maquina-generators 0.6.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d8023146b756cacff577544a89e379d751c5f4f1e1df5fd1cb61932a514049bd
-  data.tar.gz: 1bff652af72d0e15d9dbd66e90e758b8f900200d5ae5dbd5c783157cfaa49f3a
+  metadata.gz: 3a31ee05a1ed941cc88119c5721629c3c5089081dde3e7833d1768cb9598b202
+  data.tar.gz: 5bc0462a7009085c8a752791090347501a59886cab23eb74ba7bdd5ff0ff2f08
 SHA512:
-  metadata.gz: 882a19b2e1d69f38e9acc0e73a312bb5a9750155b7521c6a2dc9597ddb93c1934c83536d5525a74916b7750a49f3bfd94543bd09dcd01a43a2aa2d8b0525d794
-  data.tar.gz: b9a6a548f3b6dbf7f6871e68588066f97bad710e2fc5a978dc9dcb32636b2448c60c86928dbc874b87cc4b3012030f94becc893049635418fb0df6e29e19b474
+  metadata.gz: 85c73f484e3ed4e09e28ec2bebf42ca13ea1dd84693b9e7abbffa0746f14aa69930d95607c0c592085ad6acd88ba2a5d81afd90e602c8265cf9122e05d86a3ef
+  data.tar.gz: bf4cec22c128729f8425b71d345a6ef166e6c9f4d18172860ef1eca3bbb894997397ce227297168f54218d6d26c87dc707dbedbd7b268594620543d22f1b6437

data/README.md

@@ -19,6 +19,8 @@ A collection of Rails generators from the Maquina umbrella. Each generator produ
 - **Migrations:** 4 migrations (accounts, users, sessions, email_verifications)
 - **Test helper:** `sign_in_as(user)` and `sign_out` for integration tests
 
+Sign-in codes are encrypted at rest with Active Record encryption and compared in constant time. The generator adds the encryption keys to `config/credentials.yml.enc` when they are missing; without a master key, run `bin/rails db:encryption:init`.
+
 #### Installation
 
 Add to your Gemfile:
@@ -55,6 +57,7 @@ All generated code lives in your app -- edit it directly:
 - **Session duration:** Edit `authentication.rb` (default: 30 days)
 - **Code expiration:** Edit controllers (default: 15 minutes)
 - **Cooldown between codes:** Edit `EmailVerification::COOLDOWN_MINUTES` (default: 15)
+- **Wrong guesses before a code locks:** Edit `EmailVerification::MAX_ATTEMPTS` (default: 5)
 - **Colors/styling:** Edit view templates (default: indigo)
 - **Email sender:** Edit `app/mailers/verification_mailer.rb`
 - **Translations:** Edit `config/locales/clave.*.yml`
@@ -322,6 +325,34 @@ Development's `:memory_store` keeps bans inside the server process, so they rese
 
 ---
 
+### CSP Reports -- Content Security Policy Violation Endpoint
+
+**CSP Reports** gives the browser somewhere to send Content Security Policy violations and shows them on the Security page. It needs `maquina:security`, whose `security` database stores them.
+
+#### What it generates
+
+- **Controller:** `CspReportsController` at `POST /csp-reports` -- an API controller with no session or CSRF that accepts both the legacy `report-uri` body and the Reporting API body, capped at 64 KB. Reported URLs lose their query and fragment, and browser-extension violations are dropped
+- **Models:** `Security::CspViolation` (30-day retention) and `Security::CspViolationReport` (the page's figures)
+- **Database:** a migration in `db/security_migrate` and the `csp_violations` table in `db/security_schema.rb`
+- **Retention:** a daily `purge_csp_violations` task in `config/recurring.yml`
+- **Security page:** a section listing the last 7 days of violations, most frequent first
+- **Policy:** points `report_uri` at the endpoint in `config/initializers/content_security_policy.rb` (no `report-to`, which switches Chrome to the batched Reporting API) and gives anonymous requests a nonce -- Rails' session-id nonce is empty without a session
+- **Rack::Attack:** takes the endpoint out of the general throttle and caps it at 100 reports per 5 minutes per IP
+
+Every step is idempotent. Anything it cannot place safely is listed after the install instead of being forced.
+
+#### Usage
+
+```bash
+rails g maquina:csp_reports
+rails g maquina:csp_reports --path /security/csp-reports   # Different endpoint path
+bin/rails db:migrate
+```
+
+Watch the Security page while the policy is report-only, then set `content_security_policy_report_only = false` to enforce it.
+
+---
+
 ### App -- Full Application Setup (Orchestrator)
 
