permission_forge 0.14.1

data/app/controllers/permission_forge/api/resources_controller.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Api
+    class ResourcesController < BaseController
+      include CrudActions
+
+      before_action :set_permission_set
+      before_action :set_resource, only: %i[show update destroy generate_fields]
+
+      # Grants read (and, with grant_all, edit) on every unconfigured column,
+      # so it passes the same gates as the admin UI's "Sync fields": the
+      # authorization hook, then the lock on the resource and its set.
+      def generate_fields
+        guard_mutation!(:generate_fields, @resource)
+        return if performed?
+
+        fields = PermissionForge::Services::ResourceFieldGenerator.call(
+          resource: @resource,
+          grant_all: %w[true 1].include?(params[:grant_all])
+        )
+        data = PermissionForge::Api::Serializers::ResourceFieldSerializer.collection(fields)
+        render json: { data: data }, status: :created
+      rescue StandardError => e
+        # Log the internal detail; return a generic message so model/column names
+        # and adapter errors are not leaked to API clients.
+        Rails.logger.error("[PermissionForge] generate_fields failed for #{@resource&.name}: #{e.class}: #{e.message}")
+        render json: {
+          error: { status: 422, messages: I18n.t('permission_forge.api.errors.field_generation_failed') }
+        }, status: :unprocessable_entity
+      end
+
+      private
+
+      def collection_scope = @permission_set.resources
+      def current_record = @resource
+      def serializer_type = :resource
+
+      def set_permission_set
+        @permission_set = find_record(PermissionForge::PermissionSet, :permission_set_identifier)
+      end
+
+      def set_resource
+        @resource = find_record(@permission_set.resources)
+      end
+
+      def record_params
+        pf_require_hash(:resource).permit(
+          :name, :description, :is_active, :is_editable,
+          :read_access, :create_access, :edit_access, :delete_access,
+          :view_all, :modify_all
+        )
+      end
+    end
+  end
+end

data/app/controllers/permission_forge/application_controller.rb

@@ -0,0 +1,198 @@
+module PermissionForge
+  # Base class of the admin screens. Inherits from `config.base_controller_class`, so the host's
+  # authentication and layout apply.
+  #
+  # @api public
+  class ApplicationController < PermissionForge.configuration.base_controller_class.constantize
+    # Include standard ActionController modules when inheriting from a base
+    # that may not have them (e.g. ActionController::Base vs ApplicationController)
+    ActionController::Base::MODULES.each do |mod|
+      include mod unless self < mod
+    end
+
+    include PermissionForge::ForgeryProtection
+
+    protect_from_forgery with: :exception, **pf_forgery_strategy
+    # Several admin forms submit to more than one action via `formaction`
+    # buttons (rule builder refresh, bulk "Check names", "Apply
+    # recommendation"). Per-form tokens are bound to the form's own action, so
+    # those submissions would fail verification; the session-wide (masked)
+    # token still protects every request.
+    self.per_form_csrf_tokens = false
+
+    layout :pf_layout
+
+    include PermissionForge::BasicAuthentication
+    include PermissionForge::TenantRequired
+    include PermissionForge::ParamShapes
+    include PermissionForge::HtmlFormat
+
+    THEMES = %w[auto light dark].freeze
+    FRAGMENT_HEADER = 'X-PF-Fragment'.freeze
+    AUDIT_SOURCE = 'admin_ui'.freeze
+
+    before_action :set_locale
+    before_action :pf_require_tenant
+    around_action :pf_without_permission_scope
+    # After authentication (a refused sign-in records its own event) and
+    # inside the scope suspension (an actor resolver may query).
+    around_action :pf_audit_request
+
+    helper PermissionForge::ApplicationHelper unless self < PermissionForge::ApplicationHelper
+    helper_method :pf_fragment?, :pf_theme, :pf_help_visible?, :pf_current_admin,
+                  :pf_attention, :pf_settings_catalog, :pf_back_or
+
+    private
+
+    # Memoized per request: drives the Home badge and the home page.
