permission_forge 0.14.1

data/app/views/permission_forge/resource_fields/show.html.erb

@@ -0,0 +1,186 @@
+<% d = @detail %>
+<% set = d.permission_set %>
+<% resource = d.resource %>
+<% field = d.field %>
+<% row = d.row %>
+<% locked = d.locked? %>
+<% res_label = pf_resource_label(resource) %>
+<% resource_path = permission_forge.permission_set_resource_path(set, resource.name) %>
+<% content_for :pf_title, "#{d.label} · #{res_label}" %>
+<%= form_with url: permission_forge.permission_set_resource_field_path(set, resource.name, d.key), method: :patch, scope: :field do |f| %>
+  <input type="hidden" name="return_to" value="<%= params[:return_to].presence || resource_path %>">
+  <%# The form's default button. Without it, Enter in a text input submits through the first submit
+      button in the drawer — "Apply recommendation" or "Explain" — instead of saving.
+      Out of sight but rendered, not `hidden`: Safari before 16.4 skips a display:none button
+      when it picks the default button (webkit.org/b/247545) and would apply the recommendation. %>
+  <% unless locked %><button type="submit" class="pf-sr-only" tabindex="-1" aria-hidden="true"><%= t('.save') %></button><% end %>
+  <% footer = capture do %>
+    <span class="pf-sheet__footer-note"><%= t('.impact', people: pf_people_text(d.people_count)) %></span>
+    <%= link_to t('permission_forge.ui.close'), resource_path, class: 'pf-btn', data: { pf_close: true } %>
+    <% unless locked %><button type="submit" class="pf-btn pf-btn--primary"><%= t('.save') %></button><% end %>
+  <% end %>
+  <% after = capture do %>
+    <span class="pf-row pf-row--tight">
+      <code class="pf-mono-key"><%= d.key %></code>
+      <%= pf_badge(t('permission_forge.ui.badges.virtual')) if d.virtual? %>
+      <%= pf_badge(t('permission_forge.ui.badges.sensitive'), variant: :sensitive) if row.sensitive? %>
+      <%= pf_badge(t('permission_forge.ui.badges.column_missing'), variant: :column_missing) if row.missing %>
+    </span>
+  <% end %>
+  <%= pf_sheet_frame({ title: d.label, subtitle: "#{set.name} › #{resource.name}", after_title: after,
+                       close_path: resource_path, footer: footer,
+                       breadcrumb: pf_breadcrumb([t('permission_forge.nav.permission_sets'), permission_forge.permission_sets_path],
+                                                 [set.name, permission_forge.permission_set_path(set)], [res_label, resource_path], d.label) }) do %>
+    <% if locked %>
+      <div class="pf-banner" role="note"><span class="pf-banner__glyph" aria-hidden="true"><%= pf_lock_icon %></span>
+        <div class="pf-banner__body"><span><%= t('permission_forge.ui.locked.title') %></span></div></div>
+    <% end %>
+    <% if d.muting? %>
+      <div class="pf-banner pf-banner--muting" role="note"><span class="pf-banner__glyph" aria-hidden="true">⊘</span>
+        <div class="pf-banner__body"><span><%= t('.muting_note') %></span></div></div>
+    <% end %>
+
+    <%# 2. Access level %>
+    <section class="pf-stack" aria-labelledby="pf-fd-level" data-pf-mask-scope>
+      <%= pf_section_heading(t('.access_level'), id: 'pf-fd-level') %>
+      <%= render 'permission_forge/shared/level_control', name: 'field[level]', checked: d.level, muting: d.muting?, large: true,
+                 aria: t('.access_level'), locked: locked, edit_disabled: d.edit_disabled?,
+                 id_prefix: 'pf-fd-lv', resource_label: res_label %>
+      <%# No setting in force (none, or one that is turned off): say what applies right now. %>
+      <% if (note = d.unconfigured_note) %>
+        <% behaviour = t("permission_forge.ui.unconfigured.#{d.unconfigured_behaviour}", default: t('permission_forge.ui.unconfigured.block')) %>
+        <p class="pf-fs-13 pf-text-warn">
+          <%= t(".#{note}", set: set.name, behaviour: behaviour) %>
+          <%= pf_setting_link(d.unconfigured_setting) %>
+        </p>
+      <% end %>
+
+      <div class="pf-panel pf-panel--mask pf-stack" data-pf-show-when="field[level]=masked,mask">
+        <label class="pf-label" for="pf-fd-strategy"><%= t('.mask_strategy') %></label>
+        <select id="pf-fd-strategy" name="field[mask_strategy]" class="pf-select pf-select--auto" data-pf-mask-select <%= 'disabled' if locked %>>
