@nocobase/app-template-default 1.0.0-beta.70 → 1.0.0-beta.71

package/client/components/permission-editor.tsx

@@ -126,7 +126,7 @@ function LevelControl({
   if (levels.length === 0) return null;
   if (levels.length === 1)
     return (
-      <span className='block truncate px-2.5 text-sm text-muted-foreground'>
+      <span className='flex min-h-7 min-w-0 items-center px-2 text-xs text-muted-foreground'>
         {levels[0]?.label}
       </span>
     );
@@ -141,7 +141,7 @@ function LevelControl({
     >
       <SelectTrigger
         size='sm'
-        className='h-6 w-auto max-w-48 gap-1 border-0 bg-muted/50 px-2 text-xs shadow-none'
+        className='h-7 w-full min-w-0 max-w-full flex-1 gap-1 border-0 bg-muted/50 px-2 text-xs shadow-none'
         aria-label={label}
       >
         <SelectValue />
@@ -162,6 +162,7 @@ function LevelControl({
 function PermissionRow({
   row,
   controlId,
+  showScopeLabels = false,
   readOnly,
   labels,
   onEnabledChange,
@@ -169,6 +170,7 @@ function PermissionRow({
 }: {
   readonly row: PermissionEditorRow;
   readonly controlId: string;
+  readonly showScopeLabels?: boolean;
   readonly readOnly: boolean;
   readonly labels: PermissionEditorLabels;
   readonly onEnabledChange: (rowId: string, enabled: boolean) => void;
@@ -179,7 +181,7 @@ function PermissionRow({
       data-slot='permission-row'
       className='flex min-w-0 flex-col gap-1 rounded-md px-2 py-1.5'
     >
-      <div className='flex min-h-6 min-w-0 flex-wrap items-center gap-2'>
+      <div className='grid min-h-6 min-w-0 grid-cols-[auto_auto_minmax(0,1fr)] items-center gap-x-2 @2xl:grid-cols-[auto_minmax(0,1fr)] gap-y-1'>
         <Checkbox
           id={controlId}
           checked={row.enabled}
@@ -189,35 +191,45 @@ function PermissionRow({
         />
         <label
           htmlFor={controlId}
-          className='min-w-0 cursor-pointer text-sm leading-5 font-medium break-words'
+          className='min-h-6 min-w-0 max-w-36 cursor-pointer text-sm leading-6 font-medium break-words @2xl:max-w-none'
         >
           {row.label}
         </label>
         {row.enabled && row.levels ? (
-          <LevelControl
-            label={labels.levelFor(row.label)}
-            levels={row.levels}
-            value={row.level ?? ''}
-            disabled={readOnly}
-            onChange={(level) => onLevelChange(row.id, level)}
-          />
+          <div className='col-start-3 min-w-0 @2xl:col-start-2'>
+            <LevelControl
+              label={labels.levelFor(row.label)}
+              levels={row.levels}
+              value={row.level ?? ''}
+              disabled={readOnly}
+              onChange={(level) => onLevelChange(row.id, level)}
+            />
+          </div>
         ) : null}
         {row.enabled &&
           row.scopes?.map((scope) => (
-            <div key={scope.id} className='flex min-w-0 items-center gap-1'>
-              {row.scopes && row.scopes.length > 1 && (
-                <span className='text-xs text-muted-foreground'>
+            <div
+              key={scope.id}
+              className={cn(
+                'col-start-3 grid min-w-0 gap-1 @2xl:col-start-2',
+                showScopeLabels && 'col-span-2 col-start-2 @2xl:col-span-1',
+              )}
+            >
+              {(showScopeLabels || (row.scopes && row.scopes.length > 1)) && (
+                <span className='text-xs leading-5 text-muted-foreground'>
                   {scope.label}
                 </span>
               )}
-              <LevelControl
-                label={labels.levelFor(`${row.label} · ${scope.label}`)}
-                levels={scope.levels}
-                value={scope.level ?? ''}
-                disabled={readOnly}
-                onChange={(level) => onLevelChange(scope.id, level)}
-              />
-              {scope.configuration}
+              <div className='flex min-h-7 min-w-0 items-center gap-1'>
+                <LevelControl
+                  label={labels.levelFor(`${row.label} · ${scope.label}`)}
+                  levels={scope.levels}
+                  value={scope.level ?? ''}
+                  disabled={readOnly}
+                  onChange={(level) => onLevelChange(scope.id, level)}
+                />
+                {scope.configuration}
+              </div>
             </div>
           ))}
       </div>
@@ -280,7 +292,7 @@ export function PermissionEditor({
   return (
     <div className='@container flex min-w-0 flex-col overflow-hidden rounded-xl border bg-card'>
       <div className='flex flex-wrap items-center gap-3 border-b p-3'>
-        <div className='relative min-w-0 flex-1'>
+        <div className='relative min-w-48 flex-1'>
           <SearchIcon
             aria-hidden
             className='pointer-events-none absolute top-1/2 left-3 size-4 -translate-y-1/2 text-muted-foreground'
@@ -296,7 +308,7 @@ export function PermissionEditor({
         </div>
         <label
           htmlFor={`${id}-enabled`}
-          className='flex items-center gap-2 text-sm'
+          className='flex shrink-0 items-center gap-2 text-sm whitespace-nowrap'
