permission_forge 0.14.1

data/app/views/permission_forge/permission_set_rules/_builder.html.erb

@@ -0,0 +1,145 @@
+<% form = @form %>
+<% set = @permission_set %>
+<% resource = @resource %>
+<% back = permission_forge.permission_set_resource_path(set, resource.name, tab: 'rules') %>
+<% builder = rule_builder %>
+<% errors = builder.errors %>
+<% refresh = permission_forge.refresh_permission_set_resource_rules_path(set, resource.name) %>
+<%= form_with url: url, method: method, scope: :rule do %>
+  <% if @rule&.persisted? %><input type="hidden" name="rule_id" value="<%= @rule.id %>"><% end %>
+  <%# The form's default button. Without it, Enter in a text input submits through the refresh
+      button below: the builder is re-rendered on its own page and the rule is not saved. %>
+  <button type="submit" class="pf-sr-only" tabindex="-1" aria-hidden="true"><%= t('.save') %></button>
+  <%# Hidden button used to re-render the builder after shape-changing selects. %>
+  <button type="submit" formaction="<%= refresh %>" formmethod="post" name="_method" value="post" hidden data-pf-refresh-button><%= t('.update_form') %></button>
+  <% footer = capture do %>
+    <span class="pf-sheet__footer-note">
+      <% builder.error_codes.each do |code| %><span class="pf-error" role="alert"><%= t(".errors.#{code}") %></span> <% end %>
+      <% builder.model_errors.each do |msg| %><span class="pf-error" role="alert"><%= msg %></span> <% end %>
+    </span>
+    <%= link_to t('permission_forge.ui.cancel'), back, class: 'pf-btn', data: { pf_close: true } %>
+    <button type="submit" class="pf-btn pf-btn--primary"><%= t('.save') %></button>
+  <% end %>
+  <%= pf_sheet_frame({ title: title, subtitle: set.name, close_path: back, footer: footer,
+                       breadcrumb: pf_breadcrumb([t('permission_forge.nav.permission_sets'), permission_forge.permission_sets_path],
+                                                 [set.name, permission_forge.permission_set_path(set)], [pf_resource_label(resource), back], title) }) do %>
+    <% if builder.ignored_warning? %>
+      <div class="pf-banner pf-banner--warn"><span class="pf-banner__glyph" aria-hidden="true">⚠</span>
+        <div class="pf-banner__body"><span><%= t('.ignored_warning') %></span></div></div>
+    <% end %>
+
+    <%# 1. Name %>
+    <div class="pf-field">
+      <label class="pf-label" for="pf-rule-name">1. <%= t('.name') %></label>
+      <input id="pf-rule-name" class="pf-input" type="text" name="rule[name]" value="<%= form.name %>" placeholder="<%= t('.name_placeholder') %>"
+             <%= pf_attrs_when(errors[:name], aria: { invalid: true }) %>>
+    </div>
+
+    <%# 2. Field (with relationship path) %>
+    <div class="pf-stack">
+      <span class="pf-label">2. <%= t('.field') %></span>
+      <div class="pf-builder-path">
+        <span class="pf-token"><%= pf_resource_plural(resource.name) %></span>
+        <% builder.steps.each_with_index do |(model, assoc), i| %>
+          <span aria-hidden="true">›</span>
+          <label class="pf-sr-only" for="pf-rule-path-<%= i %>"><%= t('.relationship') %></label>
+          <select id="pf-rule-path-<%= i %>" name="rule[path][]" class="pf-select pf-select--sm pf-select--rel" data-pf-refresh>
+            <% model.associations.each do |a| %>
+              <option value="<%= a.name %>" <%= 'selected' if assoc&.name == a.name %>><%= a.label %></option>
+            <% end %>
+          </select>
+          <button type="submit" formaction="<%= refresh %>" name="rule[remove_step]" value="<%= i %>" class="pf-btn pf-btn--ghost pf-btn--xs"
+                  aria-label="<%= t('.remove_step') %>">×</button>
+        <% end %>
+        <span aria-hidden="true">›</span>
+        <label class="pf-sr-only" for="pf-rule-field"><%= t('.field') %></label>
+        <select id="pf-rule-field" name="rule[field_name]" class="pf-select pf-select--sm" data-pf-refresh <%= pf_attrs_when(errors[:field], aria: { invalid: true }) %>>
+          <option value=""><%= t('.pick_field') %></option>
+          <% form.field_options.each do |col| %>
+            <option value="<%= col.name %>" <%= 'selected' if builder.field_selected?(col) %>><%= col.label %> (<%= col.name %>)</option>
+          <% end %>
+        </select>
+      </div>
+      <% if builder.follow? %>
+        <div class="pf-row">
