From bd477641004694e21f81e8328414e13e03ee6e0e Mon Sep 17 00:00:00 2001
From: Duncan McClean <duncan@duncanmcclean.com>
Date: Wed, 8 Jul 2026 12:08:14 +0100
Subject: [PATCH 01/13] Add superseding permissions concept

Permissions can declare a broader permission that supersedes them. The
roles UI hides superseded permissions while the superseder is checked.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../js/components/roles/PermissionTree.vue    | 13 +++++-
 resources/js/components/roles/PublishForm.vue |  7 +++
 src/Auth/Permission.php                       | 10 ++++-
 tests/Permissions/PermissionTest.php          | 43 +++++++++++++++++++
 tests/Permissions/PermissionsTest.php         | 13 ++++++
 5 files changed, 84 insertions(+), 2 deletions(-)

diff --git a/resources/js/components/roles/PermissionTree.vue b/resources/js/components/roles/PermissionTree.vue
index a25fbe8b014..1bff79de863 100644
--- a/resources/js/components/roles/PermissionTree.vue
+++ b/resources/js/components/roles/PermissionTree.vue
@@ -1,6 +1,6 @@
 <template>
     <div :style="`padding-inline-start: ${12 * depth - 12}px`">
-        <template v-for="permission in permissions" :key="permission.value">
+        <template v-for="permission in visiblePermissions" :key="permission.value">
             <ui-checkbox
                 :class="[
                     permission.description
@@ -30,12 +30,23 @@ export default {
         depth: Number,
     },
 
+    inject: ['checkedPermissionValues'],
+
     data() {
         return {
             permissions: this.initialPermissions,
         };
     },
 
+    computed: {
+        visiblePermissions() {
+            return this.permissions.filter(
+                (permission) =>
+                    !permission.superseded_by || !this.checkedPermissionValues.includes(permission.superseded_by)
+            );
+        },
+    },
+
     watch: {
         initialPermissions: {
             handler(newPermissions) {
diff --git a/resources/js/components/roles/PublishForm.vue b/resources/js/components/roles/PublishForm.vue
index 6b7098ed7dc..94f5b744e07 100644
--- a/resources/js/components/roles/PublishForm.vue
+++ b/resources/js/components/roles/PublishForm.vue
@@ -75,6 +75,7 @@
 </template>
 
 <script>
+import { computed } from 'vue';
 import { Header, Button, Panel, PanelHeader, Heading, Card, Switch, Field, Input, CommandPaletteItem } from '@/components/ui';
 import { requireElevatedSession } from '@/components/elevated-sessions';
 import PermissionTree from '@/components/roles/PermissionTree.vue';
@@ -102,6 +103,12 @@ export default {
         CommandPaletteItem,
     },
 
+    provide() {
+        return {
+            checkedPermissionValues: computed(() => this.checkedPermissions),
+        };
+    },
+
     props: {
         initialTitle: String,
         initialHandle: String,
diff --git a/src/Auth/Permission.php b/src/Auth/Permission.php
index 0a91de22cab..4df49ce58f1 100644
--- a/src/Auth/Permission.php
+++ b/src/Auth/Permission.php
@@ -19,6 +19,7 @@ class Permission
     protected $label;
     protected $description;
     protected $group;
+    protected $supersededBy;
 
     /**
      * @return ($value is null ? string|string[] : static)
@@ -103,7 +104,8 @@ public function permissions()
                 ->placeholder($this->placeholder)
                 ->placeholderLabel($replacement['label'])
                 ->placeholderValue($replacement['value'])
-                ->group($this->group());
+                ->group($this->group())
+                ->supersededBy($this->supersededBy());
 
             if ($this->children()) {
                 $replaced->children($this->children()->all());
@@ -205,6 +207,7 @@ public function toTree()
                 'label' => $permission->label(),
                 'description' => $permission->description(),
                 'group' => $permission->group(),
+                'superseded_by' => $permission->supersededBy(),
                 'children' => $children->flatMap->toTree()->all(),
             ];
         })->all();
@@ -219,4 +222,9 @@ public function description()
     {
         return $this->fluentlyGetOrSet('description')->args(func_get_args());
     }
+
+    public function supersededBy(?string $permission = null)
+    {
+        return $this->fluentlyGetOrSet('supersededBy')->args(func_get_args());
+    }
 }
diff --git a/tests/Permissions/PermissionTest.php b/tests/Permissions/PermissionTest.php
index daa1aec1168..2fb35136569 100644
--- a/tests/Permissions/PermissionTest.php
+++ b/tests/Permissions/PermissionTest.php
@@ -20,6 +20,7 @@ public function it_makes_a_tree()
                 'label' => 'one',
                 'description' => null,
                 'group' => null,
+                'superseded_by' => null,
                 'children' => [],
             ],
         ], $permission->toTree());
@@ -42,12 +43,14 @@ public function it_makes_tree_with_children()
                 'label' => 'parent',
                 'description' => null,
                 'group' => 'foo',
+                'superseded_by' => null,
                 'children' => [
                     [
                         'value' => 'child',
                         'label' => 'Child!',
                         'description' => null,
                         'group' => 'foo',
+                        'superseded_by' => null,
                         'children' => [],
                     ],
                 ],
@@ -135,6 +138,38 @@ public function it_adds_a_group()
         $this->assertEquals('the-group', $permission->toTree()[0]['group']);
     }
 
+    #[Test]
+    public function it_adds_a_superseding_permission()
+    {
+        $permission = (new Permission)->value('test');
+        $this->assertNull($permission->supersededBy());
+        $this->assertNull($permission->toTree()[0]['superseded_by']);
+
+        $return = $permission->supersededBy('other');
+
+        $this->assertEquals($permission, $return);
+        $this->assertEquals('other', $permission->supersededBy());
+        $this->assertEquals('other', $permission->toTree()[0]['superseded_by']);
+    }
+
+    #[Test]
+    public function it_keeps_the_superseding_permission_when_replacements_are_defined()
+    {
+        $permission = (new Permission)
+            ->value('edit {handle} form')
+            ->supersededBy('edit forms')
+            ->replacements('handle', function () {
+                return [
+                    ['value' => 'first', 'label' => 'FIRST'],
+                    ['value' => 'second', 'label' => 'SECOND'],
+                ];
+            });
+
+        $this->assertEquals(['edit forms', 'edit forms'], $permission->permissions()->map->supersededBy()->all());
+        $this->assertEquals('edit forms', $permission->toTree()[0]['superseded_by']);
+        $this->assertEquals('edit forms', $permission->toTree()[1]['superseded_by']);
+    }
+
     #[Test]
     public function it_gets_its_permissions_when_replacements_are_not_defined()
     {
@@ -217,18 +252,21 @@ public function it_combines_replacements_and_children()
                 'label' => 'view FIRST entries',
                 'description' => null,
                 'group' => 'test-group',
+                'superseded_by' => null,
                 'children' => [
                     [
                         'value' => 'edit first entries',
                         'label' => 'edit FIRST entries',
                         'description' => null,
                         'group' => 'test-group',
+                        'superseded_by' => null,
                         'children' => [
                             [
                                 'value' => 'delete first entries',
                                 'label' => 'delete FIRST entries',
                                 'description' => null,
                                 'group' => 'test-group',
+                                'superseded_by' => null,
                                 'children' => [],
                             ],
                         ],
@@ -238,6 +276,7 @@ public function it_combines_replacements_and_children()
                         'label' => 'publish FIRST entries',
                         'description' => null,
                         'group' => 'test-group',
+                        'superseded_by' => null,
                         'children' => [],
                     ],
                 ],
@@ -247,18 +286,21 @@ public function it_combines_replacements_and_children()
                 'label' => 'view SECOND entries',
                 'description' => null,
                 'group' => 'test-group',
+                'superseded_by' => null,
                 'children' => [
                     [
                         'value' => 'edit second entries',
                         'label' => 'edit SECOND entries',
                         'description' => null,
                         'group' => 'test-group',
+                        'superseded_by' => null,
                         'children' => [
                             [
                                 'value' => 'delete second entries',
                                 'label' => 'delete SECOND entries',
                                 'description' => null,
                                 'group' => 'test-group',
+                                'superseded_by' => null,
                                 'children' => [],
                             ],
                         ],
@@ -268,6 +310,7 @@ public function it_combines_replacements_and_children()
                         'label' => 'publish SECOND entries',
                         'description' => null,
                         'group' => 'test-group',
+                        'superseded_by' => null,
                         'children' => [],
                     ],
                 ],
diff --git a/tests/Permissions/PermissionsTest.php b/tests/Permissions/PermissionsTest.php
index e396e78b2f3..2e95def07ee 100644
--- a/tests/Permissions/PermissionsTest.php
+++ b/tests/Permissions/PermissionsTest.php
@@ -171,18 +171,21 @@ public function it_makes_a_tree()
                         'label' => 'two',
                         'description' => null,
                         'group' => 'test',
+                        'superseded_by' => null,
                         'children' => [
                             [
                                 'value' => 'child-three',
                                 'label' => 'child-three',
                                 'description' => null,
                                 'group' => 'test',
+                                'superseded_by' => null,
                                 'children' => [
                                     [
                                         'value' => 'nested-child',
                                         'label' => 'nested-child',
                                         'description' => null,
                                         'group' => 'test',
+                                        'superseded_by' => null,
                                         'children' => [],
                                     ],
                                 ],
@@ -200,18 +203,21 @@ public function it_makes_a_tree()
                         'label' => 'four FIRST',
                         'description' => null,
                         'group' => 'group-with-replacements',
+                        'superseded_by' => null,
                         'children' => [
                             [
                                 'value' => 'replaced child first',
                                 'label' => 'Replaced FIRST',
                                 'description' => null,
                                 'group' => 'group-with-replacements',
+                                'superseded_by' => null,
                                 'children' => [
                                     [
                                         'value' => 'replaced nested child first',
                                         'label' => 'Replaced Nested FIRST',
                                         'description' => null,
                                         'group' => 'group-with-replacements',
+                                        'superseded_by' => null,
                                         'children' => [],
                                     ],
                                 ],
@@ -223,18 +229,21 @@ public function it_makes_a_tree()
                         'label' => 'four SECOND',
                         'description' => null,
                         'group' => 'group-with-replacements',
+                        'superseded_by' => null,
                         'children' => [
                             [
                                 'value' => 'replaced child second',
                                 'label' => 'Replaced SECOND',
                                 'description' => null,
                                 'group' => 'group-with-replacements',
+                                'superseded_by' => null,
                                 'children' => [
                                     [
                                         'value' => 'replaced nested child second',
                                         'label' => 'Replaced Nested SECOND',
                                         'description' => null,
                                         'group' => 'group-with-replacements',
+                                        'superseded_by' => null,
                                         'children' => [],
                                     ],
                                 ],
@@ -252,12 +261,14 @@ public function it_makes_a_tree()
                         'label' => 'one',
                         'description' => null,
                         'group' => null,
+                        'superseded_by' => null,
                         'children' => [
                             [
                                 'value' => 'child-one',
                                 'label' => 'child-one',
                                 'description' => null,
                                 'group' => null,
+                                'superseded_by' => null,
                                 'children' => [],
                             ],
                             [
@@ -265,6 +276,7 @@ public function it_makes_a_tree()
                                 'label' => 'child-two',
                                 'description' => null,
                                 'group' => null,
+                                'superseded_by' => null,
                                 'children' => [],
                             ],
                         ],
@@ -274,6 +286,7 @@ public function it_makes_a_tree()
                         'label' => 'three',
                         'description' => null,
                         'group' => null,
+                        'superseded_by' => null,
                         'children' => [],
                     ],
                 ],

