permission_forge 0.14.1

data/app/controllers/permission_forge/audit_events_controller.rb

@@ -0,0 +1,94 @@
+module PermissionForge
+  # The audit log: every recorded event, filtered and paged, one event in
+  # full, and the exports (the filtered log as CSV or JSON, and who holds
+  # what). Read-only: nothing here writes an event — viewing and exporting
+  # are recorded by Audit::AuditedViews, a refusal by AuditLogGate.
+  #
+  # @api private
+  class AuditEventsController < ApplicationController
+    include PermissionForge::AuditLogGate
+
+    EXPORT_FORMATS = %w[csv json].freeze
+    MAX_KEY_LENGTH = 255
+
+    pf_exports EXPORT_FORMATS.map(&:to_sym), only: %i[index holdings]
+    before_action :pf_require_audit_log!
+
+    def index
+      @log = PermissionForge::Admin::AuditLog.new(params, include_views: export?)
+      return pf_stream(PermissionForge::Admin::Exports::Events.call(@log.relation, filters: @log.filters), 'audit-log') if export?
+
+      @page = @log.page(params[:page])
+      @lookups = PermissionForge::Admin::AuditLookups.new(@page.events)
+    rescue PermissionForge::Audit::EventQuery::Invalid => e
+      invalid_filters(e)
+    end
+
+    def show
+      @event = find_event || pf_not_found
+      @lookups = PermissionForge::Admin::AuditLookups.new([@event])
+      @detail = PermissionForge::Admin::AuditEventDetail.new(@event, @lookups)
+    end
+
+    # Who holds what: every assignment as it stands, with its review.
+    def holdings
+      return head(:not_acceptable) unless export?
+
+      pf_stream(PermissionForge::Admin::Exports::Holdings.call, 'who-holds-what')
+    end
+
+    private
+
+    def export?
+      EXPORT_FORMATS.include?(request.format.symbol.to_s)
+    end
+
+    # By uuid (what the pages link to), or by id. A key no column can hold
+    # (a NUL byte, longer than a column) is not looked for.
+    def find_event
+      key = params[:id].to_s
+      return nil if key.include?("\0") || key.length > MAX_KEY_LENGTH
+
+      events = PermissionForge::AuditEvent
+      events.find_by(uuid: key) || (key.match?(/\A\d{1,18}\z/) ? events.find_by(id: key) : nil)
+    end
+
+    def invalid_filters(error)
+      return head(:unprocessable_entity) if export?
+
+      @errors = error.errors
+      @page = nil
+      render :index, status: :unprocessable_entity
+    end
+
+    # Hands the file over as it is written (batch by batch), with no cap.
+    def pf_stream(document, name)
+      format = request.format.symbol.to_s
+      headers.merge!(pf_download_headers(format, PermissionForge::Admin::Exports.filename(name, format)))
+      self.response_body = pf_in_request_context(document.chunks(format))
+    end
+
+    # The body is written after the action's around_actions have ended: the
+    # record rules are no longer suspended (the people of the rows would be
+    # looked up under the admin's own rules) and the host's tenant may be gone.
+    # Each is captured here, in the action, and put back while the body is written.
+    def pf_in_request_context(chunks)
+      tenant = PermissionForge.ambient_tenant
+      Enumerator.new do |out|
+        PermissionForge.with_ambient_tenant(tenant) do
+          PermissionForge.without_permission_scope { chunks.each { |chunk| out << chunk } }
+        end
+      end
+    end
+
+    # Not buffered or cached on the way: no ETag digest (Last-Modified set),
+    # no proxy buffering, nothing stored.
+    def pf_download_headers(format, filename)
+      {
+        'Content-Type' => Mime[format.to_sym].to_s,
+        'Content-Disposition' => ActionDispatch::Http::ContentDisposition.format(disposition: 'attachment', filename: filename),
+        'Cache-Control' => 'no-store', 'Last-Modified' => Time.current.httpdate, 'X-Accel-Buffering' => 'no'
+      }
+    end
+  end
+end