         >
           <Switch
             id={`${id}-enabled`}
@@ -322,7 +334,7 @@ export function PermissionEditor({
       <div className='flex max-h-128 min-w-0 flex-col overflow-auto @2xl:flex-row'>
         <nav
           aria-label={words.navigation}
-          className='flex shrink-0 gap-1 overflow-x-auto border-b bg-muted/25 p-2 @2xl:sticky @2xl:top-0 @2xl:max-h-128 @2xl:w-48 @2xl:self-start @2xl:flex-col @2xl:border-r @2xl:border-b-0'
+          className='flex shrink-0 gap-1 overflow-x-auto border-b bg-muted/25 p-2 @2xl:sticky @2xl:top-0 @2xl:max-h-128 @2xl:w-64 @2xl:self-start @2xl:flex-col @2xl:border-r @2xl:border-b-0'
         >
           {sections.map((section) => {
             const rows = section.groups.flatMap((group) => group.rows);
@@ -338,13 +350,18 @@ export function PermissionEditor({
                   setEnabledOnly(false);
                 }}
                 className={cn(
-                  'h-auto shrink-0 justify-between gap-4 px-3 py-2.5 text-left whitespace-normal',
+                  'h-auto shrink-0 justify-between gap-3 px-3 py-2 text-left whitespace-nowrap @2xl:w-full @2xl:min-w-0',
                   section.id === active &&
                     'bg-primary/10 text-primary hover:bg-primary/15',
                 )}
               >
-                <span>{section.title}</span>
-                <span className='rounded-md bg-background px-1.5 py-0.5 text-xs tabular-nums'>
+                <span
+                  className='min-w-0 @2xl:flex-1 @2xl:truncate'
+                  title={section.title}
+                >
+                  {section.title}
+                </span>
+                <span className='shrink-0 rounded-md bg-background px-1.5 py-0.5 text-xs tabular-nums'>
                   {rows.filter((row) => row.enabled).length}/{rows.length}
                 </span>
               </Button>
@@ -357,6 +374,9 @@ export function PermissionEditor({
               const original =
                 sections.find((item) => item.id === section.id) ?? section;
               const singleResource = original.groups.length === 1;
+              const showScopeLabels = original.groups.some((group) =>
+                group.rows.some((row) => (row.scopes?.length ?? 0) > 1),
+              );
               const keys = [
                 ...new Set(
                   original.groups
@@ -369,16 +389,30 @@ export function PermissionEditor({
                 ...common.filter((key) => keys.includes(key)),
                 ...keys.filter((key) => !common.includes(key)),
               ];
-              // Dense or unclassified catalogs keep the wrapping layout instead of hiding actions.
               const aligned =
                 columns.length > 0 &&
-                columns.length <= 7 &&
+                columns.length <= 4 &&
                 original.groups.every(
                   (group) =>
                     group.rows.every((row) => row.actionKey) &&
                     new Set(group.rows.map((row) => row.actionKey)).size ===
                       group.rows.length,
                 );
+              // Keep action columns only when each has room for its label and scope.
+              const alignment = [
+                '',
+                '@3xl:grid-cols-(--permission-columns)',
+                '@3xl:grid-cols-(--permission-columns)',
+                '@5xl:grid-cols-(--permission-columns)',
+                '@7xl:grid-cols-(--permission-columns)',
+              ][columns.length];
+              const placement = [
+                '',
+                '@3xl:col-start-(--permission-column) @3xl:row-start-1',
+                '@3xl:col-start-(--permission-column) @3xl:row-start-1',
+                '@5xl:col-start-(--permission-column) @5xl:row-start-1',
+                '@7xl:col-start-(--permission-column) @7xl:row-start-1',
+              ][columns.length];
               return (
                 <section
                   key={section.id}
@@ -430,11 +464,11 @@ export function PermissionEditor({
                       return (
                         <div
                           key={group.id}
-                          className='grid min-w-0 gap-2 p-3 @xl:grid-cols-[minmax(8rem,1fr)_minmax(0,4fr)]'
+                          className='grid min-w-0 gap-2 p-3 @3xl:grid-cols-[9rem_minmax(0,1fr)]'
                           data-slot='permission-resource'
                         >
-                          <div className='flex min-w-0 flex-col justify-center gap-1'>
-                            <h3 className='text-sm font-medium break-words'>
+                          <div className='flex min-w-0 flex-col gap-1 py-1.5'>
+                            <h3 className='min-h-6 text-sm leading-6 font-medium break-words'>
                               {group.title ?? section.title}
                             </h3>
                             {group.hint && (
@@ -442,7 +476,12 @@ export function PermissionEditor({
                                 {group.hint}
                               </p>
                             )}
-                            <div className='flex items-center gap-2 text-xs text-muted-foreground'>
