maquina-generators 0.4.1 → 0.6.0

data/lib/generators/maquina/mission_control_jobs/templates/app/views/backstage_dashboard/index.html.erb.tt

@@ -0,0 +1,93 @@
+<div class="py-8">
+  <!-- Header -->
+  <div class="mb-6 flex items-end justify-between border-b border-border pb-4">
+    <h1 class="text-2xl font-bold text-foreground">Overview</h1>
+    <%% if @generated_at %>
+      <p class="font-mono text-[11px] tabular-nums text-muted-foreground">as of <%%= @generated_at.strftime("%H:%M %Z") %></p>
+    <%% end %>
+  </div>
+
+  <!-- Metrics: populate @metrics in BackstageDashboardController#index. Aggregate-only. -->
+  <%% if @metrics.present? %>
+    <div class="grid grid-cols-2 gap-4 lg:grid-cols-4">
+      <%% @metrics.each do |metric| %>
+        <%%= render "components/card" do %>
+          <div class="px-5 py-4">
+            <div class="mb-2 flex items-center gap-1.5 text-[11px] font-semibold uppercase tracking-wider text-muted-foreground">
+              <%% if metric[:icon] %><%%= icon_for(metric[:icon], class: "size-3.5") %><%% end %>
+              <%%= metric[:label] %>
+            </div>
+            <div class="font-display text-4xl font-semibold tabular-nums text-foreground">
+              <%%= number_with_delimiter(metric[:value]) %><%% if metric[:total] %><span class="text-xl text-muted-foreground">/<%%= number_with_delimiter(metric[:total]) %></span><%% end %>
+            </div>
+            <%% if metric[:hint] %>
+              <div class="mt-1 text-[11px] tabular-nums text-muted-foreground"><%%= metric[:hint] %></div>
+            <%% end %>
+          </div>
+        <%% end %>
+      <%% end %>
+    </div>
+  <%% else %>
+    <%%= empty_state(
+      title: "No metrics yet",
+      description: "Add aggregate counts in BackstageDashboardController#index to populate this overview.",
+      icon: :layout_dashboard,
+      size: :default
+    ) %>
+  <%% end %>
+
+  <!-- Operations: entry points to the installed engines -->
+  <h2 class="mt-10 mb-3 text-[11px] font-semibold uppercase tracking-wider text-muted-foreground">Operations</h2>
+  <div class="grid grid-cols-1 gap-4 sm:grid-cols-2">
+    <%% if defined?(SolidErrors::Engine) %>
+      <%%= link_to "<%= options[:prefix] %>/errors", class: "group block" do %>
+        <%%= render "components/card", css_classes: "transition-shadow hover:shadow-md" do %>
+          <div class="flex items-center gap-4 px-5 py-4">
+            <span class="inline-flex size-10 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground">
+              <%%= icon_for(:triangle_alert, class: "size-5") %>
+            </span>
+            <div class="min-w-0 flex-1">
+              <div class="font-semibold text-foreground">Errors</div>
+              <div class="text-sm text-muted-foreground">Exceptions, backtraces, and resolution</div>
+            </div>
+            <%%= icon_for(:arrow_right, class: "size-4 text-muted-foreground transition-transform group-hover:translate-x-0.5") %>
+          </div>
+        <%% end %>
+      <%% end %>
+    <%% end %>
+
+    <%% if defined?(MissionControl::Jobs::Engine) %>
+      <%%= link_to "<%= options[:prefix] %>/jobs", class: "group block" do %>
+        <%%= render "components/card", css_classes: "transition-shadow hover:shadow-md" do %>
+          <div class="flex items-center gap-4 px-5 py-4">
+            <span class="inline-flex size-10 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground">
+              <%%= icon_for(:inbox, class: "size-5") %>
+            </span>
+            <div class="min-w-0 flex-1">
+              <div class="font-semibold text-foreground">Background jobs</div>
+              <div class="text-sm text-muted-foreground">Queues, workers, and recurring tasks</div>
+            </div>
+            <%%= icon_for(:arrow_right, class: "size-4 text-muted-foreground transition-transform group-hover:translate-x-0.5") %>
+          </div>
+        <%% end %>
+      <%% end %>
+    <%% end %>
+
+    <%% if defined?(Security::AbuseEvent) %>
+      <%%= link_to "<%= options[:prefix] %>/security", class: "group block" do %>
+        <%%= render "components/card", css_classes: "transition-shadow hover:shadow-md" do %>
+          <div class="flex items-center gap-4 px-5 py-4">
+            <span class="inline-flex size-10 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground">
+              <%%= icon_for(:slash, class: "size-5") %>
+            </span>
+            <div class="min-w-0 flex-1">
+              <div class="font-semibold text-foreground">Security</div>
+              <div class="text-sm text-muted-foreground">Throttled, blocked, and banned requests</div>
+            </div>
+            <%%= icon_for(:arrow_right, class: "size-4 text-muted-foreground transition-transform group-hover:translate-x-0.5") %>
+          </div>
+        <%% end %>
+      <%% end %>
+    <%% end %>
+  </div>
+</div>

