@nocobase/app-template-default 1.0.0-beta.75 → 1.0.0-beta.77

package/client/locales/system/settings-en-US.ts

@@ -1,4 +1,25 @@
 const settings = {
+  setup: {
+    title: 'Feature prerequisites',
+    checking: 'Checking current configuration…',
+    checkAgain: 'Check again',
+    ready: 'The checked prerequisites are ready.',
+    missing: 'Review the configuration items below.',
+    manageMembers: 'Manage members',
+    manageMembersFor: 'Manage {{role}} members',
+    unavailable: 'Unable to check right now. Try again.',
+    signIn: 'Your session expired. Sign in again to check configuration.',
+    forbidden:
+      'You do not have access to check this configuration. Contact an administrator.',
+    invalid:
+      'This prerequisite could not be verified. Ask the application maintainer to check its configuration.',
+  },
+  roleFilterIncomplete:
+    'Choose both a role scope and a role, or clear the filters.',
+  backToSource: 'Return to previous page',
+  roleFilter: 'Filter by role',
+  allRoles: 'All roles',
+
   permissionManagement: 'Permission management',
   defaultAccess: {
     noResourcesShort: 'No configurable objects available',
@@ -57,7 +78,7 @@ const settings = {
   scopeExplanation:
     'Each range applies to its corresponding data. The operation must also pass its authorization checks.',
   noAdditionalScopeHint:
-    'This action grants no additional record access here. Default access, sharing and restriction rules still determine actual access.',
+    'This role adds no records. Effective access also depends on other roles and default, sharing and restriction rules.',
   systemToolsHint:
     'Manage system configuration and tools. Review the capabilities each action includes before granting access.',
   userAccountsHint:
@@ -65,7 +86,7 @@ const settings = {
   businessOperationsHint:
     'Choose the operations this role can perform and the data each operation can use.',
   pageAccessHint:
-    'Controls which pages this role can open. Data and actions on each page require their own permissions.',
+    'Choose the business pages this role can open. All system settings, including user management and business configuration, are controlled under Configuration permissions. Data and business actions require separate permissions.',
   roleAssignment: 'Role assignment',
   accountSecurity: 'Account security',
   userInformation: 'User information',
@@ -83,6 +104,11 @@ const settings = {
 
   assignedRoles: 'Assigned roles',
   actionSaved: 'Updated access for "{{name}}"',
+  userActionSaved: {
+    disable: 'Disabled user "{{name}}"',
+    enable: 'Enabled user "{{name}}"',
+    revokeSessions: 'Revoked active sessions for "{{name}}"',
+  },
 
   identityConflict: 'This email or username is already in use.',
   signInAgain: 'Sign in again',
@@ -97,6 +123,7 @@ const settings = {
   userSearch: 'Search names, usernames or emails',
   roleSearch: 'Search role names',
   newUser: 'New user',
+  editUserFor: 'Edit {{name}}',
   editUser: 'Edit user',
   newRole: 'New role',
   editRole: 'Edit role',
@@ -117,9 +144,16 @@ const settings = {
   noResults: 'No matching results',
   clearHint: 'Try a different search or clear the filters.',
   noUsers: 'No users yet',
+  usersReadOnlyEmpty:
+    'Contact an administrator to add users or grant the permissions needed to create users and assign roles.',
+  rolesReadOnlyEmpty:
+    'Contact an administrator to create a role or grant you permission to create roles.',
   noRoles: 'No roles yet',
   create: 'Create',
   edit: 'Edit',
+  selectRoles: 'Select roles',
+  searchRoles: 'Search roles',
+  noRolesFound: 'No roles found.',
   save: 'Save',
   cancel: 'Cancel',
   saving: 'Saving…',
@@ -149,28 +183,41 @@ const settings = {
   discardTitle: 'Discard changes?',
   discardHint: 'Your unsaved changes will be lost.',
   failed: 'Unable to complete the request. Try again.',
+  invalidRequest:
+    'Some values are invalid. Check your input or filters and try again.',
   retry: 'Retry',
   loading: 'Loading',
   denied: 'You do not have access. Contact an administrator.',
   missing: 'This record does not exist or has been deleted.',
   conflict:
-    'This role has changed. Reload it and merge your changes before saving.',
+    'The request conflicts with current data. Review the latest record before trying again.',
   sessionEnded: 'Your session has ended. Sign in again.',
   previous: 'Previous',
   next: 'Next',
   total_one: '{{count}} user',
   total_other: '{{count}} users',
   access: 'Access',
+  expandPermissionGroup: 'Expand {{name}}',
+  collapsePermissionGroup: 'Collapse {{name}}',
+  pagesOutsideNavigation: 'Pages outside navigation',
+  configurationPermissions: 'Configuration permissions',
+  configurationPermissionsHint:
+    'Control access and actions for system settings, user management and business configuration. Only actual application features are shown.',
   permissionSearch: 'Search categories, groups or permissions',
   enabledOnly: 'Enabled only',
   noPermissions: 'No permissions to configure',
+  permissionEmptyHint:
+    'Ask the application developer to expose the permissions this role can configure.',
+  permissionReadOnlyHint: 'These permissions are read-only.',
+  permissionManagedHint: 'This permission is managed by the application.',
+  permissionSaveHint: 'Permission changes take effect after saving.',
   permissionCategories: 'Permission categories',
   selectAllPermissions: 'All',
   dataRanges: 'Data ranges ({{count}})',
   selectVisiblePermissions: 'Select visible permissions in {{name}}',
   permissionSummary: '{{enabled}} of {{total}} enabled',
   preservedRecordScope: 'Keep existing configuration',
-  noRecordScope: 'No additional record access',
+  noRecordScope: 'Use default rules',
   permissionFilter: {
     limit: 'Up to 20 conditions',
     configure: 'Conditions',

