permission_forge 0.14.1

data/lib/generators/permission_forge/upgrade/templates/add_audit_events.rb.tt

@@ -0,0 +1,98 @@
+class PermissionForgeAddAuditEvents < ActiveRecord::Migration<%= migration_version %>
+  # Creates the insert-only audit log and the columns the access review and the
+  # "This is intended" acknowledgement record. Every step is guarded, so running
+  # it against an install that already has them changes nothing. Existing
+  # assignments are not backfilled: a blank reviewed_at means "never reviewed".
+  def up
+    create_audit_events unless table_exists?(:<%= table_prefix %>audit_events)
+    add_tenant_column
+    add_audit_indexes
+
+    add_column_once :<%= table_prefix %>permission_set_users, :reviewed_at, :datetime
+    add_column_once :<%= table_prefix %>permission_set_users, :reviewed_by_id, user_key_type
+    add_column_once :<%= table_prefix %>permission_set_users, :reason, :string
+    add_column_once :<%= table_prefix %>permission_set_group_users, :reason, :string
+    add_column_once :<%= table_prefix %>resource_fields, :sensitive_acknowledged_by_id, user_key_type
+  end
+
+  # The audit log is evidence, and `up` may have changed nothing because the
+  # install already owned these objects, so a rollback must never delete it.
+  def down
+    raise ActiveRecord::IrreversibleMigration,
+          'The audit log is evidence: permission_forge_add_audit_events does not drop the audit_events table ' \
+          'or its columns on rollback. Remove them deliberately, by hand, if you really mean to.'
+  end
+
+  private
+
+  # No foreign keys: events outlive the records they describe.
+  def create_audit_events
+    create_table :<%= table_prefix %>audit_events do |t|
+      t.string   :uuid, null: false
+      t.datetime :occurred_at, null: false, precision: 6
+      t.string   :event, null: false
+      t.string   :category, null: false
+      t.string   :actor_type, null: false
+      t.string   :actor_id
+      t.string   :actor_label
+      t.string   :source, null: false
+      t.string   :record_type
+      t.string   :record_id
+      t.string   :record_uuid
+      t.string   :record_label
+      t.bigint   :permission_set_id
+      t.string   :permission_set_uuid
+      t.string   :subject_user_id
+      t.text     :data
+      t.string   :reason
+      t.string   :request_id
+      t.string   :ip
+      t.string   :correlation_id
+<% if tenant_column %>      t.column   :<%= tenant_column %>, tenant_key_type
+<% end %>      t.datetime :created_at, null: false
+    end
+  end
+
+  # A table made by an earlier run without tenancy gets the column before its index.
+  def add_tenant_column
+<% if tenant_column %>    add_column_once :<%= table_prefix %>audit_events, :<%= tenant_column %>, tenant_key_type
+<% end %>  end
+
+  def add_audit_indexes
+    table = :<%= table_prefix %>audit_events
+    add_index_once table, :uuid, unique: true, name: 'idx_pf_audit_uuid'
+    add_index_once table, :occurred_at, name: 'idx_pf_audit_occurred'
+    add_index_once table, %i[event occurred_at], name: 'idx_pf_audit_event'
+    add_index_once table, %i[subject_user_id occurred_at], name: 'idx_pf_audit_subject'
+    add_index_once table, %i[permission_set_id occurred_at], name: 'idx_pf_audit_pset'
+    add_index_once table, %i[permission_set_uuid occurred_at], name: 'idx_pf_audit_pset_uuid'
+    add_index_once table, %i[record_type record_id occurred_at], name: 'idx_pf_audit_record'
+    add_index_once table, %i[actor_id occurred_at], name: 'idx_pf_audit_actor'
+    add_index_once table, :correlation_id, name: 'idx_pf_audit_correlation'
+<% if tenant_column %>    add_index_once table, :<%= tenant_column %>, name: 'idx_pf_audit_tenant'
+<% end %>  end
+
+  # User and tenant ids keep the type the install already uses (a UUID or
+  # string key must not be truncated by a bigint column); bigint when unknown.
+  def user_key_type
+    key_type_of(:<%= table_prefix %>permission_set_users, :user_id)
+  end
+
+  def tenant_key_type
+<% if tenant_column %>    key_type_of(:<%= table_prefix %>permission_sets, :<%= tenant_column %>)
+<% else %>    :bigint
+<% end %>  end
+
+  def key_type_of(table, column)
+    existing = table_exists?(table) && connection.columns(table).find { |c| c.name == column.to_s }
+    existing ? existing.sql_type : :bigint
+  end
+
+  def add_column_once(table, column, type)
+    add_column table, column, type unless column_exists?(table, column)
+  end
+
+  def add_index_once(table, columns, **options)
+    add_index table, columns, **options unless index_name_exists?(table, options[:name])
+  end
+end

data/lib/generators/permission_forge/upgrade/templates/add_resource_fields_unique_index.rb.tt

