beskar 0.1.0 → 0.2.0

data/app/models/beskar/banned_ip.rb

@@ -1,193 +1,152 @@
+require "ipaddr"
+
 module Beskar
   class BannedIp < ApplicationRecord
-    # Serialize metadata as JSON
     serialize :metadata, coder: JSON
 
     validates :ip_address, presence: true, uniqueness: true
-    validates :reason, presence: true
-    validates :banned_at, presence: true
-
-    # Ensure metadata is always a hash
-    after_initialize do
-      self.metadata ||= {}
-    end
-
-    # Cache management callbacks
-    after_save :update_cache
-    after_destroy :clear_cache
-
-    scope :active, -> { where("expires_at IS NULL OR expires_at > ?", Time.current) }
+    validates :reason, :banned_at, presence: true
+    validates :expires_at, presence: true, unless: :permanent?
+    validates :violation_count, numericality: {only_integer: true, greater_than: 0}
+    validate :valid_ip_address
+
+    after_initialize { self.metadata ||= {} if has_attribute?(:metadata) }
+    before_validation :normalize_attributes
+    before_validation :sanitize_audit_fields
+    after_find :sanitize_audit_fields
+    after_commit :clear_legacy_cache
+
+    # Permanent is authoritative even for legacy rows with an expired timestamp.
+    scope :active, -> { where("permanent = ? OR expires_at > ?", true, Time.current) }
     scope :permanent, -> { where(permanent: true) }
     scope :temporary, -> { where(permanent: false) }
-    scope :expired, -> { where("expires_at IS NOT NULL AND expires_at <= ?", Time.current) }
+    scope :expired, -> { temporary.where("expires_at <= ?", Time.current) }
     scope :by_reason, ->(reason) { where(reason: reason) }
 
-    # Check if a ban is currently active
     def active?
       permanent? || (expires_at.present? && expires_at > Time.current)
     end
 
-    # Check if ban has expired
+    def sanitize_audit_fields
+      self.reason = Services::AuditData.field(:reason, reason, limit: 100) if has_attribute?(:reason)
+      self.details = Services::AuditData.field(:details, details) if has_attribute?(:details)
+      self.metadata = Services::AuditData.metadata(metadata) if has_attribute?(:metadata)
+    end
+    private :sanitize_audit_fields
+
     def expired?
       !permanent? && expires_at.present? && expires_at <= Time.current
     end
 
-    # Extend ban duration (for repeat offenders)
     def extend_ban!(additional_time = nil)
-      self.violation_count += 1
-      
-      if permanent?
-        # Already permanent, just increment violation count
-        save!
-      elsif additional_time
-        self.expires_at = [expires_at || Time.current, Time.current].max + additional_time
-        save!
-      else
-        # Calculate exponential backoff based on violation count
-        # 1 hour, 6 hours, 24 hours, 7 days, permanent
-        duration = case violation_count
-        when 1 then 1.hour
-        when 2 then 6.hours
-        when 3 then 24.hours
-        when 4 then 7.days
-        else
-          self.permanent = true
-          nil
-        end
-
-        if duration
-          self.expires_at = Time.current + duration
-        end
+      validate_duration!(additional_time)
+      SecurityState.mutate("ban:#{ip_address}", ttl: 1.day) do
+        reload(lock: true)
+        apply_extension(additional_time)
         save!
       end
     end
 
-    # Unban an IP address
     def unban!
-      destroy
+      destroy!
     end
 
