parry 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8cc12161a95a47d2f1c7fbc380e3ce403ed222c52db5aaadfaa888727018434d
-  data.tar.gz: 167cfa0213772b36b2b120a48b12940bfb6ab5a7489dc9a88ee34399cee181ea
+  metadata.gz: e471289a3e66fdd541918f0a5891c24062af5609ca7fd958d75b4927660ba679
+  data.tar.gz: e9545bd991b262a57de839c253cc594ecca37ad886fd9a2fcc2e35b5aa0ee5d7
 SHA512:
-  metadata.gz: 4712d4f7e07147d8c42055b3c90876a2138b10a51c5625f4e36a5bfc4aadb917371b83ddd34b04fea4e1c011159900532851c1dcf3939d829cadc657fb867846
-  data.tar.gz: 4be6faf2aeacf909ee4ba20603f7e7b18660e23aa0d39dffe0c1bf564f412ac0c0fdc551115bc17b24db8a44fac3facec7379d12dc1a51d32b922efb6216254d
+  metadata.gz: 135b9c7801d8e82bdced96eb1a578f5e60fc7ee256aaac6f6eb5dfe2a4274c3419a4073fa6585ff5342a224041cd8db339653c7321ea715ca526c0f018326aa6
+  data.tar.gz: 194b02b4a325cbdc86f2cc536a0d09359e2ced883787625992b7d49a15fd10b4a78a71fa782510e386ed85d63fd9fb7f82102c804a919cd5e70a1b74d7d81525

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 ## [Unreleased]
 
-## [0.1.0] - 2026-07-13
+## [0.2.0] - 2026-10-16
 
-- Initial release
+- Paginate the blocked hosts page, 50 at a time.
+
+- Export and import rules as JSON, from the GUI or through `Parry::RuleTransfer`.
+
+## [0.1.0] - 2026-08-20
+
+- Initial release: a mountable Rails engine with a GUI for Rack::Attack.
+  Manage honeypot, blocklist, safelist and throttle rules stored in Redis, see the hosts that were blocked,
+  throttled or caught, and unblock them. Honeypots match their path by prefix or by regular expression.

data/README.md

@@ -1,43 +1,345 @@
 # Parry
 
-TODO: Delete this and the text below, and describe your gem
+Parry is a mountable Rails engine that puts a GUI in front of [Rack::Attack](https://github.com/rack/rack-attack).
 
-Welcome to your new gem! In this directory, you'll find the files you need to be able to package up your Ruby library into a gem. Put your Ruby code in the file `lib/parry`. To experiment with that code, run `bin/console` for an interactive prompt.
+Rack::Attack rules normally live in an initializer, so changing them means a deploy. Parry keeps its rules in
+Redis instead and applies them to every application process as soon as you save them:
+
+- manage **blocklists**, **safelists**, **throttles** and **honeypots** from a web page
+- see the hosts that were **blocked or throttled**, with hit counts and the rule they matched
+- **unblock** a host: the blocklist rules covering it are deleted and its throttle counters are reset
+
+Parry has no opinion about authentication - mount it behind whatever your application already uses.
 