+    def pf_attention
+      @pf_attention ||= PermissionForge::Admin::AttentionItems.new
+    end
+
+    def pf_settings_catalog
+      @pf_settings_catalog ||= PermissionForge::Admin::SettingsCatalog.new
+    end
+
+    def set_locale
+      session[:permission_forge_locale] = params[:locale] if params[:locale].present? && available_locale?(params[:locale])
+
+      I18n.locale = session[:permission_forge_locale] || I18n.default_locale
+    end
+
+    def available_locale?(locale)
+      allowed = PermissionForge.configuration.available_locales || PermissionForge::BUNDLED_LOCALES
+      Array(allowed).map(&:to_s).include?(locale.to_s)
+    end
+
+    def default_url_options
+      {}
+    end
+
+    # The admin manages permissions for everyone, so it must see every record:
+    # suspend Level 1 auto-scoping / Level 2 detection for the request.
+    def pf_without_permission_scope(&)
+      PermissionForge.without_permission_scope(&)
+    end
+
+    # Who acts, from where, which request and why — for every audit event of
+    # the request; one correlation id for a request that changes something;
+    # the read-only pages of Audit::AuditedViews recorded after success.
+    # Nothing of it outlives the request (Audit::RequestContext).
+    def pf_audit_request(&)
+      PermissionForge::Audit::RequestContext.wrap(self, source: AUDIT_SOURCE, &)
+    end
+
+    # Records a refused request (admin.auth_failed, admin.lock_refused …) so
+    # that no rollback takes it along. `data` gets method, path and endpoint.
+    #
+    #   pf_audit_refused('admin.auth_failed', data: { 'reason' => 'assignment_not_authorized' }, permission_set: set)
+    def pf_audit_refused(event, **payload)
+      PermissionForge::Audit::RequestContext.refused(self, event, source: AUDIT_SOURCE, **payload)
+    end
+
+    # Requests from the progressive-enhancement script that load a page into
+    # a drawer/dialog get the bare content, without the sidebar layout.
+    def pf_fragment?
+      request.headers[FRAGMENT_HEADER].present?
+    end
+
+    def pf_layout
+      pf_fragment? ? 'permission_forge/fragment' : 'permission_forge/application'
+    end
+
+    def pf_theme
+      theme = cookies[:pf_theme].to_s
+      THEMES.include?(theme) ? theme : 'auto'
+    end
+
+    def pf_dismissed_help
+      cookies[:pf_help].to_s.split(',').grep(/\A[a-z_]+\z/)
+    end
+
+    def pf_help_visible?(key)
+      !pf_dismissed_help.include?(key.to_s)
+    end
+
+    # Cookies are scoped to the engine's mount path so they never collide with
+    # (or leak into) the host app's own cookies, and are Secure whenever the
+    # admin is served over HTTPS.
+    def pf_cookie(name, value)
+      cookies[name] = { value: value, path: pf_mount_path, httponly: true, same_site: :lax,
+                        secure: request.ssl?, expires: 1.year.from_now }
+    end
+
+    def pf_mount_path
+      request.script_name.presence || '/'
+    end
+
+    def pf_current_admin
+      return @pf_current_admin if defined?(@pf_current_admin)
+
+      @pf_current_admin = begin
+        PermissionForge.current_user
+      rescue StandardError
+        nil
+      end
+    end
+
+    # Redirect with a toast. `undo:` is { path:, method:, params: } for a
+    # one-click reversal rendered inside the toast.
+    # Messages: notice:, alert:.
+    def pf_redirect(path, undo: nil, **messages)
+      flash[:pf_undo] = undo if undo
+      redirect_to path, **messages.slice(:notice, :alert)
+    end
+
+    def pf_back_or(default)
+      target = params[:return_to].to_s
+      pf_local_path?(target) ? target : default
+    end
+
+    # Same-origin path ("/x"), never protocol-relative ("//host"), and
+    # nothing a browser could read as another host: no backslash ("/\\host")
+    # and no control character (a tab or newline inside "//").
+    def pf_local_path?(path)
+      path.start_with?('/') && !path.start_with?('//') && !path.match?(/[\\[:cntrl:]]/)
+    end
+
+    # Expiry preset + custom date posted by the assign forms.
+    def pf_load_expiry
+      @expiry = PermissionForge::Admin::ExpiryPresets::KEYS.include?(params[:expiry]) ? params[:expiry] : 'never'
+      @custom_date = params[:custom_date].to_s
+    end
+
+    # Sets @expires_at from the chosen preset; returns the translated error
+    # for an invalid custom date, else nil.