+          <% pf_mask_strategies.each do |s| %>
+            <option value="<%= s %>" <%= 'selected' if s == d.strategy %>><%= pf_mask_strategy_label(s) %><%= " #{t('.custom')}" if pf_custom_mask_strategy?(s) %></option>
+          <% end %>
+        </select>
+        <% pf_mask_strategies.each do |s| %>
+          <p class="pf-fs-13 pf-mono" data-pf-mask-preview="<%= s %>" <%= 'hidden' unless s == d.strategy %>>
+            <%= pf_mask_sample(d.key) %> → <span class="pf-text-mask"><%= pf_mask_preview(d.key, s) %></span>
+          </p>
+        <% end %>
+        <%= pf_setting_link('custom_mask_strategies', t('.custom_link')) %>
+      </div>
+
+      <% if d.recommendation_banner? %>
+        <div class="pf-banner pf-banner--warn">
+          <div class="pf-banner__body">
+            <span>⚠ <%= t('.sensitive', pattern: row.match.pattern, strategy: pf_mask_strategy_label(row.match.strategy)) %></span>
+          </div>
+          <% case d.recommendation %>
+          <% when :applied %>
+            <span class="pf-fs-13 pf-text-grant">✓ <%= t('.applied') %></span>
+          <% when :apply %>
+            <button type="submit" formaction="<%= permission_forge.apply_recommendation_permission_set_resource_field_path(set, resource.name, d.key) %>"
+                    formmethod="post" name="_method" value="post" class="pf-btn pf-btn--primary pf-btn--xs"><%= t('.apply_recommendation') %></button>
+          <% end %>
+        </div>
+      <% end %>
+
+      <% if d.variants.any? %>
+        <p class="pf-fs-13 pf-text-2">
+          <%= d.muting? ? t('.variants_muting') : t('.variants') %>
+          <% d.variants.each do |v| %><code class="pf-mono-key"><%= v %></code> <% end %>
+          <%= pf_setting_link('field_variant_mappings') %>
+        </p>
+      <% end %>
+      <% if d.virtual? %>
+        <% extra_method = content_tag(:code, d.extra_fields_method) %>
+        <% if d.declared? %>
+          <p class="pf-fs-13 pf-text-2"><%= t('.virtual_html', method: extra_method) %> <%= pf_setting_link('extra_fields_method') %></p>
+        <% else %>
+          <p class="pf-fs-13 pf-text-2"><%= t('.virtual_discovered_html', method: extra_method) %> <%= pf_setting_link('virtual_field_discovery') %></p>
+        <% end %>
+        <p class="pf-fs-13 pf-text-2">
+          <%= d.model_masks_virtual? ? t('.virtual_model_masking_on') : t('.virtual_model_masking_off') %>
+          <%= pf_setting_link('mask_virtual_attributes') %>
+        </p>
+      <% end %>
+    </section>
+
+    <%# 3. Details %>
+    <section class="pf-stack" aria-labelledby="pf-fd-details">
+      <%= pf_section_heading(t('.details'), id: 'pf-fd-details') %>
+      <div class="pf-field">
+        <span class="pf-label"><%= t('.column') %></span>
+        <code class="pf-mono"><%= d.key %></code>
+      </div>
+      <div class="pf-field">
+        <label class="pf-label" for="pf-fd-label"><%= t('.label') %></label>
+        <input id="pf-fd-label" class="pf-input" type="text" name="field[label]" value="<%= field&.label %>" placeholder="<%= d.label %>" <%= 'readonly' if locked %>>
+      </div>
+      <div class="pf-field">
+        <label class="pf-label" for="pf-fd-desc"><%= t('.description') %></label>
+        <textarea id="pf-fd-desc" class="pf-textarea" name="field[description]" rows="2" <%= 'readonly' if locked %>><%= field&.description %></textarea>
+      </div>
+      <% if field %>
+        <label class="pf-switch pf-switch--bare">
+          <input type="hidden" name="field[is_active]" value="0">
+          <input type="checkbox" role="switch" name="field[is_active]" value="1" <%= 'checked' if field.is_active %> <%= 'disabled' if locked %>>
+          <span class="pf-switch__track" aria-hidden="true"></span>
+          <span class="pf-switch__on"><%= t('permission_forge.shared.active') %></span>
+          <span class="pf-switch__off"><%= t('permission_forge.ui.badges.off') %></span>
+        </label>
+      <% end %>
+      <% unless locked %><%= render 'permission_forge/shared/reason_field', id: 'pf-field-reason', value: params[:reason] %><% end %>
+    </section>
+
+    <%# 4. Used by rules %>
+    <section class="pf-stack" aria-labelledby="pf-fd-rules">
