beskar 0.0.2 → 0.2.0

data/lib/beskar/middleware/request_analyzer.rb

@@ -7,78 +7,122 @@ module Beskar
 
       def call(env)
         request = ActionDispatch::Request.new(env)
-        ip_address = request.ip
+        ip_address = Beskar::Services::RequestContext.ip(request)
+
+        Beskar::Logger.debug("[RequestAnalyzer] Processing request from IP: #{ip_address}", component: :Middleware)
 
         # 1. Check if IP is whitelisted (whitelisted IPs skip blocking but still get logged)
         is_whitelisted = Beskar::Services::IpWhitelist.whitelisted?(ip_address)
 
-        # 2. Check if IP is banned (early exit for blocked IPs, unless whitelisted)
+        # 2. Check if IP is banned (early exit for blocked IPs, unless whitelisted or in monitor-only mode)
         if !is_whitelisted && Beskar::BannedIp.banned?(ip_address)
-          Rails.logger.warn "[Beskar::Middleware] Blocked request from banned IP: #{ip_address}"
-          return blocked_response("Your IP address has been blocked due to suspicious activity.")
+          if Beskar.configuration.monitor_only?
+            Beskar::Logger.warn("🔍 MONITOR-ONLY: Would block request from banned IP: #{ip_address}, but monitor_only=true. Request proceeding normally.", component: :Middleware)
+          else
+            Beskar::Logger.warn("Blocked request from banned IP: #{ip_address}", component: :Middleware)
+            return blocked_response("Your IP address has been blocked due to suspicious activity.")
+          end
         end
 
         # 3. Check rate limiting (unless whitelisted)
-        if !is_whitelisted && rate_limited?(request)
-          Rails.logger.warn "[Beskar::Middleware] Rate limit exceeded for IP: #{ip_address}"
-          
-          # Auto-block after excessive rate limiting violations
-          if should_auto_block_rate_limit?(ip_address)
+        rate_limit = Beskar.configuration.rate_limiting[:ip_attempts][:block_requests] ?
+          Beskar::Services::RateLimiter.check_ip_rate_limit(ip_address) : {allowed: true}
+        if !is_whitelisted && !rate_limit[:allowed]
+          # Observe denials separately in monitor mode; never create active bans.
+          if should_auto_block_rate_limit?(ip_address) && !Beskar.configuration.monitor_only?
             Beskar::BannedIp.ban!(
               ip_address,
-              reason: 'rate_limit_abuse',
+              reason: "rate_limit_abuse",
               duration: 1.hour,
-              details: 'Excessive rate limit violations'
+              details: "Excessive rate limit violations"
             )
           end
-          
-          return rate_limit_response
+
+          if Beskar.configuration.monitor_only?
+            Beskar::Logger.warn("🔍 MONITOR-ONLY: Would block rate limit exceeded for IP: #{ip_address}, but monitor_only=true. Request proceeding normally.", component: :Middleware)
+          else
+            Beskar::Logger.warn("Rate limit exceeded for IP: #{ip_address}", component: :Middleware)
+            return rate_limit_response(rate_limit[:retry_after])
+          end
         end
 
