beskar 0.1.0 → 0.2.0

data/app/controllers/beskar/application_controller.rb

@@ -3,15 +3,44 @@ module Beskar
     # Use the main app's CSRF protection settings
     protect_from_forgery with: :exception, prepend: true
 
-    layout 'beskar/application'
+    layout "beskar/application"
 
     # Ensure CSRF token is available for forms
     before_action :ensure_csrf_token
 
     before_action :authenticate_admin!
+    before_action :authorize_admin_action!
 
     private
 
+    def authorize_admin_action!
+      permission = if controller_name == "administrative_actions"
+        :read_audit
+      elsif action_name == "export"
+        :export
+      elsif controller_name == "banned_ips" && %w[new create edit update destroy extend review bulk_action].include?(action_name)
+        :manage_bans
+      else
+        :read
+      end
+      callback = Beskar.configuration.authorize_admin
+      allowed = callback && instance_exec(request, permission, &callback) == true
+      head :forbidden unless performed? || allowed
+    rescue => error
+      Beskar::Logger.warn("Administrative authorization unavailable (#{error.class})")
+      head :service_unavailable unless performed?
+    end
+
+    def administrative_actor!
+      callback = Beskar.configuration.audit_actor
+      actor = instance_exec(request, &callback) if callback
+      raise Services::AdministrativeAudit::Unavailable unless Services::AdministrativeBans.valid_actor?(actor)
+      actor
+    rescue => error
+      Beskar::Logger.warn("Administrative actor unavailable (#{error.class})")
+      raise Services::AdministrativeAudit::Unavailable, "Administrative identity unavailable"
+    end
+
     # Override this method in your application to implement authentication
     # For example, you might want to use Devise's authenticate_admin! or
     # a custom authentication method
@@ -29,19 +58,20 @@ module Beskar
       # This gives the block access to controller methods like cookies, session,
       # authenticate_or_request_with_http_basic, etc.
       result = instance_exec(request, &Beskar.configuration.authenticate_admin)
+      return false if performed?
       return true if result
 
       handle_authentication_failure
       false
     rescue => e
-      Rails.logger.error "Beskar authentication error: #{e.message}"
+      Rails.logger.error "Beskar authentication error: #{e.class}"
       handle_authentication_failure
       false
     end
 
     def handle_missing_authentication_configuration
       # Log the configuration error for debugging, but return 404 to avoid revealing Beskar is installed
-      error_message = <<~MSG
+      error_message = <<~'MSG'
         Beskar authentication not configured!
 
         Configure Beskar.configuration.authenticate_admin in your initializer:
@@ -57,14 +87,16 @@ module Beskar
 
           # Example 2: HTTP Basic Auth (uses controller method)
           # authenticate_or_request_with_http_basic do |username, password|
-          #   username == ENV['BESKAR_USERNAME'] && password == ENV['BESKAR_PASSWORD']
+          #   Beskar::Services::RequestContext.secure_match?(username, ENV['BESKAR_USERNAME']) &&
+          #     Beskar::Services::RequestContext.secure_match?(password, ENV['BESKAR_PASSWORD'])
           # end
 
           # Example 3: Cookie-based auth (uses controller cookies)
-          # cookies.signed[:admin_token] == ENV['BESKAR_ADMIN_TOKEN']
+          # Beskar::Services::RequestContext.secure_match?(cookies.signed[:admin_token], ENV['BESKAR_ADMIN_TOKEN'])
 
           # Example 4: Simple token-based auth
-          # request.headers['Authorization'] == "Bearer #{ENV['BESKAR_ADMIN_TOKEN']}"
+          # token = ENV['BESKAR_ADMIN_TOKEN']
+          # token.present? && Beskar::Services::RequestContext.secure_match?(request.headers['Authorization'], "Bearer #{token}")
 