+      <%= pf_section_heading(t('.used_by_rules'), id: 'pf-fd-rules') %>
+      <% if d.rules.empty? %>
+        <p class="pf-fs-13 pf-text-3"><%= t('.no_rules') %></p>
+      <% else %>
+        <% d.rules.each do |rule| %>
+          <%= link_to permission_forge.edit_permission_set_resource_rule_path(set, resource.name, rule), class: 'pf-panel pf-stack pf-stack--tight' do %>
+            <b><%= rule.name %></b><%= pf_rule_sentence(rule, resource.name) %>
+          <% end %>
+        <% end %>
+      <% end %>
+    </section>
+
+    <%# 5. Across all Permission Sets %>
+    <section class="pf-stack" aria-labelledby="pf-fd-across">
+      <%= pf_section_heading(t('.across'), id: 'pf-fd-across') %>
+      <%= render 'permission_forge/shared/across_sets', rows: d.across, key: d.key, current_set: set %>
+    </section>
+
+    <%# 6. Explain for a person %>
+    <section class="pf-stack" aria-labelledby="pf-fd-explain">
+      <%= pf_section_heading(t('.explain'), id: 'pf-fd-explain') %>
+      <% if d.explain_people.empty? %>
+        <p class="pf-fs-13 pf-text-3"><%= t('.explain_nobody') %></p>
+      <% else %>
+        <div class="pf-row">
+          <label class="pf-sr-only" for="pf-fd-explain-user"><%= t('.explain') %></label>
+          <select id="pf-fd-explain-user" name="explain_user_id" class="pf-select pf-select--sm pf-select--auto" data-pf-untracked>
+            <option value=""><%= t('.pick_person') %></option>
+            <% d.explain_people.each do |u| %>
+              <option value="<%= u.id %>" <%= 'selected' if d.explain_selected?(u) %>><%= pf_person_name(u) %></option>
+            <% end %>
+          </select>
+          <button type="submit" class="pf-btn pf-btn--xs" formmethod="get"
+                  formaction="<%= permission_forge.permission_set_resource_field_path(set, resource.name, d.key) %>"><%= t('.explain_button') %></button>
+        </div>
+        <% if d.explain %>
+          <%= render 'explain', explain: d.explain, resource: resource %>
+        <% end %>
+      <% end %>
+    </section>
+
+    <% if field %>
+      <%= pf_tech_details(field, extras: { read_access: field.read_access, edit_access: field.edit_access, mask_access: field.mask_access }) do %>
+        <% if d.muting? %><span class="pf-fs-12 pf-text-3"><%= t('.flags_muting_note') %></span><% end %>
+      <% end %>
+      <%= pf_audit_footer(field) %>
+    <% end %>
+  <% end %>
+<% end %>

data/app/views/permission_forge/resources/_actions_tab.html.erb

@@ -0,0 +1,88 @@
+<%# Actions of a Resource. With controller_action_discovery on, each row also
+    shows where the action runs, whether that controller is guarded and what
+    the saved configuration means right now; the app's controller actions
+    without a row are listed and can be added (review → apply). %>
+<% rows = @action_rows %>
+<% discovery = rows.discovery? %>
+<% discovered = rows.discovered_rows %>
+<% partials = 'permission_forge/resource_actions' %>
+<div class="pf-stack pf-stack--loose">
+  <p class="pf-fs-13 pf-text-2"><%= muting ? t('.intro_muting') : t('.intro') %></p>
+  <% if discovery %>
+    <%= render "#{partials}/managed_note" %>
+    <% unless rows.any_guarded? %>
+      <div class="pf-banner pf-banner--warn" role="note">
+        <span class="pf-banner__glyph" aria-hidden="true">⚠</span>
+        <div class="pf-banner__body">
+          <span class="pf-banner__title"><%= t('.no_guard_title') %></span>
+          <span><%= t('.no_guard_body_html', guard: content_tag(:code, 'PermissionForge::Concerns::ControllerActionGuard')) %></span>
+        </div>
+      </div>
+    <% end %>
+  <% end %>
+  <div class="pf-card">
+    <% rows.configured_rows.each do |row| %>
+      <% action = row.action %>
+      <% action_locked = locked %>
+      <div class="pf-card__row">
+        <div class="pf-stack pf-stack--tight pf-grow">
+          <span class="pf-row pf-row--tight">
+            <b><%= row.label %></b>
+            <code class="pf-mono-key"><%= row.name %></code>
+            <%= pf_off_badge unless action.is_active %>
+            <% if row.unlinked %><%= pf_badge("– #{t('.unlinked')}", title: t('.unlinked_title')) %><% end %>
+          </span>
+          <% if action.description.present? %><span class="pf-fs-13 pf-text-2"><%= action.description %></span><% end %>
