permission_forge 0.14.1

data/app/models/permission_forge/permission_set.rb

@@ -0,0 +1,100 @@
+module PermissionForge
+  # A named group of resource, field, action and rule grants (or, with `is_muting`, of revocations)
+  # that is assigned to users.
+  #
+  # @api public
+  class PermissionSet < ActiveRecord::Base
+    # The table name, with the configured prefix (read on every call, so a prefix set at runtime applies).
+    def self.table_name = "#{PermissionForge.table_name_prefix}permission_sets"
+
+    include PermissionForge::Concerns::HasActiveScope
+    include PermissionForge::Concerns::HasUuid
+    include PermissionForge::Concerns::ValidatesColumnLengths
+    include PermissionForge::Concerns::HasAuditTrail
+    include PermissionForge::Concerns::HasTenantScoping
+    include PermissionForge::Concerns::HasPermissionSetUsers
+    include PermissionForge::Concerns::PermissionsRegenerator
+    include PermissionForge::Concerns::InvalidatesManagedActions
+    include PermissionForge::Concerns::RecordsAuditEvents
+
+    permission_set_user_lookup :self
+
+    belongs_to :permission_set_group, class_name: 'PermissionForge::PermissionSetGroup', optional: true
+    # Every collection removes through callbacks (an audit event each):
+    # `dependent: :destroy` on :users destroys the assignment rows, never a
+    # person; AuditedCollection covers `clear` / `delete_all`.
+    has_many :resources, class_name: 'PermissionForge::Resource', dependent: :destroy, extend: Concerns::AuditedCollection
+    has_many :permission_set_rules, class_name: 'PermissionForge::PermissionSetRule', dependent: :destroy,
+                                    extend: Concerns::AuditedCollection
+    has_many :permission_set_users, class_name: 'PermissionForge::PermissionSetUser', dependent: :destroy,
+                                    inverse_of: :permission_set, extend: Concerns::AuditedCollection
+    has_many :users, through: :permission_set_users, dependent: :destroy, extend: Concerns::AuditedCollection
+
+    # Checked for a new row and on a rename only: a row whose name was
+    # blank before 0.14 stays editable in its other attributes.
+    validates :name, presence: { message: ->(*) { I18n.t('permission_forge.validations.name_blank') } },
+                     if: -> { new_record? || will_save_change_to_name? }
+    validates :name, length: { maximum: 255 }
+    # A group id must name a group (of this tenant): optional, but never dangling.
+    validates :permission_set_group,
+              presence: { message: ->(*) { I18n.t('permission_forge.validations.permission_set.group_missing') } },
+              if: -> { permission_set_group_id.present? && will_save_change_to_permission_set_group_id? }
+    validates :allowed_hours_start, numericality: { in: 0..23, allow_nil: true }
+    validates :allowed_hours_end, numericality: { in: 0..23, allow_nil: true }
+
+    scope :muting, -> { where(is_muting: true) }
+    scope :granting, -> { where(is_muting: false) }
+    scope :conditional, lambda {
+      where.not(requires_session_flag: [nil, ''])
+           .or(where.not(allowed_ips: [nil, '']))
+           .or(where.not(allowed_hours_start: nil))
+    }
+    scope :unconditional, lambda {
+      where(requires_session_flag: [nil, ''])
+        .where(allowed_ips: [nil, ''])
+        .where(allowed_hours_start: nil)
+    }
+
+    apply_tenant_scoping! # from the configuration, as the class loads (HasTenantScoping)
+
+    def active?
+      is_active
+    end
+
+    def inactive?
+      !is_active
+    end
+
+    def muting?
+      is_muting
+    end
+
+    def granting?
+      !is_muting
+    end
+
+    def conditional?
+      requires_session_flag.present? || allowed_ips.present? || allowed_hours_start.present?
+    end
+
+    def unconditional?
+      !conditional?
+    end
+
+    # Deep-clones this permission set with all resources, fields, and rules.
+    # Does NOT copy user assignments — the clone starts with no users.
+    def deep_clone(attrs = {})
+      PermissionForge::Services::PermissionSetCloner.call(permission_set: self, attrs: attrs)
+    end
+
+    private
+
+    # InvalidatesManagedActions: a new set has no resources yet and the index
+    # holds no set names, so only switching a set on or off changes what is
+    # managed. (Its resources drop the index themselves when they are added
+    # or destroyed.)
+    def managed_actions_changed?
+      !previously_new_record? && saved_change_to_is_active?
+    end
+  end
+end

