beskar 0.0.2 → 0.2.0

data/lib/beskar/services/ban_expiry.rb

@@ -0,0 +1,28 @@
+require "time"
+require "date"
+
+module Beskar
+  module Services
+    # datetime-local has no timezone. Dashboard wall-clock input is explicitly
+    # UTC; scripted callers may instead supply an ISO 8601 numeric offset.
+    module BanExpiry
+      class InvalidInput < ArgumentError; end
+      FORMAT = /\A(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.\d{1,6})?)?(Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)?\z/
+
+      def self.parse(value)
+        return nil if value.nil? || value == ""
+        match = FORMAT.match(value) if value.is_a?(String) && value.bytesize <= 40
+        unless match && match[1].to_i.positive? && Date.valid_date?(*match.captures.first(3).map(&:to_i)) &&
+            match[4].to_i < 24 && match[5].to_i < 60 && match[6].to_i < 60
+          raise InvalidInput, "Expiry must be a valid UTC date and time or ISO 8601 timestamp with offset"
+        end
+        # Browsers omit seconds when zero; Ruby's ISO parser requires them.
+        timestamp = value.sub(/T(\d{2}):(\d{2})(?=Z|[+-]|\z)/, 'T\1:\2:00')
+        Time.iso8601(match[7] ? timestamp : "#{timestamp}Z").utc
+      rescue ArgumentError => error
+        raise error if error.is_a?(InvalidInput)
+        raise InvalidInput, "Expiry must be a valid UTC date and time or ISO 8601 timestamp with offset"
+      end
+    end
+  end
+end

data/lib/beskar/services/device_detector.rb

@@ -27,14 +27,14 @@ module Beskar
         curl|wget|postman|httpie|
         python-requests|ruby|php|java|
         headless|phantom|selenium|playwright
-      }ix.freeze
+      }ix
 
       # Mobile device patterns
       MOBILE_PATTERNS = %r{
         Mobile|Android|iPhone|iPad|iPod|
         BlackBerry|IEMobile|Opera\s*Mini|
         Windows\s*Phone|webOS|Kindle
-      }ix.freeze
+      }ix
 
       # Browser patterns with version extraction
       BROWSER_PATTERNS = {
@@ -111,11 +111,11 @@ module Beskar
         # because Chrome user agents contain "Safari"
         # Also check for Opera (OPR) before Chrome since it also contains Chrome
         if user_agent.match?(/OPR|Opera/i)
-          if match = user_agent.match(BROWSER_PATTERNS[:opera])
+          if (match = user_agent.match(BROWSER_PATTERNS[:opera]))
             return "Opera #{match[1]}"
           end
         elsif user_agent.match?(/Chrome/i) && !user_agent.match?(/Edg/i)
-          if match = user_agent.match(BROWSER_PATTERNS[:chrome])
+          if (match = user_agent.match(BROWSER_PATTERNS[:chrome]))
             return "Chrome #{match[1]}"
           end
         end
@@ -123,7 +123,7 @@ module Beskar
         BROWSER_PATTERNS.each do |browser, pattern|
           next if browser == :chrome # Already handled above
 
-          if match = user_agent.match(pattern)
+          if (match = user_agent.match(pattern))
             return "#{browser.to_s.titleize} #{match[1]}"
           end
         end
@@ -139,7 +139,7 @@ module Beskar
         return "Unknown" if user_agent.blank?
 