+                            <div
+                              className={cn(
+                                'flex min-h-7 items-center gap-2 text-xs text-muted-foreground',
+                                showScopeLabels && '@3xl:mt-6',
+                              )}
+                            >
                               {onEnabledBatchChange &&
                                 totalRows.length > 1 &&
                                 selectable.length > 0 && (
@@ -514,9 +553,8 @@ export function PermissionEditor({
                           </div>
                           <div
                             className={cn(
-                              'flex min-w-0 flex-wrap items-start gap-x-3 gap-y-1',
-                              aligned &&
-                                '@4xl:grid @4xl:grid-cols-(--permission-columns) @4xl:gap-x-1',
+                              'grid min-w-0 grid-cols-[repeat(auto-fill,minmax(min(100%,14rem),1fr))] items-start gap-x-2 gap-y-1',
+                              aligned && alignment,
                             )}
                             style={
                               {
@@ -524,42 +562,42 @@ export function PermissionEditor({
                               } as CSSProperties
                             }
                           >
-                            {(aligned
-                              ? [...group.rows].sort(
-                                  (a, b) =>
-                                    columns.indexOf(a.actionKey ?? '') -
-                                    columns.indexOf(b.actionKey ?? ''),
-                                )
-                              : group.rows
-                            ).map((row) => (
-                              <div
-                                key={row.id}
-                                className={cn(
-                                  'min-w-0',
-                                  aligned &&
-                                    '@4xl:col-start-(--permission-column) @4xl:row-start-1',
-                                )}
-                                style={
-                                  {
-                                    '--permission-column':
-                                      columns.indexOf(row.actionKey ?? '') + 1,
-                                  } as CSSProperties
-                                }
-                              >
-                                <PermissionRow
-                                  controlId={`${id}-${row.id}`}
-                                  row={row}
-                                  readOnly={readOnly}
-                                  labels={words}
-                                  onEnabledChange={(rowId, on) => {
-                                    if (enabledOnly && !on)
-                                      searchRef.current?.focus();
-                                    onEnabledChange(rowId, on);
-                                  }}
-                                  onLevelChange={onLevelChange}
-                                />
-                              </div>
-                            ))}
+                            {[...group.rows]
+                              .sort(
+                                (a, b) =>
+                                  columns.indexOf(a.actionKey ?? '') -
+                                  columns.indexOf(b.actionKey ?? ''),
+                              )
+                              .map((row) => (
+                                <div
+                                  key={row.id}
+                                  className={cn(
+                                    'min-w-0',
+                                    aligned && placement,
+                                  )}
+                                  style={
+                                    {
+                                      '--permission-column':
+                                        columns.indexOf(row.actionKey ?? '') +
+                                        1,
+                                    } as CSSProperties
+                                  }
+                                >
+                                  <PermissionRow
+                                    controlId={`${id}-${row.id}`}
+                                    row={row}
+                                    showScopeLabels={showScopeLabels}
+                                    readOnly={readOnly}
+                                    labels={words}
+                                    onEnabledChange={(rowId, on) => {
+                                      if (enabledOnly && !on)
+                                        searchRef.current?.focus();
+                                      onEnabledChange(rowId, on);
+                                    }}
+                                    onLevelChange={onLevelChange}
+                                  />
+                                </div>
+                              ))}
                           </div>
                         </div>
                       );

