beskar 0.0.2 → 0.2.0

data/app/channels/concerns/beskar/channels/session_security.rb

@@ -0,0 +1,46 @@
+module Beskar
+  module Channels
+    # Prepend to ApplicationCable::Channel to cover every subscription and inbound
+    # action. The connection resolves identity and the credential's signed epoch.
+    # Standard outbound channel transmissions are checked too. No polling of idle
+    # connections is needed; direct connection.transmit bypasses channel policy.
+    module SessionSecurity
+      def subscribe_to_channel
+        unless beskar_session_allowed?
+          reject
+          reject_subscription
+          return
+        end
+        super
+      end
+
+      def perform_action(data)
+        unless beskar_session_allowed?
+          stop_all_streams
+          connection.close(reason: "authentication_revoked", reconnect: false)
+          return
+        end
+        super
+      end
+
+      private
+
+      def transmit(data, via: nil)
+        unless beskar_session_allowed?
+          stop_all_streams
+          connection.close(reason: "authentication_revoked", reconnect: false)
+          return
+        end
+        super
+      end
+
+      def beskar_session_allowed?
+        return false unless connection.respond_to?(:beskar_authenticated_user) && connection.respond_to?(:beskar_authenticated_generation)
+        Services::SessionRevocation.allowed?(connection.beskar_authenticated_user,
+          request: connection.request, token: connection.beskar_authenticated_generation)
+      rescue Services::AuthenticationAttempt::Unavailable
+        false
+      end
+    end
+  end
+end

data/app/controllers/beskar/administrative_actions_controller.rb

@@ -0,0 +1,16 @@
+module Beskar
+  class AdministrativeActionsController < ApplicationController
+    before_action { response.headers["Cache-Control"] = "no-store" }
+
+    def index
+      records = AdministrativeAction.order(id: :desc)
+      records = records.where(target_type: "BannedIp", target_id: params[:target_id]) if params[:target_id].present?
+      @pagination = paginate(records)
+      @administrative_actions = @pagination[:records]
+    end
+
+    def show
+      @administrative_action = AdministrativeAction.find(params[:id])
+    end
+  end
+end