package/client/locales/system/settings-zh-CN.ts

@@ -1,4 +1,22 @@
 const settings = {
+  setup: {
+    title: '功能前置配置',
+    checking: '正在检查当前配置…',
+    checkAgain: '重新检查',
+    ready: '已检查的前置配置已就绪。',
+    missing: '请检查以下配置项。',
+    manageMembers: '管理成员',
+    manageMembersFor: '管理{{role}}成员',
+    unavailable: '暂时无法检查，请稍后重试。',
+    signIn: '登录已失效，请重新登录后检查配置。',
+    forbidden: '没有权限检查此配置，请联系管理员。',
+    invalid: '无法确认此前置配置，请应用维护者检查其配置声明。',
+  },
+  roleFilterIncomplete: '请同时指定角色范围与角色，或清除筛选条件。',
+  backToSource: '返回原页面',
+  roleFilter: '按角色筛选',
+  allRoles: '全部角色',
+
   permissionManagement: '权限管理',
   defaultAccess: {
     noResourcesShort: '暂无可配置的业务对象',
@@ -50,14 +68,14 @@ const settings = {
   scopeExplanation:
     '每项范围分别约束对应数据，实际操作还需通过相应的权限检查。',
   noAdditionalScopeHint:
-    '此操作在这里不额外授予数据访问权限，实际可访问范围仍取决于默认数据范围、共享与限制规则。',
+    '此角色不增加记录范围；实际访问还取决于其他角色及默认、共享和限制规则。',
   systemToolsHint: '管理系统配置与工具，授权前请确认每项操作包含的能力。',
   userAccountsHint:
     '管理用户资料、账号安全和角色分配，请逐项确认需要授予的权限。',
   businessOperationsHint:
     '设置此角色可以执行的业务操作，以及每项操作可使用的数据范围。',
   pageAccessHint:
-    '控制此角色可以进入哪些页面。页面中的数据和操作仍需单独授权。',
+    '设置此角色可访问的业务页面。系统设置（包括用户管理、业务配置项）统一在“配置项权限”中控制。页面内的数据和业务操作仍需单独授权。',
   roleAssignment: '角色分配',
   accountSecurity: '账号安全',
   userInformation: '用户资料',
@@ -75,6 +93,11 @@ const settings = {
 
   assignedRoles: '已分配角色',
   actionSaved: '已更新“{{name}}”的访问状态',
+  userActionSaved: {
+    disable: '已禁用用户“{{name}}”',
+    enable: '已启用用户“{{name}}”',
+    revokeSessions: '已撤销“{{name}}”的登录会话',
+  },
 
