beskar 0.0.2 → 0.2.0

data/lib/tasks/beskar_tasks.rake

@@ -1,6 +1,11 @@
 # frozen_string_literal: true
 
 namespace :beskar do
+  desc "Remove expired coordination state (does not remove audit events or active bans)"
+  task cleanup_security_state: :environment do
+    Beskar::SecurityState.cleanup_expired!
+  end
+
   desc "Install Beskar: copy migrations and create initializer"
   task install: :environment do
     puts "=" * 80
@@ -10,25 +15,19 @@ namespace :beskar do
 
     # Copy migrations
     puts "📦 Copying migrations..."
-    begin
-      Rake::Task["beskar:install:migrations"].invoke
-    rescue RuntimeError
-      # In development/test within the gem, this task might not exist
-      # In a real app using the gem, it will work fine
-      puts "   (Skipping migration copy in gem development mode)"
-    end
+    Rake::Task["beskar:install:migrations"].invoke
     puts "✓ Migrations ready"
     puts
 
     # Create initializer
     initializer_path = Rails.root.join("config/initializers/beskar.rb")
-    
+
     if File.exist?(initializer_path)
       puts "⚠️  Initializer already exists at config/initializers/beskar.rb"
       print "   Overwrite? (y/N): "
-      response = $stdin.gets.chomp.downcase
-      
-      unless response == 'y' || response == 'yes'
+      response = $stdin.gets.to_s.strip.downcase
+
+      unless response == "y" || response == "yes"
         puts "   Skipping initializer creation"
         puts
         next_steps
@@ -37,8 +36,17 @@ namespace :beskar do
     end
 
     puts "📝 Creating initializer..."
-    template_path = File.expand_path("../beskar/templates/beskar_initializer.rb", __dir__)
-    FileUtils.cp(template_path, initializer_path)
+    template_path = File.expand_path("../generators/beskar/install/templates/initializer.rb.tt", __dir__)
+
+    # Read the template and process ERB (Rails will be available in the rake task context)
+    template_content = File.read(template_path)
+    erb = ERB.new(template_content, trim_mode: "-")
+
+    # Evaluate the ERB template in a context where Rails is available
+    processed_content = erb.result(binding)
+
+    # Write the processed initializer
+    File.write(initializer_path, processed_content)
     puts "✓ Created config/initializers/beskar.rb"
     puts
 