@@ -0,0 +1,69 @@
+class PermissionForgeAddResourceFieldsUniqueIndex < ActiveRecord::Migration<%= migration_version %>
+  def up
+    table = :<%= table_prefix %>resource_fields
+    index_name = 'idx_pf_resource_fields_unique'
+    columns = %i[resource_id name]
+    # Installs from 0.11 on create this unique index in their install
+    # migration: there is nothing to do. A same-named index that is not unique
+    # is replaced (add_index would fail on the existing name).
+    return if index_exists?(table, columns, name: index_name, unique: true)
+
+    remove_index table, name: index_name if index_name_exists?(table, index_name)
+
+    # Collapse any pre-existing duplicate (resource_id, name) rows before adding
+    # the unique index, otherwise index creation fails. Keep the most-restrictive
+    # row per group: masked over unmasked, then no-edit over edit, then lowest id.
+    duplicate_groups = select_rows(<<~SQL.squish)
+      SELECT resource_id, name, COUNT(*) AS c
+      FROM #{quote_table_name(table)}
+      GROUP BY resource_id, name
+      HAVING COUNT(*) > 1
+    SQL
+
+    duplicate_groups.each do |resource_id, name, _count|
+      rows = select_rows(<<~SQL.squish)
+        SELECT id, mask_access, edit_access
+        FROM #{quote_table_name(table)}
+        WHERE resource_id = #{quote(resource_id)}
+          AND name = #{quote(name)}
+      SQL
+
+      keeper = rows.min_by { |id, mask_access, edit_access| [truthy(mask_access) ? 0 : 1, truthy(edit_access) ? 1 : 0, id] }
+      loser_ids = rows.map(&:first) - [keeper.first]
+      next if loser_ids.empty?
+
+      # These deletes run past the models, so the audit log does not record
+      # them: the migration output is their trace.
+      say "resource_id #{resource_id}, name #{name.to_s.inspect}: kept id #{keeper[0]} " \
+          "(mask_access #{truthy(keeper[1])}, edit_access #{truthy(keeper[2])}); " \
+          "deleted ids #{loser_ids.sort.join(', ')} (not in the audit log)"
+
+      execute(<<~SQL.squish)
+        DELETE FROM #{quote_table_name(table)}
+        WHERE id IN (#{loser_ids.map { |id| quote(id) }.join(',')})
+      SQL
+    end
+
+    add_index table, columns, unique: true, name: index_name
+  end
+
+  # On an install from 0.11 on, `up` changed nothing, yet this removes the
+  # index the install migration created (as it always has).
+  def down
+    remove_index :<%= table_prefix %>resource_fields, name: 'idx_pf_resource_fields_unique'
+  end
+
+  private
+
+  def truthy(value)
+    [true, 1, '1', 't', 'true'].include?(value)
+  end
+
+  def select_rows(sql)
+    connection.select_rows(sql)
+  end
+
+  def quote(value)
+    connection.quote(value)
+  end
+end