+          <% if discovery %>
+            <%= render "#{partials}/endpoints", endpoints: row.endpoints unless row.unlinked %>
+            <%= render "#{partials}/effect", row: row, muting: muting %>
+          <% end %>
+        </div>
+        <div class="pf-row pf-row--nowrap">
+          <%= render 'permission_forge/shared/crud_cell', name: "pf[actions][#{action.id}][is_permitted]", flag: 'is_permitted',
+                     checked: action.is_permitted, muting: muting, locked: action_locked, form: 'pf-res-form',
+                     aria: row.label %>
+        </div>
+        <%= pf_modal_link t('permission_forge.resources.fields_tab.details'),
+                          permission_forge.permission_set_resource_action_path(set, resource.name, action),
+                          kind: 'drawer', class: 'pf-btn pf-btn--ghost pf-btn--xs' %>
+      </div>
+    <% end %>
+    <% discovered.each do |row| %>
+      <%# A controller action of the app with no row in this set yet. %>
+      <div class="pf-card__row">
+        <div class="pf-stack pf-stack--tight pf-grow">
+          <span class="pf-row pf-row--tight">
+            <b><%= row.label %></b>
+            <code class="pf-mono-key"><%= row.name %></code>
+            <%= pf_badge(t('permission_forge.ui.badges.not_configured'), variant: :unconfigured) %>
+          </span>
+          <%= render "#{partials}/endpoints", endpoints: row.endpoints %>
+          <%= render "#{partials}/effect", row: row, muting: muting %>
+        </div>
+        <% unless locked %>
+          <div class="pf-row pf-row--nowrap">
+            <label class="pf-sr-only" for="pf-new-action-<%= row.name %>"><%= t('.add_aria', action: row.label) %></label>
+            <%= render "#{partials}/add_select", id: "pf-new-action-#{row.name}", muting: muting,
+                       name: "pf[new_actions][#{resource.id}][#{row.name}][is_permitted]" %>
+          </div>
+          <%= pf_modal_link t('permission_forge.resources.fields_tab.details'),
+                            permission_forge.new_permission_set_resource_action_path(set, resource.name, key: row.name),
+                            kind: 'drawer', class: 'pf-btn pf-btn--ghost pf-btn--xs', 'aria-label': t('.details_aria', action: row.label) %>
+        <% end %>
+      </div>
+    <% end %>
+    <% if rows.rows.empty? %><p class="pf-empty"><%= discovery ? t('.empty_discovery') : t('.empty') %></p><% end %>
+    <% unless locked %>
+      <div class="pf-card__footer">
+        <%= pf_modal_link "+ #{t('.add')}", permission_forge.new_permission_set_resource_action_path(set, resource.name), kind: 'drawer', class: 'pf-btn pf-btn--sm' %>
+        <% if discovered.any? %>
+          <%# Adds every discovered action at once; a row's own choice wins. %>
+          <input type="hidden" name="pf[bulk_actions][resource_id]" value="<%= resource.id %>" form="pf-res-form">
+          <label class="pf-fs-13 pf-ml-auto" for="pf-bulk-actions"><%= t('.bulk_label', count: discovered.size) %></label>
+          <%= render "#{partials}/add_select", id: 'pf-bulk-actions', muting: muting, name: 'pf[bulk_actions][is_permitted]' %>
+        <% end %>
+      </div>
+    <% end %>
+  </div>
+</div>

data/app/views/permission_forge/resources/_fields_tab.html.erb

@@ -0,0 +1,89 @@
+<% rows = @rows.filtered(filter: @filter, query: @query) %>
+<% counts = @rows.counts %>
+<% label = pf_resource_label(resource) %>
+<% read_off = !muting && !resource.read_access %>
+<% edit_disabled = !muting && !resource.edit_access %>
+<% strategy = PermissionForge.configuration.unconfigured_field_strategy %>
+<div class="pf-stack pf-stack--loose" data-pf-bulk>
+  <div class="pf-row pf-row--between">
+    <%= form_with url: permission_forge.permission_set_resource_path(set, resource.name), method: :get, class: 'pf-row', role: 'search' do %>
+      <input type="hidden" name="filter" value="<%= @filter %>">
+      <label class="pf-sr-only" for="pf-field-q"><%= t('.search') %></label>
+      <input id="pf-field-q" class="pf-input pf-input--sm pf-input--auto" type="search" name="q" value="<%= @query %>"
+             placeholder="<%= t('.search') %>" data-pf-row-filter="pf-field-rows" data-pf-untracked>
