permission_forge 0.14.1

data/lib/permission_forge/admin/audit_event_detail.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # What the audit event page (audit_events/show) lays out for one event: the
+    # event's data split into its before/after changes, its snapshot and
+    # whatever else it carries, and which of the who/what rows have a value.
+    # The template only draws it.
+    #
+    # @example
+    #   detail = AuditEventDetail.new(event, AuditLookups.new([event]))
+    #   detail.change_rows   # => [['mask_strategy', 'full', 'last4']]
+    #   detail.no_data?      # => false
+    class AuditEventDetail
+      SNAPSHOT_ENDINGS = %w[destroyed revoked removed].freeze
+
+      attr_reader :event, :lookups
+
+      def initialize(event, lookups)
+        @event = event
+        @lookups = lookups
+      end
+
+      # The person who acted, when the actor is a user we can open.
+      def actor_user
+        lookups.person(event.actor_id) if event.actor_type == 'user'
+      end
+
+      def person = lookups.person(event.subject_user_id)
+      def permission_set = lookups.permission_set(event.permission_set_id)
+
+      def actor_id? = event.actor_id.present?
+      def record? = event.record_type.present?
+      def record_id? = event.record_id.present?
+      def record_uuid? = event.record_uuid.present?
+      def permission_set? = event.permission_set_id.present? || event.permission_set_uuid.present?
+      def permission_set_key = event.permission_set_id || event.permission_set_uuid
+      def subject_user? = event.subject_user_id.present?
+      def correlation? = event.correlation_id.present?
+
+      # [attribute, before, after] per changed attribute; a bare value (not a
+      # [before, after] pair) is an "after" with no before.
+      def change_rows
+        return [] unless changes
+
+        changes.map do |attribute, pair|
+          before, after = pair.is_a?(Array) && pair.size == 2 ? pair : [nil, pair]
+          [attribute, before, after]
+        end
+      end
+
+      def changes? = !changes.nil?
+      def changes_count = changes&.size.to_i
+      def snapshot? = !snapshot.nil?
+      def snapshot_rows = snapshot.to_a
+
+      # The event's snapshot is of something that went away.
+      def snapshot_of_removed? = event.event.end_with?(*SNAPSHOT_ENDINGS)
+
+      def other_rows = other.to_a
+      def other? = other.any?
+      def no_data? = changes.nil? && snapshot.nil? && other.empty?
+
+      private
+
+      def data = @data ||= event.data.is_a?(Hash) ? event.data : {}
+      def changes = @changes ||= (data['changes'] if data['changes'].is_a?(Hash))
+      def snapshot = @snapshot ||= (data['snapshot'] if data['snapshot'].is_a?(Hash))
+
+      def other
+        @other ||= data.reject { |key, _| (key == 'changes' && changes) || (key == 'snapshot' && snapshot) }
+      end
+    end
+  end
+end

data/lib/permission_forge/admin/audit_log.rb

@@ -0,0 +1,193 @@
+# frozen_string_literal: true
+
+require 'active_support/core_ext/numeric/time' # KNOWN_PEOPLE_WINDOW, read as this file loads
+
+module PermissionForge
+  module Admin
+    # The admin's audit log: the events that match a filter, newest first,
+    # one page at a time, with no cap on how far back the pages go.
+    # Filtering is Audit::EventQuery's (the JSON API uses the same), so an
+    # invalid value raises Audit::EventQuery::Invalid naming the parameter.
+    #
+    #   log = AuditLog.new(params)                       # every event
+    #   log = AuditLog.new(params, scope: AuditLog.for_permission_set(set))
+    #   log.page(params[:page])                          # => AuditLog::Page
+    #   log.relation                                     # the whole result (exports)
+    class AuditLog
+      FILTERS = %w[from to event category actor_type actor_id subject_user_id permission_set correlation_id
+                   record_type record_id record_uuid].freeze
+      PER_PAGE = 50
+      MAX_PAGE = 10_000_000
+      KNOWN_PEOPLE = 500
+      # known_people looks this far back (the occurred_at index serves it).
+      KNOWN_PEOPLE_WINDOW = 90.days
+      # Every view of the log writes one; left out of the default list and
+      # the timelines so they do not bury the changes (exports keep them).