From cbcbf1cb16dae89c0c416465127324ab093079bd Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 9 Jul 2026 14:05:23 -0400
Subject: [PATCH 02/13] Test the superseding permission filter in the roles UI

Covers hiding a superseded permission (and its children) once the
superseding permission is checked, and leaving it visible otherwise.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../components/roles/PermissionTree.test.js   | 79 +++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 resources/js/tests/components/roles/PermissionTree.test.js

diff --git a/resources/js/tests/components/roles/PermissionTree.test.js b/resources/js/tests/components/roles/PermissionTree.test.js
new file mode 100644
index 00000000000..37deaeeda80
--- /dev/null
+++ b/resources/js/tests/components/roles/PermissionTree.test.js
@@ -0,0 +1,79 @@
+import { mount } from '@vue/test-utils';
+import { expect, test } from 'vitest';
+import { ref } from 'vue';
+import PermissionTree from '@/components/roles/PermissionTree.vue';
+
+const permission = (value, overrides = {}) => ({
+    value,
+    label: value,
+    description: null,
+    superseded_by: null,
+    checked: false,
+    children: [],
+    ...overrides,
+});
+
+const mountTree = (permissions, checkedPermissionValues = []) =>
+    mount(PermissionTree, {
+        props: { depth: 1, initialPermissions: permissions },
+        global: {
+            provide: { checkedPermissionValues: ref(checkedPermissionValues) },
+            stubs: {
+                'ui-checkbox': {
+                    props: ['value'],
+                    template: '<div class="permission">{{ value }}</div>',
+                },
+            },
+        },
+    });
+
+const renderedPermissions = (wrapper) => wrapper.findAll('.permission').map((el) => el.text());
+
+test('it shows superseded permissions when the superseding permission is unchecked', () => {
+    const wrapper = mountTree([
+        permission('configure asset containers'),
+        permission('view images assets', { superseded_by: 'configure asset containers' }),
+    ]);
+
+    expect(renderedPermissions(wrapper)).toEqual(['configure asset containers', 'view images assets']);
+});
+
+test('it hides superseded permissions when the superseding permission is checked', () => {
+    const wrapper = mountTree(
+        [
+            permission('configure asset containers', { checked: true }),
+            permission('view images assets', { superseded_by: 'configure asset containers' }),
+        ],
+        ['configure asset containers'],
+    );
+
+    expect(renderedPermissions(wrapper)).toEqual(['configure asset containers']);
+});
+
+test('it hides the children of a superseded permission', () => {
+    const wrapper = mountTree(
+        [
+            permission('configure asset containers', { checked: true }),
+            permission('view images assets', {
+                superseded_by: 'configure asset containers',
+                children: [permission('delete images assets')],
+            }),
+        ],
+        ['configure asset containers'],
+    );
+
+    expect(renderedPermissions(wrapper)).toEqual(['configure asset containers']);
+});
+
+test('it only hides permissions superseded by a checked permission', () => {
+    const wrapper = mountTree(
+        [
+            permission('configure asset containers', { checked: true }),
+            permission('view images assets', { superseded_by: 'configure asset containers' }),
+            permission('view blog entries', { superseded_by: 'configure collections' }),
+        ],
+        ['configure asset containers'],
+    );
+
+    expect(renderedPermissions(wrapper)).toEqual(['configure asset containers', 'view blog entries']);
+});

From c1663b39421f88d643d87da3fe61b7bc20063ed0 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 9 Jul 2026 14:05:28 -0400
Subject: [PATCH 03/13] Use the entry policy to determine the publish state
 ability

When creating an entry, the ability was resolved from the raw
"publish {collection} entries" permission, which sidesteps the policy.
Users able to configure collections were denied the publish state
toggle, despite the policy granting them everything.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../CP/Collections/EntriesController.php      |  2 +-
 tests/Feature/Entries/CreateEntryTest.php     | 42 +++++++++++++++++++
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/src/Http/Controllers/CP/Collections/EntriesController.php b/src/Http/Controllers/CP/Collections/EntriesController.php
index a2392a4d0f9..acd8b573d60 100644
--- a/src/Http/Controllers/CP/Collections/EntriesController.php
+++ b/src/Http/Controllers/CP/Collections/EntriesController.php
@@ -347,7 +347,7 @@ public function create(Request $request, $collection, $site)
                 ];
             })->values()->all(),
             'revisionsEnabled' => $collection->revisionsEnabled(),
-            'canManagePublishState' => User::current()->can('publish '.$collection->handle().' entries'),
+            'canManagePublishState' => User::current()->can('publish', [EntryContract::class, $collection]),
             'previewTargets' => $collection->previewTargets()->all(),
             'autosaveInterval' => $collection->autosaveInterval(),
             'parent' => $collection->hasStructure() ? $request->parent : null,
diff --git a/tests/Feature/Entries/CreateEntryTest.php b/tests/Feature/Entries/CreateEntryTest.php
index ef8245ae536..ff3db43b69b 100644
--- a/tests/Feature/Entries/CreateEntryTest.php
+++ b/tests/Feature/Entries/CreateEntryTest.php
@@ -47,4 +47,46 @@ public function it_populates_the_form_from_query_string()
                 ->where('values.title', 'Foo Bar')
             );
     }
+
+    #[Test]
+    public function the_publish_state_cannot_be_managed_without_permission()
+    {
+        $this->setTestRoles(['test' => ['access cp', 'create test entries']]);
+        $user = tap(User::make()->assignRole('test'))->save();
+        Collection::make('test')->save();
+
+        $this
+            ->actingAs($user)
+            ->get(cp_route('collections.entries.create', ['test', 'en']))
+            ->assertOk()
+            ->assertInertia(fn ($page) => $page->where('canManagePublishState', false));
+    }
+
+    #[Test]
+    public function the_publish_state_can_be_managed_with_the_publish_permission()
+    {
+        $this->setTestRoles(['test' => ['access cp', 'create test entries', 'publish test entries']]);
+        $user = tap(User::make()->assignRole('test'))->save();
+        Collection::make('test')->save();
+
+        $this
+            ->actingAs($user)
+            ->get(cp_route('collections.entries.create', ['test', 'en']))
+            ->assertOk()
+            ->assertInertia(fn ($page) => $page->where('canManagePublishState', true));
+    }
+
+    #[Test]
+    public function the_publish_state_can_be_managed_when_able_to_configure_collections()
+    {
+        $this->setTestRoles(['test' => ['access cp', 'configure collections']]);
+        $user = tap(User::make()->assignRole('test'))->save();
+        Collection::make('test')->save();
+
+        $this
+            ->actingAs($user)
+            ->get(cp_route('collections.entries.create', ['test', 'en']))
+            ->assertOk()
+            ->assertInertia(fn ($page) => $page->where('canManagePublishState', true));
+    }
 }

From 3d0370599d957217a2b04cd83aae53d36b30d4ec Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 9 Jul 2026 14:05:32 -0400
Subject: [PATCH 04/13] Supersede per-item permissions with their configure
 permissions

The configure permissions already grant every ability their policies
guard, so the per-item permissions they cover no longer need to be
shown in the roles UI alongside them.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/Auth/CorePermissions.php              | 15 +++----
 tests/Permissions/CorePermissionsTest.php | 48 +++++++++++++++++++++++
 2 files changed, 56 insertions(+), 7 deletions(-)
 create mode 100644 tests/Permissions/CorePermissionsTest.php

diff --git a/src/Auth/CorePermissions.php b/src/Auth/CorePermissions.php
index d0d3eeb125d..d0a99ad742f 100644
--- a/src/Auth/CorePermissions.php
+++ b/src/Auth/CorePermissions.php
@@ -95,7 +95,7 @@ protected function registerCollections()
         $this->register('configure collections');
 
         $this->register('view {collection} entries', function ($permission) {
-            $this->permission($permission)->children([
+            $this->permission($permission)->supersededBy('configure collections')->children([
                 $this->permission('edit {collection} entries')->children([
                     $this->permission('create {collection} entries'),
                     $this->permission('delete {collection} entries'),
@@ -119,7 +119,7 @@ protected function registerNavigation()
         $this->register('configure navs');
 
         $this->register('view {nav} nav', function ($permission) {
-            $this->permission($permission)->children([
+            $this->permission($permission)->supersededBy('configure navs')->children([
                 $this->permission('edit {nav} nav'),
             ])->replacements('nav', function () {
                 return Nav::all()->map(function ($nav) {
@@ -134,7 +134,7 @@ protected function registerGlobals()
         $this->register('configure globals');
 
         $this->register('edit {global} globals', function ($permission) {
-            $permission->replacements('global', function () {
+            $permission->supersededBy('configure globals')->replacements('global', function () {
                 return GlobalSet::all()->map(function ($global) {
                     return ['value' => $global->handle(), 'label' => __($global->title())];
                 });
@@ -147,7 +147,7 @@ protected function registerTaxonomies()
         $this->register('configure taxonomies');
 
         $this->register('view {taxonomy} terms', function ($permission) {
-            $this->permission($permission)->children([
+            $this->permission($permission)->supersededBy('configure taxonomies')->children([
                 $this->permission('edit {taxonomy} terms')->children([
                     $this->permission('create {taxonomy} terms'),
                     $this->permission('delete {taxonomy} terms'),
@@ -165,7 +165,7 @@ protected function registerAssets()
         $this->register('configure asset containers');
 
         $this->register('view {container} assets', function ($permission) {
-            $this->permission($permission)->children([
+            $this->permission($permission)->supersededBy('configure asset containers')->children([
                 $this->permission('upload {container} assets'),
                 $this->permission('edit {container} folders'),
                 $this->permission('edit {container} assets')->children([
@@ -210,7 +210,7 @@ protected function registerForms()
         $this->register('configure forms');
 
