beskar 0.1.0 → 0.2.0

data/lib/beskar/services/session_revocation.rb

@@ -0,0 +1,62 @@
+module Beskar
+  module Services
+    # Account-lifetime state. Never expire or clear generations on unlock: doing
+    # so would resurrect credentials issued before a lock. No cache authority.
+    class SessionRevocation
+      def self.token(user)
+        SecurityState.uncached { SecurityState.read(NativeAccountLock.key(user)).fetch("generation", "0") }
+      rescue ActiveRecord::ActiveRecordError
+        raise AuthenticationAttempt::Unavailable, "Session state unavailable"
+      end
+
+      def self.revoke!(user)
+        SecurityState.mutate(NativeAccountLock.key(user), ttl: nil) do |state|
+          rotate!(state.fetch(NativeAccountLock.key(user)))
+          NativeAccountLock.revoke_sessions!(user) if user.respond_to?(:beskar_access_locked?)
+        end
+      rescue ActiveRecord::ActiveRecordError
+        raise AuthenticationAttempt::Unavailable, "Session revocation unavailable"
+      end
+
+      def self.rotate!(data)
+        data["generation"] = SecureRandom.uuid
+      end
+
+      # Rails-native database sessions need no new session column. Check the
+      # persisted row as well as the account lock, including stale Current objects.
+      def self.native_session_allowed?(record, request:)
+        return false unless record&.persisted?
+        record.reload
+        user = record.user
+        user&.beskar_access_allowed?(request)
+      rescue ActiveRecord::RecordNotFound
+        false
+      rescue ActiveRecord::ActiveRecordError
+        raise AuthenticationAttempt::Unavailable, "Session state unavailable"
+      end
+
+      # Tokens must carry the generation captured at issuance inside their
+      # authenticated server-side record or signed claims, never a request param.
+      # Call on every protected request / WebSocket message, not just connect.
+      def self.allowed?(user, request:, token:)
+        return false unless user&.persisted? && token.is_a?(String)
+        # Cable connections can retain a model object after its database row is
+        # deleted. persisted? alone only describes that stale Ruby object.
+        user = user.class.uncached { user.class.find_by(user.class.primary_key => user.id) }
+        return false unless user
+        data = SecurityState.uncached { SecurityState.read(NativeAccountLock.key(user)) }
+        return false unless ActiveSupport::SecurityUtils.secure_compare(data.fetch("generation", "0"), token)
+        return true unless RequestContext.enforce?(RequestContext.ip(request))
+        if user.respond_to?(:beskar_access_locked?)
+          !NativeAccountLock.locked_data?(data)
+        elsif user.respond_to?(:access_locked?)
+          !user.access_locked?
+        else
+          true
+        end
+      rescue ActiveRecord::ActiveRecordError
+        raise AuthenticationAttempt::Unavailable, "Session state unavailable"
+      end
+    end
+  end
+end