+      VIEW_EVENT = 'audit.viewed'
+
+      Page = Struct.new(:events, :total, :number, :per_page, keyword_init: true) do
+        def pages = [(total + per_page - 1) / per_page, 1].max
+        def first_index = total.zero? ? 0 : ((number - 1) * per_page) + 1
+        def last_index = [number * per_page, total].min
+        def previous? = number > 1
+        def next? = number < pages
+      end
+
+      # Whether the audit table exists (the upgrade migration has run). The
+      # log can be read while recording is switched off; without the table
+      # there is nothing to read and every list is empty.
+      def self.table?
+        PermissionForge::AuditEvent.table_exists?
+      rescue StandardError
+        false
+      end
+
+      # Why the log is not recording, or nil when it records:
+      #   :off            audit_events is false (with or without the table)
+      #   :failing        audit_events is true, the table is missing and
+      #                   audit_change_failure_strategy is :raise — every
+      #                   permission change fails
+      #   :missing_table  the table is missing otherwise — nothing is recorded
+      def self.recording_problem(configuration = PermissionForge.configuration)
+        return :off if configuration.audit_events == false
+        return if table?
+        return :failing if configuration.audit_events == true && configuration.audit_change_failure_strategy == :raise
+
+        :missing_table
+      end
+
+      # The events of a Permission Set: its own, its resources', fields',
+      # actions', rules' and assignments' (permission_set_id is filled on all).
+      def self.for_permission_set(permission_set)
+        return PermissionForge::AuditEvent.none unless table?
+
+        PermissionForge::AuditEvent.where(permission_set_id: permission_set.id)
+      end
+
+      # The events about a person (their access) or by them (as the actor).
+      def self.for_person(user_id)
+        events = PermissionForge::AuditEvent
+        return events.none unless table?
+
+        events.where(subject_user_id: user_id.to_s).or(events.where(actor_type: 'user', actor_id: user_id.to_s))
+      end
+
+      # The filter parameters that are set, by name. Values are kept as
+      # given (an array stays an array, so EventQuery can refuse it).
+      #
+      # @param params [ActionController::Parameters, Hash]
+      # @return [ActiveSupport::HashWithIndifferentAccess]
+      def self.filters(params)
+        indifferent(params).slice(*FILTERS).reject { |_, value| value.blank? }
+      end
+
+      def self.indifferent(params)
+        (params.respond_to?(:to_unsafe_h) ? params.to_unsafe_h : params.to_h).with_indifferent_access
+      end
+
+      attr_reader :filters
+
+      # @param params [ActionController::Parameters, Hash] see FILTERS; `views: '1'`
+      #   keeps the views of the log in the list
+      # @param scope [ActiveRecord::Relation] the events to filter
+      # @param include_views [Boolean] keep the views of the log whatever the params say (exports)
+      def initialize(params = {}, scope: PermissionForge::AuditEvent.all, include_views: false)
+        @filters = self.class.filters(params)
+        @views_asked = self.class.indifferent(params)[:views].to_s == '1'
+        @include_views = include_views
+        @scope = scope
+      end
+
+      # Views of the log are listed when asked for, when the filter names an
+      # event or a category (whatever it names is shown), and in exports.
+      def include_views?
+        @include_views || @views_asked || @filters.key?('event') || @filters.key?('category')
+      end
+
+      # The filters plus the views toggle, for links that keep the page's state.
+      def link_params
+        @views_asked ? @filters.merge('views' => '1') : @filters
+      end
+
+      # @return [ActiveRecord::Relation] newest first
+      # @raise [Audit::EventQuery::Invalid]
+      def relation
+        @relation ||= PermissionForge::Audit::EventQuery.call(AuditLogDays.localize(@filters), scope: base_scope)
+      end
+
+      def base_scope
+        return @scope.none unless self.class.table?
+
+        include_views? ? @scope : @scope.where.not(event: VIEW_EVENT)
+      end
+      private :base_scope
+
+      # A page past the last one shows the last page.
+      #
+      # @param number [Object] the page parameter (1 when absent or not a number)
+      # @return [Page]
+      # @raise [Audit::EventQuery::Invalid]
+      def page(number, per_page: PER_PAGE)
+        total = relation.count
+        current = self.class.page_number(number, total, per_page)
+        events = relation.offset((current - 1) * per_page).limit(per_page).to_a
+        Page.new(events: events, total: total, number: current, per_page: per_page)
+      end
+
+      # 1 for anything that is not a number; at most the last page.
+      def self.page_number(number, total, per_page)
+        return 1 unless number.to_s.match?(/\A\d{1,9}\z/)
+
+        last = [(total + per_page - 1) / per_page, 1].max
+        number.to_i.clamp(1, [last, MAX_PAGE].min)
+      end
+
+      # People the log names lately (KNOWN_PEOPLE_WINDOW), for the actor and
+      # person filters' suggestions: [[id, label], ...]