data/lib/generators/permission_forge/upgrade/upgrade_generator.rb

@@ -0,0 +1,66 @@
+require 'rails/generators'
+require 'rails/generators/active_record'
+
+module PermissionForge
+  module Generators
+    # Adds schema hardening that shipped after the initial install, for apps that
+    # ran `permission_forge:install` before these guards existed.
+    #
+    #   bin/rails generate permission_forge:upgrade
+    #
+    # The table prefix defaults to the app's configured
+    # PermissionForge.table_name_prefix (the initializer is loaded by
+    # `rails generate`), so an app on unprefixed tables gets migrations for
+    # its real tables. Pass --table-prefix to override.
+    #
+    # Currently: de-duplicates any (resource_id, name) collisions in
+    # resource_fields (keeping the most-restrictive row) and adds the unique
+    # index that new installs get by default; adds the nullable
+    # resource_fields.sensitive_acknowledged_at column used by the admin UI's
+    # privacy audit ("This is intended"); creates the audit_events table and
+    # the review/reason columns (see add_audit_events.rb.tt).
+    class UpgradeGenerator < Rails::Generators::Base
+      include ActiveRecord::Generators::Migration
+
+      source_root File.expand_path('templates', __dir__)
+
+      class_option :table_prefix, type: :string, default: nil,
+                                  desc: 'Table name prefix (default: the configured PermissionForge.table_name_prefix)'
+      class_option :tenant_column, type: :string, default: nil,
+                                   desc: 'Tenant column of the audit table (default: the configured tenant column, if any)'
+
+      def copy_migration
+        migration_template 'add_resource_fields_unique_index.rb.tt',
+                           'db/migrate/permission_forge_add_resource_fields_unique_index.rb'
+      end
+
+      # Admin UI privacy audit: "This is intended" acknowledgements.
+      def copy_admin_ui_migration
+        migration_template 'add_admin_ui_columns.rb.tt',
+                           'db/migrate/permission_forge_add_admin_ui_columns.rb'
+      end
+
+      # Insert-only audit log (permission_forge_audit_events) and the columns
+      # the access review and acknowledgement record. Guarded: safe to re-run.
+      def copy_audit_events_migration
+        migration_template 'add_audit_events.rb.tt',
+                           'db/migrate/permission_forge_add_audit_events.rb'
+      end
+
+      private
+
+      def table_prefix
+        options[:table_prefix] || PermissionForge.table_name_prefix.to_s
+      end
+
+      # The tenant column of the app's other tables, or nil without tenancy.
+      def tenant_column
+        options[:tenant_column].presence || PermissionForge.configuration.resolved_tenant_column&.to_s
+      end
+
+      def migration_version
+        "[#{ActiveRecord::Migration.current_version}]"
+      end
+    end
+  end
+end

data/lib/permission_forge/admin/action_across_sets.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # One resource's action rows in every Permission Set that contains the
+    # resource: who manages an action and who permits it. Loaded on first use,
+    # once for all of the resource's action keys. Backs the Actions tab, the
+    # action drawers ("Across all Permission Sets") and the "Review and save"
+    # sentences.
+    #
+    # "Managed" means what ControllerActions::ManagedIndex means: a row in
+    # effect (ResourceAction#in_effect?) in any Permission Set, granting or
+    # muting. This reads the database, not the index, so it also knows *which*
+    # sets.
+    #
+    # @example
+    #   across = ActionAcrossSets.new('Customer')
+    #   across.managed?('export')         # => true
+    #   across.permitting_sets('export')  # => [#<PermissionSet name: "Sales rep">]
+    class ActionAcrossSets
+      def initialize(resource_name)
+        @resource_name = resource_name.to_s
+      end
+
+      # @param key [String, Symbol] action key (e.g. 'export')
+      # @return [Array<Hash>] { resource:, set:, action: (ResourceAction or nil), in_effect: }
+      #   for every set containing the resource — granting sets first, then by
+      #   name. in_effect is whether the row (or, without a row, the resource)
+      #   counts right now.
+      def rows(key)
+        name = key.to_s
+        resources.map do |resource|
+          action = action_in(resource, name)
+          { resource: resource, set: resource.permission_set, action: action, in_effect: (action || resource).in_effect? }
+        end
+      end
+
+      # @return [Boolean] whether any Permission Set manages the action right now
+      def managed?(key)
+        live_rows.key?(key.to_s)
+      end
+
+      # @return [Array<PermissionForge::PermissionSet>] granting sets whose row
+      #   permits the action right now
+      def permitting_sets(key)
+        live_rows.fetch(key.to_s, []).filter_map do |permission_set, action|
+          permission_set if action.is_permitted && !permission_set.is_muting
+        end
+      end
+
+      private
+
+      def resources
+        @resources ||= PermissionForge::Resource.where(name: @resource_name).includes(:permission_set, :resource_actions)
+                                                .sort_by { |resource| sort_key(resource.permission_set) }
+      end
+
+      def sort_key(permission_set)
+        [permission_set.is_muting ? 1 : 0, permission_set.name]
+      end
+
+      # { 'export' => [[PermissionSet, ResourceAction], ...] } — the rows in effect.
+      def live_rows
+        @live_rows ||= resources.each_with_object({}) do |resource, index|
+          resource.resource_actions.select(&:in_effect?).each do |action|
+            (index[action.name] ||= []) << [resource.permission_set, action]
+          end
+        end
+      end
+
+      def action_in(resource, name)
+        resource.resource_actions.find { |action| action.name == name }
+      end
+    end
+  end
+end

