permission_forge 0.14.1

data/app/views/permission_forge/bulk_assignments/new.html.erb

@@ -0,0 +1,69 @@
+<% set = @permission_set %>
+<% content_for :pf_title, t('.title', set: set.name) %>
+<% close_path = permission_forge.permission_set_path(set, tab: 'assignments') %>
+<%= form_with url: permission_forge.permission_set_bulk_assignment_path(set), method: :post do %>
+  <% footer = capture do %>
+    <span class="pf-sheet__footer-note">
+      <% if @nobody %><span class="pf-error" role="alert"><%= t('.errors.nobody') %></span>
+      <% elsif @expiry_error %><span class="pf-error" role="alert"><%= @expiry_error %></span>
+      <% else %><%= t('permission_forge.assignments.new.applies_now') %>
+      <% end %>
+    </span>
+    <%= link_to t('permission_forge.ui.cancel'), close_path, class: 'pf-btn', data: { pf_close: true } %>
+    <button type="submit" class="pf-btn" formaction="<%= permission_forge.preview_permission_set_bulk_assignment_path(set) %>" data-pf-stay><%= t('.check') %></button>
+    <button type="submit" class="pf-btn pf-btn--primary">
+      <%= @result ? t('.assign_count', count: @result.to_assign.size) : t('.assign') %>
+    </button>
+  <% end %>
+  <%= pf_sheet_frame({ title: t('.title', set: set.name), close_path: close_path, footer: footer,
+                       breadcrumb: pf_breadcrumb([t('permission_forge.nav.permission_sets'), permission_forge.permission_sets_path], [set.name, close_path], t('.crumb')) }) do %>
+    <div class="pf-field">
+      <label class="pf-label" for="pf-bulk-text"><%= t('.paste') %></label>
+      <textarea id="pf-bulk-text" name="identifiers" rows="5" class="pf-textarea pf-textarea--mono" placeholder="<%= t('.paste_placeholder') %>"><%= @text %></textarea>
+      <span class="pf-hint"><%= t('.paste_hint') %></span>
+    </div>
+
+    <section class="pf-stack" aria-labelledby="pf-bulk-pick">
+      <%= pf_section_heading(t('.pick'), id: 'pf-bulk-pick') %>
+      <div class="pf-row pf-row--nowrap">
+        <label class="pf-sr-only" for="pf-bulk-q"><%= t('permission_forge.ui.search_people') %></label>
+        <input id="pf-bulk-q" class="pf-input" type="search" name="q" value="<%= @query %>" autocomplete="off"
+               placeholder="<%= t('permission_forge.ui.search_people') %>"
+               data-pf-live="pf-bulk-people" data-pf-live-url="<%= permission_forge.new_permission_set_bulk_assignment_path(set) %>">
+        <button type="submit" class="pf-btn pf-btn--sm" formmethod="get" formaction="<%= permission_forge.new_permission_set_bulk_assignment_path(set) %>"><%= t('permission_forge.ui.search') %></button>
+      </div>
+      <% @picked_ids.each do |id| %>
+        <% next if @people.people.any? { |p| p.id.to_s == id } %>
+        <input type="hidden" name="user_ids[]" value="<%= id %>">
+      <% end %>
+      <div id="pf-bulk-people">
+        <%= render 'permission_forge/assignments/person_options', page: @people, query: @query, field: 'user_ids', type: 'checkbox', selected: @picked_ids %>
+      </div>
+    </section>
+
+    <% if @result %>
+      <div class="pf-grid-3">
+        <div class="pf-panel pf-panel--grant pf-fs-13">
+          ✓ <%= t('.will_assign', count: @result.to_assign.size) %>
+          <% if @result.already.any? %> · <%= t('.already', count: @result.already.size) %><% end %>
+          <% if @result.to_assign.any? %>
+            <ul class="pf-stack pf-stack--tight pf-mt-8"><% @result.to_assign.each do |u| %><li><%= pf_person_name(u) %></li><% end %></ul>
+          <% end %>
+        </div>
+        <% if @result.not_found.any? %>
+          <div class="pf-panel pf-panel--block pf-fs-13">
+            ✕ <%= t('.not_found', count: @result.not_found.size) %>
+            <ul class="pf-stack pf-stack--tight pf-mt-8 pf-mono"><% @result.not_found.each do |token| %><li><%= token %></li><% end %></ul>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
+
+    <section class="pf-stack" aria-labelledby="pf-bulk-expiry">
+      <%= pf_section_heading(t('permission_forge.assignments.new.expires'), id: 'pf-bulk-expiry') %>
+      <%= render 'permission_forge/shared/expiry_picker', selected: @expiry, custom_date: @custom_date, error: @expiry_error %>
+    </section>
+
+    <%= render 'permission_forge/shared/reason_field', value: params[:reason] %>
+  <% end %>
+<% end %>