+          <label class="pf-fs-13 pf-text-2" for="pf-rule-follow">+ <%= t('.follow') %></label>
+          <select id="pf-rule-follow" name="rule[path][]" class="pf-select pf-select--sm pf-select--auto" data-pf-refresh>
+            <option value="" selected>—</option>
+            <% builder.follow_options.each do |a| %><option value="<%= a.name %>"><%= a.label %></option><% end %>
+          </select>
+          <button type="submit" formaction="<%= refresh %>" class="pf-btn pf-btn--xs" data-pf-js-hide><%= t('.update_form') %></button>
+        </div>
+      <% end %>
+      <% if form.follows_relationship? %>
+        <code class="pf-mono-key">field_accessor_path: <%= form.path.join('.') %></code>
+      <% end %>
+      <% if builder.model_missing? %><p class="pf-error" role="alert"><%= t('.model_missing') %></p><% end %>
+    </div>
+
+    <%# 3. Condition %>
+    <div class="pf-stack">
+      <span class="pf-label">3. <%= t('.condition') %></span>
+      <div class="pf-condition">
+        <label class="pf-sr-only" for="pf-rule-op"><%= t('.operator') %></label>
+        <select id="pf-rule-op" name="rule[operator]" class="pf-select pf-select--auto" data-pf-refresh>
+          <% form.operators.each do |op| %>
+            <option value="<%= op %>" <%= 'selected' if builder.operator_selected?(op) %>><%= pf_operator_label(op) %></option>
+          <% end %>
+        </select>
+        <button type="submit" formaction="<%= refresh %>" class="pf-btn pf-btn--xs" data-pf-js-hide><%= t('.update_form') %></button>
+        <%= render 'value_input', form: form, invalid: errors[:value] %>
+      </div>
+      <% if form.nullable? %>
+        <label class="pf-checkbox">
+          <input type="checkbox" name="rule[include_nulls]" value="1" <%= 'checked' if form.include_nulls %>>
+          <span><%= t('.include_nulls', field: form.column&.label || t('.this_field')) %></span>
+        </label>
+      <% end %>
+    </div>
+
+    <%# 4. Blocked message %>
+    <div class="pf-field">
+      <label class="pf-label" for="pf-rule-msg">4. <%= t('.message') %> <span class="pf-fs-12 pf-text-3 pf-fw-500"><%= t('.optional') %></span></label>
+      <textarea id="pf-rule-msg" class="pf-textarea" name="rule[failure_message]" rows="2" placeholder="<%= t('.message_placeholder') %>"><%= form.failure_message %></textarea>
+    </div>
+
+    <%# Advanced %>
+    <details class="pf-panel" <%= 'open' if builder.advanced_open? %>>
+      <summary class="pf-fw-600"><%= t('.advanced') %> <span class="pf-fs-12 pf-text-3 pf-fw-500"><%= t('.advanced_hint') %></span></summary>
+      <div class="pf-stack pf-mt-12">
+        <div class="pf-choices" role="radiogroup" aria-label="<%= t('.join') %>">
+          <% builder.join_choices.each do |choice| %>
+            <label class="pf-choice">
+              <input type="radio" name="rule[join]" value="<%= choice.join %>" <%= 'checked' if choice.checked %>>
+              <span class="pf-choice__box">
+                <span class="pf-choice__title"><%= t(".joins.#{choice.join}.title") %></span>
+                <span class="pf-choice__desc"><%= choice.auto? ? t('.joins.auto.desc', choice: t(".joins.#{choice.auto}.title")) : t(".joins.#{choice.join}.desc") %></span>
+              </span>
+            </label>
+          <% end %>
+        </div>
+        <span class="pf-hint"><%= t('.join_note') %></span>
+        <label class="pf-checkbox">
+          <input type="hidden" name="rule[is_active]" value="0">
+          <input type="checkbox" name="rule[is_active]" value="1" <%= 'checked' if form.is_active %>>
+          <span><%= t('.active') %></span>
+        </label>
+      </div>
+    </details>
+
+    <p class="pf-fs-13 pf-text-2">
+      <%= builder.scoping_on? ? t('permission_forge.resources.rules_tab.scoping_on') : t('permission_forge.resources.rules_tab.scoping_off') %>
+      <%= pf_setting_link('auto_query_scoping', t('permission_forge.ui.setting')) %>
+    </p>
+
+    <div class="pf-panel pf-panel--muted pf-stack pf-stack--tight">
+      <span class="pf-eyebrow"><%= t('.preview') %></span>
+      <% if form.column %>
+        <span><%= pf_rule_text(form.preview_rule, resource.name) %>.</span>
+      <% else %>
+        <span class="pf-text-3"><%= t('.preview_empty') %></span>
+      <% end %>
+    </div>
+    <%= render 'permission_forge/shared/reason_field', id: 'pf-rule-reason', value: params[:reason] %>
+  <% end %>
+<% end %>

