permission_forge 0.14.1

data/app/views/permission_forge/permission_sets/index.html.erb

@@ -0,0 +1,83 @@
+<% content_for :pf_title, t('permission_forge.nav.permission_sets') %>
+<div class="pf-page-header">
+  <div class="pf-page-header__text">
+    <h1 class="pf-h1"><%= t('permission_forge.nav.permission_sets') %></h1>
+    <p class="pf-subtitle"><%= t('.subtitle') %></p>
+  </div>
+  <div class="pf-actions">
+    <%= pf_modal_link t('permission_forge.ui.field_lookup'), permission_forge.field_lookup_path, kind: 'drawer', class: 'pf-btn' %>
+    <%= pf_modal_link "+ #{t('.new')}", permission_forge.new_permission_set_path, class: 'pf-btn pf-btn--primary' %>
+  </div>
+</div>
+
+<%= pf_help_banner('permission_sets', term: t('.help_term'), text: t('.help_text')) %>
+
+<% if @total.zero? %>
+  <section class="pf-card">
+    <div class="pf-empty">
+      <h2 class="pf-h2"><%= t('.empty_title') %></h2>
+      <p><%= t('.empty_body') %></p>
+      <%= pf_modal_link t('permission_forge.home.index.first_run.cta'), permission_forge.new_permission_set_path, class: 'pf-btn pf-btn--primary' %>
+    </div>
+  </section>
+<% else %>
+  <div class="pf-stack">
+    <%= form_with url: permission_forge.permission_sets_path, method: :get, role: 'search' do %>
+      <input type="hidden" name="filter" value="<%= @filter %>">
+      <label class="pf-sr-only" for="pf-sets-q"><%= t('.search') %></label>
+      <input id="pf-sets-q" class="pf-input" type="search" name="q" value="<%= @query %>" placeholder="<%= t('.search') %>"
+             autocomplete="off" data-pf-live="pf-sets-results">
+    <% end %>
+  </div>
+  <div id="pf-sets-results" class="pf-stack pf-stack--loose">
+    <div class="pf-filters" role="group" aria-label="<%= t('.filter_label') %>">
+      <% PermissionForge::PermissionSetsController::FILTERS.each do |filter| %>
+        <%= pf_filter_chip t(".filters.#{filter}"), permission_forge.permission_sets_path(q: @query.presence, filter: filter),
+                           selected: @filter == filter, count: @counts[filter] %>
+      <% end %>
+    </div>
+    <div class="pf-card pf-scroll-x">
+      <div class="pf-table pf-table--sets" role="table" aria-label="<%= t('permission_forge.nav.permission_sets') %>">
+        <div class="pf-table__head" role="row">
+          <span role="columnheader"><%= t('.columns.set') %></span>
+          <span role="columnheader"><%= t('.columns.people') %></span>
+          <span role="columnheader"><%= t('.columns.status') %></span>
+          <span role="columnheader"><%= t('.columns.group') %></span>
+          <span role="columnheader"><span class="pf-sr-only"><%= t('.columns.actions') %></span></span>
+        </div>
+        <% @permission_sets.each do |set| %>
+          <div class="pf-table__row" role="row">
+            <span role="cell" class="pf-stack pf-stack--tight">
+              <span class="pf-row pf-row--tight">
+                <%= link_to set.name, permission_forge.permission_set_path(set), class: 'pf-fw-600' %>
+                <%= pf_set_badges(set) %>
+              </span>
+              <% if set.description.present? %><span class="pf-fs-13 pf-text-2"><%= set.description %></span><% end %>
+              <% if set.resources.any? %>
+                <span class="pf-mono-key pf-fs-11"><%= set.resources.map(&:name).join(' · ') %></span>
+              <% end %>
+            </span>
+            <span role="cell" class="pf-tabular"><%= @people_counts.fetch(set.id, 0) %></span>
+            <span role="cell" class="pf-fs-13">
+              <% if set.is_active %>
+                <span class="pf-text-grant">● <%= t('permission_forge.shared.active') %></span>
+              <% else %>
+                <span class="pf-text-3">○ <%= t('permission_forge.ui.badges.off') %></span>
+              <% end %>
+            </span>
+            <span role="cell" class="pf-fs-13 pf-text-2 pf-ellipsis"><%= set.permission_set_group&.name || '—' %></span>
+            <span role="cell">
+              <%= form_with url: permission_forge.duplicate_permission_set_path(set), method: :post, class: 'pf-reason-form' do %>
+                <button type="submit" class="pf-btn pf-btn--xs pf-btn--fixed" aria-label="<%= t('.duplicate_aria', name: set.name) %>"><%= t('permission_forge.ui.duplicate') %></button>
+                <%= render 'permission_forge/shared/reason_field', compact: true, id: "pf-duplicate-reason-#{set.id}" %>
+              <% end %>
+            </span>
+          </div>
+        <% end %>
+      </div>
+      <% if @permission_sets.empty? %>
+        <p class="pf-empty"><%= t('.no_match') %></p>
+      <% end %>
+    </div>
+  </div>
+<% end %>

