permission_forge 0.14.1

data/app/controllers/permission_forge/permission_set_groups_controller.rb

@@ -0,0 +1,111 @@
+module PermissionForge
+  # Permission Set Groups: purely organisational. Membership never grants
+  # access; changes here save immediately and never change anyone's access.
+  #
+  # @api private
+  class PermissionSetGroupsController < ApplicationController
+    before_action :set_group, except: %i[index create]
+    before_action :reject_locked, only: %i[update destroy confirm_destroy add_set remove_set]
+
+    def index
+      load_index
+      @new_open = params[:new].present?
+    end
+
+    def create
+      @group = PermissionForge::PermissionSetGroup.new(name: pf_text_param(:name), is_active: true, is_editable: true)
+      return render_blank_name if @group.name.blank?
+
+      @group.save!
+      redirect_to permission_forge.group_path(@group), notice: t('permission_forge.flash.groups.created', name: @group.name)
+    end
+
+    def show
+      @sets = @group.permission_sets.order(:name)
+      @other_sets = PermissionForge::PermissionSet.where.not(id: @sets.select(:id)).includes(:permission_set_group).order(:name)
+      @members = @group.permission_set_group_users.includes(:user).order(:created_at)
+      @candidates = PermissionForge.configuration.assignable_users(exclude_ids: @members.map(&:user_id))
+      @people_counts = PermissionForge::PermissionSetUser.active_assignments.group(:permission_set_id).count
+    end
+
+    def update
+      attrs = group_params
+      return redirect_to(permission_forge.group_path(@group), alert: t('permission_forge.errors.admin.group_blank')) if blank_name?(attrs)
+
+      @group.update!(attrs)
+      redirect_to permission_forge.group_path(@group), notice: t('permission_forge.flash.groups.updated')
+    end
+
+    def duplicate
+      copy = PermissionForge::Services::PermissionSetGroupCloner.call(
+        permission_set_group: @group, attrs: { name: t('permission_forge.permission_sets.copy_name', name: @group.name), is_editable: true },
+        unlock: true
+      )
+      redirect_to permission_forge.group_path(copy), notice: t('permission_forge.flash.groups.duplicated', name: @group.name)
+    end
+
+    def confirm_destroy; end
+
+    def destroy
+      name = @group.name
+      @group.destroy!
+      redirect_to permission_forge.groups_path, notice: t('permission_forge.flash.groups.deleted', name: name)
+    end
+
+    # Moving a set here also changes the list of the group it is in now: a
+    # locked one keeps it (EditableLock.locked_group_for_move), as in the
+    # set editor and the API.
+    def add_set
+      set = PermissionForge::PermissionSet.find(params[:permission_set_id])
+      leaving = PermissionForge::Admin::EditableLock.locked_group_for_move(from: set.permission_set_group_id, to: @group.id)
+      return if pf_reject_locked!([set, leaving], permission_forge.group_path(@group))
+
+      set.update!(permission_set_group: @group)
+      redirect_to permission_forge.group_path(@group), notice: t('permission_forge.flash.groups.set_added', set: set.name)
+    end
+
+    def remove_set
+      set = @group.permission_sets.find(params[:permission_set_id])
+      return if pf_reject_locked!(set, permission_forge.group_path(@group))
+
+      set.update!(permission_set_group: nil)
+      redirect_to permission_forge.group_path(@group), notice: t('permission_forge.flash.groups.set_removed', set: set.name)
+    end
+
+    private
+
+    def set_group
+      @group = PermissionForge::PermissionSetGroup.find(params[:id])
+    end
+
+    def load_index
+      @groups = PermissionForge::PermissionSetGroup.includes(:permission_sets, :permission_set_group_users).order(:name)
+      @ungrouped = PermissionForge::PermissionSet.where(permission_set_group_id: nil).order(:name)
+    end
+
+    # Re-renders the index with the "new group" form open and an error.