+      # by id. Actors keep the name the event recorded; people who are only
+      # subjects are named from the user model when they still exist.
+      #
+      # @return [Array<Array(String, String)>]
+      def self.known_people(limit: KNOWN_PEOPLE, configuration: PermissionForge.configuration)
+        return [] unless table?
+
+        actors = actor_labels(limit)
+        people = actors.merge(subject_names(subject_ids(limit) - actors.keys, configuration))
+        people.sort_by { |id, _| [id.to_s.rjust(20, '0'), id.to_s] }.first(limit)
+      end
+
+      # { actor id => the name the events recorded } of people acting lately.
+      def self.actor_labels(limit)
+        recent.where(actor_type: 'user').where.not(actor_id: nil).group(:actor_id).limit(limit).maximum(:actor_label)
+      end
+
+      def self.subject_ids(limit)
+        recent.where.not(subject_user_id: nil).group(:subject_user_id).limit(limit).count.keys
+      end
+
+      def self.recent
+        PermissionForge::AuditEvent.where(occurred_at: KNOWN_PEOPLE_WINDOW.ago..)
+      end
+
+      # { id => label (nil when the person is gone) } for every id.
+      def self.subject_names(ids, configuration)
+        return {} if ids.empty?
+
+        found = configuration.user_model.where(id: ids).to_h { |user| [user.id.to_s, PersonLabel.new(user).name] }
+        ids.index_with { |id| found[id.to_s] }
+      rescue StandardError
+        ids.index_with(nil)
+      end
+      private_class_method :actor_labels, :subject_ids, :subject_names, :recent
+
+      # Every catalogued event name, by category (the event filter).
+      # @return [Hash{String => Array<String>}]
+      def self.event_names_by_category
+        PermissionForge::Audit::EventCatalog.entries.values.group_by(&:category)
+                                            .transform_values { |entries| entries.map(&:name).sort }
+                                            .sort_by { |category, _| PermissionForge::AuditEvent::CATEGORIES.index(category) || 99 }
+                                            .to_h
+      end
+    end
+  end
+end

data/lib/permission_forge/admin/audit_log_days.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # The audit log page shows dates in the admin's time zone (Time.zone), so
+    # a date-only "from" / "to" means that day there: from its first to its
+    # last microsecond, with the offset written out for Audit::EventQuery
+    # (which reads a bare date as a UTC day — the JSON API keeps that).
+    # Anything else (a timestamp, an impossible date, a list) is left for
+    # EventQuery to accept or refuse.
+    module AuditLogDays
+      DATE = /\A(\d{4})-(\d{2})-(\d{2})\z/
+
+      module_function
+
+      # @param filters [Hash] the filters as given (string keys)
+      # @param zone [ActiveSupport::TimeZone]
+      # @return [Hash] the same, date-only from / to as local-day timestamps
+      def localize(filters, zone: Time.zone)
+        filters.merge(%w[from to].each_with_object({}) do |key, out|
+          day = local_day(filters[key], zone)
+          out[key] = (key == 'from' ? day.beginning_of_day : day.end_of_day).iso8601(6) if day
+        end)
+      end
+
+      def local_day(value, zone)
+        match = value.is_a?(String) && DATE.match(value)
+        return nil unless match && zone
+
+        year, month, day = match.captures.map(&:to_i)
+        zone.local(year, month, day) if year.positive? && Date.valid_date?(year, month, day)
+      end
+
+      # The zone's name for the page and the export metadata ("Pacific/Auckland").
+      def zone_name(zone = Time.zone)
+        name = zone.tzinfo&.name || zone.name
+        name == 'Etc/UTC' ? 'UTC' : name
+      end
+    end
+  end
+end

data/lib/permission_forge/admin/audit_lookups.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # The people, Permission Sets and Permission Set Groups a page of audit
+    # events names, loaded once for the page (one query per kind) so every
+    # row can say "Ana gave Bo the Permission Set Sales". A record that is
+    # gone is simply not found: the event's own label snapshots stand in.
+    #
+    # A set or group is named as it was when the event happened
+    # (#permission_set_name, #group_name): the label of its own latest event
+    # at or before that moment (a create, update or destroy keeps the name it
+    # had then), else the name its earliest later rename started from, else
+    # its name today (AuditNameHistory; no new column, a bounded read).