data/lib/permission_forge/admin/action_rows.rb

@@ -0,0 +1,156 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # One row per action on a Resource page: configured ResourceActions and —
+    # while controller_action_discovery is on — the app's controller actions
+    # that map to the resource but have no row in this set yet.
+    #
+    # Each row carries where the action runs (endpoints, with whether that
+    # controller runs the action guard) and what the saved configuration
+    # means right now for people with this set (effect).
+    #
+    # @example
+    #   rows = ActionRows.new(resource)
+    #   rows.configured_rows.map(&:name)  # => ['export']
+    #   rows.discovered_rows.map(&:name)  # => ['archive', 'merge']
+    #   rows.row('archive').effect        # => :unmanaged_allowed
+    class ActionRows
+      # endpoints: ControllerCatalog::Entry list (empty while discovery is off).
+      # unlinked:  configured, but no controller action maps to it — normal for
+      #            an action the app checks in code with can?.
+      # standing:  what the row means right now (see Standing).
+      Row = Struct.new(:name, :label, :action, :endpoints, :unlinked, :standing, keyword_init: true) do
+        delegate :effect, :permitted_by, to: :standing
+
+        def configured? = !action.nil?
+      end
+
+      # What one action means right now for people with this set, and which
+      # sets permit it. The other Permission Sets are only read when a row is
+      # asked for it: the Actions tab shows it only while discovery is on.
+      #
+      # effect:
+      #   :permitted          this set permits it
+      #   :not_permitted      this set has a row that does not permit it
+      #   :blocked            this muting set blocks it
+      #   :unchanged          this muting set has a row that does not block it
+      #   :managed_elsewhere  no row in effect here, and another set manages it
+      #   :unmanaged_allowed  no set manages it — everyone can run it
+      #   :unmanaged_blocked  no set manages it — blocked until a set permits it
+      class Standing
+        # @param action [PermissionForge::ResourceAction, nil] this set's row
+        def initialize(key, action, across:, configuration:)
+          @key = key
+          @action = action
+          @across = across
+          @configuration = configuration
+        end
+
+        def effect
+          @effect ||= @action&.in_effect? ? row_effect : effect_without_row
+        end
+
+        # @return [Array<PermissionForge::PermissionSet>] granting sets that
+        #   permit the action right now
+        def permitted_by
+          @permitted_by ||= @across.permitting_sets(@key)
+        end
+
+        private
+
+        # This set's row is in effect. In a muting set is_permitted means "block".
+        def row_effect
+          flagged = @action.is_permitted
+          if @action.resource.permission_set.is_muting
+            flagged ? :blocked : :unchanged
+          else
+            flagged ? :permitted : :not_permitted
+          end
+        end
+
+        # No row in effect here: another set manages it, or nobody does.
+        def effect_without_row
+          return :managed_elsewhere if @across.managed?(@key)
+
+          @configuration.allow_unconfigured_actions? ? :unmanaged_allowed : :unmanaged_blocked
+        end
+      end
+
+      def initialize(resource, catalog: nil, configuration: PermissionForge.configuration,
+                     across: ActionAcrossSets.new(resource.name))
+        @resource = resource
+        @catalog = catalog
+        @configuration = configuration
+        @across = across
+      end
+
+      # @return [Boolean] whether the app's controller actions are listed
+      def discovery?
+        @configuration.controller_action_discovery?
+      end
+
+      # @return [Array<Row>] configured rows, then discovered ones, each by key
+      def rows
+        @rows ||= configured_rows + discovered_rows
+      end
+
+      def configured_rows
+        @configured_rows ||= saved_actions.sort_by(&:name).map { |action| build_row(action.name, action) }
+      end
+
+      # Controller actions that map to the resource and have no row in this set.
+      def discovered_rows
+        @discovered_rows ||= (endpoints_by_key.keys - configured_names).sort.map { |key| build_row(key, nil) }
+      end
+
+      def row(name)
+        key = name.to_s
+        rows.find { |row| row.name == key }
+      end
+
+      # Discovered keys with no row yet, offered on the free-text "new action" form.
+      def suggestions
+        discovered_rows.map(&:name)
+      end
+
+      # @return [Boolean] whether any of the app's listed controllers runs the
+      #   action guard (false: nothing here is enforced at runtime)
+      def any_guarded?
+        catalog.any_guarded?
+      end
+
+      # This action (by key) in every Permission Set containing the resource.
+      def across_sets(key)
+        @across.rows(key)
+      end
+
+      private
+
+      def catalog
+        @catalog ||= ControllerCatalog.new(configuration: @configuration)
+      end
+
+      # Rows a form built on the association but has not saved are not configured.
+      def saved_actions
+        @resource.resource_actions.select(&:persisted?)
+      end
+
+      def configured_names
+        saved_actions.map(&:name)
+      end
+
+      # { 'export' => [ControllerCatalog::Entry, ...] }; empty while discovery is off.
+      def endpoints_by_key
+        @endpoints_by_key ||= discovery? ? catalog.for_resource(@resource.name).group_by(&:key) : {}
+      end
+
+      def build_row(key, action)
+        endpoints = endpoints_by_key.fetch(key, [])
+        Row.new(name: key, label: action&.display_name || key.humanize, action: action, endpoints: endpoints,
+                unlinked: discovery? && endpoints.empty?,
+                standing: Standing.new(key, action, across: @across, configuration: @configuration))
+      end
+    end
+  end
+end