+    def render_blank_name
+      @new_error = t('permission_forge.errors.admin.group_blank')
+      @new_open = true
+      load_index
+      render(:index, status: :unprocessable_entity)
+    end
+
+    def group_params
+      pf_require_hash(:group).permit(:name, :description, :is_active).tap { |attrs| strip_name!(attrs) }
+    end
+
+    def strip_name!(attrs)
+      attrs[:name] = attrs[:name].to_s.strip if attrs.key?(:name)
+    end
+
+    # A name was submitted but is empty.
+    def blank_name?(attrs)
+      attrs.key?(:name) && attrs[:name].blank?
+    end
+
+    def reject_locked
+      pf_reject_locked!(@group, permission_forge.group_path(@group))
+    end
+  end
+end

data/app/controllers/permission_forge/permission_set_rules_controller.rb

@@ -0,0 +1,97 @@
+module PermissionForge
+  # Record rules (row-level filters) for a Resource, built as sentences.
+  #
+  # @api private
+  class PermissionSetRulesController < ApplicationController
+    before_action :set_resource
+    before_action :set_rule, only: %i[edit update destroy confirm_destroy toggle]
+    before_action :reject_locked
+    helper_method :rule_builder
+
+    def new
+      @form = PermissionForge::Admin::RuleForm.new(resource: @resource)
+    end
+
+    def create
+      @form = PermissionForge::Admin::RuleForm.new(resource: @resource, params: rule_params)
+      @rule = @resource.permission_set_rules.build(permission_set: @permission_set)
+      save_rule(:new, 'created')
+    end
+
+    def edit
+      @form = PermissionForge::Admin::RuleForm.new(resource: @resource, rule: @rule)
+    end
+
+    def update
+      @form = PermissionForge::Admin::RuleForm.new(resource: @resource, params: rule_params)
+      save_rule(:edit, 'updated')
+    end
+
+    # Re-renders the builder after a relationship/field/operator change.
+    def refresh
+      @form = PermissionForge::Admin::RuleForm.new(resource: @resource, params: rule_params)
+      @rule = @resource.permission_set_rules.find_by(id: params[:rule_id])
+      render(@rule ? :edit : :new)
+    end
+
+    def toggle
+      @rule.update!(is_active: !@rule.is_active)
+      key = @rule.is_active ? 'turned_on' : 'turned_off'
+      redirect_to rules_path, notice: t("permission_forge.flash.rules.#{key}", rule: @rule.name)
+    end
+
+    def confirm_destroy; end
+
+    def destroy
+      name = @rule.name
+      @rule.destroy!
+      redirect_to rules_path, notice: t('permission_forge.flash.rules.deleted', rule: name)
+    end
+
+    private
+
+    # What the builder page draws: built here, read by the template.
+    def rule_builder
+      @rule_builder ||= PermissionForge::Admin::RuleBuilder.new(form: @form, resource: @resource, model_errors: @model_errors)
+    end
+
+    def set_resource
+      @permission_set = PermissionForge::PermissionSet.find(params[:permission_set_id])
+      @resource = @permission_set.resources.find_by!(name: params[:resource_model])
+    end
+
+    def set_rule
+      @rule = @resource.permission_set_rules.find(params[:id])
+    end
+
+    def reject_locked
+      locked = [@permission_set, @resource, @rule].compact.find { |r| pf_locked?(r) }
+      pf_reject_locked!(locked, rules_path) if locked
+    end
+
+    def rules_path
+      permission_forge.permission_set_resource_path(@permission_set, @resource.name, tab: 'rules')
+    end
+
+    def rule_params
+      pf_hash_param(:rule).permit(:name, :field_name, :operator, :value, :values_text, :value_from, :value_to,
+                                  :current_user, :include_nulls, :failure_message, :join, :is_active, :remove_step,
+                                  path: [], values: [])
+    end
+
+    def save_rule(template, flash_key)
+      unless @form.valid?
