permission_forge 0.14.1

data/lib/permission_forge/services/security_audit/assignment_check.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Services
+    module SecurityAuditChecks
+      # Who holds access: stale, orphaned and leftover assignments, inactive
+      # users, people stacking many sets.
+      class AssignmentCheck < BaseCheck
+        MANY_SETS = 3
+
+        def call
+          [stale, missing_users, inactive_users, expired_uncleaned, many_sets, inactive_sets_assigned,
+           all_permanent].compact
+        end
+
+        private
+
+        def active
+          PermissionForge::PermissionSetUser.active_assignments
+        end
+
+        def stale_days
+          configuration.try(:admin_stale_assignment_days) || 90
+        end
+
+        def stale
+          result = StaleAssignmentAuditor.call(threshold_days: stale_days)
+          return if result[:stale_count].zero?
+
+          labels = labels_for(result[:assignments].pluck(:user_id))
+          finding(:medium, :stale_assignments, "Permanent access not reviewed in #{stale_days} days",
+                  'Confirm these people still need it (Keep on the admin Home), or give it an end date.',
+                  items: result[:assignments].map do |row|
+                    "#{labels[row[:user_id]]} — #{row[:permission_set]} (#{row[:days_stale]} days)"
+                  end)
+        end
+
+        def missing_users
+          ids = active.distinct.pluck(:user_id) - user_ids
+          return if ids.empty?
+
+          finding(:medium, :missing_users, 'Assignments for users that no longer exist',
+                  'These rows grant access to ids the user table no longer has; a new user reusing an id ' \
+                  'would inherit it. Remove them.', items: ids.sort.map { |id| "User ##{id}" })
+        end
+
+        def inactive_users
+          check = configuration.user_active_check
+          return unless check
+
+          inactive = assigned_users.reject { |user| check.call(user) }
+          return if inactive.empty?
+
+          finding(:medium, :inactive_users, 'Deactivated users still hold access',
+                  'user_active_check says these users are inactive, but their assignments remain and apply if ' \
+                  'they are reactivated or use another way in. Remove the access.',
+                  items: inactive.map { |user| label(user) })
+        end
+
+        def expired_uncleaned
+          count = PermissionForge::PermissionSetUser.expired.count
+          return if count.zero?
+
+          finding(:low, :expired_uncleaned, "#{count} expired assignment(s) not cleaned up",
+                  'Expired assignments no longer grant access but clutter reviews. Run ' \
+                  '`rake permission_forge:cleanup_expired_assignments` or use Clean up on the admin Home.')
+        end
+
+        def many_sets
+          heavy = active.group(:user_id).count.select { |_, count| count >= MANY_SETS }
+          return if heavy.empty?
+
+          labels = labels_for(heavy.keys)
+          finding(:low, :many_sets, "People holding #{MANY_SETS} or more sets",
+                  'Granting sets add up (most permissive wins). Check their effective access on the admin Person page.',
+                  items: heavy.sort_by { |_, count| -count }.map { |id, count| "#{labels[id]}: #{count} sets" })
+        end
+
+        def inactive_sets_assigned
+          sets = PermissionForge::PermissionSet.where(is_active: false).order(:name)
+                                               .select { |set| people_counts.fetch(set.id, 0).positive? }
+          return if sets.empty?
+
+          finding(:low, :inactive_sets_assigned, 'Turned-off sets still have people',
+                  'They grant nothing while off, but turning one on restores access silently.',
+                  items: sets.map { |set| "#{set.name} · #{people(set.id)}" })
+        end
+
+        def all_permanent
+          total = active.count
+          return if total.zero? || active.where.not(expires_at: nil).exists?
+
+          finding(:info, :all_permanent, "All #{total} assignment(s) are permanent",
+                  'Consider end dates for temporary needs (contractors, projects, cover).')