data/app/views/permission_forge/permission_set_rules/_value_input.html.erb

@@ -0,0 +1,42 @@
+<% aria_invalid = pf_attrs_when(invalid, aria: { invalid: true }) %>
+<% case_arity = form.arity %>
+<% if case_arity == :none %>
+  <span class="pf-fs-13 pf-text-3"><%= t('.no_value') %></span>
+<% elsif case_arity == :range %>
+  <label class="pf-sr-only" for="pf-rule-from"><%= t('.from') %></label>
+  <input id="pf-rule-from" class="pf-input pf-input--auto" type="<%= form.input_type %>" name="rule[value_from]" value="<%= form.value_from %>" <%= aria_invalid %>>
+  <span><%= t('permission_forge.ui.rules.and') %></span>
+  <label class="pf-sr-only" for="pf-rule-to"><%= t('.to') %></label>
+  <input id="pf-rule-to" class="pf-input pf-input--auto" type="<%= form.input_type %>" name="rule[value_to]" value="<%= form.value_to %>" <%= aria_invalid %>>
+<% elsif case_arity == :list %>
+  <% if form.enum_values.present? %>
+    <span class="pf-list-chips" role="group" aria-label="<%= t('.values') %>">
+      <% form.enum_values.each do |v| %>
+        <label class="pf-list-chip"><input type="checkbox" name="rule[values][]" value="<%= v %>" <%= 'checked' if form.values.include?(v) %>><span><%= v %></span></label>
+      <% end %>
+    </span>
+  <% else %>
+    <label class="pf-sr-only" for="pf-rule-values"><%= t('.values') %></label>
+    <input id="pf-rule-values" class="pf-input pf-input--auto" type="text" name="rule[values_text]" value="<%= form.values.join(', ') %>"
+           placeholder="<%= t('.values_placeholder') %>" <%= aria_invalid %>>
+  <% end %>
+<% else %>
+  <% if form.user_field? || form.current_user %>
+    <label class="pf-checkbox">
+      <input type="checkbox" name="rule[current_user]" value="1" <%= 'checked' if form.current_user %>>
+      <span class="pf-token pf-token--value"><%= t('permission_forge.ui.rules.current_user') %></span>
+    </label>
+    <span class="pf-fs-13 pf-text-3" data-pf-show-when="rule[current_user]="><%= t('.or') %></span>
+  <% end %>
+  <% if form.enum_values.present? %>
+    <label class="pf-sr-only" for="pf-rule-value"><%= t('.value') %></label>
+    <select id="pf-rule-value" name="rule[value]" class="pf-select pf-select--auto" <%= aria_invalid %>>
+      <option value=""><%= t('.pick_value') %></option>
+      <% form.enum_values.each do |v| %><option value="<%= v %>" <%= 'selected' if form.value == v %>><%= v %></option><% end %>
+    </select>
+  <% else %>
+    <label class="pf-sr-only" for="pf-rule-value"><%= t('.value') %></label>
+    <input id="pf-rule-value" class="pf-input pf-input--auto" type="<%= form.input_type %>" name="rule[value]" value="<%= form.value %>"
+           <%= aria_invalid %> <%= pf_attrs_when(form.user_field? || form.current_user, data: { pf_show_when: 'rule[current_user]=' }) %>>
+  <% end %>
+<% end %>

data/app/views/permission_forge/permission_set_rules/confirm_destroy.html.erb

@@ -0,0 +1,13 @@
+<% back = permission_forge.permission_set_resource_path(@permission_set, @resource.name, tab: 'rules') %>
+<% content_for :pf_title, t('.title', rule: @rule.name) %>
+<%= pf_dialog_frame({ title: t('.title', rule: @rule.name), danger: true }) do %>
+  <%= pf_rule_sentence(@rule, @resource.name) %>
+  <p class="pf-text-2"><%= t('.body', set: @permission_set.name) %></p>
+  <%= form_with url: permission_forge.permission_set_resource_rule_path(@permission_set, @resource.name, @rule), method: :delete, class: 'pf-confirm-form' do %>
+    <%= render 'permission_forge/shared/reason_field' %>
+    <div class="pf-actions pf-row--right">
+      <%= link_to t('permission_forge.ui.cancel'), back, class: 'pf-btn', data: { pf_close: true } %>
+      <button type="submit" class="pf-btn pf-btn--danger-solid"><%= t('permission_forge.ui.remove') %></button>
+    </div>
+  <% end %>
+<% end %>

data/app/views/permission_forge/permission_set_rules/edit.html.erb

@@ -0,0 +1,3 @@
+<% content_for :pf_title, t('.title', resource: pf_resource_label(@resource)) %>
+<%= render 'builder', title: t('.title', resource: pf_resource_label(@resource)),
+           url: permission_forge.permission_set_resource_rule_path(@permission_set, @resource.name, @rule), method: :patch %>

data/app/views/permission_forge/permission_set_rules/new.html.erb

@@ -0,0 +1,3 @@
+<% content_for :pf_title, t('.title', resource: pf_resource_label(@resource)) %>
+<%= render 'builder', title: t('.title', resource: pf_resource_label(@resource)),
+           url: permission_forge.permission_set_resource_rules_path(@permission_set, @resource.name), method: :post %>