+    <% end %>
+    <div class="pf-filters" role="group" aria-label="<%= t('.filter_label') %>">
+      <% @rows.filters.each do |f| %>
+        <%= pf_filter_chip t(".filters.#{f}"), permission_forge.permission_set_resource_path(set, resource.name, filter: f, q: @query.presence),
+                           selected: @filter == f, count: counts[f] %>
+      <% end %>
+    </div>
+  </div>
+
+  <% if read_off %>
+    <p class="pf-banner pf-banner--warn"><%= t('.read_off', resource: label) %></p>
+  <% end %>
+
+  <% unless locked || read_off %>
+    <div class="pf-bulk-bar" data-pf-bulk-bar>
+      <input type="hidden" name="pf[bulk][resource_id]" value="<%= resource.id %>" form="pf-res-form">
+      <span class="pf-fw-600" data-pf-selected-count data-pf-one="<%= t('.selected.one', count: '%{count}') %>"
+            data-pf-other="<%= t('.selected.other', count: '%{count}') %>"><%= t('.select_hint') %></span>
+      <span><%= t('.set_to') %></span>
+      <% PermissionForge::Admin::FieldLevel.levels_for(muting: muting).each do |level| %>
+        <button type="submit" form="pf-res-form" name="pf[bulk][level]" value="<%= level %>" class="pf-btn pf-btn--xs"
+                <%= 'disabled' if level == 'edit' && edit_disabled %>><%= pf_level_label(level) %></button>
+      <% end %>
+    </div>
+  <% end %>
+
+  <div class="pf-card" id="pf-field-rows" data-pf-fields-of="r<%= resource.id %>">
+    <div class="pf-fields__row pf-fields__row--head">
+      <% unless locked || read_off %>
+        <input type="checkbox" data-pf-select-all aria-label="<%= t('.select_all') %>" hidden data-pf-js-show>
+      <% end %>
+      <span class="pf-grow"><%= t('.field') %></span>
+      <span><%= t('.level') %></span>
+    </div>
+    <% rows.each do |row| %>
+      <% field = row.field %>
+      <% row_locked = locked || row.locked? || read_off %>
+      <% name = field ? "pf[fields][#{field.id}][level]" : "pf[new_fields][#{resource.id}][#{row.name}][level]" %>
+      <% detail = permission_forge.permission_set_resource_field_path(set, resource.name, row.name) %>
+      <div class="pf-fields__row" data-pf-row-text="<%= "#{row.name} #{row.label}".downcase %>">
+        <% unless locked || read_off %>
+          <input type="checkbox" name="pf[bulk][keys][]" value="<%= row.name %>" form="pf-res-form" data-pf-select data-pf-untracked
+                 aria-label="<%= t('.select_field', field: row.label) %>" <%= 'disabled' if row.locked? %>>
+        <% end %>
+        <%= pf_modal_link detail, kind: 'drawer', class: 'pf-fields__name', 'aria-label': t('.details_aria', field: row.label) do %>
+          <span class="pf-row pf-row--tight">
+            <span class="pf-fields__label"><%= row.label %></span>
+            <code class="pf-mono-key"><%= row.name %></code>
+            <%= pf_badge(t('permission_forge.ui.badges.sensitive'), variant: :sensitive) if row.sensitive? %>
+            <%= pf_badge(t('permission_forge.ui.badges.virtual')) if row.virtual %>
+            <%= pf_badge(t('permission_forge.ui.badges.column_missing'), variant: :column_missing) if row.missing %>
+            <%= pf_lock_badge if row.locked? %>
+            <%= pf_off_badge if field && !field.is_active %>
+          </span>
+        <% end %>
+        <%# No setting in force (none, or one that is turned off): say what applies right now. %>
+        <% unless row.in_force? %>
+          <% implicit = row.implicit_grant %>
+          <% behaviour = implicit ? t('.implicit_grant') : t("permission_forge.ui.unconfigured.#{strategy}", default: t('permission_forge.ui.unconfigured.block')) %>
+          <%= pf_badge(row.configured? ? t('.turned_off', behaviour: behaviour) : t('.not_configured', behaviour: behaviour),
+                       variant: :unconfigured, href: pf_setting_path(implicit ? 'extra_fields_default_access' : 'unconfigured_field_strategy')) %>
+        <% end %>
+        <%= render 'permission_forge/shared/level_control', name: name, checked: row.level, muting: muting,
+                   aria: t('.level_aria', field: row.label), locked: row_locked, edit_disabled: edit_disabled,
+                   form: 'pf-res-form', id_prefix: "pf-lv-#{resource.id}-#{row.name}", resource_label: label %>