+        @people_count = pf_people_count(@permission_set)
+        return render(template, status: :unprocessable_entity)
+      end
+
+      @rule.assign_attributes(@form.attributes)
+      if @rule.save
+        redirect_to rules_path, notice: t("permission_forge.flash.rules.#{flash_key}", rule: @rule.name)
+      else
+        @model_errors = @rule.errors.full_messages
+        render template, status: :unprocessable_entity
+      end
+    end
+  end
+end

data/app/controllers/permission_forge/permission_sets_controller.rb

@@ -0,0 +1,227 @@
+module PermissionForge
+  # Permission Sets: list, create (granting or muting), and the one-page
+  # editor (resources matrix, assignments, conditions, audit).
+  #
+  # @api private
+  class PermissionSetsController < ApplicationController
+    include PermissionSetEditor
+    include PermissionForge::AuditLogGate
+
+    FILTERS = %w[all granting muting conditional off].freeze
+    TABS = %w[resources assignments conditions audit].freeze
+
+    # List filter => predicate on a set ('all' and unknown filters match everything).
+    FILTER_MATCHERS = {
+      'granting' => ->(set) { !set.is_muting },
+      'muting' => lambda(&:is_muting),
+      'conditional' => lambda(&:conditional?),
+      'off' => ->(set) { !set.is_active }
+    }.freeze
+
+    pf_exports %i[csv], only: :show # the audit tab
+    before_action :set_permission_set, except: %i[index new create]
+    before_action :reject_locked, only: %i[review apply destroy confirm_destroy switch_mode confirm_switch_mode conditions]
+    before_action :reject_locked_group_move, only: %i[create review apply]
+
+    def index
+      @query = params[:q].to_s.strip
+      @filter = filter_param
+      all = PermissionForge::PermissionSet.includes(:permission_set_group, :resources).order(:name).to_a
+      @total = all.size
+      @counts = filter_counts(all)
+      @permission_sets = all.select { |ps| filter_match?(ps, @filter) && query_match?(ps) }
+      @people_counts = people_counts
+    end
+
+    def new
+      @muting = params[:type] == 'muting'
+      @name = params[:name].to_s
+      load_new_form
+    end
+
+    def create
+      @muting = params[:type] == 'muting'
+      @name = pf_text_param(:name)
+      load_new_form
+      @error = name_error(@name)
+      return render(:new, status: :unprocessable_entity) if @error
+
+      set = build_set
+      redirect_to permission_forge.permission_set_path(set), notice: t('permission_forge.flash.permission_sets.created', name: set.name)
+    end
+
+    def show
+      # The CSV is the audit tab's export, whatever tab the link came from.
+      @tab = if request.format.csv?
+               'audit'
+             else
+               (TABS.include?(params[:tab]) ? params[:tab] : 'resources')
+             end
+      load_editor
+      return pf_refuse_audit_tab unless pf_audit_tab_allowed?
+
+      send("load_#{@tab}_tab")
+      respond_to do |format|
+        format.html
+        format.csv { send_audit_csv }
+      end
+    end
+
+    # "Review and save": lists every pending change and who it affects.
+    def review
+      @change_set = change_set
+      if @change_set.empty?
+        return redirect_to(pf_back_or(permission_forge.permission_set_path(@permission_set)),
+                           notice: t('permission_forge.flash.permission_sets.no_changes'))
+      end
+
+      load_editor
+      @changes = @change_set.changes
+      render :review
+    end
+
+    def apply
+      changes = change_set.apply!
+      redirect_to back_to_set, notice: t('permission_forge.flash.permission_sets.saved',
+                                         count: changes.size, people: helpers.pf_people_text(pf_people_count(@permission_set)))
+    rescue PermissionForge::Admin::ChangeSet::Invalid => e
+      redirect_to back_to_set, alert: t('permission_forge.flash.permission_sets.save_failed', errors: e.message)
+    end
+
+    def duplicate
+      name = PermissionForge::Admin::PermissionSetFactory.unique_name(
+        t('permission_forge.permission_sets.copy_name', name: @permission_set.name)
+      )
+      copy = PermissionForge::Admin::PermissionSetFactory.duplicate(@permission_set, name: name)
+      group = @permission_set.permission_set_group
+      notice = if group && copy.permission_set_group_id.nil?