data/app/models/permission_forge/permission_set_group.rb

@@ -0,0 +1,83 @@
+module PermissionForge
+  # An optional grouping of Permission Sets that is assigned to people as one.
+  #
+  # @api public
+  class PermissionSetGroup < ActiveRecord::Base
+    # The table name, with the configured prefix (read on every call, so a prefix set at runtime applies).
+    def self.table_name = "#{PermissionForge.table_name_prefix}permission_set_groups"
+
+    include PermissionForge::Concerns::HasActiveScope
+    include PermissionForge::Concerns::HasUuid
+    include PermissionForge::Concerns::ValidatesColumnLengths
+    include PermissionForge::Concerns::HasAuditTrail
+    include PermissionForge::Concerns::HasTenantScoping
+    include PermissionForge::Concerns::PermissionsRegenerator
+    include PermissionForge::Concerns::RecordsAuditEvents
+
+    # Deleting a group detaches its sets (detach_permission_sets) — not
+    # `dependent: :nullify`, whose UPDATE runs no callbacks and so leaves no
+    # audit event. A set removed from the collection (`delete`, `ids=`, `=`,
+    # `clear`) is detached the same way by `before_remove`, so Rails' own
+    # nullify that follows finds nothing left to change. Never
+    # `dependent: :destroy` here: that would delete the sets.
+    has_many :permission_sets, class_name: 'PermissionForge::PermissionSet',
+                               before_remove: :detach_permission_set, extend: Concerns::AuditedCollection
+    has_many :permission_set_group_users, class_name: 'PermissionForge::PermissionSetGroupUser', dependent: :destroy,
+                                          extend: Concerns::AuditedCollection
+    # Destroys the membership rows, never a person.
+    has_many :users, through: :permission_set_group_users, dependent: :destroy, extend: Concerns::AuditedCollection
+
+    # Checked for a new row and on a rename only: a row whose name was
+    # blank before 0.14 stays editable in its other attributes.
+    validates :name, presence: { message: ->(*) { I18n.t('permission_forge.validations.name_blank') } },
+                     if: -> { new_record? || will_save_change_to_name? }
+
+    before_destroy :detach_permission_sets
+
+    apply_tenant_scoping! # from the configuration, as the class loads (HasTenantScoping)
+
+    # Deep-clones this group with all its permission sets and their resources/fields/rules.
+    # Does NOT copy user assignments — the clone starts with no users.
+    def deep_clone(attrs = {})
+      PermissionForge::Services::PermissionSetGroupCloner.call(permission_set_group: self, attrs: attrs)
+    end
+
+    private
+
+    # before_remove of #permission_sets: an audited save (a
+    # `permission_set.updated` event) instead of Rails' UPDATE. The row is
+    # what counts, not the instance: one loaded before the set joined this
+    # group still has the old foreign key, so the stored row is detached.
+    def detach_permission_set(set)
+      return unless set.persisted?
+
+      set = in_record_tenant(PermissionForge::PermissionSet).find_by(id: set.id, permission_set_group_id: id) unless
+        set.permission_set_group_id == id
+      return unless set
+
+      set.permission_set_group_id = nil
+      set.save!(validate: false)
+    end
+
+    # One audited save per set (a `permission_set.updated` event each, in the
+    # destroy's transaction, so they share its correlation id). The sets are
+    # read in the group's own tenant. Validation is skipped: a set that an
+    # unrelated rule would now refuse (a legacy over-long name) must still let
+    # go of a group that is being deleted.
+    def detach_permission_sets
+      in_record_tenant(PermissionForge::PermissionSet).where(permission_set_group_id: id).find_each do |set|
+        set.permission_set_group_id = nil
+        set.save!(validate: false)
+      end
+    end
+
+    def users_on_permission_set
+      return [] unless is_active
+
+      ps_ids = in_record_tenant(PermissionForge::PermissionSet).where(permission_set_group_id: id, is_active: true).pluck(:id)
+      return [] if ps_ids.empty?
+
+      in_record_tenant(PermissionForge::PermissionSetUser).where(permission_set_id: ps_ids)
+    end
+  end
+end