         # 4. Check WAF patterns (vulnerability scans)
         if Beskar.configuration.waf_enabled?
+          Beskar::Logger.debug("[RequestAnalyzer] WAF enabled, analyzing request", component: :Middleware)
           waf_analysis = Beskar::Services::Waf.analyze_request(request)
-          
+
           if waf_analysis
+            Beskar::Logger.debug("[RequestAnalyzer] WAF detected threat: #{waf_analysis[:patterns].map { |p| p[:description] }.join(", ")}", component: :Middleware)
             # Log the violation (and create security event if configured)
             # Pass whitelist status to prevent auto-blocking whitelisted IPs
-            violation_count = Beskar::Services::Waf.record_violation(ip_address, waf_analysis, whitelisted: is_whitelisted)
-            
+            current_score = Beskar::Services::Waf.record_violation(ip_address, waf_analysis, whitelisted: is_whitelisted)
+            waf_recorded = true
+            Beskar::Logger.debug("[RequestAnalyzer] Current score after recording: #{current_score.round(2)}", component: :Middleware)
+
             # Log even for whitelisted IPs (but don't block)
             if is_whitelisted
-              Rails.logger.info(
-                "[Beskar::Middleware] WAF violation from whitelisted IP #{ip_address} " \
-                "(not blocking): #{waf_analysis[:patterns].map { |p| p[:description] }.join(', ')}"
-              )
+              Beskar::Logger.info("WAF violation from whitelisted IP #{ip_address} " \
+                "(not blocking): #{waf_analysis[:patterns].map { |p| p[:description] }.join(", ")}", component: :Middleware)
             else
               # Check if we should block
               should_block = Beskar::Services::Waf.should_block?(ip_address)
-              
-              if Beskar.configuration.waf_monitor_only?
-                # Monitor-only mode: Just log, don't block
+              Beskar::Logger.debug("[RequestAnalyzer] Should block IP #{ip_address}?: #{should_block}", component: :Middleware)
+
+              if Beskar.configuration.monitor_only?
+                # Monitor-only mode records observations without creating active bans.
                 if should_block
-                  Rails.logger.warn(
-                    "[Beskar::Middleware] 🔍 MONITOR-ONLY: Would block IP #{ip_address} " \
-                    "after #{violation_count} WAF violations, but monitor_only=true. " \
-                    "Request proceeding normally."
-                  )
+                  Beskar::Logger.warn("🔍 MONITOR-ONLY: Would block IP #{ip_address} " \
+                    "with score #{current_score.round(2)}, but monitor_only=true. " \
+                    "Request proceeding normally.", component: :Middleware)
                 end
-              elsif should_block
-                # Actually block the request
-                Rails.logger.warn(
-                  "[Beskar::Middleware] 🔒 Blocking IP #{ip_address} " \
-                  "after #{violation_count} WAF violations"
-                )
+              elsif should_block && !Beskar.configuration.monitor_only?
+                # Actually block the request (not in monitor-only mode)
+                Beskar::Logger.warn("🔒 Blocking IP #{ip_address} " \
+                  "with WAF score #{current_score.round(2)}", component: :Middleware)
                 # Block already handled by WAF.record_violation auto-block logic
                 # But we return 403 immediately
                 return blocked_response("Access denied due to suspicious activity.")
               end
             end
+          else
+            Beskar::Logger.debug("[RequestAnalyzer] No WAF threat detected", component: :Middleware)
           end
+        else
+          Beskar::Logger.debug("[RequestAnalyzer] WAF is disabled", component: :Middleware)
         end
 
         # 5. Process the request normally (will raise 404 if route not found)
+        Beskar::Logger.debug("[RequestAnalyzer] Passing request to application", component: :Middleware)
+        processing_host = true
         @app.call(env)
+      rescue Beskar::Services::AuthenticationAttempt::Unavailable
+        Beskar::Services::AuthenticationAttempt.unavailable_response
+      rescue ActionController::UnknownFormat => e
+        # Analyze unknown format as potential scanner
+        if Beskar.configuration.waf_enabled?
+          handle_rails_exception(request, e, ip_address, is_whitelisted) unless waf_recorded
+        end
+        # Re-raise to allow normal error handling
+        raise
+      rescue ActionDispatch::RemoteIp::IpSpoofAttackError => e
+        # Attribute downstream errors only when Rails already resolved a trusted
+        # client IP. Never ban an address from a rejected proxy chain.
+        handle_rails_exception(request, e, ip_address, is_whitelisted) if !waf_recorded && ip_address && Beskar.configuration.waf_enabled?
+        raise
+      rescue ActiveRecord::RecordNotFound => e
+        # Analyze record not found as potential enumeration scan
+        if Beskar.configuration.waf_enabled?
+          handle_rails_exception(request, e, ip_address, is_whitelisted) unless waf_recorded
+        end
+        # Re-raise to allow normal error handling
+        raise
+      rescue ActionDispatch::Http::MimeNegotiation::InvalidType => e
+        # Analyze invalid MIME type as potential scanner
+        if Beskar.configuration.waf_enabled?
+          handle_rails_exception(request, e, ip_address, is_whitelisted) unless waf_recorded
+        end
+        # Re-raise to allow normal error handling
+        raise
       rescue ActionController::RoutingError => e
         # If WAF is enabled, log 404s as potential scanning attempts
         if Beskar.configuration.waf_enabled?
@@ -86,79 +130,69 @@ module Beskar
         end
         # Re-raise to allow normal 404 handling
         raise
+      rescue ActiveRecord::ActiveRecordError => error
+        raise if processing_host
+        Beskar::Logger.warn("Request security state unavailable (#{error.class})")
+        Beskar::Services::AuthenticationAttempt.unavailable_response
       end
 