data/app/views/permission_forge/permission_sets/_assignments_tab.html.erb

@@ -0,0 +1,74 @@
+<% back = permission_forge.permission_set_path(set, tab: 'assignments') %>
+<div class="pf-stack pf-stack--loose" data-pf-bulk>
+  <div class="pf-row pf-row--between">
+    <p class="pf-text-2"><%= t('.immediate') %></p>
+    <% unless PermissionForge::Admin::EditableLock.widening_lock(set, :grant) %>
+      <div class="pf-actions">
+        <%= pf_modal_link t('.bulk'), permission_forge.new_permission_set_bulk_assignment_path(set), kind: 'drawer', class: 'pf-btn pf-btn--sm' %>
+        <%= pf_modal_link "+ #{t('.assign')}", permission_forge.new_assignment_path(permission_set_id: set.id, return_to: back),
+                          kind: 'drawer', class: 'pf-btn pf-btn--sm pf-btn--primary' %>
+      </div>
+    <% end %>
+  </div>
+
+  <%= form_with url: permission_forge.revoke_permission_set_bulk_assignment_path(set), method: :get, id: 'pf-revoke-form',
+                data: { pf_modal: 'dialog' } do %>
+  <% end %>
+
+  <% if @assignments.any? %>
+    <div class="pf-bulk-bar" data-pf-bulk-bar>
+      <span class="pf-fw-600" data-pf-selected-count data-pf-one="<%= t('.selected.one', count: '%{count}') %>"
+            data-pf-other="<%= t('.selected.other', count: '%{count}') %>"><%= t('.select_hint') %></span>
+      <button type="submit" form="pf-revoke-form" class="pf-btn pf-btn--sm"><%= t('.revoke_selected') %></button>
+    </div>
+  <% end %>
+
+  <div class="pf-card pf-scroll-x">
+    <div class="pf-table pf-table--assignments" role="table" aria-label="<%= t('.label') %>">
+      <div class="pf-table__head" role="row">
+        <span role="columnheader">
+          <% unless @assignments.empty? %>
+            <input type="checkbox" data-pf-select-all aria-label="<%= t('.select_all') %>" hidden data-pf-js-show>
+          <% end %>
+        </span>
+        <span role="columnheader"><%= t('.columns.person') %></span>
+        <span role="columnheader"><%= t('.columns.assigned') %></span>
+        <span role="columnheader"><%= t('.columns.expires') %></span>
+        <span role="columnheader"><span class="pf-sr-only"><%= t('.columns.actions') %></span></span>
+      </div>
+      <% @assignments.each do |a| %>
+        <% name = pf_person_name(a.user) %>
+        <div class="pf-table__row" role="row">
+          <span role="cell">
+            <input type="checkbox" name="user_ids[]" value="<%= a.user_id %>" form="pf-revoke-form" data-pf-select
+                   aria-label="<%= t('.select_person', name: name) %>">
+          </span>
+          <span role="cell"><%= pf_person_cell(a.user, href: permission_forge.person_path(a.user_id)) %></span>
+          <span role="cell" class="pf-fs-13 pf-text-2"><%= t('.assigned_on', date: pf_date(a.created_at), by: pf_person_name(a.try(:created_by))) %></span>
+          <span role="cell" class="pf-fs-13 pf-row pf-row--tight">
+            <%= pf_expiry_tag(a.expires_at) %>
+            <%= pf_badge(t('permission_forge.ui.badges.expired'), variant: :block) if a.expired? %>
+          </span>
+          <span role="cell" class="pf-row pf-row--tight pf-row--nowrap">
+            <%= form_with url: permission_forge.assignment_path(a), method: :patch, class: 'pf-row pf-row--tight pf-row--nowrap pf-reason-form' do %>
+              <input type="hidden" name="return_to" value="<%= back %>">
+              <label class="pf-sr-only" for="pf-sexp-<%= a.id %>"><%= t('permission_forge.people.access_tab.change_end') %></label>
+              <select id="pf-sexp-<%= a.id %>" name="expiry" class="pf-select pf-select--sm pf-select--auto" data-pf-autosubmit>
+                <option value="" selected><%= t('permission_forge.people.access_tab.change_end') %>…</option>
+                <% PermissionForge::Admin::ExpiryPresets::CHANGE_KEYS.each do |key| %>
+                  <option value="<%= key %>"><%= t("permission_forge.ui.expiry_change.#{key}") %></option>
+                <% end %>
+              </select>
+              <button type="submit" class="pf-btn pf-btn--xs" data-pf-js-hide><%= t('permission_forge.ui.apply') %></button>
+              <%= render 'permission_forge/shared/reason_field', compact: true, id: "pf-sexp-reason-#{a.id}" %>
+            <% end %>
+            <%= pf_modal_link t('permission_forge.ui.remove'), permission_forge.remove_assignment_path(a, return_to: back), class: 'pf-btn pf-btn--ghost-danger' %>
+          </span>
+        </div>
+      <% end %>
+    </div>
+    <% if @assignments.empty? %>
+      <p class="pf-empty"><%= t('.empty') %></p>
+    <% end %>
+  </div>
+</div>