data/app/controllers/permission_forge/bulk_assignments_controller.rb

@@ -0,0 +1,108 @@
+module PermissionForge
+  # Bulk assign (paste emails/names and/or pick people) and bulk revoke for
+  # one Permission Set. Both apply immediately, through the model callbacks
+  # (one audit event per person, one correlation id per action), after
+  # config.admin_assignment_authorization (AssignmentAuthorization).
+  #
+  # @api private
+  class BulkAssignmentsController < ApplicationController
+    include PermissionForge::AssignmentAuthorization
+    include PermissionForge::ActingAdmin
+
+    before_action :set_permission_set
+    # A locked set refuses what widens access (EditableLock.widening_lock):
+    # new holders of a granting set, removing holders of a Muting one.
+    before_action :widening_grant_refused?, only: %i[new preview create]
+    before_action :widening_revoke_refused?, only: %i[confirm_revoke revoke]
+
+    def new
+      load_form
+    end
+
+    # Shows who would be assigned, who already has it and what wasn't found.
+    def preview
+      load_form
+      @result = matcher_result
+      render :new
+    end
+
+    def create
+      load_form
+      @result = matcher_result
+      @expiry_error = pf_resolve_expiry
+      @nobody = @result.to_assign.empty?
+      return render(:new, status: :unprocessable_entity) if @expiry_error || @nobody
+      return if grant_refused?
+
+      outcome = assign(@result.to_assign)
+      redirect_to assignments_path,
+                  notice: t('permission_forge.flash.bulk_assignments.assigned', count: outcome[:assigned], set: @permission_set.name)
+    end
+
+    def confirm_revoke
+      @people = selected_people
+    end
+
+    def revoke
+      ids = selected_people.map(&:id)
+      return if pf_assignment_refused?(@permission_set, ids, :revoke, assignments_path)
+
+      outcome = PermissionForge::Services::BulkPermissionSetAssignment.call(
+        permission_set: @permission_set, user_ids: ids, action: :revoke
+      )
+      redirect_to assignments_path,
+                  notice: t('permission_forge.flash.bulk_assignments.revoked', count: outcome[:revoked], set: @permission_set.name)
+    end
+
+    private
+
+    def set_permission_set
+      @permission_set = PermissionForge::PermissionSet.find(params[:permission_set_id])
+    end
+
+    def grant_refused?
+      pf_assignment_refused?(@permission_set, @result.to_assign.map(&:id), :grant, assignments_path)
+    end
+
+    def assignments_path
+      permission_forge.permission_set_path(@permission_set, tab: 'assignments')
+    end
+
+    def widening_grant_refused?
+      pf_widening_refused?(pf_widening_lock(@permission_set, :grant), permission_forge.permission_set_path(@permission_set))
+    end
+
+    def widening_revoke_refused?
+      pf_widening_refused?(pf_widening_lock(@permission_set, :revoke), assignments_path)
+    end
+
+    def load_form
+      @text = params[:identifiers].to_s
+      @query = params[:q].to_s.strip
+      @picked_ids = Array(params[:user_ids]).compact_blank.map(&:to_s)
+      @people = people_directory.pick(query: @query, limit: 8)
+      pf_load_expiry
+    end
+
+    def assign(people)
+      PermissionForge::Services::BulkPermissionSetAssignment.call(
+        permission_set: @permission_set, user_ids: people.map(&:id), action: :assign,
+        created_by: pf_acting_admin_record, expires_at: @expires_at
+      )
+    end
+
+    def matcher_result
+      PermissionForge::Admin::BulkPeopleMatcher.new(directory: people_directory)
+                                               .call(text: @text, user_ids: @picked_ids, permission_set: @permission_set)
+    end
+
+    # One per request: the picker and the matcher share its resolved people.
+    def people_directory
+      @people_directory ||= PermissionForge::Admin::PeopleDirectory.new
+    end
+
+    def selected_people
+      people_directory.find_all(params[:user_ids])
+    end
+  end
+end