data/app/views/permission_forge/field_lookups/show.html.erb

@@ -0,0 +1,32 @@
+<% content_for :pf_title, t('permission_forge.ui.field_lookup') %>
+<%= pf_sheet_frame({ title: t('permission_forge.ui.field_lookup'), close_path: permission_forge.root_path }) do %>
+  <p class="pf-fs-13 pf-text-2"><%= t('.intro') %></p>
+  <%= form_with url: permission_forge.field_lookup_path, method: :get, class: 'pf-form-grid' do %>
+    <div class="pf-field">
+      <label class="pf-label" for="pf-lookup-resource"><%= t('permission_forge.ui.resource') %></label>
+      <select id="pf-lookup-resource" name="resource" class="pf-select" data-pf-autosubmit>
+        <option value=""><%= t('.pick_resource') %></option>
+        <% @resource_names.each do |name| %>
+          <option value="<%= name %>" <%= 'selected' if name == @resource_name %>><%= pf_resource_label(name) %> (<%= name %>)</option>
+        <% end %>
+      </select>
+    </div>
+    <div class="pf-field">
+      <label class="pf-label" for="pf-lookup-field"><%= t('.field') %></label>
+      <select id="pf-lookup-field" name="field" class="pf-select" data-pf-autosubmit <%= 'disabled' unless @resource_name %>>
+        <option value=""><%= t('.pick_field') %></option>
+        <% @field_options.each do |name, label| %>
+          <option value="<%= name %>" <%= 'selected' if name == @field %>><%= label %> (<%= name %>)</option>
+        <% end %>
+      </select>
+    </div>
+    <div><button type="submit" class="pf-btn pf-btn--sm" data-pf-js-hide><%= t('permission_forge.ui.apply') %></button></div>
+  <% end %>
+  <% if @resource_names.empty? %>
+    <p class="pf-fs-13 pf-text-3"><%= t('.no_resources') %></p>
+  <% elsif @field %>
+    <%= pf_section_heading(t('.who_can_see', field: @field_label)) %>
+    <%= render 'permission_forge/shared/across_sets', rows: @rows, key: @field %>
+    <p class="pf-hint"><%= t('.hint') %></p>
+  <% end %>
+<% end %>

data/app/views/permission_forge/home/_audit_card.html.erb

@@ -0,0 +1,19 @@
+<% problem = @attention.audit_findings.first %>
+<section class="pf-card" aria-labelledby="pf-card-audit">
+  <div class="pf-card__header">
+    <div class="pf-stack pf-stack--tight pf-grow">
+      <div class="pf-row">
+        <span class="pf-text-block" aria-hidden="true">⊘</span>
+        <h2 class="pf-h2" id="pf-card-audit"><%= t('.title') %></h2>
+      </div>
+      <p class="pf-card__desc"><%= t(".#{problem}") %></p>
+    </div>
+    <%= link_to t('permission_forge.ui.open_setting'), pf_setting_path('audit_events'), class: 'pf-btn pf-btn--sm' %>
+  </div>
+  <% if %i[missing_table failing].include?(problem) %>
+    <div class="pf-card__body">
+      <pre class="pf-code">bin/rails generate permission_forge:upgrade
+bin/rails db:migrate</pre>
+    </div>
+  <% end %>
+</section>