-    # Class methods for ban management
     class << self
-      # Ban an IP address
       def ban!(ip_address, reason:, duration: nil, permanent: false, details: nil, metadata: {})
-        # Retry logic to handle race conditions when multiple requests try to ban the same IP
-        retries = 0
-        max_retries = 2
-
-        begin
-          banned_ip = find_or_initialize_by(ip_address: ip_address)
-
+        raise ArgumentError, "Ban duration must be positive" if duration && !duration.to_f.positive?
+        raise ArgumentError, "Ban requires a single IP address" if ip_address.to_s.include?("/")
+        ip_address = IPAddr.new(ip_address.to_s).to_s
+
+        SecurityState.mutate("ban:#{ip_address}", ttl: 1.day) do
+          # The coordination lookup may establish a MySQL REPEATABLE READ
+          # snapshot before another worker commits. Locking the state row does
+          # not refresh that snapshot: read the ban with a current lock too.
+          banned_ip = lock.find_or_initialize_by(ip_address: ip_address)
           if banned_ip.persisted?
-            # Existing ban - extend it
-            banned_ip.extend_ban!(duration)
+            banned_ip.permanent = true if permanent
+            banned_ip.send(:apply_extension, duration)
+            banned_ip.reason = reason
             banned_ip.details = details if details
-            # Deep stringify keys to avoid duplicate key issues
-            if metadata.any?
-              banned_ip.metadata = banned_ip.metadata.deep_stringify_keys.merge(metadata.deep_stringify_keys)
-            end
-            banned_ip.save!
+            banned_ip.metadata = banned_ip.metadata.deep_stringify_keys.merge(metadata.deep_stringify_keys)
           else
-            # New ban
             banned_ip.assign_attributes(
-              reason: reason,
-              banned_at: Time.current,
-              expires_at: permanent ? nil : (Time.current + (duration || 1.hour)),
-              permanent: permanent,
-              details: details,
-              metadata: metadata
+              reason: reason, banned_at: Time.current, permanent: permanent,
+              expires_at: permanent ? nil : Time.current + (duration || 1.hour),
+              details: details, metadata: metadata
             )
-            banned_ip.save!
           end
-
-          # Update cache
-          cache_key = "beskar:banned_ip:#{ip_address}"
-          Rails.cache.write(cache_key, true, expires_in: permanent ? nil : (duration || 1.hour))
-
+          banned_ip.save!
           banned_ip
-        rescue ActiveRecord::RecordInvalid => e
-          # Race condition: another request created the record between find and save
-          if e.message.include?("Ip address has already been taken") && retries < max_retries
-            retries += 1
-            # Small random delay to reduce contention (1-10ms)
-            sleep(rand(1..10) / 1000.0)
-            retry
-          else
-            # Re-raise if it's a different validation error or we've exceeded retries
-            raise
-          end
         end
       end
 
-      # Check if an IP is banned (cache-first approach)
+      # Cache eviction, rollback, stale values, or process-local caches cannot
+      # change enforcement. All workers consult the same indexed database.
       def banned?(ip_address)
-        # Check cache first for performance
-        cache_key = "beskar:banned_ip:#{ip_address}"
-        cached_result = Rails.cache.read(cache_key)
-        return true if cached_result == true
-        return false if cached_result == false
-
-        # Check database
-        banned_record = active.find_by(ip_address: ip_address)
-        is_banned = banned_record&.active? || false
-
-        # Update cache
-        if is_banned && banned_record
-          ttl = banned_record.permanent? ? 30.days : (banned_record.expires_at - Time.current).to_i
-          Rails.cache.write(cache_key, true, expires_in: ttl)
-        else
-          Rails.cache.write(cache_key, false, expires_in: 5.minutes)
-        end
-
-        is_banned
+        return false if ip_address.to_s.include?("/")
+        active.exists?(ip_address: IPAddr.new(ip_address.to_s).to_s)
+      rescue IPAddr::InvalidAddressError
+        false
       end
 
-      # Unban an IP address
       def unban!(ip_address)
-        banned_ip = find_by(ip_address: ip_address)
-        if banned_ip
-          banned_ip.destroy
-          # Clear cache
-          Rails.cache.delete("beskar:banned_ip:#{ip_address}")
-          true
-        else
-          false
-        end
+        banned_ip = find_by(ip_address: IPAddr.new(ip_address.to_s).to_s)
+        return false unless banned_ip
+        banned_ip.destroy!
+        true
       end
 
-      # Load all active bans into cache (called on app startup)
+      # Kept for compatibility; no enforcement state lives in Rails.cache.
       def preload_cache!
-        active.find_each do |banned_ip|
-          cache_key = "beskar:banned_ip:#{banned_ip.ip_address}"
-          ttl = banned_ip.permanent? ? 30.days : [(banned_ip.expires_at - Time.current).to_i, 60].max
-          Rails.cache.write(cache_key, true, expires_in: ttl)
-        end
       end
 