package/client/locales/system/settings-en-US.ts

@@ -97,6 +97,7 @@ const settings = {
   selectAllPermissions: 'All',
   selectVisiblePermissions: 'Select visible permissions in {{name}}',
   permissionSummary: '{{enabled}} of {{total}} enabled',
+  preservedRecordScope: 'Keep existing configuration',
   noRecordScope: 'No records (not authorized)',
   permissionFilter: {
     limit: 'Up to 20 conditions',

package/client/locales/system/settings-zh-CN.ts

@@ -88,18 +88,19 @@ const settings = {
   total_other: '共 {{count}} 位用户',
   access: '访问',
   permissionSearch: '搜索分类、分组或权限',
-  enabledOnly: '仅看已开启',
+  enabledOnly: '仅显示已授权',
   noPermissions: '暂无可配置权限',
   permissionCategories: '权限分类',
   selectAllPermissions: '全选',
   selectVisiblePermissions: '选择“{{name}}”中显示的权限',
-  permissionSummary: '已开启 {{enabled}} / {{total}}',
-  noRecordScope: '无记录（未授权）',
+  permissionSummary: '已授权 {{enabled}} / {{total}}',
+  noRecordScope: '不允许访问数据',
+  preservedRecordScope: '保留现有配置',
   permissionFilter: {
     limit: '最多支持 20 个条件',
-    configure: '筛选条件',
-    title: '配置记录筛选',
-    description: '应用条件后还需保存角色，权限才会生效。',
+    configure: '设置条件',
+    title: '设置数据范围',
+    description: '仅允许访问符合以下条件的数据，保存角色后生效。',
     all: '满足全部条件',
     any: '满足任一条件',
     field: '字段',

package/client/pages/settings/page-permissions.ts

@@ -24,19 +24,28 @@ export function pagePermissionResources(
   titles: PagePermissionTitles,
   unnamed: (path: string) => string,
 ): CatalogResource[] {
-  return routes.flatMap((route) => [
-    ...(route.componentLoader &&
-    typeof route.authz === 'object' &&
-    route.authz.resource.type === 'page'
-      ? [
-          {
+  const resources = new Map<string, CatalogResource>();
+  const visit = (items: readonly AppClientRegisteredRoute[]): void => {
+    for (const route of items) {
+      if (
+        route.componentLoader &&
+        typeof route.authz === 'object' &&
+        route.authz.resource.type === 'page'
+      ) {
+        const id = route.authz.resource.id;
+        // Resolved child routes may inherit the parent's authorization resource.
+        // They share one grant, so showing independent checkboxes is misleading.
+        if (!resources.has(id))
+          resources.set(id, {
             type: 'page',
-            id: route.authz.resource.id,
+            id,
             title: pagePermissionTitle(route, titles) ?? unnamed(route.path),
             actions: [{ name: 'access', title: { key: 'settings.access' } }],
-          },
-        ]
-      : []),
-    ...pagePermissionResources(route.children ?? [], titles, unnamed),
-  ]);
+          });
+      }
+      visit(route.children ?? []);
+    }
+  };
+  visit(routes);
+  return [...resources.values()];
 }