       private
 
-      def rate_limited?(request)
-        # Check both IP rate limit and authentication abuse
-        ip_check = Beskar::Services::RateLimiter.check_ip_rate_limit(request.ip)
-        auth_abused = authentication_brute_force?(request.ip)
-        
-        !ip_check[:allowed] || auth_abused
-      end
-
       def should_auto_block_rate_limit?(ip_address)
-        # Check how many times this IP has been rate limited in the past hour
-        cache_key = "beskar:rate_limit_violations:#{ip_address}"
-        violations = Rails.cache.read(cache_key) || 0
-        violations += 1
-        Rails.cache.write(cache_key, violations, expires_in: 1.hour)
-        
-        # Block after 5 rate limit violations in an hour
-        violations >= 5
+        mode = Beskar.configuration.monitor_only? ? "observe" : "enforce"
+        key = "rate_denials:#{mode}:#{ip_address}"
+        Beskar::SecurityState.mutate(key, ttl: 1.hour) do |state|
+          data = state.fetch(key)
+          now = Time.current.to_f
+          # A fixed window: repeated requests cannot prolong old violations.
+          data.clear if data["window_end"] && data["window_end"] <= now
+          data["window_end"] ||= now + 1.hour
+          data["count"] = [data.fetch("count", 0) + 1, 5].min
+          data["count"] >= 5
+        end
       end
 
-      def authentication_brute_force?(ip_address)
-        # Check authentication failure count from RateLimiter
-        cache_key = "beskar:ip_auth_failures:#{ip_address}"
-        
-        # Get current failure count and timestamp
-        failure_data = Rails.cache.read(cache_key)
-        return false unless failure_data.is_a?(Hash)
-        
-        # Count recent failures (within the configured period)
-        config = Beskar.configuration.rate_limiting[:ip_attempts] || {}
-        period = config[:period] || 1.hour
-        limit = config[:limit] || 10
-        
-        now = Time.current.to_i
-        recent_failures = failure_data.select { |timestamp, _| now - timestamp.to_i < period.to_i }
-        
-        # If too many auth failures, it's brute force
-        if recent_failures.length >= limit
-          # Auto-ban for authentication abuse
-          Beskar::BannedIp.ban!(
-            ip_address,
-            reason: 'authentication_abuse',
-            duration: 1.hour,
-            details: "#{recent_failures.length} failed authentication attempts in #{period / 60} minutes",
-            metadata: { failure_count: recent_failures.length, detection_time: Time.current }
-          )
-          
-          Rails.logger.warn(
-            "[Beskar::Middleware] 🔒 Auto-blocked IP #{ip_address} " \
-            "for authentication brute force (#{recent_failures.length} failures)"
-          )
-          
-          return true
+      def handle_rails_exception(request, exception, ip_address, is_whitelisted)
+        # Analyze the exception using WAF
+        waf_analysis = Beskar::Services::Waf.analyze_exception(exception, request)
+
+        if waf_analysis
+          Beskar::Logger.debug("[RequestAnalyzer] WAF detected threat from exception: #{exception.class.name}", component: :Middleware)
+
+          # Record the violation (similar to regular WAF violations)
+          current_score = Beskar::Services::Waf.record_violation(ip_address, waf_analysis, whitelisted: is_whitelisted)
+
+          # Log for whitelisted IPs
+          if is_whitelisted
+            Beskar::Logger.info("Exception-based WAF violation from whitelisted IP #{ip_address} " \
+              "(not blocking): #{exception.class.name} - #{waf_analysis[:patterns].first[:description]}", component: :Middleware)
+          else
+            # Check if we should block
+            should_block = Beskar::Services::Waf.should_block?(ip_address)
+
+            if Beskar.configuration.monitor_only?
+              if should_block
+                Beskar::Logger.warn("🔍 MONITOR-ONLY: Would block IP #{ip_address} " \
+                  "with score #{current_score.round(2)} (exception: #{exception.class.name}), " \
+                  "but monitor_only=true. Request proceeding normally.", component: :Middleware)
+              end
+            elsif should_block && !Beskar.configuration.monitor_only?
+              Beskar::Logger.warn("🔒 Blocking IP #{ip_address} " \
+                "with score #{current_score.round(2)} (exception: #{exception.class.name})", component: :Middleware)
+              # Note: We don't return blocked response here as exception is already raised
+              # The ban record is created by WAF.record_violation
+            end
+          end
         end
-        
-        false
       end
 
