permission_forge 0.14.1

data/app/models/permission_forge/resource_field.rb

@@ -0,0 +1,69 @@
+module PermissionForge
+  # Column-level read, edit and mask access to one field of a resource.
+  #
+  # @api public
+  class ResourceField < ActiveRecord::Base
+    # The table name, with the configured prefix (read on every call, so a prefix set at runtime applies).
+    def self.table_name = "#{PermissionForge.table_name_prefix}resource_fields"
+
+    include PermissionForge::Concerns::HasActiveScope
+    include PermissionForge::Concerns::HasUuid
+    include PermissionForge::Concerns::ValidatesColumnLengths
+    include PermissionForge::Concerns::HasAuditTrail
+    include PermissionForge::Concerns::HasTenantScoping
+    include PermissionForge::Concerns::HasPermissionSetUsers
+    include PermissionForge::Concerns::ValidatesDependency
+    include PermissionForge::Concerns::PermissionsRegenerator
+    include PermissionForge::Concerns::RecordsAuditEvents
+
+    permission_set_user_lookup :via_resource
+
+    # optional: as declared since 0.13 (the foreign key holds); stated, so the
+    # host's belongs_to_required_by_default decides nothing here.
+    belongs_to :resource, class_name: 'PermissionForge::Resource', optional: true
+
+    # Active rows of active resources of active Permission Sets — the rows the
+    # engine merges. A switched-off row counts as no row.
+    scope :in_effect, lambda {
+      active.joins(resource: :permission_set)
+            .merge(PermissionForge::Resource.active).merge(PermissionForge::PermissionSet.active)
+    }
+
+    # A duplicate (resource_id, name) row would let a second field entry with
+    # mask_access: false silently unmask the field via FieldPermissionMerger's
+    # AND logic. Enforced by a DB unique index (idx_pf_resource_fields_unique)
+    # as well; the validation surfaces a 422 instead of a RecordNotUnique 500.
+    # No case_sensitive option: the check then compares the way the column's
+    # collation does, and so the way the index does. On MySQL's default
+    # (case-insensitive) collation "Email" collides with "email" in the index;
+    # a forced case-sensitive check would let it through to a RecordNotUnique.
+    # Checked for a new row and on a rename only: a row whose name was
+    # blank before 0.14 stays editable in its other attributes.
+    validates :name, presence: { message: ->(*) { I18n.t('permission_forge.validations.name_blank') } },
+                     if: -> { new_record? || will_save_change_to_name? }
+    validates :name, uniqueness: { scope: :resource_id }
+
+    validates_dependency :edit_access, requires: :read_access
+    validates_dependency :mask_access, requires: :read_access
+
+    validates :mask_strategy, presence: {
+                                message: I18n.t('permission_forge.validations.resource_field.mask_strategy_required',
+                                                default: 'must be present when mask access is enabled')
+                              },
+                              if: :mask_access?
+    validates :mask_strategy, inclusion: {
+                                in: ->(_) { PermissionForge::Services::MaskValue.strategies.keys },
+                                message: I18n.t('permission_forge.validations.resource_field.invalid_mask_strategy',
+                                                default: 'is not a valid mask strategy')
+                              },
+                              if: :mask_access?
+
+    apply_tenant_scoping! # from the configuration, as the class loads (HasTenantScoping)
+
+    private
+
+    def mask_access?
+      mask_access == true
+    end
+  end
+end

data/app/views/layouts/permission_forge/application.html.erb

@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html lang="<%= I18n.locale %>" class="pf-root" data-theme="<%= pf_theme %>">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="robots" content="noindex, nofollow">
+  <title><%= [content_for(:pf_title).presence, t('permission_forge.layouts.application.title')].compact.join(' · ') %></title>
+  <%= csrf_meta_tags %>
+  <%= csp_meta_tag if respond_to?(:csp_meta_tag) %>
+  <link rel="icon" href="<%= pf_asset_url('favicon.ico') %>" sizes="any">
+  <link rel="icon" href="<%= pf_asset_url('favicon.svg') %>" type="image/svg+xml">
+  <link rel="apple-touch-icon" href="<%= pf_asset_url('apple-touch-icon.png') %>">
+  <link rel="stylesheet" href="<%= pf_asset_url('pf_admin.css') %>"<%= pf_nonce_attribute(:style) %>>
+  <script src="<%= pf_asset_url('pf_admin.js') %>" defer<%= pf_nonce_attribute(:script) %>></script>
+  <%= render 'permission_forge/shared/head_extra' %>
+</head>
+<body class="pf-body">
+  <a class="pf-skip" href="#pf-main"><%= t('permission_forge.layouts.application.skip_to_content') %></a>
+  <div class="pf-app">
+    <%= render 'permission_forge/shared/topbar' %>
+    <%= render 'permission_forge/shared/sidebar' %>
+    <main id="pf-main" class="pf-main" tabindex="-1">
+      <div class="pf-main__inner">
+        <%= yield %>
+      </div>
+    </main>
+  </div>
+  <%= render 'permission_forge/shared/toasts' %>
+</body>
+</html>