 **App** is a meta-generator that sets up a complete Rails application in one command. Run it after `rails new myapp --css tailwind`.

data/lib/generators/maquina/clave/clave_generator.rb

@@ -1,5 +1,6 @@
 require "rails/generators"
 require "rails/generators/migration"
+require "active_support/encrypted_configuration"
 
 module Maquina
   module Generators
@@ -42,6 +43,23 @@ module Maquina
       end
 
       # 2. Controllers
+      # EmailVerification encrypts its code, which needs Active Record
+      # encryption keys. They go into the app's credentials when missing; with
+      # no master key to write them, the post-install message says what to run.
+      def configure_encryption_keys
+        credentials = app_credentials
+        if credentials.nil?
+          @encryption_pending = true
+          return
+        end
+
+        content = credentials.read
+        return if content.match?(/^active_record_encryption:/)
+
+        credentials.write(content.rstrip + (content.strip.empty? ? "" : "\n\n") + encryption_keys_yaml)
+        @encryption_written = true
+      end
+
       def create_controllers
         template "app/controllers/concerns/authentication.rb.tt",
           "app/controllers/concerns/authentication.rb"
@@ -172,6 +190,15 @@ module Maquina
           say "  4. Visit /registration/new           # Sign-up page"
         end
         say ""
+        if @encryption_written
+          say "Added Active Record encryption keys to config/credentials.yml.enc (EmailVerification encrypts its code).", :yellow
+          say ""
+        elsif @encryption_pending
+          say "EmailVerification encrypts its code. Generate keys and add them to your credentials:", :yellow
+          say "  bin/rails db:encryption:init"
+          say "  bin/rails credentials:edit"
+          say ""
+        end
         say "Optional:", :yellow
         say "  - Edit app/controllers/concerns/authentication.rb to customize redirect URLs"
         say "  - Edit config/locales/clave.*.yml to customize messages"
@@ -181,6 +208,27 @@ module Maquina
 
       private
 
+      # The app's credentials, or nil when there is no key to decrypt them with.
+      def app_credentials
+        key_path = File.join(destination_root, "config/master.key")
+        return unless File.exist?(key_path) || ENV["RAILS_MASTER_KEY"].present?
+
+        ActiveSupport::EncryptedConfiguration.new(
+          config_path: File.join(destination_root, "config/credentials.yml.enc"),
+          key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: false
+        )
+      end
+
+      # The same shape `bin/rails db:encryption:init` prints.
+      def encryption_keys_yaml
+        <<~YAML
+          active_record_encryption:
+            primary_key: #{SecureRandom.alphanumeric(32)}
+            deterministic_key: #{SecureRandom.alphanumeric(32)}
+            key_derivation_salt: #{SecureRandom.alphanumeric(32)}
+        YAML
+      end
+
       def migration_version
         "[#{Rails::VERSION::MAJOR}.#{Rails::VERSION::MINOR}]"
       end

data/lib/generators/maquina/clave/templates/app/controllers/registration/verifications_controller.rb.tt

@@ -26,7 +26,16 @@ class Registration::VerificationsController < ApplicationController
       return
     end
 
