beskar 0.0.2 → 0.2.0

data/lib/beskar/engine.rb

@@ -6,105 +6,38 @@ module Beskar
       app.config.middleware.use ::Beskar::Middleware::RequestAnalyzer
     end
 
-    # Preload banned IPs into cache on startup
-    config.after_initialize do
-      if defined?(Beskar::BannedIp)
-        Rails.application.executor.wrap do
-          Beskar::BannedIp.preload_cache!
-          Rails.logger.info "[Beskar] Preloaded banned IPs into cache"
-        rescue => e
-          Rails.logger.warn "[Beskar] Failed to preload banned IPs: #{e.message}"
-        end
+    initializer "beskar.warden_callbacks", after: :load_config_initializers do
+      if defined?(Devise)
+        require "devise/strategies/database_authenticatable"
+        Devise::Strategies::DatabaseAuthenticatable.prepend(Beskar::DeviseAuthentication)
       end
-    end
 
-    initializer "beskar.warden_callbacks", after: :load_config_initializers do |app|
       if defined?(Warden)
-        # Track successful authentication and check for high-risk locks
-        Warden::Manager.after_set_user except: :fetch do |user, auth, opts|
-          # Only proceed if Beskar security tracking is available and enabled
-          if user.respond_to?(:track_authentication_event) && auth.request
-            # Track the authentication event (creates security event)
-            security_event = user.track_authentication_event(auth.request, :success)
-
-            # Check if account was locked due to high risk (only if immediate_signout is enabled)
-            # This happens AFTER successful authentication but BEFORE the request completes
-            # Requires :lockable module to be enabled on the user model
-            if Beskar.configuration.immediate_signout? &&
-               Beskar.configuration.risk_based_locking_enabled? &&
-               security_event &&
-               user_was_just_locked?(user, security_event) &&
-               user.respond_to?(:access_locked?) && user.access_locked?
-              Rails.logger.warn "[Beskar] Signing out user #{user.id} due to high-risk lock"
-              auth.logout
-              throw :warden, scope: opts[:scope], message: :account_locked_due_to_high_risk
-            end
-          end
-        end
-
-        # Alternative approach using after_authentication is available but not enabled by default
-        # Uncomment this to use the alternative approach (more targeted, only on authentication)
-        # Warden::Manager.after_authentication do |user, auth, opts|
-        #   if user.respond_to?(:check_high_risk_lock_and_signout)
-        #     user.check_high_risk_lock_and_signout(auth)
-        #   end
-        # end
+        Warden::Strategies::Base.prepend(Beskar::WardenStrategyAdmission)
+        Warden::Proxy.prepend(Beskar::WardenSessionAdmission)
 
         Warden::Manager.before_failure do |env, opts|
-          if env
-            request = ActionDispatch::Request.new(env)
-            scope = opts[:scope]
-            
-            # Try to get model class from configuration
-            model_class = Beskar.configuration&.model_class_for_scope(scope)
-            
-            if model_class && model_class.respond_to?(:track_failed_authentication)
-              model_class.track_failed_authentication(request, scope)
-            else
-              Rails.logger.debug "[Beskar] No trackable model found for scope: #{scope}"
-            end
-          end
+          next unless env
+          request = ActionDispatch::Request.new(env)
+          attempt = Services::AuthenticationAttempt.current(request, opts[:scope])
+          next unless attempt && !attempt.completed
+          model = Beskar.configuration.model_class_for_scope(opts[:scope])
+          model.track_failed_authentication(request, opts[:scope], attempt: attempt) if model&.respond_to?(:track_failed_authentication)
         end
       end
     end
 
-    # Helper method to check if user was just locked
-    def self.user_was_just_locked?(user, security_event)
-      return false unless Beskar.configuration.risk_based_locking_enabled?
-      return false unless security_event
-      return false unless user&.respond_to?(:security_events)
-
-      # Check if an account_locked or lock_attempted event was just created
-      recent_lock = user.security_events
-        .where(event_type: [ "account_locked", "lock_attempted" ])
-        .where("created_at >= ?", 10.seconds.ago)
-        .order(created_at: :desc)
-        .first
-
-      recent_lock.present?
+    initializer "beskar.register_configuration_validation", after: :load_config_initializers do |app|
+      # Register after host configuration files, so their after_initialize hooks
+      # precede this one. Resolve app/jobs only after the main autoloader is ready.
+      app.config.after_initialize { Beskar.configuration.validate!.seal! }
     end
 