data/app/controllers/permission_forge/field_lookups_controller.rb

@@ -0,0 +1,38 @@
+module PermissionForge
+  # "Who can see iban?" — pick a resource and a field, see its level in every
+  # Permission Set that includes the resource.
+  #
+  # @api private
+  class FieldLookupsController < ApplicationController
+    # Labels are computed here from the allow-listed resource name (via
+    # ModelCatalog, which only resolves real models) so the view never
+    # constantizes request input.
+    def show
+      @resource_names = PermissionForge::Resource.distinct.order(:name).pluck(:name)
+      @resource_name = @resource_names.include?(params[:resource]) ? params[:resource] : nil
+      model = @resource_name && PermissionForge::Admin::ModelCatalog.new.find(@resource_name)
+      @fields = @resource_name ? field_names(@resource_name, model) : []
+      @field_options = @fields.map { |name| [name, field_label(model, name)] }
+      load_field(model)
+    end
+
+    private
+
+    def load_field(model)
+      @field = @fields.include?(params[:field]) ? params[:field] : nil
+      @field_label = field_label(model, @field) if @field
+      @rows = @field ? PermissionForge::Admin::FieldAcrossSets.call(@resource_name, @field) : []
+    end
+
+    def field_names(resource_name, model)
+      configured = PermissionForge::ResourceField.joins(:resource)
+                                                 .where(PermissionForge::Resource.table_name => { name: resource_name })
+                                                 .distinct.pluck(:name)
+      (configured + (model ? model.managed_column_names + model.virtual_field_names : [])).uniq.sort
+    end
+
+    def field_label(model, name)
+      model&.klass&.human_attribute_name(name) || name.humanize
+    end
+  end
+end

data/app/controllers/permission_forge/home_controller.rb

@@ -0,0 +1,24 @@
+module PermissionForge
+  # "Needs attention": what the owner should look at, plus quick lookups.
+  #
+  # @api private
+  class HomeController < ApplicationController
+    PRIVACY_PREVIEW = 5
+
+    def index
+      @attention = pf_attention
+      @first_run = !PermissionForge::PermissionSet.exists?
+      @show_all_privacy = params[:privacy] == 'all'
+      @cleanup_preview = params[:cleanup].present?
+      @people_with_access = live_assignments.distinct.count(:user_id)
+      @active_sets = PermissionForge::PermissionSet.active.count
+    end
+
+    private
+
+    def live_assignments
+      PermissionForge::PermissionSetUser.active_assignments
+                                        .where(permission_set_id: PermissionForge::PermissionSet.active.select(:id))
+    end
+  end
+end

data/app/controllers/permission_forge/maintenance_controller.rb

@@ -0,0 +1,13 @@
+module PermissionForge
+  # Housekeeping triggered from the home page.
+  #
+  # @api private
+  class MaintenanceController < ApplicationController
+    # Removes expired assignments (the dry run is shown on Home first).
+    def cleanup
+      result = PermissionForge::Services::ExpiredAssignmentCleaner.call
+      redirect_to permission_forge.root_path,
+                  notice: t('permission_forge.flash.maintenance.cleaned', count: result[:removed])
+    end
+  end
+end