-    if @verification.code != params[:code]&.upcase&.strip
+    # Too many wrong guesses: kill the code so a fresh one is required.
+    if @verification.locked?
+      @verification.update!(expires_at: Time.current)
+      Rails.logger.warn "[AUTH] Verification locked after #{@verification.attempts} attempts for #{@email} from #{request.remote_ip}"
+      flash.now[:alert] = t("flash.registrations.code_locked")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    unless @verification.code_matches?(params[:code])
       @verification.increment!(:attempts)
       Rails.logger.warn "[AUTH] Invalid verification code attempt for #{@email} from #{request.remote_ip} (attempt #{@verification.attempts})"
       flash.now[:alert] = t("flash.registrations.invalid_code")

data/lib/generators/maquina/clave/templates/app/controllers/session/verifications_controller.rb.tt

@@ -27,7 +27,16 @@ class Session::VerificationsController < ApplicationController
       return
     end
 
-    if @verification.code != params[:code]&.upcase&.strip
+    # Too many wrong guesses: kill the code so a fresh one is required.
+    if @verification.locked?
+      @verification.update!(expires_at: Time.current)
+      Rails.logger.warn "[AUTH] Verification locked after #{@verification.attempts} attempts for #{@email} from #{request.remote_ip}"
+      flash.now[:alert] = t("flash.sessions.code_locked")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    unless @verification.code_matches?(params[:code])
       @verification.increment!(:attempts)
       Rails.logger.warn "[AUTH] Invalid verification code attempt for #{@email} from #{request.remote_ip} (attempt #{@verification.attempts})"
       flash.now[:alert] = t("flash.sessions.invalid_code")

data/lib/generators/maquina/clave/templates/app/models/email_verification.rb.tt

@@ -1,6 +1,7 @@
 class EmailVerification < ApplicationRecord
   VERIFICATION_TYPES = %w[signup login].freeze
   COOLDOWN_MINUTES = 15
+  MAX_ATTEMPTS = 5
 
   validates :email, presence: true, format: {with: URI::MailTo::EMAIL_REGEXP}
   validates :code, presence: true
@@ -10,6 +11,10 @@ class EmailVerification < ApplicationRecord
   normalizes :email, with: ->(email) { email.strip.downcase }
   normalizes :code, with: ->(code) { code.strip.upcase }
 
+  # Encrypted at rest, not digested: the mail goes out through deliver_later,
+  # whose job reloads this row by GlobalID and must read the code back.
+  encrypts :code
+
   scope :pending, -> { where(verified_at: nil) }
   scope :expired, -> { where("expires_at < ?", Time.current) }
   scope :active, -> { pending.where("expires_at >= ?", Time.current) }
@@ -20,6 +25,19 @@ class EmailVerification < ApplicationRecord
     expires_at < Time.current
   end
 
+  # A code is single-use against a bounded number of guesses: once the wrong-code
+  # count hits the ceiling the record is dead regardless of how many IPs an
+  # attacker rotates through, since each code only ever maps to one row.
+  def locked?
+    attempts >= MAX_ATTEMPTS
+  end
+
+  # Constant-time, so response timing reveals nothing about how close a guess
+  # came. Normalized the same way the stored code is.
+  def code_matches?(candidate)
+    ActiveSupport::SecurityUtils.secure_compare(code, candidate.to_s.strip.upcase)
+  end
+
   def verified?
     verified_at.present?
   end

data/lib/generators/maquina/clave/templates/config/locales/clave.en.yml

@@ -8,6 +8,7 @@ en:
       code_sent: "We sent you a verification code."
       invalid_code: "The code is incorrect. Please try again."
       code_expired: "The code has expired. Request a new one."
+      code_locked: "Too many incorrect tries. Request a new code to keep going."
       code_resent: "We sent you a new code."
       cooldown: "You must wait %{minutes} minutes before requesting another code."
       code_already_sent: "We already sent you a code. Check your email (including spam). You can request a new one in %{minutes} minutes."
@@ -19,6 +20,7 @@ en:
       email_taken: "An account with this email already exists. Would you like to sign in?"
       invalid_code: "The code is incorrect. Please try again."
       code_expired: "The code has expired. Request a new one."
+      code_locked: "Too many incorrect tries. Request a new code to keep going."
       code_resent: "We sent you a new code."
       cooldown: "You must wait %{minutes} minutes before requesting another code."
       code_already_sent: "We already sent you a code. Check your email (including spam). You can request a new one in %{minutes} minutes."

