rails_error_dashboard 0.8.2 → 0.8.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c51d8221b7ca00ce0f9242f98f3594fd86028a2c98c464fcac28aac34f6d2a3b
-  data.tar.gz: 597373253abc68befcf70edab809093c320740fca1a575bcc8cae7fd6ae7e3e5
+  metadata.gz: 270ac48ebee51c2f68cab29abdbf1169b7db7d7b860bf1fc5a43883960cdc0c6
+  data.tar.gz: 6def5b5a2bbcabffd1116f13607771f6923823dc65eec803e028ba911af85ec9
 SHA512:
-  metadata.gz: 2bcae54eb97ce19345f5ca8a92e515c7b44d9957afc985885bda168afddadc24b3640b7fc3dcdfbe5e80637564975be851d7aeb2d2be14fbdfb8b38bf769300c
-  data.tar.gz: f269598ef3e5c0b4a7761be4bb4ddeeef32f662dd18f6e75dca292f108804b8d73f4d95e0f30e86a550e51478ec66d43431bb722740caf7d0149f98addb9c042
+  metadata.gz: fd6984fc8ccb2a68f9543786ffd6157d1a975ed5d446a13e38b3a38b42cc93047117918186b7f3936c2ddc3a53c3609db63073abad5f25d02edba4961e7b1f30
+  data.tar.gz: 55ba8d78b0d06176ac80e63919cd29a6ca94423d8880712c8fb82979a17741b5881878ef2351efd89c468fbb3d03c6411c82c5c4668a687f4f441b512c169814

data/README.md

@@ -13,7 +13,7 @@
 gem 'rails_error_dashboard'
 ```
 
-**5-minute setup** · **Works out-of-the-box** · **Postgres, MySQL/Trilogy, SQLite** · **No vendor lock-in**
+**5-minute setup** · **Works out-of-the-box** · **PostgreSQL, MySQL/Trilogy, SQLite — shared or separate database** · **No vendor lock-in**
 
 [Full Documentation](https://anjanj.github.io/rails_error_dashboard/) · [Live Demo](https://rails-error-dashboard.anjan.dev) · [RubyGems](https://rubygems.org/gems/rails_error_dashboard)
 
@@ -602,6 +602,37 @@ end
 
 ---
 
+## FAQ
+
+**Does Rails Error Dashboard support a separate database for errors?**
+Yes. You can store errors in your app's existing database (shared) **or** in a dedicated, isolated database (separate). Set `config.use_separate_database = true` (or `USE_SEPARATE_ERROR_DB=true`) and point it at a separate connection — the engine routes all of its tables through `connects_to`, keeping error data fully isolated from your app data. Both modes are first-class and covered by the [Database Options guide](docs/guides/DATABASE_OPTIONS.md).
+
+**Which databases does it work with?**
+SQLite, PostgreSQL, and MySQL/Trilogy — in either shared or separate-database mode.
+
+**Is this a self-hosted alternative to Sentry?**
+Yes. It runs entirely inside your own Rails process — no external services, no SDK calling out, no per-event pricing. Error data never leaves your infrastructure.
+
+**Does it capture local variables like Sentry?**
+Yes — local **and** instance variables at the moment the exception is raised, via `TracePoint(:raise)`, with sensitive-data filtering and configurable limits. This is opt-in and a capability Sentry charges extra for.
+
+**Will a flood of errors take down my app?**
+No. Storm protection (a circuit breaker with adaptive sampling, **ON by default**) makes the gem degrade itself first during error floods — occurrence counts stay exact while it sheds the expensive work. Measured hot-path overhead is ~2.4µs/error.
+
+**Does it work with my background jobs?**
+Yes — it auto-detects and supports Sidekiq, SolidQueue, and GoodJob, and can log errors asynchronously through any of them.
+
+**Does it work with my authentication?**
+Yes — HTTP Basic Auth out of the box, or a custom `authenticate_with` lambda that integrates with Devise, Warden, or session-based auth.
+
+**Can it track more than one app?**
+Yes — multi-app support tracks errors from multiple Rails apps in one dashboard with per-app filtering.
+
+**What Rails and Ruby versions are supported?**
+Rails 7.0–8.1 and Ruby 3.2–4.0.
+
+---
+
 ## Documentation
 
 ### Getting Started

data/app/controllers/rails_error_dashboard/errors_controller.rb

@@ -484,9 +484,8 @@ module RailsErrorDashboard
     end
 
     def rack_attack_summary
-      unless RailsErrorDashboard.configuration.enable_rack_attack_tracking &&
-             RailsErrorDashboard.configuration.enable_breadcrumbs
-        flash[:alert] = "Rack Attack tracking is not enabled. Enable enable_rack_attack_tracking and enable_breadcrumbs in config/initializers/rails_error_dashboard.rb"
+      unless RailsErrorDashboard.configuration.enable_rack_attack_tracking
+        flash[:alert] = "Rack Attack tracking is not enabled. Set enable_rack_attack_tracking = true in config/initializers/rails_error_dashboard.rb"
         redirect_to errors_path(**app_context_params)
         return
       end

data/app/jobs/rails_error_dashboard/rack_attack_flush_job.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  # Job: Persist buffered Rack::Attack event counts to the database.
