beskar 0.0.2 → 0.2.0

data/lib/beskar/services/account_locker.rb

@@ -5,7 +5,7 @@ module Beskar
     # Service for locking user accounts based on risk scores
     #
     # This service provides a modular approach to account locking that can work
-    # with Devise's lockable module or custom locking implementations. It keeps
+    # with Devise's lockable module or the Rails-native lock adapter. It keeps
     # Devise-specific code isolated for maintainability.
     #
     # @example Basic usage with Devise lockable
@@ -30,7 +30,7 @@ module Beskar
         @user = user
         @risk_score = risk_score
         @reason = reason
-        @metadata = metadata
+        @metadata = metadata.deep_symbolize_keys
       end
 
       # Check if account should be locked based on configuration
@@ -39,6 +39,7 @@ module Beskar
       def should_lock?
         return false unless Beskar.configuration.risk_based_locking_enabled?
         return false unless user
+        return false unless RequestContext.enforce?(metadata[:ip_address])
         return false if user_already_locked?
 
         risk_score >= Beskar.configuration.risk_threshold
@@ -57,16 +58,19 @@ module Beskar
       # @return [Boolean] true if lock was successful, false otherwise
       def lock!
         return false unless user
+        return false unless RequestContext.enforce?(metadata[:ip_address])
 
-        strategy = Beskar.configuration.lock_strategy
+        strategy = effective_strategy
 
         result = case strategy
         when :devise_lockable
           lock_with_devise_lockable
-        when :custom
-          lock_with_custom_strategy
+        when :rails_auth
+          NativeAccountLock.lock!(user, duration: Beskar.configuration.auto_unlock_time, metadata: metadata)
+        when :none
+          false
         else
-          Rails.logger.warn "[Beskar::AccountLocker] Unknown lock strategy: #{strategy}"
+          Beskar::Logger.warn("Unknown lock strategy: #{strategy}", component: :AccountLocker)
           false
         end
 
@@ -89,18 +93,20 @@ module Beskar
       def unlock!
         return false unless user
 
-        strategy = Beskar.configuration.lock_strategy
+        strategy = effective_strategy
 
         result = case strategy
         when :devise_lockable
           unlock_with_devise_lockable
-        when :custom
-          unlock_with_custom_strategy
+        when :rails_auth
+          NativeAccountLock.unlock!(user)
+        when :none
+          false
         else
           false
         end
 
-        # Log unlock event for adaptive learning
+        # Log the administrative unlock; this does not establish trusted history.
         if result && Beskar.configuration.log_lock_events?
           log_unlock_event
         end
@@ -115,13 +121,32 @@ module Beskar
         user_already_locked?
       end
 
+      def supported?
+        case effective_strategy
+        when :devise_lockable then devise_lockable_available?
+        when :rails_auth then user.respond_to?(:beskar_access_locked?) && user.respond_to?(:sessions)
+        else false
+        end
+      end
+
       private
 
+      def effective_strategy
+        strategy = Beskar.configuration.lock_strategy
+        if strategy == :devise_lockable && user.respond_to?(:beskar_access_locked?)
+          :rails_auth
+        else
+          strategy
+        end
+      end
+
       # Check if user is already locked
       def user_already_locked?
         return false unless user
 
-        if user.respond_to?(:access_locked?)
+        if user.respond_to?(:beskar_access_locked?)
+          user.beskar_access_locked?
+        elsif user.respond_to?(:access_locked?)
           user.access_locked?
         elsif user.respond_to?(:locked_at)
           user.locked_at.present?
@@ -133,61 +158,48 @@ module Beskar
       # Lock account using Devise's lockable module
       def lock_with_devise_lockable
         unless devise_lockable_available?
-          Rails.logger.warn "[Beskar::AccountLocker] Devise lockable not available for #{user.class.name}"
+          Beskar::Logger.warn("Devise lockable not available for #{user.class.name}", component: :AccountLocker)
           return false
         end
 
         begin
           # Use Devise's lock_access! method
-          user.lock_access!(send_instructions: false)
-          
-          # Set automatic unlock time if configured and supported
-          if Beskar.configuration.auto_unlock_time && user.respond_to?(:locked_at=)
-            user.update_column(:locked_at, Time.current)
+          unless user.lock_access!(send_instructions: false)
+            raise AuthenticationAttempt::Unavailable, "Account lock could not be persisted"
           end
 