@@ -60,7 +68,7 @@ namespace :beskar do
     puts
     puts "   # app/models/user.rb"
     puts "   class User < ApplicationRecord"
-    puts "     include Beskar::SecurityTrackable"
+    puts "     include Beskar::Models::SecurityTrackable"
     puts "     "
     puts "     devise :database_authenticatable, :registerable,"
     puts "            :recoverable, :rememberable, :validatable"
@@ -89,11 +97,8 @@ namespace :beskar do
     puts "5. When ready to enable blocking:"
     puts
     puts "   # config/initializers/beskar.rb"
-    puts "   config.waf = {"
-    puts "     enabled: true,"
-    puts "     monitor_only: false,  # <-- Change this to false"
-    puts "     # ... rest of config"
-    puts "   }"
+    puts "   config.waf[:enabled] = true"
+    puts "   config.monitor_only = false"
     puts
     puts "6. Optional: Add IP whitelist for trusted sources:"
     puts
@@ -106,7 +111,7 @@ namespace :beskar do
     puts "=" * 80
     puts "Documentation:"
     puts "  - README: https://github.com/humadroid-io/beskar"
-    puts "  - WAF Monitor Mode: See MONITOR_ONLY_MODE.md"
+    puts "  - WAF Monitor Mode: See docs/operations/monitor-only-mode.md"
     puts "=" * 80
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: beskar
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.2.0
 platform: ruby
 authors:
 - Maciej Litwiniuk
@@ -23,6 +23,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 8.0.0
+- !ruby/object:Gem::Dependency
+  name: csv
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: maxminddb
   requirement: !ruby/object:Gem::Requirement
@@ -66,7 +80,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: ostruct
+  name: factory_bot_rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -80,7 +94,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: factory_bot_rails
+  name: mocha
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -94,7 +108,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: mocha
+  name: ostruct
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -107,50 +121,115 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: |-
-  Rails Security Shield is a comprehensive, Rails-native security engine designed to provide multi-layered protection for modern web applications. It actively defends against common threats by integrating a powerful Web Application Firewall (WAF) to block attacks like SQLi and XSS, an advanced bot detection system using JavaScript challenges and honeypots, and robust account takeover prevention to stop brute-force and credential stuffing attacks.
-
-  Built as a mountable Rails Engine, it leverages core framework features like ActiveJob and Rails.cache to ensure high performance and minimal external dependencies. It includes a real-time dashboard for monitoring security events, giving you immediate insight into the threats your application faces. Drop it in, configure it, and get enterprise-grade security that feels like a natural extension of Rails.
+description: Beskar is a mountable Rails engine with database-coordinated authentication
+  admission limits, risk-based account locks, persistent IP bans, scanner-path signatures,
+  and an administrative security dashboard. It supports Devise and explicit Rails-native
+  authentication integration, optional MaxMind enrichment, User-Agent risk heuristics,
+  and monitor-only operation. It does not implement general SQL injection or XSS filtering,
+  JavaScript challenges, or honeypots.
 email:
 - maciej@litwiniuk.net
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - MIT-LICENSE
 - README.md
 - Rakefile
 - app/assets/stylesheets/beskar/application.css
+- app/channels/concerns/beskar/channels/session_security.rb
+- app/controllers/beskar/administrative_actions_controller.rb
 - app/controllers/beskar/application_controller.rb
+- app/controllers/beskar/banned_ips_controller.rb
+- app/controllers/beskar/dashboard_controller.rb
+- app/controllers/beskar/security_events_controller.rb
+- app/controllers/concerns/beskar/controllers/audit_export.rb
 - app/controllers/concerns/beskar/controllers/security_tracking.rb
+- app/controllers/concerns/beskar/controllers/session_security.rb
 - app/helpers/beskar/application_helper.rb
 - app/jobs/beskar/application_job.rb