   identityConflict: '此邮箱或用户名已被使用。',
   signInAgain: '重新登录',
@@ -89,6 +112,7 @@ const settings = {
   userSearch: '搜索姓名、用户名或邮箱',
   roleSearch: '搜索角色名称',
   newUser: '新建用户',
+  editUserFor: '编辑 {{name}}',
   editUser: '编辑用户',
   newRole: '新建角色',
   editRole: '编辑角色',
@@ -109,9 +133,15 @@ const settings = {
   noResults: '没有匹配的结果',
   clearHint: '请更换搜索条件或清除筛选。',
   noUsers: '暂无用户',
+  usersReadOnlyEmpty:
+    '请联系管理员添加用户，或授予创建用户和分配角色所需的权限。',
+  rolesReadOnlyEmpty: '请联系管理员创建角色，或授予你创建角色的权限。',
   noRoles: '暂无角色',
   create: '创建',
   edit: '编辑',
+  selectRoles: '选择角色',
+  searchRoles: '搜索角色',
+  noRolesFound: '没有匹配的角色。',
   save: '保存',
   cancel: '取消',
   saving: '正在保存…',
@@ -139,26 +169,37 @@ const settings = {
   discardTitle: '放弃未保存的更改？',
   discardHint: '未保存的更改将丢失。',
   failed: '请求失败，请重试。',
+  invalidRequest: '部分内容无效，请检查填写内容或筛选条件后重试。',
   retry: '重试',
   loading: '加载中',
-  denied: '无权查看，请联系管理员。',
+  denied: '没有执行此操作的权限，请联系管理员。',
   missing: '记录不存在或已被删除。',
-  conflict: '角色已被其他人修改，请重新加载后合并。',
+  conflict: '此操作与当前数据冲突，请查看最新记录后再试。',
   sessionEnded: '会话已结束，请重新登录。',
   previous: '上一页',
   next: '下一页',
   total_one: '共 {{count}} 位用户',
   total_other: '共 {{count}} 位用户',
   access: '访问',
+  expandPermissionGroup: '展开“{{name}}”',
+  collapsePermissionGroup: '收起“{{name}}”',
+  pagesOutsideNavigation: '未显示在菜单中的页面',
+  configurationPermissions: '配置项权限',
+  configurationPermissionsHint:
+    '统一设置系统设置、用户管理和业务配置项的访问与操作权限，仅显示应用实际开放的功能。',
   permissionSearch: '搜索分类、分组或权限',
   enabledOnly: '仅显示已授权',
   noPermissions: '暂无可配置权限',
+  permissionEmptyHint: '请联系应用开发者，开放此角色需要配置的权限。',
+  permissionReadOnlyHint: '当前权限配置为只读。',
+  permissionManagedHint: '此权限由应用管理。',
+  permissionSaveHint: '权限修改保存后生效。',
   permissionCategories: '权限分类',
   selectAllPermissions: '全选',
   dataRanges: '数据范围（{{count}}）',
   selectVisiblePermissions: '选择“{{name}}”中显示的权限',
   permissionSummary: '已授权 {{enabled}} / {{total}}',
-  noRecordScope: '不额外授权数据范围',
+  noRecordScope: '按默认规则',
   preservedRecordScope: '保留现有配置',
   permissionFilter: {
     limit: '最多支持 20 个条件',

package/client/locales/system/zh-CN.ts

@@ -6,6 +6,16 @@ import inboxZhCN from '#extensions/nocobase-inbox/locales/zh-CN';
 /** The Chinese copy of what the template ships; see `./en-US.ts`. */
 const systemZhCN: SystemResource = {
   flowDiagram: {
+    controls: '流程图控制',
+    fitView: '适应画布',
+    fullscreen: '全屏',
+    exitFullscreen: '退出全屏',
+    escapeHint: '按 Escape 退出',
+    leavesTo: '可转到',
+    arrivesFrom: '来自',
+    otherRoutes: '其他流转',
+    minimap: '流程缩略导航',
+
     configure: '配置',
     overview: '流程缩略导航',
     actualSize: '实际大小',