data/app/views/permission_forge/permission_sets/new.html.erb

@@ -0,0 +1,63 @@
+<% content_for :pf_title, t('.title') %>
+<%= pf_dialog_frame({ title: t('.title'), role: 'dialog', wide: true,
+                     breadcrumb: pf_breadcrumb([t('permission_forge.nav.permission_sets'), permission_forge.permission_sets_path], t('.title')) }) do %>
+  <%= form_with url: permission_forge.permission_sets_path, method: :post, class: 'pf-stack pf-stack--loose' do %>
+    <fieldset class="pf-stack">
+      <legend class="pf-label"><%= t('.type') %></legend>
+      <div class="pf-choices" role="radiogroup">
+        <label class="pf-choice">
+          <input type="radio" name="type" value="granting" <%= 'checked' unless @muting %>>
+          <span class="pf-choice__box">
+            <span class="pf-choice__title"><span class="pf-glyph-grant" aria-hidden="true">✓</span> <%= t('.granting.title') %></span>
+            <span class="pf-choice__desc"><%= t('.granting.desc') %></span>
+            <span class="pf-choice__sub"><%= t('.granting.example') %></span>
+          </span>
+        </label>
+        <label class="pf-choice pf-choice--muting">
+          <input type="radio" name="type" value="muting" <%= 'checked' if @muting %>>
+          <span class="pf-choice__box">
+            <span class="pf-choice__title"><span class="pf-glyph-restrict" aria-hidden="true">⊘</span> <%= t('.muting.title') %></span>
+            <span class="pf-choice__desc"><%= t('.muting.desc') %></span>
+            <span class="pf-choice__sub"><%= t('.muting.example') %></span>
+          </span>
+        </label>
+      </div>
+    </fieldset>
+
+    <div class="pf-field">
+      <label class="pf-label" for="pf-new-set-name"><%= t('.name') %></label>
+      <input id="pf-new-set-name" class="pf-input" type="text" name="name" value="<%= @name %>" required maxlength="255" autofocus
+             placeholder="<%= t('.name_placeholder') %>" <%= pf_attrs_when(@error, aria: { invalid: true, describedby: 'pf-new-set-error' }) %>>
+      <% if @error %><p id="pf-new-set-error" class="pf-error" role="alert"><%= @error %></p><% end %>
+    </div>
+
+    <% %w[granting muting].each do |kind| %>
+      <% options = @sources.select { |ps| ps.is_muting == (kind == 'muting') } %>
+      <div class="pf-field" data-pf-show-when="type=<%= kind %>">
+        <label class="pf-label" for="pf-new-set-from-<%= kind %>"><%= t(".start_from_#{kind}") %></label>
+        <select id="pf-new-set-from-<%= kind %>" name="start_from_<%= kind %>" class="pf-select">
+          <option value=""><%= t('.blank') %></option>
+          <% options.each do |ps| %>
+            <option value="<%= ps.id %>" <%= 'selected' if @start_from == ps.id.to_s %>><%= t('.copy_of', name: ps.name) %></option>
+          <% end %>
+        </select>
+      </div>
+    <% end %>
+
+    <div class="pf-field">
+      <label class="pf-label" for="pf-new-set-group"><%= t('.group') %></label>
+      <select id="pf-new-set-group" name="permission_set_group_id" class="pf-select">
+        <option value=""><%= t('permission_forge.ui.no_group') %></option>
+        <% @groups.each do |g| %><option value="<%= g.id %>" <%= 'selected' if @group_id == g.id.to_s %>><%= g.name %></option><% end %>
+      </select>
+    </div>
+
+    <p class="pf-hint"><%= t('.note') %></p>
+    <%= render 'permission_forge/shared/reason_field', id: 'pf-new-set-reason', value: params[:reason] %>
+
+    <div class="pf-actions pf-row--right">
+      <%= link_to t('permission_forge.ui.cancel'), permission_forge.permission_sets_path, class: 'pf-btn', data: { pf_close: true } %>
+      <button type="submit" class="pf-btn pf-btn--primary"><%= t('.create') %></button>
+    </div>
+  <% end %>
+<% end %>