-          Rails.logger.info "[Beskar::AccountLocker] Locked account #{user.id} (#{user.class.name}) - Risk: #{risk_score}, Reason: #{reason}"
+          # Devise owns its unlock policy (unlock_strategy/unlock_in). Beskar's
+          # auto_unlock_time applies to Rails-native locks, not Devise columns.
+
+          Beskar::Logger.info("Locked account #{user.id} (#{user.class.name}) - Risk: #{risk_score}, Reason: #{reason}", component: :AccountLocker)
           true
+        rescue ActiveRecord::ActiveRecordError
+          raise AuthenticationAttempt::Unavailable, "Account lock could not be persisted"
+        rescue AuthenticationAttempt::Unavailable
+          raise
         rescue => e
-          Rails.logger.error "[Beskar::AccountLocker] Failed to lock account: #{e.message}"
-          false
+          Beskar::Logger.error("Failed to lock account (#{e.class})", component: :AccountLocker)
+          raise AuthenticationAttempt::Unavailable, "Account lock could not be persisted"
         end
       end
 
       # Unlock account using Devise's lockable module
       def unlock_with_devise_lockable
         unless devise_lockable_available?
-          Rails.logger.warn "[Beskar::AccountLocker] Devise lockable not available for #{user.class.name}"
+          Beskar::Logger.warn("Devise lockable not available for #{user.class.name}", component: :AccountLocker)
           return false
         end
 
         begin
           user.unlock_access!
-          Rails.logger.info "[Beskar::AccountLocker] Unlocked account #{user.id} (#{user.class.name})"
+          Beskar::Logger.info("Unlocked account #{user.id} (#{user.class.name})", component: :AccountLocker)
           true
         rescue => e
-          Rails.logger.error "[Beskar::AccountLocker] Failed to unlock account: #{e.message}"
+          Beskar::Logger.error("Failed to unlock account: #{e.class}", component: :AccountLocker)
           false
         end
       end
 
-      # Lock account using custom strategy (to be implemented by application)
-      def lock_with_custom_strategy
-        # Applications can implement this by:
-        # 1. Adding a locked_by_beskar column to users table
-        # 2. Checking this in authentication callbacks
-        # 3. Implementing unlock logic
-
-        Rails.logger.warn "[Beskar::AccountLocker] Custom lock strategy not implemented"
-        false
-      end
-
-      # Unlock using custom strategy
-      def unlock_with_custom_strategy
-        Rails.logger.warn "[Beskar::AccountLocker] Custom unlock strategy not implemented"
-        false
-      end
-
       # Check if Devise lockable is available for this user
       def devise_lockable_available?
         defined?(Devise) &&
@@ -202,61 +214,58 @@ module Beskar
         return unless user.respond_to?(:security_events)
 
         begin
-          event_type = lock_succeeded ? 'account_locked' : 'lock_attempted'
-          
-          user.security_events.create!(
-            event_type: event_type,
-            ip_address: metadata[:ip_address] || 'system',
-            user_agent: metadata[:user_agent] || 'beskar_system',
-            risk_score: risk_score,
-            metadata: {
-              reason: reason,
-              risk_threshold: Beskar.configuration.risk_threshold,
-              lock_strategy: Beskar.configuration.lock_strategy,
-              auto_unlock_time: Beskar.configuration.auto_unlock_time,
-              locked_at: Time.current.iso8601,
-              lock_succeeded: lock_succeeded,
-              additional_context: metadata
-            }
-          )
+          event_type = lock_succeeded ? "account_locked" : "lock_attempted"
+
+          Beskar::SecurityEvent.transaction(requires_new: true) do
+            Beskar::SecurityEvent.create!(
+              user_type: user.class.polymorphic_name, user_id: user.id,
+              event_type: event_type,
+              ip_address: metadata[:ip_address] || "system",
+              user_agent: metadata[:user_agent] || "beskar_system",
+              risk_score: risk_score,
+              metadata: {
+                reason: reason,
+                risk_threshold: Beskar.configuration.risk_threshold,
+                lock_strategy: effective_strategy,
+                auto_unlock_time: Beskar.configuration.auto_unlock_time,
+                locked_at: Time.current.iso8601,
+                lock_succeeded: lock_succeeded,
+                additional_context: metadata
+              }
+            )
+          end
         rescue => e
-          Rails.logger.warn "[Beskar::AccountLocker] Failed to log lock event: #{e.message}"
+          Beskar::Logger.warn("Failed to log lock event: #{e.class}", component: :AccountLocker)
         end
       end
 