         $this->register('view {form} form submissions', function ($permission) {
-            $this->permission($permission)->children([
+            $this->permission($permission)->supersededBy('configure forms')->children([
                 $this->permission('delete {form} form submissions'),
             ])->replacements('form', function () {
                 return Form::all()->map(function ($form) {
@@ -229,7 +229,8 @@ protected function registerAddons()
             ->each(function ($addon) {
                 Permission::register("edit {$addon->package()} settings", function ($permission) use ($addon) {
                     return $permission
-                        ->label(__('statamic::permissions.edit_addon_settings', ['addon' => __($addon->name())]));
+                        ->label(__('statamic::permissions.edit_addon_settings', ['addon' => __($addon->name())]))
+                        ->supersededBy('configure addons');
                 });
             });
     }
diff --git a/tests/Permissions/CorePermissionsTest.php b/tests/Permissions/CorePermissionsTest.php
new file mode 100644
index 00000000000..ccbba433bef
--- /dev/null
+++ b/tests/Permissions/CorePermissionsTest.php
@@ -0,0 +1,48 @@
+<?php
+
+namespace Tests\Permissions;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\Attributes\Test;
+use Statamic\Facades\Permission;
+use Tests\TestCase;
+
+class CorePermissionsTest extends TestCase
+{
+    public static function supersededPermissionProvider()
+    {
+        return [
+            'entries' => ['view {collection} entries', 'configure collections'],
+            'navs' => ['view {nav} nav', 'configure navs'],
+            'globals' => ['edit {global} globals', 'configure globals'],
+            'terms' => ['view {taxonomy} terms', 'configure taxonomies'],
+            'assets' => ['view {container} assets', 'configure asset containers'],
+            'form submissions' => ['view {form} form submissions', 'configure forms'],
+        ];
+    }
+
+    #[Test]
+    #[DataProvider('supersededPermissionProvider')]
+    public function configure_permissions_supersede_their_per_item_permissions($permission, $superseder)
+    {
+        $this->assertEquals($superseder, Permission::boot()->get($permission)->supersededBy());
+    }
+
+    #[Test]
+    public function child_permissions_are_not_superseded_since_their_parents_are()
+    {
+        $this->assertNull(Permission::boot()->get('edit {collection} entries')->supersededBy());
+        $this->assertNull(Permission::boot()->get('delete {container} assets')->supersededBy());
+    }
+
+    #[Test]
+    public function site_access_is_not_superseded_by_configuring_sites()
+    {
+        $this->setSites([
+            'en' => ['url' => '/', 'locale' => 'en_US', 'name' => 'English'],
+            'fr' => ['url' => '/fr/', 'locale' => 'fr_FR', 'name' => 'French'],
+        ]);
+
+        $this->assertNull(Permission::boot()->get('access {site} site')->supersededBy());
+    }
+}

From a8c56d1490bd7b84908f71bb7929985ea514ba8c Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 9 Jul 2026 14:29:39 -0400
Subject: [PATCH 05/13] Rename supersededBy to hiddenBy and accept multiple
 permissions

The hiding is purely visual, so name it for what it does rather than
implying the hidden permission has been replaced. A permission may now
be hidden by any one of several permissions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../js/components/roles/PermissionTree.vue    |  3 +-
 .../components/roles/PermissionTree.test.js   | 41 ++++++++++----
 src/Auth/CorePermissions.php                  | 14 ++---
 src/Auth/Permission.php                       | 15 +++--
 tests/Permissions/CorePermissionsTest.php     | 18 +++---
 tests/Permissions/PermissionTest.php          | 55 +++++++++++--------
 tests/Permissions/PermissionsTest.php         | 26 ++++-----
 7 files changed, 104 insertions(+), 68 deletions(-)

diff --git a/resources/js/components/roles/PermissionTree.vue b/resources/js/components/roles/PermissionTree.vue
index 1bff79de863..060a135b645 100644
--- a/resources/js/components/roles/PermissionTree.vue
+++ b/resources/js/components/roles/PermissionTree.vue
@@ -41,8 +41,7 @@ export default {
     computed: {
         visiblePermissions() {
             return this.permissions.filter(
-                (permission) =>
-                    !permission.superseded_by || !this.checkedPermissionValues.includes(permission.superseded_by)
+                (permission) => !permission.hidden_by.some((value) => this.checkedPermissionValues.includes(value))
             );
         },
     },
diff --git a/resources/js/tests/components/roles/PermissionTree.test.js b/resources/js/tests/components/roles/PermissionTree.test.js
index 37deaeeda80..24cbe2158b5 100644
--- a/resources/js/tests/components/roles/PermissionTree.test.js
+++ b/resources/js/tests/components/roles/PermissionTree.test.js
@@ -7,8 +7,8 @@ const permission = (value, overrides = {}) => ({
     value,
     label: value,
     description: null,
-    superseded_by: null,
     checked: false,
+    hidden_by: [],
     children: [],
     ...overrides,
 });
@@ -29,20 +29,20 @@ const mountTree = (permissions, checkedPermissionValues = []) =>
 
 const renderedPermissions = (wrapper) => wrapper.findAll('.permission').map((el) => el.text());
 
-test('it shows superseded permissions when the superseding permission is unchecked', () => {
+test('it shows a permission when the permission hiding it is unchecked', () => {
     const wrapper = mountTree([
         permission('configure asset containers'),
-        permission('view images assets', { superseded_by: 'configure asset containers' }),
+        permission('view images assets', { hidden_by: ['configure asset containers'] }),
     ]);
 
     expect(renderedPermissions(wrapper)).toEqual(['configure asset containers', 'view images assets']);
 });
 
-test('it hides superseded permissions when the superseding permission is checked', () => {
+test('it hides a permission when the permission hiding it is checked', () => {
     const wrapper = mountTree(
         [
             permission('configure asset containers', { checked: true }),
-            permission('view images assets', { superseded_by: 'configure asset containers' }),
+            permission('view images assets', { hidden_by: ['configure asset containers'] }),
         ],
         ['configure asset containers'],
     );
@@ -50,12 +50,12 @@ test('it hides superseded permissions when the superseding permission is checked
     expect(renderedPermissions(wrapper)).toEqual(['configure asset containers']);
 });
 
-test('it hides the children of a superseded permission', () => {
+test('it hides the children of a hidden permission', () => {
     const wrapper = mountTree(
         [
             permission('configure asset containers', { checked: true }),
             permission('view images assets', {
-                superseded_by: 'configure asset containers',
+                hidden_by: ['configure asset containers'],
                 children: [permission('delete images assets')],
             }),
         ],
@@ -65,15 +65,36 @@ test('it hides the children of a superseded permission', () => {
     expect(renderedPermissions(wrapper)).toEqual(['configure asset containers']);
 });
 
-test('it only hides permissions superseded by a checked permission', () => {
+test('it only hides permissions hidden by a checked permission', () => {
     const wrapper = mountTree(
         [
             permission('configure asset containers', { checked: true }),
-            permission('view images assets', { superseded_by: 'configure asset containers' }),
-            permission('view blog entries', { superseded_by: 'configure collections' }),
+            permission('view images assets', { hidden_by: ['configure asset containers'] }),
+            permission('view blog entries', { hidden_by: ['configure collections'] }),
         ],
         ['configure asset containers'],
     );
 
     expect(renderedPermissions(wrapper)).toEqual(['configure asset containers', 'view blog entries']);
 });
+
+test('it hides a permission when any of the permissions hiding it are checked', () => {
+    const permissions = () => [
+        permission('configure forms'),
+        permission('edit forms'),
+        permission('edit contact form', { hidden_by: ['configure forms', 'edit forms'] }),
+    ];
+
+    expect(renderedPermissions(mountTree(permissions(), ['configure forms']))).toEqual([
+        'configure forms',
+        'edit forms',
+    ]);
+
+    expect(renderedPermissions(mountTree(permissions(), ['edit forms']))).toEqual(['configure forms', 'edit forms']);
+
+    expect(renderedPermissions(mountTree(permissions(), []))).toEqual([
+        'configure forms',
+        'edit forms',
+        'edit contact form',
+    ]);
+});
diff --git a/src/Auth/CorePermissions.php b/src/Auth/CorePermissions.php
index d0a99ad742f..3647229808e 100644
--- a/src/Auth/CorePermissions.php
+++ b/src/Auth/CorePermissions.php
@@ -95,7 +95,7 @@ protected function registerCollections()
         $this->register('configure collections');
 
         $this->register('view {collection} entries', function ($permission) {
-            $this->permission($permission)->supersededBy('configure collections')->children([
+            $this->permission($permission)->hiddenBy('configure collections')->children([
                 $this->permission('edit {collection} entries')->children([
                     $this->permission('create {collection} entries'),
                     $this->permission('delete {collection} entries'),
@@ -119,7 +119,7 @@ protected function registerNavigation()
         $this->register('configure navs');
 
         $this->register('view {nav} nav', function ($permission) {
-            $this->permission($permission)->supersededBy('configure navs')->children([
+            $this->permission($permission)->hiddenBy('configure navs')->children([
                 $this->permission('edit {nav} nav'),
             ])->replacements('nav', function () {
                 return Nav::all()->map(function ($nav) {
@@ -134,7 +134,7 @@ protected function registerGlobals()
         $this->register('configure globals');
 
         $this->register('edit {global} globals', function ($permission) {
-            $permission->supersededBy('configure globals')->replacements('global', function () {
+            $permission->hiddenBy('configure globals')->replacements('global', function () {
                 return GlobalSet::all()->map(function ($global) {
                     return ['value' => $global->handle(), 'label' => __($global->title())];
                 });
@@ -147,7 +147,7 @@ protected function registerTaxonomies()
         $this->register('configure taxonomies');
 
         $this->register('view {taxonomy} terms', function ($permission) {
-            $this->permission($permission)->supersededBy('configure taxonomies')->children([
+            $this->permission($permission)->hiddenBy('configure taxonomies')->children([
                 $this->permission('edit {taxonomy} terms')->children([
                     $this->permission('create {taxonomy} terms'),
                     $this->permission('delete {taxonomy} terms'),
@@ -165,7 +165,7 @@ protected function registerAssets()
         $this->register('configure asset containers');
 
         $this->register('view {container} assets', function ($permission) {
-            $this->permission($permission)->supersededBy('configure asset containers')->children([
+            $this->permission($permission)->hiddenBy('configure asset containers')->children([
                 $this->permission('upload {container} assets'),
                 $this->permission('edit {container} folders'),
                 $this->permission('edit {container} assets')->children([
@@ -210,7 +210,7 @@ protected function registerForms()
         $this->register('configure forms');
 