-    # Add engine migrations to host app's migration paths
-    initializer "beskar.append_migrations" do |app|
-      # Don't add migrations if we're inside the engine itself (testing)
-      if !root.to_s.include?(app.root.to_s) && !app.root.to_s.include?(root.to_s)
-        engine_migrations = root.join("db", "migrate").to_s
-
-        # Add to Rails paths
-        app.config.paths["db/migrate"] << engine_migrations
-      end
+    # Compatibility helper: only the current attempt's actual lock qualifies.
+    def self.user_was_just_locked?(user, security_event)
+      return false unless Beskar.configuration.risk_based_locking_enabled?
+      attempt = security_event&.beskar_attempt
+      !!(attempt && attempt.user == user && attempt.locked_now)
     end
-
-    # Ensure ActiveRecord sees the engine migrations after initialization
-    # config.after_initialize do |app|
-    #   unless root.to_s.include?(app.root.to_s)
-    #     engine_migrations = root.join("db", "migrate").to_s
-
-    #     # Update ActiveRecord::Tasks paths
-    #     current_paths = Array(ActiveRecord::Tasks::DatabaseTasks.migrations_paths)
-    #     current_paths << engine_migrations
-    #     ActiveRecord::Tasks::DatabaseTasks.migrations_paths = current_paths.uniq
-    #   end
-    # end
   end
 end