data/app/models/permission_forge/permission_set_group_user.rb

@@ -0,0 +1,43 @@
+module PermissionForge
+  # The membership of a user in a Permission Set Group (unique per user and group).
+  #
+  # @api public
+  class PermissionSetGroupUser < ActiveRecord::Base
+    # The table name, with the configured prefix (read on every call, so a prefix set at runtime applies).
+    def self.table_name = "#{PermissionForge.table_name_prefix}permission_set_group_users"
+
+    include PermissionForge::Concerns::HasUuid
+    include PermissionForge::Concerns::ValidatesColumnLengths
+    include PermissionForge::Concerns::HasAuditTrail
+    include PermissionForge::Concerns::HasTenantScoping
+    include PermissionForge::Concerns::RecordsAuditEvents
+
+    # optional: is stated (see PermissionSetUser): the group is optional as
+    # declared since 0.13, the user is required.
+    belongs_to :permission_set_group, class_name: 'PermissionForge::PermissionSetGroup', optional: true
+    belongs_to :user, class_name: PermissionForge.configuration.user_class, optional: false
+
+    # Mirrors the DB unique index so a repeat assignment returns a 422 instead of
+    # a RecordNotUnique 500 (and prevents silent duplicate rows on schemas that
+    # predate the index).
+    validates :user_id, uniqueness: { scope: :permission_set_group_id }
+
+    # See PermissionSetUser: never store a truncated user key.
+    before_validation { PermissionForge::Services::HostKeyGuard.verify! }
+
+    # The reason of the change in progress (Audit::Context) is kept on the row.
+    before_save :keep_audit_reason
+
+    apply_tenant_scoping! # from the configuration, as the class loads (HasTenantScoping)
+
+    private
+
+    def keep_audit_reason
+      reason = PermissionForge::Audit::Context[:reason]
+      return if reason.blank? || !has_attribute?(:reason)
+      return unless new_record? || changed?
+
+      self.reason = PermissionForge::Audit::ColumnValues.value(reason.to_s)
+    end
+  end
+end