data/lib/generators/maquina/mission_control_jobs/templates/app/views/layouts/_admin_navigation.html.erb.tt

@@ -4,17 +4,29 @@
       <div class="flex items-center gap-6">
         <span class="text-sm font-semibold text-foreground">Admin</span>
         <div class="-mb-px flex items-center space-x-4">
-          <%%= link_to "<%= options[:prefix] %>/solid_errors",
-              class: "inline-flex items-center gap-1.5 whitespace-nowrap px-1 py-3 text-sm font-medium #{request.path.start_with?('<%= options[:prefix] %>/solid_errors') ? 'border-b-2 border-primary text-primary' : 'text-muted-foreground hover:text-foreground'}" do %>
-            <%%= icon_for(:alert_triangle, class: "size-4") %>
+          <%%= link_to "<%= options[:prefix] %>",
+              class: "inline-flex items-center gap-1.5 whitespace-nowrap px-1 py-3 text-sm font-medium #{request.path == '<%= options[:prefix] %>' ? 'border-b-2 border-primary text-primary' : 'text-muted-foreground hover:text-foreground'}" do %>
+            <%%= icon_for(:layout_dashboard, class: "size-4") %>
+            <span>Overview</span>
+          <%% end %>
+
+          <%%= link_to "<%= options[:prefix] %>/errors",
+              class: "inline-flex items-center gap-1.5 whitespace-nowrap px-1 py-3 text-sm font-medium #{request.path.start_with?('<%= options[:prefix] %>/errors') ? 'border-b-2 border-primary text-primary' : 'text-muted-foreground hover:text-foreground'}" do %>
+            <%%= icon_for(:triangle_alert, class: "size-4") %>
             <span>Errors</span>
           <%% end %>
 
-          <%%= link_to "<%= options[:prefix] %>/mission_control_jobs",
-              class: "inline-flex items-center gap-1.5 whitespace-nowrap px-1 py-3 text-sm font-medium #{request.path.start_with?('<%= options[:prefix] %>/mission_control_jobs') ? 'border-b-2 border-primary text-primary' : 'text-muted-foreground hover:text-foreground'}" do %>
-            <%%= icon_for(:briefcase, class: "size-4") %>
+          <%%= link_to "<%= options[:prefix] %>/jobs",
+              class: "inline-flex items-center gap-1.5 whitespace-nowrap px-1 py-3 text-sm font-medium #{request.path.start_with?('<%= options[:prefix] %>/jobs') ? 'border-b-2 border-primary text-primary' : 'text-muted-foreground hover:text-foreground'}" do %>
+            <%%= icon_for(:inbox, class: "size-4") %>
             <span>Jobs</span>
           <%% end %>
+
+          <%%= link_to "<%= options[:prefix] %>/security",
+              class: "inline-flex items-center gap-1.5 whitespace-nowrap px-1 py-3 text-sm font-medium #{request.path.start_with?('<%= options[:prefix] %>/security') ? 'border-b-2 border-primary text-primary' : 'text-muted-foreground hover:text-foreground'}" do %>
+            <%%= icon_for(:slash, class: "size-4") %>
+            <span>Security</span>
+          <%% end %>
         </div>
       </div>
 

data/lib/generators/maquina/mission_control_jobs/templates/app/views/layouts/admin.html.erb

