beskar 0.1.0 → 0.2.1

data/app/views/beskar/banned_ips/show.html.erb

@@ -3,12 +3,8 @@
 <% content_for :header_actions do %>
   <%= link_to "← Back to Banned IPs", banned_ips_path, class: "btn btn-secondary" %>
   <%= link_to "Edit", edit_banned_ip_path(@banned_ip), class: "btn btn-secondary" %>
-  <%= link_to "Unban", banned_ip_path(@banned_ip),
-      data: {
-        "turbo-method": "delete",
-        "turbo-confirm": "Are you sure you want to unban #{@banned_ip.ip_address}?"
-      },
-      class: "btn btn-danger" %>
+  <%= link_to "Action History", administrative_actions_path(target_id: @banned_ip.id), class: "btn btn-secondary" %>
+  <%= link_to "Unban", review_banned_ip_path(@banned_ip, operation: "unban"), class: "btn btn-danger" %>
 <% end %>
 
 <!-- Ban Overview -->
@@ -143,7 +139,7 @@
       </div>
 
       <div style="text-align: center; padding: 1rem; background: #FAFBFC; border-radius: 6px;">
-        <div style="font-size: 24px; font-weight: 600; color: <%= @stats[:avg_risk_score] > 70 ? '#E91E63' : '#1A1F36' %>;">
+        <div style="font-size: 24px; font-weight: 600; color: <%= risk_level_color(@stats[:avg_risk_score]) %>;">
           <%= @stats[:avg_risk_score] %>
         </div>
         <div style="font-size: 11px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.025em; color: #697386; margin-top: 0.25rem;">
@@ -152,7 +148,7 @@
       </div>
 
       <div style="text-align: center; padding: 1rem; background: #FAFBFC; border-radius: 6px;">
-        <div style="font-size: 24px; font-weight: 600; color: <%= @stats[:max_risk_score] > 85 ? '#D32F2F' : '#1A1F36' %>;">
+        <div style="font-size: 24px; font-weight: 600; color: <%= risk_level_color(@stats[:max_risk_score]) %>;">
           <%= @stats[:max_risk_score] %>
         </div>
         <div style="font-size: 11px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.025em; color: #697386; margin-top: 0.25rem;">
@@ -185,6 +181,10 @@
   </div>
 </div>
 
+<% if @banned_ip.reason == "waf_violation" %>
+  <%= render "beskar/shared/waf_analysis", analysis: @banned_ip.metadata["waf_analysis"], banned: true %>
+<% end %>
+
 <!-- Metadata -->
 <% if @banned_ip.metadata.present? && @banned_ip.metadata.any? %>
   <div class="card">
@@ -214,6 +214,7 @@
               <th>User</th>
               <th>Risk Score</th>
               <th>Details</th>
+              <th>Requested Path</th>
               <th>Actions</th>
             </tr>
           </thead>
@@ -239,11 +240,11 @@
                 <td>
                   <% if event.user %>
                     <div style="font-size: 13px;">
-                      <%= event.user.try(:email) || "User ##{event.user_id}" %>
+                      <%= audit_user_label(event) %>
                     </div>
                   <% elsif event.attempted_email %>
                     <div style="font-size: 13px; color: #697386;">
-                      <%= event.attempted_email %>
+                      <%= audit_user_label(event) %>
                     </div>
                   <% else %>
                     <span style="color: #C1C7D0;">-</span>
@@ -259,6 +260,10 @@
                     <%= event.details || event.metadata&.dig("message") || "-" %>
                   </div>
                 </td>
+                <td style="font-family: monospace; font-size: 12px; overflow-wrap: anywhere; max-width: 300px;">
+                  <% analysis = event.metadata["waf_analysis"] %>
+                  <%= analysis.is_a?(Hash) ? analysis["request_path"].presence || "Not recorded" : "-" %>
+                </td>
                 <td>
                   <%= link_to "View", security_event_path(event), class: "btn btn-sm btn-secondary" %>
                 </td>
@@ -295,16 +300,14 @@
               ['Make Permanent', 'permanent']
             ]),
             style: "padding: 0.5rem 0.75rem; font-size: 14px;" %>
+        <%= label_tag :audit_reason, "Administrative reason" %>
+        <%= text_field_tag :audit_reason, nil, required: true, maxlength: 1000 %>
         <%= submit_tag "Extend Ban", class: "btn btn-warning" %>
       <% end %>
     </div>
   <% end %>
 