           # Example 5: For development/testing (NOT for production!)
           # Rails.env.development? || Rails.env.test?
@@ -77,14 +109,14 @@ module Beskar
 
     def handle_authentication_failure
       # Return 404 to avoid revealing that Beskar is installed
-      render_404
+      render_404 unless performed?
     end
 
     def render_404
       respond_to do |format|
         format.html { render file: "#{Rails.public_path}/404.html", status: :not_found, layout: false }
-        format.json { render json: { error: "Not found" }, status: :not_found }
-        format.any  { head :not_found }
+        format.json { render json: {error: "Not found"}, status: :not_found }
+        format.any { head :not_found }
       end
     end
 
@@ -95,6 +127,11 @@ module Beskar
     end
     helper_method :format_timestamp
 
+    def ban_expiry_input_value(time)
+      time&.utc&.iso8601(3)&.delete_suffix("Z")
+    end
+    helper_method :ban_expiry_input_value
+
     # Helper method to format IP addresses with location if available
     def format_ip_with_location(ip, metadata = {})
       return ip unless metadata.present?
@@ -107,27 +144,34 @@ module Beskar
       end
 
       return ip if location_parts.empty?
-      "#{ip} (#{location_parts.join(', ')})"
+      "#{ip} (#{location_parts.join(", ")})"
     end
     helper_method :format_ip_with_location
 
     # Helper to determine risk level badge color
     def risk_level_class(risk_score)
-      return "neutral" unless risk_score
-
-      case risk_score
-      when 0..30
-        "success"
-      when 31..60
-        "warning"
-      when 61..85
-        "danger"
-      else
-        "critical"
-      end
+      RiskLevel::BADGES.fetch(RiskLevel.for(risk_score), "neutral")
     end
     helper_method :risk_level_class
 
+    def risk_level_color(risk_score)
+      RiskLevel::COLORS.fetch(RiskLevel.for(risk_score), "#697386")
+    end
+    helper_method :risk_level_color
+
+    def risk_level_label(risk_score)
+      level = RiskLevel.for(risk_score)
+      level ? "#{level.to_s.capitalize} Risk" : "Unknown Risk"
+    end
+    helper_method :risk_level_label
+
+    def audit_user_label(event)
+      attempted = event.attempted_email
+      Services::AuditData.user_email(event.user) || (Services::AuditData.field(:email, attempted, limit: 320) if attempted.present?) ||
+        (event.user_id ? "User ##{event.user_id}" : "-")
+    end
+    helper_method :audit_user_label
+
     # Helper to format event type for display
     def format_event_type(event_type)
       event_type.to_s.humanize.titleize
@@ -147,7 +191,7 @@ module Beskar
       page = 1 if page < 1
 
       total_count = collection.count
-      total_pages = total_count > 0 ? (total_count.to_f / per_page).ceil : 0
+      total_pages = (total_count > 0) ? (total_count.to_f / per_page).ceil : 0
 
       offset = (page - 1) * per_page
       records = collection.limit(per_page).offset(offset)
@@ -160,8 +204,8 @@ module Beskar
         per_page: per_page,
         has_previous: page > 1,
         has_next: page < total_pages,
-        previous_page: page > 1 ? page - 1 : nil,
-        next_page: page < total_pages ? page + 1 : nil
+        previous_page: (page > 1) ? page - 1 : nil,
+        next_page: (page < total_pages) ? page + 1 : nil
       }
     end
 

data/app/controllers/beskar/banned_ips_controller.rb

@@ -1,8 +1,17 @@
-require 'csv'
+require "csv"
 
 module Beskar
   class BannedIpsController < ApplicationController
-    before_action :set_banned_ip, only: [:show, :edit, :update, :destroy, :extend]
+    include Controllers::AuditExport
+
+    class ActorUnavailable < StandardError; end
+    before_action :set_banned_ip, only: [:show, :edit, :update, :destroy, :extend, :review]
+    before_action :prepare_administration, only: [:create, :update, :destroy, :extend, :bulk_action]
+    rescue_from ActorUnavailable, with: :administration_unavailable
+    rescue_from Services::AdministrativeBans::InvalidInput, Services::BanExpiry::InvalidInput do |error|
+      render plain: error.message, status: :unprocessable_content
+    end
+    rescue_from ActiveRecord::ActiveRecordError, with: :administration_unavailable
 
     def index
       @banned_ips = Beskar::BannedIp.order(banned_at: :desc)
@@ -16,23 +25,21 @@ module Beskar
 