+        end
+
+        def assigned_users
+          @assigned_users ||= user_model.where(id: active.distinct.select(:user_id)).to_a
+        end
+
+        def user_ids
+          @user_ids ||= user_model.where(id: active.distinct.select(:user_id)).pluck(:id)
+        end
+
+        def labels_for(ids)
+          users = user_model.where(id: ids).index_by(&:id)
+          ids.index_with { |id| users[id] ? label(users[id]) : "User ##{id}" }
+        end
+
+        def label(user)
+          PermissionForge::Admin::PersonLabel.new(user, configuration: configuration).name
+        end
+
+        def user_model
+          configuration.user_model
+        end
+      end
+    end
+  end
+end

data/lib/permission_forge/services/security_audit/audit_trail_check.rb

@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Services
+    module SecurityAuditChecks
+      # The audit event log ({PermissionForge::Audit}): is it recording, can
+      # its actors be trusted, and are the failure settings strict enough.
+      # Event queries use the indexed event / actor_type / occurred_at columns
+      # and follow the tenant scoping of the AuditEvent model like any other.
+      class AuditTrailCheck < BaseCheck
+        RULES = %i[
+          table_missing audit_off shared_basic_auth anonymous_api unknown_actors self_granted
+          default_runtime_events hook_failures_only_logged change_failures_not_raised kept_forever
+        ].freeze
+
+        UNKNOWN_ACTOR_DAYS = 30
+        SUBJECT_LIMIT = 10
+        SELF_GRANT_SCAN_LIMIT = 5000
+
+        def call
+          RULES.filter_map { |rule| send(rule) }
+        end
+
+        private
+
+        def audit_events = PermissionForge::AuditEvent
+
+        # true, false, or nil when the database could not be asked.
+        def table?
+          return @table if defined?(@table)
+
+          @table = audit_events.table_exists?
+        rescue ActiveRecord::ConnectionNotEstablished, ActiveRecord::NoDatabaseError, ActiveRecord::StatementInvalid
+          @table = nil
+        end
+
+        def table_missing
+          return if configuration.audit_events == false || table? != false
+
+          finding(:high, :audit_table_missing, 'The audit events table is missing',
+                  "audit_events is #{configuration.audit_events.inspect} but the table #{audit_events.table_name} " \
+                  "does not exist, so #{missing_table_effect}. Run bin/rails generate permission_forge:upgrade " \
+                  'and migrate.')
+        end
+
+        # :auto records nothing without the table; true tries every time.
+        def missing_table_effect
+          return 'no permission change is recorded (changes still go through)' unless configuration.audit_events == true
+          return 'every permission change fails (audit_change_failure_strategy :raise)' if
+            configuration.audit_change_failure_strategy == :raise
+
+          'every permission change goes through unrecorded (audit_change_failure_strategy ' \
+            ":#{configuration.audit_change_failure_strategy})"
+        end
+
+        def audit_off
+          return unless configuration.audit_events == false
+
+          finding(:high, :audit_off, 'The audit event log is switched off',
+                  'audit_events is false: nobody can later tell who granted, changed or revoked access. Set it ' \
+                  'to :auto (or true) unless another system records these changes.')
+        end
+
+        def shared_basic_auth
+          return unless configuration.http_basic_auth_enabled && configuration.audit_actor_resolver.nil?
+
+          finding(:medium, :audit_shared_basic_auth, 'Admin changes can be attributed to one shared login',
+                  'The admin UI uses HTTP Basic auth and audit_actor_resolver is not set, so when ' \
+                  'current_user_resolver finds nobody in an admin request, its events name the shared ' \
+                  'username, not a person. Set audit_actor_resolver to return the signed-in admin.')
+        end
+
+        def anonymous_api
+          return unless configuration.api_enabled && configuration.audit_actor_resolver.nil?
+
+          finding(:medium, :audit_anonymous_api, 'API changes can be recorded as an anonymous API client',
+                  'The JSON API is enabled and audit_actor_resolver is not set, so when current_user_resolver ' \
+                  'finds nobody in an API request (a token or API key), its events name an anonymous ' \
+                  '"API client", not the caller. Set audit_actor_resolver to return the token, key or user.')