-  <%= link_to "Unban IP", banned_ip_path(@banned_ip),
-      data: {
-        "turbo-method": "delete",
-        "turbo-confirm": "Are you sure you want to unban #{@banned_ip.ip_address}?"
-      },
+  <%= link_to "Unban IP", review_banned_ip_path(@banned_ip, operation: "unban"),
       class: "btn btn-danger",
       style: "margin-left: #{ @banned_ip.active? && !@banned_ip.permanent? ? '0' : 'auto' };" %>
 </div>

data/app/views/beskar/dashboard/index.html.erb

@@ -38,7 +38,7 @@
     <div class="stat-value" style="color: var(--primary);">
       <%= number_with_delimiter(@stats[:high_risk_events]) %>
     </div>
-    <div class="stat-change">Score > 60</div>
+    <div class="stat-change">Score &ge; <%= Beskar::RiskLevel::RANGES[:high].begin %></div>
   </div>
 
   <div class="stat-card">
@@ -46,7 +46,7 @@
     <div class="stat-value" style="color: #D32F2F;">
       <%= number_with_delimiter(@stats[:critical_threats]) %>
     </div>
-    <div class="stat-change">Score > 85</div>
+    <div class="stat-change">Score &ge; <%= Beskar::RiskLevel::RANGES[:critical].begin %></div>
   </div>
 </div>
 
@@ -172,11 +172,11 @@
                 <td>
                   <% if event.user %>
                     <div style="font-size: 13px;">
-                      <%= event.user.try(:email) || "User ##{event.user_id}" %>
+                      <%= audit_user_label(event) %>
                     </div>
                   <% elsif event.attempted_email %>
                     <div style="font-size: 13px; color: #697386;">
-                      <%= event.attempted_email %>
+                      <%= audit_user_label(event) %>
                     </div>
                   <% else %>
                     <span style="color: #C1C7D0;">-</span>
@@ -206,10 +206,10 @@
   <!-- Top Threats & Active Bans -->
   <div style="display: flex; flex-direction: column; gap: 1.5rem;">
     <!-- Top Threat IPs -->
-    <div class="card">
+    <div class="card" id="top-threat-ips">
       <div class="card-header">
         <h3 class="card-title">Top Threat IPs</h3>
-        <div class="card-subtitle">Most active suspicious IPs</div>
+        <div class="card-subtitle">Most active suspicious IPs in the selected period</div>
       </div>
       <div class="card-body">
         <div style="display: flex; flex-direction: column; gap: 0.75rem;">

data/app/views/beskar/security_events/index.html.erb

@@ -2,10 +2,7 @@
 
 <% content_for :header_actions do %>
   <div style="display: flex; gap: 0.5rem;">
-    <%= link_to "Export CSV", export_security_events_path(request.query_parameters.merge(format: :csv)),
-        class: "btn btn-secondary" %>
-    <%= link_to "Export JSON", export_security_events_path(request.query_parameters.merge(format: :json)),
-        class: "btn btn-secondary" %>
+    <%= render "beskar/shared/export_form", export_url: export_security_events_path %>
   </div>
 <% end %>
 
@@ -46,12 +43,7 @@
         <div class="form-group">
           <label>Risk Level</label>
           <%= select_tag :risk_level,
-              options_for_select([
-                ['Low (0-30)', 'low'],
-                ['Medium (31-60)', 'medium'],
-                ['High (61-85)', 'high'],
-                ['Critical (86-100)', 'critical']
-              ], params[:risk_level]),
+              options_for_select(@risk_levels, params[:risk_level]),
               prompt: 'All risk levels',
               style: "width: 100%;" %>
         </div>
@@ -109,15 +101,16 @@
   </div>
 
