beskar 0.1.0 → 0.2.0

data/lib/beskar/models/security_trackable_authenticable.rb

@@ -16,17 +16,31 @@ module Beskar
 
       # Make handle_high_risk_lock public (it's private in Generic)
       public
-      
+
+      def beskar_access_locked?
+        Services::NativeAccountLock.locked?(self)
+      end
+
+      def beskar_access_allowed?(request)
+        !Services::RequestContext.enforce?(Services::RequestContext.ip(request)) || !beskar_access_locked?
+      end
+
+      def with_beskar_session(request, generation: nil, &block)
+        Services::NativeAccountLock.with_session(self, request, generation: generation, &block)
+      end
+
       # Rails 8 auth-specific: Handle high risk lock by destroying sessions
       # Public method called when high-risk event is detected
       def handle_high_risk_lock(security_event, request)
+        return unless Services::RequestContext.enforce?(Services::RequestContext.ip(request))
+        return unless beskar_access_locked?
         reason = determine_lock_reason(security_event)
-        
+
         Beskar::Logger.warn("Rails auth high-risk lock detected: #{reason}")
-        
-        # Destroy all sessions to immediately lock out attacker
-        destroy_all_sessions(except: request.session.id)
-        
+
+        # NativeAccountLock already revoked every database session atomically
+        # with the lock. A Rack session ID is not a sessions-table primary key.
+
         # Check if this warrants emergency password reset
         if should_reset_password?(security_event, reason)
           perform_emergency_password_reset(security_event, reason)
@@ -50,117 +64,82 @@ module Beskar
           Beskar::Logger.warn("Model does not have sessions association, cannot destroy sessions")
         end
       rescue => e
-        Beskar::Logger.error("Failed to destroy sessions: #{e.message}")
+        Beskar::Logger.error("Failed to destroy sessions: #{e.class}")
       end
 
       # Determine if emergency password reset is warranted
       def should_reset_password?(security_event, reason)
         config = Beskar.configuration.emergency_password_reset
         return false unless config[:enabled]
+        return false unless Services::RequestContext.enforce?(security_event.ip_address)
 
-        case reason
-        when :impossible_travel
-          # Count impossible travel events in recent history
-          recent_impossible_travel = security_events
-            .where(event_type: ["account_locked", "login_success"])
-            .where("created_at >= ?", 24.hours.ago)
-            .where("metadata->>'geolocation' LIKE ?", '%impossible_travel%')
-            .count
-          
-          recent_impossible_travel >= (config[:impossible_travel_threshold] || 3)
-          
-        when :suspicious_device
-          # Multiple suspicious device logins
-          recent_suspicious = security_events
-            .where(event_type: "account_locked")
-            .where("created_at >= ?", 24.hours.ago)
-            .where("metadata->>'device_info' LIKE ?", '%suspicious%')
-            .count
-          
-          recent_suspicious >= (config[:suspicious_device_threshold] || 5)
-          
-        else
-          # For other reasons, check total lock count
-          recent_locks = security_events
-            .where(event_type: "account_locked")
-            .where("created_at >= ?", 24.hours.ago)
-            .count
-          
-          recent_locks >= (config[:total_locks_threshold] || 5)
+        events = security_events.where(event_type: "account_locked")
+          .where("created_at >= ?", 24.hours.ago)
+        threshold = case reason
+        when :impossible_travel then config[:impossible_travel_threshold] || 3
+        when :suspicious_device then config[:suspicious_device_threshold] || 5
+        else config[:total_locks_threshold] || 5
         end
+
+        count = 0
+        events.find_each do |event|
+          data = (event.metadata || {}).deep_stringify_keys
+          context = data["additional_context"] || {}
+          matches = case reason
+          when :impossible_travel
+            data["reason"] == "impossible_travel" ||
+              data.dig("geolocation", "impossible_travel") == true ||
+              context.dig("geolocation", "impossible_travel") == true
+          when :suspicious_device
+            data["reason"] == "suspicious_device" ||
+              data.dig("device_info", "suspicious") == true ||
+              context.dig("device_info", "suspicious") == true
+          else true
+          end
+          count += 1 if matches
+          return true if count >= threshold
+        end
+        false
       end
 