         PLATFORM_PATTERNS.each do |platform, pattern|
-          if match = user_agent.match(pattern)
+          if (match = user_agent.match(pattern))
             version = match[1]&.tr("_", ".")
 
             case platform
@@ -183,44 +183,35 @@ module Beskar
       # @param user_agent [String] The User-Agent string
       # @return [Integer] Risk score from 0 to 50
       def calculate_user_agent_risk(user_agent)
-        return 20 if user_agent.blank?
-
-        risk = 0
-
-        # Bot detection adds significant risk
-        if bot?(user_agent)
-                risk += 30
-        Rails.logger.info "Bot detected: #{user_agent}, adding 30 risk"
-        end
-
-        # Suspicious patterns
-        if user_agent.length < 20 || user_agent.length > 500
-                risk += 15
-        Rails.logger.info "Suspicious length: #{user_agent.length}, adding 15 risk"
-        end
-
-        if user_agent.match?(/test|debug|script/i)
-                risk += 10
-        Rails.logger.info "Suspicious pattern: #{user_agent}, adding 10 risk"
-        end
-
-        if user_agent.count("()") > 3
-                risk += 5
-        Rails.logger.info "Suspicious pattern: #{user_agent}, adding 5 risk"
-        end
+        assess(user_agent)[:score]
+      end
 
-        # Very old browsers might be suspicious
-        if browser_info = detect_browser(user_agent)
-          if browser_info.match?(/Chrome (\d+)/) && $1.to_i < 90
-            risk += 5
-            Rails.logger.info "Suspicious browser: #{browser_info}, adding 5 risk"
-          elsif browser_info.match?(/Firefox (\d+)/) && $1.to_i < 90
-            risk += 5
-            Rails.logger.info "Suspicious browser: #{browser_info}, adding 5 risk"
+      # Evidence describes unverified User-Agent claims, never device identity.
+      # Do not log the raw header, which can contain attacker-controlled secrets.
+      def assess(user_agent)
+        original_length = user_agent.to_s.length
+        user_agent = RequestContext.text(user_agent)
+        info = detect(user_agent)
+        factors = []
+        if user_agent.blank?
+          factors << {name: "user_agent_missing", points: 20, evidence: {}}
+        else
+          factors << {name: "user_agent_bot", points: 30, evidence: {bot: true}} if info[:bot]
+          if original_length < 20 || original_length > 500
+            factors << {name: "user_agent_length", points: 15, evidence: {length: original_length}}
+          end
+          if user_agent.match?(/test|debug|script/i)
+            factors << {name: "user_agent_suspicious_pattern", points: 10, evidence: {}}
+          end
+          factors << {name: "user_agent_parentheses", points: 5, evidence: {count: user_agent.count("()")}} if user_agent.count("()") > 3
+          if (match = info[:browser].match(/\A(?:Chrome|Firefox) (\d+)/)) && match[1].to_i < 90
+            factors << {name: "old_browser", points: 5, evidence: {browser: info[:browser], legacy_major_cutoff: 90}}
           end
         end
-
-        [ risk, 50 ].min # Cap at 50 to leave room for other risk factors
+        total = factors.sum { |factor| factor[:points] }
+        factors << {name: "user_agent_cap", points: 50 - total, evidence: {cap: 50}} if total > 50
+        info[:suspicious] = factors.any? { |factor| %w[user_agent_bot user_agent_suspicious_pattern].include?(factor[:name]) }
+        {score: [total, 50].min, device_info: info, factors: factors}
       end
 