package/client/pages/settings/default-access-form.tsx

@@ -25,6 +25,7 @@ import { Alert, AlertDescription } from '#components/ui/alert';
 import { SettingsError, SettingsLoading } from './shared.js';
 import { useSettingsData, useSettingsLeave } from './hooks.js';
 import { permissionFilterLabels } from './permission-filters.js';
+import { permissionFilterFieldLabel } from './permission-workspace.js';
 import {
   actionKey,
   resourceKey,
@@ -79,7 +80,10 @@ function DefaultAccessFormBody(): ReactElement {
     draft !== undefined && JSON.stringify(draft) !== JSON.stringify(initial);
   const leave = useSettingsLeave(dirty, busy);
   const close = () => {
-    void navigate({ pathname: '/default-access', search: location.search });
+    void navigate(
+      { pathname: '/default-access', search: location.search },
+      { replace: true },
+    );
   };
   const text = (value: LocalizedText): string =>
     typeof value === 'string'
@@ -174,6 +178,7 @@ function DefaultAccessFormBody(): ReactElement {
       id: scope.id,
       error: scopeErrors[scope.id],
       action: text(scope.actionTitle),
+      actionId: scope.action,
       scope: text(scope.title),
       value: selectedValue,
       options: choices,
@@ -185,7 +190,13 @@ function DefaultAccessFormBody(): ReactElement {
             value={params}
             fields={scope.fields.map((field) => ({
               value: field,
-              label: fieldLabels[field] ?? field,
+              label:
+                fieldLabels[field] ??
+                permissionFilterFieldLabel(
+                  scope.collection,
+                  field,
+                  (key, fallback) => t(key, { defaultValue: fallback ?? key }),
+                ),
             }))}
             labels={labels}
             disabled={readOnly}
@@ -210,6 +221,7 @@ function DefaultAccessFormBody(): ReactElement {
       controls.push({
         id: actionKey(action),
         action: action.action,
+        actionId: action.action,
         scope: action.scopeKey ?? value.resource.id,
         value: JSON.stringify(action.selection),
         options: [

package/client/pages/settings/default-access-model.ts

@@ -3,6 +3,7 @@ import type {
   LocalizedText,
 } from '@nocobase/app-plugin-authorization/client';
 import type { CatalogResource } from './permissions-model.js';
+import { permissionScopeTitle } from './permission-workspace.js';
 
 export type ScopeSelection =
   | { readonly type: 'all' }
@@ -51,7 +52,10 @@ export function ruleResources(
     ...catalog.collections.map((collection) => ({
       type: 'database.collection',
       id: collection.name,
-      title: collection.name,
+      title: permissionScopeTitle(
+        { type: 'database.collection', id: collection.name },
+        { collection: collection.name, title: collection.name },
+      ),
       actions: ['read', 'update', 'delete'].map((name) => ({
         name,
         title: {
@@ -98,7 +102,7 @@ export function ruleScopes(
           action: action.name,
           scopeKey: scope.key,
           actionTitle: action.title,
-          title: scope.title,
+          title: permissionScopeTitle(resource, scope, undefined, action.name),
           collection: scope.collection,
           fields: scope.fields,
           recordAccess: scope.recordAccess,

package/client/pages/settings/default-access.tsx

@@ -1,3 +1,5 @@
+import { RecordLink } from '#components/record-link';
+import { useTableUrlState } from '#hooks/use-table-url-state';
 import { useApiClient, useToaster } from '@nocobase/app-client';
 import {
   useCan,
@@ -119,15 +121,14 @@ export default function DefaultAccessPage(): ReactElement {
         />
       ),
       cell: ({ row }) => (
-        <Link
-          className='text-foreground underline-offset-4 hover:underline'
+        <RecordLink
           to={{
             pathname: `${encodeURIComponent(row.original.key)}/edit`,
             search: location.search,
           }}
         >
           {name(row.original)}
-        </Link>
+        </RecordLink>
       ),
     },
     {
@@ -210,6 +211,29 @@ export default function DefaultAccessPage(): ReactElement {
         .includes(search.toLocaleLowerCase()),
     )
     .sort((a, b) => name(a).localeCompare(name(b), i18n.language));
+  const tableState = useTableUrlState({
+    defaultPageSize: 20,
+    sortColumns: ['resource'],
+    rowCount:
+      rules.data &&
+      !rules.loading &&
+      !rules.error &&
+      catalog.data &&
+      !catalog.loading &&
+      !catalog.error
+        ? rows.length
+        : undefined,
+  });
+  const clearSearch = () =>
+    setParams(
+      (old) => {
+        const next = new URLSearchParams(old);
+        next.delete('q');
+        next.delete('page');
+        return next;
+      },
+      { replace: true },
+    );
   const eligible = resources.some(
     (resource) =>
       !rules.data?.data.some(
@@ -295,13 +319,20 @@ export default function DefaultAccessPage(): ReactElement {
             placeholder={t('settings.defaultAccess.search')}
             aria-label={t('settings.defaultAccess.search')}
             onChange={(event) =>
-              setParams(event.target.value ? { q: event.target.value } : {}, {
-                replace: true,
-              })
+              setParams(
+                (old) => {
+                  const next = new URLSearchParams(old);
+                  next.delete('page');
+                  if (event.target.value) next.set('q', event.target.value);
+                  else next.delete('q');
+                  return next;
+                },
+                { replace: true },
+              )
             }
           />
           {search && (
-            <Button variant='ghost' onClick={() => setParams({})}>
+            <Button variant='ghost' onClick={clearSearch}>
               {t('settings.clear')}
             </Button>
           )}
@@ -329,6 +360,7 @@ export default function DefaultAccessPage(): ReactElement {
           !catalog.error &&
           (rows.length ? (
             <DataTable
+              {...tableState}
               columns={columns}
               data={rows}
               getRowId={(rule) => rule.key}
@@ -358,7 +390,7 @@ export default function DefaultAccessPage(): ReactElement {
               </EmptyDescription>
               <EmptyContent>
                 {search ? (
-                  <Button variant='outline' onClick={() => setParams({})}>
+                  <Button variant='outline' onClick={clearSearch}>
                     {t('settings.clear')}
                   </Button>
                 ) : (