+  #
+  # Two usage modes:
+  # 1. With a counts hash — dispatched by RackAttackTracker's periodic flush.
+  #    Zero I/O in the request path; all DB writes happen here.
+  # 2. Without arguments — scheduled periodic sweep that flushes the current
+  #    thread's buffer (useful as a cron safety net for low-traffic apps where
+  #    the flush interval may not be reached during a request).
+  #
+  # Example cron (via solid_queue or whenever):
+  #   every 5.minutes { RailsErrorDashboard::RackAttackFlushJob.perform_later }
+  class RackAttackFlushJob < ApplicationJob
+    queue_as :default
+
+    def perform(counts = nil)
+      return unless RailsErrorDashboard.configuration.enable_rack_attack_tracking
+
+      if counts
+        # Mode 1: Persist provided snapshot (dispatched from tracker flush)
+        Commands::FlushRackAttackEvents.call(counts: counts)
+      else
+        # Mode 2: Flush current thread's buffer (scheduled cron safety net).
+        # sync: true because we are already off the request path.
+        Services::RackAttackTracker.flush!(sync: true)
+      end
+    end
+  end
+end

data/app/jobs/rails_error_dashboard/retention_cleanup_job.rb

@@ -20,6 +20,12 @@ module RailsErrorDashboard
       return 0 if retention_days.blank?
 
       cutoff = retention_days.days.ago
+
+      # Rack Attack events live in their own table and expire independently of
+      # errors — clean them up BEFORE the early return below, which fires
+      # whenever no error logs happen to be expired.
+      cleanup_rack_attack_events(cutoff)
+
       expired_scope = ErrorLog.where("occurred_at < ?", cutoff)
       return 0 if expired_scope.none?
 
@@ -52,5 +58,29 @@ module RailsErrorDashboard
       RailsErrorDashboard::Logger.error("[RailsErrorDashboard] Retention cleanup failed: #{e.class} - #{e.message}")
       0
     end
+
+    private
+
+    # Expire aggregated Rack Attack event rows. Isolated in its own rescue so a
+    # failure here (e.g. table not yet migrated) never blocks error cleanup.
+    def cleanup_rack_attack_events(cutoff)
+      return unless RailsErrorDashboard.configuration.enable_rack_attack_tracking
+      return unless RackAttackEvent.table_exists?
+
+      deleted = 0
+      RackAttackEvent.where("period_hour < ?", cutoff).in_batches(of: 1000) do |batch|
+        deleted += batch.delete_all
+      end
+
+      if deleted > 0
+        RailsErrorDashboard::Logger.info(
+          "[RailsErrorDashboard] Retention cleanup: deleted #{deleted} rack attack events"
+        )
+      end
+    rescue => e
+      RailsErrorDashboard::Logger.debug(
+        "[RailsErrorDashboard] Rack attack retention cleanup failed: #{e.class} - #{e.message}"
+      )
+    end
   end
 end

data/app/models/rails_error_dashboard/rack_attack_event.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  # Stores aggregated Rack::Attack throttle/blocklist/track events per hourly bucket.
+  #
+  # Rack::Attack events are NOT errors — a throttled request returns HTTP 429 without
+  # raising. They are therefore persisted independently of error_logs rather than as
+  # a side-effect of error capture (see issue #143).
+  #
+  # Rows are aggregated hourly by (rule, match_type, discriminator, path) so that a
+  # rate-limit flood collapses to a handful of rows instead of one INSERT per request.
+  class RackAttackEvent < ErrorLogsRecord
+    self.table_name = "rails_error_dashboard_rack_attack_events"
+
+    # Event types emitted by Rack::Attack (v5.0+)
+    MATCH_TYPES = %w[throttle blocklist track safelist].freeze
+
+    belongs_to :application, optional: true
+
+    validates :rule, presence: true
+    validates :match_type, presence: true
+    validates :period_hour, presence: true
+    validates :event_count, presence: true, numericality: { greater_than_or_equal_to: 0 }
+
+    scope :for_application, ->(app_id) { where(application_id: app_id) }
+    scope :since, ->(time) { where("period_hour >= ?", time) }
+    scope :recent, -> { order(period_hour: :desc) }
+    scope :throttles, -> { where(match_type: "throttle") }
+    scope :blocklists, -> { where(match_type: "blocklist") }
+
+    # Whether this event represents a hard block rather than a rate limit
+    def blocked?