       private

data/lib/beskar/services/event_search.rb

@@ -0,0 +1,58 @@
+module Beskar
+  module Services
+    # Centralizes adapter-specific JSON expressions. Values are always bound;
+    # table/column names come from the model, never request parameters.
+    class EventSearch
+      def initialize(relation)
+        @relation = relation
+        @connection = relation.klass.connection
+      end
+
+      def search(term)
+        match(term, %w[ip_address user_agent attempted_email event_type].map { |name| column(name) } + [metadata_text])
+      end
+
+      def email(term)
+        # Match the model's legacy fallback, not unrelated text in metadata.
+        match(term, ["COALESCE(#{column("attempted_email")}, #{legacy_email})"])
+      end
+
+      private
+
+      def match(term, expressions)
+        return @relation unless term.is_a?(String) && term.present?
+        value = RequestContext.text(term, limit: 256).downcase
+        pattern = "%#{@relation.klass.sanitize_sql_like(value, "!")}%"
+        predicates = expressions.map { |expression| "LOWER(#{expression}) LIKE ? ESCAPE '!'" }
+        @relation.where(predicates.join(" OR "), *Array.new(expressions.length, pattern))
+      end
+
+      def column(name)
+        "#{@connection.quote_table_name(@relation.klass.table_name)}.#{@connection.quote_column_name(name)}"
+      end
+
+      def mysql?
+        %w[Mysql2 Trilogy].include?(@connection.adapter_name)
+      end
+
+      def metadata_text
+        "CAST(#{column("metadata")} AS #{mysql? ? "CHAR" : "TEXT"})"
+      end
+
+      def legacy_email
+        metadata = column("metadata")
+        case @connection.adapter_name
+        when "PostgreSQL"
+          "(#{metadata} ->> 'attempted_email')"
+        when "Mysql2", "Trilogy"
+          extracted = "JSON_EXTRACT(#{metadata}, '$.attempted_email')"
+          "CASE WHEN JSON_TYPE(#{extracted}) = 'NULL' THEN NULL ELSE JSON_UNQUOTE(#{extracted}) END"
+        when "SQLite"
+          "json_extract(#{metadata}, '$.attempted_email')"
+        else
+          raise ArgumentError, "Beskar email search does not support this database adapter"
+        end
+      end
+    end
+  end
+end

data/lib/beskar/services/geolocation_service.rb

@@ -1,7 +1,9 @@
 # frozen_string_literal: true
 
+require "digest"
+
 begin
-  require 'maxminddb'
+  require "maxminddb"
 rescue LoadError
   # MaxMindDB gem not available
 end
@@ -35,15 +37,15 @@ module Beskar
     class GeolocationService
       # Private/internal IP ranges that should not be geolocated
       PRIVATE_IP_RANGES = [
-        IPAddr.new('10.0.0.0/8'),      # RFC 1918 - Private networks
-        IPAddr.new('172.16.0.0/12'),   # RFC 1918 - Private networks
-        IPAddr.new('192.168.0.0/16'),  # RFC 1918 - Private networks
-        IPAddr.new('127.0.0.0/8'),     # Loopback
-        IPAddr.new('169.254.0.0/16'),  # Link-local
-        IPAddr.new('224.0.0.0/4'),     # Multicast
-        IPAddr.new('::1/128'),         # IPv6 loopback
-        IPAddr.new('fe80::/10'),       # IPv6 link-local
-        IPAddr.new('fc00::/7')         # IPv6 unique local
+        IPAddr.new("10.0.0.0/8"),      # RFC 1918 - Private networks
+        IPAddr.new("172.16.0.0/12"),   # RFC 1918 - Private networks
+        IPAddr.new("192.168.0.0/16"),  # RFC 1918 - Private networks
+        IPAddr.new("127.0.0.0/8"),     # Loopback
+        IPAddr.new("169.254.0.0/16"),  # Link-local
+        IPAddr.new("224.0.0.0/4"),     # Multicast
+        IPAddr.new("::1/128"),         # IPv6 loopback
+        IPAddr.new("fe80::/10"),       # IPv6 link-local
+        IPAddr.new("fc00::/7")         # IPv6 unique local
       ].freeze
 
       # Cache TTL for geolocation results (4 hours)
@@ -98,8 +100,9 @@ module Beskar
           dlat = lat2_rad - lat1_rad
           dlon = lon2_rad - lon1_rad
 
-          a = Math.sin(dlat/2)**2 + Math.cos(lat1_rad) * Math.cos(lat2_rad) * Math.sin(dlon/2)**2
-          c = 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1-a))
+          a = Math.sin(dlat / 2)**2 + Math.cos(lat1_rad) * Math.cos(lat2_rad) * Math.sin(dlon / 2)**2
+          a = a.clamp(0.0, 1.0)
+          c = 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1 - a))
 
           # Earth's radius in kilometers
           earth_radius = 6371.0
@@ -107,35 +110,36 @@ module Beskar
         end
       end
 