-      # Log unlock event for adaptive learning
-      # This helps establish patterns - if user unlocks and logs in successfully,
-      # that context becomes "established" and trusted
+      # Log the administrative action without granting IP/device trust.
       def log_unlock_event
         return unless user.respond_to?(:security_events)
 
         begin
-          user.security_events.create!(
-            event_type: 'account_unlocked',
-            ip_address: metadata[:ip_address] || 'system',
-            user_agent: metadata[:user_agent] || 'beskar_system',
-            risk_score: 0, # Unlock has no risk
-            metadata: {
-              unlocked_at: Time.current.iso8601,
-              unlock_method: 'manual',
-              additional_context: metadata
-            }
-          )
+          Beskar::SecurityEvent.transaction(requires_new: true) do
+            Beskar::SecurityEvent.create!(
+              user_type: user.class.polymorphic_name, user_id: user.id,
+              event_type: "account_unlocked",
+              ip_address: metadata[:ip_address] || "system",
+              user_agent: metadata[:user_agent] || "beskar_system",
+              risk_score: 0, # Unlock has no risk
+              metadata: {
+                unlocked_at: Time.current.iso8601,
+                unlock_method: "manual",
+                additional_context: metadata
+              }
+            )
+          end
         rescue => e
-          Rails.logger.warn "[Beskar::AccountLocker] Failed to log unlock event: #{e.message}"
+          Beskar::Logger.warn("Failed to log unlock event: #{e.class}", component: :AccountLocker)
         end
       end
 
       # Notify user about account lock
       def notify_user
-        # This would integrate with ActionMailer or notification system
-        # For now, just log it
-        Rails.logger.info "[Beskar::AccountLocker] User #{user.id} should be notified of account lock"
-        
-        # Future implementation:
-        # if defined?(Beskar::AccountLockMailer)
-        #   Beskar::AccountLockMailer.account_locked(user, risk_score, reason).deliver_later
-        # end
+        Notifications.enqueue(user, "account_locked")
       end
     end
   end

data/lib/beskar/services/administrative_audit.rb

@@ -0,0 +1,36 @@
+module Beskar
+  module Services
+    class AdministrativeAudit
+      class Unavailable < StandardError; end
+
+      def self.record!(actor:, reason:, request_id:, action:, target_type:, before_state: {}, after_state: {})
+        raise AdministrativeBans::InvalidInput, "Administrative actor must be an opaque identifier" unless AdministrativeBans.valid_actor?(actor)
+        unless reason.is_a?(String) && reason.strip.present? && reason.length <= 1000
+          raise AdministrativeBans::InvalidInput, "An administrative reason of 1 to 1000 characters is required"
+        end
+        AdministrativeAction.create!(actor: actor, reason: reason.strip, request_id: request_id,
+          operation_id: SecureRandom.uuid, action: action, target_type: target_type,
+          before_state: before_state, after_state: after_state)
+      end
+
+      def self.configuration_snapshot(config)
+        values = (Configuration::SECTIONS + [:monitor_only, :ip_whitelist]).to_h { |name| [name, config.public_send(name)] }
+        %i[authenticate_admin audit_actor authorize_admin authorize_configuration].each do |name|
+          values[name] = config.public_send(name).present? ? "[CALLBACK]" : nil
+        end
+        AuditData.metadata(configuration_value(values))
+      end
+
+      def self.configuration_value(value)
+        case value
+        when Hash then value.transform_values { |item| configuration_value(item) }
+        when Array then value.map { |item| configuration_value(item) }
+        when ActiveSupport::Duration then value.to_f
+        when Regexp then {pattern: value.source, options: value.options}
+        when Class then value.name
+        else value
+        end
+      end
+    end
+  end
+end