data/lib/generators/maquina/clave/templates/config/locales/clave.es.yml

@@ -8,6 +8,7 @@ es:
       code_sent: "Te enviamos un codigo de verificacion."
       invalid_code: "El codigo es incorrecto. Por favor, intenta de nuevo."
       code_expired: "El codigo ha expirado. Solicita uno nuevo."
+      code_locked: "Demasiados intentos incorrectos. Solicita un codigo nuevo para continuar."
       code_resent: "Te enviamos un nuevo codigo."
       cooldown: "Debes esperar %{minutes} minutos antes de solicitar otro codigo."
       code_already_sent: "Ya te enviamos un codigo. Revisa tu correo (incluyendo spam). Podras solicitar uno nuevo en %{minutes} minutos."
@@ -19,6 +20,7 @@ es:
       email_taken: "Ya existe una cuenta con este correo. Quieres iniciar sesion?"
       invalid_code: "El codigo es incorrecto. Por favor, intenta de nuevo."
       code_expired: "El codigo ha expirado. Solicita uno nuevo."
+      code_locked: "Demasiados intentos incorrectos. Solicita un codigo nuevo para continuar."
       code_resent: "Te enviamos un nuevo codigo."
       cooldown: "Debes esperar %{minutes} minutos antes de solicitar otro codigo."
       code_already_sent: "Ya te enviamos un codigo. Revisa tu correo (incluyendo spam). Podras solicitar uno nuevo en %{minutes} minutos."

data/lib/generators/maquina/csp_reports/USAGE

@@ -0,0 +1,18 @@
+Description:
+  Adds a Content Security Policy violation report endpoint and shows the
+  reports on the backstage Security page. Needs maquina:security, whose
+  `security` database stores them.
+
+  Installs CspReportsController (POST <path>, no session or CSRF, both report
+  formats, 64 KB cap, browser-extension noise dropped), the
+  Security::CspViolation model and its migration in db/security_migrate, the
+  csp_violations table in db/security_schema.rb, a daily purge in
+  config/recurring.yml and a section on the Security page. It points the
+  policy's report-uri at the endpoint, gives anonymous requests a nonce
+  (Rails' session-id nonce is empty without a session), exempts the endpoint
+  from the general Rack::Attack throttle and caps it on its own. Anything it
+  cannot place safely is listed after the install instead of being forced.
+
+Examples:
+  rails g maquina:csp_reports
+  rails g maquina:csp_reports --path /security/csp-reports