+                 t('permission_forge.flash.permission_sets.duplicated_outside_group', name: @permission_set.name, group: group.name)
+               else
+                 t('permission_forge.flash.permission_sets.duplicated', name: @permission_set.name)
+               end
+      redirect_to permission_forge.permission_set_path(copy), notice: notice
+    end
+
+    def confirm_destroy
+      load_impact
+    end
+
+    def destroy
+      name = @permission_set.name
+      @permission_set.destroy!
+      redirect_to permission_forge.permission_sets_path, notice: t('permission_forge.flash.permission_sets.deleted', name: name)
+    end
+
+    def confirm_switch_mode
+      load_impact
+    end
+
+    # Granting <-> muting. Field flags are kept; their meaning inverts.
+    def switch_mode
+      @permission_set.update!(is_muting: !@permission_set.is_muting)
+      key = @permission_set.is_muting ? 'switched_muting' : 'switched_granting'
+      redirect_to permission_forge.permission_set_path(@permission_set),
+                  notice: t("permission_forge.flash.permission_sets.#{key}", name: @permission_set.name)
+    end
+
+    def conditions
+      @conditions_form = PermissionForge::Admin::ConditionsForm.new(params) # the re-render reads it back
+      attrs = @conditions_form.attributes
+      @condition_errors = @conditions_form.errors
+      if @condition_errors.empty? && @permission_set.update(attrs)
+        return redirect_to permission_forge.permission_set_path(@permission_set, tab: 'conditions'),
+                           notice: t('permission_forge.flash.permission_sets.conditions_saved')
+      end
+
+      @tab = 'conditions'
+      @ip_text = params[:allowed_ips].to_s
+      load_editor
+      load_conditions_tab
+      render :show, status: :unprocessable_entity
+    end
+
+    private
+
+    def set_permission_set
+      @permission_set = PermissionForge::PermissionSet.find(params[:id])
+    end
+
+    # Deleting the set also changes its group's list of sets: a locked group
+    # refuses it (EditableLock.container_of).
+    def reject_locked
+      container = PermissionForge::Admin::EditableLock.container_of(@permission_set) if action_name.include?('destroy')
+      pf_reject_locked!([@permission_set, container], permission_forge.permission_set_path(@permission_set))
+    end
+
+    # A set created in, or moved into or out of, a locked Permission Set
+    # Group changes that group's list of sets: refused, as on the group page.
+    def reject_locked_group_move
+      requested = @permission_set ? pf_hash_param(:pf)[:set] : params
+      return unless requested.respond_to?(:key?) && requested.key?(:permission_set_group_id)
+
+      locked = PermissionForge::Admin::EditableLock.locked_group_for_move(
+        from: @permission_set&.permission_set_group_id, to: requested[:permission_set_group_id]
+      )
+      back = @permission_set ? permission_forge.permission_set_path(@permission_set) : permission_forge.permission_sets_path
+      pf_reject_locked!(locked, back) if locked
+    end
+
+    def back_to_set
+      pf_back_or(permission_forge.permission_set_path(@permission_set))
+    end
+
+    def change_set
+      PermissionForge::Admin::ChangeSet.new(permission_set: @permission_set, params: pf_hash_param(:pf))
+    end
+
+    # --- list -----------------------------------------------------------------
+
+    def filter_param
+      filter = params[:filter]
+      FILTERS.include?(filter) ? filter : 'all'
+    end
+
+    def filter_counts(sets)
+      FILTERS.index_with { |filter| sets.count { |ps| filter_match?(ps, filter) } }
+    end
+
+    def filter_match?(set, filter)
+      matcher = FILTER_MATCHERS[filter]
+      matcher ? matcher.call(set) : true
+    end
+
+    def query_match?(set)
+      return true if @query.empty?