data/app/views/permission_forge/permission_sets/review.html.erb

@@ -0,0 +1,26 @@
+<% set = @permission_set %>
+<% content_for :pf_title, t('.title') %>
+<%= pf_dialog_frame({ title: t('.title', count: @changes.size), role: 'dialog', wide: true,
+                     breadcrumb: pf_breadcrumb([t('permission_forge.nav.permission_sets'), permission_forge.permission_sets_path],
+                                               [set.name, permission_forge.permission_set_path(set)], t('.crumb')) }) do %>
+  <p class="pf-text-2">
+    <%= @people_count.positive? ? t('.body', people: pf_people_text(@people_count)) : t('.body_nobody') %>
+  </p>
+  <ul class="pf-confirm__list pf-change-list">
+    <% @changes.each do |change| %><li><span><%= pf_change_description(change) %></span></li><% end %>
+  </ul>
+  <% if @impact_people.any? %>
+    <p class="pf-fs-13 pf-text-3">
+      <%= t('.affected', names: (@impact_people.map { |u| pf_person_name(u) } + (@people_count > 3 ? [t('permission_forge.permission_sets.show.and_more', count: @people_count - 3)] : [])).to_sentence) %>
+    </p>
+  <% end %>
+  <%= form_with url: permission_forge.apply_permission_set_path(set), method: :patch, class: 'pf-confirm-form' do %>
+    <%= render 'permission_forge/shared/reason_field' %>
+    <div class="pf-actions pf-row--right">
+      <input type="hidden" name="return_to" value="<%= params[:return_to] %>">
+      <%= pf_hidden_params('pf', params[:pf]) %>
+      <%= link_to t('.back'), pf_back_or(permission_forge.permission_set_path(set)), class: 'pf-btn', data: { pf_close: true } %>
+      <button type="submit" class="pf-btn pf-btn--primary"><%= t('.save') %></button>
+    </div>
+  <% end %>
+<% end %>

data/app/views/permission_forge/permission_sets/show.html.erb

@@ -0,0 +1,50 @@
+<% set = @permission_set %>
+<% locked = pf_locked_record?(set) %>
+<% content_for :pf_title, set.name %>
+<%= pf_breadcrumb([t('permission_forge.nav.permission_sets'), permission_forge.permission_sets_path], set.name) %>
+
+<%= render 'permission_forge/shared/mode_banners', record: set, muting: set.is_muting,
+           duplicate_path: permission_forge.duplicate_permission_set_path(set) %>
+
+<%# The batched-edit form. Inputs anywhere on the page join it via form="pf-set-form". %>
+<%= form_with url: permission_forge.review_permission_set_path(set), method: :post, id: 'pf-set-form',
+              data: { pf_track: 'pf-set-savebar', pf_review: true } do %>
+  <input type="hidden" name="return_to" value="<%= request.fullpath %>">
+<% end %>
+
+<%= render 'header', set: set, locked: locked %>
+
+<p class="pf-impact">
+  <span class="pf-dot" aria-hidden="true"></span>
+  <% if @people_count.zero? %>
+    <%= t('.impact_none') %>
+  <% else %>
+    <%= t('.impact', people: pf_people_text(@people_count),
+                     names: (@impact_people.map { |u| pf_person_name(u) } + (@people_count > 3 ? [t('.and_more', count: @people_count - 3)] : [])).to_sentence) %>
+  <% end %>
+</p>
+
+<nav class="pf-tabs" role="tablist" aria-label="<%= t('.tabs_label') %>">
+  <%= pf_tab t('.tabs.resources'), permission_forge.permission_set_path(set), selected: @tab == 'resources', count: @resources.size %>
+  <%= pf_tab t('.tabs.assignments'), permission_forge.permission_set_path(set, tab: 'assignments'), selected: @tab == 'assignments', count: @assignment_count %>
+  <%= pf_tab t('.tabs.conditions') + (set.conditional? ? " (#{t('.on')})" : ''), permission_forge.permission_set_path(set, tab: 'conditions'), selected: @tab == 'conditions' %>
+  <%= pf_tab t('.tabs.audit'), permission_forge.permission_set_path(set, tab: 'audit'), selected: @tab == 'audit' %>
+</nav>
+
+<div role="tabpanel">
+  <%= render "#{@tab}_tab", set: set, locked: locked %>
+</div>
+
+<% unless locked %>
+  <%= render 'permission_forge/shared/savebar', id: 'pf-set-savebar', form: 'pf-set-form', people: @people_count %>
+<% end %>
+
+<%= pf_tech_details(set, extras: { is_muting: set.is_muting }) do %>
+  <% unless locked %>
+    <div>
+      <%= pf_modal_link(set.is_muting ? t('.switch_to_granting') : t('.switch_to_muting'),
+                        permission_forge.switch_mode_permission_set_path(set), class: 'pf-btn pf-btn--danger pf-btn--xs') %>
+    </div>
+  <% end %>
+<% end %>
+<%= pf_audit_footer(set) %>