data/lib/generators/maquina/csp_reports/csp_reports_generator.rb

@@ -0,0 +1,231 @@
+require "rails/generators"
+require "rails/generators/migration"
+
+module Maquina
+  module Generators
+    class CspReportsGenerator < Rails::Generators::Base
+      include Rails::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+
+      THROTTLE_LIMIT = 100
+      THROTTLE_PERIOD = "5.minutes"
+      # Rails' default nonce generator, empty for a request without a session.
+      SESSION_NONCE = "->(request) { request.session.id.to_s }"
+      POLICY_BLOCK = /^  config\.content_security_policy do \|policy\|\n/
+      # The general throttle's exemptions, in the two shapes maquina:rack_attack
+      # has shipped: a start_with? list, and a STATIC_FILE_PREFIXES word array.
+      COUNTED_IP_EXEMPTIONS = /req\.path\.start_with\?\("\/assets", "\/rails\/active_storage"/
+      STATIC_FILE_PREFIXES = /(STATIC_FILE_PREFIXES = %w\[)([^\]]*)(\])/
+      SECURITY_PAGE_END = /\n<\/div>\n\z/
+
+      class_option :path, type: :string, default: "/csp-reports",
+        desc: "Path browsers post violation reports to"
+      class_option :quiet, type: :boolean, default: false,
+        desc: "Suppress post-install instructions"
+
+      def self.next_migration_number(dirname)
+        current = Time.now.utc.strftime("%Y%m%d%H%M%S")
+        existing = Dir.glob("#{dirname}/[0-9]*_*.rb").map { |f| File.basename(f).split("_", 2).first }.max
+        (existing && existing >= current) ? existing.succ : current
+      end
+
+      # 1. maquina:security owns the database the reports go in.
+      def require_security_database
+        return if File.exist?(File.join(destination_root, "db/security_schema.rb"))
+
+        raise Thor::Error, "maquina:csp_reports stores reports in the `security` database. Run `rails g maquina:security --prefix /admin` first."
+      end
+
+      # 2. Models
+      def create_models
+        copy_file "app/models/security/csp_violation.rb", "app/models/security/csp_violation.rb"
+        copy_file "app/models/security/csp_violation_report.rb", "app/models/security/csp_violation_report.rb"
+      end
+
+      # 3. Controller and route
+      def create_controller
+        copy_file "app/controllers/csp_reports_controller.rb", "app/controllers/csp_reports_controller.rb"
+        route %(post "#{options[:path]}", to: "csp_reports#create", as: :csp_reports)
+      end
+
+      # 4. The table: a migration for an existing security database, the schema
+      #    for a fresh one (db:prepare loads the schema only on create).
+      def create_table
+        return if File.read(schema_path).include?(%("csp_violations"))
+
+        migration_template "db/create_csp_violations.rb.tt", "db/security_migrate/create_csp_violations.rb"
+        version = Dir.glob(File.join(destination_root, "db/security_migrate/*_create_csp_violations.rb"))
+          .map { |f| File.basename(f).split("_", 2).first }.max
+        gsub_file "db/security_schema.rb", /define\(version: [\d_]+\)/, "define(version: #{version_with_underscores(version)})"
+        inject_into_file "db/security_schema.rb", csp_violations_table, before: /^end\s*\z/
+      end
+
+      # 5. The policy reports to the endpoint, and anonymous requests get a nonce.
+      def configure_content_security_policy
+        path = "config/initializers/content_security_policy.rb"
+        content = File.exist?(File.join(destination_root, path)) ? File.read(File.join(destination_root, path)) : ""
+
+        if content.include?("report_uri")
+          @report_uri_pending = !content.include?(%(report_uri "#{options[:path]}"))
+        elsif content.match?(POLICY_BLOCK)
+          inject_into_file path, report_uri_line, after: POLICY_BLOCK
+        else
+          @report_uri_pending = true
+        end
+
+        if content.include?(SESSION_NONCE)
+          gsub_file path, SESSION_NONCE, "->(request) { request.session.id.to_s.presence || SecureRandom.base64(16) }"
+        end
+      end
+
+      # 6. Rack::Attack: out of the general throttle, capped on its own.
+      def configure_rack_attack
+        path = "config/initializers/rack_attack.rb"
+        full_path = File.join(destination_root, path)
+        return @rack_attack_pending = true unless File.exist?(full_path)
+
+        content = File.read(full_path)
+        return if content.include?(%("csp/ip"))
+
+        if content.match?(COUNTED_IP_EXEMPTIONS)
+          # The match stops before the call's closing paren, which stays in place.
+          gsub_file path, COUNTED_IP_EXEMPTIONS, 'req.path.start_with?("/assets", "/rails/active_storage", ' + %("#{options[:path]}")
+        elsif content.match?(STATIC_FILE_PREFIXES)
+          gsub_file path, STATIC_FILE_PREFIXES, "\\1\\2 #{options[:path]}\\3"
+        else
+          @rack_attack_pending = true
+        end
+
