beskar 0.1.0 → 0.2.0

data/lib/beskar/engine.rb

@@ -6,105 +6,38 @@ module Beskar
       app.config.middleware.use ::Beskar::Middleware::RequestAnalyzer
     end
 
-    # Preload banned IPs into cache on startup
-    config.after_initialize do
-      if defined?(Beskar::BannedIp)
-        Rails.application.executor.wrap do
-          Beskar::BannedIp.preload_cache!
-          Beskar::Logger.info("Preloaded banned IPs into cache")
-        rescue => e
-          Beskar::Logger.warn("Failed to preload banned IPs: #{e.message}")
-        end
+    initializer "beskar.warden_callbacks", after: :load_config_initializers do
+      if defined?(Devise)
+        require "devise/strategies/database_authenticatable"
+        Devise::Strategies::DatabaseAuthenticatable.prepend(Beskar::DeviseAuthentication)
       end
-    end
 
-    initializer "beskar.warden_callbacks", after: :load_config_initializers do |app|
       if defined?(Warden)
-        # Track successful authentication and check for high-risk locks
-        Warden::Manager.after_set_user except: :fetch do |user, auth, opts|
-          # Only proceed if Beskar security tracking is available and enabled
-          if user.respond_to?(:track_authentication_event) && auth.request
-            # Track the authentication event (creates security event)
-            security_event = user.track_authentication_event(auth.request, :success)
-
-            # Check if account was locked due to high risk (only if immediate_signout is enabled)
-            # This happens AFTER successful authentication but BEFORE the request completes
-            # Requires :lockable module to be enabled on the user model
-            if Beskar.configuration.immediate_signout? &&
-               Beskar.configuration.risk_based_locking_enabled? &&
-               security_event &&
-               user_was_just_locked?(user, security_event) &&
-               user.respond_to?(:access_locked?) && user.access_locked?
-              Beskar::Logger.warn("Signing out user #{user.id} due to high-risk lock")
-              auth.logout
-              throw :warden, scope: opts[:scope], message: :account_locked_due_to_high_risk
-            end
-          end
-        end
-
-        # Alternative approach using after_authentication is available but not enabled by default
-        # Uncomment this to use the alternative approach (more targeted, only on authentication)
-        # Warden::Manager.after_authentication do |user, auth, opts|
-        #   if user.respond_to?(:check_high_risk_lock_and_signout)
-        #     user.check_high_risk_lock_and_signout(auth)
-        #   end
-        # end
+        Warden::Strategies::Base.prepend(Beskar::WardenStrategyAdmission)
+        Warden::Proxy.prepend(Beskar::WardenSessionAdmission)
 
         Warden::Manager.before_failure do |env, opts|
-          if env
-            request = ActionDispatch::Request.new(env)
-            scope = opts[:scope]
-            
-            # Try to get model class from configuration
-            model_class = Beskar.configuration&.model_class_for_scope(scope)
-            
-            if model_class && model_class.respond_to?(:track_failed_authentication)
-              model_class.track_failed_authentication(request, scope)
-            else
-              Beskar::Logger.debug("No trackable model found for scope: #{scope}")
-            end
-          end
+          next unless env
+          request = ActionDispatch::Request.new(env)
+          attempt = Services::AuthenticationAttempt.current(request, opts[:scope])
+          next unless attempt && !attempt.completed
+          model = Beskar.configuration.model_class_for_scope(opts[:scope])
+          model.track_failed_authentication(request, opts[:scope], attempt: attempt) if model&.respond_to?(:track_failed_authentication)
         end
       end
     end
 
-    # Helper method to check if user was just locked
-    def self.user_was_just_locked?(user, security_event)
-      return false unless Beskar.configuration.risk_based_locking_enabled?
-      return false unless security_event
-      return false unless user&.respond_to?(:security_events)
-
-      # Check if an account_locked or lock_attempted event was just created
-      recent_lock = user.security_events
-        .where(event_type: [ "account_locked", "lock_attempted" ])
-        .where("created_at >= ?", 10.seconds.ago)
-        .order(created_at: :desc)
-        .first
-
-      recent_lock.present?
+    initializer "beskar.register_configuration_validation", after: :load_config_initializers do |app|
+      # Register after host configuration files, so their after_initialize hooks
+      # precede this one. Resolve app/jobs only after the main autoloader is ready.
+      app.config.after_initialize { Beskar.configuration.validate!.seal! }
     end
 