       # Get filter options
       @ban_reasons = Beskar::BannedIp.distinct.pluck(:reason).compact.sort
-      @ban_statuses = ['active', 'expired', 'permanent', 'temporary']
+      @ban_statuses = ["active", "expired", "permanent", "temporary"]
     end
 
     def show
       # Get related security events for this IP
-      @related_events = Beskar::SecurityEvent
-        .where(ip_address: @banned_ip.ip_address)
-        .order(created_at: :desc)
-        .limit(20)
+      events = Beskar::SecurityEvent.where(ip_address: @banned_ip.ip_address)
+      @related_events = events.preload(:user).order(created_at: :desc, id: :desc).limit(20)
 
       # Calculate statistics
       @stats = {
-        total_events: @related_events.count,
-        avg_risk_score: @related_events.average(:risk_score)&.round(1) || 0,
-        max_risk_score: @related_events.maximum(:risk_score) || 0,
-        first_seen: @related_events.minimum(:created_at),
-        last_seen: @related_events.maximum(:created_at)
+        total_events: events.count,
+        avg_risk_score: events.average(:risk_score)&.round(1) || 0,
+        max_risk_score: events.maximum(:risk_score) || 0,
+        first_seen: events.minimum(:created_at),
+        last_seen: events.maximum(:created_at)
       }
     end
 
@@ -44,116 +51,132 @@ module Beskar
 
     def create
       manager = BannedIpManager.new(create_params)
-      manager.create
-
-      if manager.success?
-        redirect_to banned_ip_path(manager.banned_ip),
-                    notice: "IP address #{manager.banned_ip.ip_address} has been banned successfully."
-      else
-        @banned_ip = manager.banned_ip
-        render :new
-      end
+      @banned_ip = @administration.create!(manager.build)
+      redirect_to banned_ip_path(@banned_ip), notice: "IP address #{@banned_ip.ip_address} has been banned successfully."
+    rescue ActiveRecord::RecordInvalid => error
+      render_invalid_ban(error, :new)
     end
 
     def edit
     end
 
     def update
-      if @banned_ip.update(banned_ip_params)
-        redirect_to banned_ip_path(@banned_ip),
-                    notice: "Ban for IP #{@banned_ip.ip_address} has been updated."
-      else
-        render :edit
+      attributes = banned_ip_params.to_h
+      if attributes.key?("expires_at")
+        attributes["expires_at"] = if ActiveModel::Type::Boolean.new.cast(attributes.fetch("permanent", @banned_ip.permanent?))
+          nil
+        else
+          Services::BanExpiry.parse(attributes["expires_at"])
+        end
+        # HTML datetime-local only represents milliseconds. Preserve the stored
+        # microseconds when the displayed value was submitted without a change.
+        current_expiry = @banned_ip.expires_at
+        if params[:expiry_precision] == "milliseconds" && current_expiry &&
+            attributes["expires_at"] == current_expiry.change(usec: current_expiry.usec / 1000 * 1000)
+          attributes["expires_at"] = current_expiry
+        end
       end
+      count = @administration.change!([@banned_ip.id], action: "update", attributes: attributes)
+      message = count.positive? ? "Ban for IP #{@banned_ip.ip_address} has been updated." : "No ban changes were necessary."
+      redirect_to banned_ip_path(@banned_ip), notice: message
+    rescue ActiveRecord::RecordInvalid => error
+      render_invalid_ban(error, :edit)
     end
 
     def destroy
       ip_address = @banned_ip.ip_address
-      @banned_ip.destroy
+      @administration.change!([@banned_ip.id], action: "unban")
 
       redirect_to banned_ips_path,
-                  notice: "IP address #{ip_address} has been unbanned."
+        notice: "IP address #{ip_address} has been unbanned."
     end
 