data/app/views/layouts/permission_forge/fragment.html.erb

@@ -0,0 +1,2 @@
+<%# Bare content for pages loaded into a drawer/dialog by pf_admin.js. %>
+<%= yield %>

data/app/views/permission_forge/assignments/_person_options.html.erb

@@ -0,0 +1,26 @@
+<%# Person picker rows. Locals: page (PeopleDirectory::Page), query, field, type ('radio'|'checkbox'),
+    selected (ids), invalid (error text). %>
+<% selected = Array(local_assigns[:selected]).map(&:to_s) %>
+<% invalid = local_assigns[:invalid] %>
+<div class="pf-listbox" <%= pf_attrs_when(invalid, aria: { invalid: true }) %>>
+  <div class="pf-listbox__scroll" role="group" aria-label="<%= t('.label') %>">
+    <% if page.people.empty? %>
+      <p class="pf-option pf-text-3"><%= query.present? ? t('.no_match', query: query) : t('.nobody') %></p>
+    <% end %>
+    <% page.people.each do |person| %>
+      <% label = pf_person(person) %>
+      <label class="pf-option">
+        <input type="<%= type %>" name="<%= type == 'checkbox' ? "#{field}[]" : field %>" value="<%= person.id %>" <%= 'checked' if selected.include?(person.id.to_s) %>>
+        <%= pf_avatar(person, size: 'sm') %>
+        <span class="pf-option__main">
+          <span class="pf-fw-600 pf-ellipsis"><%= label.name %></span>
+          <% if label.secondary %><span class="pf-fs-12 pf-text-3 pf-ellipsis"><%= label.secondary %></span><% end %>
+        </span>
+      </label>
+    <% end %>
+  </div>
+  <% if page.total > page.people.size %>
+    <div class="pf-listbox__footer"><%= t('.capped', shown: page.people.size, total: page.total) %></div>
+  <% end %>
+</div>
+<% if invalid %><p class="pf-error" role="alert"><%= invalid %></p><% end %>

data/app/views/permission_forge/assignments/confirm_destroy.html.erb

@@ -0,0 +1,24 @@
+<% person = pf_person_name(@assignment.user) %>
+<% set = @assignment.permission_set %>
+<% content_for :pf_title, t('.title', set: set.name, name: person) %>
+<%= pf_dialog_frame({ title: t('.title', set: set.name, name: person), danger: true,
+                     breadcrumb: pf_breadcrumb([t('permission_forge.nav.people'), permission_forge.people_path], [person, permission_forge.person_path(@assignment.user_id)], t('.crumb')) }) do %>
+  <p class="pf-text-2">
+    <% first = pf_person(@assignment.user).first_name %>
+    <% if set.is_muting %>
+      <%= t('.body_muting', name: first, set: set.name) %>
+    <% elsif @lost.any? %>
+      <%= t('.body', name: first, resources: @lost.to_sentence) %>
+    <% else %>
+      <%= t('.body_nothing', name: first) %>
+    <% end %>
+  </p>
+  <%= form_with url: permission_forge.assignment_path(@assignment), method: :delete, class: 'pf-confirm-form' do %>
+    <%= render 'permission_forge/shared/reason_field' %>
+    <div class="pf-actions pf-row--right">
+      <input type="hidden" name="return_to" value="<%= params[:return_to] %>">
+      <%= link_to t('permission_forge.ui.cancel'), pf_back_or(permission_forge.person_path(@assignment.user_id)), class: 'pf-btn', data: { pf_close: true } %>
+      <button type="submit" class="pf-btn pf-btn--danger-solid"><%= t('permission_forge.ui.remove') %></button>
+    </div>
+  <% end %>
+<% end %>