data/lib/beskar/services/waf.rb

@@ -1,131 +1,69 @@
 module Beskar
   module Services
     class Waf
-      # Common vulnerability scan patterns
+      RULES_VERSION = 1
+      # Root/segment boundaries prevent matches inside ordinary words. Matching
+      # uses a decoded path, not arbitrary query values; dot segments are retained.
       VULNERABILITY_PATTERNS = {
         rails_exceptions: {
-          patterns: [
-            %r{/(?:users?|posts?|articles?|comments?|api/v\d+/\w+)/\d+\.(?:exe|bat|cmd|com|scr|vbs|jar|app|deb|rpm)$}i,  # Rails resources with executable extensions
-            %r{/(?:users?|posts?|articles?|comments?|api/v\d+/\w+)\.(?:asp|aspx|jsp|do|action|cgi|pl|py|rb)$}i,  # Rails routes with server-side script extensions
-            %r{\?format=(?:exe|bat|cmd|com|scr|vbs|jar|asp|aspx|jsp|php)$}i,  # Suspicious format in query params
-          ],
-          severity: :medium,
-          description: "Potential Rails exception triggering attempt"
-        },
-        ip_spoofing: {
-          patterns: [
-            %r{X-Forwarded-For.*X-Forwarded-For}i,  # Multiple X-Forwarded-For headers in path (suspicious)
-            %r{Client-IP.*X-Forwarded-For}i,  # Conflicting IP headers in path
-          ],
-          severity: :high,
-          description: "Potential IP spoofing attempt"
+          patterns: [%r{/(?:users?|posts?|articles?|comments?|api/v\d+/\w+)/\d+\.(?:exe|bat|cmd|com|scr|vbs|jar|app|deb|rpm)\z}i,
+            %r{/(?:users?|posts?|articles?|comments?|api/v\d+/\w+)\.(?:asp|aspx|jsp|do|action|cgi|pl|py|rb)\z}i],
+          severity: :medium, description: "Potential Rails exception triggering attempt"
         },
         record_scanning: {
-          patterns: [
-            %r{/(?:user|admin|account|profile|order|payment|invoice|document|file|download)/\d{6,}}i,  # Large IDs that likely don't exist
-            %r{/(?:user|admin|account|profile)/(?:test|admin|root|administrator|superuser)}i,  # Common test usernames
-            %r{/api/v\d+/(?:users?|accounts?|orders?|payments?)/(?:999999|123456|0|null|undefined)}i,  # Obviously fake API IDs
-          ],
-          severity: :low,
-          description: "Potential record enumeration/scanning"
+          patterns: [%r{/(?:user|admin|account|profile|order|payment|invoice|document|file|download)/\d{6,}(?:/|\z)}i,
+            %r{\A/(?:user|admin|account|profile)/(?:test|admin|root|administrator|superuser)(?:/|\z)}i,
+            %r{/api/v\d+/(?:users?|accounts?|orders?|payments?)/(?:999999|123456|0|null|undefined)(?:/|\z)}i],
+          severity: :low, description: "Potential record enumeration/scanning"
         },
         wordpress: {
-          patterns: [
-            %r{/wp-admin}i,
-            %r{/wp-login\.php}i,
-            %r{/wp-content/.*\.php}i,  # PHP files in wp-content are suspicious
-            %r{/wp-includes}i,
-            %r{/xmlrpc\.php}i,
-            %r{/wp-config\.php}i,
-            %r{/wp-config\.bak}i,
-            %r{/wordpress}i
-          ],
-          severity: :high,
-          description: "WordPress vulnerability scan"
+          patterns: [%r{/wp-admin(?:/|\z)}i, %r{/wp-login\.php(?:/|\z)}i,
+            %r{/wp-content/.*\.php(?:/|\z)}i, %r{/wp-includes(?:/|\z)}i,
+            %r{/xmlrpc\.php(?:/|\z)}i, %r{/wp-config\.(?:php|bak)(?:/|\z)}i,
+            %r{\A/wordpress(?:/|\z)}i],
+          severity: :high, description: "WordPress vulnerability scan"
         },
         wordpress_static: {
-          patterns: [
-            %r{/wp-content/.*\.(?:css|js|jpe?g|png|gif|svg|webp|ico|woff2?|ttf|eot|map)$}i,  # Static files in wp-content
-            %r{/wp-content/(?:uploads|themes|plugins)/[^.]*$}i,  # Directory listing attempts
-          ],
-          severity: :low,
-          description: "WordPress static file probe"
+          patterns: [%r{/wp-content/.*\.(?:css|js|jpe?g|png|gif|svg|webp|ico|woff2?|ttf|eot|map)\z}i,
+            %r{/wp-content/(?:uploads|themes|plugins)/[^.]*\z}i],
+          severity: :low, description: "WordPress static file probe"
         },
         php_admin: {
-          patterns: [
-            %r{/phpmyadmin}i,
-            %r{/pma}i,
-            %r{/admin\.php}i,
-            %r{/administrator}i,
-            %r{/admin/config\.php}i,
-            %r{/phpinfo\.php}i
-          ],
-          severity: :high,
-          description: "PHP admin panel scan"
+          patterns: [%r{\A/(?:phpmyadmin|pma|administrator)(?:/|\z)}i,
+            %r{/(?:admin|phpinfo)\.php(?:/|\z)}i, %r{/admin/config\.php(?:/|\z)}i],
+          severity: :high, description: "PHP admin panel scan"
         },
         config_files: {
-          patterns: [
-            %r{/\.env},
-            %r{/\.git},
-            %r{/config\.php}i,
-            %r{/configuration\.php}i,
-            %r{/settings\.php}i,
-            %r{/database\.yml},
-            %r{/credentials\.yml}i
-          ],
-          severity: :critical,
-          description: "Configuration file access attempt"
+          patterns: [%r{/(?:\.env(?:\.[a-z0-9_-]+)?|\.git)(?:/|\z)}i,
+            %r{/(?:config|configuration|settings)\.php(?:/|\z)}i,
+            %r{/(?:database|credentials)\.yml(?:\.enc)?(?:/|\z)}i],
+          severity: :critical, description: "Configuration file access attempt"
         },
         path_traversal: {
-          patterns: [
-            %r{/etc/passwd},
-            %r{/etc/shadow},
-            %r{/etc/hosts},
-            %r{\.\./},
-            %r{\.\.\\},
-            %r{%2e%2e/}i,
-            %r{%252e%252e/}i
-          ],
-          severity: :critical,
-          description: "Path traversal attempt"
+          patterns: [%r{/(?:etc/(?:passwd|shadow|hosts))(?:/|\z)}i, %r{(?:\A|/)\.\.(?:/|\z)}],
+          severity: :critical, description: "Path traversal attempt"
         },
         framework_debug: {
-          patterns: [
-            %r{/rails/info/routes},
-            %r{/__debug__},
-            %r{/debug},
-            %r{/telescope},
-            %r{/_profiler},
-            %r{/\.well-known}
-          ],
-          severity: :medium,
-          description: "Framework debug endpoint scan"
+          patterns: [%r{\A/(?:rails/info/routes|__debug__|debug|telescope|_profiler)(?:/|\z)}],
+          severity: :medium, description: "Framework debug endpoint scan"
         },
         cms_scan: {
-          patterns: [
-            %r{/joomla}i,
-            %r{/drupal}i,
-            %r{/magento}i,
-            %r{/prestashop}i,
-            %r{/typo3}i
-          ],
-          severity: :medium,
-          description: "CMS detection scan"
+          patterns: [%r{\A/(?:joomla|drupal|magento|prestashop|typo3)(?:/|\z)}i],
+          severity: :medium, description: "CMS detection scan"
         },
         common_exploits: {
-          patterns: [
-            %r{/shell\.php}i,
-            %r{/cmd\.php}i,
-            %r{/backdoor}i,
-            %r{/c99\.php}i,
-            %r{/r57\.php}i,
-            %r{/webshell}i
-          ],
-          severity: :critical,
-          description: "Common exploit file access"
+          patterns: [%r{/(?:shell|cmd|c99|r57)\.php(?:/|\z)}i, %r{/(?:backdoor|webshell)(?:/|\z)}i],
+          severity: :critical, description: "Common exploit file access"
         }
       }.freeze
 