+        <span class="pf-mask-preview">
+          <% if field && %w[masked mask].include?(row.level) %>
+            <%= pf_mask_strategy_label(field.mask_strategy) %> · <%= pf_mask_preview(row.name, field.mask_strategy) %>
+          <% end %>
+        </span>
+        <%= pf_modal_link t('.details'), detail, kind: 'drawer', class: 'pf-btn pf-btn--ghost pf-btn--xs', 'aria-label': t('.details_aria', field: row.label) %>
+      </div>
+    <% end %>
+    <% if rows.empty? %><p class="pf-empty"><%= t('.no_match') %></p><% end %>
+  </div>
+</div>

data/app/views/permission_forge/resources/_rules_tab.html.erb

@@ -0,0 +1,55 @@
+<% scoping = PermissionForge.configuration.auto_query_scoping.to_s %>
+<div class="pf-stack pf-stack--loose">
+  <% unenforced = scoping == 'filter_only' ? @rules.any? { |r| r.is_active && r.join_rule? } : @rules.any?(&:is_active) %>
+  <% if muting %>
+    <p class="pf-banner"><%= t('.muting') %></p>
+  <% elsif unenforced && !resource.view_all %>
+    <div class="pf-banner pf-banner--warn" role="note"><span class="pf-banner__glyph" aria-hidden="true">⚠</span>
+      <div class="pf-banner__body"><span><%= scoping == 'filter_only' ? t('.join_rules_warning') : t('.scoping_off_warning') %>
+        <%= pf_setting_link('auto_query_scoping', t('permission_forge.ui.setting')) %></span></div></div>
+  <% else %>
+    <p class="pf-fs-13 pf-text-2">
+      <%= scoping == 'filter_only' ? t('.scoping_on') : t('.scoping_off') %>
+      <%= pf_setting_link('auto_query_scoping', t('permission_forge.ui.setting')) %>
+    </p>
+  <% end %>
+  <% @rules.each do |rule| %>
+    <% ignored = resource.view_all && rule.is_active %>
+    <% rule_locked = locked || pf_locked_record?(rule) %>
+    <div class="pf-rule<%= ' pf-rule--off' unless rule.is_active %>">
+      <div class="pf-row">
+        <b><%= rule.name %></b>
+        <%= pf_off_badge unless rule.is_active %>
+        <% if ignored %><%= pf_badge("⚠ #{resource.modify_all ? t('.ignored_both') : t('.ignored')}", variant: :warn) %><% end %>
+        <%= pf_lock_badge if pf_locked_record?(rule) %>
+        <% unless rule_locked %>
+          <span class="pf-actions pf-ml-auto">
+            <%= form_with url: permission_forge.toggle_permission_set_resource_rule_path(set, resource.name, rule),
+                          method: :patch, class: 'pf-reason-form' do %>
+              <button type="submit" class="pf-btn pf-btn--ghost pf-btn--xs"><%= rule.is_active ? t('.turn_off') : t('.turn_on') %></button>
+              <%= render 'permission_forge/shared/reason_field', compact: true, id: "pf-rule-toggle-reason-#{rule.id}" %>
+            <% end %>
+            <%= pf_modal_link t('permission_forge.ui.edit'), permission_forge.edit_permission_set_resource_rule_path(set, resource.name, rule),
+                              kind: 'drawer', class: 'pf-btn pf-btn--xs' %>
+            <%= pf_modal_link t('permission_forge.ui.remove'), permission_forge.delete_permission_set_resource_rule_path(set, resource.name, rule),
+                              class: 'pf-btn pf-btn--ghost-danger' %>
+          </span>
+        <% end %>
+      </div>
+      <%= pf_rule_sentence(rule, resource.name) %>
+      <div class="pf-rule__meta">
+        <span><%= rule.join_rule? ? t('.join_rule') : t('.filter_rule', applies: (scoping == 'filter_only' ? t('.all_queries') : t('.scoped_lookups'))) %></span>
+        <% if rule.failure_message.present? %><span><%= t('.blocked_message', message: rule.failure_message) %></span><% end %>
+      </div>
+      <%= pf_audit_footer(rule) %>
+    </div>
+  <% end %>
+  <% if @rules.empty? %>
+    <p class="pf-card pf-empty">
+      <%= muting ? t('.empty_muting') : (resource.view_all ? t('.empty_view_all') : t('.empty', resources: pf_resource_plural(resource.name))) %>
+    </p>
+  <% end %>
+  <% unless locked || muting %>
+    <div><%= pf_modal_link "+ #{t('.add')}", permission_forge.new_permission_set_resource_rule_path(set, resource.name), kind: 'drawer', class: 'pf-btn pf-btn--sm' %></div>
+  <% end %>
+</div>

data/app/views/permission_forge/resources/_sync.html.erb

@@ -0,0 +1,57 @@
+<% fresh = @rows.new_columns %>
+<% missing = @rows.missing_fields %>
+<% ignored = @rows.ignored_columns %>