data/app/views/permission_forge/assignments/new.html.erb

@@ -0,0 +1,99 @@
+<% content_for :pf_title, t('.title') %>
+<% errors = @errors || {} %>
+<% title = if @person then t('.title_person', name: pf_person_name(@person))
+           elsif @preset_set then t('.title_set', set: @preset_set.name)
+           else t('.title') end %>
+<% close_path = pf_back_or(@person ? permission_forge.person_path(@person) : permission_forge.people_path) %>
+<%= form_with url: permission_forge.assignments_path, method: :post, id: 'pf-assign-form' do %>
+  <input type="hidden" name="return_to" value="<%= params[:return_to] %>">
+  <% footer = capture do %>
+    <span class="pf-sheet__footer-note">
+      <% if errors.any? %>
+        <% errors.each_value do |msg| %><span class="pf-error" role="alert"><%= msg %></span> <% end %>
+      <% elsif @person && @chosen_sets.any? %>
+        <%= t('.summary', name: pf_person_name(@person), sets: @chosen_sets.map(&:name).to_sentence,
+                          until: (@expiry == 'never' ? t('.forever') : t('.until', date: pf_expiry_preset_date(@expiry) || @custom_date))) %>
+      <% else %>
+        <%= t('.applies_now') %>
+      <% end %>
+    </span>
+    <%= link_to t('permission_forge.ui.cancel'), close_path, class: 'pf-btn', data: { pf_close: true } %>
+    <button type="submit" class="pf-btn pf-btn--primary">
+      <%= @chosen_sets.size > 1 ? t('.assign_many', count: @chosen_sets.size) : t('.assign') %>
+    </button>
+  <% end %>
+
+  <%= pf_sheet_frame({ title: title, close_path: close_path, footer: footer }) do %>
+    <%# 1. Person %>
+    <section class="pf-stack" aria-labelledby="pf-assign-person">
+      <%= pf_section_heading("1. #{t('.person')}", id: 'pf-assign-person') %>
+      <% if @person %>
+        <input type="hidden" name="user_id" value="<%= @person.id %>">
+        <div class="pf-picked">
+          <%= pf_person_cell(@person) %>
+          <button type="submit" class="pf-btn pf-btn--xs pf-ml-auto" formmethod="get" formaction="<%= permission_forge.new_assignment_path %>"
+                  name="change_person" value="1"><%= t('.change') %></button>
+        </div>
+      <% else %>
+        <div class="pf-row pf-row--nowrap">
+          <label class="pf-sr-only" for="pf-assign-q"><%= t('permission_forge.ui.search_people') %></label>
+          <input id="pf-assign-q" class="pf-input" type="search" name="q" value="<%= @query %>" autocomplete="off" autofocus
+                 placeholder="<%= t('permission_forge.ui.search_people') %>"
+                 data-pf-live="pf-assign-people" data-pf-live-url="<%= permission_forge.new_assignment_path %>">
+          <button type="submit" class="pf-btn pf-btn--sm" formmethod="get" formaction="<%= permission_forge.new_assignment_path %>" name="search" value="1"><%= t('permission_forge.ui.search') %></button>
+        </div>
+        <div id="pf-assign-people">
+          <%= render 'person_options', page: @people, query: @query, field: 'user_id', type: 'radio', invalid: errors[:person] %>
+        </div>
+      <% end %>
+    </section>
+
+    <%# 2. Permission Sets %>
+    <section class="pf-stack" aria-labelledby="pf-assign-sets">
+      <%= pf_section_heading("2. #{t('permission_forge.nav.permission_sets')}", id: 'pf-assign-sets') %>
+      <div class="pf-row pf-row--nowrap">
+        <label class="pf-sr-only" for="pf-assign-set-q"><%= t('.filter_sets') %></label>
+        <input id="pf-assign-set-q" class="pf-input pf-input--sm" type="search" name="set_q" value="<%= @set_query %>"
+               placeholder="<%= t('.filter_sets') %>" data-pf-live="pf-assign-set-list" data-pf-live-url="<%= permission_forge.new_assignment_path %>">
+      </div>
+      <div id="pf-assign-set-list" class="pf-listbox">
+        <div class="pf-listbox__scroll" role="group" aria-label="<%= t('permission_forge.nav.permission_sets') %>">
+          <% if @sets.empty? %>
+            <p class="pf-option pf-text-3"><%= t('.no_sets') %></p>
+          <% end %>
+          <% @sets.each do |set| %>
+            <% has = @existing_ids.include?(set.id) %>
+            <label class="pf-option">
+              <input type="checkbox" name="set_ids[]" value="<%= set.id %>" <%= 'checked' if @selected_ids.include?(set.id) && !has %> <%= 'disabled' if has %>>
+              <span class="pf-option__main">
+                <span class="pf-row pf-row--tight">
+                  <span class="pf-fw-600"><%= set.name %></span>
+                  <% if has %><%= pf_badge(t('.already')) %><% end %>
+                  <% if set.is_muting %><%= pf_badge("⊘ #{t('permission_forge.ui.badges.muting')}", variant: :muting) %><% end %>
+                  <% unless set.is_active %><%= pf_off_badge %><% end %>
+                </span>
+                <% if set.description.present? %><span class="pf-fs-12 pf-text-3"><%= set.description %></span><% end %>
+              </span>
+              <span class="pf-option__aside"><%= pf_people_text(@people_counts.fetch(set.id, 0)) %></span>
+            </label>
+          <% end %>
+        </div>
+      </div>
+      <% muting = @chosen_sets.select(&:is_muting) %>
+      <% if muting.any? %>
+        <div class="pf-banner pf-banner--muting">
+          <span class="pf-banner__glyph" aria-hidden="true">⊘</span>
+          <div class="pf-banner__body"><span><%= t('.muting_notice', sets: muting.map(&:name).to_sentence, name: @person ? pf_person(@person).first_name : t('.this_person')) %></span></div>
+        </div>
+      <% end %>
+    </section>
+
+    <%# 3. Expiry %>
+    <section class="pf-stack" aria-labelledby="pf-assign-expiry">
+      <%= pf_section_heading("3. #{t('.expires')}", id: 'pf-assign-expiry') %>
+      <%= render 'permission_forge/shared/expiry_picker', selected: @expiry, custom_date: @custom_date, error: errors[:expiry] %>
+    </section>
+
+    <%= render 'permission_forge/shared/reason_field', value: params[:reason] %>
+  <% end %>
+<% end %>