   <div style="display: flex; align-items: center; gap: 0.5rem;">
-    <label style="margin: 0; font-size: 13px; color: #697386;">Per page:</label>
+    <label for="per_page" style="margin: 0; font-size: 13px; color: #697386;">Per page:</label>
     <%= form_with url: security_events_path, method: :get, local: true, style: "display: inline;" do |f| %>
-      <% request.query_parameters.except(:per_page).each do |key, value| %>
+      <% request.query_parameters.except("per_page", "page").each do |key, value| %>
         <%= hidden_field_tag key, value %>
       <% end %>
       <%= select_tag :per_page,
           options_for_select([10, 25, 50, 100], params[:per_page]&.to_i || 25),
-          onchange: "this.form.submit();",
+          data: { beskar_auto_submit: true },
           style: "padding: 0.25rem 0.5rem; font-size: 13px;" %>
+      <%= submit_tag "Apply page size", class: "btn btn-sm btn-secondary" %>
     <% end %>
   </div>
 </div>
@@ -132,6 +125,7 @@
             <th>ID</th>
             <th>Timestamp</th>
             <th>Event Type</th>
+            <th>Requested Path</th>
             <th>IP Address</th>
             <th>User</th>
             <th>Risk Score</th>
@@ -164,6 +158,14 @@
                     <%= event.event_type %>
                   </div>
                 </td>
+                <td data-request-path style="font-family: monospace; font-size: 12px; max-width: 300px; overflow-wrap: anywhere;">
+                  <% analysis = event.metadata["waf_analysis"] %>
+                  <% if event.event_type == "waf_violation" %>
+                    <%= analysis.is_a?(Hash) ? analysis["request_path"].presence || "Not recorded" : "Not recorded" %>
+                  <% else %>
+                    <%= event.metadata["request_path"].presence || "-" %>
+                  <% end %>
+                </td>
                 <td>
                   <div style="font-family: monospace; font-size: 13px;">
                     <%= event.ip_address %>
@@ -178,14 +180,14 @@
                 <td>
                   <% if event.user %>
                     <div style="font-size: 13px;">
-                      <%= event.user.try(:email) || "User ##{event.user_id}" %>
+                      <%= audit_user_label(event) %>
                     </div>
                     <div style="font-size: 11px; color: #697386;">
                       ID: <%= event.user_id %>
                     </div>
                   <% elsif event.attempted_email %>
                     <div style="font-size: 13px; color: #697386;">
-                      <%= event.attempted_email %>
+                      <%= audit_user_label(event) %>
                     </div>
                     <div style="font-size: 11px; color: #C1C7D0;">
                       (attempted)
@@ -230,7 +232,7 @@
             <% end %>
           <% else %>
             <tr>
-              <td colspan="8" style="text-align: center; padding: 3rem;">
+              <td colspan="9" style="text-align: center; padding: 3rem;">
                 <div style="color: #697386;">
                   <svg width="48" height="48" fill="currentColor" viewBox="0 0 24 24" style="margin: 0 auto 1rem;">
                     <path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm-2 15l-5-5 1.41-1.41L10 14.17l7.59-7.59L19 8l-9 9z"/>