+        append_to_file path, csp_throttle
+      end
+
+      # 7. Daily purge
+      def add_recurring_purge
+        path = File.join(destination_root, "config/recurring.yml")
+        content = File.exist?(path) ? File.read(path) : ""
+        return if content.include?("purge_csp_violations")
+
+        if content.match?(/^production:\n/)
+          inject_into_file "config/recurring.yml", recurring_entry, after: /^production:\n/
+        else
+          @recurring_pending = true
+        end
+      end
+
+      # 8. Security page section
+      def add_security_page_section
+        copy_file "app/views/backstage/security/_csp_violations.html.erb",
+          "app/views/backstage/security/_csp_violations.html.erb"
+
+        page = "app/views/backstage/security/show.html.erb"
+        full_path = File.join(destination_root, page)
+        content = File.exist?(full_path) ? File.read(full_path) : ""
+        return if content.include?("backstage/security/csp_violations")
+
+        if content.match?(SECURITY_PAGE_END)
+          inject_into_file page, security_page_section, before: SECURITY_PAGE_END
+        else
+          @page_pending = true
+        end
+      end
+
+      # 9. Post-install message
+      def show_post_install
+        return if options[:quiet]
+
+        say ""
+        say "Content Security Policy reports are set up at POST #{options[:path]}.", :green
+        say ""
+        say "Next steps:", :yellow
+        say "  - Add the table: bin/rails db:migrate (db:prepare on deploy)"
+        say "  - Watch the Security page while the policy is report-only, then set"
+        say "    content_security_policy_report_only = false to enforce it."
+        if @report_uri_pending
+          say ""
+          say "Point the policy at the endpoint in config/initializers/content_security_policy.rb:", :yellow
+          say "  #{report_uri_line.strip}"
+        end
+        if @rack_attack_pending
+          say ""
+          say "Exempt #{options[:path]} from the general throttle in config/initializers/rack_attack.rb and add:", :yellow
+          say csp_throttle
+        end
+        if @recurring_pending
+          say ""
+          say "Add to config/recurring.yml under your production (or shared) key:", :yellow
+          say recurring_entry
+        end
+        if @page_pending
+          say ""
+          say "Render the section on the Security page:", :yellow
+          say security_page_section
+        end
+        say ""
+      end
+
+      private
+
+      def schema_path = File.join(destination_root, "db/security_schema.rb")
+
+      def migration_version
+        "[#{Rails::VERSION::MAJOR}.#{Rails::VERSION::MINOR}]"
+      end
+
+      def version_with_underscores(version)
+        version.sub(/\A(\d{4})(\d{2})(\d{2})(\d{6})\z/, '\1_\2_\3_\4')
+      end
+
+      def report_uri_line
+        %(    # Violations go to CspReportsController (maquina:csp_reports). report-uri\n) +
+          %(    # alone: adding report-to switches Chrome to the batched Reporting API.\n) +
+          %(    policy.report_uri "#{options[:path]}"\n)
+      end
+
+      def csp_throttle
+        <<~RUBY
+
+          # Content Security Policy reports (maquina:csp_reports): exempt from the
+          # general throttle above — one page with a dozen violations would spend a
+          # reader's budget — and capped on their own.
+          Rack::Attack.throttle("csp/ip", limit: #{THROTTLE_LIMIT}, period: #{THROTTLE_PERIOD}) do |req|
+            (req.env["action_dispatch.remote_ip"]&.to_s || req.ip) if req.path == "#{options[:path]}" && req.post?
+          end
+        RUBY
+      end
+
+      def recurring_entry
+        <<~YAML.gsub(/^/, "  ")
+          purge_csp_violations:
+            command: "Security::CspViolation.expired.delete_all"
+            schedule: every day at 4:30am
+        YAML
+      end
+
+      def security_page_section
+        %(\n\n  <%= render "backstage/security/csp_violations", report: Security::CspViolationReport.new %>)
+      end
+
+      def csp_violations_table
+        <<~RUBY.gsub(/^(?=.)/, "  ")
+
+          create_table "csp_violations", force: :cascade do |t|
+            t.integer "column_number"
+            t.datetime "created_at", null: false
+            t.string "blocked_uri"
+            t.string "disposition"
+            t.string "document_uri"
+            t.string "effective_directive", null: false
+            t.string "ip"
+            t.integer "line_number"
+            t.string "sample"
+            t.string "source_file"
+            t.string "user_agent"
+            t.index ["created_at"], name: "index_csp_violations_on_created_at"
+            t.index ["effective_directive", "created_at"], name: "index_csp_violations_on_effective_directive_and_created_at"
+          end
+        RUBY
+      end
+    end
+  end
+end