+        end
+
+        def unknown_actors
+          return unless table?
+
+          count = audit_events.where(category: 'change', actor_type: 'unknown', occurred_at: UNKNOWN_ACTOR_DAYS.days.ago..)
+                              .count
+          return if count.zero?
+
+          finding(:medium, :audit_unknown_actors,
+                  "#{count} #{count == 1 ? 'change' : 'changes'} in #{UNKNOWN_ACTOR_DAYS} days " \
+                  "#{count == 1 ? 'has' : 'have'} no known actor",
+                  'Changes were made where no user, API caller or system label was available (a console, job or ' \
+                  'script outside PermissionForge.with_audit_actor). Wrap such work in with_audit_actor, or set ' \
+                  'current_user_resolver / audit_actor_resolver.')
+        end
+
+        def self_granted
+          return unless table?
+
+          grants = self_grant_events
+          return if grants.empty?
+
+          held = PermissionForge::PermissionSetUser.active_assignments.where(id: grants.map(&:first)).pluck(:user_id).uniq
+          return if held.empty?
+
+          finding(:high, :audit_self_granted,
+                  "#{people_label(held.size)} #{held.size == 1 ? 'holds' : 'hold'} access they granted to themselves",
+                  'The assignment.granted event names the same person as grantor and recipient. Confirm each ' \
+                  'was approved by someone else, and restrict who may assign sets (admin_assignment_authorization).',
+                  items: held.first(SUBJECT_LIMIT).map { |id| "user #{id}" })
+        end
+
+        # [assignment id, subject id] of grants whose actor is their subject.
+        def self_grant_events
+          table = audit_events.arel_table
+          audit_events.where(event: 'assignment.granted', actor_type: 'user',
+                             record_type: PermissionForge::PermissionSetUser.base_class.name)
+                      .where(table[:actor_id].eq(table[:subject_user_id]))
+                      .order(occurred_at: :desc).limit(SELF_GRANT_SCAN_LIMIT).pluck(:record_id, :subject_user_id)
+                      .map { |record_id, subject| [record_id.to_i, subject] }
+        end
+
+        def default_runtime_events
+          groups = Array(configuration.audit_runtime_events)
+          return unless (groups - [:denied]).empty?
+          return no_runtime_events if groups.empty?
+
+          finding(:info, :audit_runtime_default, 'Only denied access is recorded at runtime',
+                  'audit_runtime_events holds just :denied, so reads of masked fields, rule bypasses and cache ' \
+                  'rebuilds leave no event. Add groups (:bypass, :field_read, ...) if you must show who saw what.')
+        end
+
+        def no_runtime_events
+          finding(:info, :audit_runtime_default, 'No runtime events are stored',
+                  'No runtime events are stored (audit_runtime_events is empty): denied access, reads of masked ' \
+                  'fields, rule bypasses and cache rebuilds leave no event (they are still published as ' \
+                  'notifications). Add :denied at least, and other groups if you must show who saw what.')
+        end
+
+        def hook_failures_only_logged
+          return unless configuration.audit_hook_failure_strategy == :log
+
+          finding(:low, :audit_hook_failures_logged, 'Audit hook failures are only logged',
+                  'audit_hook_failure_strategy is :log: a failing subscriber or runtime event store is not ' \
+                  'handed to Rails.error. Use :report (default) so it reaches your error tracker.')
+        end
+
+        def change_failures_not_raised
+          return if configuration.audit_change_failure_strategy == :raise
+
+          finding(:medium, :audit_changes_unrecorded, 'A permission change can go through without its audit event',
+                  "audit_change_failure_strategy is :#{configuration.audit_change_failure_strategy}: when the event " \
+                  'cannot be written the change still succeeds and the record is lost. Use :raise (default).')
+        end
+
+        def kept_forever
+          return unless configuration.audit_retention_period.nil?
+
+          finding(:info, :audit_kept_forever, 'Audit events are kept forever',
+                  'audit_retention_period is nil. Confirm this matches your retention policy, or set a period ' \
+                  'so the purge service can remove older events.')