+    class AuditLookups
+      GROUP_KEYS = %w[permission_set_group_id].freeze
+
+      # @param events [Array<AuditEvent>]
+      def initialize(events, configuration: PermissionForge.configuration)
+        @events = Array(events)
+        @configuration = configuration
+      end
+
+      # @param id [String, Integer, nil] a user id
+      # @return [Object, nil] the host user
+      def person(id)
+        people[id.to_s] if id.present?
+      end
+
+      # @return [PermissionForge::PermissionSet, nil]
+      def permission_set(id)
+        permission_sets[id.to_i] if id.present?
+      end
+
+      # The Permission Set Group of a membership event (from its data).
+      # @return [PermissionForge::PermissionSetGroup, nil]
+      def group(event)
+        id = self.class.group_id(event)
+        groups[id.to_i] if id
+      end
+
+      # The Permission Set's name when `event` happened (nil: unknown).
+      # @return [String, nil]
+      def permission_set_name(event)
+        id = event.permission_set_id
+        return if id.blank?
+
+        set_history.name_as_of(id, event) || permission_set(id)&.name
+      end
+
+      # The name of a membership event's group when the event happened.
+      # @return [String, nil]
+      def group_name(event)
+        id = self.class.group_id(event)
+        return unless id
+
+        group_history.name_as_of(id, event) || groups[id.to_i]&.name
+      end
+
+      def self.group_id(event)
+        data = event.data || {}
+        snapshot = data['snapshot'].is_a?(Hash) ? data['snapshot'] : {}
+        changes = data['changes'].is_a?(Hash) ? data['changes'] : {}
+        GROUP_KEYS.each do |key|
+          value = snapshot[key] || Array(changes[key]).last
+          return value if value.present?
+        end
+        nil
+      end
+
+      private
+
+      def people
+        @people ||= begin
+          ids = @events.flat_map { |e| [e.subject_user_id, (e.actor_id if e.actor_type == 'user')] }.compact_blank.uniq
+          ids.empty? ? {} : @configuration.user_model.where(id: ids).index_by { |user| user.id.to_s }
+        rescue StandardError
+          {}
+        end
+      end
+
+      def permission_sets
+        @permission_sets ||= find_by_ids(PermissionForge::PermissionSet, @events.map(&:permission_set_id))
+      end
+
+      def groups
+        @groups ||= find_by_ids(PermissionForge::PermissionSetGroup, @events.map { |e| self.class.group_id(e) })
+      end
+
+      def find_by_ids(model, ids)
+        ids = ids.compact.map(&:to_i).uniq
+        ids.empty? ? {} : model.where(id: ids).index_by(&:id)
+      end
+
+      def set_history
+        @set_history ||= AuditNameHistory.new(PermissionForge::PermissionSet, @events.map(&:permission_set_id), @events)
+      end
+
+      def group_history
+        @group_history ||= AuditNameHistory.new(PermissionForge::PermissionSetGroup,
+                                                @events.map { |e| self.class.group_id(e) }, @events)
+      end
+    end
+  end
+end

data/lib/permission_forge/admin/audit_name_history.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # The name a Permission Set or group had when each event of a page
+    # happened, from the label snapshots of its own events (a create, update
+    # or destroy keeps the name it had then): the latest at or before the
+    # event, else what its first recorded rename started from (or that
+    # event's own label), else nil (the caller falls back to today's name).
+    #
+    # Reads a bounded slice, never the whole history: the record's events
+    # inside the page's time span and its one latest event before it (two
+    # plucks of four columns), plus one full event per record that has no
+    # earlier event at all (for its `changes`).
+    class AuditNameHistory
+      Entry = Struct.new(:record_id, :occurred_at, :id, :record_label)
+      COLUMNS = %i[record_id occurred_at id record_label].freeze
+
+      # @param model [Class] PermissionSet or PermissionSetGroup
+      # @param ids [Array] the record ids the page names
+      # @param events [Array<AuditEvent>] the page
+      def initialize(model, ids, events)
+        @ids = ids.compact_blank.map(&:to_s).uniq
+        @first, @last = events.filter_map(&:occurred_at).minmax
+        @scope = PermissionForge::AuditEvent.where(record_type: model.base_class.name, record_id: @ids)
+        @first_events = {}
+      end
+
+      # @return [String, nil]
+      def name_as_of(id, event)
+        return if @ids.empty? || @first.nil? || event.occurred_at.nil?