 ## Installation
 
-TODO: Replace `UPDATE_WITH_YOUR_GEM_NAME_IMMEDIATELY_AFTER_RELEASE_TO_RUBYGEMS_ORG` with your gem name right after releasing it to RubyGems.org. Please do not do it earlier due to security reasons. Alternatively, replace this section with instructions to install your gem from git if you don't plan to release to RubyGems.org.
+```ruby
+# Gemfile
+gem "parry"
+```
+
+Parry depends on `rack-attack` and `redis`. Make sure Rack::Attack itself is set up in your application:
+
+```ruby
+# config/application.rb
+config.middleware.use Rack::Attack
+```
+
+```ruby
+# config/initializers/rack_attack.rb
+# Rack::Attack needs a shared, incrementable cache store. Redis is a good fit.
+Rack::Attack.cache.store = ActiveSupport::Cache::RedisCacheStore.new(url: ENV["REDIS_URL"])
+```
+
+Then mount the engine:
+
+```ruby
+# config/routes.rb
+mount Parry::Engine => "/parry"
+```
+
+## Authentication
+
+The engine is deliberately unauthenticated, so restrict it when you mount it. With Devise:
+
+```ruby
+authenticate :user, ->(user) { user.admin? } do
+  mount Parry::Engine => "/parry"
+end
+```
+
+With HTTP basic auth:
+
+```ruby
+Parry::Engine.middleware.use(Rack::Auth::Basic) do |username, password|
+  ActiveSupport::SecurityUtils.secure_compare(username, ENV.fetch("PARRY_USER")) &
+    ActiveSupport::SecurityUtils.secure_compare(password, ENV.fetch("PARRY_PASSWORD"))
+end
+
+mount Parry::Engine => "/parry"
+```
+
+Or with a route constraint:
+
+```ruby
+constraints ->(request) { request.session[:admin] } do
+  mount Parry::Engine => "/parry"
+end
+```
+
+## Configuration
+
+```ruby
+# config/initializers/parry.rb
+Parry.configure do |config|
+  # Redis client. Defaults to Redis.new(url: ENV["PARRY_REDIS_URL"] || ENV["REDIS_URL"]).
+  # A ConnectionPool works too - anything that responds to #with.
+  config.redis = Redis.new(url: ENV["PARRY_REDIS_URL"])
+
+  # Prefix for every key Parry writes. Default: "parry".
+  config.key_prefix = "parry"
+
+  # Register the Rack::Attack hooks on boot. Default: true.
+  # Set to false to call Parry.install! yourself.
+  config.auto_install = true
+
+  # Record blocked and throttled requests for the "Blocked hosts" page. Default: true.
+  config.track_events = true
+
+  # How many hosts that page keeps, oldest dropped first. Default: 1000.
+  # The page itself lists them 50 at a time.
+  config.max_tracked_hosts = 1_000
+
+  # Seconds a honeypot regex may spend on one path before it is abandoned.
+  # Default: 0.05.
+  config.regex_timeout = 0.05
+end
+```
+
+## Redis persistence
+
+Parry's rules and the hosts its honeypots caught are **data, not cache**. If the Redis holding them loses its
+contents, your rules are gone and every host you blocked is free again. Two ways that happens:
+
+**A Redis container without a volume.** Everything lives in the container's writable layer, so anything that
+recreates the container - a redeploy, `docker compose up --force-recreate`, a host rebuild - wipes it. Give it a
+volume and turn on the append-only file:
+
+```yaml
+services:
+  redis:
+    image: redis:7-alpine
+    command: redis-server --appendonly yes
+    volumes:
+      - ./tmp/redis:/data
+```
+
+With Kamal, run Redis as an accessory with a directory of its own:
+
+```yaml
+# config/deploy.yml
+accessories:
+  redis:
+    image: redis:7-alpine
+    host: 203.0.113.10
+    cmd: redis-server --appendonly yes
+    directories:
+      - data:/data
+```
+
+`directories` bind-mounts a directory on the host into the container, so the data outlives any container that
+gets replaced. Without it the accessory keeps everything inside the container, and the first