+
+      needle = @query.downcase
+      [set.name, set.description].compact.any? { |v| v.downcase.include?(needle) }
+    end
+
+    def people_counts
+      PermissionForge::PermissionSetUser.active_assignments.group(:permission_set_id).count
+    end
+
+    # --- create / duplicate -----------------------------------------------------
+
+    def load_new_form
+      @groups = PermissionForge::PermissionSetGroup.order(:name)
+      @sources = PermissionForge::PermissionSet.order(:name).to_a
+      @start_from = params[@muting ? :start_from_muting : :start_from_granting].to_s
+      @group_id = params[:permission_set_group_id].to_s
+    end
+
+    def name_error(name)
+      return t('permission_forge.errors.admin.set_name_blank') if name.blank?
+      return t('permission_forge.errors.admin.set_name_taken') if PermissionForge::Admin::PermissionSetFactory.name_taken?(name)
+
+      nil
+    end
+
+    def build_set
+      group = PermissionForge::PermissionSetGroup.find_by(id: @group_id)
+      source = @sources.find { |ps| ps.id.to_s == @start_from && ps.is_muting == @muting }
+      PermissionForge::Admin::PermissionSetFactory.create({ name: @name, is_muting: @muting, permission_set_group: group },
+                                                          source: source)
+    end
+  end
+end

data/app/controllers/permission_forge/preferences_controller.rb

@@ -0,0 +1,26 @@
+module PermissionForge
+  # Per-browser admin preferences, stored in cookies scoped to the engine's
+  # mount path: colour theme and dismissed helper banners.
+  #
+  # @api private
+  class PreferencesController < ApplicationController
+    HELP_KEY = /\A[a-z_]{1,40}\z/
+
+    def update
+      theme = params[:theme]
+      pf_cookie(:pf_theme, theme) if THEMES.include?(theme.to_s)
+      dismiss_help(params[:dismiss_help].to_s)
+      redirect_to pf_back_or(permission_forge.root_path)
+    end
+
+    private
+
+    # Blank or malformed keys are ignored.
+    def dismiss_help(key)
+      return unless key.match?(HELP_KEY)
+
+      keys = (pf_dismissed_help + [key]).uniq.last(30)
+      pf_cookie(:pf_help, keys.join(','))
+    end
+  end
+end

data/app/controllers/permission_forge/resource_actions_controller.rb

@@ -0,0 +1,106 @@
+module PermissionForge
+  # Special actions on a Resource (e.g. export, sync). Saves apply immediately.
+  # With controller_action_discovery on, the drawers also show where an action
+  # runs and what its row means; discovered actions added from the Actions tab
+  # go through Admin::ChangeSet instead (review, then apply).
+  #
+  # @api private
+  class ResourceActionsController < ApplicationController
+    before_action :set_resource
+    before_action :set_action, only: %i[show update destroy confirm_destroy]
+    before_action :reject_locked, only: %i[new create update destroy confirm_destroy]
+
+    # `?key=export` opens the form for a discovered controller action.
+    def new
+      @action_record = @resource.resource_actions.build(name: suggested_key, is_active: true,
+                                                        is_permitted: !@permission_set.is_muting)
+      load_rows
+    end
+
+    def create
+      @action_record = @resource.resource_actions.build(action_params)
+      normalize_name!(@action_record)
+      @errors = validate(@action_record)
+      return render_invalid if @errors.any?
+
+      @action_record.save!
+      redirect_to resource_path, notice: t('permission_forge.flash.actions.created', action: @action_record.display_name)
+    end
+
+    def show
+      load_rows
+      @across = @action_rows.across_sets(@action_record.name)
+      @people_count = pf_people_count(@permission_set)
+    end
+
+    def update
+      @action_record.assign_attributes(action_params.except(:name))
+      @action_record.save!
+      redirect_to pf_back_or(resource_path), notice: t('permission_forge.flash.actions.updated', action: @action_record.display_name)
+    end
+
+    def confirm_destroy; end
+
+    def destroy
+      name = @action_record.display_name
+      @action_record.destroy!