       def log_404_for_waf(request, error)
-        # 404s on suspicious paths might indicate scanning
-        path = request.fullpath || request.path
-        
         # Only log if it matches WAF patterns (already analyzed in analyze_request)
         waf_analysis = Beskar::Services::Waf.analyze_request(request)
-        
+
         if waf_analysis
-          Rails.logger.info(
-            "[Beskar::Middleware] 404 on suspicious path from #{request.ip}: #{path} " \
-            "(WAF patterns: #{waf_analysis[:patterns].map { |p| p[:description] }.join(', ')})"
-          )
+          Beskar::Logger.info("404 matching WAF rules from #{Beskar::Services::RequestContext.ip(request)} " \
+            "(WAF patterns: #{waf_analysis[:patterns].map { |p| p[:description] }.join(", ")})", component: :Middleware)
         end
       end
 
@@ -166,20 +200,20 @@ module Beskar
         [
           403,
           {
-            "Content-Type" => "text/html",
-            "X-Beskar-Blocked" => "true"
+            "content-type" => "text/html; charset=utf-8",
+            "x-beskar-blocked" => "true"
           },
           [render_blocked_page(message)]
         ]
       end
 
-      def rate_limit_response
+      def rate_limit_response(retry_after)
         [
           429,
           {
-            "Content-Type" => "text/html",
-            "Retry-After" => "3600",
-            "X-Beskar-Rate-Limited" => "true"
+            "content-type" => "text/html; charset=utf-8",
+            "retry-after" => [retry_after.to_i, 1].max.to_s,
+            "x-beskar-rate-limited" => "true"
           },
           [render_rate_limit_page]
         ]