data/app/views/permission_forge/home/_ending_card.html.erb

@@ -0,0 +1,32 @@
+<% items = @attention.ending_soon %>
+<section class="pf-card" aria-labelledby="pf-card-ending">
+  <div class="pf-card__header">
+    <div class="pf-stack pf-stack--tight pf-grow">
+      <div class="pf-row">
+        <h2 class="pf-h2" id="pf-card-ending"><%= t('.title') %></h2>
+        <span class="pf-count-pill pf-count-pill--warn"><%= items.size %></span>
+      </div>
+      <p class="pf-card__desc"><%= t('.description') %></p>
+    </div>
+  </div>
+  <% items.each do |assignment| %>
+    <div class="pf-card__row pf-card__row--top">
+      <div class="pf-stack pf-stack--tight pf-grow">
+        <div class="pf-row pf-row--tight">
+          <%= link_to pf_person_name(assignment.user), permission_forge.person_path(assignment.user_id), class: 'pf-fw-600' %>
+          <%= pf_set_chip(assignment.permission_set) %>
+        </div>
+        <span class="pf-fs-13"><%= pf_expiry_tag(assignment.expires_at) %></span>
+      </div>
+      <div class="pf-actions">
+        <%= form_with url: permission_forge.assignment_path(assignment), method: :patch, class: 'pf-reason-form' do %>
+          <input type="hidden" name="expiry" value="extend30">
+          <input type="hidden" name="return_to" value="<%= permission_forge.root_path %>">
+          <button type="submit" class="pf-btn pf-btn--sm"><%= t('.extend') %></button>
+          <%= render 'permission_forge/shared/reason_field', compact: true, id: "pf-extend-reason-#{assignment.id}" %>
+        <% end %>
+        <%= link_to t('permission_forge.ui.open_person'), permission_forge.person_path(assignment.user_id), class: 'pf-btn pf-btn--ghost' %>
+      </div>
+    </div>
+  <% end %>
+</section>

data/app/views/permission_forge/home/_expired_card.html.erb

@@ -0,0 +1,34 @@
+<% items = @attention.expired %>
+<section class="pf-card" aria-labelledby="pf-card-expired" id="pf-cleanup">
+  <div class="pf-card__header">
+    <div class="pf-stack pf-stack--tight pf-grow">
+      <div class="pf-row">
+        <h2 class="pf-h2" id="pf-card-expired"><%= t('.title') %></h2>
+        <span class="pf-count-pill"><%= items.size %></span>
+      </div>
+      <p class="pf-card__desc"><%= t('.description', count: items.size) %></p>
+    </div>
+  </div>
+  <div class="pf-card__body">
+    <% if @cleanup_preview %>
+      <div class="pf-dryrun" role="region" aria-label="<%= t('.dry_run') %>">
+        <span class="pf-eyebrow"><%= t('.dry_run') %></span>
+        <ul class="pf-stack pf-stack--tight pf-fs-13">
+          <% items.each do |a| %>
+            <li><%= t('.item', person: pf_person_name(a.user), set: a.permission_set.name) %>
+              <span class="pf-text-3">· <%= pf_expiry(a.expires_at).first %></span></li>
+          <% end %>
+        </ul>
+        <div class="pf-actions">
+          <%= form_with url: permission_forge.maintenance_cleanup_path, method: :delete, class: 'pf-reason-form' do %>
+            <button type="submit" class="pf-btn pf-btn--danger-solid pf-btn--sm"><%= t('.remove', count: items.size) %></button>
+            <%= render 'permission_forge/shared/reason_field', compact: true, id: 'pf-cleanup-reason' %>
+          <% end %>
+          <%= link_to t('permission_forge.ui.cancel'), permission_forge.root_path, class: 'pf-btn pf-btn--sm' %>
+        </div>
+      </div>
+    <% else %>
+      <%= link_to t('.preview'), permission_forge.root_path(cleanup: 1, anchor: 'pf-cleanup'), class: 'pf-btn pf-btn--sm' %>
+    <% end %>
+  </div>
+</section>