data/app/controllers/permission_forge/people_controller.rb

@@ -0,0 +1,190 @@
+module PermissionForge
+  # People: everyone in the host app, what they can access, and why.
+  #
+  # @api private
+  class PeopleController < ApplicationController
+    include PermissionForge::CacheConfirmation
+    include PermissionForge::AssignmentAuthorization
+    include PermissionForge::AuditLogGate
+
+    PER_PAGE = 25
+    TABS = %w[access effective audit].freeze
+    # Records listed per type under "Changes made by" (the CSV has them all).
+    CHANGES_SHOWN = 100
+    TIMELINE_PER_PAGE = 20
+
+    pf_exports %i[csv], only: :show # the person's changes
+    before_action :set_person, except: %i[index]
+
+    def index
+      @query = params[:q].to_s.strip
+      @filter = filter_param
+      @page = directory.search(query: @query, filter: @filter, page: params[:page], per_page: PER_PAGE)
+      @counts = directory.counts(query: @query)
+      @assignments = assignments_for(@page.people.map(&:id))
+    end
+
+    def show
+      @tab = TABS.include?(params[:tab]) ? params[:tab] : 'access'
+      @assignments = @person_assignments
+      @groups = PermissionForge::PermissionSetGroupUser.where(user_id: @person.id).includes(:permission_set_group)
+      return pf_refuse_audit_tab unless pf_audit_tab_allowed?
+
+      send("load_#{@tab}_tab")
+      respond_to do |format|
+        format.html
+        format.csv { send_changes_csv }
+      end
+    end
+
+    # --- offboarding ------------------------------------------------------------
+
+    def confirm_remove_all
+      load_removable
+      @lost = lost_resource_labels(@removable)
+    end
+
+    # Each assignment is destroyed through its callbacks (one
+    # assignment.revoked event each, sharing one correlation id). Granting
+    # sets lose the person also when locked; a locked Muting Permission Set
+    # keeps them (removing them would give access back — EditableLock).
+    def remove_all
+      load_removable
+      sets = @removable.map(&:permission_set).uniq
+      path = permission_forge.person_path(@person)
+      return if pf_assignment_refused?(sets, @person.id, :revoke, path)
+
+      count = @removable.size
+      confirmed = cache_confirmed? { PermissionForge::Audit.correlate { @removable.each(&:destroy!) } }
+      redirect_to permission_forge.person_path(@person),
+                  **cache_flash(confirmed, { notice: :removed_all, alert: :removed_all_cache_kept }, count: count, name: person_name)
+    end
+
+    def refresh_cache
+      confirmed = cache_confirmed? { @person.invalidate_permissions if @person.respond_to?(:invalidate_permissions) }
+      redirect_to permission_forge.person_path(@person, tab: pf_tab_param(TABS)),
+                  **cache_flash(confirmed, { notice: :cache_refreshed, alert: :cache_refresh_failed }, name: person_name)
+    end
+
+    # --- consent withdrawal -------------------------------------------------------
+
+    def consent_preview
+      @flags = consent_flags
+      @flag = params[:flag].presence || @flags.first
+      @affected = @person_assignments.select { |assignment| @flag.present? && assignment.permission_set.requires_session_flag == @flag }
+    end
+
+    def withdraw_consent
+      flag = params[:flag].to_s
+      return redirect_to(permission_forge.person_path(@person)) unless consent_flags.include?(flag)
+
+      count, invalidated = consent_service(flag, dry_run: false).values_at(:revoked_sets, :invalidated)
+      # nothing revoked means nothing to clear: that is not a failure
+      redirect_to permission_forge.person_path(@person),
+                  **cache_flash(count.zero? || invalidated, { notice: :consent_withdrawn, alert: :consent_withdrawn_cache_kept },
+                                count: count, flag: flag)
+    end
+
+    # --- erasure ----------------------------------------------------------------------
+
+    def erasure_preview
+      @preview = erasure_service(dry_run: true)