+      EXCEPTION_RULES = {
+        "ActionController::UnknownFormat" => [:unknown_format, :medium, "Unknown format requested - potential scanner"],
+        "ActionDispatch::RemoteIp::IpSpoofAttackError" => [:ip_spoof, :critical, "IP spoofing attack detected"],
+        "ActiveRecord::RecordNotFound" => [:record_not_found, :low, "Record not found - potential enumeration scan"],
+        "ActionDispatch::Http::MimeNegotiation::InvalidType" => [:invalid_mime_type, :medium, "Invalid MIME type requested - potential scanner"]
+      }.freeze
+
       # Configuration for RecordNotFound exclusion patterns
       # These patterns will not trigger WAF violations
       RECORD_NOT_FOUND_EXCLUSIONS = [
@@ -136,118 +74,42 @@ module Beskar
       class << self
         # Analyze a request for vulnerability scanning patterns
         def analyze_request(request)
-          path = request.fullpath || request.path
-          return nil if path.blank?
-
-          detected_patterns = []
-
+          input = WafRequest.new(request)
+          return nil if input.path.blank? && !input.problem
+          patterns = []
+          if input.problem && !input.excluded?(:malformed_path)
+            patterns << {category: :malformed_path, rule_id: "malformed_path:#{input.problem}",
+                         severity: :medium, description: "Malformed or oversized request path"}
+          end
           VULNERABILITY_PATTERNS.each do |category, config|
-            config[:patterns].each do |pattern|
-              if path.match?(pattern)
-                detected_patterns << {
-                  category: category,
-                  pattern: pattern.source,
-                  severity: config[:severity],
-                  description: config[:description],
-                  matched_path: path
-                }
-              end
+            next if input.excluded?(category)
+            config[:patterns].each_with_index do |pattern, index|
+              next unless input.path.match?(pattern)
+              patterns << {category: category, rule_id: "#{category}:#{index}", severity: config[:severity], description: config[:description]}
             end
           end
-
-          if detected_patterns.any?
-            {
-              threat_detected: true,
-              patterns: detected_patterns,
-              highest_severity: calculate_highest_severity(detected_patterns),
-              ip_address: request.ip,
-              user_agent: request.user_agent,
-              timestamp: Time.current
-            }
-          else
-            nil
+          if input.suspicious_format? && !input.excluded?(:rails_exceptions)
+            patterns << {category: :rails_exceptions, rule_id: "rails_exceptions:format",
+                         severity: :medium, description: VULNERABILITY_PATTERNS[:rails_exceptions][:description]}
           end
+          analysis_for(request, input, patterns) if patterns.any?
         end
 