     def extend
-      # Default to 24 hours if no duration specified (e.g., from index page)
-      duration_param = params[:duration] || '24h'
-
-      duration = case duration_param
-      when '1h'
-        1.hour
-      when '6h'
-        6.hours
-      when '24h'
-        24.hours
-      when '7d'
-        7.days
-      when '30d'
-        30.days
-      when 'permanent'
-        nil
-      else
-        24.hours
-      end
-
-      if duration_param == 'permanent'
-        @banned_ip.update!(permanent: true, expires_at: nil)
-        message = "Ban for IP #{@banned_ip.ip_address} is now permanent."
-      else
-        # Ensure the ban can be extended (not already permanent)
-        if @banned_ip.permanent?
-          redirect_to banned_ip_path(@banned_ip), alert: "Cannot extend a permanent ban."
-          return
-        end
-
-        @banned_ip.extend_ban!(duration)
-        duration_text = duration_param == '24h' ? '24 hours' : duration_param.gsub(/(\d+)([hd])/, '\1 \2').gsub('h', 'hour(s)').gsub('d', 'day(s)')
-        message = "Ban for IP #{@banned_ip.ip_address} has been extended by #{duration_text}."
-      end
+      action = (params[:duration] == "permanent") ? "make_permanent" : "extend"
+      @administration.change!([@banned_ip.id], action: action, duration: params[:duration] || "24h")
+      redirect_to banned_ip_path(@banned_ip), notice: "Ban updated and administrative action recorded."
+    end
 
-      redirect_to banned_ip_path(@banned_ip), notice: message
-    rescue => e
-      Rails.logger.error "Failed to extend ban: #{e.message}"
-      redirect_to banned_ip_path(@banned_ip), alert: "Failed to extend ban: #{e.message}"
+    def review
+      @operation = params[:operation]
+      head :bad_request unless %w[unban extend].include?(@operation)
     end
 
     def bulk_action
-      case params[:bulk_action]
-      when 'unban'
-        unban_selected
-      when 'make_permanent'
-        make_permanent_selected
-      when 'extend'
-        extend_selected
-      else
-        redirect_to banned_ips_path, alert: "Unknown action."
-      end
+      action = params[:bulk_action]
+      raise Services::AdministrativeBans::InvalidInput, "Unknown bulk action" unless %w[unban extend make_permanent].include?(action)
+      count = @administration.change!(params[:ip_ids], action: action, duration: params[:duration])
+      description = {"unban" => "unbanned", "make_permanent" => "made permanent", "extend" => "extended"}.fetch(action)
+      redirect_to banned_ips_path, notice: "#{count} ban(s) #{description}; administrative actions recorded."
     end
 
     def export
       @banned_ips = Beskar::BannedIp.all
       apply_filters!
+      records = export_records(@banned_ips)
+      return if performed?
 
       respond_to do |format|
         format.csv do
-          send_data generate_csv(@banned_ips),
+          send_data generate_csv(records),
             filename: "banned-ips-#{Date.current}.csv",
-            type: 'text/csv'
+            type: "text/csv"
         end
         format.json do
-          render json: @banned_ips.as_json(except: [:updated_at])
+          render json: records.map { |ban|
+            ban.attributes.slice("id", "ip_address", "reason", "details",
+              "permanent", "banned_at", "expires_at", "violation_count", "metadata", "created_at")
+          }
         end
       end
     end
 
     private
 
+    def ban_reason_options
+      options = [["Rate Limit Abuse", "rate_limit_abuse"], ["Authentication Abuse", "authentication_abuse"],
+        ["WAF Violation", "waf_violation"], ["Brute Force Attack", "brute_force_attack"],
+        ["Suspicious Activity", "suspicious_activity"], ["Manual Ban", "manual_ban"], ["Other", "other"]]
+      reason = @suggested_reason || @banned_ip.reason
+      options << [reason, reason] if reason.present? && options.none? { |_, value| value == reason }
+      options
+    end
+    helper_method :ban_reason_options
+
+    def prepare_administration
+      begin
+        callback = Beskar.configuration.audit_actor
+        actor = instance_exec(request, &callback) if callback
+        raise ActorUnavailable unless Services::AdministrativeBans.valid_actor?(actor)
+      rescue => error
+        Beskar::Logger.warn("Administrative actor unavailable (#{error.class})")
+        raise ActorUnavailable, "Administrative identity unavailable"
+      end
+      @administration = Services::AdministrativeBans.new(actor: actor, reason: params[:audit_reason], request_id: request.request_id)
+    end
+
+    def administration_unavailable(error)
+      return head :not_found if error.is_a?(ActiveRecord::RecordNotFound)
+      Beskar::Logger.warn("Administrative operation unavailable (#{error.class})")
+      render plain: "Administrative changes are unavailable. Reload state before retrying.", status: :service_unavailable
+    end
+
+    def render_invalid_ban(error, template)
+      return administration_unavailable(error) unless error.record.is_a?(BannedIp)
+      @banned_ip = error.record
+      render template, status: :unprocessable_content
+    end
+
     def set_banned_ip
       @banned_ip = Beskar::BannedIp.find(params[:id])
     end
 