package/client/pages/settings/page-permissions.ts

@@ -1,6 +1,15 @@
 import type { AppClientRegisteredRoute } from '@nocobase/app-client/plugins';
 import type { LocalizedText } from '@nocobase/app-plugin-authorization/client';
-import type { CatalogResource } from './permissions-model.js';
+import { permissionRowId, type CatalogResource } from './permissions-model.js';
+import type {
+  PermissionEditorNavigationNode,
+  PermissionEditorSection,
+  PermissionEditorGroup,
+} from '#components/permission-editor';
+import {
+  buildRouteNavigation,
+  type RouteNavigationItem,
+} from '../../routing/route-navigation.js';
 
 /** Application route names are stable within their owner; labels never change stored grants. */
 export type PagePermissionTitles = Readonly<Record<string, string>>;
@@ -49,3 +58,159 @@ export function pagePermissionResources(
   visit(routes);
   return [...resources.values()];
 }
+
+/** Resource ownership follows the application's real settings branch, not translated labels or URL guesses. */
+function configurationResources(
+  routes: readonly AppClientRegisteredRoute[],
+): ReadonlySet<string> {
+  const resources = new Set<string>();
+  const visit = (
+    items: readonly AppClientRegisteredRoute[],
+    inSettings = false,
+  ): void => {
+    for (const route of items) {
+      const settings =
+        inSettings ||
+        (route.source === 'application' &&
+          ['settings', 'systemManagement'].includes(route.name));
+      if (
+        settings &&
+        route.componentLoader &&
+        typeof route.authz === 'object'
+      ) {
+        resources.add(
+          JSON.stringify([route.authz.resource.type, route.authz.resource.id]),
+        );
+      }
+      visit(route.children ?? [], settings);
+    }
+  };
+  visit(routes);
+  return resources;
+}
+
+/** The business page tree excludes system settings, whose original grants are configured in their own category. */
+export function pagePermissionNavigation(
+  routes: readonly AppClientRegisteredRoute[],
+  titles: PagePermissionTitles,
+  unnamed: (path: string) => string,
+  text: (value: LocalizedText) => string,
+): readonly PermissionEditorNavigationNode[] {
+  const configuration = configurationResources(routes);
+  const pages = pagePermissionResources(routes, titles, unnamed).filter(
+    ({ type, id }) => !configuration.has(JSON.stringify([type, id])),
+  );
+  const resources = new Map(pages.map((page) => [page.id, page]));
+  const seen = new Set<string>();
+  const visit = (
+    items: readonly RouteNavigationItem[],
+  ): PermissionEditorNavigationNode[] =>
+    items.flatMap(({ route, children }) => {
+      const resource =
+        route.componentLoader &&
+        typeof route.authz === 'object' &&
+        route.authz.resource.type === 'page'
+          ? resources.get(route.authz.resource.id)
+          : undefined;
+      const rowId =
+        resource && !seen.has(resource.id)
+          ? permissionRowId(resource, 'access')
+          : undefined;
+      if (rowId && resource) seen.add(resource.id);
+      const descendants = visit(children);
+      if (!rowId && !descendants.length) return [];
+      return [
+        {
+          id: `menu:${route.packageName}:${route.id}:${route.path}`,
+          label: text(
+            rowId && resource
+              ? resource.title
+              : route.navigation?.title
+                ? { key: route.navigation.title, ns: route.packageName }
+                : unnamed(route.path),
+          ),
+          rowId,
+          children: descendants,
+        },
+      ];
+    });
+  // Author the catalog from the complete menu, not the signed-in editor's filtered navigation.
+  const navigation = visit(buildRouteNavigation(routes, new Set()));
+  const outside = pages
+    .filter((page) => !seen.has(page.id))
+    .map((page) => ({
+      id: `page:${page.id}`,
+      label: text(page.title),