+`kamal accessory reboot redis` - or anything else that recreates it - starts from an empty database.
+
+**A Redis used as a cache.** With a `maxmemory` limit and an eviction policy like `allkeys-lru`, Redis quietly
+drops keys when it fills up, and it does not exempt yours. Either run the instance with `noeviction`, or point
+Parry somewhere else with `PARRY_REDIS_URL` - a separate database on the same server is enough:
+
+```ruby
+Parry.configure do |config|
+  config.redis = Redis.new(url: ENV.fetch("PARRY_REDIS_URL"))
+end
+```
+
+To check what a running server is doing:
+
+```sh
+redis-cli config get appendonly
+redis-cli config get maxmemory-policy
+```
+
+## Rule types
+
+| Type | Effect |
+| --- | --- |
+| Blocklist | Requests from the IP or CIDR range get `403 Forbidden` |
+| Safelist | Requests from the IP or CIDR range skip every blocklist, throttle and honeypot |
+| Throttle | More than *limit* requests per *period* seconds from one IP get `429 Too Many Requests`, optionally only under a path prefix |
+| Honeypot | Requesting the path - by prefix or regex - blocklists the host, so all of its later requests get `403 Forbidden` too |
+
+Both IPv4 and IPv6 addresses and ranges are accepted.
+
+### Honeypots
+
+A honeypot turns a path into bait. The first request to it gets a `403`, and the host is blocked everywhere
+until you release it:
+
+```
+GET /.env  from 203.0.113.9   -> 403, host caught
+GET /      from 203.0.113.9   -> 403, still blocked
+GET /      from 198.51.100.1  -> 200
+```
+
+Point honeypots at paths a real visitor never requests - `/.env`, `/wp-login.php`, `/.git/config` - and they will
+catch the scanners probing for them. Caught hosts show up under **Blocked hosts** as `Caught`, together with
+the path that caught them, and the Unblock button releases them.
+
+A honeypot matches its path in one of two ways:
+
+**Prefix** (the default) - `/wp-login.php` also catches `/wp-login.php.bak`, and `/admin` catches everything
+below `/admin`.
+
+**Regular expression** - one rule can cover a family of probes:
+
+| Pattern | Catches |
+| --- | --- |
+| `\.(env\|git)` | `/.env`, `/.git/config`, `/config/.env` |
+| `\A/(wp-admin\|wp-login)` | `/wp-admin/`, `/wp-login.php` |
+| `\.(php\|asp\|aspx)\z` | any request ending in a PHP or ASP extension |
+
+The pattern is ordinary Ruby regex syntax and is **matched anywhere in the path unless you anchor it** with `\A`
+or `\z`. Bear in mind the path always starts with `/`, so `\Awp-` never matches anything - you want `\A/wp-`.
+
+Whichever you choose, pick it carefully: anything a legitimate visitor can reach blocks them, so `/` as a prefix
+honeypots your entire audience. Safelist your own address before arming a broad one.
+
+Regexes are compiled with a timeout (`config.regex_timeout`, 50ms by default) because they run against every
+request path. A pattern that backtracks catastrophically is abandoned and logged rather than allowed to hang the
+request, and a pattern that does not compile is rejected by the form.
+
+## Export and import
+
+The rules list has **Export** and **Import** buttons. Export downloads every rule as JSON; import reads that
+file back, either adding to the rules already there or replacing them outright.
+
+```json
+{
+  "format": 1,
+  "parry_version": "0.1.0",
+  "exported_at": 1787390429,
+  "rules": [
+    {"id": "3f2a...", "kind": "honeypot", "path": "\\.(env|git)", "path_match": "regex", "name": "Config probe"}
+  ]
+}
+```
+
+Use it to keep a backup of a hand-built rule set, to move rules from staging to production, or to keep the
+same honeypots across several applications. Rules keep their ids, so re-importing the same file updates the
+rules it already created instead of duplicating them.
 