package/client/pages/settings/permissions-model.ts

@@ -17,6 +17,15 @@ export function setPermission(
   action: string,
   enabled: boolean,
 ): readonly PermissionGrant[] {
+  const existing =
+    grants
+      .find(
+        (grant) =>
+          grant.resource.type === resource.type &&
+          grant.resource.id === resource.id,
+      )
+      ?.actions.some((entry) => entry.action === action) ?? false;
+  if (existing === enabled) return grants;
   const next = grants.map((grant) => ({
     ...grant,
     actions: [...grant.actions],
@@ -87,40 +96,55 @@ export function permissionSections(
             return {
               ...row,
               scopes: granted
-                ? (resource.dataScopes?.[action.name] ?? []).map((scope) => ({
-                    id: JSON.stringify([
-                      resource.type,
-                      resource.id,
-                      action.name,
-                      scope.key,
-                    ]),
-                    label: text(
-                      typeof scope.title === 'string' &&
-                        scope.title === scope.collection
-                        ? { key: 'settings.recordScope' }
-                        : scope.title,
-                    ),
-                    levels: [
-                      {
-                        value: '',
-                        label: text({ key: 'settings.noRecordScope' }),
-                      },
-                      ...scope.recordAccess.map((key) => ({
-                        value: key,
-                        label: text(
-                          catalog.recordAccess.find(
-                            (entry) => entry.key === key,
-                          )?.title ?? key,
-                        ),
-                      })),
-                    ],
-                    level: scopeSelectionKey(
+                ? (resource.dataScopes?.[action.name] ?? []).map((scope) => {
+                    const value = scopeSelectionKey(
                       granted.policy?.scopes &&
                         typeof granted.policy.scopes === 'object'
                         ? Reflect.get(granted.policy.scopes, scope.key)
                         : undefined,
-                    ),
-                  }))
+                    );
+                    const preserved =
+                      value !== '' && !scope.recordAccess.includes(value);
+                    return {
+                      id: JSON.stringify([
+                        resource.type,
+                        resource.id,
+                        action.name,
+                        scope.key,
+                      ]),
+                      label: text(
+                        typeof scope.title === 'string' &&
+                          scope.title === scope.collection
+                          ? { key: 'settings.recordScope' }
+                          : scope.title,
+                      ),
+                      levels: [
+                        ...(preserved
+                          ? [
+                              {
+                                value,
+                                label: text({
+                                  key: 'settings.preservedRecordScope',
+                                }),
+                              },
+                            ]
+                          : []),
+                        {
+                          value: '',
+                          label: text({ key: 'settings.noRecordScope' }),
+                        },
+                        ...scope.recordAccess.map((key) => ({
+                          value: key,
+                          label: text(
+                            catalog.recordAccess.find(
+                              (entry) => entry.key === key,
+                            )?.title ?? key,
+                          ),
+                        })),
+                      ],
+                      level: value,
+                    };
+                  })
                 : [],
             };
           }),
@@ -136,6 +160,11 @@ export function setScope(
   value: unknown,
 ): readonly PermissionGrant[] {
   const [type, id, action, scope] = JSON.parse(rowId) as string[];
+  if (
+    typeof value === 'string' &&
+    scopeSelectionKey(getScopeSelection(grants, rowId)) === value
+  )
+    return grants;
   return grants.map((grant) =>
     grant.resource.type !== type || grant.resource.id !== id
       ? grant
@@ -216,7 +245,7 @@ function scopeSelectionKey(value: unknown): string {
     typeof Reflect.get(value, 'key') === 'string'
   )
     return String(Reflect.get(value, 'key'));
-  return '';
+  return value == null || value === '' ? '' : '__preserved_scope__';
 }
 
 /** Legacy bare custom-filter keys require configuration before saving. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nocobase/app-template-default",
   "displayName": "Default Template",
-  "version": "1.0.0-beta.70",
+  "version": "1.0.0-beta.71",
   "type": "module",
   "prettier": "@nocobase/dev-config/prettier",
   "engines": {
@@ -9,7 +9,7 @@
   },
   "nocobase": {
     "templateKind": "app",
-    "defaultTemplateVersion": "1.0.0-beta.70"
+    "defaultTemplateVersion": "1.0.0-beta.71"
   },
   "devDependencies": {
     "@ai-sdk/react": "2.0.0",
@@ -79,13 +79,13 @@
     "elkjs": "^0.10.2",
     "@nocobase/app-client": "^3.0.0-beta.2",
     "@nocobase/app-plugin-template-print": "0.0.2-beta.2",
-    "@nocobase/app-skills": "0.1.0-beta.38",
+    "@nocobase/app-skills": "0.1.0-beta.39",
     "@nocobase/app-testing": "0.1.0-beta.4",
     "@nocobase/app-websocket": "^0.0.2-beta.0",
     "@nocobase/dev-config": "0.1.0-beta.23",
-    "@nocobase/drive": "^0.1.0-beta.6",
-    "@nocobase/session": "^0.1.0-beta.3",
-    "@nocobase/logging": "^0.1.0-beta.7"
+    "@nocobase/drive": "^0.1.0-beta.7",
+    "@nocobase/logging": "^0.1.0-beta.7",
+    "@nocobase/session": "^0.1.0-beta.3"
   },
   "files": [
     ".prettierignore",
@@ -156,7 +156,7 @@
     "@nocobase/app-plugin-notification-providers": "^0.2.0-beta.12",
     "@nocobase/app-plugin-scheduler": "^1.0.0-beta.17",
     "@nocobase/app-plugin-users": "^2.0.0-beta.5",
-    "@nocobase/app-server": "^2.0.0-beta.8",
+    "@nocobase/app-server": "^2.0.0-beta.9",
     "@nocobase/config": "^0.1.0-beta.3",
     "@nocobase/db": "^1.0.0-beta.21",
     "@nocobase/db-sqlite": "^0.1.0-beta.6",