data/app/models/permission_forge/permission_set_rule.rb

@@ -0,0 +1,99 @@
+module PermissionForge
+  # A row-level query rule of a Permission Set: one operator applied to one field of one resource.
+  #
+  # @api public
+  class PermissionSetRule < ActiveRecord::Base
+    # The table name, with the configured prefix (read on every call, so a prefix set at runtime applies).
+    def self.table_name = "#{PermissionForge.table_name_prefix}permission_set_rules"
+
+    include PermissionForge::Concerns::HasActiveScope
+    include PermissionForge::Operators::Constants
+    include PermissionForge::Concerns::HasUuid
+    include PermissionForge::Concerns::ValidatesColumnLengths
+    include PermissionForge::Concerns::HasAuditTrail
+    include PermissionForge::Concerns::HasTenantScoping
+    include PermissionForge::Concerns::HasPermissionSetUsers
+    include PermissionForge::Concerns::PermissionsRegenerator
+    include PermissionForge::Concerns::RecordsAuditEvents
+
+    permission_set_user_lookup :direct
+
+    # optional: as declared since 0.13 (the foreign keys hold); stated, so the
+    # host's belongs_to_required_by_default decides nothing here.
+    belongs_to :permission_set, class_name: 'PermissionForge::PermissionSet', optional: true
+    belongs_to :resource, class_name: 'PermissionForge::Resource', optional: true
+    scope :recently_deactivated, -> { where(is_active: false).where('updated_at > ?', 7.days.ago) }
+
+    # join_type values that mean "filter on the model's own table". Any other
+    # join_type is a join rule: auto_query_scoping skips it, so it only applies
+    # through find_by/find_by! and permission_scoped.
+    FILTER_JOIN_TYPES = [nil, '', 'filter'].freeze
+    scope :join_type_rules, -> { where.not(join_type: FILTER_JOIN_TYPES) }
+
+    # Whether a join_type means "filter on the model's own table": nothing,
+    # blank or 'filter'. The one definition — the applier, the default scope
+    # and the RLS generator all ask here, so a row written past the model's
+    # validation is read the same way by all three.
+    def self.filter_join_type?(join_type)
+      join_type.blank? || join_type.to_s == 'filter'
+    end
+
+    def join_rule?
+      !self.class.filter_join_type?(join_type)
+    end
+
+    validates :operator, inclusion: {
+      in: OPERATORS,
+      message: I18n.t('permission_forge.validations.permission_set_rule.invalid_operator',
+                      default: 'is not a valid operator')
+    }
+    # An operator that takes no value (Operators::Validations.valueless?)
+    # stores an empty one: the column is NOT NULL, and the natural API payload
+    # for a null check has no field_value.
+    before_validation { self.field_value = '' if field_value.nil? && valueless_operator? }
+
+    validates :field_value, presence: {
+      message: I18n.t('permission_forge.validations.permission_set_rule.field_value_required',
+                      default: 'is required for this operator')
+    }, unless: :valueless_operator?
+    validates :join_type, inclusion: {
+      in: JOIN_TYPES,
+      message: I18n.t('permission_forge.validations.permission_set_rule.invalid_join_type',
+                      default: 'is not a valid join type')
+    }, allow_nil: true, allow_blank: false
+    validates :field_name, presence: true
+    validates :field_name, format: {
+      with: /\A[a-zA-Z_][a-zA-Z0-9_.]*\z/,
+      message: I18n.t('permission_forge.validations.permission_set_rule.invalid_field_name',
+                      default: 'must be a valid column name (letters, numbers, underscores, dots)')
+    }, allow_blank: true
+
+    validate :validate_field_name_segments, if: :field_name_changed?
+    validate :validate_field_value_for_operator
+
+    apply_tenant_scoping! # from the configuration, as the class loads (HasTenantScoping)
+
+    private
+
+    def valueless_operator?
+      PermissionForge::Operators::Validations.valueless?(operator)
+    end
+
+    # `flag.` or `a..b` passes the format above, but an empty segment makes it
+    # another name than the one written (see Operators::RuleColumn.name?).
+    # Checked for a new rule and on a rename only: a row that already carries
+    # such a name stays editable in its other attributes (it matches nothing).
+    def validate_field_name_segments
+      return if field_name.blank? || errors[:field_name].any?
+      return if PermissionForge::Operators::RuleColumn.name?(field_name)
+
+      errors.add(:field_name, I18n.t('permission_forge.validations.permission_set_rule.invalid_field_name',
+                                     default: 'must be a valid column name (letters, numbers, underscores, dots)'))
+    end
+
+    def validate_field_value_for_operator
+      result = PermissionForge::Operators::Validations.validate(operator, field_value)
+      errors.add(result[:field], result[:message]) if result
+    end
+  end
+end