data/lib/permission_forge/admin/attention_items.rb

@@ -0,0 +1,207 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # Everything the admin home page asks the owner to look at. Each finder is
+    # a read-only query; actions (extend, keep, clean up, acknowledge) live in
+    # the controllers.
+    class AttentionItems
+      ENDING_DAYS = 7
+
+      # `field` — the field row, when there is one, switched on or off.
+      # `implicit_grant` — no active field row, and the field is readable and
+      # editable anyway because the model declares it as an extra (virtual) field.
+      SensitiveFinding = Struct.new(:permission_set, :resource, :field, :column, :match, :people_count, :implicit_grant,
+                                    keyword_init: true) do
+        # No setting in force: no row, or one that is turned off (the engine skips it).
+        def unconfigured? = field.nil? || turned_off?
+        def turned_off? = !field.nil? && !field.is_active
+        def implicit_grant? = implicit_grant == true
+        def name = field&.name || column
+      end
+
+      TidyFinding = Struct.new(:permission_set, :kind, :people_count, keyword_init: true) do
+        # A finding for an active set nobody uses, or an inactive set people
+        # are still assigned to; nil otherwise.
+        def self.for(permission_set, people)
+          active = permission_set.is_active
+          if people.zero? && active
+            new(permission_set: permission_set, kind: :no_people, people_count: 0)
+          elsif people.positive? && !active
+            new(permission_set: permission_set, kind: :inactive_with_people, people_count: people)
+          end
+        end
+      end
+
+      # Active record rules the app's query scoping won't apply to every query:
+      # all of them while auto_query_scoping is off, join rules when it's on.
+      RulesFinding = Struct.new(:permission_set, :resource, :rule_count, :people_count, keyword_init: true) do
+        def self.build(resource, rule_count, people_counts)
+          new(permission_set: resource.permission_set, resource: resource, rule_count: rule_count,
+              people_count: people_counts.fetch(resource.permission_set_id, 0))
+        end
+      end
+
+      def self.acknowledgement_supported?
+        PermissionForge::ResourceField.column_names.include?('sensitive_acknowledged_at')
+      rescue StandardError
+        false
+      end
+
+      def initialize(configuration: PermissionForge.configuration, catalog: ModelCatalog.new,
+                     sensitive: SensitiveColumns.new(configuration: configuration))
+        @configuration = configuration
+        @catalog = catalog
+        @sensitive = sensitive
+      end
+
+      def total
+        [audit_findings.size, privacy_findings.size, unenforced_rules.size, ending_soon.size, expired.size, stale.size,
+         tidy.size].sum
+      end
+
+      def all_good?
+        total.zero?
+      end
+
+      # --- Audit log -----------------------------------------------------------
+
+      # [AuditLog.recording_problem] — :off, :failing or :missing_table —
+      # while the log does not record. Empty when it records.
+      def audit_findings
+        @audit_findings ||= [audit_problem].compact
+      end
+
+      # --- Privacy audit ------------------------------------------------------
+
+      def privacy_findings
+        @privacy_findings ||= unmasked_sensitive_fields + unconfigured_sensitive_fields
+      end
+
+      # --- Record rules --------------------------------------------------------
+
+      def unenforced_rules
+        @unenforced_rules ||= begin
+          enforced = rule_enforced_resources
+          counts = unenforced_rule_scope.where(resource_id: enforced.keys).group(:resource_id).count
+          findings = counts.map { |id, count| RulesFinding.build(enforced.fetch(id), count, people_counts) }
+          findings.sort_by { |finding| [finding.permission_set.name, finding.resource.name] }
+        end
+      end
+
+      def auto_query_scoping?
+        @configuration.auto_query_scoping_enabled?
+      end
+
+      # --- Assignments --------------------------------------------------------
+
+      def ending_soon
+        @ending_soon ||= assignments.where(expires_at: Time.current..ENDING_DAYS.days.from_now.end_of_day)