-        # Analyze Rails exceptions as potential security threats
         def analyze_exception(exception, request)
-          case exception
-          when ActionController::UnknownFormat
-            {
-              threat_detected: true,
-              patterns: [{
-                category: :unknown_format,
-                pattern: "ActionController::UnknownFormat",
-                severity: :medium,
-                description: "Unknown format requested - potential scanner",
-                matched_path: request.fullpath
-              }],
-              highest_severity: :medium,
-              ip_address: request.ip,
-              user_agent: request.user_agent,
-              timestamp: Time.current,
-              exception_class: exception.class.name,
-              exception_message: exception.message
-            }
-          when ActionDispatch::RemoteIp::IpSpoofAttackError
-            {
-              threat_detected: true,
-              patterns: [{
-                category: :ip_spoof,
-                pattern: "ActionDispatch::RemoteIp::IpSpoofAttackError",
-                severity: :critical,
-                description: "IP spoofing attack detected",
-                matched_path: request.fullpath
-              }],
-              highest_severity: :critical,
-              ip_address: request.ip,
-              user_agent: request.user_agent,
-              timestamp: Time.current,
-              exception_class: exception.class.name,
-              exception_message: exception.message
-            }
-          when ActiveRecord::RecordNotFound
-            # Check if this path should be excluded from WAF
-            if should_exclude_record_not_found?(request.fullpath)
-              return nil
-            end
-
-            {
-              threat_detected: true,
-              patterns: [{
-                category: :record_not_found,
-                pattern: "ActiveRecord::RecordNotFound",
-                severity: :low,
-                description: "Record not found - potential enumeration scan",
-                matched_path: request.fullpath
-              }],
-              highest_severity: :low,
-              ip_address: request.ip,
-              user_agent: request.user_agent,
-              timestamp: Time.current,
-              exception_class: exception.class.name,
-              exception_message: exception.message
-            }
-          when ActionDispatch::Http::MimeNegotiation::InvalidType
-            {
-              threat_detected: true,
-              patterns: [{
-                category: :invalid_mime_type,
-                pattern: "ActionDispatch::Http::MimeNegotiation::InvalidType",
-                severity: :medium,
-                description: "Invalid MIME type requested - potential scanner",
-                matched_path: request.fullpath
-              }],
-              highest_severity: :medium,
-              ip_address: request.ip,
-              user_agent: request.user_agent,
-              timestamp: Time.current,
-              exception_class: exception.class.name,
-              exception_message: exception.message
-            }
-          else
-            nil
-          end
+          rule = EXCEPTION_RULES[exception.class.name]
+          return unless rule
+          category, severity, description = rule
+          input = WafRequest.new(request)
+          return if input.excluded?(category)
+          return if category == :record_not_found && should_exclude_record_not_found?(input.path)
+          policy = waf_config.fetch(:exception_detection, :suspicious)
+          return if policy == :none
+          # A Rails error alone is not proof of abuse. Broad legacy scoring must
+          # be opted into; resolved IP-spoof exceptions remain a distinct signal.
+          return unless policy == :all || category == :ip_spoof || analyze_request(request)
+          analysis_for(request, input, [{category: category, rule_id: "exception:#{category}",
+                                         severity: severity, description: description}])
+            .merge(exception_class: exception.class.name)
         end
 