+      redirect_to resource_path, notice: t('permission_forge.flash.actions.deleted', action: name)
+    end
+
+    private
+
+    def set_resource
+      @permission_set = PermissionForge::PermissionSet.find(params[:permission_set_id])
+      @resource = @permission_set.resources.find_by!(name: params[:resource_model])
+    end
+
+    def set_action
+      @action_record = @resource.resource_actions.find(params[:id])
+    end
+
+    def reject_locked
+      locked = [@permission_set, @resource].find { |r| pf_locked?(r) }
+      pf_reject_locked!(locked, resource_path) if locked
+    end
+
+    def resource_path
+      permission_forge.permission_set_resource_path(@permission_set, @resource.name, tab: 'actions')
+    end
+
+    def action_params
+      pf_require_hash(:resource_action).permit(:name, :label, :description, :is_permitted, :is_active)
+    end
+
+    # "Export CSV " => "export_csv"
+    def normalize_name!(record)
+      record.name = record.name.to_s.strip.downcase.tr(' ', '_')
+    end
+
+    # Rows for the drawers: endpoints, guard status and effect. @row is the
+    # row of the action in the form (nil for a key discovery does not know).
+    def load_rows
+      @action_rows = PermissionForge::Admin::ActionRows.new(@resource)
+      @row = @action_rows.row(@action_record.name)
+    end
+
+    def render_invalid
+      load_rows
+      render :new, status: :unprocessable_entity
+    end
+
+    def suggested_key
+      key = params[:key].to_s
+      key if key.match?(PermissionForge::ControllerActions::KEY_FORMAT)
+    end
+
+    def validate(record)
+      errors = {}
+      if !record.name.to_s.match?(PermissionForge::ControllerActions::KEY_FORMAT)
+        errors[:name] = t('permission_forge.errors.admin.action_format')
+      elsif @resource.resource_actions.where(name: record.name).exists?
+        errors[:name] = t('permission_forge.errors.admin.action_taken')
+      end
+      errors
+    end
+  end
+end

data/app/controllers/permission_forge/resource_fields_controller.rb

@@ -0,0 +1,129 @@
+module PermissionForge
+  # Field detail (drawer or page) for one column of a Resource — configured or
+  # not yet configured. Saves apply immediately (with an impact line).
+  #
+  # @api private
+  class ResourceFieldsController < ApplicationController
+    include PermissionForge::ActingAdmin
+
+    before_action :load_field
+    before_action :reject_locked, only: %i[update acknowledge apply_recommendation]
+
+    def show
+      row = @rows.row(@key)
+      @detail = PermissionForge::Admin::FieldDetail.new(
+        resource: @resource, row: row, rows: @rows,
+        rules: field_rules, across: PermissionForge::Admin::FieldAcrossSets.call(@resource.name, @key),
+        people_count: pf_people_count(@permission_set), explain_people: explain_candidates,
+        explain: (explain(params[:explain_user_id]) if params[:explain_user_id].present?),
+        explain_user_id: params[:explain_user_id]
+      )
+    end
+
+    def update
+      attrs = pf_require_hash(:field).permit(:level, :mask_strategy, :label, :description, :is_active).to_h
+      changes = apply_field_changes(attrs)
+      finish_new_field(attrs) unless @field
+      redirect_to pf_back_or(resource_path), notice: saved_notice(changes)
+    rescue PermissionForge::Admin::ChangeSet::Invalid => e
+      redirect_to field_path, alert: t('permission_forge.flash.permission_sets.save_failed', errors: e.message)
+    end
+
+    # Privacy audit: "This is intended" — stop flagging this unmasked field.
+    # Records who acknowledged it (sensitive_acknowledged_by_id, when the
+    # column exists) through a normal update: one field.sensitive_acknowledged event.
+    def acknowledge
+      if @field && PermissionForge::Admin::AttentionItems.acknowledgement_supported?