data/app/views/permission_forge/home/_privacy_card.html.erb

@@ -0,0 +1,67 @@
+<% findings = @attention.privacy_findings %>
+<% unmasked = findings.count { |f| !f.unconfigured? } %>
+<% turned_off = findings.count(&:turned_off?) %>
+<% unconfigured = findings.count(&:unconfigured?) - turned_off %>
+<% shown = @show_all_privacy ? findings : findings.first(PermissionForge::HomeController::PRIVACY_PREVIEW) %>
+<% can_ack = PermissionForge::Admin::AttentionItems.acknowledgement_supported? %>
+<section class="pf-card" aria-labelledby="pf-card-privacy">
+  <div class="pf-card__header">
+    <div class="pf-stack pf-stack--tight pf-grow">
+      <div class="pf-row">
+        <h2 class="pf-h2" id="pf-card-privacy"><%= t('.title') %></h2>
+        <span class="pf-count-pill pf-count-pill--warn"><%= findings.size %></span>
+      </div>
+      <p class="pf-card__desc">
+        <%= t('.description', unmasked: t('.unmasked', count: unmasked), unconfigured: t('.unconfigured', count: unconfigured)) %>
+        <%= t('.turned_off', count: turned_off) if turned_off.positive? %>
+      </p>
+      <%# Not-configured and turned-off lines describe one set on its own. %>
+      <% if findings.any?(&:unconfigured?) %>
+        <p class="pf-card__desc"><%= t('.per_set_note') %></p>
+      <% end %>
+    </div>
+  </div>
+  <% shown.each do |finding| %>
+    <% resource = finding.resource %>
+    <% field_label = finding.field&.label.presence || resource.name.safe_constantize&.human_attribute_name(finding.name) || finding.name.humanize %>
+    <div class="pf-card__row pf-card__row--top">
+      <div class="pf-stack pf-stack--tight pf-grow">
+        <div class="pf-row pf-row--tight">
+          <strong><%= field_label %></strong>
+          <code class="pf-mono-key"><%= finding.name %></code>
+          <%# A row that is turned off is not "not configured": the engine skips it, and Fix opens it. %>
+          <% if finding.turned_off? %>
+            <%= pf_off_badge %>
+          <% elsif finding.unconfigured? %>
+            <%= pf_badge(t('permission_forge.ui.badges.not_configured'), variant: :unconfigured,
+                         href: pf_setting_path(finding.implicit_grant? ? 'extra_fields_default_access' : 'unconfigured_field_strategy')) %>
+          <% end %>
+        </div>
+        <span class="pf-fs-13 pf-text-warn">
+          <% where = finding.implicit_grant? ? '.where_virtual' : '.where_unconfigured' %>
+          <% where = finding.implicit_grant? ? '.where_turned_off_virtual' : '.where_turned_off' if finding.turned_off? %>
+          <%= t(finding.unconfigured? ? where : '.where',
+                resource: pf_resource_label(resource), set: finding.permission_set.name,
+                people: pf_people_text(finding.people_count)) %>
+        </span>
+      </div>
+      <div class="pf-actions">
+        <%= pf_modal_link t('.fix'), permission_forge.permission_set_resource_field_path(finding.permission_set, resource.name, finding.name),
+                          kind: 'drawer', class: 'pf-btn pf-btn--sm' %>
+        <% if can_ack && !finding.unconfigured? && !pf_locked_record?(finding.field) %>
+          <%= form_with url: permission_forge.acknowledge_permission_set_resource_field_path(finding.permission_set, resource.name, finding.name),
+                        method: :post, class: 'pf-reason-form' do %>
+            <input type="hidden" name="return_to" value="<%= permission_forge.root_path %>">
+            <button type="submit" class="pf-btn pf-btn--ghost"><%= t('.intended') %></button>
+            <%= render 'permission_forge/shared/reason_field', compact: true, id: "pf-ack-reason-#{finding.field&.id || finding.name}" %>
+          <% end %>
+        <% end %>
+      </div>
+    </div>
+  <% end %>
+  <% if !@show_all_privacy && findings.size > shown.size %>
+    <div class="pf-card__footer">
+      <%= link_to t('.show_all', count: findings.size), permission_forge.root_path(privacy: 'all'), class: 'pf-btn pf-btn--ghost' %>
+    </div>
+  <% end %>
+</section>

data/app/views/permission_forge/home/_rules_card.html.erb

@@ -0,0 +1,23 @@
+<% items = @attention.unenforced_rules %>
+<% mode = @attention.auto_query_scoping? ? 'join_rules' : 'scoping_off' %>
+<section class="pf-card" aria-labelledby="pf-card-rules">
+  <div class="pf-card__header">
+    <div class="pf-stack pf-stack--tight pf-grow">
+      <div class="pf-row">
+        <h2 class="pf-h2" id="pf-card-rules"><%= t('.title') %></h2>
+        <span class="pf-count-pill pf-count-pill--warn"><%= items.size %></span>
+      </div>
+      <p class="pf-card__desc"><%= t(".#{mode}") %> <%= pf_setting_link('auto_query_scoping') %></p>
+    </div>
+  </div>
+  <% items.each do |item| %>
+    <div class="pf-card__row">
+      <div class="pf-stack pf-stack--tight pf-grow">
+        <strong><%= t('.rules', count: item.rule_count, resource: pf_resource_label(item.resource), name: item.permission_set.name) %></strong>
+        <span class="pf-fs-13 pf-text-2"><%= t('.people', count: item.people_count) %></span>
+      </div>
+      <%= link_to t('.open'), permission_forge.permission_set_resource_path(item.permission_set, item.resource.name, tab: 'rules'),
+                  class: 'pf-btn pf-btn--sm' %>
+    </div>
+  <% end %>
+</section>