-    # Add engine migrations to host app's migration paths
-    initializer "beskar.append_migrations" do |app|
-      # Don't add migrations if we're inside the engine itself (testing)
-      if !root.to_s.include?(app.root.to_s) && !app.root.to_s.include?(root.to_s)
-        engine_migrations = root.join("db", "migrate").to_s
-
-        # Add to Rails paths
-        app.config.paths["db/migrate"] << engine_migrations
-      end
+    # Compatibility helper: only the current attempt's actual lock qualifies.
+    def self.user_was_just_locked?(user, security_event)
+      return false unless Beskar.configuration.risk_based_locking_enabled?
+      attempt = security_event&.beskar_attempt
+      !!(attempt && attempt.user == user && attempt.locked_now)
     end
-
-    # Ensure ActiveRecord sees the engine migrations after initialization
-    # config.after_initialize do |app|
-    #   unless root.to_s.include?(app.root.to_s)
-    #     engine_migrations = root.join("db", "migrate").to_s
-
-    #     # Update ActiveRecord::Tasks paths
-    #     current_paths = Array(ActiveRecord::Tasks::DatabaseTasks.migrations_paths)
-    #     current_paths << engine_migrations
-    #     ActiveRecord::Tasks::DatabaseTasks.migrations_paths = current_paths.uniq
-    #   end
-    # end
   end
 end

data/lib/beskar/logger.rb

@@ -36,18 +36,15 @@ module Beskar
 
         formatted_message = format_message(message, component)
         logger.send(level, formatted_message)
-      rescue StandardError => e
+      rescue => e
         # Fallback to stderr if logging fails
-        $stderr.puts "[Beskar::Logger] Failed to log message: #{e.message}"
-        $stderr.puts "[Beskar::Logger] Original message: #{formatted_message}"
+        Kernel.warn "[Beskar::Logger] Logging unavailable (#{e.class})"
       end
 
       # Configure the logger instance
       #
       # @param logger_instance [Logger, nil] The logger to use, defaults to Rails.logger
-      def logger=(logger_instance)
-        @logger = logger_instance
-      end
+      attr_writer :logger
 
       # Get the current logger instance
       #
@@ -86,9 +83,7 @@ module Beskar
       #     'Beskar::Services::Waf' => 'WAF',
       #     'Beskar::Services::AccountLocker' => 'AccountLocker'
       #   }
-      def component_aliases=(aliases)
-        @component_aliases = aliases
-      end
+      attr_writer :component_aliases
 
       # Get component aliases
       #
@@ -156,16 +151,16 @@ module Beskar
         return aliased if aliased
 
         # Remove Beskar:: prefix if present for lookup
-        clean_name = component_name.sub(/^Beskar::/, '')
+        clean_name = component_name.sub(/^Beskar::/, "")
         aliased = component_aliases[clean_name]
         return aliased if aliased
 
         # Check if it's already a simple component name (no ::)
-        return clean_name unless clean_name.include?('::')
+        return clean_name unless clean_name.include?("::")
 
         # Extract the last component for nested classes
         # e.g., "Beskar::Services::Waf" -> "Waf"
-        last_component = clean_name.split('::').last
+        last_component = clean_name.split("::").last
         component_aliases[clean_name] || last_component
       end
 