data/app/controllers/beskar/application_controller.rb

@@ -1,4 +1,218 @@
 module Beskar
   class ApplicationController < ActionController::Base
+    # Use the main app's CSRF protection settings
+    protect_from_forgery with: :exception, prepend: true
+
+    layout "beskar/application"
+
+    # Ensure CSRF token is available for forms
+    before_action :ensure_csrf_token
+
+    before_action :authenticate_admin!
+    before_action :authorize_admin_action!
+
+    private
+
+    def authorize_admin_action!
+      permission = if controller_name == "administrative_actions"
+        :read_audit
+      elsif action_name == "export"
+        :export
+      elsif controller_name == "banned_ips" && %w[new create edit update destroy extend review bulk_action].include?(action_name)
+        :manage_bans
+      else
+        :read
+      end
+      callback = Beskar.configuration.authorize_admin
+      allowed = callback && instance_exec(request, permission, &callback) == true
+      head :forbidden unless performed? || allowed
+    rescue => error
+      Beskar::Logger.warn("Administrative authorization unavailable (#{error.class})")
+      head :service_unavailable unless performed?
+    end
+
+    def administrative_actor!
+      callback = Beskar.configuration.audit_actor
+      actor = instance_exec(request, &callback) if callback
+      raise Services::AdministrativeAudit::Unavailable unless Services::AdministrativeBans.valid_actor?(actor)
+      actor
+    rescue => error
+      Beskar::Logger.warn("Administrative actor unavailable (#{error.class})")
+      raise Services::AdministrativeAudit::Unavailable, "Administrative identity unavailable"
+    end
+
+    # Override this method in your application to implement authentication
+    # For example, you might want to use Devise's authenticate_admin! or
+    # a custom authentication method
+    def authenticate_admin!
+      unless Beskar.configuration.authenticate_admin.present?
+        handle_missing_authentication_configuration
+        return false
+      end
+
+      handle_custom_authentication
+    end
+
+    def handle_custom_authentication
+      # Execute the authentication block in the controller's context
+      # This gives the block access to controller methods like cookies, session,
+      # authenticate_or_request_with_http_basic, etc.
+      result = instance_exec(request, &Beskar.configuration.authenticate_admin)
+      return false if performed?
+      return true if result
+
+      handle_authentication_failure
+      false
+    rescue => e
+      Rails.logger.error "Beskar authentication error: #{e.class}"
+      handle_authentication_failure
+      false
+    end
+
+    def handle_missing_authentication_configuration
+      # Log the configuration error for debugging, but return 404 to avoid revealing Beskar is installed
+      error_message = <<~'MSG'
+        Beskar authentication not configured!
+
+        Configure Beskar.configuration.authenticate_admin in your initializer:
+
+        # config/initializers/beskar.rb
+        Beskar.configuration.authenticate_admin = ->(request) do
+          # The block is executed in the controller context, giving you access
+          # to controller methods like cookies, session, authenticate_or_request_with_http_basic, etc.
+
+          # Example 1: Check for admin user with Devise
+          # user = request.env['warden']&.authenticate(scope: :user)
+          # user&.admin?
+
+          # Example 2: HTTP Basic Auth (uses controller method)
+          # authenticate_or_request_with_http_basic do |username, password|
+          #   Beskar::Services::RequestContext.secure_match?(username, ENV['BESKAR_USERNAME']) &&
+          #     Beskar::Services::RequestContext.secure_match?(password, ENV['BESKAR_PASSWORD'])
+          # end
+
+          # Example 3: Cookie-based auth (uses controller cookies)
+          # Beskar::Services::RequestContext.secure_match?(cookies.signed[:admin_token], ENV['BESKAR_ADMIN_TOKEN'])
+
+          # Example 4: Simple token-based auth
+          # token = ENV['BESKAR_ADMIN_TOKEN']
+          # token.present? && Beskar::Services::RequestContext.secure_match?(request.headers['Authorization'], "Bearer #{token}")
+
+          # Example 5: For development/testing (NOT for production!)
+          # Rails.env.development? || Rails.env.test?
+        end
+      MSG
+
+      Rails.logger.error error_message
+      render_404
+    end
+
+    def handle_authentication_failure
+      # Return 404 to avoid revealing that Beskar is installed
+      render_404 unless performed?
+    end
+
+    def render_404
+      respond_to do |format|
+        format.html { render file: "#{Rails.public_path}/404.html", status: :not_found, layout: false }
+        format.json { render json: {error: "Not found"}, status: :not_found }
+        format.any { head :not_found }
+      end
+    end
+
+    # Helper method to format timestamps
+    def format_timestamp(time)
+      return "-" unless time
+      time.in_time_zone.strftime("%Y-%m-%d %H:%M:%S %Z")
+    end
+    helper_method :format_timestamp
+
+    def ban_expiry_input_value(time)
+      time&.utc&.iso8601(3)&.delete_suffix("Z")
+    end
+    helper_method :ban_expiry_input_value
+
+    # Helper method to format IP addresses with location if available
+    def format_ip_with_location(ip, metadata = {})
+      return ip unless metadata.present?
+
+      location_parts = []
+      if metadata["geolocation"].present?
+        geo = metadata["geolocation"]
+        location_parts << geo["city"] if geo["city"].present?
+        location_parts << geo["country"] if geo["country"].present?
+      end
+
+      return ip if location_parts.empty?
+      "#{ip} (#{location_parts.join(", ")})"
+    end
+    helper_method :format_ip_with_location
+
+    # Helper to determine risk level badge color
+    def risk_level_class(risk_score)
+      RiskLevel::BADGES.fetch(RiskLevel.for(risk_score), "neutral")
+    end
+    helper_method :risk_level_class
+
+    def risk_level_color(risk_score)
+      RiskLevel::COLORS.fetch(RiskLevel.for(risk_score), "#697386")
+    end
+    helper_method :risk_level_color
+
+    def risk_level_label(risk_score)
+      level = RiskLevel.for(risk_score)
+      level ? "#{level.to_s.capitalize} Risk" : "Unknown Risk"
+    end
+    helper_method :risk_level_label
+
+    def audit_user_label(event)
+      attempted = event.attempted_email
+      Services::AuditData.user_email(event.user) || (Services::AuditData.field(:email, attempted, limit: 320) if attempted.present?) ||
+        (event.user_id ? "User ##{event.user_id}" : "-")
+    end
+    helper_method :audit_user_label
+
+    # Helper to format event type for display
+    def format_event_type(event_type)
+      event_type.to_s.humanize.titleize
+    end
+    helper_method :format_event_type
+
+    # Pagination helper
+    def paginate(collection, per_page: 25)
+      # Handle per_page from params if provided
+      if params[:per_page].present?
+        per_page = params[:per_page].to_i
+        per_page = 25 if per_page <= 0  # Default if invalid
+        per_page = 100 if per_page > 100  # Max limit
+      end
+
+      page = (params[:page] || 1).to_i
+      page = 1 if page < 1
+
+      total_count = collection.count
+      total_pages = (total_count > 0) ? (total_count.to_f / per_page).ceil : 0
+
+      offset = (page - 1) * per_page
+      records = collection.limit(per_page).offset(offset)
+
+      {
+        records: records,
+        current_page: page,
+        total_pages: total_pages,
+        total_count: total_count,
+        per_page: per_page,
+        has_previous: page > 1,
+        has_next: page < total_pages,
+        previous_page: (page > 1) ? page - 1 : nil,
+        next_page: (page < total_pages) ? page + 1 : nil
+      }
+    end
+
+    # Ensure CSRF token is properly set for forms in the engine
+    def ensure_csrf_token
+      # Force generation of CSRF token if not present
+      form_authenticity_token
+    end
   end
 end