-      # Get or initialize the MaxMind City database reader
-      # Uses thread-safe singleton pattern for efficient database access
-      #
-      # @return [MaxMindDB::Reader, nil] The reader instance or nil if not configured
-      def self.city_reader
-        return @city_reader if @city_reader
-        return nil unless Beskar.configuration.maxmind_city_db_path
-        return nil unless defined?(MaxMindDB)
+      # Namespace readers and optional caches by the configured database generation.
+      def self.database_identity
+        path = Beskar.configuration.maxmind_city_db_path.to_s
+        stat = File.stat(path) if path.present?
+        [path, stat&.ino, stat&.size, stat&.mtime&.to_r&.to_s]
+      rescue SystemCallError
+        [path, nil, nil, nil]
+      end
 
+      def self.city_reader(identity = database_identity)
         @city_reader_mutex.synchronize do
-          return @city_reader if @city_reader
-
-          db_path = Beskar.configuration.maxmind_city_db_path
-          if File.exist?(db_path)
-            @city_reader = MaxMindDB.new(db_path)
-            Rails.logger.info "[Beskar::GeolocationService] MaxMind City database loaded from #{db_path}"
-          else
-            Rails.logger.warn "[Beskar::GeolocationService] MaxMind City database not found at #{db_path}"
-          end
-          @city_reader
+          return @city_reader if @city_reader_identity == identity && @city_reader
+          @city_reader = nil
+          @city_reader_identity = identity
+          path = identity.first
+          return nil unless path.present? && defined?(MaxMindDB) && File.file?(path)
+          @city_reader = MaxMindDB.new(path)
         end
-      rescue => e
-        Rails.logger.error "[Beskar::GeolocationService] Failed to load MaxMind City database: #{e.message}"
+      rescue => error
+        Beskar::Logger.error("Failed to load MaxMind database (#{error.class})", component: :GeolocationService)
         nil
       end
 
-      # Reset the database reader (useful for testing or reloading configuration)
+      # Existing lookups can finish using their reader; do not close it underneath
+      # another thread. New lookups select the current database generation.
       def self.reset_readers!
-        @city_reader_mutex.synchronize { @city_reader = nil }
+        @city_reader_mutex.synchronize do
+          @city_reader = nil
+          @city_reader_identity = nil
+        end
       end
 
       # Initialize the geolocation service
@@ -143,7 +147,11 @@ module Beskar
       # @param provider [Symbol] The geolocation provider to use (:maxmind, :mock)
       def initialize(provider: nil)
         @provider = provider || Beskar.configuration.geolocation_provider
-        @cache_key_prefix = "beskar:geolocation"
+        unless Configuration::GEOLOCATION_PROVIDERS.include?(@provider)
+          raise Configuration::Error, "geolocation.provider must be mock or maxmind"
+        end
+        @database_identity = self.class.database_identity
+        @cache_key_prefix = "beskar:geolocation:v2:#{Digest::SHA256.hexdigest([@provider, @database_identity].to_json)}"
         @cache_ttl = Beskar.configuration.geolocation_cache_ttl
       end
 
@@ -159,18 +167,18 @@ module Beskar
         end
 
         # Check cache first
-        if cached_result = get_cached_location(ip_address)
+        if (cached_result = get_cached_location(ip_address))
           return cached_result
         end
 
         # Perform lookup based on provider
-        case @provider
+        result = case @provider
         when :maxmind
-          result = lookup_maxmind(ip_address)
-        when :ip2location
-          result = lookup_ip2location(ip_address)
+          lookup_maxmind(ip_address)
+        when :mock
+          lookup_mock(ip_address)
         else
-          result = lookup_mock(ip_address)
+          unknown_location(ip_address)
         end
 
         # Cache the result
@@ -178,7 +186,7 @@ module Beskar
 
         result
       rescue => e
-        Rails.logger.warn "[Beskar::GeolocationService] Failed to locate IP #{ip_address}: #{e.message}"
+        Beskar::Logger.warn("Failed to locate IP #{ip_address}: #{e.class}", component: :GeolocationService)
         unknown_location(ip_address)
       end
 