data/app/views/permission_forge/resource_actions/_across_sets.html.erb

@@ -0,0 +1,24 @@
+<%# One action in every Permission Set containing the resource.
+    Locals: rows ([{ resource:, set:, action:, in_effect: }] from Admin::ActionAcrossSets#rows) %>
+<div class="pf-listbox">
+  <% rows.each do |row| %>
+    <% action = row[:action] %>
+    <% set = row[:set] %>
+    <div class="pf-option">
+      <span class="pf-option__main"><span class="pf-row pf-row--tight">
+        <% if set.is_muting %><span class="pf-text-restrict" aria-hidden="true">⊘</span><% end %>
+        <span class="pf-fw-600"><%= set.name %></span>
+        <%= pf_off_badge unless row[:in_effect] %>
+      </span></span>
+      <% if action.nil? %>
+        <%= pf_level_badge('none', label: t('permission_forge.ui.badges.not_configured')) %>
+      <% elsif set.is_muting %>
+        <%= pf_level_badge(action.is_permitted ? 'muted' : 'leave',
+                           label: action.is_permitted ? "⊘ #{t('permission_forge.resource_actions.states.blocked')}" : t('permission_forge.resource_actions.states.unchanged')) %>
+      <% else %>
+        <%= pf_level_badge(action.is_permitted ? 'edit' : 'none',
+                           label: action.is_permitted ? "✓ #{t('permission_forge.resource_actions.states.permitted')}" : t('permission_forge.resource_actions.states.not_permitted')) %>
+      <% end %>
+    </div>
+  <% end %>
+</div>

data/app/views/permission_forge/resource_actions/_add_select.html.erb

@@ -0,0 +1,12 @@
+<%# Adds a discovered controller action to the set through "Review and save".
+    The blank option posts nothing to add. In a muting set a row blocks.
+    Locals: id, name, muting %>
+<select id="<%= id %>" class="pf-select pf-select--sm pf-select--auto" name="<%= name %>" form="pf-res-form">
+  <option value=""><%= t('.none') %></option>
+  <% if muting %>
+    <option value="1"><%= t('.block') %></option>
+  <% else %>
+    <option value="1"><%= t('.permitted') %></option>
+    <option value="0"><%= t('.not_permitted') %></option>
+  <% end %>
+</select>

data/app/views/permission_forge/resource_actions/_effect.html.erb

@@ -0,0 +1,25 @@
+<%# What the saved configuration means right now for people with this set, and
+    which Permission Sets permit the action.
+    Locals: row (Admin::ActionRows::Row), muting %>
+<% setting = pf_setting_path('unconfigured_action_strategy') %>
+<%# The four row states share their words with the "Across all Permission Sets" list. %>
+<% badges = {
+     permitted: ["✓ #{t('permission_forge.resource_actions.states.permitted')}", { variant: :grant }],
+     not_permitted: ["– #{t('permission_forge.resource_actions.states.not_permitted')}", {}],
+     blocked: ["⊘ #{t('permission_forge.resource_actions.states.blocked')}", { variant: :block }],
+     unchanged: ["– #{t('permission_forge.resource_actions.states.unchanged')}", {}],
+     managed_elsewhere: ["– #{muting ? t('.managed_elsewhere_muting') : t('.managed_elsewhere')}", {}],
+     unmanaged_allowed: ["○ #{t('.unmanaged_allowed')}", { variant: :unconfigured, href: setting }],
+     unmanaged_blocked: ["⊘ #{t('.unmanaged_blocked')}", { variant: :block, href: setting }]
+   } %>
+<% text, options = badges.fetch(row.effect) %>
+<span class="pf-row pf-row--tight pf-fs-12">
+  <span class="pf-text-3"><%= t('.right_now') %></span>
+  <%= pf_badge(text, square: true, extra: 'pf-badge--wrap', **options) %>
+  <% unless %i[permitted unmanaged_allowed unmanaged_blocked].include?(row.effect) %>
+    <%# The action is managed and this set does not permit it: say who does. %>
+    <span class="pf-text-3">
+      <%= row.permitted_by.any? ? t('.permitted_by', sets: row.permitted_by.map(&:name).join(', ')) : t('.permitted_by_nobody') %>
+    </span>
+  <% end %>
+</span>