data/app/views/permission_forge/audit_events/index.html.erb

@@ -0,0 +1,161 @@
+<% content_for :pf_title, t('.title') %>
+<% filters = @log.filters %>
+<% value = ->(key) { pf_audit_filter_value(filters, key) } %>
+<% invalid = ->(key) { @errors&.key?(key.to_sym) ? tag.attributes('aria-invalid': 'true') : '' } %>
+<div class="pf-page-header">
+  <div class="pf-page-header__text">
+    <h1 class="pf-h1"><%= t('.title') %></h1>
+    <p class="pf-subtitle"><%= t('.subtitle') %></p>
+  </div>
+  <div class="pf-actions">
+    <%= link_to t('.holdings'), permission_forge.holdings_audit_events_path(format: :csv), class: 'pf-btn', title: t('.holdings_title') %>
+  </div>
+</div>
+
+<% if (problem = PermissionForge::Admin::AuditLog.recording_problem) %>
+  <%= render 'permission_forge/shared/audit_off_note', problem: problem %>
+<% end %>
+
+<% if @errors %>
+  <div class="pf-banner pf-banner--block" role="alert" id="pf-audit-errors">
+    <span class="pf-banner__glyph" aria-hidden="true">⊘</span>
+    <div class="pf-banner__body">
+      <span class="pf-banner__title"><%= t('.invalid.title') %></span>
+      <ul class="pf-audit-errors">
+        <% @errors.each do |name, messages| %>
+          <li><%= pf_audit_filter_error(name, messages, value.(name.to_s)) %></li>
+        <% end %>
+      </ul>
+    </div>
+  </div>
+<% end %>
+
+<%= form_with url: permission_forge.audit_events_path, method: :get, class: 'pf-card pf-audit-filters', role: 'search',
+              'aria-label': t('.filters.label') do %>
+  <div class="pf-card__body pf-audit-filters__grid">
+    <p class="pf-hint pf-audit-filters__zone"><%= t('.filters.time_zone', zone: PermissionForge::Admin::AuditLogDays.zone_name) %></p>
+    <div class="pf-field">
+      <label class="pf-label" for="pf-audit-from"><%= t('.filters.from') %></label>
+      <input id="pf-audit-from" class="pf-input pf-input--sm" type="date" name="from" value="<%= value.('from') %>" <%= invalid.('from') %>>
+    </div>
+    <div class="pf-field">
+      <label class="pf-label" for="pf-audit-to"><%= t('.filters.to') %></label>
+      <input id="pf-audit-to" class="pf-input pf-input--sm" type="date" name="to" value="<%= value.('to') %>" <%= invalid.('to') %>>
+    </div>
+    <div class="pf-field">
+      <label class="pf-label" for="pf-audit-event"><%= t('.filters.event') %></label>
+      <select id="pf-audit-event" class="pf-select pf-select--sm" name="event" <%= invalid.('event') %>>
+        <option value=""><%= t('.filters.any_event') %></option>
+        <% PermissionForge::Admin::AuditLog.event_names_by_category.each do |category, names| %>
+          <optgroup label="<%= pf_audit_category_label(category) %>">
+            <% names.each do |name| %>
+              <option value="<%= name %>" <%= 'selected' if value.('event') == name %>><%= name %></option>
+            <% end %>
+          </optgroup>
+        <% end %>
+        <% if value.('event').present? && PermissionForge::Admin::AuditLog.event_names_by_category.values.flatten.exclude?(value.('event')) %>
+          <option value="<%= value.('event') %>" selected><%= value.('event') %></option>
+        <% end %>
+      </select>
+    </div>
+    <div class="pf-field">
+      <label class="pf-label" for="pf-audit-category"><%= t('.filters.category') %></label>
+      <select id="pf-audit-category" class="pf-select pf-select--sm" name="category" <%= invalid.('category') %>>
+        <option value=""><%= t('.filters.any_category') %></option>
+        <% PermissionForge::AuditEvent::CATEGORIES.each do |category| %>
+          <option value="<%= category %>" <%= 'selected' if value.('category') == category %>><%= pf_audit_category_label(category) %></option>
+        <% end %>
+      </select>
+    </div>
+    <div class="pf-field">
+      <label class="pf-label" for="pf-audit-actor-type"><%= t('.filters.actor_type') %></label>
+      <select id="pf-audit-actor-type" class="pf-select pf-select--sm" name="actor_type" <%= invalid.('actor_type') %>>
+        <option value=""><%= t('.filters.any_actor_type') %></option>
+        <% PermissionForge::AuditEvent::ACTOR_TYPES.each do |type| %>
+          <option value="<%= type %>" <%= 'selected' if value.('actor_type') == type %>><%= pf_audit_actor_type_label(type) %></option>
+        <% end %>
+      </select>
+    </div>
+    <div class="pf-field">
+      <label class="pf-label" for="pf-audit-actor"><%= t('.filters.actor_id') %></label>
+      <input id="pf-audit-actor" class="pf-input pf-input--sm" type="text" name="actor_id" value="<%= value.('actor_id') %>"
+             list="pf-audit-people" autocomplete="off" placeholder="<%= t('.filters.id_placeholder') %>" <%= invalid.('actor_id') %>>