data/app/views/permission_forge/permission_sets/_audit_tab.html.erb

@@ -0,0 +1,80 @@
+<% if @audit_refused %>
+  <%= render 'permission_forge/shared/audit_refused_note' %>
+<% else %>
+<div class="pf-stack pf-stack--loose">
+  <%= render 'permission_forge/shared/audit_timeline',
+             title: t('.timeline'), description: t('.timeline_desc'),
+             page: @timeline, lookups: @timeline_lookups,
+             path: ->(number) { permission_forge.permission_set_path(set, tab: 'audit', who: @who, type: @type, days: @days, sort: @sort, views: params[:views].presence, page: number) },
+             views_path: (permission_forge.permission_set_path(set, tab: 'audit', who: @who, type: @type, days: @days, sort: @sort, views: 1) unless @timeline_log.include_views?),
+             links: [[t('.open_log'), pf_audit_log_path(permission_set: set.id)]] %>
+
+  <h2 class="pf-h2"><%= t('.records') %></h2>
+  <% if PermissionForge.configuration.audit_trail_enabled %>
+    <%= form_with url: permission_forge.permission_set_path(set), method: :get, class: 'pf-row' do %>
+      <input type="hidden" name="tab" value="audit">
+      <label class="pf-sr-only" for="pf-audit-who"><%= t('.who') %></label>
+      <select id="pf-audit-who" name="who" class="pf-select pf-select--sm pf-select--auto" data-pf-autosubmit>
+        <option value=""><%= t('.anyone') %></option>
+        <% @editors.each do |u| %><option value="<%= u.id %>" <%= 'selected' if @who == u.id.to_s %>><%= pf_person_name(u) %></option><% end %>
+      </select>
+      <label class="pf-sr-only" for="pf-audit-type"><%= t('.type') %></label>
+      <select id="pf-audit-type" name="type" class="pf-select pf-select--sm pf-select--auto" data-pf-autosubmit>
+        <option value=""><%= t('.all_types') %></option>
+        <% %w[permission_set resource field action rule assignment].each do |type| %>
+          <option value="<%= type %>" <%= 'selected' if @type == type %>><%= pf_audit_type_label(type) %></option>
+        <% end %>
+      </select>
+      <label class="pf-sr-only" for="pf-audit-days"><%= t('.days') %></label>
+      <select id="pf-audit-days" name="days" class="pf-select pf-select--sm pf-select--auto" data-pf-autosubmit>
+        <option value=""><%= t('.any_time') %></option>
+        <% PermissionForge::Admin::AuditTrail::DAY_FILTERS.each do |d| %>
+          <option value="<%= d %>" <%= 'selected' if @days.to_s == d.to_s %>><%= t('.last_days', count: d) %></option>
+        <% end %>
+      </select>
+      <button type="submit" name="sort" value="<%= @sort == 'asc' ? 'desc' : 'asc' %>" class="pf-btn pf-btn--sm">
+        <%= @sort == 'asc' ? t('.oldest_first') : t('.newest_first') %>
+      </button>
+      <button type="submit" class="pf-btn pf-btn--sm" data-pf-js-hide><%= t('permission_forge.ui.apply') %></button>
+      <span class="pf-fs-13 pf-text-3 pf-ml-auto"><%= t('.count', count: @entries.size) %></span>
+      <%= link_to t('permission_forge.ui.export_csv'),
+                  permission_forge.permission_set_path(set, tab: 'audit', who: @who, type: @type, days: @days, sort: @sort, format: :csv),
+                  class: 'pf-btn pf-btn--sm' %>
+    <% end %>
+
+    <div class="pf-card pf-scroll-x">
+      <div class="pf-table pf-table--audit" role="table" aria-label="<%= t('.label') %>">
+        <div class="pf-table__head" role="row">
+          <span role="columnheader"><%= t('.columns.type') %></span>
+          <span role="columnheader"><%= t('.columns.record') %></span>
+          <span role="columnheader"><%= t('.columns.created') %></span>
+          <span role="columnheader"><%= t('.columns.edited') %></span>
+        </div>
+        <% @entries.each do |entry| %>
+          <% type_label, label, where = pf_audit_describe(entry) %>
+          <div class="pf-table__row pf-table__row--link" role="row">
+            <span role="cell" class="pf-fs-12 pf-text-3"><%= type_label %></span>
+            <span role="cell" class="pf-stack pf-stack--tight">
+              <% if (entry_path = pf_audit_path(entry)) %>
+                <%= link_to label, entry_path, class: 'pf-table__link pf-fw-600' %>
+              <% else %>
+                <span class="pf-fw-600"><%= label %></span>
+              <% end %>
+              <% if where %><span class="pf-fs-12 pf-text-3"><%= where %></span><% end %>
+            </span>
+            <span role="cell" class="pf-fs-13 pf-text-2"><%= pf_audit_who_when(entry.created_by, entry.created_at) %></span>
+            <span role="cell" class="pf-fs-13 pf-text-2"><%= pf_audit_edited(entry) %></span>
+          </div>
+        <% end %>
+      </div>
+      <% if @entries.empty? %><p class="pf-empty"><%= t('.empty') %></p><% end %>
+    </div>
+  <% else %>
+    <div class="pf-banner pf-banner--warn" role="note">
+      <span class="pf-banner__glyph" aria-hidden="true">⚠</span>
+      <div class="pf-banner__body"><span><%= t('permission_forge.people.audit_tab.disabled') %></span></div>
+      <%= link_to t('permission_forge.ui.open_setting'), pf_setting_path('audit_trail_enabled'), class: 'pf-btn pf-btn--xs' %>
+    </div>
+  <% end %>
+</div>
+<% end %>