         # Check if a RecordNotFound exception should be excluded from WAF
@@ -281,43 +143,29 @@ module Beskar
 
           Beskar::Logger.debug("[WAF] Recording violation for IP: #{ip_address}, whitelisted: #{whitelisted}", component: :WAF)
 
-          # Get current violations and add new one
-          cache_key = "beskar:waf_violations:#{ip_address}"
-          violations = Rails.cache.read(cache_key) || []
-
-          # Calculate risk score for this violation
+          analysis_result = sanitized_analysis(analysis_result)
+          key = state_key(ip_address, whitelisted: whitelisted)
           risk_score = severity_to_risk_score(analysis_result[:highest_severity])
-
-          # Create new violation record
-          new_violation = {
-            timestamp: Time.current.to_i,
-            score: risk_score,
-            severity: analysis_result[:highest_severity],
-            category: analysis_result[:patterns].first[:category],
-            description: analysis_result[:patterns].first[:description],
-            path: analysis_result[:patterns].first[:matched_path]
-          }
-
-          violations << new_violation
-
-          # Prune old violations (outside violation window and max tracked)
-          violations = prune_violations(violations, config)
-
-          # Calculate current score with decay
-          current_score = calculate_current_score(violations, config)
-
-          Beskar::Logger.debug("[WAF] Violation recorded for #{ip_address}: score=#{risk_score}, current_total=#{current_score.round(2)}, violations_count=#{violations.size}", component: :WAF)
-
-          # Store violations with TTL from config
-          ttl = config[:violation_window] || 6.hours
-          Rails.cache.write(cache_key, violations, expires_in: ttl)
+          violations, current_score = SecurityState.mutate(key, ttl: config[:violation_window] || 6.hours) do |state|
+            entries = Array(state[key]["violations"]).map { |entry| entry.deep_symbolize_keys.slice(:timestamp, :score, :severity, :category, :rule_id) }
+            entries << {
+              timestamp: Time.current.to_i,
+              score: risk_score,
+              severity: analysis_result[:highest_severity],
+              category: analysis_result[:patterns].first[:category],
+              rule_id: analysis_result[:patterns].first[:rule_id]
+            }
+            entries = prune_violations(entries, config)
+            state[key]["violations"] = entries
+            [entries, calculate_current_score(entries, config)]
+          end
 