package/tests/components/permission-editor.test.tsx

@@ -475,3 +475,65 @@ it('aligns semantic actions across resources without dropping special or filtere
     view.container.querySelectorAll('[data-slot=permission-row]'),
   ).toHaveLength(1);
 });
+
+it('keeps scope captions consistent in a category with multiple data ranges, including when filtered', async () => {
+  const level = [{ value: 'all', label: 'All records' }];
+  render(
+    <PermissionEditor
+      sections={[
+        {
+          id: 'business',
+          title: 'Business',
+          groups: [
+            {
+              id: 'quotes',
+              title: 'Quotes',
+              rows: [
+                {
+                  id: 'view',
+                  label: 'View quotes',
+                  enabled: true,
+                  scopes: [
+                    {
+                      id: 'view-records',
+                      label: 'Visible quotes',
+                      level: 'all',
+                      levels: level,
+                    },
+                  ],
+                },
+                {
+                  id: 'submit',
+                  label: 'Submit quote',
+                  enabled: true,
+                  scopes: [
+                    {
+                      id: 'submit-projects',
+                      label: 'Linked projects',
+                      level: 'all',
+                      levels: level,
+                    },
+                    {
+                      id: 'submit-quotes',
+                      label: 'Allowed quotes',
+                      level: 'all',
+                      levels: level,
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+        },
+      ]}
+      onEnabledChange={vi.fn()}
+      onLevelChange={vi.fn()}
+    />,
+  );
+  expect(screen.getByText('Visible quotes')).toBeVisible();
+  expect(screen.getByText('Linked projects')).toBeVisible();
+  expect(screen.getByText('Allowed quotes')).toBeVisible();
+  await userEvent.type(screen.getByRole('textbox'), 'View quotes');
+  expect(screen.queryByText('Linked projects')).not.toBeInTheDocument();
+  expect(screen.getByText('Visible quotes')).toBeVisible();
+});

package/tests/logic/page-permission-titles.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest';
 import {
   resolveAppClientContributions,
+  defineAppRoutes,
   type AppClientRegisteredRoute,
 } from '@nocobase/app-client/plugins';
 import applicationRoutes from '../../client/routes.js';
@@ -70,7 +71,7 @@ describe('page permission labels', () => {
       expect(names.has(name), `Stale permission title: ${name}`).toBe(true);
   });
 
-  it('preserves the complete application page-resource identity list', () => {
+  it('preserves each unique application page-resource identity', () => {
     const expected = pages.map((route) => {
       if (typeof route.authz !== 'object')
         throw new Error('Expected page authorization');
@@ -86,7 +87,9 @@ describe('page permission labels', () => {
         id,
         actions: actions.map((action) => action.name),
       })),
-    ).toEqual(expected);
+    ).toEqual([
+      ...new Map(expected.map((resource) => [resource.id, resource])).values(),
+    ]);
   });
 