data/app/views/permission_forge/home/_stale_card.html.erb

@@ -0,0 +1,39 @@
+<% items = @attention.stale %>
+<% granters = pf_granters(items) %>
+<section class="pf-card" aria-labelledby="pf-card-stale">
+  <div class="pf-card__header">
+    <div class="pf-stack pf-stack--tight pf-grow">
+      <div class="pf-row">
+        <h2 class="pf-h2" id="pf-card-stale"><%= t('.title') %></h2>
+        <span class="pf-count-pill pf-count-pill--warn"><%= items.size %></span>
+      </div>
+      <p class="pf-card__desc"><%= t('.description', days: @attention.stale_days) %></p>
+    </div>
+  </div>
+  <div class="pf-scroll-y">
+    <% items.each do |assignment| %>
+      <div class="pf-card__row pf-card__row--top">
+        <div class="pf-stack pf-stack--tight pf-grow">
+          <div class="pf-row pf-row--tight">
+            <%= link_to pf_person_name(assignment.user), permission_forge.person_path(assignment.user_id), class: 'pf-fw-600' %>
+            <%= pf_set_chip(assignment.permission_set) %>
+          </div>
+          <span class="pf-row pf-row--tight pf-fs-13">
+            <%= pf_reviewed(assignment) %>
+            <span class="pf-text-3">· <%= t('.assigned', date: pf_date(assignment.created_at), by: pf_granted_by(assignment, granters)) %></span>
+          </span>
+        </div>
+        <div class="pf-actions">
+          <%= form_with url: permission_forge.keep_assignment_path(assignment), method: :post, class: 'pf-reason-form' do %>
+            <input type="hidden" name="return_to" value="<%= permission_forge.root_path %>">
+            <button type="submit" class="pf-btn pf-btn--sm"><%= t('permission_forge.ui.keep') %></button>
+            <%= render 'permission_forge/shared/reason_field', compact: true, id: "pf-keep-reason-#{assignment.id}" %>
+          <% end %>
+          <%= pf_lock_badge if pf_locked_record?(assignment.permission_set) %>
+          <%= pf_modal_link t('permission_forge.ui.remove'), permission_forge.remove_assignment_path(assignment, return_to: permission_forge.root_path),
+                            class: 'pf-btn pf-btn--ghost-danger' %>
+        </div>
+      </div>
+    <% end %>
+  </div>
+</section>

data/app/views/permission_forge/home/_tidy_card.html.erb

@@ -0,0 +1,18 @@
+<% items = @attention.tidy %>
+<section class="pf-card" aria-labelledby="pf-card-tidy">
+  <div class="pf-card__header">
+    <div class="pf-row pf-grow">
+      <h2 class="pf-h2" id="pf-card-tidy"><%= t('.title') %></h2>
+      <span class="pf-count-pill"><%= items.size %></span>
+    </div>
+  </div>
+  <% items.each do |item| %>
+    <div class="pf-card__row">
+      <div class="pf-stack pf-stack--tight pf-grow">
+        <strong><%= t(".#{item.kind}", name: item.permission_set.name, count: item.people_count) %></strong>
+        <span class="pf-fs-13 pf-text-2"><%= t(".#{item.kind}_hint") %></span>
+      </div>
+      <%= link_to t('.open'), permission_forge.permission_set_path(item.permission_set), class: 'pf-btn pf-btn--sm' %>
+    </div>
+  <% end %>
+</section>