+    </div>
+    <div class="pf-field">
+      <label class="pf-label" for="pf-audit-person"><%= t('.filters.subject_user_id') %></label>
+      <input id="pf-audit-person" class="pf-input pf-input--sm" type="text" name="subject_user_id" value="<%= value.('subject_user_id') %>"
+             list="pf-audit-people" autocomplete="off" placeholder="<%= t('.filters.id_placeholder') %>" <%= invalid.('subject_user_id') %>>
+    </div>
+    <div class="pf-field">
+      <label class="pf-label" for="pf-audit-set"><%= t('.filters.permission_set') %></label>
+      <% sets = PermissionForge::PermissionSet.order(:name).pluck(:id, :name) %>
+      <select id="pf-audit-set" class="pf-select pf-select--sm" name="permission_set" <%= invalid.('permission_set') %>>
+        <option value=""><%= t('.filters.any_set') %></option>
+        <% sets.each do |id, name| %>
+          <option value="<%= id %>" <%= 'selected' if value.('permission_set') == id.to_s %>><%= name %></option>
+        <% end %>
+        <% if value.('permission_set').present? && sets.none? { |id, _| id.to_s == value.('permission_set') } %>
+          <option value="<%= value.('permission_set') %>" selected><%= t('.filters.deleted_set', id: value.('permission_set')) %></option>
+        <% end %>
+      </select>
+    </div>
+    <div class="pf-field">
+      <label class="pf-label" for="pf-audit-correlation"><%= t('.filters.correlation_id') %></label>
+      <input id="pf-audit-correlation" class="pf-input pf-input--sm" type="text" name="correlation_id" value="<%= value.('correlation_id') %>"
+             autocomplete="off" <%= invalid.('correlation_id') %>>
+    </div>
+    <% record_filter = %w[record_type record_id record_uuid].any? { |key| filters.key?(key) } %>
+    <% %w[record_type record_id record_uuid].each do |key| %>
+      <% if record_filter %>
+        <div class="pf-field">
+          <label class="pf-label" for="pf-audit-<%= key.dasherize %>"><%= t(".filters.#{key}") %></label>
+          <input id="pf-audit-<%= key.dasherize %>" class="pf-input pf-input--sm" type="text" name="<%= key %>" value="<%= value.(key) %>"
+                 autocomplete="off" <%= invalid.(key) %>>
+        </div>
+      <% end %>
+    <% end %>
+    <% unless @errors %>
+      <datalist id="pf-audit-people">
+        <% PermissionForge::Admin::AuditLog.known_people.each do |id, label| %>
+          <option value="<%= id %>"><%= label.presence || t('permission_forge.audit_log.person_id', id: id) %></option>
+        <% end %>
+      </datalist>
+    <% end %>
+    <label class="pf-checkbox pf-audit-filters__views">
+      <input type="checkbox" name="views" value="1" <%= 'checked' if params[:views].to_s == '1' %>>
+      <span><%= t('.filters.views') %></span>
+    </label>
+  </div>
+  <div class="pf-card__footer pf-card__footer--muted">
+    <button type="submit" class="pf-btn pf-btn--primary pf-btn--sm"><%= t('.filters.apply') %></button>
+    <% if @log.link_params.any? %>
+      <%= link_to t('.filters.clear'), permission_forge.audit_events_path, class: 'pf-btn pf-btn--sm' %>
+    <% end %>
+    <% unless @errors %>
+      <span class="pf-ml-auto pf-row pf-row--tight">
+        <span class="pf-fs-13 pf-text-2"><%= t('.export') %></span>
+        <%= link_to 'CSV', permission_forge.audit_events_path(filters.merge(format: :csv)), class: 'pf-btn pf-btn--sm', title: t('.export_title', kind: 'CSV') %>
+        <%= link_to 'JSON', permission_forge.audit_events_path(filters.merge(format: :json)), class: 'pf-btn pf-btn--sm', title: t('.export_title', kind: 'JSON') %>
+      </span>
+    <% end %>
+  </div>
+<% end %>
+
+<% if @page %>
+  <section class="pf-card" aria-labelledby="pf-audit-results">
+    <div class="pf-card__header">
+      <h2 class="pf-h2" id="pf-audit-results"><%= t('.results', count: @page.total) %></h2>
+      <span class="pf-card__desc"><%= t('.newest_first') %></span>
+    </div>
+    <% unless @log.include_views? %>
+      <p class="pf-card__row pf-fs-13 pf-text-2 pf-audit-views-note">
+        <%= t('.views_hidden') %>
+        <%= link_to t('.views_show'), permission_forge.audit_events_path(@log.link_params.merge('views' => '1')) %>
+      </p>
+    <% end %>
+    <%= render 'permission_forge/shared/audit_events', events: @page.events, lookups: @lookups,
+               empty: (filters.any? ? t('.empty_filtered') : t('permission_forge.audit_log.empty')) %>
+    <%= render 'permission_forge/shared/audit_pagination', page: @page,
+               path: ->(number) { permission_forge.audit_events_path(@log.link_params.merge(page: number)) } %>
+  </section>
+<% end %>