data/lib/generators/maquina/csp_reports/templates/app/controllers/csp_reports_controller.rb

@@ -0,0 +1,24 @@
+# Receives Content Security Policy violation reports. Browsers post them with no
+# cookie and no CSRF token, in either the legacy report-uri shape
+# (application/csp-report) or the Reporting API's (application/reports+json),
+# so this is an API controller that reads the raw body itself.
+#
+# Always 204 for a report it could read — a browser does nothing with the
+# answer — and best effort: a locked security database must never turn a
+# report into a 500 that the browser retries.
+class CspReportsController < ActionController::API
+  MAX_BYTES = 64.kilobytes
+
+  def create
+    body = request.body.read(MAX_BYTES + 1).to_s
+    return head 413 if body.bytesize > MAX_BYTES
+
+    Security::CspViolation.record_report!(body, ip: request.remote_ip, user_agent: request.user_agent)
+    head :no_content
+  rescue JSON::ParserError
+    head :bad_request
+  rescue => error
+    Rails.logger.error "[CSP] report not recorded: #{error.class}: #{error.message}"
+    head :no_content
+  end
+end

data/lib/generators/maquina/csp_reports/templates/app/models/security/csp_violation.rb

@@ -0,0 +1,89 @@
+# One Content Security Policy violation a browser reported to CspReportsController.
+# Rows are written once and never updated; they are what tells you whether the
+# policy is ready to enforce (report-only) or what it is breaking (enforced).
+#
+# Browsers send two shapes. The legacy `report-uri` one is a single object,
+# `{"csp-report": {"blocked-uri": ..., ...}}` (Content-Type application/csp-report);
+# the Reporting API one is an array of `{"type": "csp-violation", "body": {...}}`
+# (application/reports+json) with camelCase keys. Both normalize to the same row.
+class Security::CspViolation < Security::Record
+  RETENTION = 30.days
+
+  # Violations caused by the reader's own browser extensions say nothing about
+  # the app, and they are most of the volume.
+  NOISE_SCHEMES = %w[chrome-extension moz-extension safari-extension safari-web-extension ms-browser-extension].freeze
+
+  FIELD_LIMIT = 1024
+  SAMPLE_LIMIT = 256
+
+  LEGACY_KEYS = {
+    "document-uri" => :document_uri, "blocked-uri" => :blocked_uri,
+    "effective-directive" => :effective_directive, "violated-directive" => :effective_directive,
+    "disposition" => :disposition, "source-file" => :source_file,
+    "line-number" => :line_number, "column-number" => :column_number, "script-sample" => :sample
+  }.freeze
+
+  REPORTING_API_KEYS = {
+    "documentURL" => :document_uri, "blockedURL" => :blocked_uri,
+    "effectiveDirective" => :effective_directive, "disposition" => :disposition,
+    "sourceFile" => :source_file, "lineNumber" => :line_number,
+    "columnNumber" => :column_number, "sample" => :sample
+  }.freeze
+
+  validates :effective_directive, presence: true
+
+  scope :recent, -> { order(created_at: :desc, id: :desc) }
+  scope :within, ->(window) { where(created_at: window.ago..) }
+  scope :expired, -> { where(created_at: ...RETENTION.ago) }
+
+  # Records every violation in a raw report body; returns how many were kept.
+  # Raises JSON::ParserError on a body that isn't JSON.