data/app/views/permission_forge/home/index.html.erb

@@ -0,0 +1,69 @@
+<% content_for :pf_title, t('.title') %>
+<div class="pf-page-header">
+  <div class="pf-page-header__text">
+    <h1 class="pf-h1"><%= t('.title') %></h1>
+    <p class="pf-subtitle">
+      <%= t('.subtitle', things: t('.things', count: @attention.total),
+                         people: t('.people', count: @people_with_access),
+                         sets: t('.sets', count: @active_sets)) %>
+    </p>
+  </div>
+  <%= pf_modal_link t('permission_forge.ui.assign_set'), permission_forge.new_assignment_path, kind: 'drawer', class: 'pf-btn pf-btn--primary' %>
+</div>
+
+<div class="pf-toolbar">
+  <%= form_with url: permission_forge.people_path, method: :get, class: 'pf-search-field', role: 'search' do %>
+    <label class="pf-sr-only" for="pf-home-q"><%= t('.lookup') %></label>
+    <svg class="pf-search-field__icon" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.6"
+         aria-hidden="true" focusable="false"><circle cx="7" cy="7" r="4.5"/><path d="m10.5 10.5 3 3"/></svg>
+    <input id="pf-home-q" class="pf-input pf-search-field__input" type="search" name="q" autocomplete="off"
+           placeholder="<%= t('.search_placeholder') %>">
+  <% end %>
+  <%= pf_modal_link t('permission_forge.ui.field_lookup'), permission_forge.field_lookup_path, kind: 'drawer',
+                    class: 'pf-btn', title: t('.field_lookup_title') %>
+</div>
+
+<% if @first_run %>
+  <section class="pf-card" aria-labelledby="pf-first-run">
+    <div class="pf-card__body pf-stack pf-stack--loose">
+      <div class="pf-stack pf-stack--tight">
+        <h2 class="pf-h2" id="pf-first-run"><%= t('.first_run.title') %></h2>
+        <p class="pf-card__desc"><%= t('.first_run.body') %></p>
+      </div>
+      <ol class="pf-steps">
+        <% %w[create add assign].each_with_index do |step, i| %>
+          <li class="pf-step">
+            <span class="pf-step__num" aria-hidden="true"><%= i + 1 %></span>
+            <strong><%= t(".first_run.steps.#{step}.title") %></strong>
+            <span class="pf-fs-13 pf-text-2"><%= t(".first_run.steps.#{step}.body") %></span>
+          </li>
+        <% end %>
+      </ol>
+      <div>
+        <%= pf_modal_link t('.first_run.cta'), permission_forge.new_permission_set_path, class: 'pf-btn pf-btn--primary' %>
+      </div>
+    </div>
+  </section>
+<% elsif @attention.all_good? %>
+  <section class="pf-card">
+    <div class="pf-all-good">
+      <span class="pf-all-good__icon" aria-hidden="true">✓</span>
+      <h2 class="pf-h2"><%= t('.all_good.title') %></h2>
+      <p class="pf-card__desc"><%= t('.all_good.body', days: @attention.stale_days) %></p>
+    </div>
+  </section>
+<% else %>
+  <%# Two independent stacks (no shared grid rows), so a tall card never leaves
+      a gap in the other column. Cards alternate in priority order. %>
+  <% cards = { 'audit_card' => @attention.audit_findings, 'privacy_card' => @attention.privacy_findings, 'rules_card' => @attention.unenforced_rules,
+               'ending_card' => @attention.ending_soon,
+               'expired_card' => @attention.expired, 'stale_card' => @attention.stale,
+               'tidy_card' => @attention.tidy }.select { |_, items| items.any? }.keys %>
+  <div class="pf-masonry">
+    <% cards.partition.with_index { |_, i| i.even? }.reject(&:empty?).each do |column| %>
+      <div class="pf-masonry__col">
+        <% column.each do |card| %><%= render card %><% end %>
+      </div>
+    <% end %>
+  </div>
+<% end %>