data/app/views/permission_forge/audit_events/show.html.erb

@@ -0,0 +1,146 @@
+<% d = @detail %>
+<% event = d.event %>
+<% lookups = d.lookups %>
+<% content_for :pf_title, t('.title', event: event.event) %>
+<%= pf_breadcrumb([t('permission_forge.audit_events.index.title'), permission_forge.audit_events_path], event.event) %>
+
+<div class="pf-page-header">
+  <div class="pf-page-header__text">
+    <div class="pf-row pf-row--tight">
+      <%= pf_audit_category_badge(event.category) %>
+      <span class="pf-mono-key"><%= event.event %></span>
+    </div>
+    <h1 class="pf-h1"><%= pf_audit_sentence(event, lookups) %></h1>
+    <p class="pf-subtitle"><%= pf_datetime(event.occurred_at) %> · <time datetime="<%= event.occurred_at.utc.iso8601(6) %>"><%= event.occurred_at.utc.iso8601 %></time></p>
+  </div>
+</div>
+
+<div class="pf-grid-2">
+  <section class="pf-card" aria-labelledby="pf-event-who">
+    <div class="pf-card__header"><h2 class="pf-h2" id="pf-event-who"><%= t('.who') %></h2></div>
+    <dl class="pf-card__body pf-kv">
+      <dt><%= t('.actor') %></dt>
+      <dd>
+        <span class="pf-fw-600"><%= pf_audit_actor_name(event) %></span>
+        <span class="pf-text-3">· <%= pf_audit_actor_type_label(event.actor_type) %><% if d.actor_id? %> · <%= t('.id', id: event.actor_id) %><% end %></span>
+        <div class="pf-row pf-row--tight pf-fs-12">
+          <%= link_to t('.all_by_actor'), pf_audit_log_path(actor_type: event.actor_type, actor_id: event.actor_id) %>
+          <% if d.actor_user %>· <%= link_to t('.open_person'), permission_forge.person_path(d.actor_user) %><% end %>
+        </div>
+      </dd>
+      <dt><%= t('.source') %></dt>
+      <dd><%= pf_audit_source_label(event.source) %> <span class="pf-mono-key"><%= event.source %></span></dd>
+      <dt><%= t('.reason') %></dt>
+      <dd><%= event.reason.presence || t('.no_reason') %></dd>
+      <dt><%= t('.request_id') %></dt>
+      <dd class="pf-audit-code"><%= event.request_id.presence || t('permission_forge.audit_log.no_value') %></dd>
+      <dt><%= t('.ip') %></dt>
+      <dd class="pf-audit-code"><%= event.ip.presence || t('permission_forge.audit_log.no_value') %></dd>
+    </dl>
+  </section>
+
+  <section class="pf-card" aria-labelledby="pf-event-what">
+    <div class="pf-card__header"><h2 class="pf-h2" id="pf-event-what"><%= t('.what') %></h2></div>
+    <dl class="pf-card__body pf-kv">
+      <dt><%= t('.record') %></dt>
+      <dd>
+        <% if d.record? %>
+          <span class="pf-fw-600"><%= pf_audit_record_name(event) %></span>
+          <div class="pf-fs-12 pf-text-3"><span class="pf-audit-code"><%= event.record_type %></span><% if d.record_id? %> · <%= t('.id', id: event.record_id) %><% end %></div>
+          <% if d.record_uuid? %><div class="pf-fs-12 pf-audit-code pf-text-3"><%= event.record_uuid %></div><% end %>
+          <% if d.record_id? %>
+            <div class="pf-fs-12"><%= link_to t('.all_for_record'), pf_audit_log_path(record_type: event.record_type, record_id: event.record_id) %></div>
+          <% end %>
+        <% else %>
+          <%= t('permission_forge.audit_log.no_value') %>
+        <% end %>
+      </dd>
+      <dt><%= t('.permission_set') %></dt>
+      <dd>
+        <% if d.permission_set? %>
+          <% if d.permission_set %><%= link_to pf_audit_set_name(event, lookups), permission_forge.permission_set_path(d.permission_set) %><% else %><%= pf_audit_set_name(event, lookups) %><% end %>
+          <div class="pf-fs-12"><%= link_to t('.all_for_set'), pf_audit_log_path(permission_set: d.permission_set_key) %></div>
+        <% else %>
+          <%= t('permission_forge.audit_log.no_value') %>