data/lib/beskar/services/administrative_bans.rb

@@ -0,0 +1,104 @@
+module Beskar
+  module Services
+    # All selected changes and their required history share one writer transaction.
+    # The existing ban coordination keys also serialize with automatic escalation.
+    class AdministrativeBans
+      class InvalidInput < ArgumentError; end
+      MAX_BATCH = 100
+      DURATIONS = {"1h" => 1.hour, "6h" => 6.hours, "24h" => 24.hours,
+                   "7d" => 7.days, "30d" => 30.days}.freeze
+      SNAPSHOT_FIELDS = %w[id ip_address reason details permanent banned_at expires_at violation_count metadata].freeze
+      ACTION_NAMES = {"update" => "ban_updated", "unban" => "ban_unbanned", "extend" => "ban_extended", "make_permanent" => "ban_made_permanent"}.freeze
+      UPDATE_FIELDS = %w[ip_address reason details permanent expires_at violation_count metadata].freeze
+
+      def self.valid_actor?(actor)
+        actor.is_a?(String) && actor.match?(/\A[a-zA-Z0-9][a-zA-Z0-9:_.\/-]{0,199}\z/)
+      end
+
+      def initialize(actor:, reason:, request_id:)
+        unless self.class.valid_actor?(actor)
+          raise InvalidInput, "Administrative actor must be an opaque identifier"
+        end
+        unless reason.is_a?(String) && reason.strip.present? && reason.length <= 1000
+          raise InvalidInput, "An administrative reason of 1 to 1000 characters is required"
+        end
+        @context = {actor: actor, reason: reason.strip, request_id: AuditData.field(:request_id, request_id, limit: 200),
+                    operation_id: SecureRandom.uuid}
+      end
+
+      def create!(ban)
+        raise InvalidInput, "Create requires a new ban" unless ban.new_record?
+        raise ActiveRecord::RecordInvalid, ban unless ban.valid?
+        SecurityState.mutate("ban:#{ban.ip_address}", ttl: 1.day) do
+          ban.save!
+          record!(ban, "ban_created", {})
+        end
+        ban
+      end
+
+      def change!(ids, action:, attributes: {}, duration: nil)
+        unless %w[update unban extend make_permanent].include?(action)
+          raise InvalidInput, "Unknown administrative action"
+        end
+        unless attributes.is_a?(Hash) && (attributes.keys.map(&:to_s) - UPDATE_FIELDS).empty?
+          raise InvalidInput, "Unsupported ban attributes"
+        end
+        extension = DURATIONS[duration] if action == "extend"
+        raise InvalidInput, "Unsupported extension duration" if action == "extend" && !extension
+        ids = normalize_ids(ids)
+        targets = BannedIp.where(id: ids).order(:id).pluck(:id, :ip_address)
+        raise ActiveRecord::RecordNotFound unless targets.size == ids.size
+
+        changed = 0
+        SecurityState.mutate(targets.map { |_, ip| "ban:#{ip}" }, ttl: 1.day) do
+          changed = 0 # The block can be retried after an optimistic conflict.
+          bans = BannedIp.where(id: ids).order(:id).lock.to_a
+          raise ActiveRecord::RecordNotFound unless bans.size == ids.size
+          raise InvalidInput, "Ban identity changed; reload before retrying" unless bans.map { |ban| [ban.id, ban.ip_address] } == targets
+          bans.each do |ban|
+            before = snapshot(ban)
+            case action
+            when "unban" then ban.destroy!
+            when "make_permanent" then ban.update!(permanent: true, expires_at: nil)
+            when "extend"
+              raise InvalidInput, "Cannot extend a permanent ban" if ban.permanent?
+              ban.update!(expires_at: [ban.expires_at || Time.current, Time.current].max + extension)
+            when "update"
+              ban.assign_attributes(attributes)
+              if ban.ip_address_changed?
+                ban.errors.add(:ip_address, "cannot be changed")
+                raise ActiveRecord::RecordInvalid, ban
+              end
+              ban.save!
+            end
+            after = ban.destroyed? ? {} : snapshot(ban)
+            # Filtered/bounded snapshots can look identical even when stored
+            # fields changed (for example subsecond deadlines or redacted data).
+            next unless ban.destroyed? || ban.saved_changes.except("updated_at").present?
+            record!(ban, ACTION_NAMES.fetch(action), before, after)
+            changed += 1
+          end
+        end
+        changed
+      end
+
+      private
+
+      def normalize_ids(ids)
+        values = Array(ids)
+        unless values.size.between?(1, MAX_BATCH) && values.all? { |id| id.to_s.match?(/\A[1-9]\d{0,18}\z/) && id.to_s.to_i <= 9_223_372_036_854_775_807 }
+          raise InvalidInput, "Select 1 to 100 valid ban IDs"
+        end
+        values.map(&:to_i).uniq.sort
+      end
+
+      def snapshot(ban)
+        AuditData.metadata(ban.attributes.slice(*SNAPSHOT_FIELDS))
+      end
+
+      def record!(ban, action, before, after = snapshot(ban))
+        AdministrativeAction.create!(@context.merge(action: action, target_id: ban.id, before_state: before, after_state: after))
+      end
+    end
+  end
+end