data/app/views/permission_forge/permission_sets/_conditions_tab.html.erb

@@ -0,0 +1,83 @@
+<% errors = @condition_errors || {} %>
+<% form = @conditions_form %>
+<% hours_on = set.allowed_hours_start.present? && set.allowed_hours_end.present? %>
+<% hours_on = form.hours_enabled? if form %>
+<% from = form&.submitted_hour(:allowed_hours_start) || set.allowed_hours_start || 8 %>
+<% to = form&.submitted_hour(:allowed_hours_end) || set.allowed_hours_end || 18 %>
+<% flag = params.key?(:requires_session_flag) ? params[:requires_session_flag].to_s : set.requires_session_flag.to_s %>
+<div class="pf-card">
+  <%= form_with url: permission_forge.conditions_permission_set_path(set), method: :patch, class: 'pf-card__body pf-stack pf-stack--xl' do %>
+    <div class="pf-stack pf-stack--tight">
+      <div class="pf-row">
+        <strong><%= pf_condition_sentence(set) %></strong>
+        <%= pf_fail_open_badge(long: true) if set.conditional? && pf_fail_open? %>
+      </div>
+      <p class="pf-fs-13 pf-text-2"><%= t('.intro') %></p>
+    </div>
+
+    <div class="pf-field">
+      <label class="pf-label" for="pf-ips"><%= t('.ips') %> <span class="pf-fs-12 pf-text-3 pf-fw-500"><%= t('.one_per_line') %></span></label>
+      <textarea id="pf-ips" name="allowed_ips" rows="4" class="pf-textarea pf-textarea--mono" placeholder="10.0.0.0/8"
+                <%= 'readonly' if locked %> <%= pf_attrs_when(errors[:ips], aria: { invalid: true }) %>><%= @ip_text %></textarea>
+      <% Array(errors[:ips]).each do |msg| %><p class="pf-error" role="alert"><%= msg %></p><% end %>
+      <span class="pf-hint"><%= t('.ips_hint') %></span>
+    </div>
+
+    <fieldset class="pf-stack">
+      <legend class="pf-label"><%= t('.hours') %></legend>
+      <label class="pf-checkbox">
+        <input type="hidden" name="hours_enabled" value="0">
+        <input type="checkbox" name="hours_enabled" value="1" <%= 'checked' if hours_on %> <%= 'disabled' if locked %>>
+        <span><%= t('.hours_only') %></span>
+      </label>
+      <div class="pf-row" data-pf-show-when="hours_enabled=1">
+        <label for="pf-hours-from"><%= t('.from') %></label>
+        <select id="pf-hours-from" name="allowed_hours_start" class="pf-select pf-select--sm pf-select--auto" <%= 'disabled' if locked %>>
+          <% (0..23).each do |h| %><option value="<%= h %>" <%= 'selected' if h == from %>><%= pf_hour(h) %></option><% end %>
+        </select>
+        <label for="pf-hours-to"><%= t('.to') %></label>
+        <select id="pf-hours-to" name="allowed_hours_end" class="pf-select pf-select--sm pf-select--auto" <%= 'disabled' if locked %>>
+          <% (0..23).each do |h| %><option value="<%= h %>" <%= 'selected' if h == to %>><%= pf_hour(h) %></option><% end %>
+        </select>
+        <span class="pf-fs-12 pf-text-3"><%= t('.server_time', zone: Time.zone.name) %></span>
+      </div>
+      <% if hours_on && to <= from %>
+        <span class="pf-fs-13 pf-text-2">☾ <%= t('.overnight', from: pf_hour(from), to: pf_hour(to)) %></span>
+      <% end %>
+    </fieldset>
+
+    <fieldset class="pf-stack">
+      <legend class="pf-label"><%= t('.flag') %></legend>
+      <p class="pf-fs-13 pf-text-2"><%= t('.flag_intro') %></p>
+      <div class="pf-stack pf-stack--tight" role="radiogroup">
+        <label class="pf-checkbox">
+          <input type="radio" name="requires_session_flag" value="" <%= 'checked' if flag.blank? %> <%= 'disabled' if locked %>>
+          <span><%= t('.no_flag') %></span>
+        </label>
+        <% @flag_options.each do |option| %>
+          <label class="pf-checkbox">
+            <input type="radio" name="requires_session_flag" value="<%= option %>" <%= 'checked' if flag == option %> <%= 'disabled' if locked %>>
+            <span><%= pf_flag_label(option) %> <code class="pf-mono-key"><%= option %></code></span>
+          </label>
+        <% end %>
+      </div>
+      <% unless locked %>
+        <div class="pf-field">
+          <label class="pf-fs-13 pf-text-2" for="pf-flag-custom"><%= t('.flag_custom') %></label>
+          <input id="pf-flag-custom" class="pf-input pf-input--sm pf-input--auto pf-mono" type="text" name="requires_session_flag_custom"
+                 pattern="[A-Za-z0-9_.:-]*" placeholder="mfa_verified">
+          <% if errors[:flag] %><p class="pf-error" role="alert"><%= errors[:flag] %></p><% end %>
+          <span class="pf-hint"><%= t('.flag_hint_html', setting: pf_setting_link('admin_session_flags', 'admin_session_flags')) %></span>
+        </div>
+      <% end %>
+    </fieldset>
+
+    <% unless locked %>
+      <%= render 'permission_forge/shared/reason_field', id: 'pf-conditions-reason', value: params[:reason] %>
+      <div class="pf-actions">
+        <button type="submit" class="pf-btn pf-btn--primary"><%= t('.save', people: pf_people_text(@people_count)) %></button>
+        <%= link_to t('.reset'), permission_forge.permission_set_path(set, tab: 'conditions'), class: 'pf-btn' %>
+      </div>
+    <% end %>
+  <% end %>
+</div>