     def banned_ip_params
-      params.require(:banned_ip).permit(
+      input = params.require(:banned_ip)
+      if input.key?(:expires_at) && !input[:expires_at].nil? && !input[:expires_at].is_a?(String)
+        raise Services::BanExpiry::InvalidInput, "Expiry must be a date and time string"
+      end
+      input.permit(
         :ip_address, :reason, :details, :permanent,
         :expires_at, :violation_count, metadata: {}
       )
@@ -169,13 +192,13 @@ module Beskar
     def apply_filters!
       # Filter by status
       case params[:status]
-      when 'active'
+      when "active"
         @banned_ips = @banned_ips.active
-      when 'expired'
+      when "expired"
         @banned_ips = @banned_ips.expired
-      when 'permanent'
+      when "permanent"
         @banned_ips = @banned_ips.permanent
-      when 'temporary'
+      when "temporary"
         @banned_ips = @banned_ips.temporary
       end
 
@@ -209,70 +232,22 @@ module Beskar
       end
     end
 
-    def unban_selected
-      if params[:ip_ids].present?
-        banned_ips = Beskar::BannedIp.where(id: params[:ip_ids])
-        count = banned_ips.count
-
-        banned_ips.destroy_all
-
-        redirect_to banned_ips_path,
-                    notice: "#{count} IP(s) have been unbanned."
-      else
-        redirect_to banned_ips_path, alert: "No IPs selected."
-      end
-    end
-
-    def make_permanent_selected
-      if params[:ip_ids].present?
-        count = Beskar::BannedIp.where(id: params[:ip_ids])
-                       .update_all(permanent: true, expires_at: nil)
-
-        redirect_to banned_ips_path,
-                    notice: "#{count} ban(s) have been made permanent."
-      else
-        redirect_to banned_ips_path, alert: "No IPs selected."
-      end
-    end
-
-    def extend_selected
-      if params[:ip_ids].present? && params[:duration].present?
-        banned_ips = Beskar::BannedIp.where(id: params[:ip_ids])
-
-        duration = case params[:duration]
-        when '24h' then 24.hours
-        when '7d' then 7.days
-        when '30d' then 30.days
-        else 24.hours
-        end
-
-        banned_ips.each do |banned_ip|
-          banned_ip.extend_ban!(duration)
-        end
-
-        redirect_to banned_ips_path,
-                    notice: "#{banned_ips.count} ban(s) have been extended."
-      else
-        redirect_to banned_ips_path, alert: "No IPs selected or duration not specified."
-      end
-    end
-
     def generate_csv(banned_ips)
-      require 'csv'
+      require "csv"
 
-      CSV.generate(headers: true) do |csv|
-        csv << ['IP Address', 'Reason', 'Banned At', 'Expires At', 'Status', 'Violation Count', 'Details']
+      CSV.generate(headers: true, force_quotes: true) do |csv|
+        csv << ["IP Address", "Reason", "Banned At", "Expires At", "Status", "Violation Count", "Details"]
 