data/lib/beskar/services/audit_data.rb

@@ -0,0 +1,72 @@
+require "active_support/parameter_filter"
+
+module Beskar
+  module Services
+    # Defense at capture and export boundaries, including legacy records. This
+    # cannot identify arbitrary secrets embedded in otherwise legitimate prose.
+    module AuditData
+      FILTERED = "[FILTERED]"
+      MAX_DEPTH = 10
+      MAX_NODES = 512
+      MAX_BYTES = 65_536
+      SENSITIVE_KEYS = /password|secret|token|authorization|cookie|session_id|csrf|exception_message|fullpath|matched_path/i
+
+      module_function
+
+      def metadata(value)
+        bounded = bound(value.is_a?(Hash) ? value : {}, depth: 0, budget: [MAX_NODES])
+        filters = [SENSITIVE_KEYS] + Array(Rails.application.config.filter_parameters)
+        filtered = ActiveSupport::ParameterFilter.new(filters).filter(bounded)
+        filtered = bound(filtered, depth: 0, budget: [MAX_NODES])
+        (filtered.to_json.bytesize <= MAX_BYTES) ? filtered : {"_truncated" => true}
+      end
+
+      def text(value, limit: 2048)
+        RequestContext.text(value, limit: limit)
+      end
+
+      def field(name, value, limit: 2048)
+        metadata(name.to_s => text(value, limit: limit))[name.to_s]
+      end
+
+      def user_email(user)
+        return unless user
+        if user.try(:email).present?
+          field(:email, user.email, limit: 320)
+        elsif user.try(:email_address).present?
+          field(:email, field(:email_address, user.email_address, limit: 320), limit: 320)
+        end
+      end
+
+      def bound(value, depth:, budget:)
+        return "[TRUNCATED]" if depth > MAX_DEPTH || (budget[0] -= 1) < 0
+        case value
+        when Hash
+          value.first(64).each_with_object({}) do |(key, child), result|
+            next unless key.is_a?(String) || key.is_a?(Symbol)
+            key = key.to_s
+            next if key.bytesize > 128
+            result[key] = bound(child, depth: depth + 1, budget: budget)
+          end
+        when Array then value.first(50).map { |child| bound(child, depth: depth + 1, budget: budget) }
+        when String, Symbol then text(value)
+        when Float then value.finite? ? value : nil
+        when Integer, TrueClass, FalseClass, NilClass then value
+        when Time, DateTime, Date then value.iso8601
+        else "[UNSUPPORTED]"
+        end
+      end
+
+      # CSV quoting handles delimiters, but does not neutralize spreadsheet
+      # formulas. Prefix dangerous textual cells, including obscured/fullwidth
+      # prefixes. JSON exports preserve text without this spreadsheet marker.
+      def csv_cell(value)
+        return value if value.is_a?(Numeric) || value.nil?
+        string = text(value)
+        probe = string.unicode_normalize(:nfkc)
+        dangerous = probe.match?(/\A[\p{Space}\p{Cf}\p{Cc}]*[=+\-@]/)
+        dangerous ? "text: #{string}" : string
+      end
+    end
+  end
+end