+
+        rows = entries.fetch(id.to_s, [])
+        earlier = latest_at_or_before(rows, [event.occurred_at, event.id || 0])
+        return earlier.record_label.presence if earlier
+
+        name_before(first_event(id.to_s, rows))
+      end
+
+      private
+
+      def latest_at_or_before(rows, moment)
+        rows.reverse_each.find { |row| ([row.occurred_at, row.id] <=> moment) <= 0 }
+      end
+
+      # { "id" => [Entry, ...] oldest first }
+      def entries
+        @entries ||= (span + latest_before_span).uniq(&:id).sort_by { |row| [row.occurred_at, row.id] }.group_by(&:record_id)
+      rescue ActiveRecord::ActiveRecordError
+        {}
+      end
+
+      def span = pluck(@scope.where(occurred_at: @first..@last))
+
+      def latest_before_span
+        latest = @scope.where(occurred_at: ...@first).group(:record_id).maximum(:occurred_at)
+        return [] if latest.empty?
+
+        pluck(latest.map { |id, at| @scope.where(record_id: id, occurred_at: at) }.reduce(:or))
+      end
+
+      def pluck(relation) = relation.pluck(*COLUMNS).map { |values| Entry.new(*values) }
+
+      # The record's first recorded event (it has none at or before the
+      # event asking): the first one in the span, else the first after it.
+      def first_event(id, rows)
+        return @first_events[id] if @first_events.key?(id)
+
+        @first_events[id] =
+          if rows.any? then PermissionForge::AuditEvent.find_by(id: rows.first.id)
+          else @scope.where(record_id: id).where(occurred_at: @last..).order(:occurred_at, :id).first
+          end
+      rescue ActiveRecord::ActiveRecordError
+        @first_events[id] = nil
+      end
+
+      def name_before(event)
+        return unless event
+
+        renamed = event.data.dig('changes', 'name')
+        renamed.is_a?(Array) ? renamed.first.presence : event.record_label.presence
+      end
+    end
+  end
+end

data/lib/permission_forge/admin/audit_trail.rb

@@ -0,0 +1,169 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # Who created and who last edited each permission record. Creation comes
+    # from created_by / created_at (HasAuditTrail); the last edit from the
+    # record's latest change event when the audit log has one (LastChanges),
+    # else from updated_by / updated_at — an event names the real editor,
+    # while updated_by keeps the previous one across an edit by nobody, an
+    # HTTP Basic login or an API client. The full history is the audit log
+    # (Admin::AuditLog).
+    class AuditTrail
+      TYPES = {
+        'permission_set' => 'PermissionForge::PermissionSet',
+        'resource' => 'PermissionForge::Resource',
+        'field' => 'PermissionForge::ResourceField',
+        'action' => 'PermissionForge::ResourceAction',
+        'rule' => 'PermissionForge::PermissionSetRule',
+        'assignment' => 'PermissionForge::PermissionSetUser',
+        'group' => 'PermissionForge::PermissionSetGroup',
+        'group_membership' => 'PermissionForge::PermissionSetGroupUser'
+      }.freeze
+
+      DAY_FILTERS = [7, 30, 90].freeze
+      CSV_HEADER = ['Type', 'Record', 'Where', 'Created by', 'Created at', 'Last edited by', 'Last edited at'].freeze
+
+      # `last_event` — the record's latest change event, or nil (no events:
+      # auditing off, or the record predates the audit log).
+      Entry = Struct.new(:type, :record, :last_event, keyword_init: true) do
+        def created_by = record.try(:created_by)
+        def updated_by = record.try(:updated_by)
+        def created_at = record.created_at
+        def created_by_id = record.try(:created_by_id)
+        def updated_by_id = record.try(:updated_by_id)
+
+        # When the last edit happened: the event's time when there is one.
+        def updated_at = last_event ? last_event.occurred_at : record.updated_at
+
+        # The last editor's user id as a String, or nil (not a person, or unknown).
+        def editor_id
+          return updated_by_id&.to_s unless last_event
+
+          last_event.actor_id if last_event.actor_type == 'user'
+        end
+      end
+
+      def self.type_of(record)
+        TYPES.key(record.class.name)
+      end
+
+      # People who appear as creator/editor in the given entries.
+      def self.editors(entries)
+        entries.flat_map { |e| [e.created_by, e.updated_by] }.compact.uniq(&:id)
+      end
+
+      # Records a person created or last edited, grouped by type, most
+      # recently edited first. `limit` caps each type (the admin page);
+      # nil lists everything (the CSV export).