data/app/controllers/beskar/banned_ips_controller.rb

@@ -0,0 +1,255 @@
+require "csv"
+
+module Beskar
+  class BannedIpsController < ApplicationController
+    include Controllers::AuditExport
+
+    class ActorUnavailable < StandardError; end
+    before_action :set_banned_ip, only: [:show, :edit, :update, :destroy, :extend, :review]
+    before_action :prepare_administration, only: [:create, :update, :destroy, :extend, :bulk_action]
+    rescue_from ActorUnavailable, with: :administration_unavailable
+    rescue_from Services::AdministrativeBans::InvalidInput, Services::BanExpiry::InvalidInput do |error|
+      render plain: error.message, status: :unprocessable_content
+    end
+    rescue_from ActiveRecord::ActiveRecordError, with: :administration_unavailable
+
+    def index
+      @banned_ips = Beskar::BannedIp.order(banned_at: :desc)
+
+      # Apply filters
+      apply_filters!
+
+      # Paginate results
+      @pagination = paginate(@banned_ips, per_page: params[:per_page]&.to_i || 25)
+      @banned_ips = @pagination[:records]
+
+      # Get filter options
+      @ban_reasons = Beskar::BannedIp.distinct.pluck(:reason).compact.sort
+      @ban_statuses = ["active", "expired", "permanent", "temporary"]
+    end
+
+    def show
+      # Get related security events for this IP
+      events = Beskar::SecurityEvent.where(ip_address: @banned_ip.ip_address)
+      @related_events = events.preload(:user).order(created_at: :desc, id: :desc).limit(20)
+
+      # Calculate statistics
+      @stats = {
+        total_events: events.count,
+        avg_risk_score: events.average(:risk_score)&.round(1) || 0,
+        max_risk_score: events.maximum(:risk_score) || 0,
+        first_seen: events.minimum(:created_at),
+        last_seen: events.maximum(:created_at)
+      }
+    end
+
+    def new
+      @banned_ip = Beskar::BannedIp.new
+      @suggested_ip = params[:ip_address]
+      @suggested_reason = params[:reason]
+    end
+
+    def create
+      manager = BannedIpManager.new(create_params)
+      @banned_ip = @administration.create!(manager.build)
+      redirect_to banned_ip_path(@banned_ip), notice: "IP address #{@banned_ip.ip_address} has been banned successfully."
+    rescue ActiveRecord::RecordInvalid => error
+      render_invalid_ban(error, :new)
+    end
+
+    def edit
+    end
+
+    def update
+      attributes = banned_ip_params.to_h
+      if attributes.key?("expires_at")
+        attributes["expires_at"] = if ActiveModel::Type::Boolean.new.cast(attributes.fetch("permanent", @banned_ip.permanent?))
+          nil
+        else
+          Services::BanExpiry.parse(attributes["expires_at"])
+        end
+        # HTML datetime-local only represents milliseconds. Preserve the stored
+        # microseconds when the displayed value was submitted without a change.
+        current_expiry = @banned_ip.expires_at
+        if params[:expiry_precision] == "milliseconds" && current_expiry &&
+            attributes["expires_at"] == current_expiry.change(usec: current_expiry.usec / 1000 * 1000)
+          attributes["expires_at"] = current_expiry
+        end
+      end
+      count = @administration.change!([@banned_ip.id], action: "update", attributes: attributes)
+      message = count.positive? ? "Ban for IP #{@banned_ip.ip_address} has been updated." : "No ban changes were necessary."
+      redirect_to banned_ip_path(@banned_ip), notice: message
+    rescue ActiveRecord::RecordInvalid => error
+      render_invalid_ban(error, :edit)
+    end
+
+    def destroy
+      ip_address = @banned_ip.ip_address
+      @administration.change!([@banned_ip.id], action: "unban")
+
+      redirect_to banned_ips_path,
+        notice: "IP address #{ip_address} has been unbanned."
+    end
+
+    def extend
+      action = (params[:duration] == "permanent") ? "make_permanent" : "extend"
+      @administration.change!([@banned_ip.id], action: action, duration: params[:duration] || "24h")
+      redirect_to banned_ip_path(@banned_ip), notice: "Ban updated and administrative action recorded."
+    end
+
+    def review
+      @operation = params[:operation]
+      head :bad_request unless %w[unban extend].include?(@operation)
+    end
+
+    def bulk_action
+      action = params[:bulk_action]
+      raise Services::AdministrativeBans::InvalidInput, "Unknown bulk action" unless %w[unban extend make_permanent].include?(action)
+      count = @administration.change!(params[:ip_ids], action: action, duration: params[:duration])
+      description = {"unban" => "unbanned", "make_permanent" => "made permanent", "extend" => "extended"}.fetch(action)
+      redirect_to banned_ips_path, notice: "#{count} ban(s) #{description}; administrative actions recorded."
+    end
+
+    def export
+      @banned_ips = Beskar::BannedIp.all
+      apply_filters!
+      records = export_records(@banned_ips)
+      return if performed?