data/lib/beskar/services/authentication.rb

@@ -0,0 +1,31 @@
+module Beskar
+  module Services
+    # Framework-neutral admission for token issuance, OAuth and custom APIs.
+    # The host verifies credentials in the block and returns the authenticated
+    # model (or nil). This method never issues a credential or grants access.
+    class Authentication
+      def self.authenticate(request, model:, scope:, credentials: {})
+        user = model.find_by(credentials) unless credentials.empty?
+        attempt = AuthenticationAttempt.reserve(request, model: model, scope: scope,
+          user: user, credentials: credentials)
+        unless attempt.allowed?
+          model.track_failed_authentication(request, scope, attempt: attempt)
+          return attempt
+        end
+        resource = yield
+        if resource
+          raise AuthenticationAttempt::Unavailable, "Authentication identity mismatch" unless resource.is_a?(model) && resource.persisted?
+          resource.track_authentication_event(request, :success, attempt: attempt, persist: false)
+          attempt.verify_generation!
+          attempt.persist_outcome!
+        else
+          model.track_failed_authentication(request, scope, attempt: attempt)
+          attempt.deny!(:invalid_credentials)
+        end
+        attempt
+      rescue ActiveRecord::ActiveRecordError
+        raise AuthenticationAttempt::Unavailable, "Authentication temporarily unavailable"
+      end
+    end
+  end
+end