+  def self.record_report!(raw, ip:, user_agent:)
+    violations = parse(raw).reject { |attrs| noise?(attrs) }
+    violations.each do |attrs|
+      create!(attrs.merge(ip:, user_agent: user_agent&.truncate(FIELD_LIMIT, omission: "")))
+    end
+    violations.size
+  end
+
+  def self.parse(raw)
+    payload = JSON.parse(raw)
+    reports = payload.is_a?(Array) ? payload : [payload]
+
+    reports.filter_map do |report|
+      next unless report.is_a?(Hash)
+
+      if report.key?("csp-report")
+        normalize(report["csp-report"], LEGACY_KEYS)
+      elsif report["type"] == "csp-violation"
+        normalize(report["body"], REPORTING_API_KEYS)
+      end
+    end
+  end
+
+  def self.noise?(attrs)
+    [attrs[:blocked_uri], attrs[:source_file]].compact.any? do |uri|
+      NOISE_SCHEMES.any? { |scheme| uri.start_with?("#{scheme}:") }
+    end
+  end
+
+  def self.normalize(body, keys)
+    return unless body.is_a?(Hash)
+
+    attrs = keys.each_with_object({}) do |(key, attribute), acc|
+      acc[attribute] ||= body[key] if body.key?(key)
+    end
+    # The directive alone (`script-src`), not the whole violated policy line.
+    attrs[:effective_directive] = attrs[:effective_directive].to_s.split.first
+    # URLs lose their query and fragment: a reported URL can carry a token.
+    %i[document_uri blocked_uri source_file].each { |key| attrs[key] = strip_url(attrs[key]) }
+    attrs[:sample] = attrs[:sample]&.to_s&.truncate(SAMPLE_LIMIT, omission: "")
+    %i[line_number column_number].each { |key| attrs[key] = attrs[key]&.to_i }
+    attrs.transform_values { |value| value.is_a?(String) ? value.truncate(FIELD_LIMIT, omission: "") : value }
+  end
+
+  def self.strip_url(value)
+    value&.to_s&.split(/[?#]/, 2)&.first
+  end
+  private_class_method :normalize, :strip_url
+end

data/lib/generators/maquina/csp_reports/templates/app/models/security/csp_violation_report.rb

@@ -0,0 +1,30 @@
+# What the Security page shows about Content Security Policy: the last `window`
+# of reported violations, grouped by what was blocked, where and why.
+class Security::CspViolationReport
+  Group = Data.define(:effective_directive, :blocked_uri, :document_uri, :count, :last_seen)
+
+  attr_reader :window, :limit
+
+  def initialize(window: 7.days, limit: 10)
+    @window = window
+    @limit = limit
+  end
+
+  def violations = Security::CspViolation.within(window)
+
+  def empty? = violations.none?
+
+  def total = violations.count
+
+  # The same blocked resource on the same page under the same directive, most
+  # frequent first — one row per thing to fix, however many readers hit it.
+  def top
+    violations.group(:effective_directive, :blocked_uri, :document_uri)
+      .order(Arel.sql("COUNT(*) DESC, MAX(created_at) DESC")).limit(limit)
+      .pluck(:effective_directive, :blocked_uri, :document_uri, Arel.sql("COUNT(*)"), Arel.sql("MAX(created_at)"))
+      .map do |directive, blocked, document, count, last|
+        Group.new(effective_directive: directive, blocked_uri: blocked, document_uri: document,
+          count:, last_seen: last.is_a?(String) ? ActiveSupport::TimeZone["UTC"].parse(last) : last)
+      end
+  end
+end