+- app/jobs/beskar/notification_job.rb
 - app/mailers/beskar/application_mailer.rb
+- app/mailers/beskar/security_mailer.rb
+- app/models/beskar/administrative_action.rb
 - app/models/beskar/application_record.rb
 - app/models/beskar/banned_ip.rb
 - app/models/beskar/security_event.rb
+- app/models/beskar/security_state.rb
+- app/services/beskar/banned_ip_manager.rb
+- app/views/beskar/administrative_actions/index.html.erb
+- app/views/beskar/administrative_actions/show.html.erb
+- app/views/beskar/banned_ips/edit.html.erb
+- app/views/beskar/banned_ips/index.html.erb
+- app/views/beskar/banned_ips/new.html.erb
+- app/views/beskar/banned_ips/review.html.erb
+- app/views/beskar/banned_ips/show.html.erb
+- app/views/beskar/dashboard/index.html.erb
+- app/views/beskar/security_events/index.html.erb
+- app/views/beskar/security_events/show.html.erb
+- app/views/beskar/shared/_export_form.html.erb
+- app/views/layouts/beskar/_behavior.html.erb
 - app/views/layouts/beskar/application.html.erb
 - config/locales/en.yml
 - config/routes.rb
 - db/migrate/20251016000001_create_beskar_security_events.rb
 - db/migrate/20251016000002_create_beskar_banned_ips.rb
+- db/migrate/20260910000001_create_beskar_security_states.rb
+- db/migrate/20260911000001_create_beskar_administrative_actions.rb
+- db/migrate/20260911000002_expand_administrative_action_targets.rb
+- docs/README.md
+- docs/archive/project-documentation.md
+- docs/audits/project-review.md
+- docs/audits/repair-status.md
+- docs/guides/audit-and-waf.md
+- docs/guides/audit-lifecycle.md
+- docs/guides/authentication.md
+- docs/guides/configuration.md
+- docs/guides/dashboard-and-search.md
+- docs/guides/notifications-and-recovery.md
+- docs/guides/risk-scoring.md
+- docs/operations/monitor-only-mode.md
+- docs/operations/security-hardening.md
+- docs/operations/state-storage.md
+- docs/research/rust-performance-assessment.md
 - lib/beskar.rb
 - lib/beskar/configuration.rb
+- lib/beskar/configuration_validator.rb
+- lib/beskar/devise_authentication.rb
 - lib/beskar/engine.rb
+- lib/beskar/logger.rb
 - lib/beskar/middleware.rb
 - lib/beskar/middleware/request_analyzer.rb
 - lib/beskar/models/security_trackable.rb
 - lib/beskar/models/security_trackable_authenticable.rb
 - lib/beskar/models/security_trackable_devise.rb
 - lib/beskar/models/security_trackable_generic.rb
+- lib/beskar/risk_level.rb
 - lib/beskar/services/account_locker.rb
+- lib/beskar/services/administrative_audit.rb
+- lib/beskar/services/administrative_bans.rb
+- lib/beskar/services/audit_data.rb
+- lib/beskar/services/authentication.rb
+- lib/beskar/services/authentication_attempt.rb
+- lib/beskar/services/ban_expiry.rb
 - lib/beskar/services/device_detector.rb
+- lib/beskar/services/event_search.rb
 - lib/beskar/services/geolocation_service.rb
 - lib/beskar/services/ip_whitelist.rb
+- lib/beskar/services/location_assessment.rb
+- lib/beskar/services/native_account_lock.rb
+- lib/beskar/services/notifications.rb
 - lib/beskar/services/rate_limiter.rb
+- lib/beskar/services/request_context.rb
+- lib/beskar/services/risk_assessment.rb
+- lib/beskar/services/session_revocation.rb
 - lib/beskar/services/waf.rb
-- lib/beskar/templates/beskar_initializer.rb
+- lib/beskar/services/waf_request.rb
 - lib/beskar/version.rb
+- lib/beskar/warden_authentication.rb
+- lib/generators/beskar/install/install_generator.rb
+- lib/generators/beskar/install/templates/initializer.rb.tt
 - lib/tasks/beskar_tasks.rake
 homepage: https://humadroid.io/beskar
 licenses:
@@ -158,6 +237,8 @@ licenses:
 metadata:
   homepage_uri: https://humadroid.io/beskar
   source_code_uri: https://github.com/humadroid-io/beskar
+  documentation_uri: https://github.com/humadroid-io/beskar/blob/master/docs/README.md
+  changelog_uri: https://github.com/humadroid-io/beskar/blob/master/CHANGELOG.md
 rdoc_options: []
 require_paths:
 - lib
@@ -172,8 +253,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.20
 specification_version: 4
-summary: An all-in-one security engine for Rails providing WAF, bot detection, and
-  account takeover prevention.
+summary: A Rails security engine for authentication limits, risk-based locks, IP bans,
+  and audit events.
 test_files: []