@@ -192,7 +187,7 @@ module Beskar
         if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
           Rails.logger
         else
-          require 'logger'
+          require "logger"
           ::Logger.new($stdout)
         end
       end
@@ -202,28 +197,28 @@ module Beskar
       # @return [Hash] Default aliases
       def default_component_aliases
         {
-          'Beskar::Services::Waf' => 'WAF',
-          'Beskar::Services::WAF' => 'WAF',
-          'Services::Waf' => 'WAF',
-          'Services::WAF' => 'WAF',
-          'Beskar::Services::AccountLocker' => 'AccountLocker',
-          'Services::AccountLocker' => 'AccountLocker',
-          'Beskar::Services::RateLimiter' => 'RateLimiter',
-          'Services::RateLimiter' => 'RateLimiter',
-          'Beskar::Services::IpWhitelist' => 'IpWhitelist',
-          'Services::IpWhitelist' => 'IpWhitelist',
-          'Beskar::Services::GeolocationService' => 'GeolocationService',
-          'Services::GeolocationService' => 'GeolocationService',
-          'Beskar::Services::DeviceDetector' => 'DeviceDetector',
-          'Services::DeviceDetector' => 'DeviceDetector',
-          'Beskar::Middleware::RequestAnalyzer' => 'Middleware',
-          'Middleware::RequestAnalyzer' => 'Middleware',
-          'Beskar::Models::SecurityTrackableDevise' => 'SecurityTracking',
-          'Models::SecurityTrackableDevise' => 'SecurityTracking',
-          'Beskar::Models::SecurityTrackableAuthenticable' => 'SecurityTracking',
-          'Models::SecurityTrackableAuthenticable' => 'SecurityTracking',
-          'Beskar::Models::SecurityTrackableGeneric' => 'SecurityTracking',
-          'Models::SecurityTrackableGeneric' => 'SecurityTracking'
+          "Beskar::Services::Waf" => "WAF",
+          "Beskar::Services::WAF" => "WAF",
+          "Services::Waf" => "WAF",
+          "Services::WAF" => "WAF",
+          "Beskar::Services::AccountLocker" => "AccountLocker",
+          "Services::AccountLocker" => "AccountLocker",
+          "Beskar::Services::RateLimiter" => "RateLimiter",
+          "Services::RateLimiter" => "RateLimiter",
+          "Beskar::Services::IpWhitelist" => "IpWhitelist",
+          "Services::IpWhitelist" => "IpWhitelist",
+          "Beskar::Services::GeolocationService" => "GeolocationService",
+          "Services::GeolocationService" => "GeolocationService",
+          "Beskar::Services::DeviceDetector" => "DeviceDetector",
+          "Services::DeviceDetector" => "DeviceDetector",
+          "Beskar::Middleware::RequestAnalyzer" => "Middleware",
+          "Middleware::RequestAnalyzer" => "Middleware",
+          "Beskar::Models::SecurityTrackableDevise" => "SecurityTracking",
+          "Models::SecurityTrackableDevise" => "SecurityTracking",
+          "Beskar::Models::SecurityTrackableAuthenticable" => "SecurityTracking",
+          "Models::SecurityTrackableAuthenticable" => "SecurityTracking",
+          "Beskar::Models::SecurityTrackableGeneric" => "SecurityTracking",
+          "Models::SecurityTrackableGeneric" => "SecurityTracking"
         }
       end
     end

data/lib/beskar/middleware/request_analyzer.rb

@@ -7,9 +7,9 @@ module Beskar
 
       def call(env)
         request = ActionDispatch::Request.new(env)
-        ip_address = request.ip
+        ip_address = Beskar::Services::RequestContext.ip(request)
 
-        Beskar::Logger.debug("[RequestAnalyzer] Processing request from IP: #{ip_address}, Path: #{request.path}", component: :Middleware)
+        Beskar::Logger.debug("[RequestAnalyzer] Processing request from IP: #{ip_address}", component: :Middleware)
 
         # 1. Check if IP is whitelisted (whitelisted IPs skip blocking but still get logged)
         is_whitelisted = Beskar::Services::IpWhitelist.whitelisted?(ip_address)
@@ -25,9 +25,11 @@ module Beskar
         end
 
         # 3. Check rate limiting (unless whitelisted)
-        if !is_whitelisted && rate_limited?(request)
-          # Auto-block after excessive rate limiting violations (even in monitor-only mode - we create the ban record)
-          if should_auto_block_rate_limit?(ip_address)
+        rate_limit = Beskar.configuration.rate_limiting[:ip_attempts][:block_requests] ?
+          Beskar::Services::RateLimiter.check_ip_rate_limit(ip_address) : {allowed: true}
+        if !is_whitelisted && !rate_limit[:allowed]
+          # Observe denials separately in monitor mode; never create active bans.
+          if should_auto_block_rate_limit?(ip_address) && !Beskar.configuration.monitor_only?
             Beskar::BannedIp.ban!(
               ip_address,
               reason: "rate_limit_abuse",
@@ -40,7 +42,7 @@ module Beskar
             Beskar::Logger.warn("🔍 MONITOR-ONLY: Would block rate limit exceeded for IP: #{ip_address}, but monitor_only=true. Request proceeding normally.", component: :Middleware)
           else
             Beskar::Logger.warn("Rate limit exceeded for IP: #{ip_address}", component: :Middleware)
-            return rate_limit_response
+            return rate_limit_response(rate_limit[:retry_after])
           end
         end
 