data/app/views/permission_forge/people/_access_tab.html.erb

@@ -0,0 +1,58 @@
+<% first_name = pf_person(@person).first_name %>
+<% granters = pf_granters(@assignments) %>
+<div class="pf-stack pf-stack--loose">
+  <div class="pf-card">
+    <% if @assignments.empty? %>
+      <p class="pf-empty"><%= t('.empty', name: first_name) %></p>
+    <% end %>
+    <% @assignments.each do |assignment| %>
+      <% set = assignment.permission_set %>
+      <div class="pf-assignment">
+        <div class="pf-assignment__main">
+          <div class="pf-row pf-row--tight"><%= pf_set_chip(set, large: true, expired: assignment.expired?) %></div>
+          <% if set.description.present? %><span class="pf-fs-13 pf-text-2"><%= set.description %></span><% end %>
+          <% if set.conditional? %>
+            <span class="pf-row pf-row--tight pf-fs-13 pf-text-accent">◷ <%= pf_condition_sentence(set) %> <%= pf_fail_open_badge if pf_fail_open? %></span>
+          <% end %>
+          <% unless set.is_active %>
+            <span class="pf-fs-13 pf-text-3">○ <%= t('.set_off') %></span>
+          <% end %>
+          <span class="pf-fs-12 pf-text-3"><%= t('.assigned', date: pf_date(assignment.created_at), by: pf_granted_by(assignment, granters)) %></span>
+        </div>
+        <div class="pf-assignment__when">
+          <%= pf_expiry_tag(assignment.expires_at) %>
+          <%= pf_reviewed(assignment) %>
+        </div>
+        <div class="pf-assignment__actions">
+          <%= pf_lock_badge if pf_locked_record?(set) %>
+          <%= form_with url: permission_forge.assignment_path(assignment), method: :patch, class: 'pf-row pf-row--tight' do %>
+            <input type="hidden" name="return_to" value="<%= permission_forge.person_path(@person) %>">
+            <label class="pf-sr-only" for="pf-exp-<%= assignment.id %>"><%= t('.change_end') %></label>
+            <select id="pf-exp-<%= assignment.id %>" name="expiry" class="pf-select pf-select--sm pf-select--auto" data-pf-autosubmit>
+              <option value="" selected><%= t('.change_end') %>…</option>
+              <% PermissionForge::Admin::ExpiryPresets::CHANGE_KEYS.each do |key| %>
+                <option value="<%= key %>"><%= t("permission_forge.ui.expiry_change.#{key}") %></option>
+              <% end %>
+            </select>
+            <button type="submit" class="pf-btn pf-btn--xs" data-pf-js-hide><%= t('permission_forge.ui.apply') %></button>
+            <%= render 'permission_forge/shared/reason_field', compact: true, id: "pf-exp-reason-#{assignment.id}" %>
+          <% end %>
+          <% if pf_stale?(assignment) %>
+            <%= form_with url: permission_forge.keep_assignment_path(assignment), method: :post, class: 'pf-reason-form' do %>
+              <input type="hidden" name="return_to" value="<%= permission_forge.person_path(@person) %>">
+              <button type="submit" class="pf-btn pf-btn--xs"><%= t('permission_forge.ui.keep') %></button>
+              <%= render 'permission_forge/shared/reason_field', compact: true, id: "pf-keep-reason-#{assignment.id}" %>
+            <% end %>
+          <% end %>
+          <%= pf_modal_link t('permission_forge.ui.remove'), permission_forge.remove_assignment_path(assignment, return_to: permission_forge.person_path(@person)),
+                            class: 'pf-btn pf-btn--ghost-danger' %>
+        </div>
+      </div>
+    <% end %>
+  </div>
+  <% if @groups.any? %>
+    <p class="pf-fs-13 pf-text-2">
+      <%= t('.groups_html', groups: safe_join(@groups.map { |g| link_to(g.permission_set_group.name, permission_forge.group_path(g.permission_set_group)) }, ', ')) %>
+    </p>
+  <% end %>
+</div>