+        <% end %>
+      </dd>
+      <dt><%= t('.person') %></dt>
+      <dd>
+        <% if d.subject_user? %>
+          <% if d.person %><%= link_to pf_audit_person_name(event, lookups), permission_forge.person_path(d.person) %><% else %><%= pf_audit_person_name(event, lookups) %><% end %>
+          <span class="pf-text-3">· <%= t('.id', id: event.subject_user_id) %></span>
+          <div class="pf-fs-12"><%= link_to t('.all_for_person'), pf_audit_log_path(subject_user_id: event.subject_user_id) %></div>
+        <% else %>
+          <%= t('permission_forge.audit_log.no_value') %>
+        <% end %>
+      </dd>
+      <dt><%= t('.correlation') %></dt>
+      <dd>
+        <% if d.correlation? %>
+          <span class="pf-audit-code pf-fs-12"><%= event.correlation_id %></span>
+          <div class="pf-fs-12"><%= link_to t('.all_in_action'), pf_audit_log_path(correlation_id: event.correlation_id) %></div>
+        <% else %>
+          <%= t('permission_forge.audit_log.no_value') %>
+        <% end %>
+      </dd>
+      <dt><%= t('.uuid') %></dt>
+      <dd class="pf-audit-code pf-fs-12"><%= event.uuid %></dd>
+    </dl>
+  </section>
+</div>
+
+<% if d.changes? %>
+  <section class="pf-card pf-scroll-x" aria-labelledby="pf-event-changes">
+    <div class="pf-card__header">
+      <h2 class="pf-h2" id="pf-event-changes"><%= t('.changes') %></h2>
+      <span class="pf-card__desc"><%= t('.changes_desc', count: d.changes_count) %></span>
+    </div>
+    <table class="pf-audit-table">
+      <thead><tr><th scope="col"><%= t('.attribute') %></th><th scope="col"><%= t('.before') %></th><th scope="col"><%= t('.after') %></th></tr></thead>
+      <tbody>
+        <% d.change_rows.each do |attribute, from, to| %>
+          <tr>
+            <th scope="row" class="pf-audit-code"><%= attribute %></th>
+            <td class="pf-audit-table__before"><span class="pf-sr-only"><%= t('.before') %>: </span><%= pf_audit_value(from) %></td>
+            <td class="pf-audit-table__after"><span aria-hidden="true">→ </span><span class="pf-sr-only"><%= t('.after') %>: </span><%= pf_audit_value(to) %></td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  </section>
+<% end %>
+
+<% if d.snapshot? %>
+  <section class="pf-card pf-scroll-x" aria-labelledby="pf-event-snapshot">
+    <div class="pf-card__header">
+      <h2 class="pf-h2" id="pf-event-snapshot"><%= t('.snapshot') %></h2>
+      <span class="pf-card__desc"><%= d.snapshot_of_removed? ? t('.snapshot_destroyed') : t('.snapshot_desc') %></span>
+    </div>
+    <table class="pf-audit-table">
+      <thead><tr><th scope="col"><%= t('.attribute') %></th><th scope="col"><%= t('.value') %></th></tr></thead>
+      <tbody>
+        <% d.snapshot_rows.each do |attribute, attribute_value| %>
+          <tr><th scope="row" class="pf-audit-code"><%= attribute %></th><td><%= pf_audit_value(attribute_value) %></td></tr>
+        <% end %>
+      </tbody>
+    </table>
+  </section>
+<% end %>
+
+<% if d.other? %>
+  <section class="pf-card pf-scroll-x" aria-labelledby="pf-event-data">
+    <div class="pf-card__header"><h2 class="pf-h2" id="pf-event-data"><%= t('.data') %></h2></div>
+    <table class="pf-audit-table">
+      <thead><tr><th scope="col"><%= t('.key') %></th><th scope="col"><%= t('.value') %></th></tr></thead>
+      <tbody>
+        <% d.other_rows.each do |key, data_value| %>
+          <tr><th scope="row" class="pf-audit-code"><%= key %></th><td class="pf-audit-code"><%= pf_audit_value(data_value) %></td></tr>
+        <% end %>
+      </tbody>
+    </table>
+  </section>
+<% end %>
+
+<% if d.no_data? %>
+  <p class="pf-fs-13 pf-text-3"><%= t('.no_data') %></p>
+<% end %>