data/app/views/permission_forge/resource_actions/_endpoints.html.erb

@@ -0,0 +1,16 @@
+<%# Where a controller action runs: verbs, paths, controller#action and whether
+    that controller includes the action guard.
+    Locals: endpoints ([Admin::ControllerCatalog::Entry]) %>
+<ul class="pf-stack pf-stack--tight">
+  <% endpoints.each do |endpoint| %>
+    <li class="pf-row pf-row--tight pf-fs-12">
+      <span class="pf-mono"><%= endpoint.verbs.join(', ') %> <%= endpoint.paths.join(', ') %></span>
+      <code class="pf-mono-key"><%= endpoint.endpoint %></code>
+      <% if endpoint.guarded? %>
+        <%= pf_badge("✓ #{t('.guarded')}", variant: :grant, title: t('.guarded_title')) %>
+      <% else %>
+        <%= pf_badge("⚠ #{t('.not_guarded')}", variant: :warn, title: t('.not_guarded_title')) %>
+      <% end %>
+    </li>
+  <% end %>
+</ul>

data/app/views/permission_forge/resource_actions/_form.html.erb

@@ -0,0 +1,44 @@
+<% muting = @permission_set.is_muting %>
+<% errors = @errors || {} %>
+<% new_record = action.new_record? %>
+<%# Discovered controller actions without a row yet, offered as suggestions (no JS needed). %>
+<% suggestions = local_assigns[:suggestions] || [] %>
+<div class="pf-field">
+  <%# Only a new action's name is a control; an existing one is shown, not edited. %>
+  <%= content_tag(new_record ? :label : :span, t('.name'), class: 'pf-label', for: ('pf-action-name' if new_record)) %>
+  <% if new_record %>
+    <input id="pf-action-name" class="pf-input pf-mono" type="text" name="resource_action[name]" value="<%= action.name %>" required
+           pattern="[a-z][a-z0-9_]*" placeholder="export" autofocus <%= pf_attrs_when(errors[:name], aria: { invalid: true }) %>
+           <%= pf_attrs_when(suggestions.any?, list: 'pf-action-keys') %>>
+    <% if suggestions.any? %>
+      <datalist id="pf-action-keys">
+        <% suggestions.each do |key| %><option value="<%= key %>"></option><% end %>
+      </datalist>
+    <% end %>
+    <span class="pf-hint"><%= t('.name_hint') %></span>
+    <% if suggestions.any? %><span class="pf-hint"><%= t('.name_suggestions') %></span><% end %>
+    <% if errors[:name] %><p class="pf-error" role="alert"><%= errors[:name] %></p><% end %>
+  <% else %>
+    <code class="pf-mono"><%= action.name %></code>
+  <% end %>
+</div>
+<div class="pf-field">
+  <label class="pf-label" for="pf-action-label"><%= t('.label') %></label>
+  <input id="pf-action-label" class="pf-input" type="text" name="resource_action[label]" value="<%= action.label %>" placeholder="<%= t('.label_placeholder') %>">
+</div>
+<div class="pf-field">
+  <label class="pf-label" for="pf-action-desc"><%= t('.description') %></label>
+  <textarea id="pf-action-desc" class="pf-textarea" name="resource_action[description]" rows="2"><%= action.description %></textarea>
+</div>
+<label class="pf-switch pf-switch--bare">
+  <input type="hidden" name="resource_action[is_permitted]" value="0">
+  <input type="checkbox" role="switch" name="resource_action[is_permitted]" value="1" <%= 'checked' if action.is_permitted %>>
+  <span class="pf-switch__track" aria-hidden="true"></span>
+  <span><%= muting ? t('.block') : t('.permitted') %></span>
+</label>
+<label class="pf-switch pf-switch--bare">
+  <input type="hidden" name="resource_action[is_active]" value="0">
+  <input type="checkbox" role="switch" name="resource_action[is_active]" value="1" <%= 'checked' if action.is_active %>>
+  <span class="pf-switch__track" aria-hidden="true"></span>
+  <span><%= t('permission_forge.shared.active') %></span>
+</label>

