beskar 0.0.2 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (90) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +274 -0
  3. data/README.md +412 -204
  4. data/app/channels/concerns/beskar/channels/session_security.rb +46 -0
  5. data/app/controllers/beskar/administrative_actions_controller.rb +16 -0
  6. data/app/controllers/beskar/application_controller.rb +214 -0
  7. data/app/controllers/beskar/banned_ips_controller.rb +255 -0
  8. data/app/controllers/beskar/dashboard_controller.rb +62 -0
  9. data/app/controllers/beskar/security_events_controller.rb +164 -0
  10. data/app/controllers/concerns/beskar/controllers/audit_export.rb +54 -0
  11. data/app/controllers/concerns/beskar/controllers/security_tracking.rb +76 -48
  12. data/app/controllers/concerns/beskar/controllers/session_security.rb +29 -0
  13. data/app/jobs/beskar/notification_job.rb +33 -0
  14. data/app/mailers/beskar/security_mailer.rb +59 -0
  15. data/app/models/beskar/administrative_action.rb +41 -0
  16. data/app/models/beskar/banned_ip.rb +105 -105
  17. data/app/models/beskar/security_event.rb +51 -4
  18. data/app/models/beskar/security_state.rb +58 -0
  19. data/app/services/beskar/banned_ip_manager.rb +88 -0
  20. data/app/views/beskar/administrative_actions/index.html.erb +33 -0
  21. data/app/views/beskar/administrative_actions/show.html.erb +21 -0
  22. data/app/views/beskar/banned_ips/edit.html.erb +195 -0
  23. data/app/views/beskar/banned_ips/index.html.erb +319 -0
  24. data/app/views/beskar/banned_ips/new.html.erb +190 -0
  25. data/app/views/beskar/banned_ips/review.html.erb +24 -0
  26. data/app/views/beskar/banned_ips/show.html.erb +304 -0
  27. data/app/views/beskar/dashboard/index.html.erb +280 -0
  28. data/app/views/beskar/security_events/index.html.erb +302 -0
  29. data/app/views/beskar/security_events/show.html.erb +293 -0
  30. data/app/views/beskar/shared/_export_form.html.erb +10 -0
  31. data/app/views/layouts/beskar/_behavior.html.erb +121 -0
  32. data/app/views/layouts/beskar/application.html.erb +581 -6
  33. data/config/routes.rb +30 -0
  34. data/db/migrate/20251016000001_create_beskar_security_events.rb +3 -3
  35. data/db/migrate/20260910000001_create_beskar_security_states.rb +14 -0
  36. data/db/migrate/20260911000001_create_beskar_administrative_actions.rb +22 -0
  37. data/db/migrate/20260911000002_expand_administrative_action_targets.rb +6 -0
  38. data/docs/README.md +73 -0
  39. data/docs/archive/project-documentation.md +659 -0
  40. data/docs/audits/project-review.md +437 -0
  41. data/docs/audits/repair-status.md +216 -0
  42. data/docs/guides/audit-and-waf.md +175 -0
  43. data/docs/guides/audit-lifecycle.md +172 -0
  44. data/docs/guides/authentication.md +213 -0
  45. data/docs/guides/configuration.md +182 -0
  46. data/docs/guides/dashboard-and-search.md +251 -0
  47. data/docs/guides/notifications-and-recovery.md +157 -0
  48. data/docs/guides/risk-scoring.md +116 -0
  49. data/docs/operations/monitor-only-mode.md +85 -0
  50. data/docs/operations/security-hardening.md +167 -0
  51. data/docs/operations/state-storage.md +144 -0
  52. data/docs/research/rust-performance-assessment.md +69 -0
  53. data/lib/beskar/configuration.rb +105 -20
  54. data/lib/beskar/configuration_validator.rb +188 -0
  55. data/lib/beskar/devise_authentication.rb +24 -0
  56. data/lib/beskar/engine.rb +21 -88
  57. data/lib/beskar/logger.rb +288 -0
  58. data/lib/beskar/middleware/request_analyzer.rb +133 -99
  59. data/lib/beskar/models/security_trackable_authenticable.rb +76 -97
  60. data/lib/beskar/models/security_trackable_devise.rb +34 -25
  61. data/lib/beskar/models/security_trackable_generic.rb +171 -214
  62. data/lib/beskar/risk_level.rb +22 -0
  63. data/lib/beskar/services/account_locker.rb +90 -81
  64. data/lib/beskar/services/administrative_audit.rb +36 -0
  65. data/lib/beskar/services/administrative_bans.rb +104 -0
  66. data/lib/beskar/services/audit_data.rb +72 -0
  67. data/lib/beskar/services/authentication.rb +31 -0
  68. data/lib/beskar/services/authentication_attempt.rb +141 -0
  69. data/lib/beskar/services/ban_expiry.rb +28 -0
  70. data/lib/beskar/services/device_detector.rb +32 -41
  71. data/lib/beskar/services/event_search.rb +58 -0
  72. data/lib/beskar/services/geolocation_service.rb +83 -114
  73. data/lib/beskar/services/ip_whitelist.rb +31 -40
  74. data/lib/beskar/services/location_assessment.rb +109 -0
  75. data/lib/beskar/services/native_account_lock.rb +82 -0
  76. data/lib/beskar/services/notifications.rb +46 -0
  77. data/lib/beskar/services/rate_limiter.rb +99 -125
  78. data/lib/beskar/services/request_context.rb +64 -0
  79. data/lib/beskar/services/risk_assessment.rb +58 -0
  80. data/lib/beskar/services/session_revocation.rb +62 -0
  81. data/lib/beskar/services/waf.rb +311 -198
  82. data/lib/beskar/services/waf_request.rb +60 -0
  83. data/lib/beskar/version.rb +1 -1
  84. data/lib/beskar/warden_authentication.rb +53 -0
  85. data/lib/beskar.rb +54 -4
  86. data/lib/generators/beskar/install/install_generator.rb +158 -0
  87. data/lib/generators/beskar/install/templates/initializer.rb.tt +261 -0
  88. data/lib/tasks/beskar_tasks.rake +25 -20
  89. metadata +93 -12
  90. data/lib/beskar/templates/beskar_initializer.rb +0 -107
data/docs/README.md ADDED
@@ -0,0 +1,73 @@
1
+ # Beskar documentation
2
+
3
+ Start with the current guides and operational contracts below. The original
4
+ review and archived overview describe earlier code; they are not current setup
5
+ instructions. [Repair status](audits/repair-status.md) distinguishes verified
6
+ changes from open findings and production validation still required.