+<% sensitive = PermissionForge::Admin::SensitiveColumns.new %>
+<details class="pf-sync" <%= 'open' if params[:sync] %>>
+  <summary>
+    <span>⚠ <%= t('.title') %></span>
+    <span class="pf-fw-500"><%= [(t('.new_count', count: fresh.size) if fresh.any?), (t('.missing_count', count: missing.size) if missing.any?),
+                                 (t('.ignored_count', count: ignored.size) if ignored.any?)].compact.join(' · ') %></span>
+    <span class="pf-btn pf-btn--xs pf-ml-auto"><%= t('.review') %></span>
+  </summary>
+  <div class="pf-sync__body pf-grid-3">
+    <div class="pf-panel pf-stack">
+      <span class="pf-fw-600 pf-fs-13"><%= t('.new_title') %></span>
+      <% if fresh.empty? %><span class="pf-fs-13 pf-text-3"><%= t('.none') %></span><% end %>
+      <ul class="pf-stack pf-stack--tight">
+        <% fresh.each do |col| %>
+          <% match = sensitive.match(col) %>
+          <li class="pf-row pf-row--tight pf-fs-13">
+            <span><%= @rows.model.klass.human_attribute_name(col) %></span><code class="pf-mono-key"><%= col %></code>
+            <%= pf_badge(t('permission_forge.ui.badges.virtual')) if @rows.row(col)&.virtual %>
+            <% if match && !muting %><%= pf_badge(t('.sensitive_rec', strategy: pf_mask_strategy_label(match.strategy)), variant: :sensitive) %><% end %>
+          </li>
+        <% end %>
+      </ul>
+      <% if fresh.any? %>
+        <%= form_with url: permission_forge.sync_permission_set_resource_path(set, resource.name), method: :post, class: 'pf-reason-form' do %>
+          <input type="hidden" name="op" value="add_new">
+          <% (muting ? %w[hide] : %w[hidden read edit]).each do |level| %>
+            <button type="submit" name="level" value="<%= level %>" class="pf-btn pf-btn--xs"><%= t(".add_as.#{level}") %></button>
+          <% end %>
+          <%= render 'permission_forge/shared/reason_field', compact: true, id: 'pf-sync-add-reason' %>
+        <% end %>
+        <% unless muting %>
+          <span class="pf-hint"><%= PermissionForge.configuration.gdpr_defaults ? t('.gdpr_on') : t('.gdpr_off') %> <%= pf_setting_link('gdpr_defaults') %></span>
+        <% end %>
+      <% end %>
+    </div>
+    <div class="pf-panel pf-stack">
+      <span class="pf-fw-600 pf-fs-13"><%= t('.missing_title') %></span>
+      <% if missing.empty? %><span class="pf-fs-13 pf-text-3"><%= t('.none') %></span><% end %>
+      <div class="pf-row pf-row--tight"><% missing.each do |row| %><code class="pf-mono-key pf-strike"><%= row.name %></code><% end %></div>
+      <% if missing.any? %>
+        <%= form_with url: permission_forge.sync_permission_set_resource_path(set, resource.name), method: :post, class: 'pf-reason-form' do %>
+          <input type="hidden" name="op" value="remove_missing">
+          <button type="submit" class="pf-btn pf-btn--xs pf-btn--danger"><%= t('.remove_missing') %></button>
+          <%= render 'permission_forge/shared/reason_field', compact: true, id: 'pf-sync-remove-reason' %>
+        <% end %>
+      <% end %>
+    </div>
+    <div class="pf-panel pf-stack">
+      <span class="pf-fw-600 pf-fs-13"><%= t('.ignored_title') %></span>
+      <div class="pf-row pf-row--tight"><% ignored.each do |col| %><code class="pf-mono-key"><%= col %></code><% end %></div>
+      <%= pf_setting_link('ignored_fields', t('.ignored_link')) %>
+    </div>
+  </div>
+</details>

data/app/views/permission_forge/resources/confirm_destroy.html.erb

@@ -0,0 +1,17 @@
+<% set = @permission_set %>
+<% label = pf_resource_label(@resource) %>
+<% content_for :pf_title, t('.title', resource: label, set: set.name) %>
+<%= pf_dialog_frame({ title: t('.title', resource: label, set: set.name), danger: true,
+                     breadcrumb: pf_breadcrumb([t('permission_forge.nav.permission_sets'), permission_forge.permission_sets_path],
+                                               [set.name, permission_forge.permission_set_path(set)], label) }) do %>
+  <p class="pf-text-2">
+    <%= set.is_muting ? t('.body_muting', people: pf_people_text(@people_count)) : t('.body', people: pf_people_text(@people_count), resources: pf_resource_plural(@resource.name)) %>
+  </p>
+  <%= form_with url: permission_forge.permission_set_resource_path(set, @resource.name), method: :delete, class: 'pf-confirm-form' do %>