data/app/views/permission_forge/permission_sets/_header.html.erb

@@ -0,0 +1,36 @@
+<div class="pf-page-header">
+  <div class="pf-page-header__text">
+    <h1 class="pf-sr-only"><%= set.name %></h1>
+    <label class="pf-sr-only" for="pf-set-name"><%= t('.name') %></label>
+    <input id="pf-set-name" class="pf-title-input" type="text" name="pf[set][name]" value="<%= set.name %>" form="pf-set-form"
+           maxlength="255" required <%= 'readonly' if locked %>>
+    <label class="pf-sr-only" for="pf-set-desc"><%= t('.description') %></label>
+    <input id="pf-set-desc" class="pf-desc-input" type="text" name="pf[set][description]" value="<%= set.description %>" form="pf-set-form"
+           placeholder="<%= t('.description_placeholder') %>" <%= 'readonly' if locked %>>
+    <div class="pf-row pf-mt-4">
+      <label class="pf-fs-13 pf-text-2" for="pf-set-group"><%= t('.group') %></label>
+      <select id="pf-set-group" name="pf[set][permission_set_group_id]" class="pf-select pf-select--sm pf-select--auto" form="pf-set-form" <%= 'disabled' if locked %>>
+        <option value=""><%= t('permission_forge.ui.no_group') %></option>
+        <% @groups.each do |g| %>
+          <option value="<%= g.id %>" <%= 'selected' if set.permission_set_group_id == g.id %>><%= g.name %></option>
+        <% end %>
+      </select>
+    </div>
+  </div>
+  <div class="pf-actions">
+    <label class="pf-switch">
+      <input type="hidden" name="pf[set][is_active]" value="0" form="pf-set-form">
+      <input type="checkbox" role="switch" name="pf[set][is_active]" value="1" form="pf-set-form" <%= 'checked' if set.is_active %> <%= 'disabled' if locked %>>
+      <span class="pf-switch__track" aria-hidden="true"></span>
+      <span class="pf-switch__on"><%= t('permission_forge.shared.active') %></span>
+      <span class="pf-switch__off"><%= t('permission_forge.ui.badges.off') %></span>
+    </label>
+    <%= form_with url: permission_forge.duplicate_permission_set_path(set), method: :post, class: 'pf-reason-form' do %>
+      <button type="submit" class="pf-btn pf-btn--sm"><%= t('permission_forge.ui.duplicate') %></button>
+      <%= render 'permission_forge/shared/reason_field', compact: true, id: 'pf-duplicate-reason' %>
+    <% end %>
+    <% unless locked %>
+      <%= pf_modal_link t('permission_forge.ui.delete'), permission_forge.delete_permission_set_path(set), class: 'pf-btn pf-btn--sm pf-btn--danger' %>
+    <% end %>
+  </div>
+</div>

data/app/views/permission_forge/permission_sets/_records_summary.html.erb

@@ -0,0 +1,16 @@
+<% rules = resource.permission_set_rules.select(&:is_active) %>
+<% if muting %>
+  <span class="pf-text-3">—</span>
+<% elsif !resource.read_access %>
+  <span class="pf-text-3">–</span>
+<% elsif resource.view_all %>
+  <span><%= resource.modify_all ? t('.view_modify_all') : t('permission_forge.ui.view_all') %></span>
+  <% if rules.any? %><span class="pf-fs-12 pf-text-warn">⚠ <%= t('.ignored', count: rules.size) %></span><% end %>
+<% else %>
+  <span><%= t('permission_forge.ui.rules_count', count: rules.size) %></span>
+  <% if rules.first %>
+    <span class="pf-fs-12 pf-text-3 pf-ellipsis"><%= pf_rule_summary(rules.first, resource.name) %></span>
+  <% else %>
+    <span class="pf-fs-12 pf-text-warn"><%= t('.no_rules') %></span>
+  <% end %>
+<% end %>

data/app/views/permission_forge/permission_sets/_resource_summary.html.erb

@@ -0,0 +1,11 @@
+<% fields = resource.resource_fields %>
+<% model = @catalog&.find(resource.name) %>
+<% new_count = model ? (model.managed_field_names - fields.map(&:name)).size : 0 %>
+<% if muting %>
+  <%= t('.muting', hidden: fields.count { |f| PermissionForge::Admin::FieldLevel.level_of(f, muting: true) == 'hide' },
+                   masked: fields.count { |f| PermissionForge::Admin::FieldLevel.level_of(f, muting: true) == 'mask' }) %>
+<% else %>
+  <%= [t('.fields', count: fields.size),
+       t('.masked', count: fields.count { |f| PermissionForge::Admin::FieldLevel.level_of(f, muting: false) == 'masked' }),
+       (t('.new', count: new_count) if new_count.positive?)].compact.join(' · ') %>
+<% end %>