+        end
+      end
+    end
+  end
+end

data/lib/permission_forge/services/security_audit/base_check.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Services
+    # @api private
+    module SecurityAuditChecks
+      # Shared plumbing for SecurityAudit checks: subclasses implement #call
+      # and build findings with #finding.
+      class BaseCheck
+        ITEM_LIMIT = 50
+
+        def initialize(configuration:, environment:)
+          @configuration = configuration
+          @environment = environment
+        end
+
+        private
+
+        attr_reader :configuration
+
+        def production?
+          @environment == 'production'
+        end
+
+        def finding(severity, code, title, detail, items: [])
+          SecurityAudit::Finding.new(check: check_name, severity: severity, code: code, title: title,
+                                     detail: detail, items: capped(items))
+        end
+
+        def capped(items)
+          extra = items.size - ITEM_LIMIT
+          extra.positive? ? items.first(ITEM_LIMIT) << "… and #{extra} more" : items
+        end
+
+        def check_name
+          self.class.name.demodulize.delete_suffix('Check').underscore
+        end
+
+        def active_granting_sets
+          PermissionForge::PermissionSet.active.granting
+        end
+
+        def people_counts
+          @people_counts ||= PermissionForge::PermissionSetUser.active_assignments.group(:permission_set_id).count
+        end
+
+        def people(set_id)
+          people_label(people_counts.fetch(set_id, 0))
+        end
+
+        def people_label(count)
+          "#{count} #{count == 1 ? 'person' : 'people'}"
+        end
+      end
+    end
+  end
+end

data/lib/permission_forge/services/security_audit/config_check.rb

@@ -0,0 +1,212 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Services
+    module SecurityAuditChecks
+      # Configuration hardening: who can reach the admin, whether the cache is
+      # shared, fail-closed flags, GDPR and audit settings, and the JSON API.
+      class ConfigCheck < BaseCheck
+        RULES = %i[
+          admin_ui_exposed process_local_cache unconfigured_fields_pass write_protection_off nested_parent_fallback
+          nil_user_bypass masked_nil_user_bypass gdpr_defaults_off log_filtering_off audit_trail_off conditional_sets_lenient
+          detection_raises_in_production api_without_auth api_mutations_unguarded api_sequential_ids
+          api_rule_values_exposed tenantless_admin strict_overrides
+        ].freeze
+
+        def call
+          RULES.filter_map { |rule| send(rule) }
+        end
+
+        private
+
+        def admin_ui_exposed
+          return if configuration.http_basic_auth_enabled
+          return unless configuration.base_controller_class.to_s.delete_prefix('::') == 'ActionController::Base'
+
+          finding(:critical, :admin_ui_exposed, 'The admin UI has no authentication',
+                  'http_basic_auth_enabled is false and base_controller_class is ActionController::Base, so ' \
+                  'anyone who can reach the mount path can change permissions. Set base_controller_class to ' \
+                  'a controller that authenticates and authorizes admins, or turn HTTP Basic back on.')
+        end
+
+        def process_local_cache
+          return unless production? && configuration.cache_backend.to_s == 'memory'
+
+          finding(:high, :process_local_cache, 'Permission cache is local to each process',
+                  'cache_backend is :memory in production: a revoked permission stays cached in other Puma ' \
+                  'workers until their TTL expires. Use :rails_cache with a shared store.')
+        end
+
+        def unconfigured_fields_pass
+          strategy = configuration.unconfigured_field_strategy.to_s
+          return unless %w[pass_through warn].include?(strategy)
+
+          finding(:high, :unconfigured_fields_pass, 'Unconfigured fields are returned unfiltered',
+                  "unconfigured_field_strategy is :#{strategy}, so a new column reaches filtered responses " \
+                  'before anyone decides who may read it. Use :block (the default).')