           # Log the violation
           log_violation(ip_address, analysis_result, current_score, violations.size)
 
           # Create security event if configured
           if config[:create_security_events]
-            create_security_event(ip_address, analysis_result, current_score)
+            create_security_event(ip_address, analysis_result, current_score, whitelisted: whitelisted, violation_count: violations.size)
           end
 
           # Check if we should auto-block (skip if whitelisted)
@@ -325,17 +173,12 @@ module Beskar
 
           Beskar::Logger.debug("[WAF] Auto-block check: whitelisted=#{whitelisted}, auto_block=#{config[:auto_block]}, score=#{current_score.round(2)}, threshold=#{threshold}", component: :WAF)
 
-          if !whitelisted && config[:auto_block] && current_score >= threshold
-            Beskar::Logger.info("[WAF] Score threshold reached for #{ip_address}, creating ban record", component: :WAF)
-            # Always create the ban record (even in monitor-only mode)
-            auto_block_ip(ip_address, analysis_result, current_score)
-
-            # But also log monitor-only message if in monitor mode
+          if !whitelisted && !IpWhitelist.whitelisted?(ip_address) && config[:auto_block] && current_score >= threshold
             if Beskar.configuration.monitor_only?
               log_monitor_only_action(ip_address, analysis_result, current_score, threshold)
+            else
+              auto_block_ip(ip_address, analysis_result, current_score)
             end
-          else
-            Beskar::Logger.debug("[WAF] Not auto-blocking: conditions not met", component: :WAF)
           end
 
           current_score
@@ -349,8 +192,8 @@ module Beskar
 
         # Get violations for an IP
         def get_violations(ip_address)
-          cache_key = "beskar:waf_violations:#{ip_address}"
-          Rails.cache.read(cache_key) || []
+          entries = Array(SecurityState.read(state_key(ip_address))["violations"]).map { |entry| entry.deep_symbolize_keys.slice(:timestamp, :score, :severity, :category, :rule_id) }
+          prune_violations(entries, waf_config)
         end
 
         # Get violation count for an IP (number of violations tracked)
@@ -360,12 +203,52 @@ module Beskar
 
         # Reset violations for an IP
         def reset_violations(ip_address)
-          cache_key = "beskar:waf_violations:#{ip_address}"
-          Rails.cache.delete(cache_key)
+          ip_address = IPAddr.new(ip_address.to_s).to_s
+          keys = ["waf:enforce:#{ip_address}", "waf:observe:#{ip_address}"]
+          SecurityState.mutate(keys, ttl: 1.second) { |state| state.each_value(&:clear) }
         end
 