data/app/views/beskar/security_events/show.html.erb

@@ -35,25 +35,11 @@
           Risk Score
         </div>
         <div style="display: flex; align-items: center; gap: 0.75rem;">
-          <span style="font-size: 24px; font-weight: 600; color: <%=
-            case @event.risk_score
-            when 0..30 then '#4CAF50'
-            when 31..60 then '#FF9800'
-            when 61..85 then '#E91E63'
-            else '#D32F2F'
-            end
-          %>;">
+          <span style="font-size: 24px; font-weight: 600; color: <%= risk_level_color(@event.risk_score) %>;">
             <%= @event.risk_score %>
           </span>
           <span class="badge badge-<%= risk_level_class(@event.risk_score) %>">
-            <%=
-              case @event.risk_score
-              when 0..30 then 'Low Risk'
-              when 31..60 then 'Medium Risk'
-              when 61..85 then 'High Risk'
-              else 'Critical'
-              end
-            %>
+            <%= risk_level_label(@event.risk_score) %>
           </span>
         </div>
       </div>
@@ -101,14 +87,14 @@
         </div>
         <% if @event.user %>
           <div style="font-size: 14px; color: #1A1F36;">
-            <%= @event.user.try(:email) || "User ##{@event.user_id}" %>
+            <%= audit_user_label(@event) %>
           </div>
           <div style="font-size: 13px; color: #697386; margin-top: 0.25rem;">
             ID: <%= @event.user_id %> • Type: <%= @event.user_type %>
           </div>
         <% elsif @event.attempted_email %>
           <div style="font-size: 14px; color: #697386;">
-            <%= @event.attempted_email %> <span style="font-size: 12px;">(attempted)</span>
+            <%= audit_user_label(@event) %> <span style="font-size: 12px;">(attempted)</span>
           </div>
         <% else %>
           <div style="color: #C1C7D0;">No user associated</div>
@@ -165,6 +151,10 @@
   </div>
 </div>
 
+<% if @event.event_type == "waf_violation" %>
+  <%= render "beskar/shared/waf_analysis", analysis: @event.metadata["waf_analysis"] %>
+<% end %>
+
 <!-- Metadata -->
 <% if @event.metadata.present? && @event.metadata.any? %>
   <div class="card">
@@ -214,9 +204,9 @@
                 </td>
                 <td>
                   <% if event.user %>
-                    <%= event.user.try(:email) || "User ##{event.user_id}" %>
+                    <%= audit_user_label(event) %>
                   <% elsif event.attempted_email %>
-                    <span style="color: #697386;"><%= event.attempted_email %></span>
+                    <span style="color: #697386;"><%= audit_user_label(event) %></span>
                   <% else %>
                     <span style="color: #C1C7D0;">-</span>
                   <% end %>

data/app/views/beskar/shared/_export_form.html.erb

@@ -0,0 +1,10 @@
+<%= form_with url: export_url, method: :get, local: true do %>
+  <% request.query_parameters.except("format", "audit_reason", "page", "per_page").each do |key, value| %>
+    <%= hidden_field_tag key, value if value.is_a?(String) %>
+  <% end %>
+  <%= label_tag :export_audit_reason, "Export reason" %>
+  <%= text_field_tag :audit_reason, nil, id: :export_audit_reason, required: true, maxlength: 1000 %>
+  <%= label_tag :export_format, "Export format" %>
+  <%= select_tag :format, options_for_select([["CSV", "csv"], ["JSON", "json"]]), id: :export_format %>
+  <%= submit_tag "Export", class: "btn btn-secondary" %>
+<% end %>

data/app/views/beskar/shared/_waf_analysis.html.erb

@@ -0,0 +1,25 @@
+<% analysis = analysis.is_a?(Hash) ? analysis : {} %>
+<div class="card" data-waf-analysis>
+  <div class="card-header">
+    <h3 class="card-title">WAF Analysis</h3>
+  </div>
+  <div class="card-body">
+    <p><strong><%= local_assigns[:banned] ? "Request that triggered the ban" : "Requested path" %></strong></p>
+    <div style="font-family: monospace; font-size: 13px; background: #F4F5F7; padding: 0.75rem; border-radius: 6px; overflow-wrap: anywhere;">
+      <% if analysis["request_path"].present? %>
+        <span><%= analysis["request_method"] %></span>
+        <span data-request-path><%= analysis["request_path"] %></span>
+      <% else %>
+        <span data-request-path>Not recorded</span>
+      <% end %>
+    </div>
+    <% if analysis["patterns"].is_a?(Array) %>
+      <ul>
+        <% analysis["patterns"].each do |pattern| %>
+          <% next unless pattern.is_a?(Hash) %>
+          <li><%= pattern["description"] %> (<%= pattern["rule_id"] %>, <%= pattern["severity"] %>)</li>
+        <% end %>
+      </ul>
+    <% end %>
+  </div>
+</div>