data/lib/beskar/models/security_trackable_authenticable.rb

@@ -16,17 +16,31 @@ module Beskar
 
       # Make handle_high_risk_lock public (it's private in Generic)
       public
-      
+
+      def beskar_access_locked?
+        Services::NativeAccountLock.locked?(self)
+      end
+
+      def beskar_access_allowed?(request)
+        !Services::RequestContext.enforce?(Services::RequestContext.ip(request)) || !beskar_access_locked?
+      end
+
+      def with_beskar_session(request, generation: nil, &block)
+        Services::NativeAccountLock.with_session(self, request, generation: generation, &block)
+      end
+
       # Rails 8 auth-specific: Handle high risk lock by destroying sessions
       # Public method called when high-risk event is detected
       def handle_high_risk_lock(security_event, request)
+        return unless Services::RequestContext.enforce?(Services::RequestContext.ip(request))
+        return unless beskar_access_locked?
         reason = determine_lock_reason(security_event)
-        
-        Rails.logger.warn "[Beskar] Rails auth high-risk lock detected: #{reason}"
-        
-        # Destroy all sessions to immediately lock out attacker
-        destroy_all_sessions(except: request.session.id)
-        
+
+        Beskar::Logger.warn("Rails auth high-risk lock detected: #{reason}")
+
+        # NativeAccountLock already revoked every database session atomically
+        # with the lock. A Rack session ID is not a sessions-table primary key.
+
         # Check if this warrants emergency password reset
         if should_reset_password?(security_event, reason)
           perform_emergency_password_reset(security_event, reason)
@@ -39,128 +53,93 @@ module Beskar
           if except
             # Keep current session but destroy all others
             sessions.where.not(id: except).destroy_all
-            Rails.logger.info "[Beskar] Destroyed #{sessions.count} sessions except current"
+            Beskar::Logger.info("Destroyed #{sessions.count} sessions except current")
           else
             # Destroy ALL sessions including current
             count = sessions.count
             sessions.destroy_all
-            Rails.logger.info "[Beskar] Destroyed all #{count} sessions"
+            Beskar::Logger.info("Destroyed all #{count} sessions")
           end
         else
-          Rails.logger.warn "[Beskar] Model does not have sessions association, cannot destroy sessions"
+          Beskar::Logger.warn("Model does not have sessions association, cannot destroy sessions")
         end
       rescue => e
-        Rails.logger.error "[Beskar] Failed to destroy sessions: #{e.message}"
+        Beskar::Logger.error("Failed to destroy sessions: #{e.class}")
       end
 
       # Determine if emergency password reset is warranted
       def should_reset_password?(security_event, reason)
         config = Beskar.configuration.emergency_password_reset
         return false unless config[:enabled]
+        return false unless Services::RequestContext.enforce?(security_event.ip_address)
 
-        case reason
-        when :impossible_travel
-          # Count impossible travel events in recent history
-          recent_impossible_travel = security_events
-            .where(event_type: ["account_locked", "login_success"])
-            .where("created_at >= ?", 24.hours.ago)
-            .where("metadata->>'geolocation' LIKE ?", '%impossible_travel%')
-            .count
-          
-          recent_impossible_travel >= (config[:impossible_travel_threshold] || 3)
-          
-        when :suspicious_device
-          # Multiple suspicious device logins
-          recent_suspicious = security_events
-            .where(event_type: "account_locked")
-            .where("created_at >= ?", 24.hours.ago)
-            .where("metadata->>'device_info' LIKE ?", '%suspicious%')
-            .count
-          
-          recent_suspicious >= (config[:suspicious_device_threshold] || 5)
-          
-        else
-          # For other reasons, check total lock count
-          recent_locks = security_events
-            .where(event_type: "account_locked")
-            .where("created_at >= ?", 24.hours.ago)
-            .count
-          
-          recent_locks >= (config[:total_locks_threshold] || 5)
+        events = security_events.where(event_type: "account_locked")
+          .where("created_at >= ?", 24.hours.ago)
+        threshold = case reason
+        when :impossible_travel then config[:impossible_travel_threshold] || 3
+        when :suspicious_device then config[:suspicious_device_threshold] || 5
+        else config[:total_locks_threshold] || 5
         end
+
+        count = 0
+        events.find_each do |event|
+          data = (event.metadata || {}).deep_stringify_keys
+          context = data["additional_context"] || {}
+          matches = case reason
+          when :impossible_travel
+            data["reason"] == "impossible_travel" ||
+              data.dig("geolocation", "impossible_travel") == true ||
+              context.dig("geolocation", "impossible_travel") == true
+          when :suspicious_device
+            data["reason"] == "suspicious_device" ||
+              data.dig("device_info", "suspicious") == true ||
+              context.dig("device_info", "suspicious") == true
+          else true
+          end
+          count += 1 if matches
+          return true if count >= threshold
+        end
+        false
       end
 