7
+
8
+ ## Start here
9
+
10
+ - **Installing or integrating:** follow the [project README](../README.md#installation),
11
+ then read [configuration](guides/configuration.md),
12
+ [authentication](guides/authentication.md), and [state storage](operations/state-storage.md).
13
+ - **Upgrading an existing installation:** use the
14
+ [security hardening and rollout checklist](operations/security-hardening.md#rollout).
15
+ - **Working on repairs:** consult [repair status](audits/repair-status.md) and the
16
+ [original findings](audits/project-review.md) before selecting work.
17
+
18
+ ## Guides
19
+
20
+ - [Configuration](guides/configuration.md) — validation, supported capabilities,
21
+ defaults, and audited runtime changes.
22
+ - [Authentication](guides/authentication.md) — Devise/Warden admission, native
23
+ session integration, account locks, and revocation boundaries.
24
+ - [Risk scoring](guides/risk-scoring.md) — factors, geographic evidence, and
25
+ heuristic limitations.
26
+ - [Audit data and WAF](guides/audit-and-waf.md) — filtering, exports, scanner
27
+ matching, and privacy boundaries.
28
+ - [Audit lifecycle](guides/audit-lifecycle.md) — unchanged event retention,
29
+ administrative permissions, actor/reason history, and migrations.
30
+ - [Dashboard and search](guides/dashboard-and-search.md) — reporting, search,
31
+ routes, forms, timezones, and browser/CSP behavior.
32
+ - [Notifications and recovery](guides/notifications-and-recovery.md) — opt-in
33
+ delivery jobs and host-owned recovery flows.
34
+
35
+ ## Operations
36
+
37
+ - [State storage](operations/state-storage.md) — database authority, cache
38
+ independence, concurrency, rate limits, cleanup, and rollout.
39
+ - [Monitor-only mode](operations/monitor-only-mode.md) — observation behavior and
40
+ the transition to enforcement.
41
+ - [Security hardening](operations/security-hardening.md) — authentication
42
+ coverage, deployment requirements, availability tradeoffs, and validation gates.
43
+
44
+ ## Audits and repair tracking
45
+
46
+ - [Repair status](audits/repair-status.md) — completed batches, test evidence,
47
+ unresolved findings, and next verification gates.
48
+ - [Original project review](audits/project-review.md) — the September 2026
49
+ diagnostic baseline and F01–F26 findings; preserved as historical evidence.
50
+
51
+ ## Research and historical reference
52
+
53
+ - [Rust performance assessment](research/rust-performance-assessment.md) — a
54
+ measured investigation and proposal, not an implemented feature or performance
55
+ guarantee.
56
+ - [Archived project overview](archive/project-documentation.md) — the
57
+ pre-remediation architecture and examples; do not use it as current guidance.
58
+ - [Changelog](../CHANGELOG.md) — historical release notes.
59
+
60
+ ## Maintaining these docs
61
+
62
+ Keep `README.md` and `CHANGELOG.md` at the repository root. Put current feature
63
+ guides in `guides/`, deployment/runtime contracts in `operations/`, findings and
64
+ progress in `audits/`, proposals in `research/`, and superseded references in
65
+ `archive/`. Use lowercase, hyphenated filenames and relative Markdown links.
66
+ Source paths mentioned in prose are relative to the repository root.
67
+
68
+ Add new documents to this index. The gem includes `docs/**/*.md`; link/index and
69
+ packaging regressions run with:
70
+
71
+ ```sh
72
+ mise exec -- env PARALLEL_WORKERS=1 bin/rails test test/documentation_test.rb
73
+ ```