+        end
+
+        def write_protection_off
+          return unless configuration.masked_write_protection.to_s == 'off'
+
+          finding(:high, :write_protection_off, 'Masked values can be written back',
+                  'masked_write_protection is :off: saving a record that holds a masked value overwrites the ' \
+                  'real data with the mask. Use :skip (default) or :raise.')
+        end
+
+        def nested_parent_fallback
+          return unless configuration.nested_attributes_parent_fallback
+
+          finding(:medium, :nested_parent_fallback, 'Nested attributes fall back to the parent resource',
+                  'nested_attributes_parent_fallback is true: a `<assoc>_attributes` payload for a model the user ' \
+                  "has no Resource entry for is filtered against the parent's fields, so a key editable on the parent " \
+                  'admits the same key on a child the user was never granted. Configure the child Resource and set ' \
+                  'it back to false (the default).')
+        end
+
+        def nil_user_bypass
+          strategies = { nil_user_strategy: configuration.nil_user_strategy,
+                         response_filter_nil_user_strategy: configuration.response_filter_nil_user_strategy }
+          bypassing = strategies.select { |_, value| value.to_s == 'bypass' }.keys
+          return if bypassing.empty?
+
+          finding(:low, :nil_user_bypass, 'No current user means no permission checks',
+                  "#{bypassing.join(' and ')} #{bypassing.one? ? 'is' : 'are'} :bypass. Make sure every request " \
+                  'that touches protected models is authenticated first, or use :deny / :raise.')
+        end
+
+        # The one nil-user setting that is about the getters themselves.
+        def masked_nil_user_bypass
+          return if configuration.hide_masked_attributes_without_user?
+
+          finding(:medium, :masked_nil_user_bypass, 'Masked attributes are readable with no current user',
+                  'masked_attributes_nil_user_strategy is :bypass: when nobody is signed in (a job, a mailer, the ' \
+                  'console, a resolver that returns nil) the getters, attributes and as_json of a masked model return ' \
+                  'the stored values, whatever nil_user_strategy says. Set it to :hide (the user model stays readable, as ' \
+                  'sign-in needs), and set the current user in ' \
+                  'the jobs and mailers that read masked data.')
+        end
+
+        def gdpr_defaults_off
+          return if configuration.gdpr_defaults
+
+          finding(:medium, :gdpr_defaults_off, 'GDPR defaults are off',
+                  'Generated fields for personal data are not masked by default. Set gdpr_defaults = true if ' \
+                  'you hold EU personal data.')
+        end
+
+        def log_filtering_off
+          return if configuration.filter_parameters_integration
+
+          finding(:low, :log_filtering_off, 'Personal-data parameters are not filtered from logs',
+                  'filter_parameters_integration is false. Enable it, or add ' \
+                  'PermissionForge.gdpr_filter_parameters to Rails filter_parameters yourself.')
+        end
+
+        def audit_trail_off
+          return if configuration.audit_trail_enabled
+
+          finding(:medium, :audit_trail_off, 'Permission changes are not attributed',
+                  'audit_trail_enabled is false, so permission records do not keep created_by / updated_by.')
+        end
+
+        def conditional_sets_lenient
+          return if configuration.conditional_sets_strict_mode
+
+          conditional = conditional_set_names
+          return if conditional.empty?
+
+          finding(:medium, :conditional_sets_lenient, 'Conditional sets apply when the request context is blank',
+                  'conditional_sets_strict_mode is false: where the request context is blank (no resolver, or one ' \
+                  'that returns {} in a job or the console), session-flag / IP / hours conditions are skipped and ' \
+                  'the set applies, MFA- or IP-gated grants included.',
+                  items: conditional)
+        end
+
+        def detection_raises_in_production
+          return unless configuration.unscoped_query_detection.to_s == 'raise'
+          return unless Array(configuration.unscoped_query_detection_environments).map(&:to_s).include?('production')
+
+          finding(:medium, :detection_raises_in_production, 'Unscoped-query detection raises in production',
+                  'unscoped_query_detection is :raise for production, so a missed scope becomes a 500 for users. ' \
+                  'Use :log in production and :raise in test/CI.')