@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Admin</title>
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <%= csrf_meta_tags %>
+    <%= csp_meta_tag %>
+    <%= stylesheet_link_tag "tailwind", "data-turbo-track": "reload" %>
+    <%= javascript_importmap_tags %>
+    <%= yield :head %>
+    <%= turbo_refreshes_with method: :morph, scroll: :preserve %>
+  </head>
+  <body class="min-h-screen bg-background text-foreground">
+    <%= render "layouts/admin_navigation" %>
+    <main class="pt-4 pb-8">
+      <div class="mx-auto max-w-7xl px-4 sm:px-6 lg:px-8">
+        <%= yield %>
+      </div>
+    </main>
+  </body>
+</html>

data/lib/generators/maquina/mission_control_jobs/templates/app/views/mission_control/jobs/jobs/_general_information.html.erb

@@ -7,7 +7,7 @@
     <div class="space-y-4">
       <div>
         <span class="text-sm text-muted-foreground">Arguments</span>
-        <div class="mt-1 text-sm font-mono text-foreground break-words"><%= job_arguments(job) %></div>
+        <div class="mt-1 text-sm font-mono text-foreground break-words overflow-wrap-anywhere"><%= job_arguments(job) %></div>
       </div>
 
       <div>

data/lib/generators/maquina/mission_control_jobs/templates/app/views/mission_control/jobs/jobs/failed/_job.html.erb

@@ -1,7 +1,7 @@
 <%= render "components/table/cell" do %>
-  <div>
+  <div class="min-w-0">
     <%= link_to failed_job_error(job), application_job_path(@application, job.job_id, anchor: "error"),
-        class: "text-sm text-foreground hover:text-primary transition-colors" %>
+        class: "block text-sm text-foreground hover:text-primary transition-colors break-words overflow-wrap-anywhere line-clamp-2" %>
     <div class="text-xs text-muted-foreground mt-1"><%= time_distance_in_words_with_title(job.failed_at) %> ago</div>
   </div>
 <% end %>

data/lib/generators/maquina/mission_control_jobs/templates/app/views/mission_control/jobs/shared/_job.html.erb

@@ -12,7 +12,7 @@
   <% end %>
   <%= render "components/table/cell" do %>
     <% if job.serialized_arguments.present? %>
-      <span class="text-xs font-mono text-muted-foreground"><%= job_arguments(job) %></span>
+      <span class="block min-w-0 text-xs font-mono text-muted-foreground break-words overflow-wrap-anywhere line-clamp-2"><%= job_arguments(job) %></span>
     <% end %>
   <% end %>
   <%= render "components/table/cell" do %>

data/lib/generators/maquina/rack_attack/USAGE

@@ -3,13 +3,15 @@ Description:
   vulnerability scans and throttle abusive requests.
 
   Default protections:
-    - Blocks PHP file requests (*.php)
-    - Blocks WordPress paths (wp-admin, wp-login, wp-content, etc.)
-    - Blocks sensitive file access (.env, .git, /etc/passwd, etc.)
-    - Blocks common scanner targets (phpmyadmin, cgi-bin, etc.)
+    - Bans an IP for 7 days after 3 scanner paths in 10 minutes: PHP files,
+      WordPress paths, sensitive files (.env, .git, /etc/passwd), backup
+      archives (.zip, .sql, .tar.gz) and common scanner targets
+    - Bans an IP for 1 day after 600 requests in 5 minutes
+    - Throttles general requests (300/5min per IP; assets and Active Storage exempt)
+    - Throttles login attempts (5/20s per IP on POST --login-path)
     - Safelists localhost
-    - Throttles general requests (300/5min per IP)
-    - Throttles login attempts (5/20s per IP)
+    - Logs every refusal as an [ATTACK] line
 