data/app/models/permission_forge/permission_set_user.rb

@@ -0,0 +1,158 @@
+module PermissionForge
+  # The assignment of a Permission Set to a user (unique per user and set), optionally with an `expires_at`.
+  #
+  # @api public
+  class PermissionSetUser < ActiveRecord::Base
+    # The table name, with the configured prefix (read on every call, so a prefix set at runtime applies).
+    def self.table_name = "#{PermissionForge.table_name_prefix}permission_set_users"
+
+    include PermissionForge::Concerns::HasUuid
+    include PermissionForge::Concerns::ValidatesColumnLengths
+    include PermissionForge::Concerns::HasAuditTrail
+    include PermissionForge::Concerns::HasTenantScoping
+    include PermissionForge::Concerns::InvalidatesInBatch
+    include PermissionForge::Concerns::RecordsAuditEvents
+
+    # optional: is stated on every belongs_to: the host's
+    # belongs_to_required_by_default decides nothing here. The parent is
+    # optional, as declared since 0.13 (the foreign key holds); the user is
+    # required.
+    belongs_to :permission_set, class_name: 'PermissionForge::PermissionSet', optional: true
+    belongs_to :user, class_name: PermissionForge.configuration.user_class, optional: false
+
+    # Mirrors the DB unique index so a repeat assignment returns a 422 instead of
+    # a RecordNotUnique 500 (and prevents silent duplicate rows on schemas that
+    # predate the index). BulkPermissionSetAssignment already de-dupes; this
+    # covers the single-assignment controller/API paths.
+    validates :user_id, uniqueness: { scope: :permission_set_id }
+
+    # An integer user_id column would store a UUID or string user key as its
+    # leading digits, handing this assignment to every user who shares them.
+    before_validation { PermissionForge::Services::HostKeyGuard.verify! }
+
+    # The reason of the change in progress (Audit::Context, e.g. a ticket
+    # from the request) is kept on the row it changed.
+    before_save :keep_audit_reason
+
+    # A move to another user takes the set from the previous holder: noted
+    # at every save, invalidated with the holder after the commit
+    # (InvalidatesInBatch#note_previous_value).
+    after_save { note_previous_value('user_id') }
+
+    scope :active_assignments, -> { where(expires_at: nil).or(where(expires_at: Time.current..)) }
+    scope :expired, -> { where.not(expires_at: nil).where(expires_at: ...Time.current) }
+
+    # Permanent assignments last reviewed before `cutoff` — the access
+    # review list and StaleAssignmentAuditor. Reviewed means a "Keep"
+    # (reviewed_at), else the grant itself (created_at); a schema without
+    # the review columns (upgrade migration not run) keeps measuring from
+    # updated_at, as before.
+    scope :stale_before, ->(cutoff) { where(expires_at: nil).where(last_reviewed_column.lt(cutoff)) }
+
+    apply_tenant_scoping! # from the configuration, as the class loads (HasTenantScoping)
+
+    # The review columns exist (bin/rails generate permission_forge:upgrade).
+    def self.review_supported?
+      column_names.include?('reviewed_at')
+    end
+
+    # Arel for "when this assignment was last reviewed" (see stale_before).
+    def self.last_reviewed_column
+      table = arel_table
+      return table[:updated_at] unless review_supported?
+
+      Arel::Nodes::NamedFunction.new('COALESCE', [table[:reviewed_at], table[:created_at]])
+    end
+
+    # When this assignment was last reviewed (see stale_before).
+    def last_reviewed_at
+      return updated_at unless self.class.review_supported?
+
+      reviewed_at || created_at
+    end
+
+    # Access review "Keep": records who reviewed the assignment and when,
+    # through a normal update that writes one assignment.reviewed event
+    # (with the decision; the reason comes from Audit::Context). Without the
+    # review columns only updated_at moves, so the event is recorded itself.
+    #
+    # @param reviewer [Object, nil] the acting admin (its id is stored)
+    # @param decision [String]
+    # @return [self]
+    def mark_reviewed!(reviewer:, decision: 'keep')
+      data = { 'decision' => decision }
+      if self.class.review_supported?
+        attrs = { reviewed_at: Time.current }
+        attrs[:reviewed_by_id] = reviewer&.id if has_attribute?(:reviewed_by_id)
+        audit_as('assignment.reviewed', data: data) { update!(attrs) }
+      else
+        record_review_without_columns(data)
+      end
+      self
+    end
+
+    def deactivated?
+      active_check = PermissionForge.configuration.user_active_check
+      !active_check.call(user)
+    end
+
+    def expired?
+      expires_at.present? && expires_at < Time.current
+    end
+
+    def active_assignment?
+      !expired?
+    end
+
+    private
+
+    def record_review_without_columns(data)
+      transaction do
+        update!(updated_at: Time.current)
+        PermissionForge::Audit.record('assignment.reviewed', record: self, data: data)
+      end
+    end
+
+    def keep_audit_reason
+      reason = PermissionForge::Audit::Context[:reason]
+      return if reason.blank? || !has_attribute?(:reason)
+      return unless new_record? || changed?
+
+      self.reason = PermissionForge::Audit::ColumnValues.value(reason.to_s)
+    end
+
+    # InvalidatesInBatch (after commit, on create/update/destroy).
+    #
+    # Assigning or revoking a set must take effect immediately: invalidate the
+    # user's cached hash so the next read rebuilds it (read-through). This also
+    # covers PermissionSet#destroy — dependent: :destroy removes each assignment
+    # through callbacks, so every previously-assigned user is invalidated even
+    # though the set's own after_commit can no longer find the deleted rows.
+    def invalidate_committed_caches
+      super
+      invalidate_user_permissions
+    end
+
+    def invalidate_user_permissions
+      holders = [user_id, *previous_values('user_id')]
+      invalidate_assigned_users(holders, invalidation_batch, permission_record_tenant_id)
+    end
+
+    # RecordsAuditEvents: the event of a move names the previous holder too
+    # (its subject is the new one; data["changes"]["user_id"] has both).
+    def audit_update_details
+      return {} unless saved_change_to_user_id?
+
+      { 'previous_subject_user_id' => user_id_before_last_save&.to_s }
+    end
+
+    # The holder of this assignment is at hand when the assignment was built
+    # with it (`create!(user: user)`): no query to load it again.
+    def assigned_users(user_ids)
+      holder = association(:user).target
+      return [holder] if holder && user_ids == [holder.id]
+
+      super
+    end
+  end
+end