@@ -190,55 +198,28 @@ module Beskar
       # @param max_speed_kmh [Integer] Maximum realistic travel speed in km/h (default: 1000 for commercial flights)
       # @return [Boolean] true if travel is impossible
       def impossible_travel?(location1, location2, time_diff_seconds, max_speed_kmh: 1000)
-        return false if location1.nil? || location2.nil?
-        return false unless location1[:latitude] && location2[:latitude]
-
-        distance_km = self.class.calculate_distance(
-          location1[:latitude], location1[:longitude],
-          location2[:latitude], location2[:longitude]
-        )
-
-        # Calculate maximum possible distance at given speed
-        time_hours = time_diff_seconds / 3600.0
-        max_distance_km = max_speed_kmh * time_hours
+        first, second = LocationAssessment.coordinates(location1), LocationAssessment.coordinates(location2)
+        elapsed, speed = LocationAssessment.number(time_diff_seconds), LocationAssessment.number(max_speed_kmh)
+        return false unless first && second && elapsed&.positive? && speed&.positive?
+        self.class.calculate_distance(*first, *second) > speed * elapsed / 3600.0
+      end
 
-        distance_km > max_distance_km
+      def assess_location(ip_address, observations: [], at: Time.current, location: nil)
+        LocationAssessment.new(location || locate(ip_address), observations: observations, at: at).call
       end
 
-      # Calculate risk score based on geolocation factors
-      #
-      # @param ip_address [String] The IP address
-      # @param previous_locations [Array<Hash>] Array of previous location hashes
-      # @param time_since_last [Integer] Seconds since last login
-      # @return [Integer] Risk score from 0 to 30
+      # Compatibility API for a single previous location and elapsed duration.
+      # Multi-observation callers must supply each observation's own timestamp.
       def calculate_location_risk(ip_address, previous_locations = [], time_since_last = nil)
-        current_location = locate(ip_address)
-        risk = 0
-
-        # Private/unknown IPs have moderate risk
-        return 10 if current_location[:country] == "Unknown" || current_location[:country] == "Private"
-
-        # Check for impossible travel if we have previous locations
-        if previous_locations.any? && time_since_last
-          previous_locations.each do |prev_location|
-            if impossible_travel?(current_location, prev_location, time_since_last)
-              risk += 25
-              break
-            end
-          end
-        end
-
-        # Country change adds some risk
-        if previous_locations.any?
-          recent_countries = previous_locations.map { |loc| loc[:country] }.uniq
-          risk += 10 unless recent_countries.include?(current_location[:country])
+        at = Time.current
+        observations = if previous_locations.all? { |entry| entry.is_a?(Hash) && (entry.key?(:occurred_at) || entry.key?("occurred_at")) }
+          previous_locations
+        elsif previous_locations.size == 1 && (elapsed = LocationAssessment.number(time_since_last))&.positive?
+          [{location: previous_locations.first, occurred_at: at - elapsed}]
+        else
+          []
         end
-
-        # Known high-risk countries (this would be configurable in production)
-        high_risk_countries = ['Unknown']
-        risk += 15 if high_risk_countries.include?(current_location[:country])
-
-        [risk, 30].min # Cap at 30 to leave room for other risk factors
+        assess_location(ip_address, observations: observations, at: at)[:score]
       end
 
       private
@@ -285,27 +266,27 @@ module Beskar
       # @return [Hash] Mock location information
       def lookup_mock(ip_address)
         # Generate consistent mock data based on IP
-        country_codes = ['US', 'CA', 'GB', 'DE', 'FR', 'JP', 'AU']
-        cities = ['New York', 'Toronto', 'London', 'Berlin', 'Paris', 'Tokyo', 'Sydney']
+        country_codes = ["US", "CA", "GB", "DE", "FR", "JP", "AU"]
+        cities = ["New York", "Toronto", "London", "Berlin", "Paris", "Tokyo", "Sydney"]
 