+    <%= render 'permission_forge/shared/reason_field' %>
+    <div class="pf-actions pf-row--right">
+      <%= link_to t('permission_forge.ui.cancel'), permission_forge.permission_set_resource_path(set, @resource.name), class: 'pf-btn', data: { pf_close: true } %>
+      <button type="submit" class="pf-btn pf-btn--danger-solid"><%= t('.confirm') %></button>
+    </div>
+  <% end %>
+<% end %>

data/app/views/permission_forge/resources/new.html.erb

@@ -0,0 +1,57 @@
+<% set = @permission_set %>
+<% content_for :pf_title, t('.title') %>
+<% back = permission_forge.permission_set_path(set) %>
+<%= pf_dialog_frame({ title: t('.title'), role: 'dialog', wide: true,
+                     breadcrumb: pf_breadcrumb([t('permission_forge.nav.permission_sets'), permission_forge.permission_sets_path], [set.name, back], t('.title')) }) do %>
+  <p class="pf-text-2"><%= t('.intro', app: pf_default_app_name || t('.the_app')) %></p>
+  <%= form_with url: permission_forge.permission_set_resources_path(set), method: :post, class: 'pf-stack pf-stack--loose' do %>
+    <div class="pf-row pf-row--nowrap">
+      <label class="pf-sr-only" for="pf-model-q"><%= t('.search') %></label>
+      <input id="pf-model-q" class="pf-input" type="search" name="q" value="<%= params[:q] %>" placeholder="<%= t('.search') %>"
+             autocomplete="off" data-pf-live="pf-model-list" data-pf-live-url="<%= permission_forge.new_permission_set_resource_path(set) %>">
+      <button type="submit" class="pf-btn pf-btn--sm" formmethod="get" formaction="<%= permission_forge.new_permission_set_resource_path(set) %>"><%= t('permission_forge.ui.search') %></button>
+    </div>
+    <div id="pf-model-list" class="pf-listbox pf-listbox--short">
+      <div class="pf-listbox__scroll" role="radiogroup" aria-label="<%= t('.models') %>">
+        <% if @shown.empty? %><p class="pf-option pf-text-3"><%= t('.no_models') %></p><% end %>
+        <% @shown.each do |model| %>
+          <% taken = @existing.include?(model.name) %>
+          <% cols = model.managed_column_names %>
+          <% sens = cols.count { |c| @sensitive.sensitive?(c) } %>
+          <label class="pf-option">
+            <input type="radio" name="model_name" value="<%= model.name %>" <%= 'checked' if @selected == model.name %> <%= 'disabled' if taken %> required>
+            <span class="pf-option__main">
+              <span class="pf-row pf-row--tight"><span class="pf-fw-600"><%= model.label %></span><code class="pf-mono-key"><%= model.name %></code></span>
+              <span class="pf-fs-12 pf-text-3"><%= [t('.columns', count: cols.size), (t('.sensitive', count: sens) if sens.positive?)].compact.join(' · ') %></span>
+            </span>
+            <% if taken %><span class="pf-option__aside"><%= t('.already') %></span><% end %>
+          </label>
+        <% end %>
+      </div>
+    </div>
+    <% if @error %><p class="pf-error" role="alert"><%= @error %></p><% end %>
+
+    <fieldset class="pf-stack">
+      <legend class="pf-label"><%= t('.start_from') %></legend>
+      <div class="pf-choices" role="radiogroup">
+        <% @presets.each do |preset| %>
+          <label class="pf-choice<%= ' pf-choice--muting' if set.is_muting %>">
+            <input type="radio" name="preset" value="<%= preset %>" <%= 'checked' if @preset == preset %>>
+            <span class="pf-choice__box">
+              <span class="pf-choice__title"><%= t(".presets.#{preset}.title") %></span>
+              <span class="pf-choice__desc"><%= t(".presets.#{preset}.desc") %></span>
+            </span>
+          </label>
+        <% end %>
+      </div>
+    </fieldset>
+    <% unless set.is_muting %>
+      <p class="pf-hint"><%= PermissionForge.configuration.gdpr_defaults ? t('.note_gdpr') : t('.note') %> <%= pf_setting_link('gdpr_defaults') %></p>
+    <% end %>
+    <%= render 'permission_forge/shared/reason_field', id: 'pf-resource-reason', value: params[:reason] %>
+    <div class="pf-actions pf-row--right">
+      <%= link_to t('permission_forge.ui.cancel'), back, class: 'pf-btn', data: { pf_close: true } %>
+      <button type="submit" class="pf-btn pf-btn--primary"><%= t('.add') %></button>
+    </div>
+  <% end %>
+<% end %>