data/app/views/permission_forge/resource_actions/_managed_note.html.erb

@@ -0,0 +1,11 @@
+<%# What "managed" means — shown before an action is added to a Permission Set. %>
+<div class="pf-banner" role="note">
+  <div class="pf-banner__body">
+    <span class="pf-banner__title"><%= t('.title') %></span>
+    <span><%= t('.body') %></span>
+    <span>
+      <%= PermissionForge.configuration.allow_unconfigured_actions? ? t('.unmanaged_allowed') : t('.unmanaged_blocked') %>
+      <%= pf_setting_link('unconfigured_action_strategy') %>
+    </span>
+  </div>
+</div>

data/app/views/permission_forge/resource_actions/confirm_destroy.html.erb

@@ -0,0 +1,13 @@
+<% name = @action_record.display_name %>
+<% back = permission_forge.permission_set_resource_path(@permission_set, @resource.name, tab: 'actions') %>
+<% content_for :pf_title, t('.title', action: name) %>
+<%= pf_dialog_frame({ title: t('.title', action: name), danger: true }) do %>
+  <p class="pf-text-2"><%= t('.body', set: @permission_set.name) %></p>
+  <%= form_with url: permission_forge.permission_set_resource_action_path(@permission_set, @resource.name, @action_record), method: :delete, class: 'pf-confirm-form' do %>
+    <%= render 'permission_forge/shared/reason_field' %>
+    <div class="pf-actions pf-row--right">
+      <%= link_to t('permission_forge.ui.cancel'), back, class: 'pf-btn', data: { pf_close: true } %>
+      <button type="submit" class="pf-btn pf-btn--danger-solid"><%= t('permission_forge.ui.remove') %></button>
+    </div>
+  <% end %>
+<% end %>

data/app/views/permission_forge/resource_actions/new.html.erb

@@ -0,0 +1,31 @@
+<% back = permission_forge.permission_set_resource_path(@permission_set, @resource.name, tab: 'actions') %>
+<% rows = @action_rows %>
+<%# Only a discovered action without a row here has something to show before it is added. %>
+<% row = @row unless @row&.configured? %>
+<% content_for :pf_title, t('.title', resource: pf_resource_label(@resource)) %>
+<%= form_with url: permission_forge.permission_set_resource_actions_path(@permission_set, @resource.name), method: :post do %>
+  <% footer = capture do %>
+    <%= link_to t('permission_forge.ui.cancel'), back, class: 'pf-btn', data: { pf_close: true } %>
+    <button type="submit" class="pf-btn pf-btn--primary"><%= t('.add') %></button>
+  <% end %>
+  <%= pf_sheet_frame({ title: t('.title', resource: pf_resource_label(@resource)), subtitle: @permission_set.name, close_path: back, footer: footer }) do %>
+    <p class="pf-fs-13 pf-text-2"><%= t('.intro') %></p>
+    <% if rows.discovery? %>
+      <%= render 'managed_note' %>
+      <% if row %>
+        <%# A discovered controller action: where it runs and who can run it today. %>
+        <section class="pf-stack" aria-labelledby="pf-na-where">
+          <%= pf_section_heading(t('.where', action: row.label), id: 'pf-na-where') %>
+          <%= render 'endpoints', endpoints: row.endpoints %>
+          <%= render 'effect', row: row, muting: @permission_set.is_muting %>
+        </section>
+        <section class="pf-stack" aria-labelledby="pf-na-across">
+          <%= pf_section_heading(t('permission_forge.resource_fields.show.across'), id: 'pf-na-across') %>
+          <%= render 'across_sets', rows: rows.across_sets(row.name) %>
+        </section>
+      <% end %>
+    <% end %>
+    <%= render 'form', action: @action_record, suggestions: rows.suggestions %>
+    <%= render 'permission_forge/shared/reason_field', id: 'pf-action-reason', value: params[:reason] %>
+  <% end %>
+<% end %>