data/app/views/layouts/beskar/_behavior.html.erb

@@ -0,0 +1,121 @@
+<%= javascript_tag nonce: true do %>
+  (() => {
+    // One delegated installation per document, even if a host evaluates the
+    // layout again. Native navigation is the dashboard's supported boundary.
+    if (window.beskarDashboardBehaviorInstalled) return;
+    window.beskarDashboardBehaviorInstalled = true;
+
+    function isPermanent(form) {
+      return form.querySelector('[name="ban_type"]:checked')?.value === 'permanent' ||
+        form.querySelector('[name="banned_ip[permanent]"]:checked')?.value === 'true';
+    }
+
+    function updateBanForm(form) {
+      const permanent = isPermanent(form);
+      const options = form.querySelector('#temporary-options');
+      options.hidden = permanent;
+      options.querySelectorAll('input, select, button').forEach(input => { input.disabled = permanent; });
+      const expiry = form.querySelector('#banned_ip_expires_at');
+      expiry.required = !permanent && !!form.querySelector('[name="banned_ip[permanent]"]');
+      const preview = document.getElementById('ban-preview');
+      if (!preview) return;
+      const ip = form.querySelector('#banned_ip_ip_address');
+      const reason = form.querySelector('#banned_ip_reason');
+      preview.hidden = !(ip.value || reason.value);
+      document.getElementById('preview-ip').textContent = ip.value || '-';
+      document.getElementById('preview-reason').textContent = reason.selectedOptions[0]?.textContent || '-';
+      const duration = form.querySelector('[name="duration"]:checked');
+      document.getElementById('preview-duration').textContent = permanent ? 'Permanent' :
+        (expiry.value ? `${expiry.value.replace('T', ' ')} UTC` : (duration?.parentElement.textContent.trim() || '24 hours (server default)'));
+      const status = document.getElementById('preview-status');
+      status.textContent = permanent ? 'Permanent' : 'Temporary';
+      status.className = permanent ? 'badge badge-critical' : 'badge badge-danger';
+    }
+
+    function updateSelection(form) {
+      const boxes = Array.from(form.querySelectorAll('.ban-checkbox'));
+      const count = boxes.filter(box => box.checked).length;
+      form.querySelector('#selected-count').textContent = count;
+      form.querySelector('#bulk-actions-bar').hidden = count === 0;
+      const all = form.querySelector('#select-all');
+      all.checked = boxes.length > 0 && count === boxes.length;
+      all.indeterminate = count > 0 && count < boxes.length;
+    }
+
+    function initialize() {
+      if (!document.querySelector('[data-beskar-dashboard]')) return;
+      document.querySelectorAll('[data-beskar-ban-form]').forEach(updateBanForm);
+      document.querySelectorAll('#bulk-actions-form').forEach(updateSelection);
+    }
+
+    document.addEventListener('change', event => {
+      if (!event.target.closest('[data-beskar-dashboard]')) return;
+      if (event.target.matches('[data-beskar-auto-submit]')) event.target.form.requestSubmit();
+      const form = event.target.closest('[data-beskar-ban-form]');
+      if (form) {
+        const expiry = form.querySelector('#banned_ip_expires_at');
+        if (event.target.name === 'duration') expiry.value = '';
+        if (event.target.name === 'banned_ip[permanent]' && !isPermanent(form) && !expiry.value) {
+          expiry.value = new Date(Date.now() + 86400000).toISOString().slice(0, -1);
+        }
+        updateBanForm(form);
+      }
+      const bulk = event.target.closest('#bulk-actions-form');
+      if (bulk) {
+        if (event.target.id === 'select-all') {
+          bulk.querySelectorAll('.ban-checkbox').forEach(box => { box.checked = event.target.checked; });
+        }
+        updateSelection(bulk);
+      }
+    });
+
+    document.addEventListener('input', event => {
+      const form = event.target.closest('[data-beskar-ban-form]');
+      if (!form) return;
+      if (event.target.id === 'banned_ip_expires_at' && event.target.value) {
+        form.querySelectorAll('[name="duration"]').forEach(input => { input.checked = false; });
+      }
+      updateBanForm(form);
+    });
+
+    document.addEventListener('click', event => {
+      if (!event.target.closest('[data-beskar-dashboard]')) return;
+      const clear = event.target.closest('[data-beskar-clear-selection]');
+      if (clear) {
+        const form = clear.closest('form');
+        form.querySelectorAll('.ban-checkbox').forEach(box => { box.checked = false; });
+        updateSelection(form);
+      }
+      const extend = event.target.closest('[data-beskar-extend-hours]');
+      if (extend) {
+        const form = extend.closest('form');
+        const expiry = form.querySelector('#banned_ip_expires_at');
+        // The displayed wall-clock value is UTC, never browser-local time.
+        const base = expiry.value ? Date.parse(`${expiry.value}Z`) : Date.now();
+        if (Number.isFinite(base)) {
+          expiry.value = new Date(Math.max(base, Date.now()) + Number(extend.dataset.beskarExtendHours) * 3600000).toISOString().slice(0, -1);
+          updateBanForm(form);
+        }
+      }
+      const permanent = event.target.closest('[data-beskar-make-permanent]');
+      if (permanent) {
+        const form = permanent.closest('form');
+        form.querySelector('[name="banned_ip[permanent]"][value="true"]').checked = true;
+        updateBanForm(form);
+      }
+    });
+
+    document.addEventListener('submit', event => {
+      if (!event.target.closest('[data-beskar-dashboard]')) return;
+      const message = event.submitter?.dataset.beskarConfirm;
+      if (message && !window.confirm(message)) event.preventDefault();
+      // Do not synthesize forms, bypass validation, or convert duration presets
+      // to client-clock timestamps. Rails forms carry CSRF and method fields.
+    });
+
+    if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', initialize, { once: true });
+    else initialize();
+    document.addEventListener('pageshow', initialize);
+    document.addEventListener('turbo:load', initialize);
+  })();
+<% end %>