-Install the gem and add to the application's Gemfile by executing:
+## Starter honeypot rules
 
-```bash
-bundle add UPDATE_WITH_YOUR_GEM_NAME_IMMEDIATELY_AFTER_RELEASE_TO_RUBYGEMS_ORG
+Import this JSON to set up a starter set of honeypots that catch common scanner probes:
+
+```json
+{
+  "format": 1,
+  "parry_version": "0.1.0",
+  "exported_at": 1792154664,
+  "rules": [
+    {"id": "81b72099bb9ee0b8", "kind": "honeypot", "path": "/wp-admin", "path_match": "prefix", "created_at": 1787485029},
+    {"id": "1cab2f085efd96c2", "kind": "honeypot", "path": "/wp-content", "path_match": "prefix", "created_at": 1787485038},
+    {"id": "319a068bd3ecf2a8", "kind": "honeypot", "path": "/*.php", "path_match": "regex", "created_at": 1787485046},
+    {"id": "45a6a5aa4ce9d553", "kind": "honeypot", "path": "/wp-includes/", "path_match": "prefix", "created_at": 1789592763},
+    {"id": "981ed0b90c9b82ac", "kind": "honeypot", "path": "\\.env", "path_match": "regex", "created_at": 1789592836},
+    {"id": "774556062efe2222", "kind": "honeypot", "path": "\\.ini", "path_match": "regex", "created_at": 1789592872},
+    {"id": "ca7a15b798c13b50", "kind": "honeypot", "path": "\\.action", "path_match": "regex", "created_at": 1789592892},
+    {"id": "ad18ef756734ab61", "kind": "honeypot", "path": "/.git", "path_match": "prefix", "created_at": 1789632673},
+    {"id": "fd4f5f92ceb0f812", "kind": "honeypot", "path": "wlwmanifest\\.xml", "path_match": "regex", "created_at": 1789632707},
+    {"id": "ea747ec75c548815", "kind": "honeypot", "path": "/static", "path_match": "prefix", "created_at": 1789632734},
+    {"id": "f91a2c1cc24a7722", "kind": "honeypot", "path": "/wp-login.php", "path_match": "prefix", "created_at": 1789632748},
+    {"id": "9a81543ea9c5df68", "kind": "honeypot", "path": "/cms", "path_match": "prefix", "created_at": 1789632834},
+    {"id": "5c0b3f04946a1eb9", "kind": "honeypot", "path": "/backup", "path_match": "prefix", "created_at": 1792154602},
+    {"id": "61a8b763a94d5154", "kind": "honeypot", "path": "/sftp-config.json", "path_match": "prefix", "created_at": 1792154628},
+    {"id": "67b7f40a073d3234", "kind": "honeypot", "path": "/version", "path_match": "prefix", "created_at": 1792154643},
+    {"id": "70b36a2230e03379", "kind": "honeypot", "path": "/docker-compose.yml", "path_match": "prefix", "created_at": 1792154659}
+  ]
+}
+```
+
+The set covers WordPress, `.env`, `.git`, backup files, and other common probes. Import it from the GUI or
+from the Rails console:
+
+```ruby
+json = File.read("starter-honeypots.json")
+Parry::RuleTransfer.import(json, replace: false)
 ```
 
-If bundler is not being used to manage dependencies, install the gem by executing:
+**An import is all or nothing.** Every rule in the file is validated as it is applied, and if any one of them is
+rejected the whole import is rolled back and each problem is listed - a file with a typo in it can never leave
+you with half a rule set. That holds for "replace" too: the rules you have now are only let go once the
+replacement is known to be good.
+
+The same thing from a console, if you would rather script it:
+
+```ruby
+File.write("rules.json", Parry::RuleTransfer.export_json)
+
+result = Parry::RuleTransfer.import(File.read("rules.json"), replace: true)
+result.ok?       # => true
+result.imported  # => 3
+result.errors    # => []
+```
+
+Blocked and caught hosts are deliberately not part of an export - they are a record of what happened on one
+server, not configuration.
+
+## How it works
+
+Parry registers exactly one safelist and one blocklist check with Rack::Attack, plus one real
+`Rack::Attack.throttle` per throttle rule. Rules are stored in a Redis hash next to a version counter that is
+bumped on every write, and caught hosts live in a hash of their own that bumps the same counter.
+The safelist check runs on every request and compares that counter against the snapshot
+the process is holding, reloading the rules when it changed - so an edit made in one process is picked up by all
+of them, at the cost of one Redis `GET` per request.
 
-```bash
-gem install UPDATE_WITH_YOUR_GEM_NAME_IMMEDIATELY_AFTER_RELEASE_TO_RUBYGEMS_ORG
+Rules you define yourself in an initializer keep working; Parry only adds to them.
+
+If Redis is unreachable, Parry logs the error and keeps serving the last snapshot it loaded rather than taking
+requests down with it.
+
+## Unblocking yourself from the Rails console
+
+If a rule locks you out of the Parry GUI, open your application's Rails console and unblock your IP address:
+
+```ruby
+Parry.unblock("203.0.113.4")
 ```
 
-## Usage
+This removes Parry blocklist rules covering the address, releases it from any honeypot, and resets its current
+throttle counters.
+
+## Things worth knowing
 