+    def pf_resolve_expiry
+      @expires_at = PermissionForge::Admin::ExpiryPresets.expires_at_for(@expiry, custom: @custom_date)
+      nil
+    rescue PermissionForge::Admin::ExpiryPresets::InvalidDate => e
+      t("permission_forge.errors.admin.expiry_#{e.message}")
+    end
+
+    def pf_people_count(permission_set)
+      permission_set.permission_set_users.active_assignments.count
+    end
+
+    def pf_not_found
+      raise ActionController::RoutingError, 'Not Found'
+    end
+
+    def pf_locked?(record)
+      PermissionForge::Admin::EditableLock.locked?(record)
+    end
+
+    # Redirects with an alert when the record (or any of `records`), or what
+    # it belongs to (Admin::EditableLock: its Resource, Permission Set, the
+    # Group of a membership), is locked, and records the refusal
+    # (admin.lock_refused, naming the locked record); returns whether it was.
+    def pf_reject_locked!(records, path, alert: t('permission_forge.flash.not_editable')) # rubocop:disable Naming/PredicateMethod -- redirects; the answer says whether it did
+      locked = PermissionForge::Admin::EditableLock.locked_record(records)
+      if locked
+        pf_audit_refused('admin.lock_refused', record: locked)
+        redirect_to path, alert: alert
+      end
+      locked ? true : false
+    end
+  end
+end

data/app/controllers/permission_forge/assets_controller.rb

@@ -0,0 +1,97 @@
+module PermissionForge
+  # Serves the admin UI's own stylesheet, script and brand files straight from
+  # the gem, so the engine works without Sprockets, Propshaft, importmap or any
+  # other host asset pipeline.
+  #
+  # Inherits from ActionController::Base on purpose — never from the host's
+  # base_controller_class — so host before_actions (sign-in redirects, tenant
+  # lookups, layouts) can't break or leak into static files. Nothing served
+  # here is sensitive: it is the same CSS/JS/logo for every visitor.
+  #
+  # @api private
+  class AssetsController < ActionController::Base
+    ROOT = Engine.root.join('app', 'frontend', 'permission_forge').freeze
+
+    # Allow-list: published name => [relative path, content type].
+    FILES = {
+      'pf_admin.css' => ['pf_admin.css', 'text/css'],
+      'pf_admin.js' => ['pf_admin.js', 'text/javascript'],
+      'logo-light.svg' => ['brand/logo-horizontal-light.svg', 'image/svg+xml'],
+      'logo-dark.svg' => ['brand/logo-horizontal-dark.svg', 'image/svg+xml'],
+      'mark.svg' => ['brand/mark.svg', 'image/svg+xml'],
+      'mark-small.svg' => ['brand/mark-small.svg', 'image/svg+xml'],
+      'favicon.svg' => ['brand/favicon.svg', 'image/svg+xml'],
+      'favicon.ico' => ['brand/favicon.ico', 'image/x-icon'],
+      'apple-touch-icon.png' => ['brand/apple-touch-icon.png', 'image/png'],
+      'chevron.svg' => ['brand/chevron.svg', 'image/svg+xml']
+    }.freeze
+
+    # GET-only; CSRF protection stays on (no-op for GET) so no request path
+    # ever runs unprotected. The cross-origin <script> check is skipped: this
+    # controller exists to serve pf_admin.js to <script src> tags, and the
+    # file is the same public, static script for every visitor.
+    include PermissionForge::ForgeryProtection
+
+    protect_from_forgery with: :exception, **pf_forgery_strategy
+    skip_after_action :verify_same_origin_request
+    # Rails 8.2 adds Vary: Sec-Fetch-Site to every protected response; the
+    # same public file for every visitor needs no per-header cache copies.
+    skip_after_action :append_sec_fetch_site_to_vary_header, raise: false
+
+    def show
+      name = params[:file].to_s
+      path, type = asset_entry(name)
+      return head(:not_found) unless path
+
+      cache_headers(name)
+      return unless stale?(etag: self.class.digest(name), public: true)
+
+      response.headers['X-Content-Type-Options'] = 'nosniff'
+      send_file path, type: type, disposition: 'inline'
+    end
+
+    private
+
+    # [absolute path, content type] for an allow-listed name whose file exists, else nil.