data/lib/beskar/logger.rb

@@ -0,0 +1,288 @@
+# frozen_string_literal: true
+
+module Beskar
+  # Centralized logging module for consistent log formatting and flexible output handling
+  module Logger
+    class << self
+      # Available log levels
+      LOG_LEVELS = %i[debug info warn error fatal].freeze
+
+      # Generate logging methods for each level
+      LOG_LEVELS.each do |level|
+        define_method(level) do |message, component: nil|
+          log(level, message, component: component)
+        end
+      end
+
+      # Main logging method that handles formatting and output
+      #
+      # @param level [Symbol] The log level (:debug, :info, :warn, :error, :fatal)
+      # @param message [String] The message to log
+      # @param component [String, Symbol, nil] Optional component name for more specific prefixes
+      #
+      # @example Basic usage
+      #   Beskar::Logger.info("User authenticated successfully")
+      #   # => [Beskar] User authenticated successfully
+      #
+      # @example With component
+      #   Beskar::Logger.warn("Rate limit exceeded", component: :WAF)
+      #   # => [Beskar::WAF] Rate limit exceeded
+      #
+      # @example With class as component
+      #   Beskar::Logger.error("Failed to lock account", component: self.class)
+      #   # => [Beskar::AccountLocker] Failed to lock account
+      def log(level, message, component: nil)
+        return unless should_log?(level)
+
+        formatted_message = format_message(message, component)
+        logger.send(level, formatted_message)
+      rescue => e
+        # Fallback to stderr if logging fails
+        Kernel.warn "[Beskar::Logger] Logging unavailable (#{e.class})"
+      end
+
+      # Configure the logger instance
+      #
+      # @param logger_instance [Logger, nil] The logger to use, defaults to Rails.logger
+      attr_writer :logger
+
+      # Get the current logger instance
+      #
+      # @return [Logger] The configured logger or Rails.logger as default
+      def logger
+        @logger ||= default_logger
+      end
+
+      # Configure log level threshold
+      #
+      # @param level [Symbol, String] Minimum log level to output
+      def level=(level)
+        @level = level.to_sym if LOG_LEVELS.include?(level.to_sym)
+      end
+
+      # Get the current log level
+      #
+      # @return [Symbol] Current log level
+      def level
+        @level ||= :debug
+      end
+
+      # Reset logger configuration to defaults
+      def reset!
+        @logger = nil
+        @level = nil
+        @component_aliases = nil
+      end
+
+      # Configure component name aliases for cleaner output
+      #
+      # @param aliases [Hash] Mapping of classes/modules to display names
+      #
+      # @example
+      #   Beskar::Logger.component_aliases = {
+      #     'Beskar::Services::Waf' => 'WAF',
+      #     'Beskar::Services::AccountLocker' => 'AccountLocker'
+      #   }
+      attr_writer :component_aliases
+
+      # Get component aliases
+      #
+      # @return [Hash] Current component aliases
+      def component_aliases
+        @component_aliases ||= default_component_aliases
+      end
+
+      private
+
+      # Format the log message with appropriate prefix
+      #
+      # @param message [String] The message to format
+      # @param component [String, Symbol, Class, nil] Component identifier
+      # @return [String] Formatted message with prefix
+      def format_message(message, component)
+        prefix = build_prefix(component)
+        "#{prefix} #{message}"
+      end
+
+      # Build the log prefix based on component
+      #
+      # @param component [String, Symbol, Class, nil] Component identifier
+      # @return [String] Formatted prefix
+      def build_prefix(component)
+        return "[Beskar]" if component.nil?
+
+        component_name = normalize_component_name(component)
+
+        if component_name.nil? || component_name.empty?
+          "[Beskar]"
+        else
+          "[Beskar::#{component_name}]"
+        end
+      end
+
+      # Normalize component name from various input types
+      #
+      # @param component [String, Symbol, Class] Component identifier
+      # @return [String, nil] Normalized component name
+      def normalize_component_name(component)
+        case component
+        when String
+          apply_component_alias(component)
+        when Symbol
+          component.to_s
+        when Class
+          apply_component_alias(component.name)
+        when Module
+          apply_component_alias(component.name)
+        else
+          component.to_s
+        end
+      end
+
+      # Apply component alias if configured
+      #
+      # @param component_name [String] Original component name
+      # @return [String] Aliased name or original
+      def apply_component_alias(component_name)
+        return nil if component_name.nil?
+
+        # First check exact matches
+        aliased = component_aliases[component_name]
+        return aliased if aliased
+
+        # Remove Beskar:: prefix if present for lookup
+        clean_name = component_name.sub(/^Beskar::/, "")
+        aliased = component_aliases[clean_name]
+        return aliased if aliased
+
+        # Check if it's already a simple component name (no ::)
+        return clean_name unless clean_name.include?("::")
+
+        # Extract the last component for nested classes
+        # e.g., "Beskar::Services::Waf" -> "Waf"
+        last_component = clean_name.split("::").last
+        component_aliases[clean_name] || last_component
+      end
+
+      # Check if message should be logged based on current level
+      #
+      # @param message_level [Symbol] Level of the message
+      # @return [Boolean] True if message should be logged
+      def should_log?(message_level)
+        level_value(message_level) >= level_value(level)
+      end
+
+      # Convert log level to numeric value for comparison
+      #
+      # @param level_sym [Symbol] Log level
+      # @return [Integer] Numeric value
+      def level_value(level_sym)
+        LOG_LEVELS.index(level_sym) || 0
+      end
+
+      # Get the default logger instance
+      #
+      # @return [Logger] Default logger (Rails.logger or stdlib Logger)
+      def default_logger
+        if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+          Rails.logger
+        else
+          require "logger"
+          ::Logger.new($stdout)
+        end
+      end
+
+      # Default component name aliases for cleaner output
+      #
+      # @return [Hash] Default aliases
+      def default_component_aliases
+        {
+          "Beskar::Services::Waf" => "WAF",
+          "Beskar::Services::WAF" => "WAF",
+          "Services::Waf" => "WAF",
+          "Services::WAF" => "WAF",
+          "Beskar::Services::AccountLocker" => "AccountLocker",
+          "Services::AccountLocker" => "AccountLocker",
+          "Beskar::Services::RateLimiter" => "RateLimiter",
+          "Services::RateLimiter" => "RateLimiter",
+          "Beskar::Services::IpWhitelist" => "IpWhitelist",
+          "Services::IpWhitelist" => "IpWhitelist",
+          "Beskar::Services::GeolocationService" => "GeolocationService",
+          "Services::GeolocationService" => "GeolocationService",
+          "Beskar::Services::DeviceDetector" => "DeviceDetector",
+          "Services::DeviceDetector" => "DeviceDetector",
+          "Beskar::Middleware::RequestAnalyzer" => "Middleware",
+          "Middleware::RequestAnalyzer" => "Middleware",
+          "Beskar::Models::SecurityTrackableDevise" => "SecurityTracking",
+          "Models::SecurityTrackableDevise" => "SecurityTracking",
+          "Beskar::Models::SecurityTrackableAuthenticable" => "SecurityTracking",
+          "Models::SecurityTrackableAuthenticable" => "SecurityTracking",
+          "Beskar::Models::SecurityTrackableGeneric" => "SecurityTracking",
+          "Models::SecurityTrackableGeneric" => "SecurityTracking"
+        }
+      end
+    end
+
+    # Module to include in classes for instance-level logging
+    module ClassMethods
+      # Log a debug message with automatic component detection
+      def log_debug(message)
+        Beskar::Logger.debug(message, component: self)
+      end
+
+      # Log an info message with automatic component detection
+      def log_info(message)
+        Beskar::Logger.info(message, component: self)
+      end
+
+      # Log a warning message with automatic component detection
+      def log_warn(message)
+        Beskar::Logger.warn(message, component: self)
+      end
+
+      # Log an error message with automatic component detection
+      def log_error(message)
+        Beskar::Logger.error(message, component: self)
+      end
+
+      # Log a fatal message with automatic component detection
+      def log_fatal(message)
+        Beskar::Logger.fatal(message, component: self)
+      end
+    end
+
+    # Module to include in classes for instance-level logging
+    module InstanceMethods
+      # Log a debug message with automatic component detection
+      def log_debug(message)
+        Beskar::Logger.debug(message, component: self.class)
+      end
+
+      # Log an info message with automatic component detection
+      def log_info(message)
+        Beskar::Logger.info(message, component: self.class)
+      end
+
+      # Log a warning message with automatic component detection
+      def log_warn(message)
+        Beskar::Logger.warn(message, component: self.class)
+      end
+
+      # Log an error message with automatic component detection
+      def log_error(message)
+        Beskar::Logger.error(message, component: self.class)
+      end
+
+      # Log a fatal message with automatic component detection
+      def log_fatal(message)
+        Beskar::Logger.fatal(message, component: self.class)
+      end
+    end
+
+    # Convenience method to include both class and instance methods
+    def self.included(base)
+      base.extend(ClassMethods)
+      base.include(InstanceMethods)
+    end
+  end
+end