-TODO: Write usage instructions here
+- **The rules apply to the GUI too.** A throttle without a path prefix counts your own visits to the Parry pages,
+  and if your address ends up blocklisted you will not be able to reach them. Safelisting the address you
+  administer from avoids locking yourself out.
+- **A caught host stays blocked when you delete the honeypot rule.** The rule is the sensor, the caught host is
+  the result: removing the sensor does not vouch for the hosts it already caught. Release them individually from
+  the Blocked hosts page.
+- **Safelist yourself before arming a broad honeypot.** The safelist check runs first, so a safelisted address can
+  never be caught - it is the way back in if a honeypot turns out to cover more than you meant.
+- **Unblock only removes Parry's own rules.** Blocklists written in your initializer are static Ruby, so the GUI
+  cannot delete them - it reports the throttle counters it reset instead.
+- **Unblock clears the current throttle window** for every registered throttle, including throttles your own
+  initializer defines, and releases the host from any honeypot. Counters from `Fail2Ban` and `Allow2Ban` are not
+  touched.
+- **Use a shared cache store.** With the default in-memory store each process counts separately and unblocking
+  only affects the process that handled the request.
+- **Give Redis a volume.** Rules and caught hosts do not survive a container that gets recreated without one -
+  see [Redis persistence](#redis-persistence).
 
 ## Development
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+Parry's test suite runs against a real Redis and a dummy Rails application:
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+```sh
+docker compose up -d   # Redis on port 6380
+bin/setup
+bundle exec rake       # tests + standard
+```
+
+To click through the GUI, boot the dummy application:
+
+```sh
+REDIS_URL=redis://127.0.0.1:6380/2 bundle exec puma test/dummy/config.ru -p 3210
+# then open http://127.0.0.1:3210/parry
+```
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/parry. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/[USERNAME]/parry/blob/master/CODE_OF_CONDUCT.md).
+Bug reports and pull requests are welcome at https://github.com/gregmolnar/parry.
 
 ## License
 
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
-
-## Code of Conduct
-
-Everyone interacting in the Parry project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/[USERNAME]/parry/blob/master/CODE_OF_CONDUCT.md).

data/Rakefile

@@ -3,7 +3,9 @@
 require "bundler/gem_tasks"
 require "minitest/test_task"
 
-Minitest::TestTask.create
+Minitest::TestTask.create do |t|
+  t.test_globs = ["test/**/*_test.rb"]
+end
 
 require "standard/rake"
 

data/app/controllers/parry/application_controller.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Parry
+  class ApplicationController < ActionController::Base
+    protect_from_forgery with: :exception
+    layout "parry/application"
+  end
+end

data/app/controllers/parry/blocked_hosts_controller.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module Parry
+  class BlockedHostsController < ApplicationController
+    PER_PAGE = 50
+    # Fallback window for reading the tracker when host tracking is uncapped.
+    MAX_LISTED = 1000
+
+    def index
+      @rule_set = Parry.store.rule_set
+      hosts = hosts_with_caught(tracked_hosts)
+
+      @total = hosts.size
+      @total_pages = [(@total / PER_PAGE.to_f).ceil, 1].max
+      @page = requested_page(@total_pages)
+      @offset = (@page - 1) * PER_PAGE
+      @hosts = hosts[@offset, PER_PAGE] || []
+    end
+
+    def unblock
+      ip = params[:ip].to_s
+
+      if ip.empty?
+        redirect_to blocked_hosts_path(page: page_param), alert: "No host given."
+        return
+      end
+
+      was_caught = Parry.honeypots.caught?(ip)
+      removed = Parry.unblock(ip)
+
+      # Back to the page they were looking at, not the top of the list.
+      redirect_to blocked_hosts_path(page: page_param), notice: unblocked_notice(ip, removed, was_caught)
+    end
+
+    private
+
+    # The tracker trims itself to max_tracked_hosts, so reading that many covers
+    # everything it holds.
+    def tracked_hosts
+      limit = Parry.config.max_tracked_hosts.to_i
+
+      Parry.tracker.all(limit: limit.positive? ? limit : MAX_LISTED)
+    end
+
+    def requested_page(total_pages)
+      page = params[:page].to_i
+      return 1 if page < 1
+
+      [page, total_pages].min
+    end
+
+    # Kept out of the URL when it is the first page.
+    def page_param
+      page = params[:page].to_i
+
+      (page > 1) ? page : nil
+    end
+
+    def unblocked_notice(ip, removed, was_caught)
+      changes = []
+      changes << "removed #{removed.size} blocklist #{"rule".pluralize(removed.size)}" if removed.any?
+      changes << "released it from the honeypot" if was_caught
+      changes << "reset its throttle counters" if changes.empty?
+
+      "Unblocked #{ip} and #{changes.to_sentence}."
+    end
+
+    def hosts_with_caught(tracked)
+      seen = tracked.map(&:ip)
+
+      caught = @rule_set.caught_hosts.each_value.reject { |host| seen.include?(host.ip) }.map do |host|
+        BlockedHost.new(
+          ip: host.ip,
+          match_type: "honeypot",
+          rule: host.rule.present? ? "Honeypot: #{host.rule}" : "Honeypot",
+          path: host.path,
+          first_seen: host.caught_at&.to_i,
+          last_seen: host.caught_at&.to_i
+        )
+      end
+
+      (tracked + caught).sort_by { |host| -(host.last_seen&.to_i || 0) }
+    end
+  end
+end