+    def asset_entry(name)
+      path, type = self.class.entries[name]
+      [path, type] if path && File.file?(path)
+    end
+
+    # Fingerprinted URLs (?v=digest) never change content, so they can be
+    # cached forever; unversioned requests revalidate via ETag.
+    def cache_headers(name)
+      version = params[:v]
+      if version.present? && version == self.class.digest(name)
+        response.headers['Cache-Control'] = 'public, max-age=31536000, immutable'
+      else
+        expires_in 0, public: true, must_revalidate: true
+      end
+    end
+
+    class << self
+      # Allow-list resolved to absolute paths: name => [path, content type].
+      # Paths come only from FILES, never from the request.
+      def entries
+        @entries ||= FILES.to_h { |name, (relative, type)| [name, [ROOT.join(relative).to_s, type]] }.freeze
+      end
+
+      # Short content digest used as the cache-busting `v` query param.
+      def digest(name)
+        @digests ||= {}
+        return @digests[name] if @digests.key?(name) && !reload_assets?
+
+        entry = FILES[name.to_s]
+        @digests[name] = entry ? Digest::SHA256.file(ROOT.join(entry.first)).hexdigest[0, 12] : nil
+      end
+
+      private
+
+      # Recompute digests on every request in development so CSS/JS edits in
+      # the gem show up without a server restart.
+      def reload_assets?
+        defined?(Rails) && Rails.env.development?
+      end
+    end
+  end
+end

data/app/controllers/permission_forge/assignments_controller.rb

@@ -0,0 +1,266 @@
+module PermissionForge
+  # Giving and taking access: PermissionSetUser rows. Every change applies
+  # immediately (the model invalidates the person's cached permissions) and
+  # goes through the model's callbacks, so each grant, change, review and
+  # revocation writes its audit event. config.admin_assignment_authorization
+  # is asked first (AssignmentAuthorization).
+  #
+  # @api private
+  class AssignmentsController < ApplicationController
+    include PermissionForge::AssignmentAuthorization
+    include PermissionForge::ActingAdmin
+
+    # What config.admin_assignment_authorization is asked for each member action.
+    CHANGE_ACTIONS = { update: :change_expiry, destroy: :revoke, keep: :review }.freeze
+
+    before_action :set_assignment, only: %i[update destroy confirm_destroy keep]
+    before_action :change_refused?, only: CHANGE_ACTIONS.keys # redirects when refused
+    # Removing a holder of a locked Muting Permission Set gives access back.
+    before_action :removal_refused?, only: %i[confirm_destroy destroy] # redirects when refused
+
+    def new
+      load_form
+    end
+
+    def create
+      load_form
+      @errors = validate_form
+      return render(:new, status: :unprocessable_entity) if @errors.any?
+
+      back = pf_back_or(permission_forge.person_path(@person))
+      return if pf_assignment_refused?(@chosen_sets, @person.id, :grant, back)
+
+      created = assign_chosen_sets
+      pf_redirect back, notice: assigned_notice(created), undo: assign_undo(created, back)
+    end
+
+    # Change the end date (presets) or extend by 30 days. On a locked
+    # Permission Set only a change that narrows access passes
+    # (EditableLock.widening_lock): for a granting set an end date set or
+    # moved earlier, for a Muting Permission Set one cleared or moved later.
+    def update
+      expires_at = new_expiry(params[:expiry].to_s)
+      return redirect_to(return_path) if expires_at == :invalid
+      return if widening_refused?(expires_at)
+
+      @assignment.update!(expires_at: expires_at)
+      redirect_to return_path, notice: end_changed_notice(expires_at)
+    end
+
+    def confirm_destroy
+      @lost = lost_labels
+    end
+
+    # Removing a holder of a granting set narrows access, also on a locked
+    # set; the toast's Undo (which grants again) is offered only where that
+    # is allowed (EditableLock.widening_lock).
+    def destroy
+      name = person_name(@assignment.user)
+      set_name = @assignment.permission_set.name
+      undo = restore_undo
+      @assignment.destroy!
+      pf_redirect return_path, notice: t('permission_forge.flash.assignments.removed', name: name, set: set_name), undo: undo
+    end
+
+    # Access review "Keep": records the reviewer and the date
+    # (PermissionSetUser#mark_reviewed!, one assignment.reviewed event);
+    # staleness is measured from the last review.