         index = ip_address.bytes.sum % country_codes.length
 
         {
           ip: ip_address,
           country: case country_codes[index]
-                   when 'US' then 'United States'
-                   when 'CA' then 'Canada'
-                   when 'GB' then 'United Kingdom'
-                   when 'DE' then 'Germany'
-                   when 'FR' then 'France'
-                   when 'JP' then 'Japan'
-                   when 'AU' then 'Australia'
+                   when "US" then "United States"
+                   when "CA" then "Canada"
+                   when "GB" then "United Kingdom"
+                   when "DE" then "Germany"
+                   when "FR" then "France"
+                   when "JP" then "Japan"
+                   when "AU" then "Australia"
                    end,
           country_code: country_codes[index],
           city: cities[index],
           latitude: (40.0 + (index * 10)) % 90,
           longitude: (-74.0 + (index * 15)) % 180,
-          timezone: "UTC#{index > 3 ? '+' : '-'}#{index + 1}",
+          timezone: "UTC#{(index > 3) ? "+" : "-"}#{index + 1}",
           provider: @provider,
           private_ip: false
         }
@@ -316,10 +297,10 @@ module Beskar
       # @param ip_address [String] The IP address
       # @return [Hash] Location information from MaxMind
       def lookup_maxmind(ip_address)
-        result = { ip: ip_address, provider: @provider, private_ip: false }
+        result = {ip: ip_address, provider: @provider, private_ip: false}
 
         # Lookup city/location data
-        if city_reader = self.class.city_reader
+        if (city_reader = self.class.city_reader(@database_identity))
           begin
             city_data = city_reader.lookup(ip_address)
             if city_data&.found?
@@ -339,7 +320,7 @@ module Beskar
               result.merge!(unknown_location(ip_address).except(:ip, :provider, :private_ip))
             end
           rescue => e
-            Rails.logger.warn "[Beskar::GeolocationService] MaxMind City lookup failed for #{ip_address}: #{e.message}"
+            Beskar::Logger.warn("MaxMind City lookup failed for #{ip_address}: #{e.class}", component: :GeolocationService)
             result.merge!(unknown_location(ip_address).except(:ip, :provider, :private_ip))
           end
         else
@@ -349,22 +330,10 @@ module Beskar
 
         result
       rescue => e
-        Rails.logger.error "[Beskar::GeolocationService] MaxMind lookup failed for #{ip_address}: #{e.message}"
+        Beskar::Logger.error("MaxMind lookup failed for #{ip_address}: #{e.class}", component: :GeolocationService)
         unknown_location(ip_address)
       end
 
-      # Lookup using IP2Location database
-      #
-      # @param ip_address [String] The IP address
-      # @return [Hash] Location information from IP2Location
-      def lookup_ip2location(ip_address)
-        # This would integrate with IP2Location in production
-        # For now, return unknown result
-        result = unknown_location(ip_address)
-        result[:provider] = @provider
-        result
-      end
-
       # Get cached location result
       #
       # @param ip_address [String] The IP address
@@ -373,7 +342,7 @@ module Beskar
         cache_key = "#{@cache_key_prefix}:#{ip_address}"
         Rails.cache.read(cache_key)
       rescue => e
-        Rails.logger.debug "[Beskar::GeolocationService] Cache read failed: #{e.message}"
+        Beskar::Logger.debug("Cache read failed: #{e.class}", component: :GeolocationService)
         nil
       end
 
@@ -385,7 +354,7 @@ module Beskar
         cache_key = "#{@cache_key_prefix}:#{ip_address}"
         Rails.cache.write(cache_key, result, expires_in: @cache_ttl)
       rescue => e
-        Rails.logger.debug "[Beskar::GeolocationService] Cache write failed: #{e.message}"
+        Beskar::Logger.debug("Cache write failed: #{e.class}", component: :GeolocationService)
       end
     end
   end

data/lib/beskar/services/ip_whitelist.rb

@@ -1,4 +1,4 @@
-require 'ipaddr'
+require "ipaddr"
 
 module Beskar
   module Services
@@ -7,45 +7,39 @@ module Beskar
         # Check if an IP address is whitelisted
         def whitelisted?(ip_address)
           return false if ip_address.blank?
-          return false unless whitelist_entries.any?
 