+    end
+
+    def erase
+      if params[:confirmation].to_s.strip != person_name
+        @preview = erasure_service(dry_run: true)
+        @confirmation_error = true
+        return render :erasure_preview, status: :unprocessable_entity
+      end
+
+      result = erasure_service(dry_run: false)
+      # nil: erased inside a transaction of the host's, the cache follows at its commit
+      confirmed = result[:cache_cleared] != false
+      redirect_to permission_forge.people_path,
+                  **cache_flash(confirmed, { notice: :erased, alert: :erased_cache_kept }, name: person_name)
+    end
+
+    private
+
+    def directory
+      @directory ||= PermissionForge::Admin::PeopleDirectory.new
+    end
+
+    def filter_param
+      filter = params[:filter]
+      PermissionForge::Admin::PeopleDirectory::FILTERS.include?(filter) ? filter : 'all'
+    end
+
+    def set_person
+      @person = directory.find(params[:id]) || pf_not_found
+      @person_assignments = PermissionForge::PermissionSetUser.where(user_id: @person.id)
+                                                              .includes(:permission_set).order(:created_at).to_a
+    end
+
+    def person_name
+      PermissionForge::Admin::PersonLabel.new(@person).name
+    end
+
+    # @removable: the assignments "Remove all access" removes; @kept: those
+    # of locked Muting Permission Sets, where removing widens access.
+    def load_removable
+      @kept, @removable = @person_assignments.partition do |assignment|
+        pf_widening_lock(assignment.permission_set, :revoke)
+      end
+    end
+
+    def assignments_for(user_ids)
+      PermissionForge::PermissionSetUser.where(user_id: user_ids).includes(:permission_set).group_by(&:user_id)
+    end
+
+    def load_access_tab; end
+
+    def load_effective_tab
+      service = PermissionForge::Admin::EffectiveAccess.new(user: @person)
+      @effective = service.call
+      @conditional_sets = service.conditional_sets
+      @open = Array(params[:open]).map(&:to_s)
+      @why = params[:why].to_s
+    end
+
+    def load_audit_tab
+      @changes = audit.changes_by(@person.id, limit: CHANGES_SHOWN)
+      @changes_capped = audit.capped?
+      @timeline_log = PermissionForge::Admin::AuditLog.new({ views: params[:views] },
+                                                           scope: PermissionForge::Admin::AuditLog.for_person(@person.id))
+      @timeline = @timeline_log.page(params[:page], per_page: TIMELINE_PER_PAGE)
+      @timeline_lookups = PermissionForge::Admin::AuditLookups.new(@timeline.events)
+    end
+
+    def audit
+      @audit ||= PermissionForge::Admin::AuditTrail.new
+    end
+
+    def send_changes_csv
+      entries = audit.changes_by(@person.id).values.flatten
+      csv = audit.to_csv(entries, describe: helpers.method(:pf_audit_describe), person: helpers.method(:pf_audit_people))
+      response.headers['Cache-Control'] = 'no-store' # names of people, like the log's exports
+      send_data csv, filename: "permission-forge-changes-#{@person.id}.csv", type: 'text/csv'
+    end
+
+    def lost_resource_labels(assignments)
+      assignments.map(&:permission_set).reject(&:is_muting)
+                 .flat_map { |ps| ps.resources.select(&:is_active).map { |r| helpers.pf_resource_plural(r.name) } }.uniq
+    end
+
+    # Flags gating sets this person has, plus configured flags.
+    def consent_flags
+      flags = @person_assignments.map { |assignment| assignment.permission_set.requires_session_flag }.compact_blank
+      (flags + (PermissionForge.configuration.admin_session_flags || {}).keys.map(&:to_s)).uniq
+    end
+
+    def consent_service(flag, dry_run:)
+      PermissionForge::Services::ConsentWithdrawalHandler.call(user: @person, consent_flag: flag, dry_run: dry_run)
+    end
+
+    def erasure_service(dry_run:)
+      PermissionForge::Services::DataSubjectErasure.call(user: @person, dry_run: dry_run)
+    end
+  end
+end