+    def keep
+      @assignment.mark_reviewed!(reviewer: pf_acting_admin_record)
+      redirect_to return_path, notice: t('permission_forge.flash.assignments.kept',
+                                         name: person_name(@assignment.user), set: @assignment.permission_set.name)
+    end
+
+    # Undo for "Remove": recreates the assignment.
+    def restore
+      expires_at = restored_expiry
+      set, user = restore_target
+      return if pf_widening_refused?(pf_widening_lock(set, :grant), return_path) || pf_assignment_refused?(set, user.id, :grant, return_path)
+
+      restore_assignment(set, user, expires_at)
+      redirect_to return_path, notice: t('permission_forge.flash.assignments.restored', name: person_name(user), set: set.name)
+    end
+
+    # Undo for "Assign": removes the assignments just created (narrows
+    # access, so also from a granting set locked since; a locked Muting
+    # Permission Set keeps its holders).
+    def undo
+      assignments = undo_assignments
+      return if undo_refused?(assignments)
+
+      PermissionForge::Audit.correlate { assignments.each(&:destroy!) }
+      redirect_to return_path, notice: t('permission_forge.flash.assignments.undone')
+    end
+
+    private
+
+    # An assignment of somebody config.user_list_resolver leaves out is not
+    # found: the admin cannot manage them through an assignment id either.
+    def set_assignment
+      @assignment = PermissionForge::PermissionSetUser.includes(:permission_set, :user).find(params[:id])
+      PermissionForge::Admin::PeopleDirectory.new.find(@assignment.user_id) || pf_not_found
+    end
+
+    def restore_undo
+      return if pf_widening_lock(@assignment.permission_set, :grant)
+
+      restore = { 'permission_set_id' => @assignment.permission_set_id, 'user_id' => @assignment.user_id,
+                  'expires_at' => @assignment.expires_at&.iso8601, 'return_to' => return_path }
+      { path: permission_forge.restore_assignments_path, method: 'post', params: restore }
+    end
+
+    # A locked set's end dates only move in the narrowing direction.
+    def widening_refused?(expires_at)
+      locked = pf_widening_lock(@assignment.permission_set, :change_expiry, from: @assignment.expires_at, to: expires_at)
+      pf_widening_refused?(locked, return_path)
+    end
+
+    def removal_refused?
+      pf_widening_refused?(pf_widening_lock(@assignment.permission_set, :revoke), return_path)
+    end
+
+    def change_refused?
+      pf_assignment_refused?(@assignment.permission_set, @assignment.user_id, CHANGE_ACTIONS.fetch(action_name.to_sym), return_path)
+    end
+
+    def restore_target
+      [PermissionForge::PermissionSet.find(params[:permission_set_id]),
+       PermissionForge::Admin::PeopleDirectory.new.find(params[:user_id]) || pf_not_found]
+    end
+
+    def restore_assignment(set, user, expires_at)
+      PermissionForge::PermissionSetUser.find_or_create_by!(permission_set: set, user: user) do |assignment|
+        assignment.expires_at = expires_at
+      end
+    end
+
+    def return_path
+      pf_back_or(@assignment ? permission_forge.person_path(@assignment.user_id) : permission_forge.people_path)
+    end
+
+    def person_name(user)
+      PermissionForge::Admin::PersonLabel.new(user).name
+    end
+
+    # All or nothing: one transaction (and one correlation id) for every chosen set.
+    def assign_chosen_sets
+      PermissionForge::PermissionSetUser.transaction do
+        @chosen_sets.map do |set|
+          PermissionForge::PermissionSetUser.create!(permission_set: set, user: @person, expires_at: @expires_at)
+        end
+      end
+    end
+
+    # Only assignments of people within config.user_list_resolver are
+    # undone (an id naming anyone else is not found).