data/app/views/layouts/beskar/application.html.erb

@@ -8,7 +8,7 @@
   <%= csp_meta_tag %>
 
   <!-- Embedded Styles (No external dependencies) -->
-  <style>
+  <style nonce="<%= content_security_policy_nonce %>">
     :root {
       --primary: #635BFF;
       --primary-dark: #5243CC;
@@ -384,6 +384,7 @@
     input[type="password"],
     input[type="number"],
     input[type="date"],
+    input[type="datetime-local"],
     select,
     textarea {
       width: 100%;
@@ -492,7 +493,7 @@
 
   <%= yield :head %>
 </head>
-<body>
+<body data-beskar-dashboard data-turbo="false">
   <div class="dashboard-container">
     <!-- Sidebar -->
     <aside class="sidebar">
@@ -531,6 +532,11 @@
           <% end %>
         </div>
 
+        <div class="nav-section">
+          <%= link_to "Administrative Actions", administrative_actions_path,
+              class: "nav-link #{controller_name == 'administrative_actions' ? 'active' : ''}" %>
+        </div>
+
         <div class="nav-section">
           <div class="nav-section-title">Configuration</div>
           <% if Beskar.configuration.monitor_only? %>
@@ -581,79 +587,6 @@
     </main>
   </div>
 
-  <%= javascript_tag nonce: true do %>
-    // Add active state to current nav link
-    document.addEventListener('DOMContentLoaded', function() {
-      // Handle nav link clicks
-      document.querySelectorAll('.nav-link').forEach(link => {
-        if (link.href === window.location.href) {
-          link.classList.add('active');
-        }
-      });
-
-      // Auto-dismiss alerts after 5 seconds
-      setTimeout(() => {
-        document.querySelectorAll('.alert').forEach(alert => {
-          alert.style.transition = 'opacity 0.5s';
-          alert.style.opacity = '0';
-          setTimeout(() => alert.remove(), 500);
-        });
-      }, 5000);
-
-      // Handle data-turbo-method links (Rails UJS replacement)
-      document.addEventListener('click', function(e) {
-        const link = e.target.closest('a[data-turbo-method]');
-        if (!link) return;
-
-        e.preventDefault();
-
-        const method = link.dataset.turboMethod || link.dataset['turbo-method'];
-        const confirm = link.dataset.turboConfirm || link.dataset['turbo-confirm'];
-
-        if (confirm && !window.confirm(confirm)) {
-          return;
-        }
-
-        const form = document.createElement('form');
-        form.method = 'POST';
-        form.action = link.href;
-        form.style.display = 'none';
-
-        // Add CSRF token
-        const csrfToken = document.querySelector('meta[name="csrf-token"]').content;
-        const csrfParam = document.querySelector('meta[name="csrf-param"]').content;
-
-        if (csrfToken && csrfParam) {
-          const input = document.createElement('input');
-          input.type = 'hidden';
-          input.name = csrfParam;
-          input.value = csrfToken;
-          form.appendChild(input);
-        }
-
-        // Add method override for DELETE, PUT, PATCH