         private
 
+        def analysis_for(request, input, patterns)
+          {threat_detected: true, patterns: patterns, highest_severity: calculate_highest_severity(patterns),
+           ip_address: RequestContext.ip(request), request_method: input.method, rules_version: RULES_VERSION,
+           decoding_passes: input.decoding_passes, timestamp: Time.current}
+        end
+
+        # A public caller may supply an old-style analysis containing raw URLs
+        # or exception messages. Project onto rule evidence before any sink.
+        def sanitized_analysis(analysis)
+          severities = %i[critical high medium low]
+          severity = severities.find { |level| level.to_s == analysis[:highest_severity].to_s }
+          raise ArgumentError, "WAF analysis requires a valid severity" unless severity
+          passes = analysis[:decoding_passes]
+          result = {threat_detected: true, highest_severity: severity, rules_version: RULES_VERSION,
+                    decoding_passes: (passes.is_a?(Integer) && (0..2).cover?(passes)) ? passes : 0, timestamp: Time.current}
+          categories = VULNERABILITY_PATTERNS.keys + EXCEPTION_RULES.values.map(&:first) + [:malformed_path]
+          result[:patterns] = Array(analysis[:patterns]).first(32).map do |pattern|
+            category = categories.find { |value| value.to_s == pattern[:category].to_s } || :custom
+            config = VULNERABILITY_PATTERNS[category]
+            exception = EXCEPTION_RULES.values.find { |rule| rule.first == category }
+            description = config&.fetch(:description) || exception&.last || "Custom WAF rule"
+            ids = config ? config[:patterns].each_index.map { |index| "#{category}:#{index}" } : []
+            ids << "rails_exceptions:format" if category == :rails_exceptions
+            ids << "exception:#{category}" if exception
+            ids.concat(%w[oversized_path invalid_encoding excessive_encoding].map { |problem| "malformed_path:#{problem}" }) if category == :malformed_path
+            rule_id = ids.include?(pattern[:rule_id]) ? pattern[:rule_id] : "custom"
+            {category: category, rule_id: rule_id, severity: severities.find { |value| value.to_s == pattern[:severity].to_s } || severity, description: description}
+          end
+          raise ArgumentError, "WAF analysis requires matched rules" if result[:patterns].empty?
+          result[:exception_class] = analysis[:exception_class] if EXCEPTION_RULES.key?(analysis[:exception_class])
+          result[:request_method] = analysis[:request_method] if %w[GET HEAD POST PUT PATCH DELETE OPTIONS CONNECT TRACE OTHER].include?(analysis[:request_method])
+          result
+        end
+
+        def state_key(ip_address, whitelisted: false)
+          mode = (Beskar.configuration.monitor_only? || whitelisted || IpWhitelist.whitelisted?(ip_address)) ? "observe" : "enforce"
+          "waf:#{mode}:#{IPAddr.new(ip_address.to_s)}"
+        end
+
         # Calculate current cumulative score with decay applied
         def calculate_current_score(violations, config)
           return 0.0 if violations.empty?
@@ -379,7 +262,7 @@ module Beskar
             age_minutes = age_seconds / 60.0
 
             # Get half-life for this severity (in minutes)
-            half_life = decay_rates[v[:severity]] || 60
+            half_life = decay_rates[v[:severity].to_sym] || 60
 
             # Exponential decay: score * (1/2)^(age/half_life)
             # Equivalent to: score * e^(-ln(2) * age / half_life)
@@ -432,15 +315,14 @@ module Beskar
           }
 
           emoji = severity_emoji[analysis_result[:highest_severity]] || "🔍"
-          config = waf_config
+          waf_config
           monitor_mode_notice = Beskar.configuration.monitor_only? ? " [MONITOR-ONLY MODE]" : ""
 
           Beskar::Logger.warn("#{emoji} Vulnerability scan detected#{monitor_mode_notice} " \
             "(score: #{current_score.round(2)}, violations: #{violation_count}) - " \
             "IP: #{ip_address}, " \
             "Severity: #{analysis_result[:highest_severity]}, " \
-            "Patterns: #{analysis_result[:patterns].map { |p| p[:description] }.join(', ')}, " \
-            "Path: #{analysis_result[:patterns].first[:matched_path]}", component: :WAF)
+            "Rules: #{analysis_result[:patterns].map { |p| p[:rule_id] }.join(", ")}", component: :WAF)
         end
 
         # Log what would happen in monitor-only mode (but don't actually block)
@@ -450,37 +332,39 @@ module Beskar
 
           Beskar::Logger.warn("🔍 MONITOR-ONLY: IP #{ip_address} WOULD BE BLOCKED " \
             "(score threshold reached: #{current_score.round(2)}/#{threshold}) - " \
-            "Duration would be: #{duration ? "#{duration / 3600.0} hours" : 'PERMANENT'}, " \
+            "Duration would be: #{duration ? "#{duration / 3600.0} hours" : "PERMANENT"}, " \
             "Severity: #{analysis_result[:highest_severity]}, " \
-            "Patterns: #{analysis_result[:patterns].map { |p| p[:description] }.join(', ')}. " \
+            "Patterns: #{analysis_result[:patterns].map { |p| p[:description] }.join(", ")}. " \
             "To enable blocking, set config.monitor_only = false", component: :WAF)
         end
 