-      # Perform emergency password reset
+      # Password invalidation and its mandatory recovery audit are one transaction.
+      # Notification hooks run after commit, never inside a retryable state block.
       def perform_emergency_password_reset(security_event, reason)
         config = Beskar.configuration.emergency_password_reset
-        
-        # Generate a cryptographically secure random password
-        new_password = SecureRandom.base58(32)
-        
-        begin
-          # Update password
+        return false unless config[:enabled]
+        return false unless Services::RequestContext.enforce?(security_event.ip_address)
+
+        self.class.transaction(requires_new: true) do
+          new_password = SecureRandom.base58(32)
           update!(password: new_password, password_confirmation: new_password)
-          
-          # Log the reset event
+          Services::NativeAccountLock.require_manual_unlock!(self) if config[:require_manual_unlock]
+          revoke_beskar_sessions!
           security_events.create!(
-            event_type: "emergency_password_reset",
-            ip_address: security_event.ip_address,
-            user_agent: security_event.user_agent,
-            metadata: {
-              reason: reason.to_s,
-              triggering_event_id: security_event.id,
-              timestamp: Time.current.iso8601,
-              reset_method: "automatic"
-            },
-            risk_score: 100
-          )
-          
-          # Send notification to user
-          if config[:send_notification]
-            send_emergency_reset_notification(reason)
-          end
-          
-          # Notify security team
-          if config[:notify_security_team]
-            notify_security_team_of_reset(reason, security_event)
-          end
-          
-          Beskar::Logger.warn("Emergency password reset performed for user #{id}, reason: #{reason}")
-          
-        rescue => e
-          Beskar::Logger.error("Failed to perform emergency password reset: #{e.message}")
-          
-          # Create failed reset event
-          security_events.create!(
-            event_type: "emergency_password_reset_failed",
-            ip_address: security_event.ip_address,
-            user_agent: security_event.user_agent,
-            metadata: {
-              reason: reason.to_s,
-              error: e.message,
-              timestamp: Time.current.iso8601
-            },
-            risk_score: 100
+            event_type: "emergency_password_reset", ip_address: security_event.ip_address,
+            user_agent: security_event.user_agent, risk_score: 100,
+            metadata: {reason: reason.to_s, triggering_event_id: security_event.id,
+                       authentication_attempt_id: security_event.beskar_attempt&.id,
+                       timestamp: Time.current.iso8601, reset_method: "automatic"}
           )
         end
+        # Keep the extension hooks independent: a failed user hook must not
+        # suppress the security-team notification or undo the committed reset.
+        Services::Notifications.after_commit { send_emergency_reset_notification(reason) } if config[:send_notification]
+        Services::Notifications.after_commit { notify_security_team_of_reset(reason, security_event) } if config[:notify_security_team]
+        true
+      rescue => error
+        Beskar::Logger.error("Emergency password reset failed (#{error.class})")
+        false
       end
 
       # Send notification to user about emergency password reset
       def send_emergency_reset_notification(reason)
-        # This should be implemented by the application
-        # Example: UserMailer.emergency_password_reset(self, reason).deliver_later
-        Beskar::Logger.info("Would send emergency reset notification to user #{id}")
-      rescue => e
-        Beskar::Logger.error("Failed to send emergency reset notification: #{e.message}")
+        Services::Notifications.enqueue(self, "emergency_password_reset")
       end
 