data/lib/beskar/services/authentication_attempt.rb

@@ -0,0 +1,141 @@
+require "digest"
+
+module Beskar
+  module Services
+    # Request-local decisions are independent of optional SecurityEvent writes.
+    # Adapters reserve before password verification and pass the same attempt to
+    # the outcome callback, so a single attempt cannot consume capacity twice.
+    class AuthenticationAttempt
+      class Unavailable < StandardError; end
+
+      attr_reader :id, :scope, :rate_limit, :ip_address, :attempted_email, :request_path
+      attr_accessor :user, :event, :locked_now, :completed
+
+      def self.current(request, scope)
+        request.env.dig("beskar.authentication_attempts", scope.to_s) if request.respond_to?(:env) && request.env
+      end
+
+      def self.reserve(request, model:, scope:, user: nil, credentials: {}, cache: false)
+        existing = current(request, scope) if cache
+        return existing if existing
+
+        attempt = new(request, scope: scope, user: user, model: model, credentials: credentials)
+        if cache && request.respond_to?(:env) && request.env
+          (request.env["beskar.authentication_attempts"] ||= {})[scope.to_s] = attempt
+        end
+        attempt
+      rescue ActiveRecord::ActiveRecordError => error
+        Beskar::Logger.error("Authentication state unavailable (#{error.class})")
+        raise Unavailable, "Authentication temporarily unavailable"
+      end
+
+      def initialize(request, scope:, user:, model:, credentials:)
+        @id = SecureRandom.uuid
+        @scope = scope.to_s
+        @ip_address = RequestContext.ip(request)
+        @request_path = RequestContext.path(request)
+        @user = user
+        @generation = SessionRevocation.token(user) if user
+        identity = credentials.to_h.stringify_keys
+        @attempted_email = identity["email"] || identity["email_address"]
+        @locked_now = false
+        @completed = false
+        @identity_reserved = user || credentials.present?
+        @rate_limit = RateLimiter.check_authentication_attempt(request, :attempt, user,
+          account_key: user ? nil : self.class.credential_key(model, credentials))
+        @allowed = !RequestContext.enforce?(ip_address) || rate_limit[:allowed]
+        @reason = :rate_limit_exceeded unless @allowed
+        if user&.respond_to?(:beskar_access_locked?) && RequestContext.enforce?(ip_address) && user.beskar_access_locked?
+          deny!(:account_locked)
+        end
+      end
+
+      def self.credential_key(model, credentials)
+        return if credentials.empty?
+        normalized = credentials.to_h.sort_by { |key, _| key.to_s }.map do |key, value|
+          value = value.to_s
+          value = value.strip if !model.respond_to?(:strip_whitespace_keys) || model.strip_whitespace_keys.map(&:to_s).include?(key.to_s)
+          value = value.downcase if !model.respond_to?(:case_insensitive_keys) || model.case_insensitive_keys.map(&:to_s).include?(key.to_s)
+          [key.to_s, value]
+        end
+        "#{model.name}:credentials:#{Digest::SHA256.hexdigest(normalized.to_json)}"
+      end
+
+      def allowed?
+        @allowed
+      end
+
+      def session_token
+        @generation
+      end
+
+      # Opaque strategies cannot identify an account until verification succeeds.
+      # Charge that account once, independently of the already reserved IP tier.
+      def bind_user!(resource)
+        if user && user != resource
+          deny!(:identity_changed)
+          return
+        end
+        unless user
+          @user = resource
+          @generation = SessionRevocation.token(resource)
+          account_result = RateLimiter.reserve_account(resource, ip_address: ip_address)
+          if RequestContext.enforce?(ip_address) && !account_result[:allowed]
+            @rate_limit = account_result
+            deny!(:rate_limit_exceeded)
+          end
+        end
+        verify_generation!
+        if RequestContext.enforce?(ip_address)
+          locked = resource.respond_to?(:beskar_access_locked?) ? resource.beskar_access_locked? : (resource.respond_to?(:access_locked?) && resource.reload.access_locked?)
+          deny!(:account_locked) if locked
+        end
+      end
+
+      def verify_generation!
+        deny!(:session_revoked) if user && @generation != SessionRevocation.token(user)
+      end
+
+      def bind_identity!(model, credentials)
+        return if user || @identity_reserved || credentials.empty?
+        @identity_reserved = true
+        result = RateLimiter.reserve_account(nil, ip_address: ip_address,
+          account_key: self.class.credential_key(model, credentials))
+        if RequestContext.enforce?(ip_address) && !result[:allowed]
+          @rate_limit = result
+          deny!(:rate_limit_exceeded)
+        end
+      end
+
+      def persist_outcome!
+        return unless event && !event.persisted? && Beskar.configuration.track_successful_logins?
+        event.event_type = "authentication_blocked" unless allowed?
+        event.metadata = (event.metadata || {}).merge("authentication" => metadata)
+        user.send(:persist_authentication_audit, event)
+        user.analyze_suspicious_patterns_async if allowed? && Beskar.configuration.auto_analyze_patterns?
+      end
+
+      def deny!(reason)
+        @allowed = false
+        @reason = reason
+      end
+
+      def metadata
+        {"attempt_id" => id, "scope" => scope, "allowed" => allowed?,
+         "reason" => @reason&.to_s, "rate_limit_allowed" => rate_limit[:allowed], "locked_now" => !!locked_now}
+      end
+
+      def response
+        status = (@reason == :rate_limit_exceeded) ? 429 : 403
+        headers = {"content-type" => "application/json", "cache-control" => "no-store"}
+        headers["retry-after"] = [rate_limit[:retry_after].to_i, 1].max.to_s if status == 429
+        [status, headers, [{error: (status == 429) ? "Too many authentication attempts" : "Authentication denied"}.to_json]]
+      end
+
+      def self.unavailable_response
+        [503, {"content-type" => "application/json", "cache-control" => "no-store", "retry-after" => "60"},
+          [{error: "Authentication temporarily unavailable"}.to_json]]
+      end
+    end
+  end
+end