 Examples:
   rails g maquina:rack_attack
+  rails g maquina:rack_attack --login-path /sign_in

data/lib/generators/maquina/rack_attack/rack_attack_generator.rb

@@ -5,6 +5,8 @@ module Maquina
     class RackAttackGenerator < Rails::Generators::Base
       source_root File.expand_path("templates", __dir__)
 
+      class_option :login_path, type: :string, default: "/session",
+        desc: "Path whose POSTs the login throttle counts"
       class_option :quiet, type: :boolean, default: false,
         desc: "Suppress post-install instructions"
 
@@ -42,9 +44,11 @@ module Maquina
         say "Rack::Attack has been installed!", :green
         say ""
         say "Default protections enabled:", :yellow
-        say "  - Blocklist: PHP files, WordPress paths, sensitive files, scanner targets"
+        say "  - Scanner ban: 3 scanner paths (PHP, WordPress, dotfiles, backup archives) in 10 min bans the IP for 7 days"
+        say "  - Flood ban: 600 requests in 5 min bans the IP for 1 day"
+        say "  - Throttle: 300 req/5min per IP, 5 POST #{options[:login_path]}/20s per IP"
         say "  - Safelist: localhost (127.0.0.1, ::1)"
-        say "  - Throttle: 300 req/5min per IP, 5 login attempts/20s per IP"
+        say "  - Every refusal logged as an [ATTACK] line"
         say ""
         say "Customize rules in config/initializers/rack_attack.rb"
         say ""

data/lib/generators/maquina/rack_attack/templates/config/initializers/rack_attack.rb.tt

@@ -2,6 +2,12 @@
 
 # Rack::Attack configuration
 # https://github.com/rack/rack-attack
+#
+# Coarse scanner-blocking only; per-action throttling belongs in controllers
+# via `rate_limit`. Counters and bans live in Rails.cache (Solid Cache in
+# production), so `SolidCache::Entry.where("key LIKE '%rack::attack%'")` is
+# the forensic record — the middleware answers before Rails, so nothing here
+# reaches the request log except through the subscriber at the bottom.
 
 # Safelist localhost
 Rack::Attack.safelist("allow-localhost") do |req|
@@ -9,66 +15,124 @@ Rack::Attack.safelist("allow-localhost") do |req|
 end
 
 # ---------------------------------------------------------------------------
-# Blocklists — common vulnerability scanner paths
+# Blocklist — common vulnerability scanner paths, with a ban
 # ---------------------------------------------------------------------------
+#
+# A scanner sprays hundreds of guesses in a couple of minutes (a thousand
+# WordPress REST probes in under five minutes from one address is ordinary).
+# Refusing the matching path alone lets every other guess through to routing
+# until the general throttle catches up, so the third scanner path bans the IP
+# for a week — long enough to outlast a rented scanner host, short enough that
+# a reassigned cloud address is not refused for the next tenant.
+#
+# Backup-archive guesses count as scanner paths too (`/<word>.zip` by the
+# hundred in a few seconds). Files the app really serves live under
+# /rails/active_storage, so that prefix is exempt.
 