+      rowId: permissionRowId(page, 'access'),
+    }));
+  return [
+    ...navigation,
+    ...(outside.length
+      ? [
+          {
+            id: 'pages:outside-navigation',
+            label: text({ key: 'settings.pagesOutsideNavigation' }),
+            children: outside,
+          },
+        ]
+      : []),
+  ];
+}
+
+/** Reclassify existing controls only: system settings never create a second page-access permission. */
+export function permissionNavigationSections(
+  sections: readonly PermissionEditorSection[],
+  routes: readonly AppClientRegisteredRoute[],
+  titles: PagePermissionTitles,
+  unnamed: (path: string) => string,
+  text: (value: LocalizedText) => string,
+): readonly PermissionEditorSection[] {
+  const configuration = configurationResources(routes);
+  const moved: PermissionEditorGroup[] = [];
+  const result = sections
+    .map((section) => {
+      if (section.id === 'configuration') return section;
+      const groups = section.groups.flatMap((group) => {
+        const belongs = (row: (typeof group.rows)[number]): boolean => {
+          const [type, id] = JSON.parse(row.id) as string[];
+          return configuration.has(JSON.stringify([type, id]));
+        };
+        const settingsRows = group.rows.filter(belongs);
+        if (settingsRows.length) moved.push({ ...group, rows: settingsRows });
+        const rows = group.rows.filter((row) => !belongs(row));
+        return rows.length ? [{ ...group, rows }] : [];
+      });
+      return {
+        ...section,
+        groups,
+        ...(section.id === 'pages'
+          ? {
+              navigation: pagePermissionNavigation(
+                routes,
+                titles,
+                unnamed,
+                text,
+              ),
+            }
+          : {}),
+      };
+    })
+    .filter((section) => section.groups.length);
+  if (!moved.length) return result;
+  const target = result.find((section) => section.id === 'configuration');
+  return target
+    ? result.map((section) =>
+        section === target
+          ? { ...section, groups: [...section.groups, ...moved] }
+          : section,
+      )
+    : [
+        ...result,
+        {
+          id: 'configuration',
+          title: text({ key: 'settings.configurationPermissions' }),
+          description: text({ key: 'settings.configurationPermissionsHint' }),
+          groups: moved,
+        },
+      ];
+}

package/client/pages/settings/permission-filters.tsx

@@ -8,6 +8,7 @@ import type {
   AuthorizationOptionsResponse,
 } from '@nocobase/app-plugin-authorization/client';
 import { getScopeSelection } from './permissions-model.js';
+import { permissionFilterFieldLabel } from './permission-workspace.js';
 
 export function configurePermissionScopes(
   sections: readonly PermissionEditorSection[],
@@ -39,7 +40,9 @@ export function configurePermissionScopes(
             const definition = resources
               .find(
                 (resource) =>
-                  resource.type === type && resource.id === resourceId,
+                  resource.type === type &&
+                  resource.id === resourceId &&
+                  resource.actions.some((item) => item.name === action),
               )
               ?.dataScopes?.[action ?? '']?.find((item) => item.key === key);
             const value = getScopeSelection(grants, scope.id);
@@ -62,7 +65,11 @@ export function configurePermissionScopes(
                   value={filter}
                   fields={(definition?.fields ?? []).map((field) => ({
                     value: field,
-                    label: text(`settings.permissionFields.${field}`, field),
+                    label: permissionFilterFieldLabel(
+                      definition?.collection ?? '',
+                      field,
+                      text,
+                    ),
                   }))}
                   labels={labels}
                   disabled={disabled}