         $this->register('view {form} form submissions', function ($permission) {
-            $this->permission($permission)->supersededBy('configure forms')->children([
+            $this->permission($permission)->hiddenBy('configure forms')->children([
                 $this->permission('delete {form} form submissions'),
             ])->replacements('form', function () {
                 return Form::all()->map(function ($form) {
@@ -230,7 +230,7 @@ protected function registerAddons()
                 Permission::register("edit {$addon->package()} settings", function ($permission) use ($addon) {
                     return $permission
                         ->label(__('statamic::permissions.edit_addon_settings', ['addon' => __($addon->name())]))
-                        ->supersededBy('configure addons');
+                        ->hiddenBy('configure addons');
                 });
             });
     }
diff --git a/src/Auth/Permission.php b/src/Auth/Permission.php
index 4df49ce58f1..212d5ab66fd 100644
--- a/src/Auth/Permission.php
+++ b/src/Auth/Permission.php
@@ -2,6 +2,7 @@
 
 namespace Statamic\Auth;
 
+use Statamic\Support\Arr;
 use Statamic\Support\Traits\FluentlyGetsAndSets;
 
 use function Statamic\trans as __;
@@ -19,7 +20,7 @@ class Permission
     protected $label;
     protected $description;
     protected $group;
-    protected $supersededBy;
+    protected $hiddenBy;
 
     /**
      * @return ($value is null ? string|string[] : static)
@@ -105,7 +106,7 @@ public function permissions()
                 ->placeholderLabel($replacement['label'])
                 ->placeholderValue($replacement['value'])
                 ->group($this->group())
-                ->supersededBy($this->supersededBy());
+                ->hiddenBy($this->hiddenBy());
 
             if ($this->children()) {
                 $replaced->children($this->children()->all());
@@ -207,7 +208,7 @@ public function toTree()
                 'label' => $permission->label(),
                 'description' => $permission->description(),
                 'group' => $permission->group(),
-                'superseded_by' => $permission->supersededBy(),
+                'hidden_by' => $permission->hiddenBy(),
                 'children' => $children->flatMap->toTree()->all(),
             ];
         })->all();
@@ -223,8 +224,12 @@ public function description()
         return $this->fluentlyGetOrSet('description')->args(func_get_args());
     }
 
-    public function supersededBy(?string $permission = null)
+    public function hiddenBy(string|array|null $permissions = null)
     {
-        return $this->fluentlyGetOrSet('supersededBy')->args(func_get_args());
+        return $this
+            ->fluentlyGetOrSet('hiddenBy')
+            ->getter(fn ($permissions) => $permissions ?? [])
+            ->setter(fn ($permissions) => Arr::wrap($permissions))
+            ->args(func_get_args());
     }
 }
diff --git a/tests/Permissions/CorePermissionsTest.php b/tests/Permissions/CorePermissionsTest.php
index ccbba433bef..38cf83ea28e 100644
--- a/tests/Permissions/CorePermissionsTest.php
+++ b/tests/Permissions/CorePermissionsTest.php
@@ -9,7 +9,7 @@
 
 class CorePermissionsTest extends TestCase
 {
-    public static function supersededPermissionProvider()
+    public static function hiddenPermissionProvider()
     {
         return [
             'entries' => ['view {collection} entries', 'configure collections'],
@@ -22,27 +22,27 @@ public static function supersededPermissionProvider()
     }
 
     #[Test]
-    #[DataProvider('supersededPermissionProvider')]
-    public function configure_permissions_supersede_their_per_item_permissions($permission, $superseder)
+    #[DataProvider('hiddenPermissionProvider')]
+    public function configure_permissions_hide_their_per_item_permissions($permission, $hider)
     {
-        $this->assertEquals($superseder, Permission::boot()->get($permission)->supersededBy());
+        $this->assertEquals([$hider], Permission::boot()->get($permission)->hiddenBy());
     }
 
     #[Test]
-    public function child_permissions_are_not_superseded_since_their_parents_are()
+    public function child_permissions_are_not_hidden_since_their_parents_are()
     {
-        $this->assertNull(Permission::boot()->get('edit {collection} entries')->supersededBy());
-        $this->assertNull(Permission::boot()->get('delete {container} assets')->supersededBy());
+        $this->assertEquals([], Permission::boot()->get('edit {collection} entries')->hiddenBy());
+        $this->assertEquals([], Permission::boot()->get('delete {container} assets')->hiddenBy());
     }
 
     #[Test]
-    public function site_access_is_not_superseded_by_configuring_sites()
+    public function site_access_is_not_hidden_by_configuring_sites()
     {
         $this->setSites([
             'en' => ['url' => '/', 'locale' => 'en_US', 'name' => 'English'],
             'fr' => ['url' => '/fr/', 'locale' => 'fr_FR', 'name' => 'French'],
         ]);
 
-        $this->assertNull(Permission::boot()->get('access {site} site')->supersededBy());
+        $this->assertEquals([], Permission::boot()->get('access {site} site')->hiddenBy());
     }
 }
diff --git a/tests/Permissions/PermissionTest.php b/tests/Permissions/PermissionTest.php
index 2fb35136569..d8837bb0328 100644
--- a/tests/Permissions/PermissionTest.php
+++ b/tests/Permissions/PermissionTest.php
@@ -20,7 +20,7 @@ public function it_makes_a_tree()
                 'label' => 'one',
                 'description' => null,
                 'group' => null,
-                'superseded_by' => null,
+                'hidden_by' => [],
                 'children' => [],
             ],
         ], $permission->toTree());
@@ -43,14 +43,14 @@ public function it_makes_tree_with_children()
                 'label' => 'parent',
                 'description' => null,
                 'group' => 'foo',
-                'superseded_by' => null,
+                'hidden_by' => [],
                 'children' => [
                     [
                         'value' => 'child',
                         'label' => 'Child!',
                         'description' => null,
                         'group' => 'foo',
-                        'superseded_by' => null,
+                        'hidden_by' => [],
                         'children' => [],
                     ],
                 ],
@@ -139,25 +139,34 @@ public function it_adds_a_group()
     }
 
     #[Test]
-    public function it_adds_a_superseding_permission()
+    public function it_adds_a_hiding_permission()
     {
         $permission = (new Permission)->value('test');
-        $this->assertNull($permission->supersededBy());
-        $this->assertNull($permission->toTree()[0]['superseded_by']);
+        $this->assertEquals([], $permission->hiddenBy());
+        $this->assertEquals([], $permission->toTree()[0]['hidden_by']);
 
-        $return = $permission->supersededBy('other');
+        $return = $permission->hiddenBy('other');
 
         $this->assertEquals($permission, $return);
-        $this->assertEquals('other', $permission->supersededBy());
-        $this->assertEquals('other', $permission->toTree()[0]['superseded_by']);
+        $this->assertEquals(['other'], $permission->hiddenBy());
+        $this->assertEquals(['other'], $permission->toTree()[0]['hidden_by']);
     }
 
     #[Test]
-    public function it_keeps_the_superseding_permission_when_replacements_are_defined()
+    public function it_adds_multiple_hiding_permissions()
+    {
+        $permission = (new Permission)->value('test')->hiddenBy(['one', 'two']);
+
+        $this->assertEquals(['one', 'two'], $permission->hiddenBy());
+        $this->assertEquals(['one', 'two'], $permission->toTree()[0]['hidden_by']);
+    }
+
+    #[Test]
+    public function it_keeps_the_hiding_permissions_when_replacements_are_defined()
     {
         $permission = (new Permission)
             ->value('edit {handle} form')
-            ->supersededBy('edit forms')
+            ->hiddenBy(['configure forms', 'edit forms'])
             ->replacements('handle', function () {
                 return [
                     ['value' => 'first', 'label' => 'FIRST'],
@@ -165,9 +174,11 @@ public function it_keeps_the_superseding_permission_when_replacements_are_define
                 ];
             });
 
-        $this->assertEquals(['edit forms', 'edit forms'], $permission->permissions()->map->supersededBy()->all());
-        $this->assertEquals('edit forms', $permission->toTree()[0]['superseded_by']);
-        $this->assertEquals('edit forms', $permission->toTree()[1]['superseded_by']);
+        $expected = ['configure forms', 'edit forms'];
+
+        $this->assertEquals([$expected, $expected], $permission->permissions()->map->hiddenBy()->all());
+        $this->assertEquals($expected, $permission->toTree()[0]['hidden_by']);
+        $this->assertEquals($expected, $permission->toTree()[1]['hidden_by']);
     }
 