         # Create security event for WAF violation
-        def create_security_event(ip_address, analysis_result, current_score)
+        def create_security_event(ip_address, analysis_result, current_score, whitelisted: false, violation_count: nil)
           config = waf_config
-          violation_count = get_violation_count(ip_address)
+          violation_count ||= get_violation_count(ip_address)
           threshold = config[:score_threshold] || 150
-          would_be_blocked = current_score >= threshold
-
-          Beskar::SecurityEvent.create!(
-            event_type: 'waf_violation',
-            ip_address: ip_address,
-            user_agent: analysis_result[:user_agent],
-            risk_score: severity_to_risk_score(analysis_result[:highest_severity]),
-            metadata: {
-              waf_analysis: analysis_result,
-              patterns_matched: analysis_result[:patterns].map { |p| p[:description] },
-              severity: analysis_result[:highest_severity],
-              monitor_only_mode: Beskar.configuration.monitor_only?,
-              would_be_blocked: would_be_blocked,
-              violation_count: violation_count,
-              current_score: current_score.round(2),
-              score_threshold: threshold
-            }
-          )
+          would_be_blocked = config[:auto_block] && !whitelisted && !IpWhitelist.whitelisted?(ip_address) && current_score >= threshold
+
+          Beskar::SecurityEvent.transaction(requires_new: true) do
+            Beskar::SecurityEvent.create!(
+              event_type: "waf_violation",
+              ip_address: ip_address,
+              user_agent: nil,
+              risk_score: severity_to_risk_score(analysis_result[:highest_severity]),
+              metadata: {
+                waf_analysis: analysis_result,
+                patterns_matched: analysis_result[:patterns].map { |p| p[:description] },
+                severity: analysis_result[:highest_severity],
+                monitor_only_mode: Beskar.configuration.monitor_only?,
+                would_be_blocked: would_be_blocked,
+                violation_count: violation_count,
+                current_score: current_score.round(2),
+                score_threshold: threshold
+              }
+            )
+          end
         rescue => e
-          Beskar::Logger.error("Failed to create security event: #{e.message}", component: :WAF)
+          Beskar::Logger.error("Failed to create security event (#{e.class})", component: :WAF)
         end
 
         # Auto-block an IP after threshold violations
@@ -494,10 +378,10 @@ module Beskar
           begin
             banned_ip = Beskar::BannedIp.ban!(
               ip_address,
-              reason: 'waf_violation',
+              reason: "waf_violation",
               duration: duration,
               permanent: duration.nil?,
-              details: "WAF score: #{current_score.round(2)} (#{violation_count} violations) - #{analysis_result[:patterns].map { |p| p[:description] }.join(', ')}",
+              details: "WAF score: #{current_score.round(2)} (#{violation_count} violations) - #{analysis_result[:patterns].map { |p| p[:description] }.join(", ")}",
               metadata: {
                 violation_count: violation_count,
                 risk_score: current_score.round(2),
@@ -509,10 +393,10 @@ module Beskar
 
             Beskar::Logger.warn("🔒 Auto-blocked IP #{ip_address} " \
               "with score #{current_score.round(2)} (#{violation_count} violations) " \
-              "(duration: #{duration ? "#{duration / 3600} hours" : 'permanent'}), " \
+              "(duration: #{duration ? "#{duration / 3600} hours" : "permanent"}), " \
               "Ban ID: #{banned_ip.id}", component: :WAF)
           rescue => e
-            Beskar::Logger.error("[WAF] Failed to create ban for #{ip_address}: #{e.class} - #{e.message}", component: :WAF)
+            Beskar::Logger.error("[WAF] Failed to create ban for #{ip_address} (#{e.class})", component: :WAF)
             raise
           end
         end