+
+      respond_to do |format|
+        format.csv do
+          send_data generate_csv(records),
+            filename: "banned-ips-#{Date.current}.csv",
+            type: "text/csv"
+        end
+        format.json do
+          render json: records.map { |ban|
+            ban.attributes.slice("id", "ip_address", "reason", "details",
+              "permanent", "banned_at", "expires_at", "violation_count", "metadata", "created_at")
+          }
+        end
+      end
+    end
+
+    private
+
+    def ban_reason_options
+      options = [["Rate Limit Abuse", "rate_limit_abuse"], ["Authentication Abuse", "authentication_abuse"],
+        ["WAF Violation", "waf_violation"], ["Brute Force Attack", "brute_force_attack"],
+        ["Suspicious Activity", "suspicious_activity"], ["Manual Ban", "manual_ban"], ["Other", "other"]]
+      reason = @suggested_reason || @banned_ip.reason
+      options << [reason, reason] if reason.present? && options.none? { |_, value| value == reason }
+      options
+    end
+    helper_method :ban_reason_options
+
+    def prepare_administration
+      begin
+        callback = Beskar.configuration.audit_actor
+        actor = instance_exec(request, &callback) if callback
+        raise ActorUnavailable unless Services::AdministrativeBans.valid_actor?(actor)
+      rescue => error
+        Beskar::Logger.warn("Administrative actor unavailable (#{error.class})")
+        raise ActorUnavailable, "Administrative identity unavailable"
+      end
+      @administration = Services::AdministrativeBans.new(actor: actor, reason: params[:audit_reason], request_id: request.request_id)
+    end
+
+    def administration_unavailable(error)
+      return head :not_found if error.is_a?(ActiveRecord::RecordNotFound)
+      Beskar::Logger.warn("Administrative operation unavailable (#{error.class})")
+      render plain: "Administrative changes are unavailable. Reload state before retrying.", status: :service_unavailable
+    end
+
+    def render_invalid_ban(error, template)
+      return administration_unavailable(error) unless error.record.is_a?(BannedIp)
+      @banned_ip = error.record
+      render template, status: :unprocessable_content
+    end
+
+    def set_banned_ip
+      @banned_ip = Beskar::BannedIp.find(params[:id])
+    end
+
+    def banned_ip_params
+      input = params.require(:banned_ip)
+      if input.key?(:expires_at) && !input[:expires_at].nil? && !input[:expires_at].is_a?(String)
+        raise Services::BanExpiry::InvalidInput, "Expiry must be a date and time string"
+      end
+      input.permit(
+        :ip_address, :reason, :details, :permanent,
+        :expires_at, :violation_count, metadata: {}
+      )
+    end
+
+    def create_params
+      banned_ip_params.to_h.merge(
+        ban_type: params[:ban_type],
+        duration: params[:duration]
+      ).symbolize_keys
+    end
+
+    def apply_filters!
+      # Filter by status
+      case params[:status]
+      when "active"
+        @banned_ips = @banned_ips.active
+      when "expired"
+        @banned_ips = @banned_ips.expired
+      when "permanent"
+        @banned_ips = @banned_ips.permanent
+      when "temporary"
+        @banned_ips = @banned_ips.temporary
+      end
+
+      # Filter by reason
+      if params[:reason].present?
+        @banned_ips = @banned_ips.by_reason(params[:reason])
+      end
+
+      # Filter by IP address (partial match)
+      if params[:ip_search].present?
+        @banned_ips = @banned_ips.where("ip_address LIKE ?", "%#{params[:ip_search]}%")
+      end
+
+      # Filter by date range
+      if params[:banned_after].present?
+        begin
+          date = Date.parse(params[:banned_after])
+          @banned_ips = @banned_ips.where("banned_at >= ?", date.beginning_of_day)
+        rescue ArgumentError
+          # Invalid date, ignore
+        end
+      end
+
+      if params[:banned_before].present?
+        begin
+          date = Date.parse(params[:banned_before])
+          @banned_ips = @banned_ips.where("banned_at <= ?", date.end_of_day)
+        rescue ArgumentError
+          # Invalid date, ignore
+        end
+      end
+    end
+
+    def generate_csv(banned_ips)
+      require "csv"
+
+      CSV.generate(headers: true, force_quotes: true) do |csv|
+        csv << ["IP Address", "Reason", "Banned At", "Expires At", "Status", "Violation Count", "Details"]
+
+        banned_ips.each do |ban|
+          csv << [
+            ban.ip_address,
+            ban.reason,
+            ban.banned_at.strftime("%Y-%m-%d %H:%M:%S"),
+            ban.expires_at&.strftime("%Y-%m-%d %H:%M:%S") || (ban.permanent? ? "Never (Permanent)" : "-"),
+            ban.active? ? "Active" : "Expired",
+            ban.violation_count,
+            ban.details || "-"
+          ].map { |value| Services::AuditData.csv_cell(value) }
+        end
+      end
+    end
+  end
+end