+    def undo_assignments
+      assignments = PermissionForge::PermissionSetUser.where(id: pf_id_list(:ids)).includes(:permission_set).to_a
+      people = PermissionForge::Admin::PeopleDirectory.new.find_all(assignments.map(&:user_id)).map(&:id)
+      pf_not_found unless assignments.all? { |assignment| people.include?(assignment.user_id) }
+      assignments
+    end
+
+    def undo_refused?(assignments)
+      assignments.group_by(&:permission_set).any? do |set, rows|
+        pf_widening_refused?(pf_widening_lock(set, :revoke), return_path) || pf_assignment_refused?(set, rows.map(&:user_id), :revoke, return_path)
+      end
+    end
+
+    # --- assign form state ------------------------------------------------------
+
+    def load_form
+      load_person
+      load_sets
+      @people_counts = PermissionForge::PermissionSetUser.active_assignments.group(:permission_set_id).count
+      pf_load_expiry
+      @chosen_sets = @sets.select { |set| @selected_ids.include?(set.id) && !@existing_ids.include?(set.id) }
+    end
+
+    def load_person
+      @person = person_chosen? ? PermissionForge::Admin::PeopleDirectory.new.find(params[:user_id]) : nil
+      @query = params[:q].to_s.strip
+      @people = @person ? nil : PermissionForge::Admin::PeopleDirectory.new.pick(query: @query, limit: picker_limit)
+      @existing_ids = @person ? PermissionForge::PermissionSetUser.where(user_id: @person.id).pluck(:permission_set_id) : []
+    end
+
+    # A person was picked (and the form is not switching or searching people).
+    def person_chosen?
+      params[:user_id].present? && params[:change_person].blank? && params[:search].blank?
+    end
+
+    def load_sets
+      @set_query = pf_text_param(:set_q)
+      @preset_set = PermissionForge::PermissionSet.find_by(id: params[:permission_set_id])
+      @selected_ids = (pf_id_list(:set_ids) + [@preset_set&.id]).compact.uniq
+      @sets = assignable_sets
+    end
+
+    def picker_limit
+      @person ? 0 : 8
+    end
+
+    # The sets a holder can be added to: not those where that widens access
+    # on a locked set (a locked Muting Permission Set takes holders).
+    def assignable_sets
+      scope = PermissionForge::PermissionSet.order(:is_muting, :name)
+      unless @set_query.empty?
+        needle = "%#{ActiveRecord::Base.sanitize_sql_like(@set_query.downcase)}%"
+        scope = scope.where('LOWER(name) LIKE ?', needle).or(scope.where(id: @selected_ids))
+      end
+      scope.reject { |set| pf_widening_lock(set, :grant) }
+    end
+
+    def validate_form
+      errors = {}
+      errors[:person] = t('permission_forge.errors.admin.person') unless @person
+      errors[:sets] = t('permission_forge.errors.admin.sets') if @chosen_sets.empty?
+      expiry_error = pf_resolve_expiry
+      errors[:expiry] = expiry_error if expiry_error
+      errors
+    end
+
+    def assign_undo(created, back)
+      { path: permission_forge.undo_assignments_path, method: 'post',
+        params: { 'ids' => created.map(&:id), 'return_to' => back } }
+    end
+
+    def end_changed_notice(expires_at)
+      t('permission_forge.flash.assignments.end_changed', name: person_name(@assignment.user),
+                                                          set: @assignment.permission_set.name,
+                                                          when: helpers.pf_expiry(expires_at).first)
+    end
+
+    # A date that cannot be read is a 400: it must never restore the
+    # assignment without an end date.
+    def restored_expiry = pf_time_param(:expires_at)
+
+    def assigned_notice(created)
+      sets = created.map { |assignment| assignment.permission_set.name }.to_sentence
+      return t('permission_forge.flash.assignments.assigned', name: person_name(@person), sets: sets) if @expires_at.nil?
+
+      t('permission_forge.flash.assignments.assigned_until', name: person_name(@person), sets: sets,
+                                                             date: helpers.pf_date(@expires_at, year: false))
+    end
+
+    # :invalid for a blank or unknown key (CHANGE_KEYS has no blank entry).
+    def new_expiry(key)
+      return extended_expiry if key == 'extend30'
+      return :invalid unless PermissionForge::Admin::ExpiryPresets::CHANGE_KEYS.include?(key)
+
+      PermissionForge::Admin::ExpiryPresets.expires_at_for(key)
+    end
+
+    def extended_expiry
+      base = [@assignment.expires_at&.to_date, Time.zone.today].compact.max
+      (base + 30).in_time_zone.end_of_day
+    end
+
+    # What the person stops seeing when this (granting) assignment is removed.
+    def lost_labels
+      permission_set = @assignment.permission_set
+      return [] if permission_set.is_muting
+
+      permission_set.resources.select(&:is_active).map { |r| helpers.pf_resource_plural(r.name) }
+    end
+  end
+end