data/app/models/permission_forge/resource.rb

@@ -0,0 +1,100 @@
+module PermissionForge
+  # Entity-level CRUD access to one model (its `name`) inside one Permission Set.
+  #
+  # @api public
+  class Resource < ActiveRecord::Base
+    # The table name, with the configured prefix (read on every call, so a prefix set at runtime applies).
+    def self.table_name = "#{PermissionForge.table_name_prefix}resources"
+
+    include PermissionForge::Concerns::HasActiveScope
+    include PermissionForge::Concerns::HasUuid
+    include PermissionForge::Concerns::ValidatesColumnLengths
+    include PermissionForge::Concerns::HasAuditTrail
+    include PermissionForge::Concerns::HasTenantScoping
+    include PermissionForge::Concerns::HasPermissionSetUsers
+    include PermissionForge::Concerns::ValidatesDependency
+    include PermissionForge::Concerns::PermissionsRegenerator
+    include PermissionForge::Concerns::InvalidatesManagedActions
+    include PermissionForge::Concerns::RecordsAuditEvents
+
+    # A Ruby constant path: Resource#name is resolved to a model class.
+    NAME_FORMAT = PermissionForge::RESOURCE_NAME_FORMAT
+
+    permission_set_user_lookup :direct
+
+    # Active rows of active Permission Sets — the rows that count right now.
+    scope :in_effect, -> { active.joins(:permission_set).merge(PermissionForge::PermissionSet.active) }
+
+    # A model named for the first time is masked in this process and every
+    # other one (MaskingSync). Noted per save, consumed once committed.
+    after_save :note_newly_named_model
+    after_commit :announce_newly_named_model
+
+    # optional: as declared since 0.13 (the foreign key holds); stated, so the
+    # host's belongs_to_required_by_default decides nothing here.
+    belongs_to :permission_set, class_name: 'PermissionForge::PermissionSet', optional: true
+    has_many :resource_fields, class_name: 'PermissionForge::ResourceField', dependent: :destroy,
+                               extend: Concerns::AuditedCollection
+    has_many :resource_actions, class_name: 'PermissionForge::ResourceAction', dependent: :destroy,
+                                extend: Concerns::AuditedCollection
+    has_many :permission_set_rules, class_name: 'PermissionForge::PermissionSetRule', dependent: :destroy,
+                                    extend: Concerns::AuditedCollection
+
+    validates :name, presence: true
+    validates :name, uniqueness: { scope: :permission_set_id, message: 'already exists in this permission set' }
+    # Resource#name is resolved to a model class via safe_constantize (e.g. by
+    # ResourceFieldGenerator and MaskedAttributes auto-apply), so constrain it to
+    # a Ruby constant path. Prevents naming a resource after arbitrary strings.
+    validates :name, format: {
+      with: NAME_FORMAT,
+      message: I18n.t('permission_forge.validations.resource.invalid_name',
+                      default: 'must be a valid model class name (e.g. Customer or Admin::Report)')
+    }, allow_blank: true
+
+    validates_dependency :edit_access, requires: :read_access
+    validates_dependency :delete_access, requires: :read_access
+    validates_dependency :modify_all, requires: :view_all
+
+    apply_tenant_scoping! # from the configuration, as the class loads (HasTenantScoping)
+
+    # Fallback for installations that haven't added the label column yet.
+    def label
+      has_attribute?(:label) ? read_attribute(:label) : name
+    end
+
+    # For a loaded record: active, in an active Permission Set (see .in_effect).
+    def in_effect?
+      is_active && permission_set.is_active
+    end
+
+    # View All / Modify All skip every record rule on this resource.
+    def rules_bypassed?
+      view_all || modify_all
+    end
+
+    # Grants full CRUD access + all field access for a resource on a permission set.
+    # Intended for seeds, migrations, or console use only.
+    def self.grant_full_access!(permission_set:, resource_name:)
+      PermissionForge::Services::ResourceWithFieldsBuilder.call(
+        permission_set: permission_set, resource_name: resource_name
+      )
+    end
+
+    private
+
+    def note_newly_named_model
+      @pf_newly_named = true if previously_new_record? || saved_change_to_name?
+    end
+
+    # The concern is applied here whatever the other rows; the other
+    # processes are told when no other row (in any tenant) had the name, or
+    # this process had not masked the model yet (MaskingSync.named!, which
+    # asks for the other rows only when the answer decides something).
+    def announce_newly_named_model
+      return unless @pf_newly_named && persisted?
+
+      @pf_newly_named = false
+      PermissionForge::MaskingSync.named!(name) { self.class.unscoped.where(name: name).where.not(id: id).exists? }
+    end
+  end
+end