+        end
+
+        def api_without_auth
+          return unless configuration.api_enabled && configuration.api_auth.nil?
+
+          finding(:medium, :api_without_auth, 'The JSON API is enabled without api_auth',
+                  'Every API request returns 401. Configure api_auth, or turn the API off.')
+        end
+
+        def api_mutations_unguarded
+          return unless configuration.api_enabled && !configuration.api_require_authorization
+          return if configuration.api_action_authorization && configuration.api_assignment_authorization
+
+          finding(:high, :api_mutations_unguarded, 'Any authenticated API caller can change permissions',
+                  'api_auth proves identity, not admin rights. Set api_action_authorization and ' \
+                  'api_assignment_authorization, or keep api_require_authorization = true (the default) ' \
+                  'to refuse changes until they are set.')
+        end
+
+        # Tenancy on, and an admin base controller that sets no tenant.
+        def tenantless_admin
+          defaults = configuration.default_admin_controllers_under_tenancy
+          return if defaults.empty?
+
+          names = defaults.join(' and ')
+          if configuration.admin_tenantless_access_allowed?
+            finding(:high, :tenantless_admin, 'The admin can read and change every tenant',
+                    'tenant_model is set, admin_tenantless_access is :allow and ActionController::Base, which sets ' \
+                    "no tenant, is still the base of #{names}: one admin request reads and changes the existing " \
+                    'Permission Sets, assignments and audit log of every tenant. Point each at a controller that ' \
+                    'sets the current tenant, and keep admin_tenantless_access :deny (the default).')
+          else
+            finding(:medium, :tenantless_admin, 'The admin base controllers set no tenant',
+                    "tenant_model is set but ActionController::Base, which sets no tenant, is still the base of #{names}: " \
+                    'every admin request without one is refused (admin_tenantless_access :deny) unless middleware ' \
+                    'sets it. Point each at a controller that sets the current tenant.')
+          end
+        end
+
+        def api_sequential_ids
+          return unless configuration.api_enabled && configuration.api_record_identifier.to_s == 'id'
+
+          finding(:low, :api_sequential_ids, 'The API exposes sequential ids',
+                  'api_record_identifier is :id, which makes records easy to enumerate. Use :uuid.')
+        end
+
+        def api_rule_values_exposed
+          return unless configuration.api_enabled && !configuration.api_redact_rule_field_values
+
+          finding(:low, :api_rule_values_exposed, 'The API returns rule values',
+                  'Rule field_value can hold user ids or business data. Set api_redact_rule_field_values = true ' \
+                  'if that matters for your data.')
+        end
+
+        # Under the :strict preset, the options set looser than it (the
+        # findings above rate the risk of each; this one names them all).
+        def strict_overrides
+          return unless configuration.preset == :strict
+
+          looser = configuration.options_looser_than_strict
+          return if looser.empty?
+
+          finding(:low, :strict_overrides, 'Settings override the :strict preset',
+                  "config.preset is :strict, but #{looser.size} #{looser.one? ? 'option is' : 'options are'} set " \
+                  'to a looser value. Check that each override is intended.',
+                  items: looser.map { |option, value| strict_override_item(option, value) })
+        end
+
+        def strict_override_item(option, value)
+          strict = Configuration::Presets::STRICT.fetch(option)
+          "#{option} = #{value.inspect} (strict: #{strict.inspect})"
+        end
+
+        def conditional_set_names
+          PermissionForge::PermissionSet.active.conditional.order(:name).pluck(:name)
+        end
+      end
+    end
+  end
+end

data/lib/permission_forge/services/security_audit/integrity_check.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Services
+    module SecurityAuditChecks
+      # Rows the models' validations would refuse but the database holds
+      # anyway (written by SQL, an older version, or another app).