-# Block PHP file requests
-Rack::Attack.blocklist("block-php") do |req|
-  req.path.match?(/\.php\d?$/i)
-end
+class Rack::Attack
+  # PHP file requests
+  PHP_PATH = /\.php\d?$/i
+
+  # Backup and dump guesses (`/backup.zip`, `/db.sql.gz`, `/site.tar.gz`)
+  ARCHIVE_PATH = /\.(zip|rar|7z|tar|tgz|gz|bz2|xz|sql|bak|backup|old)$/i
+
+  # WordPress paths
+  WORDPRESS_PATHS = %w[
+    /wp-admin
+    /wp-login
+    /wp-content
+    /wp-includes
+    /wp-json
+    /xmlrpc.php
+    /wp-config
+    /wp-cron
+  ].freeze
+
+  # Sensitive file access — anywhere in the path, since scanners probe them behind
+  # prefixes too (`/@fs/.env`, `/wp/.git/config`)
+  SENSITIVE_PATTERNS = %w[
+    /.env
+    /.git
+    /.htaccess
+    /.htpasswd
+    /.aws
+    /.ssh
+    /.svn
+  ].freeze
+
+  # Common scanner targets
+  SCANNER_PATHS = %w[
+    /cgi-bin
+    /phpmyadmin
+    /pma
+    /myadmin
+    /phpinfo
+    /mysqladmin
+    /admin/config.php
+    /solr/
+    /actuator
+    /telescope/requests
+    /debug
+    /_ignition
+    /vendor/phpunit
+  ].freeze
+
+  # The scanner ban's three knobs.
+  SCANNER_MAXRETRY = 3
+  SCANNER_FINDTIME = 10.minutes
+  SCANNER_BANTIME = 7.days
+
+  # An address still sending at twice the general throttle's limit has ignored
+  # every 429 since it hit the limit: banned for a day. A day rather than the
+  # scanner's week because a shared address (office, carrier NAT) can land here.
+  GENERAL_LIMIT = 300
+  GENERAL_PERIOD = 5.minutes
+  FLOOD_MAXRETRY = GENERAL_LIMIT * 2
+  FLOOD_BANTIME = 1.day
+
+  # Sign-in throttle.
+  LOGIN_PATH = "<%= options[:login_path] %>"
+  LOGIN_LIMIT = 5
+  LOGIN_PERIOD = 20.seconds
+
+  def self.scanner_path?(path)
+    path = path.downcase.squeeze("/")
+    return false if path.start_with?("/rails/active_storage")
 
-# Block WordPress paths
-WORDPRESS_PATHS = %w[
-  /wp-admin
-  /wp-login
-  /wp-content
-  /wp-includes
-  /xmlrpc.php
-  /wp-config
-  /wp-cron
-].freeze
-
-Rack::Attack.blocklist("block-wordpress") do |req|
-  WORDPRESS_PATHS.any? { |path| req.path.downcase.start_with?(path) }
+    path.match?(PHP_PATH) ||
+      path.match?(ARCHIVE_PATH) ||
+      WORDPRESS_PATHS.any? { |prefix| path.start_with?(prefix) } ||
+      SENSITIVE_PATTERNS.any? { |dotfile| path.include?(dotfile) } ||
+      path.include?("/etc/passwd") ||
+      path.include?("/etc/shadow") ||
+      SCANNER_PATHS.any? { |prefix| path.start_with?(prefix) }
+  end
+
+  # What the general throttle and the flood ban count: every request but
+  # assets and Active Storage, by IP.
+  def self.counted_ip(req)
+    req.ip unless req.path.start_with?("/assets", "/rails/active_storage")
+  end
+
+  def self.banned?(ip)
+    Fail2Ban.banned?("scanner:#{ip}") || Allow2Ban.banned?("flood:#{ip}")
+  end
 end
 
-# Block sensitive file access
-SENSITIVE_PATTERNS = %w[
-  /.env
-  /.git
-  /.htaccess
-  /.htpasswd
-  /.aws
-  /.ssh
-  /.svn
-].freeze
-
-Rack::Attack.blocklist("block-sensitive-files") do |req|
-  path = req.path.downcase
-  SENSITIVE_PATTERNS.any? { |pattern| path.start_with?(pattern) } ||
-    path.include?("/etc/passwd") ||
-    path.include?("/etc/shadow")
+Rack::Attack.blocklist("fail2ban/scanners") do |req|
+  Rack::Attack::Fail2Ban.filter("scanner:#{req.ip}",
+    maxretry: Rack::Attack::SCANNER_MAXRETRY, findtime: Rack::Attack::SCANNER_FINDTIME, bantime: Rack::Attack::SCANNER_BANTIME) do
+    Rack::Attack.scanner_path?(req.path)
+  end
 end
 