     #[Test]
@@ -252,21 +263,21 @@ public function it_combines_replacements_and_children()
                 'label' => 'view FIRST entries',
                 'description' => null,
                 'group' => 'test-group',
-                'superseded_by' => null,
+                'hidden_by' => [],
                 'children' => [
                     [
                         'value' => 'edit first entries',
                         'label' => 'edit FIRST entries',
                         'description' => null,
                         'group' => 'test-group',
-                        'superseded_by' => null,
+                        'hidden_by' => [],
                         'children' => [
                             [
                                 'value' => 'delete first entries',
                                 'label' => 'delete FIRST entries',
                                 'description' => null,
                                 'group' => 'test-group',
-                                'superseded_by' => null,
+                                'hidden_by' => [],
                                 'children' => [],
                             ],
                         ],
@@ -276,7 +287,7 @@ public function it_combines_replacements_and_children()
                         'label' => 'publish FIRST entries',
                         'description' => null,
                         'group' => 'test-group',
-                        'superseded_by' => null,
+                        'hidden_by' => [],
                         'children' => [],
                     ],
                 ],
@@ -286,21 +297,21 @@ public function it_combines_replacements_and_children()
                 'label' => 'view SECOND entries',
                 'description' => null,
                 'group' => 'test-group',
-                'superseded_by' => null,
+                'hidden_by' => [],
                 'children' => [
                     [
                         'value' => 'edit second entries',
                         'label' => 'edit SECOND entries',
                         'description' => null,
                         'group' => 'test-group',
-                        'superseded_by' => null,
+                        'hidden_by' => [],
                         'children' => [
                             [
                                 'value' => 'delete second entries',
                                 'label' => 'delete SECOND entries',
                                 'description' => null,
                                 'group' => 'test-group',
-                                'superseded_by' => null,
+                                'hidden_by' => [],
                                 'children' => [],
                             ],
                         ],
@@ -310,7 +321,7 @@ public function it_combines_replacements_and_children()
                         'label' => 'publish SECOND entries',
                         'description' => null,
                         'group' => 'test-group',
-                        'superseded_by' => null,
+                        'hidden_by' => [],
                         'children' => [],
                     ],
                 ],
diff --git a/tests/Permissions/PermissionsTest.php b/tests/Permissions/PermissionsTest.php
index 2e95def07ee..390d621c551 100644
--- a/tests/Permissions/PermissionsTest.php
+++ b/tests/Permissions/PermissionsTest.php
@@ -171,21 +171,21 @@ public function it_makes_a_tree()
                         'label' => 'two',
                         'description' => null,
                         'group' => 'test',
-                        'superseded_by' => null,
+                        'hidden_by' => [],
                         'children' => [
                             [
                                 'value' => 'child-three',
                                 'label' => 'child-three',
                                 'description' => null,
                                 'group' => 'test',
-                                'superseded_by' => null,
+                                'hidden_by' => [],
                                 'children' => [
                                     [
                                         'value' => 'nested-child',
                                         'label' => 'nested-child',
                                         'description' => null,
                                         'group' => 'test',
-                                        'superseded_by' => null,
+                                        'hidden_by' => [],
                                         'children' => [],
                                     ],
                                 ],
@@ -203,21 +203,21 @@ public function it_makes_a_tree()
                         'label' => 'four FIRST',
                         'description' => null,
                         'group' => 'group-with-replacements',
-                        'superseded_by' => null,
+                        'hidden_by' => [],
                         'children' => [
                             [
                                 'value' => 'replaced child first',
                                 'label' => 'Replaced FIRST',
                                 'description' => null,
                                 'group' => 'group-with-replacements',
-                                'superseded_by' => null,
+                                'hidden_by' => [],
                                 'children' => [
                                     [
                                         'value' => 'replaced nested child first',
                                         'label' => 'Replaced Nested FIRST',
                                         'description' => null,
                                         'group' => 'group-with-replacements',
-                                        'superseded_by' => null,
+                                        'hidden_by' => [],
                                         'children' => [],
                                     ],
                                 ],
@@ -229,21 +229,21 @@ public function it_makes_a_tree()
                         'label' => 'four SECOND',
                         'description' => null,
                         'group' => 'group-with-replacements',
-                        'superseded_by' => null,
+                        'hidden_by' => [],
                         'children' => [
                             [
                                 'value' => 'replaced child second',
                                 'label' => 'Replaced SECOND',
                                 'description' => null,
                                 'group' => 'group-with-replacements',
-                                'superseded_by' => null,
+                                'hidden_by' => [],
                                 'children' => [
                                     [
                                         'value' => 'replaced nested child second',
                                         'label' => 'Replaced Nested SECOND',
                                         'description' => null,
                                         'group' => 'group-with-replacements',
-                                        'superseded_by' => null,
+                                        'hidden_by' => [],
                                         'children' => [],
                                     ],
                                 ],
@@ -261,14 +261,14 @@ public function it_makes_a_tree()
                         'label' => 'one',
                         'description' => null,
                         'group' => null,
-                        'superseded_by' => null,
+                        'hidden_by' => [],
                         'children' => [
                             [
                                 'value' => 'child-one',
                                 'label' => 'child-one',
                                 'description' => null,
                                 'group' => null,
-                                'superseded_by' => null,
+                                'hidden_by' => [],
                                 'children' => [],
                             ],
                             [
@@ -276,7 +276,7 @@ public function it_makes_a_tree()
                                 'label' => 'child-two',
                                 'description' => null,
                                 'group' => null,
-                                'superseded_by' => null,
+                                'hidden_by' => [],
                                 'children' => [],
                             ],
                         ],
@@ -286,7 +286,7 @@ public function it_makes_a_tree()
                         'label' => 'three',
                         'description' => null,
                         'group' => null,
-                        'superseded_by' => null,
+                        'hidden_by' => [],
                         'children' => [],
                     ],
                 ],

From 1b33fbbb4acfa5b2cdaf825aca9f56cd4162e4a0 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 9 Jul 2026 14:39:41 -0400
Subject: [PATCH 06/13] Test that configure permissions grant their per-item
 abilities

The roles UI hides permissions that a configure permission covers, so
the coverage needs pinning down. Entries and terms had no such tests,
and globals only covered creating and deleting variables.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 tests/Policies/EntryPolicyTest.php            | 26 +++++++++++++++++++
 .../Policies/GlobalSetVariablesPolicyTest.php | 14 ++++++++++
 tests/Policies/TermPolicyTest.php             | 26 +++++++++++++++++++
 3 files changed, 66 insertions(+)

diff --git a/tests/Policies/EntryPolicyTest.php b/tests/Policies/EntryPolicyTest.php
index db40d4cd835..eb6aa35213a 100644
--- a/tests/Policies/EntryPolicyTest.php
+++ b/tests/Policies/EntryPolicyTest.php
@@ -151,6 +151,32 @@ public function entry_is_not_creatable_without_create_and_site_permissions()
         $this->assertFalse($user->can('create', [Entry::class, $collection]));
     }
 
+    #[Test]
+    public function user_with_configure_permission_can_do_it_all()
+    {
+        $userWithPermission = $this->userWithPermissions(['configure collections']);
+        $userWithoutPermission = $this->userWithPermissions([]);
+
+        $collection = tap(Collection::make('alfa'))->save();
+        $entry = EntryFactory::id('1')->collection($collection)->create();
+
+        $this->assertTrue($userWithPermission->can('view', $entry));
+        $this->assertTrue($userWithPermission->can('edit', $entry));
+        $this->assertTrue($userWithPermission->can('update', $entry));
+        $this->assertTrue($userWithPermission->can('create', [Entry::class, $collection]));
+        $this->assertTrue($userWithPermission->can('store', [Entry::class, $collection]));
+        $this->assertTrue($userWithPermission->can('delete', $entry));
+        $this->assertTrue($userWithPermission->can('publish', $entry));
+
+        $this->assertFalse($userWithoutPermission->can('view', $entry));
+        $this->assertFalse($userWithoutPermission->can('edit', $entry));
+        $this->assertFalse($userWithoutPermission->can('update', $entry));
+        $this->assertFalse($userWithoutPermission->can('create', [Entry::class, $collection]));
+        $this->assertFalse($userWithoutPermission->can('store', [Entry::class, $collection]));
+        $this->assertFalse($userWithoutPermission->can('delete', $entry));
+        $this->assertFalse($userWithoutPermission->can('publish', $entry));
+    }
+
     #[Test]
     public function another_authors_entry_is_editable()
     {
diff --git a/tests/Policies/GlobalSetVariablesPolicyTest.php b/tests/Policies/GlobalSetVariablesPolicyTest.php
index e95e6f58607..1605447be50 100644
--- a/tests/Policies/GlobalSetVariablesPolicyTest.php
+++ b/tests/Policies/GlobalSetVariablesPolicyTest.php
@@ -41,6 +41,20 @@ public function variables_are_editable_with_edit_and_site_permissions()
         $this->assertTrue($user->can('view', $global->in('de')));
     }
 
+    #[Test]
+    public function variables_are_viewable_and_editable_with_configure_permission()
+    {
+        $forbiddenUser = $this->userWithPermissions([]);
+        $authorizedUser = $this->userWithPermissions(['configure globals']);
+        $variables = tap(GlobalSet::make('test'))->save()->inDefaultSite();
+
+        $this->assertTrue($authorizedUser->can('view', $variables));
+        $this->assertTrue($authorizedUser->can('edit', $variables));
+
+        $this->assertFalse($forbiddenUser->can('view', $variables));
+        $this->assertFalse($forbiddenUser->can('edit', $variables));
+    }
+
     #[Test]
     public function variables_can_be_created_with_configure_permission()
     {
diff --git a/tests/Policies/TermPolicyTest.php b/tests/Policies/TermPolicyTest.php
index 49bfed15f22..c8a1c67181b 100644
--- a/tests/Policies/TermPolicyTest.php
+++ b/tests/Policies/TermPolicyTest.php
@@ -105,4 +105,30 @@ public function term_is_not_creatable_without_create_and_site_permissions()
         // If no site is specified, it should avoid checking site access.
         $this->assertFalse($user->can('create', [TermContract::class, $taxonomy]));
     }
+
+    #[Test]
+    public function user_with_configure_permission_can_do_it_all()
+    {
+        $userWithPermission = $this->userWithPermissions(['configure taxonomies']);
+        $userWithoutPermission = $this->userWithPermissions([]);
+
+        $taxonomy = tap(Taxonomy::make('tags'))->save();
+        $term = tap(Term::make()->taxonomy('tags')->inDefaultLocale()->slug('alfa')->data([]))->save()->term();
+
+        $this->assertTrue($userWithPermission->can('view', $term));
+        $this->assertTrue($userWithPermission->can('edit', $term));
+        $this->assertTrue($userWithPermission->can('update', $term));
+        $this->assertTrue($userWithPermission->can('create', [TermContract::class, $taxonomy]));
+        $this->assertTrue($userWithPermission->can('store', [TermContract::class, $taxonomy]));
+        $this->assertTrue($userWithPermission->can('delete', $term));
+        $this->assertTrue($userWithPermission->can('publish', $term));
+
+        $this->assertFalse($userWithoutPermission->can('view', $term));
+        $this->assertFalse($userWithoutPermission->can('edit', $term));
+        $this->assertFalse($userWithoutPermission->can('update', $term));
+        $this->assertFalse($userWithoutPermission->can('create', [TermContract::class, $taxonomy]));
+        $this->assertFalse($userWithoutPermission->can('store', [TermContract::class, $taxonomy]));
+        $this->assertFalse($userWithoutPermission->can('delete', $term));
+        $this->assertFalse($userWithoutPermission->can('publish', $term));
+    }
 }

From 8768be1274f5e650c2c42fad49781388613c4bdd Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 9 Jul 2026 14:52:53 -0400
Subject: [PATCH 07/13] Do not hide addon settings permissions

Unlike the other configure permissions, "configure addons" governs a
different resource to the addon settings permissions it would hide.
Whether it should grant access to every addon's settings is a separate
question to this one.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/Auth/CorePermissions.php | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/Auth/CorePermissions.php b/src/Auth/CorePermissions.php
index 3647229808e..1d371fa080c 100644
--- a/src/Auth/CorePermissions.php
+++ b/src/Auth/CorePermissions.php
@@ -229,8 +229,7 @@ protected function registerAddons()
             ->each(function ($addon) {
                 Permission::register("edit {$addon->package()} settings", function ($permission) use ($addon) {
                     return $permission
-                        ->label(__('statamic::permissions.edit_addon_settings', ['addon' => __($addon->name())]))
-                        ->hiddenBy('configure addons');
+                        ->label(__('statamic::permissions.edit_addon_settings', ['addon' => __($addon->name())]));
                 });
             });
     }

From d2d13dca228bf9cb23d5d849000954ad96c1b4af Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 9 Jul 2026 15:32:44 -0400
Subject: [PATCH 08/13] Pass the checked permissions to the permission tree as
 a prop