data/lib/beskar/templates/beskar_initializer.rb

@@ -1,107 +0,0 @@
-# frozen_string_literal: true
-
-Beskar.configure do |config|
-  # ============================================================================
-  # Web Application Firewall (WAF) - ENABLED IN MONITOR MODE BY DEFAULT
-  # ============================================================================
-  # Detects and logs vulnerability scanning attempts (WordPress, phpMyAdmin, etc.)
-  # Start in monitor-only mode to observe patterns before enabling blocking.
-  #
-  config.waf = {
-    enabled: true,                        # Master switch for WAF
-    monitor_only: true,                   # LOG ONLY - does not block (recommended to start)
-    auto_block: true,                     # Auto-block IPs after threshold (when monitor_only=false)
-    block_threshold: 3,                   # Number of violations before blocking
-    violation_window: 1.hour,             # Time window for counting violations
-    block_durations: [1.hour, 6.hours, 24.hours, 7.days], # Escalating ban durations
-    permanent_block_after: 5,             # Permanent ban after N violations (nil = never)
-    create_security_events: true          # Log violations to SecurityEvent table
-  }
-  
-  # After monitoring for 24-48 hours, review logs and disable monitor_only:
-  # config.waf[:monitor_only] = false
-  
-  # View WAF activity in logs:
-  # tail -f log/production.log | grep "Beskar::WAF"
-  
-  # Query violations that would be blocked:
-  # Beskar::SecurityEvent.where(event_type: 'waf_violation')
-  #   .where("metadata->>'would_be_blocked' = ?", 'true').count
-
-  # ============================================================================
-  # IP Whitelisting (RECOMMENDED)
-  # ============================================================================
-  # Trusted IPs bypass all blocking (bans, rate limits, WAF) while still
-  # logging activity for audit purposes.
-  #
-  # config.ip_whitelist = [
-  #   "192.168.1.100",      # Single IP address
-  #   "10.0.0.0/24",        # CIDR notation - entire subnet
-  #   "172.16.0.0/16"       # Larger CIDR range
-  #   # Add your office IPs, monitoring services, trusted partners, etc.
-  # ]
-
-  # ============================================================================
-  # Security Event Tracking (OPTIONAL)
-  # ============================================================================
-  # Track authentication events for risk analysis and threat detection.
-  # Disable if you don't need historical security event data.
-  #
-  # config.security_tracking = {
-  #   enabled: true,                    # Master switch for all tracking
-  #   track_successful_logins: true,    # Track successful authentications
-  #   track_failed_logins: true,        # Track failed authentication attempts
-  #   auto_analyze_patterns: true       # Enable automatic pattern analysis
-  # }
-
-  # ============================================================================
-  # Rate Limiting (OPTIONAL)
-  # ============================================================================
-  # Protect against brute force attacks by limiting authentication attempts.
-  #
-  # config.rate_limiting = {
-  #   ip_attempts: {
-  #     limit: 10,                    # Max attempts per IP
-  #     period: 1.hour,               # Time window
-  #     exponential_backoff: true     # Increase delay after each attempt
-  #   },
-  #   account_attempts: {
-  #     limit: 5,                     # Max attempts per account
-  #     period: 15.minutes,
-  #     exponential_backoff: true
-  #   },
-  #   global_attempts: {
-  #     limit: 100,                   # System-wide limit (DDoS protection)
-  #     period: 1.minute,
-  #     exponential_backoff: false
-  #   }
-  # }
-
-  # ============================================================================
-  # Risk-Based Account Locking (OPTIONAL)
-  # ============================================================================
-  # Automatically lock accounts when authentication risk score is too high.
-  # Requires Devise :lockable module.
-  #
-  # config.risk_based_locking = {
-  #   enabled: false,                 # Disabled by default
-  #   risk_threshold: 75,             # Lock if risk score >= this (0-100)
-  #   lock_strategy: :devise_lockable, # Strategy: :devise_lockable, :custom, :none
-  #   auto_unlock_time: 1.hour,       # Time until automatic unlock
-  #   notify_user: true,              # Send notification on lock
-  #   log_lock_events: true           # Create security events for locks
-  # }
-
-  # ============================================================================
-  # IP Geolocation (OPTIONAL)
-  # ============================================================================
-  # Enhance risk assessment with geographic information.
-  # Requires MaxMind GeoLite2-City database (free with registration).
-  # Download from: https://dev.maxmind.com/geoip/geolite2-free-geolocation-data
-  #
-  # config.geolocation = {
-  #   provider: :maxmind,
-  #   maxmind_city_db_path: Rails.root.join('db', 'geoip', 'GeoLite2-City.mmdb').to_s,
-  #   cache_ttl: 4.hours
-  # }
-end