-      # Perform emergency password reset
+      # Password invalidation and its mandatory recovery audit are one transaction.
+      # Notification hooks run after commit, never inside a retryable state block.
       def perform_emergency_password_reset(security_event, reason)
         config = Beskar.configuration.emergency_password_reset
-        
-        # Generate a cryptographically secure random password
-        new_password = SecureRandom.base58(32)
-        
-        begin
-          # Update password
+        return false unless config[:enabled]
+        return false unless Services::RequestContext.enforce?(security_event.ip_address)
+
+        self.class.transaction(requires_new: true) do
+          new_password = SecureRandom.base58(32)
           update!(password: new_password, password_confirmation: new_password)
-          
-          # Log the reset event
+          Services::NativeAccountLock.require_manual_unlock!(self) if config[:require_manual_unlock]
+          revoke_beskar_sessions!
           security_events.create!(
-            event_type: "emergency_password_reset",
-            ip_address: security_event.ip_address,
-            user_agent: security_event.user_agent,
-            metadata: {
-              reason: reason.to_s,
-              triggering_event_id: security_event.id,
-              timestamp: Time.current.iso8601,
-              reset_method: "automatic"
-            },
-            risk_score: 100
-          )
-          
-          # Send notification to user
-          if config[:send_notification]
-            send_emergency_reset_notification(reason)
-          end
-          
-          # Notify security team
-          if config[:notify_security_team]
-            notify_security_team_of_reset(reason, security_event)
-          end
-          
-          Rails.logger.warn "[Beskar] Emergency password reset performed for user #{id}, reason: #{reason}"
-          
-        rescue => e
-          Rails.logger.error "[Beskar] Failed to perform emergency password reset: #{e.message}"
-          
-          # Create failed reset event
-          security_events.create!(
-            event_type: "emergency_password_reset_failed",
-            ip_address: security_event.ip_address,
-            user_agent: security_event.user_agent,
-            metadata: {
-              reason: reason.to_s,
-              error: e.message,
-              timestamp: Time.current.iso8601
-            },
-            risk_score: 100
+            event_type: "emergency_password_reset", ip_address: security_event.ip_address,
+            user_agent: security_event.user_agent, risk_score: 100,
+            metadata: {reason: reason.to_s, triggering_event_id: security_event.id,
+                       authentication_attempt_id: security_event.beskar_attempt&.id,
+                       timestamp: Time.current.iso8601, reset_method: "automatic"}
           )
         end
+        # Keep the extension hooks independent: a failed user hook must not
+        # suppress the security-team notification or undo the committed reset.
+        Services::Notifications.after_commit { send_emergency_reset_notification(reason) } if config[:send_notification]
+        Services::Notifications.after_commit { notify_security_team_of_reset(reason, security_event) } if config[:notify_security_team]
+        true
+      rescue => error
+        Beskar::Logger.error("Emergency password reset failed (#{error.class})")
+        false
       end
 
       # Send notification to user about emergency password reset
       def send_emergency_reset_notification(reason)
-        # This should be implemented by the application
-        # Example: UserMailer.emergency_password_reset(self, reason).deliver_later
-        Rails.logger.info "[Beskar] Would send emergency reset notification to user #{id}"
-      rescue => e
-        Rails.logger.error "[Beskar] Failed to send emergency reset notification: #{e.message}"
+        Services::Notifications.enqueue(self, "emergency_password_reset")
       end
 
       # Notify security team about emergency password reset
       def notify_security_team_of_reset(reason, security_event)
-        # This should be implemented by the application
-        # Example: SecurityMailer.emergency_reset_alert(self, reason, security_event).deliver_later
-        Rails.logger.info "[Beskar] Would notify security team about reset for user #{id}"
-      rescue => e
-        Rails.logger.error "[Beskar] Failed to notify security team: #{e.message}"
+        Services::Notifications.enqueue(self, "security_team_reset")
       end
     end
   end

data/lib/beskar/models/security_trackable_devise.rb

@@ -9,11 +9,21 @@ module Beskar
       included do
         # Include the generic functionality first
         include Beskar::Models::SecurityTrackableGeneric
+        prepend SessionCredentials
 