+      # @return [Hash{String => Array<Entry>}]
+      def changes_by(user_id, limit: nil)
+        TYPES.each_with_object({}) do |(type, class_name), out|
+          records = touched_records(class_name.constantize, user_id, limit)
+          entries = entries_for(records.map { |record| [type, record] }).select { |entry| made_by?(entry, user_id) }
+          out[type] = entries if entries.any?
+        end
+      end
+
+      # Whether the last changes_by(limit:) read as many rows as the limit
+      # for some type (more may exist), whatever it kept of them.
+      def capped?
+        @capped == true
+      end
+
+      # Every record belonging to a Permission Set (the set, its resources,
+      # fields, actions, rules and assignments), filtered and sorted.
+      # Filters (all optional): who:, type:, days:, sort: ('asc' / 'desc', default 'desc').
+      # @return [Array<Entry>]
+      def for_permission_set(permission_set, **filters)
+        entries = apply_filters(permission_set_entries(permission_set), filters)
+        sorted = entries.sort_by { |e| e.updated_at || e.created_at || Time.at(0) }
+        filters[:sort].to_s == 'asc' ? sorted : sorted.reverse
+      end
+
+      # @param describe [#call] (entry) -> [type_label, record_label, where]
+      # @param person [#call] (entry) -> [created by, last edited by]
+      def to_csv(entries, describe:, person:)
+        Csv.document([CSV_HEADER] + entries.map { |entry| csv_row(entry, describe, person) })
+      end
+
+      private
+
+      def csv_row(entry, describe, person)
+        type_label, label, where = describe.call(entry)
+        created_by, edited_by = person.call(entry)
+        [type_label, label, where, created_by, entry.created_at&.iso8601, edited_by, entry.updated_at&.iso8601]
+      end
+
+      # The records a person created or was stamped as editing, latest edit
+      # first; notes when the limit was reached (capped?).
+      def touched_records(model, user_id, limit)
+        records = with_people(touched_by(model, user_id).order(updated_at: :desc).limit(limit)).to_a
+        @capped = true if limit && records.size >= limit
+        records
+      end
+
+      def touched_by(model, user_id)
+        model.where(created_by_id: user_id).or(model.where(updated_by_id: user_id))
+      end
+
+      # Created it, or made its last edit (by the event when there is one).
+      def made_by?(entry, user_id)
+        entry.created_by_id.to_s == user_id.to_s || entry.editor_id == user_id.to_s
+      end
+
+      def apply_filters(entries, filters)
+        type, who, days = filters.values_at(:type, :who, :days)
+        entries = entries.select { |e| e.type == type } if type.present? && TYPES.key?(type)
+        entries = filter_who(entries, who) if who.present?
+        entries = filter_days(entries, days.to_i) if DAY_FILTERS.include?(days.to_i)
+        entries
+      end
+
+      def with_people(scope)
+        scope.includes(:created_by, :updated_by)
+      rescue StandardError
+        scope
+      end
+
+      def permission_set_entries(permission_set)
+        resources = with_people(permission_set.resources).to_a
+        records = [['permission_set', permission_set]] + resources.map { |r| ['resource', r] } +
+                  resource_child_records(resources.map(&:id)) + permission_set_child_records(permission_set)
+        entries_for(records)
+      end
+
+      def permission_set_child_records(permission_set)
+        typed('rule', permission_set.permission_set_rules.includes(:resource)) +
+          typed('assignment', permission_set.permission_set_users.includes(:user))
+      end
+
+      def resource_child_records(resource_ids)
+        typed('field', PermissionForge::ResourceField.where(resource_id: resource_ids).includes(:resource)) +
+          typed('action', PermissionForge::ResourceAction.where(resource_id: resource_ids).includes(:resource))
+      end
+
+      def typed(type, scope)
+        with_people(scope).map { |record| [type, record] }
+      end
+
+      # [[type, record], ...] → entries, each with its latest change event.
+      def entries_for(typed_records)
+        last = LastChanges.new(typed_records.map(&:last))
+        typed_records.map { |type, record| Entry.new(type: type, record: record, last_event: last.last_edit(record)) }
+      end
+
+      def filter_who(entries, who)
+        entries.select { |e| e.created_by_id.to_s == who.to_s || e.editor_id == who.to_s }
+      end
+
+      def filter_days(entries, days)
+        cutoff = days.days.ago
+        entries.select do |e|
+          time = e.updated_at || e.created_at
+          time && time >= cutoff
+        end
+      end
+    end
+  end
+end