data/app/views/permission_forge/people/_audit_tab.html.erb

@@ -0,0 +1,93 @@
+<% if @audit_refused %>
+  <%= render 'permission_forge/shared/audit_refused_note' %>
+<% else %>
+<% first_name = pf_person(@person).first_name %>
+<% total = @changes.values.sum(&:size) %>
+<% granters = pf_granters(@assignments) %>
+<div class="pf-stack pf-stack--loose">
+  <% unless PermissionForge.configuration.audit_trail_enabled %>
+    <div class="pf-banner pf-banner--warn" role="note">
+      <span class="pf-banner__glyph" aria-hidden="true">⚠</span>
+      <div class="pf-banner__body"><span><%= t('.disabled') %></span></div>
+      <%= link_to t('permission_forge.ui.open_setting'), pf_setting_path('audit_trail_enabled'), class: 'pf-btn pf-btn--xs' %>
+    </div>
+  <% end %>
+
+  <%= render 'permission_forge/shared/audit_timeline',
+             title: t('.timeline', name: first_name), description: t('.timeline_desc', name: first_name),
+             page: @timeline, lookups: @timeline_lookups,
+             path: ->(number) { permission_forge.person_path(@person, tab: 'audit', views: params[:views].presence, page: number) },
+             views_path: (permission_forge.person_path(@person, tab: 'audit', views: 1) unless @timeline_log.include_views?),
+             links: [[t('.events_about', name: first_name), pf_audit_log_path(subject_user_id: @person.id)],
+                     [t('.events_by', name: first_name), pf_audit_log_path(actor_type: 'user', actor_id: @person.id)]] %>
+
+  <section class="pf-card" aria-labelledby="pf-received">
+    <div class="pf-card__header"><h2 class="pf-h2" id="pf-received"><%= t('.received') %></h2></div>
+    <% if @assignments.empty? && @groups.empty? %>
+      <p class="pf-card__row pf-text-3"><%= t('.no_assignments') %></p>
+    <% end %>
+    <% @assignments.each do |a| %>
+      <div class="pf-card__row pf-card__row--top">
+        <span class="pf-stack pf-stack--tight pf-grow">
+          <span><b><%= a.permission_set.name %></b> <span class="pf-fs-12 pf-text-3"><%= t(a.permission_set.is_muting ? '.kind_muting' : '.kind_set') %></span></span>
+          <span class="pf-fs-12 pf-text-3"><%= t('.assigned_by', who: pf_granted_by(a, granters), date: pf_date(a.created_at)) %></span>
+          <% if a.try(:reason).present? %><span class="pf-fs-12 pf-text-3"><%= t('permission_forge.audit_log.reason_inline', reason: a.reason) %></span><% end %>
+        </span>
+        <span class="pf-stack pf-stack--tight pf-fs-12">
+          <%= pf_expiry_tag(a.expires_at) %>
+          <%= pf_reviewed(a) %>
+        </span>
+      </div>
+    <% end %>
+    <% @groups.each do |m| %>
+      <div class="pf-card__row">
+        <span class="pf-stack pf-stack--tight pf-grow">
+          <span><b><%= m.permission_set_group.name %></b> <span class="pf-fs-12 pf-text-3"><%= t('.kind_group') %></span></span>
+          <span class="pf-fs-12 pf-text-3"><%= t('.assigned_by', who: pf_person_name(m.try(:created_by)), date: pf_date(m.created_at)) %></span>
+        </span>
+      </div>
+    <% end %>
+  </section>
+
+  <section class="pf-card" aria-labelledby="pf-made">
+    <div class="pf-card__header">
+      <div class="pf-stack pf-stack--tight pf-grow">
+        <h2 class="pf-h2" id="pf-made"><%= t('.made_by', name: first_name) %></h2>
+        <span class="pf-card__desc"><%= t('.made_by_desc', name: first_name, count: total) %></span>
+      </div>
+      <% if total.positive? %>
+        <%= link_to t('permission_forge.ui.export_csv'), permission_forge.person_path(@person, tab: 'audit', format: :csv), class: 'pf-btn pf-btn--sm' %>
+      <% end %>
+    </div>
+    <% if total.zero? %>
+      <p class="pf-card__row pf-text-3"><%= t('.made_none', name: first_name) %></p>
+    <% end %>
+    <% if @changes_capped %>
+      <p class="pf-card__row pf-fs-13 pf-text-2"><%= t('.made_capped', count: PermissionForge::PeopleController::CHANGES_SHOWN) %></p>
+    <% end %>
+    <div class="pf-card__body pf-stack">
+      <% @changes.each do |type, entries| %>
+        <div class="pf-listbox">
+          <div class="pf-listbox__footer pf-fw-600"><%= pf_audit_type_label(type) %> · <%= entries.size %></div>
+          <div class="pf-listbox__scroll pf-scroll-y">
+            <% entries.each do |entry| %>
+              <% _type_label, label, where = pf_audit_describe(entry) %>
+              <% path = pf_audit_path(entry) %>
+              <%= link_to (path || '#'), class: 'pf-option' do %>
+                <span class="pf-option__main">
+                  <span class="pf-fw-600"><%= label %></span>
+                  <% if where %><span class="pf-fs-12 pf-text-3"><%= where %></span><% end %>
+                </span>
+                <span class="pf-stack pf-stack--tight pf-option__aside">
+                  <span><%= t('.created', value: pf_audit_who_when(entry.created_by, entry.created_at)) %></span>
+                  <span><%= t('.edited', value: pf_audit_edited(entry)) %></span>
+                </span>
+              <% end %>
+            <% end %>
+          </div>
+        </div>
+      <% end %>
+    </div>
+  </section>
+</div>
+<% end %>

data/app/views/permission_forge/people/_effective_field_source.html.erb

@@ -0,0 +1,11 @@
+<% if field.blocked_by.any? %>
+  <%= t('.muted_by', set: field.blocked_by.map(&:name).to_sentence) %>
+<% elsif field.unconfigured %>
+  <%= t('.unconfigured', behaviour: t("permission_forge.ui.unconfigured.#{PermissionForge.configuration.unconfigured_field_strategy}", default: t('permission_forge.ui.unconfigured.block'))) %>
+<% elsif field.granted_by.any? %>
+  <%= t('.from', set: field.granted_by.first.name) %><%= t('.and_more', count: field.granted_by.size - 1) if field.granted_by.size > 1 %>
+<% elsif field.implicit %>
+  <%= t('.virtual') %>
+<% else %>
+  <%= t('.none') %>
+<% end %>