-        banned_ips.find_each do |ban|
+        banned_ips.each do |ban|
           csv << [
             ban.ip_address,
             ban.reason,
-            ban.banned_at.strftime('%Y-%m-%d %H:%M:%S'),
-            ban.expires_at&.strftime('%Y-%m-%d %H:%M:%S') || (ban.permanent? ? 'Never (Permanent)' : '-'),
-            ban.active? ? 'Active' : 'Expired',
+            ban.banned_at.strftime("%Y-%m-%d %H:%M:%S"),
+            ban.expires_at&.strftime("%Y-%m-%d %H:%M:%S") || (ban.permanent? ? "Never (Permanent)" : "-"),
+            ban.active? ? "Active" : "Expired",
             ban.violation_count,
-            ban.details || '-'
-          ]
+            ban.details || "-"
+          ].map { |value| Services::AuditData.csv_cell(value) }
         end
       end
     end

data/app/controllers/beskar/dashboard_controller.rb

@@ -2,48 +2,40 @@ module Beskar
   class DashboardController < ApplicationController
     def index
       # Time ranges for statistics
-      @time_range = params[:time_range] || '24h'
+      @time_range = params[:time_range] || "24h"
       @start_time = calculate_start_time(@time_range)
 
       # Overview statistics
+      events = Beskar::SecurityEvent.where(created_at: @start_time..Time.current)
+      @event_distribution = events.group(:event_type).count.sort_by { |_, count| -count }
+      score_counts = events.group(:risk_score).count
+      @risk_distribution = RiskLevel::RANGES.keys.to_h { |level| [level, 0] }
+      score_counts.each do |score, count|
+        level = RiskLevel.for(score)
+        @risk_distribution[level] += count if level
+      end
       @stats = {
-        total_events: Beskar::SecurityEvent.where("created_at >= ?", @start_time).count,
-        failed_logins: Beskar::SecurityEvent.where("created_at >= ?", @start_time).login_failures.count,
+        total_events: @event_distribution.sum(&:last),
+        failed_logins: @event_distribution.to_h.fetch("login_failure", 0),
         blocked_ips: Beskar::BannedIp.active.count,
-        high_risk_events: Beskar::SecurityEvent.where("created_at >= ?", @start_time).high_risk.count,
-        critical_threats: Beskar::SecurityEvent.where("created_at >= ?", @start_time).critical_risk.count
+        high_risk_events: @risk_distribution[:high] + @risk_distribution[:critical],
+        critical_threats: @risk_distribution[:critical]
       }
 
       # Recent activity
       @recent_events = Beskar::SecurityEvent
         .includes(:user)
-        .order(created_at: :desc)
+        .order(created_at: :desc, id: :desc)
         .limit(10)
 
       # Top threat IPs
-      @top_threat_ips = Beskar::SecurityEvent
-        .where("created_at >= ?", @start_time)
+      @top_threat_ips = events
         .group(:ip_address)
         .select("ip_address, COUNT(*) as event_count, AVG(risk_score) as avg_risk_score, MAX(risk_score) as max_risk_score")
         .having("COUNT(*) > 1")
         .order("event_count DESC, avg_risk_score DESC")
         .limit(5)
 
-      # Event types distribution
-      @event_distribution = Beskar::SecurityEvent
-        .where("created_at >= ?", @start_time)
-        .group(:event_type)
-        .count
-        .sort_by { |_, count| -count }
-
-      # Risk score distribution
-      @risk_distribution = {
-        low: Beskar::SecurityEvent.where("created_at >= ? AND risk_score < 30", @start_time).count,
-        medium: Beskar::SecurityEvent.where("created_at >= ? AND risk_score BETWEEN 30 AND 60", @start_time).count,
-        high: Beskar::SecurityEvent.where("created_at >= ? AND risk_score BETWEEN 61 AND 85", @start_time).count,
-        critical: Beskar::SecurityEvent.where("created_at >= ? AND risk_score > 85", @start_time).count
-      }
-
       # Currently active bans
       @active_bans = Beskar::BannedIp.active.order(banned_at: :desc).limit(5)
     end
@@ -52,15 +44,15 @@ module Beskar
 
     def calculate_start_time(range)
       case range
-      when '1h'
+      when "1h"
         1.hour.ago
-      when '6h'
+      when "6h"
         6.hours.ago
-      when '24h'
+      when "24h"
         24.hours.ago
-      when '7d'
+      when "7d"
         7.days.ago
-      when '30d'
+      when "30d"
         30.days.ago
       else
         24.hours.ago