@@ -54,6 +56,7 @@ module Beskar
             # Log the violation (and create security event if configured)
             # Pass whitelist status to prevent auto-blocking whitelisted IPs
             current_score = Beskar::Services::Waf.record_violation(ip_address, waf_analysis, whitelisted: is_whitelisted)
+            waf_recorded = true
             Beskar::Logger.debug("[RequestAnalyzer] Current score after recording: #{current_score.round(2)}", component: :Middleware)
 
             # Log even for whitelisted IPs (but don't block)
@@ -66,7 +69,7 @@ module Beskar
               Beskar::Logger.debug("[RequestAnalyzer] Should block IP #{ip_address}?: #{should_block}", component: :Middleware)
 
               if Beskar.configuration.monitor_only?
-                # Monitor-only mode: Just log, don't block (but ban record was created by WAF.record_violation)
+                # Monitor-only mode records observations without creating active bans.
                 if should_block
                   Beskar::Logger.warn("🔍 MONITOR-ONLY: Would block IP #{ip_address} " \
                     "with score #{current_score.round(2)}, but monitor_only=true. " \
@@ -82,7 +85,7 @@ module Beskar
               end
             end
           else
-            Beskar::Logger.debug("[RequestAnalyzer] No WAF threat detected for path: #{request.path}", component: :Middleware)
+            Beskar::Logger.debug("[RequestAnalyzer] No WAF threat detected", component: :Middleware)
           end
         else
           Beskar::Logger.debug("[RequestAnalyzer] WAF is disabled", component: :Middleware)
@@ -90,32 +93,33 @@ module Beskar
 
         # 5. Process the request normally (will raise 404 if route not found)
         Beskar::Logger.debug("[RequestAnalyzer] Passing request to application", component: :Middleware)
+        processing_host = true
         @app.call(env)
+      rescue Beskar::Services::AuthenticationAttempt::Unavailable
+        Beskar::Services::AuthenticationAttempt.unavailable_response
       rescue ActionController::UnknownFormat => e
         # Analyze unknown format as potential scanner
         if Beskar.configuration.waf_enabled?
-          handle_rails_exception(request, e, ip_address, is_whitelisted)
+          handle_rails_exception(request, e, ip_address, is_whitelisted) unless waf_recorded
         end
         # Re-raise to allow normal error handling
         raise
       rescue ActionDispatch::RemoteIp::IpSpoofAttackError => e
-        # Handle IP spoofing attack
-        if Beskar.configuration.waf_enabled?
-          handle_rails_exception(request, e, ip_address, is_whitelisted)
-        end
-        # Re-raise to allow normal error handling
+        # Attribute downstream errors only when Rails already resolved a trusted
+        # client IP. Never ban an address from a rejected proxy chain.
+        handle_rails_exception(request, e, ip_address, is_whitelisted) if !waf_recorded && ip_address && Beskar.configuration.waf_enabled?
         raise
       rescue ActiveRecord::RecordNotFound => e
         # Analyze record not found as potential enumeration scan
         if Beskar.configuration.waf_enabled?
-          handle_rails_exception(request, e, ip_address, is_whitelisted)
+          handle_rails_exception(request, e, ip_address, is_whitelisted) unless waf_recorded
         end
         # Re-raise to allow normal error handling
         raise
       rescue ActionDispatch::Http::MimeNegotiation::InvalidType => e
         # Analyze invalid MIME type as potential scanner
         if Beskar.configuration.waf_enabled?
-          handle_rails_exception(request, e, ip_address, is_whitelisted)
+          handle_rails_exception(request, e, ip_address, is_whitelisted) unless waf_recorded
         end
         # Re-raise to allow normal error handling
         raise
@@ -126,68 +130,26 @@ module Beskar
         end
         # Re-raise to allow normal 404 handling
         raise
+      rescue ActiveRecord::ActiveRecordError => error
+        raise if processing_host
+        Beskar::Logger.warn("Request security state unavailable (#{error.class})")
+        Beskar::Services::AuthenticationAttempt.unavailable_response
       end
 