data/app/models/permission_forge/resource_action.rb

@@ -0,0 +1,58 @@
+module PermissionForge
+  # A custom action (such as sync or export) that a Permission Set permits or withholds on a resource.
+  #
+  # @api public
+  class ResourceAction < ActiveRecord::Base
+    # The table name, with the configured prefix (read on every call, so a prefix set at runtime applies).
+    def self.table_name = "#{PermissionForge.table_name_prefix}resource_actions"
+
+    include PermissionForge::Concerns::HasActiveScope
+    include PermissionForge::Concerns::HasUuid
+    include PermissionForge::Concerns::ValidatesColumnLengths
+    include PermissionForge::Concerns::HasAuditTrail
+    include PermissionForge::Concerns::HasTenantScoping
+    include PermissionForge::Concerns::HasPermissionSetUsers
+    include PermissionForge::Concerns::PermissionsRegenerator
+    include PermissionForge::Concerns::InvalidatesManagedActions
+    include PermissionForge::Concerns::RecordsAuditEvents
+
+    permission_set_user_lookup :via_resource
+
+    # optional: as declared since 0.13 (the foreign key holds); stated, so the
+    # host's belongs_to_required_by_default decides nothing here.
+    belongs_to :resource, class_name: 'PermissionForge::Resource', optional: true
+
+    # One row per (resource, name): two rows would be OR-ed, so a second row
+    # could permit what the first one blocks. New installs also have a DB unique
+    # index (idx_pf_resource_actions_unique); the validation surfaces a 422
+    # instead of a RecordNotUnique 500. Checked when a row is created, renamed
+    # or moved, so duplicates that predate the index stay editable; the
+    # security audit lists them (`duplicate_actions`).
+    # Checked for a new row and on a rename only: a row whose name was
+    # blank before 0.14 stays editable in its other attributes.
+    validates :name, presence: { message: ->(*) { I18n.t('permission_forge.validations.name_blank') } },
+                     if: -> { new_record? || will_save_change_to_name? }
+    validates :name, uniqueness: { scope: :resource_id,
+                                   message: ->(*) { I18n.t('permission_forge.errors.admin.action_taken') } },
+                     if: -> { new_record? || will_save_change_to_name? || will_save_change_to_resource_id? }
+
+    # Active rows of active resources of active Permission Sets. An action with
+    # such a row is "managed": only people a set permits can run it.
+    scope :in_effect, lambda {
+      active.joins(resource: :permission_set)
+            .merge(PermissionForge::Resource.active).merge(PermissionForge::PermissionSet.active)
+    }
+
+    apply_tenant_scoping! # from the configuration, as the class loads (HasTenantScoping)
+
+    # For a loaded record (see .in_effect).
+    def in_effect?
+      is_active && resource.in_effect?
+    end
+
+    # @return [String] the label, or the humanized name when there is none
+    def display_name
+      label.presence || name.humanize
+    end
+  end
+end