-      # Clean up expired bans
       def cleanup_expired!
-        expired.destroy_all
+        expired.find_each do |ban|
+          ban.with_lock { ban.destroy! if ban.expired? }
+        end
       end
     end
 
     private
 
-    def update_cache
-      return unless active?
+    def apply_extension(additional_time)
+      self.violation_count += 1
+      if permanent?
+        self.expires_at = nil
+      elsif additional_time
+        self.expires_at = [expires_at || Time.current, Time.current].max + additional_time
+      elsif violation_count >= 5
+        self.permanent = true
+        self.expires_at = nil
+      else
+        self.expires_at = Time.current + [1.hour, 6.hours, 24.hours, 7.days].fetch(violation_count - 1)
+      end
+    end
 
-      cache_key = "beskar:banned_ip:#{ip_address}"
-      ttl = calculate_cache_ttl
-      Rails.cache.write(cache_key, true, expires_in: ttl)
+    def validate_duration!(duration)
+      raise ArgumentError, "Ban duration must be positive" if duration && !duration.to_f.positive?
     end
 
-    def clear_cache
-      Rails.cache.delete("beskar:banned_ip:#{ip_address}")
+    def normalize_attributes
+      self.expires_at = nil if permanent?
+      self.ip_address = IPAddr.new(ip_address.to_s).to_s if ip_address.present? && !ip_address.include?("/")
+    rescue IPAddr::InvalidAddressError
+      # Validation reports malformed addresses without raising.
     end
 
-    def calculate_cache_ttl
-      return nil if permanent? || expires_at.nil?
+    def valid_ip_address
+      raise IPAddr::InvalidAddressError if ip_address.to_s.include?("/")
+      IPAddr.new(ip_address.to_s)
+    rescue IPAddr::InvalidAddressError
+      errors.add(:ip_address, "must be a valid individual IP address")
+    end
 
-      (expires_at - Time.current).to_i
+    def clear_legacy_cache
+      [ip_address, previous_changes.dig("ip_address", 0)].compact.uniq.each do |ip|
+        Rails.cache.delete("beskar:banned_ip:#{ip}")
+      end
+    rescue => error
+      Beskar::Logger.warn("Legacy ban cache invalidation failed (#{error.class})", component: :BannedIp)
     end
   end
 end

data/app/models/beskar/security_event.rb

@@ -1,6 +1,13 @@
 module Beskar
   class SecurityEvent < ApplicationRecord
+    # MySQL reports expression defaults as functions, not Ruby attribute values.
+    attribute :metadata, default: -> { {} }
+
+    # Transient correlation; the audit row is not enforcement authority.
+    attr_accessor :beskar_attempt
     belongs_to :user, polymorphic: true, optional: true
+    before_validation :sanitize_audit_fields
+    after_find :sanitize_audit_fields
 
     validates :event_type, presence: true
     validates :ip_address, presence: true
@@ -10,15 +17,32 @@ module Beskar
     scope :login_successes, -> { where(event_type: "login_success") }
     scope :recent, ->(time = 1.hour.ago) { where("created_at >= ?", time) }
     scope :by_ip, ->(ip) { where(ip_address: ip) }
-    scope :high_risk, -> { where("risk_score >= ?", 70) }
-    scope :critical_risk, -> { where("risk_score >= ?", 90) }
+    scope :high_risk, -> { where(risk_score: RiskLevel::RANGES[:high].begin..100) }
+    scope :critical_risk, -> { where(risk_score: RiskLevel::RANGES[:critical]) }
+    scope :with_risk_level, ->(level) {
+      range = RiskLevel::RANGES.find { |name, _| name.to_s == level.to_s }&.last
+      range ? where(risk_score: range) : all
+    }
+
+    def readonly?
+      persisted? || super
+    end
+
+    def delete
+      raise ActiveRecord::ReadOnlyRecord, "Security events are append-only" if persisted?
+      super
+    end
+
+    def risk_level
+      RiskLevel.for(risk_score)
+    end
 