-# Block common scanner targets
-SCANNER_PATHS = %w[
-  /cgi-bin
-  /phpmyadmin
-  /pma
-  /myadmin
-  /phpinfo
-  /mysqladmin
-  /admin/config.php
-  /solr/
-  /actuator
-  /telescope/requests
-  /debug
-  /_ignition
-  /vendor/phpunit
-].freeze
-
-Rack::Attack.blocklist("block-scanner-targets") do |req|
-  SCANNER_PATHS.any? { |path| req.path.downcase.start_with?(path) }
+# Blocklists run before throttles, so this counts the requests the throttle
+# goes on to refuse as well.
+Rack::Attack.blocklist("allow2ban/flood") do |req|
+  if (ip = Rack::Attack.counted_ip(req))
+    Rack::Attack::Allow2Ban.filter("flood:#{ip}",
+      maxretry: Rack::Attack::FLOOD_MAXRETRY, findtime: Rack::Attack::GENERAL_PERIOD, bantime: Rack::Attack::FLOOD_BANTIME) { true }
+  end
 end
 
 # ---------------------------------------------------------------------------
@@ -76,13 +140,17 @@ end
 # ---------------------------------------------------------------------------
 
 # General rate limit: 300 requests per 5 minutes per IP
-Rack::Attack.throttle("req/ip", limit: 300, period: 5.minutes) do |req|
-  req.ip unless req.path.start_with?("/assets")
+#
+# Active Storage is exempt alongside /assets. A page of proxied images is dozens
+# of requests, and a refusal there renders as a broken image. Every one of those
+# requests is already gated by an unguessable signed id.
+Rack::Attack.throttle("req/ip", limit: Rack::Attack::GENERAL_LIMIT, period: Rack::Attack::GENERAL_PERIOD) do |req|
+  Rack::Attack.counted_ip(req)
 end
 
 # Login throttle: 5 attempts per 20 seconds per IP
-Rack::Attack.throttle("login/ip", limit: 5, period: 20.seconds) do |req|
-  req.ip if req.path == "/session" && req.post?
+Rack::Attack.throttle("login/ip", limit: Rack::Attack::LOGIN_LIMIT, period: Rack::Attack::LOGIN_PERIOD) do |req|
+  req.ip if req.path == Rack::Attack::LOGIN_PATH && req.post?
 end
 
 # ---------------------------------------------------------------------------
@@ -93,3 +161,17 @@ end
 Rack::Attack.blocklisted_responder = lambda do |_request|
   [403, {"content-type" => "text/plain"}, ["Forbidden\n"]]
 end
+
+# ---------------------------------------------------------------------------
+# Logging
+# ---------------------------------------------------------------------------
+
+# Every refused request is logged with its IP — the only trace it leaves in the
+# app's log. Safelist matches stay silent.
+ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, payload|
+  req = payload[:request]
+  match_type = req.env["rack.attack.match_type"]
+  next unless %i[blocklist throttle].include?(match_type)
+
+  Rails.logger.warn "[ATTACK] #{match_type} #{req.env["rack.attack.matched"]} #{req.ip} #{req.request_method} #{req.path}"
+end

data/lib/generators/maquina/security/USAGE

@@ -0,0 +1,15 @@
+Description:
+  Records every Rack::Attack refusal as a Security::AbuseEvent in its own
+  `security` database and shows the last week on a backstage page.
+
+  Installs the maquina:rack_attack rules unless the initializer already
+  defines Rack::Attack.banned?, plus the recording subscriber, models,
+  db/security_schema.rb, the `security` database entries, a daily purge in
+  config/recurring.yml, and the controller, layout, views, route and admin
+  navigation tab. The page is behind the backstage Basic Auth and answers
+  503 until credentials are set.
+
+Examples:
+  rails g maquina:security --prefix /admin
+  rails g maquina:security --prefix /admin --login-path /sign_in
+  rails g maquina:security --prefix /admin --no-copy-views