data/app/controllers/beskar/dashboard_controller.rb

@@ -0,0 +1,62 @@
+module Beskar
+  class DashboardController < ApplicationController
+    def index
+      # Time ranges for statistics
+      @time_range = params[:time_range] || "24h"
+      @start_time = calculate_start_time(@time_range)
+
+      # Overview statistics
+      events = Beskar::SecurityEvent.where(created_at: @start_time..Time.current)
+      @event_distribution = events.group(:event_type).count.sort_by { |_, count| -count }
+      score_counts = events.group(:risk_score).count
+      @risk_distribution = RiskLevel::RANGES.keys.to_h { |level| [level, 0] }
+      score_counts.each do |score, count|
+        level = RiskLevel.for(score)
+        @risk_distribution[level] += count if level
+      end
+      @stats = {
+        total_events: @event_distribution.sum(&:last),
+        failed_logins: @event_distribution.to_h.fetch("login_failure", 0),
+        blocked_ips: Beskar::BannedIp.active.count,
+        high_risk_events: @risk_distribution[:high] + @risk_distribution[:critical],
+        critical_threats: @risk_distribution[:critical]
+      }
+
+      # Recent activity
+      @recent_events = Beskar::SecurityEvent
+        .includes(:user)
+        .order(created_at: :desc, id: :desc)
+        .limit(10)
+
+      # Top threat IPs
+      @top_threat_ips = events
+        .group(:ip_address)
+        .select("ip_address, COUNT(*) as event_count, AVG(risk_score) as avg_risk_score, MAX(risk_score) as max_risk_score")
+        .having("COUNT(*) > 1")
+        .order("event_count DESC, avg_risk_score DESC")
+        .limit(5)
+
+      # Currently active bans
+      @active_bans = Beskar::BannedIp.active.order(banned_at: :desc).limit(5)
+    end
+
+    private
+
+    def calculate_start_time(range)
+      case range
+      when "1h"
+        1.hour.ago
+      when "6h"
+        6.hours.ago
+      when "24h"
+        24.hours.ago
+      when "7d"
+        7.days.ago
+      when "30d"
+        30.days.ago
+      else
+        24.hours.ago
+      end
+    end
+  end
+end