   const fixture = () =>
@@ -221,3 +224,80 @@ describe('page permission labels', () => {
     ).toEqual([]);
   });
 });
+
+it('lists inherited and repeated page resources once while retaining independent child grants', () => {
+  const input = resolveAppClientContributions([
+    {
+      packageName: 'shared-pages',
+      source: 'application',
+      routes: defineAppRoutes([
+        {
+          name: 'repairs',
+          path: '/repairs',
+          authz: {
+            resource: { type: 'page', id: 'repairs' },
+            action: 'access',
+          },
+          navigation: { title: 'repairs.mine' },
+          componentLoader: async () => ({ default: () => null }),
+          children: [
+            {
+              name: 'repairCreate',
+              path: 'create',
+              componentLoader: async () => ({ default: () => null }),
+            },
+            {
+              name: 'repairDetail',
+              path: ':id',
+              componentLoader: async () => ({ default: () => null }),
+              children: [
+                {
+                  name: 'repairConfirm',
+                  path: 'confirm',
+                  componentLoader: async () => ({ default: () => null }),
+                },
+              ],
+            },
+            {
+              name: 'repairAudit',
+              path: 'audit',
+              authz: {
+                resource: { type: 'page', id: 'repair-audit' },
+                action: 'access',
+              },
+              navigation: { title: 'repairs.audit' },
+              componentLoader: async () => ({ default: () => null }),
+            },
+          ],
+        },
+        {
+          name: 'repairsAlias',
+          path: '/repairs-alias',
+          authz: {
+            resource: { type: 'page', id: 'repairs' },
+            action: 'access',
+          },
+          componentLoader: async () => ({ default: () => null }),
+        },
+      ]),
+    },
+  ]);
+  const before = flatten(input.routes).map(({ id, name, authz }) => ({
+    id,
+    name,
+    authz,
+  }));
+  const result = pagePermissionResources(
+    input.routes,
+    {},
+    (path) => `Unnamed (${path})`,
+  );
+  expect(result.map(({ id }) => id)).toEqual(['repairs', 'repair-audit']);
+  expect(result[0]!.title).toEqual({ key: 'repairs.mine', ns: 'shared-pages' });
+  expect(
+    flatten(input.routes).map(({ id, name, authz }) => ({ id, name, authz })),
+  ).toEqual(before);
+  expect(
+    pagePermissionResources(input.routes, {}, (path) => `Unnamed (${path})`),
+  ).toEqual(result);
+});

package/tests/logic/settings-permissions.test.ts

@@ -166,3 +166,80 @@ it('replaces a raw collection scope caption with localized data-range text', ()
     'Record scope',
   );
 });
+
+it('preserves an existing policy when enabling the same permission again', () => {
+  const original = [
+    {
+      resource: { type: 'composite', id: 'orders' },
+      actions: [
+        {
+          action: 'edit',
+          policy: {
+            type: 'composite',
+            scopes: {
+              records: {
+                type: 'recordAccess',
+                key: 'mine',
+                params: { ownerField: 'assignee' },
+              },
+            },
+            extra: true,
+          },
+        },
+      ],
+    },
+  ];
+  expect(setPermission(original, resource, 'edit', true)).toBe(original);
+  expect(
+    setScope(
+      original,
+      JSON.stringify(['composite', 'orders', 'edit', 'records']),
+      'mine',
+    ),
+  ).toBe(original);
+});
+
+it.each(['retiredScope', { type: 'legacyPolicy', filter: { owner: 'me' } }])(
+  'shows a preserved selection for an unrecognized scope without rewriting it: %j',
+  (value) => {
+    const catalog = {
+      sections: [
+        {
+          name: 'business',
+          title: 'Business',
+          subsections: [
+            { name: 'orders', title: 'Orders', resources: [resource] },
+          ],
+        },
+      ],
+      recordAccess: [
+        { key: 'mine', title: 'Mine' },
+        { key: 'all', title: 'All' },
+      ],
+    } as unknown as Parameters<typeof permissionSections>[0];
+    const original = [
+      {
+        resource: { type: 'composite', id: 'orders' },
+        actions: [
+          {
+            action: 'edit',
+            policy: { type: 'composite', scopes: { records: value } },
+          },
+        ],
+      },
+    ];
+    const before = JSON.stringify(original);
+    const sections = permissionSections(catalog, original, (text) =>
+      typeof text === 'string' ? text : text.key,
+    );
+    const scope = sections[0]!.groups[0]!.rows[0]!.scopes![0]!;
+    expect(
+      scope.levels.find((level) => level.value === scope.level)?.label,
+    ).toBe('settings.preservedRecordScope');
+    expect(setScope(original, scope.id, scope.level!)).toBe(original);
+    expect(JSON.stringify(original)).toBe(before);
+    expect(
+      setScope(original, scope.id, 'all')[0]!.actions[0]!.policy!.scopes,
+    ).toEqual({ records: 'all' });
+  },
+);