeat(auto-fit, minmax(min(100%, 200px), 1fr)); gap: 10px; padding: 0 16px 14px; }
 .pf-ladder__tile { display: flex; flex-direction: column; gap: 4px; padding: 10px 12px; border-radius: var(--pf-radius); border: 1px solid var(--pf-border); background: var(--pf-surface-2); }
 .pf-ladder__tile--on { background: var(--pf-grant-soft); border-color: var(--pf-grant-border); color: var(--pf-grant); }
@@ -640,6 +710,7 @@
 .pf-audit-footer { font-size: 12px; color: var(--pf-text-3); padding-top: 12px; border-top: 1px solid var(--pf-border); }
 /* A link inside a line of text is told apart by more than its colour. */
 .pf-audit-footer a, .pf-hint a { text-decoration: underline; }
+.pf-audit-footer__hint { display: block; margin-top: 4px; }
 .pf-tech > summary { font-size: 12px; color: var(--pf-text-3); cursor: pointer; width: max-content; }
 .pf-tech__body { display: flex; flex-direction: column; gap: 8px; padding-top: 10px; font-size: 12px; color: var(--pf-text-2); }
 .pf-copy { display: inline-flex; align-items: center; gap: 8px; flex-wrap: wrap; }
@@ -651,6 +722,7 @@
 .pf-savebar__count { font-weight: 600; }
 .pf-savebar__note { font-size: 12px; opacity: .8; }
 .pf-savebar[data-pf-dirty="false"] .pf-savebar__count--dirty, .pf-savebar[data-pf-dirty="true"] .pf-savebar__count--clean { display: none; }
+.pf-js .pf-savebar--quiet[data-pf-dirty="false"] { display: none; }
 
 /* --------------------------------------------------------------- menus */
 .pf-menu { position: relative; display: inline-block; }
@@ -688,9 +760,15 @@
 .pf-close:hover { background: var(--pf-surface-2); }
 .pf-confirm { display: flex; flex-direction: column; gap: 14px; padding: 22px; }
 .pf-confirm__title { font-size: 17px; font-weight: 600; text-wrap: balance; }
-.pf-confirm__list { max-height: 200px; overflow-y: auto; padding: 10px 12px; border-radius: var(--pf-radius); background: var(--pf-surface-2); font-size: 13px; display: flex; flex-direction: column; gap: 4px; }
+.pf-confirm__list { position: relative; max-height: 200px; overflow-y: auto; padding: 10px 12px; border-radius: var(--pf-radius); background: var(--pf-surface-2); font-size: 13px; display: flex; flex-direction: column; gap: 4px; }
 .pf-confirm--danger { border-top: 3px solid var(--pf-block); }
 .pf-toasts { position: fixed; left: 50%; bottom: 24px; z-index: 60; transform: translateX(-50%); display: flex; flex-direction: column; gap: 8px; width: max-content; max-width: min(640px, calc(100% - 32px)); }
+/* A page with a sticky savebar keeps the bottom edge for it: toasts go to the top, so neither hides the other. */
+.pf-root:has(.pf-savebar) .pf-toasts { top: 16px; bottom: auto; }
+/* Beside the sidebar (desktop widths) toasts centre over the main column, never over the sidebar's footer (language, theme). */
+@media (min-width: 1024px) {
+  .pf-root:has(.pf-sidebar) .pf-toasts { left: calc(50% + var(--pf-sidebar-width) / 2); max-width: min(640px, calc(100% - var(--pf-sidebar-width) - 32px)); }
+}
 .pf-toast { display: flex; align-items: center; gap: 12px; padding: 10px 12px 10px 16px; border-radius: var(--pf-radius); background: var(--pf-text); color: var(--pf-surface); box-shadow: var(--pf-shadow); font-size: 13px; }
 .pf-toast--alert { background: var(--pf-block); color: #fff; }
 .pf-toast__text { flex: 1; min-width: 0; }
@@ -712,6 +790,8 @@
 .pf-sync > summary { list-style: none; cursor: pointer; display: flex; flex-wrap: wrap; align-items: center; gap: 6px 10px; padding: 12px 16px; color: var(--pf-warn); font-weight: 600; font-size: 13px; }
 .pf-sync > summary::-webkit-details-marker { display: none; }
 .pf-sync__body { padding: 0 16px 16px; }
+.pf-sync--info { border-color: var(--pf-border); background: var(--pf-surface); }
+.pf-sync--info > summary { color: var(--pf-text-2); }
 .pf-crud-grid { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); gap: 8px; }
 .pf-crud-grid__col { display: flex; flex-direction: column; gap: 6px; }
 .pf-scope-option { display: flex; gap: 8px; align-items: flex-start; }
@@ -762,5 +842,7 @@
 .pf-reason__body { display: flex; flex-direction: column; gap: 4px; margin-top: 8px; max-width: 420px; }
 .pf-reason--compact .pf-reason__summary { font-size: 12px; }
 .pf-reason--compact .pf-reason__body { margin-top: 6px; min-width: 200px; }
-.pf-reason-form { display: inline-flex; flex-wrap: wrap; align-items: center; gap: 6px 8px; }
+/* min-width: 0 — as a flex item (a card header, .pf-actions) the form may shrink to the line, so a
+   people <select> with long labels shrinks with it instead of pushing the form past the page. */
+.pf-reason-form { display: inline-flex; flex-wrap: wrap; align-items: center; gap: 6px 8px; min-width: 0; }
 .pf-reason-form .pf-reason--compact[open] { flex-basis: 100%; }