           ip = parse_ip(ip_address)
           return false unless ip
 
-          whitelist_entries.any? do |entry|
-            match_entry?(ip, entry)
+          parsed_entries.values.any? do |entry|
+            entry&.include?(ip)
           end
-        rescue IPAddr::InvalidAddressError, ArgumentError => e
-          Rails.logger.warn "[Beskar::IpWhitelist] Invalid IP address: #{ip_address} - #{e.message}"
+        rescue ArgumentError => e
+          Beskar::Logger.warn("Invalid IP address: #{ip_address} - #{e.class}", component: :IpWhitelist)
           false
         end
 
         # Get whitelist entries from configuration
         def whitelist_entries
-          @whitelist_entries ||= begin
-            entries = Beskar.configuration.ip_whitelist || []
-            # Ensure it's an array
-            entries = [entries] unless entries.is_a?(Array)
-            entries.compact
-          end
+          entries = Beskar.configuration.ip_whitelist || []
+          # Ensure it's an array
+          entries = [entries] unless entries.is_a?(Array)
+          entries.compact
         end
 
         # Clear cached whitelist (useful when config changes)
         def clear_cache!
-          @whitelist_entries = nil
-          @parsed_entries = nil
+          @parsed_snapshot = nil
         end
 
         # Validate whitelist configuration
         def validate_configuration!
           errors = []
-          
+
           whitelist_entries.each_with_index do |entry, index|
-            begin
-              parse_entry(entry)
-            rescue IPAddr::InvalidAddressError, ArgumentError => e
-              errors << "Entry #{index} (#{entry}): #{e.message}"
-            end
+            parse_entry(entry)
+          rescue ArgumentError => e
+            errors << "Entry #{index} (#{entry}): #{e.message}"
           end
 
           if errors.any?
@@ -67,16 +61,10 @@ module Beskar
         # Parse whitelist entry (can be single IP or CIDR notation)
         def parse_entry(entry)
           return nil if entry.blank?
-          
+
           entry_str = entry.to_s.strip
-          
-          # Check if it's CIDR notation
-          if entry_str.include?('/')
-            IPAddr.new(entry_str)
-          else
-            # Single IP address
-            IPAddr.new(entry_str)
-          end
+
+          IPAddr.new(entry_str)
         end
 
         # Check if IP matches whitelist entry
@@ -86,23 +74,26 @@ module Beskar
 
           # IPAddr#include? handles both single IPs and CIDR ranges
           parsed_entry.include?(ip)
-        rescue IPAddr::InvalidAddressError, ArgumentError
+        rescue ArgumentError
           false
         end
 
         # Cache parsed entries for performance
         def parsed_entries
-          @parsed_entries ||= begin
-            entries = {}
-            whitelist_entries.each do |entry|
-              begin
-                entries[entry] = parse_entry(entry)
-              rescue IPAddr::InvalidAddressError, ArgumentError => e
-                Rails.logger.warn "[Beskar::IpWhitelist] Skipping invalid entry: #{entry} - #{e.message}"
-              end
-            end
-            entries
+          source = whitelist_entries
+          snapshot = @parsed_snapshot
+          return snapshot.last if snapshot && snapshot.first == source
+
+          entries = {}
+          source.each do |entry|
+            entries[entry] = parse_entry(entry)
+          rescue ArgumentError => e
+            Beskar::Logger.warn("Skipping invalid entry: #{entry} - #{e.class}", component: :IpWhitelist)
           end
+          # Publish the source and parsed entries together, never a half-updated
+          # cache that another request could mistake for the new configuration.
+          @parsed_snapshot = [source.deep_dup, entries]
+          entries
         end
       end