       # Notify security team about emergency password reset
       def notify_security_team_of_reset(reason, security_event)
-        # This should be implemented by the application
-        # Example: SecurityMailer.emergency_reset_alert(self, reason, security_event).deliver_later
-        Beskar::Logger.info("Would notify security team about reset for user #{id}")
-      rescue => e
-        Beskar::Logger.error("Failed to notify security team: #{e.message}")
+        Services::Notifications.enqueue(self, "security_team_reset")
       end
     end
   end

data/lib/beskar/models/security_trackable_devise.rb

@@ -9,11 +9,21 @@ module Beskar
       included do
         # Include the generic functionality first
         include Beskar::Models::SecurityTrackableGeneric
+        prepend SessionCredentials
 
-        # Hook into Devise callbacks if Devise is present and available
-        if defined?(Devise) && respond_to?(:after_database_authentication)
-          # Track successful authentications
-          after_database_authentication :track_successful_login
+        after_update :revoke_beskar_sessions_after_lock
+
+        # The engine registers the single Warden outcome callback. Devise's
+        # after_database_authentication is an instance hook, not a callback macro.
+      end
+
+      module SessionCredentials
+        def authenticatable_salt
+          Digest::SHA256.hexdigest([super, beskar_session_token].to_json)
+        end
+
+        def rememberable_value
+          Digest::SHA256.hexdigest([super, beskar_session_token].to_json)
         end
       end
 
@@ -25,34 +35,34 @@ module Beskar
           return
         end
 
-        if current_request = request_from_context
+        if (current_request = request_from_context)
           track_authentication_event(current_request, :success)
         end
       rescue => e
-        Beskar::Logger.warn("Failed to track successful login: #{e.message}")
+        Beskar::Logger.warn("Failed to track successful login: #{e.class}")
         nil
       end
 
       # PUBLIC method called from Warden callback in engine.rb
       # Checks if account was just locked due to high risk and signs out if needed
-      def check_high_risk_lock_and_signout(auth)
+      def check_high_risk_lock_and_signout(auth, scope: nil, attempt: nil)
         return unless Beskar.configuration.risk_based_locking_enabled?
-
-        # Check if there's a very recent lock event (within last 5 seconds)
-        recent_lock = security_events
-          .where(event_type: ["account_locked", "lock_attempted"])
-          .where("created_at >= ?", 5.seconds.ago)
-          .exists?
-
-        if recent_lock
-          Beskar::Logger.warn("High-risk lock detected, signing out user #{id}")
-          auth.logout
-          throw :warden, message: :account_locked_due_to_high_risk
-        end
+        return unless scope
+        attempt ||= Services::AuthenticationAttempt.current(auth.request, scope) if auth.respond_to?(:request)
+        return unless attempt && attempt.user == self && attempt.scope == scope.to_s && attempt.locked_now
+        return unless Services::RequestContext.enforce?(attempt.ip_address)
+        auth.logout(scope)
+        throw :warden, scope: scope, message: :account_locked_due_to_high_risk
       end
 
       private
 
+      # Runs in the user save transaction, including Devise's own failed-password
+      # lock and ordinary updates of locked_at, not just Beskar risk-based locks.
+      def revoke_beskar_sessions_after_lock
+        revoke_beskar_sessions! if has_attribute?(:locked_at) && saved_change_to_locked_at? && locked_at.present?
+      end
+
       # Devise-specific: Try to get request from various Warden/Devise contexts
       def request_from_context
         # Try to get request from various contexts
@@ -66,16 +76,15 @@ module Beskar
           Warden::Manager.current_request
         end
       rescue => e
-        Beskar::Logger.debug("Could not get request from context: #{e.message}")
+        Beskar::Logger.debug("Could not get request from context: #{e.class}")
         nil
       end
 
-      # Devise-specific: Handle high risk lock by creating lock event
+      # Devise-specific: The current attempt carries the completed lock result.
       # The actual sign-out is handled by Warden callback in engine.rb
       def handle_high_risk_lock(security_event, request)
         Beskar::Logger.debug("Devise account locked - Warden callback will handle sign-out")
-        # The lock event is already created by AccountLocker service
-        # The Warden callback will detect it and perform the actual sign-out
+        # The Warden callback uses the attempt, independently of audit writes.
       end
     end
   end