+                                    .order(:expires_at).to_a
+      end
+
+      def expired
+        @expired ||= assignments.expired.order(:expires_at).to_a
+      end
+
+      def stale
+        @stale ||= assignments.stale_before(stale_days.days.ago)
+                              .order(PermissionForge::PermissionSetUser.last_reviewed_column).to_a
+      end
+
+      def stale_days
+        @configuration.admin_stale_assignment_days || 90
+      end
+
+      # --- Permission Sets to tidy up -----------------------------------------
+
+      def tidy
+        @tidy ||= PermissionForge::PermissionSet.order(:name).filter_map do |ps|
+          TidyFinding.for(ps, people_counts.fetch(ps.id, 0))
+        end
+      end
+
+      private
+
+      def audit_problem = AuditLog.recording_problem(@configuration)
+
+      def assignments
+        PermissionForge::PermissionSetUser.includes(:permission_set, :user)
+      end
+
+      # Resources whose rules are in force (View All / Modify All skip them), by id.
+      def rule_enforced_resources
+        granting_resources.reject(&:rules_bypassed?).index_by(&:id)
+      end
+
+      def unenforced_rule_scope
+        rules = PermissionForge::PermissionSetRule.active
+        auto_query_scoping? ? rules.join_type_rules : rules
+      end
+
+      def people_counts
+        @people_counts ||= PermissionForge::PermissionSetUser.active_assignments.group(:permission_set_id).count
+      end
+
+      def granting_resources
+        @granting_resources ||= PermissionForge::Resource.active.where(read_access: true)
+                                                         .where(permission_set_id: PermissionForge::PermissionSet.active.granting.select(:id))
+                                                         .includes(:permission_set, :resource_fields).to_a
+      end
+
+      def unmasked_sensitive_fields
+        acknowledged = self.class.acknowledgement_supported?
+        granting_resources.flat_map do |resource|
+          resource.resource_fields.filter_map do |field|
+            sensitive_finding(resource, field.name, field: field) if exposed?(field, acknowledged)
+          end
+        end
+      end
+
+      # Readable and unmasked, and not acknowledged as intentional.
+      def exposed?(field, acknowledged)
+        return false unless field.is_active && field.read_access && !field.mask_access
+
+        !(acknowledged && field.sensitive_acknowledged_at.present?)
+      end
+
+      # Sensitive columns and virtual fields with no active field row are a
+      # leak when they are readable unmasked anyway: the unconfigured-field
+      # strategy lets them through, or the model declares them as extra fields
+      # and extra_fields_default_access grants those. A switched-off row
+      # counts as no row, because the engine skips it; its finding keeps the
+      # row, so the card can say "turned off" instead of "not configured".
+      def unconfigured_sensitive_fields
+        passes = %w[pass_through warn].include?(@configuration.unconfigured_field_strategy.to_s)
+        return [] unless passes || @configuration.grant_extra_fields_by_default?
+
+        granting_resources.flat_map { |resource| unconfigured_findings(resource, passes) }
+      end
+
+      # `passes` — whether unconfigured_field_strategy lets a field with no row through.
+      def unconfigured_findings(resource, passes)
+        model = @catalog.find(resource.name)
+        return [] unless model
+
+        rows = resource.resource_fields.index_by(&:name)
+        model.managed_field_names.filter_map do |name|
+          row = rows[name]
+          next if row&.is_active
+
+          implicit = model.implicit_grant?(name)
+          sensitive_finding(resource, name, field: row, implicit_grant: implicit) if implicit || passes
+        end
+      end
+
+      # A finding when `column` looks sensitive, else nil. `details` are the
+      # finding's own attributes (field:, implicit_grant:).
+      def sensitive_finding(resource, column, **details)
+        match = @sensitive.match(column)
+        return unless match
+
+        SensitiveFinding.new(permission_set: resource.permission_set, resource: resource, column: column, match: match,
+                             people_count: people_counts.fetch(resource.permission_set_id, 0), **details)
+      end
+    end
+  end
+end