     def critical_threat?
-      risk_score >= 90
+      risk_level == :critical
     end
 
     def high_risk?
-      risk_score >= 70
+      [:high, :critical].include?(risk_level)
     end
 
     def login_failure?
@@ -60,5 +84,14 @@ module Beskar
         metadata["info"] ||
         nil
     end
+
+    private
+
+    def sanitize_audit_fields
+      self.metadata = Services::AuditData.metadata(metadata) if has_attribute?(:metadata)
+      {event_type: 100, ip_address: 64, user_agent: 500, attempted_email: 320}.each do |field, limit|
+        self[field] = Services::AuditData.field(field, self[field], limit: limit) if has_attribute?(field)
+      end
+    end
   end
 end

data/app/models/beskar/security_state.rb

@@ -0,0 +1,58 @@
+module Beskar
+  # Persistent coordination; deliberately independent of Rails.cache capabilities.
+  class SecurityState < ApplicationRecord
+    class ConcurrentCleanup < StandardError; end
+
+    # Preserve defaults on unsaved records as well as database-created rows.
+    attribute :data, default: -> { {} }
+
+    validates :key, presence: true
+
+    def self.read(key)
+      row = find_by(key: key)
+      return {} if row.nil? || (row.expires_at && row.expires_at <= Time.current)
+      row.data.deep_dup
+    end
+
+    def self.mutate(keys, ttl:)
+      keys = Array(keys).uniq.sort
+      retries = 0
+      begin
+        mutate_once(keys, ttl: ttl) { |state| yield state }
+      rescue ActiveRecord::StaleObjectError, ActiveRecord::Deadlocked, ActiveRecord::SerializationFailure, ActiveRecord::RecordNotUnique, ConcurrentCleanup
+        raise if (retries += 1) > 10
+        sleep(0.005 * retries)
+        retry
+      rescue ActiveRecord::StatementInvalid => error
+        # SQLite uses database-level write locking rather than SELECT FOR UPDATE.
+        raise unless error.cause&.class&.name == "SQLite3::BusyException"
+        raise if (retries += 1) > 10
+        sleep(0.005 * retries)
+        retry
+      end
+    end
+
+    # The block may be retried after a concurrency conflict. Keep its effects in
+    # this database transaction; do not send notifications or write to caches.
+    def self.mutate_once(keys, ttl:)
+      transaction(requires_new: true) do
+        keys.each { |key| find_by(key: key) || create_or_find_by!(key: key) }
+        rows = where(key: keys).order(:key).lock.to_a
+        raise ConcurrentCleanup unless rows.size == keys.size
+        state = rows.to_h do |row|
+          [row.key, (row.expires_at && row.expires_at <= Time.current) ? {} : row.data.deep_dup]
+        end
+        result = yield state
+        rows.each do |row|
+          row.update!(data: state.fetch(row.key), expires_at: ttl && Time.current + ttl)
+        end
+        result
+      end
+    end
+    private_class_method :mutate_once
+
+    def self.cleanup_expired!
+      where("expires_at <= ?", Time.current).in_batches.delete_all
+    end
+  end
+end

data/app/services/beskar/banned_ip_manager.rb

@@ -9,10 +9,16 @@ module Beskar
     end
 
     def create
+      build.save
+    end
+
+    def build
       @banned_ip = BannedIp.new(base_attributes)
+      unless [nil, "", "temporary", "permanent"].include?(@params[:ban_type])
+        raise Services::AdministrativeBans::InvalidInput, "Select a valid ban type"
+      end
       configure_ban_duration
-
-      @banned_ip.save
+      @banned_ip
     end
 
     def success?
@@ -39,7 +45,7 @@ module Beskar
     end
 
     def permanent_ban?
-      @params[:ban_type] == 'permanent'
+      @params[:ban_type] == "permanent"
     end
 