+      class IntegrityCheck < BaseCheck
+        RESOURCE_RULES = {
+          'edit without read' => ->(r) { r.edit_access && !r.read_access },
+          'delete without read' => ->(r) { r.delete_access && !r.read_access },
+          'Modify All without View All' => ->(r) { r.modify_all && !r.view_all }
+        }.freeze
+
+        FIELD_RULES = {
+          'edit without read' => ->(field) { field.edit_access && !field.read_access },
+          'masked without read' => ->(field) { field.mask_access && !field.read_access }
+        }.freeze
+
+        def call
+          [duplicate_fields, duplicate_actions, dependency_violations, unknown_models].compact
+        end
+
+        private
+
+        def duplicate_fields
+          groups = PermissionForge::ResourceField.group(:resource_id, :name).having('COUNT(*) > 1').count
+          return if groups.empty?
+
+          names = PermissionForge::Resource.where(id: groups.keys.map(&:first)).pluck(:id, :name).to_h
+          finding(:high, :duplicate_fields, 'Duplicate field rows',
+                  'Two rows for one field merge with mask AND-logic, so an unmasked duplicate unmasks the field. ' \
+                  'Run `bin/rails generate permission_forge:upgrade` to de-duplicate and add the unique index.',
+                  items: groups.map { |(resource_id, name), count| "#{names[resource_id]}.#{name}: #{count} rows" })
+        end
+
+        def duplicate_actions
+          groups = PermissionForge::ResourceAction.group(:resource_id, :name).having('COUNT(*) > 1').count
+          return if groups.empty?
+
+          resources = PermissionForge::Resource.where(id: groups.keys.map(&:first)).includes(:permission_set).index_by(&:id)
+          finding(:medium, :duplicate_actions, 'Duplicate action rows',
+                  'Two rows for one action are OR-ed, so a permitting duplicate permits what the other row blocks. ' \
+                  'Remove the extra row; a unique index on (resource, name) keeps new ones out ' \
+                  '(the install migration creates idx_pf_resource_actions_unique).',
+                  items: groups.map do |(resource_id, name), count|
+                    resource = resources[resource_id]
+                    "#{resource&.permission_set&.name} › #{resource&.name}.#{name}: #{count} rows"
+                  end)
+        end
+
+        def dependency_violations
+          items = resource_violations + field_violations
+          return if items.empty?
+
+          finding(:low, :dependency_violations, 'Grants that skip a required permission',
+                  'Validations require read before edit / delete / mask, and View All before Modify All. ' \
+                  'Fix these rows in the admin so they mean what they say.', items: items)
+        end
+
+        def resource_violations
+          granting_resources.flat_map do |resource|
+            violations(RESOURCE_RULES, resource).map { |what| "#{resource.permission_set.name} › #{resource.name}: #{what}" }
+          end
+        end
+
+        def field_violations
+          fields = PermissionForge::ResourceField.where(resource_id: granting_resources.map(&:id))
+                                                 .where('edit_access = ? OR mask_access = ?', true, true)
+                                                 .where(read_access: false).includes(resource: :permission_set)
+          fields.flat_map do |field|
+            resource = field.resource
+            violations(FIELD_RULES, field).map do |what|
+              "#{resource.permission_set.name} › #{resource.name}.#{field.name}: #{what}"
+            end
+          end
+        end
+
+        def violations(rules, record)
+          rules.select { |_, broken| broken.call(record) }.keys
+        end
+
+        def granting_resources
+          @granting_resources ||= PermissionForge::Resource.where(
+            permission_set_id: PermissionForge::PermissionSet.granting.select(:id)
+          ).includes(:permission_set).to_a
+        end
+
+        def unknown_models
+          names = PermissionForge::Resource.distinct.order(:name).pluck(:name).reject { |name| model?(name) }
+          return if names.empty?
+
+          finding(:low, :unknown_models, 'Resources for models this app does not have',
+                  'No ActiveRecord class matches these names, so the grants do nothing here. If another app ' \
+                  'shares these tables it may still use them — check there before deleting.', items: names)
+        end
+
+        def model?(name)
+          klass = name.safe_constantize
+          klass.is_a?(Class) && klass < ActiveRecord::Base
+        end
+      end
+    end
+  end
+end