-        # Hook into Devise callbacks if Devise is present and available
-        if defined?(Devise) && respond_to?(:after_database_authentication)
-          # Track successful authentications
-          after_database_authentication :track_successful_login
+        after_update :revoke_beskar_sessions_after_lock
+
+        # The engine registers the single Warden outcome callback. Devise's
+        # after_database_authentication is an instance hook, not a callback macro.
+      end
+
+      module SessionCredentials
+        def authenticatable_salt
+          Digest::SHA256.hexdigest([super, beskar_session_token].to_json)
+        end
+
+        def rememberable_value
+          Digest::SHA256.hexdigest([super, beskar_session_token].to_json)
         end
       end
 
@@ -21,38 +31,38 @@ module Beskar
       def track_successful_login
         # Skip tracking if disabled in configuration
         unless Beskar.configuration.track_successful_logins?
-          Rails.logger.debug "[Beskar] Successful login tracking disabled in configuration"
+          Beskar::Logger.debug("Successful login tracking disabled in configuration")
           return
         end
 
-        if current_request = request_from_context
+        if (current_request = request_from_context)
           track_authentication_event(current_request, :success)
         end
       rescue => e
-        Rails.logger.warn "[Beskar] Failed to track successful login: #{e.message}"
+        Beskar::Logger.warn("Failed to track successful login: #{e.class}")
         nil
       end
 
       # PUBLIC method called from Warden callback in engine.rb
       # Checks if account was just locked due to high risk and signs out if needed
-      def check_high_risk_lock_and_signout(auth)
+      def check_high_risk_lock_and_signout(auth, scope: nil, attempt: nil)
         return unless Beskar.configuration.risk_based_locking_enabled?
-
-        # Check if there's a very recent lock event (within last 5 seconds)
-        recent_lock = security_events
-          .where(event_type: ["account_locked", "lock_attempted"])
-          .where("created_at >= ?", 5.seconds.ago)
-          .exists?
-
-        if recent_lock
-          Rails.logger.warn "[Beskar] High-risk lock detected, signing out user #{id}"
-          auth.logout
-          throw :warden, message: :account_locked_due_to_high_risk
-        end
+        return unless scope
+        attempt ||= Services::AuthenticationAttempt.current(auth.request, scope) if auth.respond_to?(:request)
+        return unless attempt && attempt.user == self && attempt.scope == scope.to_s && attempt.locked_now
+        return unless Services::RequestContext.enforce?(attempt.ip_address)
+        auth.logout(scope)
+        throw :warden, scope: scope, message: :account_locked_due_to_high_risk
       end
 
       private
 
+      # Runs in the user save transaction, including Devise's own failed-password
+      # lock and ordinary updates of locked_at, not just Beskar risk-based locks.
+      def revoke_beskar_sessions_after_lock
+        revoke_beskar_sessions! if has_attribute?(:locked_at) && saved_change_to_locked_at? && locked_at.present?
+      end
+
       # Devise-specific: Try to get request from various Warden/Devise contexts
       def request_from_context
         # Try to get request from various contexts
@@ -66,16 +76,15 @@ module Beskar
           Warden::Manager.current_request
         end
       rescue => e
-        Rails.logger.debug "[Beskar] Could not get request from context: #{e.message}"
+        Beskar::Logger.debug("Could not get request from context: #{e.class}")
         nil
       end
 
-      # Devise-specific: Handle high risk lock by creating lock event
+      # Devise-specific: The current attempt carries the completed lock result.
       # The actual sign-out is handled by Warden callback in engine.rb
       def handle_high_risk_lock(security_event, request)
-        Rails.logger.debug "[Beskar] Devise account locked - Warden callback will handle sign-out"
-        # The lock event is already created by AccountLocker service
-        # The Warden callback will detect it and perform the actual sign-out
+        Beskar::Logger.debug("Devise account locked - Warden callback will handle sign-out")
+        # The Warden callback uses the attempt, independently of audit writes.
       end
     end
   end