+        attrs = { sensitive_acknowledged_at: Time.current }
+        attrs[:sensitive_acknowledged_by_id] = pf_acting_admin_record&.id if @field.has_attribute?(:sensitive_acknowledged_by_id)
+        @field.audit_as('field.sensitive_acknowledged') { @field.update!(attrs) }
+      end
+      redirect_to pf_back_or(field_path), notice: t('permission_forge.flash.fields.acknowledged', field: @key)
+    end
+
+    # Applies the recommended mask for a sensitive column.
+    def apply_recommendation
+      match = PermissionForge::Admin::SensitiveColumns.new.match(@key)
+      return redirect_to(field_path) unless match
+
+      level = @permission_set.is_muting ? 'mask' : 'masked'
+      apply_field_changes('level' => level, 'mask_strategy' => match.strategy)
+      redirect_to pf_back_or(field_path), notice: t('permission_forge.flash.fields.recommendation_applied', field: @key)
+    end
+
+    private
+
+    def load_field
+      load_resource
+      @key = params[:key].to_s
+      @field = @resource.resource_fields.find { |field| field.name == @key }
+      @rows = PermissionForge::Admin::FieldRows.new(@resource)
+      pf_not_found unless @field || @rows.row(@key)
+    end
+
+    def load_resource
+      @permission_set = PermissionForge::PermissionSet.find(params[:permission_set_id])
+      @resource = @permission_set.resources.includes(:resource_fields, :permission_set_rules).find_by!(name: params[:resource_model])
+    end
+
+    # Applies `attrs` to this field through a ChangeSet; an unconfigured column
+    # is created at attrs['level'].
+    def apply_field_changes(attrs)
+      change_params = if @field
+                        { fields: { @field.id.to_s => attrs } }
+                      else
+                        { new_fields: { @resource.id.to_s => { @key => { 'level' => attrs['level'] } } } }
+                      end
+      PermissionForge::Admin::ChangeSet.new(permission_set: @permission_set, params: change_params).apply!
+    end
+
+    # Filter rules (no relationship) on this field.
+    def field_rules
+      @resource.permission_set_rules.select { |rule| rule.field_name == @key && rule.field_accessor_path.blank? }
+    end
+
+    def reject_locked
+      locked = [@permission_set, @resource, @field].compact.find { |r| pf_locked?(r) }
+      pf_reject_locked!(locked, field_path) if locked
+    end
+
+    def resource_path
+      permission_forge.permission_set_resource_path(@permission_set, @resource.name)
+    end
+
+    def field_path
+      permission_forge.permission_set_resource_field_path(@permission_set, @resource.name, @key)
+    end
+
+    def finish_new_field(attrs)
+      field = @resource.resource_fields.reload.find { |candidate| candidate.name == @key }
+      return unless field
+
+      extra = attrs.slice('label', 'description').compact_blank
+      extra['mask_strategy'] = attrs['mask_strategy'] if attrs['mask_strategy'].present? && field.mask_access
+      field.update!(extra) if extra.any?
+    end
+
+    def saved_notice(changes)
+      return t('permission_forge.flash.permission_sets.no_changes') if changes.empty?
+
+      t('permission_forge.flash.permission_sets.saved', count: changes.size,
+                                                        people: helpers.pf_people_text(pf_people_count(@permission_set)))
+    end
+
+    def explain_candidates
+      set_ids = PermissionForge::Resource.where(name: @resource.name).select(:permission_set_id)
+      user_ids = PermissionForge::PermissionSetUser.active_assignments.where(permission_set_id: set_ids)
+                                                   .distinct.limit(200).pluck(:user_id)
+      PermissionForge::Admin::PeopleDirectory.new.find_all(user_ids)
+    end
+
+    def explain(user_id)
+      user = PermissionForge::Admin::PeopleDirectory.new.find(user_id)
+      return nil unless user
+
+      outcome = PermissionForge::Admin::EffectiveAccess.call(user: user).find { |r| r.name == @resource.name }
+      { user: user, field: outcome&.fields&.find { |field| field.name == @key } }
+    end
+  end
+end