The tree is self-recursive, so there is only one call site to thread it
through. A prop keeps the component standalone and makes the data flow
visible, rather than reaching for an ancestor's provide.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../js/components/roles/PermissionTree.vue    |  9 +++--
 resources/js/components/roles/PublishForm.vue | 13 +++----
 .../components/roles/PermissionTree.test.js   | 34 ++++++++++++++++---
 3 files changed, 41 insertions(+), 15 deletions(-)

diff --git a/resources/js/components/roles/PermissionTree.vue b/resources/js/components/roles/PermissionTree.vue
index 060a135b645..d31fe7b5252 100644
--- a/resources/js/components/roles/PermissionTree.vue
+++ b/resources/js/components/roles/PermissionTree.vue
@@ -18,6 +18,7 @@
                 v-if="permission.children.length"
                 :depth="depth + 1"
                 :initial-permissions="permission.children"
+                :checked-permissions="checkedPermissions"
             />
         </template>
     </div>
@@ -28,10 +29,12 @@ export default {
     props: {
         initialPermissions: Array,
         depth: Number,
+        checkedPermissions: {
+            type: Array,
+            default: () => [],
+        },
     },
 
-    inject: ['checkedPermissionValues'],
-
     data() {
         return {
             permissions: this.initialPermissions,
@@ -41,7 +44,7 @@ export default {
     computed: {
         visiblePermissions() {
             return this.permissions.filter(
-                (permission) => !permission.hidden_by.some((value) => this.checkedPermissionValues.includes(value))
+                (permission) => !permission.hidden_by.some((value) => this.checkedPermissions.includes(value))
             );
         },
     },
diff --git a/resources/js/components/roles/PublishForm.vue b/resources/js/components/roles/PublishForm.vue
index 94f5b744e07..160932f0bcc 100644
--- a/resources/js/components/roles/PublishForm.vue
+++ b/resources/js/components/roles/PublishForm.vue
@@ -67,7 +67,11 @@
                     </Button>
                 </template>
                 <Card>
-                    <PermissionTree :depth="1" :initial-permissions="group.permissions" />
+                    <PermissionTree
+                        :depth="1"
+                        :initial-permissions="group.permissions"
+                        :checked-permissions="checkedPermissions"
+                    />
                 </Card>
             </Panel>
         </div>
@@ -75,7 +79,6 @@
 </template>
 
 <script>
-import { computed } from 'vue';
 import { Header, Button, Panel, PanelHeader, Heading, Card, Switch, Field, Input, CommandPaletteItem } from '@/components/ui';
 import { requireElevatedSession } from '@/components/elevated-sessions';
 import PermissionTree from '@/components/roles/PermissionTree.vue';
@@ -103,12 +106,6 @@ export default {
         CommandPaletteItem,
     },
 
-    provide() {
-        return {
-            checkedPermissionValues: computed(() => this.checkedPermissions),
-        };
-    },
-
     props: {
         initialTitle: String,
         initialHandle: String,
diff --git a/resources/js/tests/components/roles/PermissionTree.test.js b/resources/js/tests/components/roles/PermissionTree.test.js
index 24cbe2158b5..4cd4429f058 100644
--- a/resources/js/tests/components/roles/PermissionTree.test.js
+++ b/resources/js/tests/components/roles/PermissionTree.test.js
@@ -1,6 +1,5 @@
 import { mount } from '@vue/test-utils';
 import { expect, test } from 'vitest';
-import { ref } from 'vue';
 import PermissionTree from '@/components/roles/PermissionTree.vue';
 
 const permission = (value, overrides = {}) => ({
@@ -13,11 +12,10 @@ const permission = (value, overrides = {}) => ({
     ...overrides,
 });
 
-const mountTree = (permissions, checkedPermissionValues = []) =>
+const mountTree = (permissions, checkedPermissions = []) =>
     mount(PermissionTree, {
-        props: { depth: 1, initialPermissions: permissions },
+        props: { depth: 1, initialPermissions: permissions, checkedPermissions },
         global: {
-            provide: { checkedPermissionValues: ref(checkedPermissionValues) },
             stubs: {
                 'ui-checkbox': {
                     props: ['value'],
@@ -78,6 +76,34 @@ test('it only hides permissions hidden by a checked permission', () => {
     expect(renderedPermissions(wrapper)).toEqual(['configure asset containers', 'view blog entries']);
 });
 
+test('it hides a nested permission when the permission hiding it is checked', () => {
+    const wrapper = mountTree(
+        [
+            permission('configure collections', { checked: true }),
+            permission('view blog entries', {
+                children: [permission('publish blog entries', { hidden_by: ['configure collections'] })],
+            }),
+        ],
+        ['configure collections'],
+    );
+
+    expect(renderedPermissions(wrapper)).toEqual(['configure collections', 'view blog entries']);
+});
+
+test('it shows everything when no checked permissions are given', () => {
+    const wrapper = mount(PermissionTree, {
+        props: {
+            depth: 1,
+            initialPermissions: [permission('view images assets', { hidden_by: ['configure asset containers'] })],
+        },
+        global: {
+            stubs: { 'ui-checkbox': { props: ['value'], template: '<div class="permission">{{ value }}</div>' } },
+        },
+    });
+
+    expect(renderedPermissions(wrapper)).toEqual(['view images assets']);
+});
+
 test('it hides a permission when any of the permissions hiding it are checked', () => {
     const permissions = () => [
         permission('configure forms'),

From 64baddc0d6f803e87cba87717c9d373d72b29a05 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 9 Jul 2026 15:33:36 -0400
Subject: [PATCH 09/13] Keep hiddenBy on children of permissions using
 replacements

The children of a permission with replacements are rebuilt when the tree
is generated, which dropped their hiddenBy. Core only declares it on
top level permissions, but addons may declare it anywhere.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/Auth/Permission.php              |  3 ++-
 tests/Permissions/PermissionTest.php | 20 ++++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/src/Auth/Permission.php b/src/Auth/Permission.php
index 212d5ab66fd..eb85ce26e8a 100644
--- a/src/Auth/Permission.php
+++ b/src/Auth/Permission.php
@@ -193,7 +193,8 @@ public function toTree()
                         ->placeholder($permission->placeholder())
                         ->placeholderLabel($permission->placeholderLabel())
                         ->placeholderValue($permission->placeholderValue())
-                        ->group($permission->group());
+                        ->group($permission->group())
+                        ->hiddenBy($child->hiddenBy());
 
                     if ($children = $child->children()) {
                         $replaced->children($children->all());
diff --git a/tests/Permissions/PermissionTest.php b/tests/Permissions/PermissionTest.php
index d8837bb0328..684600e9b66 100644
--- a/tests/Permissions/PermissionTest.php
+++ b/tests/Permissions/PermissionTest.php
@@ -181,6 +181,26 @@ public function it_keeps_the_hiding_permissions_when_replacements_are_defined()
         $this->assertEquals($expected, $permission->toTree()[1]['hidden_by']);
     }
 
+    #[Test]
+    public function it_keeps_the_hiding_permissions_of_children_when_replacements_are_defined()
+    {
+        $permission = (new Permission)
+            ->value('view {handle} entries')
+            ->children([
+                (new Permission)
+                    ->value('publish {handle} entries')
+                    ->hiddenBy('configure collections'),
+            ])
+            ->replacements('handle', function () {
+                return [['value' => 'first', 'label' => 'FIRST']];
+            });
+
+        $child = $permission->toTree()[0]['children'][0];
+
+        $this->assertEquals('publish first entries', $child['value']);
+        $this->assertEquals(['configure collections'], $child['hidden_by']);
+    }
+
     #[Test]
     public function it_gets_its_permissions_when_replacements_are_not_defined()
     {

From 401718ddb077bf23da383d966e62df70d11795d4 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 9 Jul 2026 15:34:10 -0400
Subject: [PATCH 10/13] Keep descriptions on permissions using replacements

Permissions with replacements, and their children, are rebuilt when the
tree is generated, which dropped their descriptions. The publish and
reorder entry permissions have never shown theirs in the roles UI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/Auth/Permission.php                   |  2 ++
 tests/Permissions/CorePermissionsTest.php | 17 +++++++++++++++++
 tests/Permissions/PermissionTest.php      | 21 +++++++++++++++++++++
 3 files changed, 40 insertions(+)

diff --git a/src/Auth/Permission.php b/src/Auth/Permission.php
index eb85ce26e8a..bf42271e087 100644
--- a/src/Auth/Permission.php
+++ b/src/Auth/Permission.php
@@ -102,6 +102,7 @@ public function permissions()
             $replaced = (new self)
                 ->value($this->value)
                 ->label($this->label)
+                ->description($this->description())
                 ->placeholder($this->placeholder)
                 ->placeholderLabel($replacement['label'])
                 ->placeholderValue($replacement['value'])
@@ -190,6 +191,7 @@ public function toTree()
                     $replaced = (new self)
                         ->value($child->originalValue())
                         ->label($child->originalLabel())
+                        ->description($child->description())
                         ->placeholder($permission->placeholder())
                         ->placeholderLabel($permission->placeholderLabel())
                         ->placeholderValue($permission->placeholderValue())
diff --git a/tests/Permissions/CorePermissionsTest.php b/tests/Permissions/CorePermissionsTest.php
index 38cf83ea28e..46aaeeb342e 100644
--- a/tests/Permissions/CorePermissionsTest.php
+++ b/tests/Permissions/CorePermissionsTest.php
@@ -4,11 +4,15 @@
 
 use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\Attributes\Test;
+use Statamic\Facades\Collection;
 use Statamic\Facades\Permission;
+use Tests\PreventSavingStacheItemsToDisk;
 use Tests\TestCase;
 
 class CorePermissionsTest extends TestCase
 {
+    use PreventSavingStacheItemsToDisk;
+
     public static function hiddenPermissionProvider()
     {
         return [
@@ -35,6 +39,19 @@ public function child_permissions_are_not_hidden_since_their_parents_are()
         $this->assertEquals([], Permission::boot()->get('delete {container} assets')->hiddenBy());
     }
 
+    #[Test]
+    public function replaced_child_permissions_keep_their_descriptions()
+    {
+        Collection::make('blog')->save();
+
+        $group = Permission::boot()->tree()->firstWhere('handle', 'collections');
+        $view = collect($group['permissions'])->firstWhere('value', 'view blog entries');
+        $edit = collect($view['children'])->firstWhere('value', 'edit blog entries');
+        $publish = collect($edit['children'])->firstWhere('value', 'publish blog entries');
+
+        $this->assertEquals(__('statamic::permissions.publish_{collection}_entries_desc'), $publish['description']);
+    }
+
     #[Test]
     public function site_access_is_not_hidden_by_configuring_sites()
     {
diff --git a/tests/Permissions/PermissionTest.php b/tests/Permissions/PermissionTest.php
index 684600e9b66..76738dd9d05 100644
--- a/tests/Permissions/PermissionTest.php
+++ b/tests/Permissions/PermissionTest.php
@@ -201,6 +201,27 @@ public function it_keeps_the_hiding_permissions_of_children_when_replacements_ar
         $this->assertEquals(['configure collections'], $child['hidden_by']);
     }
 