data/app/views/permission_forge/resource_actions/show.html.erb

@@ -0,0 +1,39 @@
+<% set = @permission_set %>
+<% back = permission_forge.permission_set_resource_path(set, @resource.name, tab: 'actions') %>
+<% locked = pf_locked_record?(set) || pf_locked_record?(@resource) %>
+<% name = @action_record.display_name %>
+<% content_for :pf_title, name %>
+<%= form_with url: permission_forge.permission_set_resource_action_path(set, @resource.name, @action_record), method: :patch do %>
+  <% footer = capture do %>
+    <span class="pf-sheet__footer-note"><%= t('permission_forge.resource_fields.show.impact', people: pf_people_text(@people_count)) %></span>
+    <% unless locked %>
+      <%= pf_modal_link t('permission_forge.ui.remove'), permission_forge.delete_permission_set_resource_action_path(set, @resource.name, @action_record), class: 'pf-btn pf-btn--ghost-danger' %>
+    <% end %>
+    <%= link_to t('permission_forge.ui.close'), back, class: 'pf-btn', data: { pf_close: true } %>
+    <% unless locked %><button type="submit" class="pf-btn pf-btn--primary"><%= t('permission_forge.resource_fields.show.save') %></button><% end %>
+  <% end %>
+  <%= pf_sheet_frame({ title: name, subtitle: "#{set.name} › #{@resource.name}", close_path: back, footer: footer }) do %>
+    <fieldset class="pf-stack" <%= 'disabled' if locked %>>
+      <%= render 'form', action: @action_record %>
+    </fieldset>
+    <% unless locked %><%= render 'permission_forge/shared/reason_field', id: 'pf-action-reason', value: params[:reason] %><% end %>
+    <% if @action_rows.discovery? %>
+      <%# Where the action runs, and what the saved row means right now. %>
+      <section class="pf-stack" aria-labelledby="pf-ad-where">
+        <%= pf_section_heading(t('.where'), id: 'pf-ad-where') %>
+        <% if @row.unlinked %>
+          <p class="pf-fs-13 pf-text-2">– <%= t('.unlinked') %></p>
+        <% else %>
+          <%= render 'endpoints', endpoints: @row.endpoints %>
+        <% end %>
+        <%= render 'effect', row: @row, muting: set.is_muting %>
+      </section>
+    <% end %>
+    <section class="pf-stack">
+      <%= pf_section_heading(t('permission_forge.resource_fields.show.across')) %>
+      <%= render 'across_sets', rows: @across %>
+    </section>
+    <%= pf_tech_details(@action_record, extras: { name: @action_record.name, is_permitted: @action_record.is_permitted }) %>
+    <%= pf_audit_footer(@action_record) %>
+  <% end %>
+<% end %>

data/app/views/permission_forge/resource_fields/_explain.html.erb

@@ -0,0 +1,24 @@
+<% outcome = explain[:field] %>
+<% name = pf_person(explain[:user]).first_name %>
+<div class="pf-panel pf-panel--muted pf-stack pf-stack--tight pf-fs-13" aria-live="polite">
+  <% if outcome.nil? %>
+    <span><%= t('.no_access', name: name, resources: pf_resource_plural(resource.name)) %></span>
+  <% else %>
+    <div><%= pf_level_badge(outcome.level, strategy: (outcome.mask_strategy if outcome.level == 'masked')) %></div>
+    <span>
+      <% if outcome.blocked_by.any? %>
+        <%= t('.muted', name: name, sets: outcome.blocked_by.map(&:name).to_sentence) %>
+      <% elsif outcome.unconfigured %>
+        <%= t('.unconfigured', name: name) %>
+      <% elsif outcome.granted_by.any? %>
+        <%= t('.granted', name: name, sets: outcome.granted_by.map(&:name).to_sentence) %>
+      <% elsif outcome.implicit %>
+        <%= t('.virtual_default', name: name) %>
+      <% else %>
+        <%= t('.none', name: name) %>
+      <% end %>
+      <%= t('.capped') if outcome.capped %>
+    </span>
+    <%= link_to t('.full_picture', name: name), permission_forge.person_path(explain[:user], tab: 'effective', why: "#{resource.name}.field.#{outcome.name}", open: [resource.name]), class: 'pf-fs-12' %>
+  <% end %>
+</div>