       private
 
-      def rate_limited?(request)
-        # Check both IP rate limit and authentication abuse
-        ip_check = Beskar::Services::RateLimiter.check_ip_rate_limit(request.ip)
-        auth_abused = authentication_brute_force?(request.ip)
-
-        !ip_check[:allowed] || auth_abused
-      end
-
       def should_auto_block_rate_limit?(ip_address)
-        # Check how many times this IP has been rate limited in the past hour
-        cache_key = "beskar:rate_limit_violations:#{ip_address}"
-        violations = Rails.cache.read(cache_key) || 0
-        violations += 1
-        Rails.cache.write(cache_key, violations, expires_in: 1.hour)
-
-        # Block after 5 rate limit violations in an hour
-        violations >= 5
-      end
-
-      def authentication_brute_force?(ip_address)
-        # Check authentication failure count from RateLimiter
-        cache_key = "beskar:ip_auth_failures:#{ip_address}"
-
-        # Get current failure count and timestamp
-        failure_data = Rails.cache.read(cache_key)
-        return false unless failure_data.is_a?(Hash)
-
-        # Count recent failures (within the configured period)
-        config = Beskar.configuration.rate_limiting[:ip_attempts] || {}
-        period = config[:period] || 1.hour
-        limit = config[:limit] || 10
-
-        now = Time.current.to_i
-        recent_failures = failure_data.select { |timestamp, _| now - timestamp.to_i < period.to_i }
-
-        # If too many auth failures, it's brute force
-        if recent_failures.length >= limit
-          # Auto-ban for authentication abuse (create ban record even in monitor-only mode)
-          Beskar::BannedIp.ban!(
-            ip_address,
-            reason: "authentication_abuse",
-            duration: 1.hour,
-            details: "#{recent_failures.length} failed authentication attempts in #{period / 60} minutes",
-            metadata: {failure_count: recent_failures.length, detection_time: Time.current}
-          )
-
-          if Beskar.configuration.monitor_only?
-            Beskar::Logger.warn("🔍 MONITOR-ONLY: Would auto-block IP #{ip_address} " \
-              "for authentication brute force (#{recent_failures.length} failures), but monitor_only=true", component: :Middleware)
-          else
-            Beskar::Logger.warn("🔒 Auto-blocked IP #{ip_address} " \
-              "for authentication brute force (#{recent_failures.length} failures)", component: :Middleware)
-          end
-
-          return true
+        mode = Beskar.configuration.monitor_only? ? "observe" : "enforce"
+        key = "rate_denials:#{mode}:#{ip_address}"
+        Beskar::SecurityState.mutate(key, ttl: 1.hour) do |state|
+          data = state.fetch(key)
+          now = Time.current.to_f
+          # A fixed window: repeated requests cannot prolong old violations.
+          data.clear if data["window_end"] && data["window_end"] <= now
+          data["window_end"] ||= now + 1.hour
+          data["count"] = [data.fetch("count", 0) + 1, 5].min
+          data["count"] >= 5
         end
-
-        false
       end
 
       def handle_rails_exception(request, exception, ip_address, is_whitelisted)
@@ -225,14 +187,11 @@ module Beskar
       end
 
       def log_404_for_waf(request, error)
-        # 404s on suspicious paths might indicate scanning
-        path = request.fullpath || request.path
-
         # Only log if it matches WAF patterns (already analyzed in analyze_request)
         waf_analysis = Beskar::Services::Waf.analyze_request(request)
 
         if waf_analysis
-          Beskar::Logger.info("404 on suspicious path from #{request.ip}: #{path} " \
+          Beskar::Logger.info("404 matching WAF rules from #{Beskar::Services::RequestContext.ip(request)} " \
             "(WAF patterns: #{waf_analysis[:patterns].map { |p| p[:description] }.join(", ")})", component: :Middleware)
         end
       end
@@ -241,20 +200,20 @@ module Beskar
         [
           403,
           {
-            "Content-Type" => "text/html",
-            "X-Beskar-Blocked" => "true"
+            "content-type" => "text/html; charset=utf-8",
+            "x-beskar-blocked" => "true"
           },
           [render_blocked_page(message)]
         ]
       end
 
-      def rate_limit_response
+      def rate_limit_response(retry_after)
         [
           429,
           {
-            "Content-Type" => "text/html",
-            "Retry-After" => "3600",
-            "X-Beskar-Rate-Limited" => "true"
+            "content-type" => "text/html; charset=utf-8",
+            "retry-after" => [retry_after.to_i, 1].max.to_s,
+            "x-beskar-rate-limited" => "true"
           },
           [render_rate_limit_page]
         ]