+    #[Test]
+    public function it_keeps_the_descriptions_when_replacements_are_defined()
+    {
+        $permission = (new Permission)
+            ->value('view {handle} entries')
+            ->description('View the entries')
+            ->children([
+                (new Permission)
+                    ->value('publish {handle} entries')
+                    ->description('Change the publish state'),
+            ])
+            ->replacements('handle', function () {
+                return [['value' => 'first', 'label' => 'FIRST']];
+            });
+
+        $parent = $permission->toTree()[0];
+
+        $this->assertEquals('View the entries', $parent['description']);
+        $this->assertEquals('Change the publish state', $parent['children'][0]['description']);
+    }
+
     #[Test]
     public function it_gets_its_permissions_when_replacements_are_not_defined()
     {

From e36e6c926d76088900574da37e303d57ee606889 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 9 Jul 2026 16:18:20 -0400
Subject: [PATCH 11/13] Test that unhiding a permission restores its checked
 state

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../tests/components/roles/PermissionTree.test.js | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/resources/js/tests/components/roles/PermissionTree.test.js b/resources/js/tests/components/roles/PermissionTree.test.js
index 4cd4429f058..3305fd38a29 100644
--- a/resources/js/tests/components/roles/PermissionTree.test.js
+++ b/resources/js/tests/components/roles/PermissionTree.test.js
@@ -104,6 +104,21 @@ test('it shows everything when no checked permissions are given', () => {
     expect(renderedPermissions(wrapper)).toEqual(['view images assets']);
 });
 
+test('unhiding a permission brings back its checked state', async () => {
+    const permissions = [
+        permission('configure asset containers', { checked: true }),
+        permission('view images assets', { checked: true, hidden_by: ['configure asset containers'] }),
+    ];
+
+    const wrapper = mountTree(permissions, ['configure asset containers']);
+    expect(renderedPermissions(wrapper)).toEqual(['configure asset containers']);
+
+    await wrapper.setProps({ checkedPermissions: [] });
+
+    expect(renderedPermissions(wrapper)).toEqual(['configure asset containers', 'view images assets']);
+    expect(permissions[1].checked).toBe(true);
+});
+
 test('it hides a permission when any of the permissions hiding it are checked', () => {
     const permissions = () => [
         permission('configure forms'),

From 51ce6df5ef248feaa4c64949ba5533d4cf635969 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 9 Jul 2026 16:18:37 -0400
Subject: [PATCH 12/13] Extract the permission visibility helpers

The roles form needs to know which permissions are visible too, so the
predicate shouldn't live in the tree component.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../js/components/roles/PermissionTree.vue    |  6 +--
 resources/js/components/roles/permissions.js  |  7 +++
 .../components/roles/permissions.test.js      | 50 +++++++++++++++++++
 3 files changed, 60 insertions(+), 3 deletions(-)
 create mode 100644 resources/js/components/roles/permissions.js
 create mode 100644 resources/js/tests/components/roles/permissions.test.js

diff --git a/resources/js/components/roles/PermissionTree.vue b/resources/js/components/roles/PermissionTree.vue
index d31fe7b5252..2bec1e60434 100644
--- a/resources/js/components/roles/PermissionTree.vue
+++ b/resources/js/components/roles/PermissionTree.vue
@@ -25,6 +25,8 @@
 </template>
 
 <script>
+import { visible } from '@/components/roles/permissions.js';
+
 export default {
     props: {
         initialPermissions: Array,
@@ -43,9 +45,7 @@ export default {
 
     computed: {
         visiblePermissions() {
-            return this.permissions.filter(
-                (permission) => !permission.hidden_by.some((value) => this.checkedPermissions.includes(value))
-            );
+            return visible(this.permissions, this.checkedPermissions);
         },
     },
 
diff --git a/resources/js/components/roles/permissions.js b/resources/js/components/roles/permissions.js
new file mode 100644
index 00000000000..845d796df0d
--- /dev/null
+++ b/resources/js/components/roles/permissions.js
@@ -0,0 +1,7 @@
+export function isVisible(permission, checkedPermissions) {
+    return !permission.hidden_by.some((value) => checkedPermissions.includes(value));
+}
+
+export function visible(permissions, checkedPermissions) {
+    return permissions.filter((permission) => isVisible(permission, checkedPermissions));
+}
diff --git a/resources/js/tests/components/roles/permissions.test.js b/resources/js/tests/components/roles/permissions.test.js
new file mode 100644
index 00000000000..aebdf18475b
--- /dev/null
+++ b/resources/js/tests/components/roles/permissions.test.js
@@ -0,0 +1,50 @@
+import { describe, expect, test } from 'vitest';
+import { isVisible, visible } from '@/components/roles/permissions.js';
+
+const permission = (value, overrides = {}) => ({
+    value,
+    checked: false,
+    hidden_by: [],
+    children: [],
+    ...overrides,
+});
+
+const values = (permissions) => permissions.map((permission) => permission.value);
+
+describe('isVisible', () => {
+    test('a permission with no hiders is always visible', () => {
+        expect(isVisible(permission('one'), [])).toBe(true);
+        expect(isVisible(permission('one'), ['two'])).toBe(true);
+    });
+
+    test('a permission is hidden when any of its hiders are checked', () => {
+        const one = permission('one', { hidden_by: ['two', 'three'] });
+
+        expect(isVisible(one, [])).toBe(true);
+        expect(isVisible(one, ['four'])).toBe(true);
+        expect(isVisible(one, ['two'])).toBe(false);
+        expect(isVisible(one, ['three'])).toBe(false);
+        expect(isVisible(one, ['two', 'three'])).toBe(false);
+    });
+});
+
+describe('visible', () => {
+    test('it filters out hidden permissions', () => {
+        const permissions = [
+            permission('configure collections'),
+            permission('view blog entries', { hidden_by: ['configure collections'] }),
+            permission('view users'),
+        ];
+
+        expect(values(visible(permissions, []))).toEqual([
+            'configure collections',
+            'view blog entries',
+            'view users',
+        ]);
+
+        expect(values(visible(permissions, ['configure collections']))).toEqual([
+            'configure collections',
+            'view users',
+        ]);
+    });
+});

From 8a3e61e3f1c0b30a951b354ad0125186a53bc28a Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 9 Jul 2026 16:18:56 -0400
Subject: [PATCH 13/13] Make check and uncheck all respect hidden permissions

The buttons walked the whole tree, so a group could read as "Check All"
with every visible box already ticked, and checking would grant
permissions the user never saw.

Checking now only affects visible permissions, using the checked state
from before anything is mutated. Unchecking clears the group outright,
since unchecking a broader permission reveals the ones it was hiding.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 resources/js/components/roles/PublishForm.vue |  52 +++---
 resources/js/components/roles/permissions.js  |  22 +++
 .../components/roles/PublishForm.test.js      | 170 ++++++++++++++++++
 .../components/roles/permissions.test.js      |  91 +++++++++-
 4 files changed, 305 insertions(+), 30 deletions(-)
 create mode 100644 resources/js/tests/components/roles/PublishForm.test.js

diff --git a/resources/js/components/roles/PublishForm.vue b/resources/js/components/roles/PublishForm.vue
index 160932f0bcc..b85995bc14a 100644
--- a/resources/js/components/roles/PublishForm.vue
+++ b/resources/js/components/roles/PublishForm.vue
@@ -82,6 +82,7 @@
 import { Header, Button, Panel, PanelHeader, Heading, Card, Switch, Field, Input, CommandPaletteItem } from '@/components/ui';
 import { requireElevatedSession } from '@/components/elevated-sessions';
 import PermissionTree from '@/components/roles/PermissionTree.vue';
+import { allVisibleChecked, checkVisible, uncheckAll, visible } from '@/components/roles/permissions.js';
 import { router } from '@inertiajs/vue3';
 
 const checked = function (permissions) {
@@ -163,46 +164,39 @@ export default {
 
     methods: {
         areAllChecked(group) {
-            const checkAll = (permissions) => {
-                return permissions.every(permission => {
-                    const childrenChecked = permission.children && permission.children.length
-                        ? checkAll(permission.children)
-                        : true;
-                    return permission.checked && childrenChecked;
-                });
-            };
-            return checkAll(group.permissions);
+            const checkedPermissions = this.checkedPermissions;
+            const shown = visible(group.permissions, checkedPermissions);
+
+            return shown.length > 0 && allVisibleChecked(shown, checkedPermissions);
         },
 
         areAllCheckedInAllGroups() {
             return this.permissions.every(group => this.areAllChecked(group));
         },
 
+        // Checking only affects what the user can see, but unchecking clears the group
+        // outright. Unchecking a broader permission reveals the ones it was hiding, so
+        // leaving those checked would need a second click to empty the group.
         toggleAllInGroup(group) {
-            const allChecked = this.areAllChecked(group);
-            const toggle = (permissions, checked) => {
-                permissions.forEach(permission => {
-                    permission.checked = checked;
-                    if (permission.children && permission.children.length) {
-                        toggle(permission.children, checked);
-                    }
-                });
-            };
-            toggle(group.permissions, !allChecked);
+            const checkedPermissions = this.checkedPermissions;
+
+            if (this.areAllChecked(group)) {
+                uncheckAll(group.permissions);
+            } else {
+                checkVisible(group.permissions, checkedPermissions);
+            }
         },
 
         toggleAllInAllGroups() {
+            const checkedPermissions = this.checkedPermissions;
             const allChecked = this.areAllCheckedInAllGroups();
-            this.permissions.forEach(group => {
-                const toggle = (permissions, checked) => {
-                    permissions.forEach(permission => {
-                        permission.checked = checked;
-                        if (permission.children && permission.children.length) {
-                            toggle(permission.children, checked);
-                        }
-                    });
-                };
-                toggle(group.permissions, !allChecked);
+
+            this.permissions.forEach((group) => {
+                if (allChecked) {
+                    uncheckAll(group.permissions);
+                } else {
+                    checkVisible(group.permissions, checkedPermissions);
+                }
             });
         },
 