data/app/controllers/permission_forge/permission_set_editor.rb

@@ -0,0 +1,71 @@
+module PermissionForge
+  # Loads the one-page Permission Set editor and its tabs (resources matrix,
+  # assignments, conditions, audit) for PermissionSetsController. Tabs are
+  # dispatched as load_<tab>_tab.
+  #
+  # @api private
+  module PermissionSetEditor
+    AUDIT_TIMELINE_PER_PAGE = 20
+
+    private
+
+    def load_editor
+      @resources = @permission_set.resources.includes(:resource_fields, :resource_actions, :permission_set_rules).order(:name).to_a
+      @groups = PermissionForge::PermissionSetGroup.order(:name)
+      load_impact
+      @assignment_count = @permission_set.permission_set_users.count
+    end
+
+    def load_impact
+      live = @permission_set.permission_set_users.active_assignments.includes(:user).order(:created_at)
+      @people_count = live.count
+      @impact_people = live.limit(3).map(&:user).compact
+      @lost = @permission_set.is_muting ? [] : @permission_set.resources.select(&:is_active).map { |r| helpers.pf_resource_plural(r.name) }
+    end
+
+    def load_resources_tab
+      @catalog = PermissionForge::Admin::ModelCatalog.new
+    end
+
+    def load_assignments_tab
+      @assignments = @permission_set.permission_set_users.includes(:user).order(:created_at).to_a
+    end
+
+    def load_conditions_tab
+      @ip_text ||= helpers.pf_ip_list(@permission_set.allowed_ips).join("\n")
+      configured = (PermissionForge.configuration.admin_session_flags || {}).keys.map(&:to_s)
+      used = PermissionForge::PermissionSet.where.not(requires_session_flag: [nil, '']).distinct.pluck(:requires_session_flag)
+      @flag_options = (configured + used).uniq
+    end
+
+    def load_audit_tab
+      load_audit_filters
+      audit = PermissionForge::Admin::AuditTrail.new
+      @editors = PermissionForge::Admin::AuditTrail.editors(audit.for_permission_set(@permission_set))
+      @entries = audit.for_permission_set(@permission_set, who: @who, type: @type, days: @days, sort: @sort)
+      load_audit_timeline unless request.format.csv?
+    end
+
+    # The set's events, newest first (the log filtered by this set).
+    def load_audit_timeline
+      @timeline_log = PermissionForge::Admin::AuditLog.new({ views: params[:views] },
+                                                           scope: PermissionForge::Admin::AuditLog.for_permission_set(@permission_set))
+      @timeline = @timeline_log.page(params[:page], per_page: AUDIT_TIMELINE_PER_PAGE)
+      @timeline_lookups = PermissionForge::Admin::AuditLookups.new(@timeline.events)
+    end
+
+    def load_audit_filters
+      @who = params[:who].presence
+      @type = params[:type].presence
+      @days = params[:days].presence
+      @sort = params[:sort] == 'asc' ? 'asc' : 'desc'
+    end
+
+    def send_audit_csv
+      audit = PermissionForge::Admin::AuditTrail.new
+      csv = audit.to_csv(@entries, describe: helpers.method(:pf_audit_describe), person: helpers.method(:pf_audit_people))
+      response.headers['Cache-Control'] = 'no-store' # names of people, like the log's exports
+      send_data csv, filename: "permission-forge-#{@permission_set.name.parameterize}-audit.csv", type: 'text/csv'
+    end
+  end
+end

data/app/controllers/permission_forge/permission_set_group_users_controller.rb

@@ -0,0 +1,57 @@
+module PermissionForge
+  # Group membership. Organisational only: it never gives Permission Sets.
+  # Adding and removing go through the model callbacks (group_membership.*
+  # audit events) after config.admin_assignment_authorization.
+  #
+  # @api private
+  class PermissionSetGroupUsersController < ApplicationController
+    include PermissionForge::AssignmentAuthorization
+
+    before_action :set_group
+    before_action :reject_locked
+
+    def create
+      user = member_user
+      return redirect_to(group_path, alert: t('permission_forge.flash.permission_set_group_users.user_not_found')) unless user
+      return if pf_assignment_refused?(@group, user.id, :add_member, group_path)
+
+      membership = PermissionForge::PermissionSetGroupUser.new(permission_set_group: @group, user: user)
+      return redirect_to(group_path, alert: t('permission_forge.flash.permission_set_group_users.add_failed')) unless membership.save
+
+      redirect_to group_path, notice: t('permission_forge.flash.groups.member_added', name: person_name(user))
+    end
+
+    # The member must be somebody config.user_list_resolver lists (404 otherwise).
+    def destroy
+      membership = @group.permission_set_group_users.find(params[:id])
+      PermissionForge::Admin::PeopleDirectory.new.find(membership.user_id) || pf_not_found
+      return if pf_assignment_refused?(@group, membership.user_id, :remove_member, group_path)
+
+      membership.destroy!
+      redirect_to group_path, notice: t('permission_forge.flash.permission_set_group_users.removed')
+    end
+
+    private
+
+    def set_group
+      @group = PermissionForge::PermissionSetGroup.find(params[:group_id])
+    end
+
+    # A locked group's members are frozen.
+    def reject_locked
+      pf_reject_locked!(@group, group_path)
+    end
+
+    def member_user
+      PermissionForge::Admin::PeopleDirectory.new.find(params[:user_id])
+    end
+
+    def person_name(user)
+      PermissionForge::Admin::PersonLabel.new(user).name
+    end
+
+    def group_path
+      permission_forge.group_path(@group)
+    end
+  end
+end