data/app/controllers/parry/rules_controller.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+module Parry
+  class RulesController < ApplicationController
+    before_action :set_rule, only: [:edit, :update, :destroy]
+
+    def index
+      @rules = Parry.store.all
+    end
+
+    def new
+      @rule = Rule.new(kind: allowed_kind(params[:kind]))
+    end
+
+    def create
+      @rule = Rule.new(rule_params)
+
+      if Parry.store.save(@rule)
+        Parry.adapter.sync!(force: true)
+        redirect_to rules_path, notice: "Rule created."
+      else
+        render :new, status: :unprocessable_entity
+      end
+    end
+
+    def edit
+    end
+
+    def update
+      @rule.assign_attributes(rule_params)
+
+      if Parry.store.save(@rule)
+        Parry.adapter.sync!(force: true)
+        redirect_to rules_path, notice: "Rule updated."
+      else
+        render :edit, status: :unprocessable_entity
+      end
+    end
+
+    def export
+      send_data RuleTransfer.export_json,
+        filename: RuleTransfer.filename,
+        type: "application/json",
+        disposition: "attachment"
+    end
+
+    def import
+    end
+
+    def perform_import
+      @result = import_result
+
+      if @result.ok?
+        Parry.adapter.sync!(force: true)
+        redirect_to rules_path, notice: import_notice(@result)
+      else
+        render :import, status: :unprocessable_entity
+      end
+    end
+
+    def destroy
+      Parry.store.delete(@rule.id)
+      Parry.adapter.sync!(force: true)
+      redirect_to rules_path, notice: "Rule deleted."
+    end
+
+    private
+
+    def import_result
+      payload = import_payload
+
+      if payload.blank?
+        return RuleTransfer::Result.new(
+          imported: 0,
+          errors: ["Choose a file to import, or paste one in."],
+          replaced: false
+        )
+      end
+
+      RuleTransfer.import(payload, replace: params[:mode] == "replace")
+    end
+
+    def import_payload
+      file = params[:file]
+      return file.read(RuleTransfer::MAX_BYTES + 1).to_s if file.respond_to?(:read)
+
+      params[:pasted].to_s
+    end
+
+    def import_notice(result)
+      counted = "#{result.imported} #{"rule".pluralize(result.imported)}"
+
+      result.replaced? ? "Replaced every rule with the #{counted} from the file." : "Imported #{counted}."
+    end
+
+    def set_rule
+      @rule = Parry.store.find(params[:id])
+      redirect_to rules_path, alert: "Rule not found." unless @rule
+    end
+
+    def rule_params
+      params.require(:rule).permit(:kind, :value, :name, :limit, :period, :path, :path_match).to_h.symbolize_keys
+    end
+
+    def allowed_kind(kind)
+      Rule::KINDS.include?(kind) ? kind : "honeypot"
+    end
+  end
+end

data/app/helpers/parry/application_helper.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Parry
+  module ApplicationHelper
+    def parry_time(time)
+      return "—" if time.nil?
+
+      tag.span("#{time_ago_in_words(time)} ago", title: time.strftime("%Y-%m-%d %H:%M:%S %Z"))
+    end
+
+    def parry_period(seconds)
+      return "—" if seconds.nil?
+
+      distance_of_time_in_words(seconds.to_i)
+    end
+
+    def parry_kind_label(kind)
+      tag.span(kind.to_s.titleize, class: "parry-tag parry-tag--#{kind}")
+    end
+  end
+end