     def set_permanent_ban
@@ -53,14 +59,15 @@ module Beskar
     end
 
     def calculate_expiry_time
-      return custom_expiry_time if custom_expiry_time.present?
-      return preset_duration_expiry if preset_duration.present?
+      custom_expiry = custom_expiry_time
+      return custom_expiry if custom_expiry
+      return preset_duration_expiry unless [nil, ""].include?(preset_duration)
 
       default_expiry_time
     end
 
     def custom_expiry_time
-      @params[:expires_at]
+      Services::BanExpiry.parse(@params[:expires_at])
     end
 
     def preset_duration
@@ -68,6 +75,9 @@ module Beskar
     end
 
     def preset_duration_expiry
+      unless preset_duration.to_s.match?(/\A[1-9]\d{0,6}\z/) && preset_duration.to_i <= 90.days.to_i
+        raise Services::AdministrativeBans::InvalidInput, "Duration must be a positive number of seconds, at most 90 days"
+      end
       Time.current + preset_duration.to_i.seconds
     end
 

data/app/views/beskar/administrative_actions/index.html.erb

@@ -0,0 +1,33 @@
+<% content_for :page_title, "Administrative Action History" %>
+<div class="card">
+  <div class="card-header">
+    <h3 class="card-title">Administrative actions</h3>
+    <p><%= @pagination[:total_count] %> actions<%= " for ban ##{params[:target_id]}" if params[:target_id].present? %>. History survives removal of the live ban.</p>
+  </div>
+  <div class="card-body">
+    <table>
+      <thead><tr><th>Time</th><th>Action</th><th>Target</th><th>Actor</th><th>Reason</th><th>Details</th></tr></thead>
+      <tbody>
+        <% @administrative_actions.each do |entry| %>
+          <tr>
+            <td><%= format_timestamp(entry.created_at) %></td>
+            <td><%= entry.action.humanize %></td>
+            <td><%= entry.target_type %><%= " ##{entry.target_id}" if entry.target_id %></td>
+            <td><%= entry.actor %></td>
+            <td><%= entry.reason %></td>
+            <td><%= link_to "View action", administrative_action_path(entry) %></td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+    <% if @administrative_actions.empty? %><p>No administrative actions recorded.</p><% end %>
+    <nav aria-label="Action history pages">
+      <% if @pagination[:has_previous] %>
+        <%= link_to "Previous", administrative_actions_path(target_id: params[:target_id], page: @pagination[:previous_page], per_page: @pagination[:per_page]) %>
+      <% end %>
+      <% if @pagination[:has_next] %>
+        <%= link_to "Next", administrative_actions_path(target_id: params[:target_id], page: @pagination[:next_page], per_page: @pagination[:per_page]) %>
+      <% end %>
+    </nav>
+  </div>
+</div>

data/app/views/beskar/administrative_actions/show.html.erb

@@ -0,0 +1,21 @@
+<% content_for :page_title, "Administrative Action ##{@administrative_action.id}" %>
+<% entry = @administrative_action %>
+<div class="card">
+  <div class="card-header"><h3 class="card-title"><%= entry.action.humanize %></h3></div>
+  <div class="card-body">
+    <dl>
+      <dt>Actor</dt><dd><%= entry.actor %></dd>
+      <dt>Reason</dt><dd><%= entry.reason %></dd>
+      <dt>Time</dt><dd><%= format_timestamp(entry.created_at) %></dd>
+      <dt>Target</dt><dd><%= entry.target_type %><%= " ##{entry.target_id}" if entry.target_id %></dd>
+      <dt>Operation ID</dt><dd><%= entry.operation_id %></dd>
+      <dt>Request ID</dt><dd><%= entry.request_id %></dd>
+    </dl>
+    <h4>Before</h4><pre><%= JSON.pretty_generate(entry.before_state) %></pre>
+    <h4>After</h4><pre><%= JSON.pretty_generate(entry.after_state) %></pre>
+    <% if entry.target_id %>
+      <%= link_to "History for this ban", administrative_actions_path(target_id: entry.target_id), class: "btn btn-secondary" %>
+    <% end %>
+    <%= link_to "All actions", administrative_actions_path, class: "btn btn-secondary" %>
+  </div>
+</div>