data/app/views/permission_forge/permission_sets/_resources_tab.html.erb

@@ -0,0 +1,49 @@
+<% muting = set.is_muting %>
+<% flags = PermissionForge::Admin::EffectiveAccess::CRUD %>
+<% requires = { 'edit_access' => 'read_access', 'delete_access' => 'read_access' } %>
+<div class="pf-card pf-scroll-x">
+  <div class="pf-matrix" role="table" aria-label="<%= t('.label') %>">
+    <div class="pf-matrix__head" role="row">
+      <span role="columnheader"><%= t('permission_forge.ui.resource') %></span>
+      <% flags.each do |flag| %><span role="columnheader"><%= t("permission_forge.ui.flags_short.#{flag}") %></span><% end %>
+      <span role="columnheader"><%= t('permission_forge.ui.records') %></span>
+      <span role="columnheader"><span class="pf-sr-only"><%= t('.open') %></span></span>
+    </div>
+    <% @resources.each do |resource| %>
+      <% res_locked = locked || pf_locked_record?(resource) %>
+      <% path = permission_forge.permission_set_resource_path(set, resource.name) %>
+      <% label = pf_resource_label(resource) %>
+      <% plural = pf_resource_plural(resource.name) %>
+      <% base = "pf[resources][#{resource.id}]" %>
+      <div class="pf-matrix__row" role="row" data-pf-crud="r<%= resource.id %>">
+        <span role="rowheader" class="pf-matrix__resource">
+          <span class="pf-row pf-row--tight">
+            <%= link_to label, path %>
+            <%= pf_off_badge unless resource.is_active %>
+            <%= pf_lock_badge if pf_locked_record?(resource) %>
+          </span>
+          <span class="pf-fs-12 pf-text-3"><%= render 'resource_summary', resource: resource, muting: muting %></span>
+        </span>
+        <% flags.each do |flag| %>
+          <span role="cell">
+            <%= render 'permission_forge/shared/crud_cell', name: "#{base}[#{flag}]", flag: flag, checked: resource.public_send(flag),
+                       muting: muting, locked: res_locked, requires: requires[flag], form: 'pf-set-form',
+                       aria: "#{t("permission_forge.ui.flags_short.#{flag}")} #{plural}" %>
+          </span>
+        <% end %>
+        <span role="cell" class="pf-stack pf-stack--tight pf-fs-13">
+          <%= render 'records_summary', resource: resource, muting: muting %>
+        </span>
+        <span role="cell"><%= link_to '›', path, class: 'pf-matrix__chev', 'aria-label': t('.open_resource', resource: label) %></span>
+      </div>
+    <% end %>
+  </div>
+  <% if @resources.empty? %>
+    <p class="pf-empty"><%= t('.empty') %></p>
+  <% end %>
+  <% unless locked %>
+    <div class="pf-card__footer">
+      <%= pf_modal_link "+ #{t('.add')}", permission_forge.new_permission_set_resource_path(set), class: 'pf-btn pf-btn--sm' %>
+    </div>
+  <% end %>
+</div>

data/app/views/permission_forge/permission_sets/confirm_destroy.html.erb

@@ -0,0 +1,23 @@
+<% set = @permission_set %>
+<% content_for :pf_title, t('.title', name: set.name) %>
+<%= pf_dialog_frame({ title: t('.title', name: set.name), danger: true,
+                     breadcrumb: pf_breadcrumb([t('permission_forge.nav.permission_sets'), permission_forge.permission_sets_path],
+                                               [set.name, permission_forge.permission_set_path(set)], t('.crumb')) }) do %>
+  <p class="pf-text-2">
+    <% if @people_count.zero? %>
+      <%= t('.body_nobody') %>
+    <% elsif set.is_muting %>
+      <%= t('.body_muting', people: pf_people_text(@people_count)) %>
+    <% else %>
+      <%= t('.body', people: pf_people_text(@people_count), resources: @lost.presence&.to_sentence || '—') %>
+    <% end %>
+    <%= t('.irreversible') %>
+  </p>
+  <%= form_with url: permission_forge.permission_set_path(set), method: :delete, class: 'pf-confirm-form' do %>
+    <%= render 'permission_forge/shared/reason_field' %>
+    <div class="pf-actions pf-row--right">
+      <%= link_to t('permission_forge.ui.cancel'), permission_forge.permission_set_path(set), class: 'pf-btn', data: { pf_close: true } %>
+      <button type="submit" class="pf-btn pf-btn--danger-solid"><%= t('.confirm') %></button>
+    </div>
+  <% end %>
+<% end %>

data/app/views/permission_forge/permission_sets/confirm_switch_mode.html.erb

@@ -0,0 +1,15 @@
+<% set = @permission_set %>
+<% key = set.is_muting ? 'to_granting' : 'to_muting' %>
+<% content_for :pf_title, t(".#{key}.title", name: set.name) %>
+<%= pf_dialog_frame({ title: t(".#{key}.title", name: set.name), danger: true,
+                     breadcrumb: pf_breadcrumb([t('permission_forge.nav.permission_sets'), permission_forge.permission_sets_path],
+                                               [set.name, permission_forge.permission_set_path(set)], t(".#{key}.title", name: set.name)) }) do %>
+  <p class="pf-text-2"><%= t(".#{key}.body", people: pf_people_text(@people_count)) %></p>
+  <%= form_with url: permission_forge.switch_mode_permission_set_path(set), method: :patch, class: 'pf-confirm-form' do %>
+    <%= render 'permission_forge/shared/reason_field' %>
+    <div class="pf-actions pf-row--right">
+      <%= link_to t('permission_forge.ui.cancel'), permission_forge.permission_set_path(set), class: 'pf-btn', data: { pf_close: true } %>
+      <button type="submit" class="pf-btn pf-btn--danger-solid"><%= t(".#{key}.confirm") %></button>
+    </div>
+  <% end %>
+<% end %>