diff --git a/resources/js/components/roles/permissions.js b/resources/js/components/roles/permissions.js
index 845d796df0d..a5b6e4bd47a 100644
--- a/resources/js/components/roles/permissions.js
+++ b/resources/js/components/roles/permissions.js
@@ -5,3 +5,25 @@ export function isVisible(permission, checkedPermissions) {
 export function visible(permissions, checkedPermissions) {
     return permissions.filter((permission) => isVisible(permission, checkedPermissions));
 }
+
+export function allVisibleChecked(permissions, checkedPermissions) {
+    return visible(permissions, checkedPermissions).every(
+        (permission) => permission.checked && allVisibleChecked(permission.children, checkedPermissions),
+    );
+}
+
+// The checked permissions are snapshotted by the caller. Visibility must not shift
+// as we check things, otherwise checking a permission would hide the ones after it.
+export function checkVisible(permissions, checkedPermissions) {
+    visible(permissions, checkedPermissions).forEach((permission) => {
+        permission.checked = true;
+        checkVisible(permission.children, checkedPermissions);
+    });
+}
+
+export function uncheckAll(permissions) {
+    permissions.forEach((permission) => {
+        permission.checked = false;
+        uncheckAll(permission.children);
+    });
+}
diff --git a/resources/js/tests/components/roles/PublishForm.test.js b/resources/js/tests/components/roles/PublishForm.test.js
new file mode 100644
index 00000000000..dc3f8c27040
--- /dev/null
+++ b/resources/js/tests/components/roles/PublishForm.test.js
@@ -0,0 +1,170 @@
+import { shallowMount } from '@vue/test-utils';
+import { describe, expect, test } from 'vitest';
+import PublishForm from '@/components/roles/PublishForm.vue';
+
+const permission = (value, overrides = {}) => ({
+    value,
+    label: value,
+    description: null,
+    checked: false,
+    hidden_by: [],
+    children: [],
+    ...overrides,
+});
+
+const group = (handle, permissions) => ({ handle, label: handle, permissions });
+
+const mountForm = (groups) =>
+    shallowMount(PublishForm, {
+        props: {
+            initialTitle: 'Test',
+            initialHandle: 'test',
+            initialPermissions: groups,
+            initialSuper: false,
+            canAssignSuper: false,
+            action: '/roles',
+            method: 'post',
+            indexUrl: '/roles',
+        },
+        global: {
+            mocks: { $keys: { bindGlobal: () => {} } },
+        },
+    });
+
+// The collections group, as core registers it: a configure permission that hides
+// the per-collection permission sitting next to it.
+const collectionsGroup = (overrides = {}) =>
+    group('collections', [
+        permission('configure collections', { checked: overrides.configure ?? false }),
+        permission('view blog entries', {
+            checked: overrides.view ?? false,
+            hidden_by: ['configure collections'],
+            children: [permission('delete blog entries', { checked: overrides.delete ?? false })],
+        }),
+    ]);
+
+describe('areAllChecked', () => {
+    test('it ignores hidden permissions', () => {
+        const wrapper = mountForm([collectionsGroup({ configure: true })]);
+
+        // "view blog entries" is unchecked, but hidden, so the group reads as fully checked.
+        expect(wrapper.vm.areAllChecked(wrapper.vm.permissions[0])).toBe(true);
+    });
+
+    test('it is false while a visible permission is unchecked', () => {
+        const wrapper = mountForm([collectionsGroup()]);
+
+        expect(wrapper.vm.areAllChecked(wrapper.vm.permissions[0])).toBe(false);
+    });
+
+    test('it is false when a group has no visible permissions', () => {
+        const wrapper = mountForm([
+            group('cp', [permission('configure collections', { checked: true })]),
+            group('collections', [permission('view blog entries', { hidden_by: ['configure collections'] })]),
+        ]);
+
+        // Nothing in the group renders, so the button must not offer to uncheck anything.
+        expect(wrapper.vm.areAllChecked(wrapper.vm.permissions[1])).toBe(false);
+    });
+});
+
+describe('toggleAllInGroup', () => {
+    test('checking only checks what is visible', () => {
+        // The hider is checked, so "view thing" is hidden. The unchecked sibling is what
+        // leaves the group with something for Check All to do.
+        const wrapper = mountForm([
+            group('test', [
+                permission('configure things', { checked: true }),
+                permission('view thing', {
+                    hidden_by: ['configure things'],
+                    children: [permission('delete thing')],
+                }),
+                permission('view other thing'),
+            ]),
+        ]);
+        const test = wrapper.vm.permissions[0];
+
+        expect(wrapper.vm.areAllChecked(test)).toBe(false);
+
+        wrapper.vm.toggleAllInGroup(test);
+
+        expect(wrapper.vm.checkedPermissions).toEqual(['configure things', 'view other thing']);
+    });
+
+    test('checking an empty group checks everything, since nothing is hidden yet', () => {
+        const wrapper = mountForm([collectionsGroup()]);
+        const collections = wrapper.vm.permissions[0];
+
+        wrapper.vm.toggleAllInGroup(collections);
+
+        expect(collections.permissions[0].checked).toBe(true);
+        expect(collections.permissions[1].checked).toBe(true);
+        expect(collections.permissions[1].children[0].checked).toBe(true);
+    });
+
+    test('unchecking clears the whole group, including hidden permissions', () => {
+        const wrapper = mountForm([collectionsGroup({ configure: true, view: true, delete: true })]);
+        const collections = wrapper.vm.permissions[0];
+
+        expect(wrapper.vm.areAllChecked(collections)).toBe(true);
+
+        wrapper.vm.toggleAllInGroup(collections);
+
+        expect(collections.permissions[0].checked).toBe(false);
+        expect(collections.permissions[1].checked).toBe(false);
+        expect(collections.permissions[1].children[0].checked).toBe(false);
+    });
+
+    test('one click always empties a fully checked group', () => {
+        // Check All, then Uncheck All. The group must end up empty, not half revealed.
+        const wrapper = mountForm([collectionsGroup()]);
+        const collections = wrapper.vm.permissions[0];
+
+        wrapper.vm.toggleAllInGroup(collections);
+        expect(wrapper.vm.areAllChecked(collections)).toBe(true);
+
+        wrapper.vm.toggleAllInGroup(collections);
+
+        expect(wrapper.vm.checkedPermissions).toEqual([]);
+        expect(wrapper.vm.areAllChecked(collections)).toBe(false);
+    });
+});
+
+describe('toggleAllInAllGroups', () => {
+    test('checking only checks what is visible in every group', () => {
+        const wrapper = mountForm([
+            collectionsGroup({ configure: true }),
+            group('users', [permission('view users')]),
+        ]);
+
+        wrapper.vm.toggleAllInAllGroups();
+
+        expect(wrapper.vm.checkedPermissions).toEqual(['configure collections', 'view users']);
+    });
+
+    test('checking a permission does not hide the ones checked after it', () => {
+        // Visibility is snapshotted before anything is checked. Reading it as we walk would
+        // let "configure things" hide "view thing" before we reach it.
+        const wrapper = mountForm([
+            group('one', [permission('configure things')]),
+            group('two', [permission('view thing', { hidden_by: ['configure things'] })]),
+        ]);
+
+        wrapper.vm.toggleAllInAllGroups();
+
+        expect(wrapper.vm.checkedPermissions).toEqual(['configure things', 'view thing']);
+    });
+
+    test('unchecking clears every group, including hidden permissions', () => {
+        const wrapper = mountForm([
+            collectionsGroup({ configure: true, view: true, delete: true }),
+            group('users', [permission('view users', { checked: true })]),
+        ]);
+
+        expect(wrapper.vm.areAllCheckedInAllGroups()).toBe(true);
+
+        wrapper.vm.toggleAllInAllGroups();
+
+        expect(wrapper.vm.checkedPermissions).toEqual([]);
+    });
+});
diff --git a/resources/js/tests/components/roles/permissions.test.js b/resources/js/tests/components/roles/permissions.test.js
index aebdf18475b..301d25ee450 100644
--- a/resources/js/tests/components/roles/permissions.test.js
+++ b/resources/js/tests/components/roles/permissions.test.js
@@ -1,5 +1,5 @@
 import { describe, expect, test } from 'vitest';
-import { isVisible, visible } from '@/components/roles/permissions.js';
+import { allVisibleChecked, checkVisible, isVisible, uncheckAll, visible } from '@/components/roles/permissions.js';
 
 const permission = (value, overrides = {}) => ({
     value,
@@ -11,6 +11,13 @@ const permission = (value, overrides = {}) => ({
 
 const values = (permissions) => permissions.map((permission) => permission.value);
 
+const flatten = (permissions) => permissions.flatMap((p) => [p, ...flatten(p.children)]);
+
+const checkedValues = (permissions) =>
+    flatten(permissions)
+        .filter((permission) => permission.checked)
+        .map((permission) => permission.value);
+
 describe('isVisible', () => {
     test('a permission with no hiders is always visible', () => {
         expect(isVisible(permission('one'), [])).toBe(true);
@@ -48,3 +55,85 @@ describe('visible', () => {
         ]);
     });
 });
+
+describe('allVisibleChecked', () => {
+    test('it is true when every visible permission is checked', () => {
+        const permissions = [
+            permission('configure collections', { checked: true }),
+            permission('view blog entries', { hidden_by: ['configure collections'] }),
+        ];
+
+        expect(allVisibleChecked(permissions, ['configure collections'])).toBe(true);
+        expect(allVisibleChecked(permissions, [])).toBe(false);
+    });
+
+    test('it recurses into visible children only', () => {
+        const permissions = [
+            permission('configure collections', { checked: true }),
+            permission('view blog entries', {
+                checked: true,
+                children: [
+                    permission('publish blog entries', { hidden_by: ['configure collections'] }),
+                    permission('delete blog entries', { checked: true }),
+                ],
+            }),
+        ];
+
+        expect(allVisibleChecked(permissions, ['configure collections'])).toBe(true);
+        expect(allVisibleChecked(permissions, [])).toBe(false);
+    });
+
+    test('an unchecked visible permission makes it false', () => {
+        const permissions = [permission('one', { checked: true }), permission('two')];
+
+        expect(allVisibleChecked(permissions, [])).toBe(false);
+    });
+
+    test('an empty set is vacuously true, so callers must guard the top level', () => {
+        expect(allVisibleChecked([], [])).toBe(true);
+    });
+});
+
+describe('checkVisible', () => {
+    test('it checks visible permissions and their visible children', () => {
+        const permissions = [
+            permission('configure collections'),
+            permission('view blog entries', {
+                hidden_by: ['configure collections'],
+                children: [permission('delete blog entries')],
+            }),
+        ];
+
+        checkVisible(permissions, ['configure collections']);
+
+        expect(checkedValues(permissions)).toEqual(['configure collections']);
+    });
+
+    test('it does not let the permissions it checks hide the ones that follow', () => {
+        const permissions = [
+            permission('configure collections'),
+            permission('view blog entries', { hidden_by: ['configure collections'] }),
+        ];
+
+        checkVisible(permissions, []);
+
+        expect(checkedValues(permissions)).toEqual(['configure collections', 'view blog entries']);
+    });
+});
+
+describe('uncheckAll', () => {
+    test('it unchecks everything, including hidden permissions', () => {
+        const permissions = [
+            permission('configure collections', { checked: true }),
+            permission('view blog entries', {
+                checked: true,
+                hidden_by: ['configure collections'],
+                children: [permission('delete blog entries', { checked: true })],
+            }),
+        ];
+
+        uncheckAll(permissions);
+
+        expect(checkedValues(permissions)).toEqual([]);
+    });
+});