-        if (method && method.toLowerCase() !== 'post') {
-          const methodInput = document.createElement('input');
-          methodInput.type = 'hidden';
-          methodInput.name = '_method';
-          methodInput.value = method;
-          form.appendChild(methodInput);
-        }
-
-        // Add any URL parameters as form inputs
-        const url = new URL(link.href);
-        url.searchParams.forEach((value, key) => {
-          const input = document.createElement('input');
-          input.type = 'hidden';
-          input.name = key;
-          input.value = value;
-          form.appendChild(input);
-        });
-
-        document.body.appendChild(form);
-        form.submit();
-      });
-    });
-  <% end %>
+  <%= render "layouts/beskar/behavior" %>
 </body>
 </html>

data/config/routes.rb

@@ -1,43 +1,32 @@
 Beskar::Engine.routes.draw do
   # Root route - dashboard
-  root to: 'dashboard#index'
+  root to: "dashboard#index"
 
   # Dashboard
-  get 'dashboard', to: 'dashboard#index', as: :dashboard
+  get "dashboard", to: "dashboard#index", as: :dashboard
 
   # Security Events
   resources :security_events, only: [:index, :show] do
     collection do
-      get 'export'
+      get "export"
     end
   end
 
   # Banned IPs
   resources :banned_ips do
     member do
-      post 'extend'
+      post "extend"
+      get "review"
     end
 
     collection do
-      post 'bulk_action'
-      get 'export'
+      post "bulk_action"
+      get "export"
     end
   end
 
-  # API endpoints (optional, for future AJAX calls)
-  namespace :api do
-    namespace :v1 do
-      resources :security_events, only: [:index, :show] do
-        collection do
-          get 'stats'
-        end
-      end
+  resources :administrative_actions, only: [:index, :show]
 
-      resources :banned_ips, only: [:index, :show, :create, :destroy] do
-        member do
-          post 'extend'
-        end
-      end
-    end
-  end
+  # No versioned JSON API is implemented. Authenticated CSV/JSON exports live
+  # on the resources above; do not expose routes to nonexistent controllers.
 end

data/db/migrate/20251016000001_create_beskar_security_events.rb

@@ -8,7 +8,7 @@ class CreateBeskarSecurityEvents < ActiveRecord::Migration[8.0]
       t.string :ip_address
       t.string :attempted_email
       t.text :user_agent
-      t.json :metadata, default: {}
+      t.json :metadata, default: -> { "('{}')" }
       t.integer :risk_score
 
       t.timestamps
@@ -19,7 +19,7 @@ class CreateBeskarSecurityEvents < ActiveRecord::Migration[8.0]
     add_index :beskar_security_events, :attempted_email
     add_index :beskar_security_events, :created_at
     add_index :beskar_security_events, :risk_score
-    add_index :beskar_security_events, [:ip_address, :event_type, :created_at], 
-              name: 'index_security_events_on_ip_event_time'
+    add_index :beskar_security_events, [:ip_address, :event_type, :created_at],
+      name: "index_security_events_on_ip_event_time"
   end
 end