data/app/views/permission_forge/bulk_assignments/confirm_revoke.html.erb

@@ -0,0 +1,21 @@
+<% set = @permission_set %>
+<% back = permission_forge.permission_set_path(set, tab: 'assignments') %>
+<% content_for :pf_title, t('.title', count: @people.size, set: set.name) %>
+<%= pf_dialog_frame({ title: t('.title', count: @people.size, set: set.name), danger: true,
+                     breadcrumb: pf_breadcrumb([t('permission_forge.nav.permission_sets'), permission_forge.permission_sets_path], [set.name, back], t('.crumb')) }) do %>
+  <% if @people.empty? %>
+    <p class="pf-text-2"><%= t('.none') %></p>
+    <div class="pf-actions pf-row--right"><%= link_to t('permission_forge.ui.close'), back, class: 'pf-btn', data: { pf_close: true } %></div>
+  <% else %>
+    <p class="pf-text-2"><%= t('.body') %></p>
+    <ul class="pf-confirm__list"><% @people.each do |u| %><li><%= pf_person_name(u) %></li><% end %></ul>
+    <%= form_with url: permission_forge.revoke_permission_set_bulk_assignment_path(set), method: :delete, class: 'pf-confirm-form' do %>
+      <%= render 'permission_forge/shared/reason_field' %>
+      <div class="pf-actions pf-row--right">
+        <% @people.each do |u| %><input type="hidden" name="user_ids[]" value="<%= u.id %>"><% end %>
+        <%= link_to t('permission_forge.ui.cancel'), back, class: 'pf-btn', data: { pf_close: true } %>
+        <button type="submit" class="pf-btn pf-btn--danger-solid"><%= t('.confirm', count: @people.size) %></button>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>