+      match_type == "blocklist"
+    end
+  end
+end

data/app/views/layouts/rails_error_dashboard.html.erb

@@ -993,7 +993,7 @@ tr[data-red-row-href]:hover .sev-bar { opacity: 1 !important; }
             <% health_items << { path: job_health_summary_errors_path(nav_params), icon: 'bi-gear-wide-connected', label: 'Jobs' } %>
             <% health_items << { path: database_health_summary_errors_path(nav_params), icon: 'bi-database', label: 'Database' } %>
           <% end %>
-          <% if RailsErrorDashboard.configuration.enable_rack_attack_tracking && RailsErrorDashboard.configuration.enable_breadcrumbs %>
+          <% if RailsErrorDashboard.configuration.enable_rack_attack_tracking %>
             <% health_items << { path: rack_attack_summary_errors_path(nav_params), icon: 'bi-shield-exclamation', label: 'Rate Limits' } %>
           <% end %>
           <% if RailsErrorDashboard.configuration.enable_actioncable_tracking && RailsErrorDashboard.configuration.enable_breadcrumbs %>

data/app/views/rails_error_dashboard/errors/rack_attack_summary.html.erb

@@ -25,16 +25,16 @@
       <i class="bi bi-shield-check display-1 text-success mb-3"></i>
       <div class="red-empty-state-title">No Rate Limit Events Found</div>
       <p class="text-muted">
-        No Rack Attack throttle, blocklist, or track events were detected in error breadcrumbs over the last <%= @days %> days.
+        No Rack Attack throttle, blocklist, or track events were recorded over the last <%= @days %> days.
       </p>
       <div class="card mx-auto" style="max-width: 500px;">
         <div class="card-body text-start">
           <h6>How Rack Attack tracking works:</h6>
           <ul class="mb-0">
-            <li>Breadcrumbs must be enabled (<code>enable_breadcrumbs = true</code>)</li>
             <li>Rack Attack tracking must be enabled (<code>enable_rack_attack_tracking = true</code>)</li>
             <li>Rack Attack must be installed and configured in your app</li>
-            <li>Throttle, blocklist, and track events are captured as breadcrumbs during requests that produce errors</li>
+            <li>Throttle, blocklist, and track events are recorded whenever a rule matches — no error required</li>
+            <li>Events are buffered and written every <%= RailsErrorDashboard.configuration.rack_attack_flush_interval %>s, so allow a short delay before they appear</li>
           </ul>
         </div>
       </div>
@@ -86,7 +86,6 @@
                 <th width="80">Count</th>
                 <th width="80">IPs</th>
                 <th>Top Path</th>
-                <th width="80">Errors</th>
                 <th width="140">Last Seen</th>
               </tr>
             </thead>
@@ -105,7 +104,6 @@
                   <td><strong><%= event[:count] %></strong></td>
                   <td><%= event[:unique_ips] %></td>
                   <td><code><%= event[:top_path] %></code></td>
-                  <td><%= event[:error_count] %></td>
                   <td><%= local_time_ago(event[:last_seen]) %></td>
                 </tr>
               <% end %>
@@ -116,7 +114,7 @@
       <div class="card-footer border-top d-flex justify-content-between align-items-center">
         <div>
           <small class="text-muted">
-            <i class="bi bi-lightbulb text-warning"></i> Rate limit events are captured when they coincide with errors. High counts may indicate abuse or misconfigured rules.
+            <i class="bi bi-lightbulb text-warning"></i> High counts may indicate abuse or misconfigured rules.
           </small>
           <small class="ms-3">
             <a href="https://github.com/rack/rack-attack" target="_blank" rel="noopener" class="text-decoration-none">

data/db/migrate/20260730000001_create_rails_error_dashboard_rack_attack_events.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+class CreateRailsErrorDashboardRackAttackEvents < ActiveRecord::Migration[7.0]
+  def change
+    # Guard against the squashed schema migration having already created this
+    # table — without it, every later migration is silently cancelled.
+    return if table_exists?(:rails_error_dashboard_rack_attack_events)
+
+    create_table :rails_error_dashboard_rack_attack_events do |t|
+      t.string   :rule,          null: false, limit: 250
+      t.string   :match_type,    null: false, limit: 50
+      # discriminator and path are capped at 191 (not 250) to keep the unique
+      # upsert index within MySQL's 3072-byte utf8mb4 limit. Budget:
+      # 250+50+191+191 chars * 4 bytes + 2 length-prefix each = 2736 bytes.
+      # See issue #96 — the swallowed_exceptions index blew this limit at 5042.
+      t.string   :discriminator, limit: 191
+      t.string   :path,          limit: 191
+      t.string   :http_method,   limit: 10
+      t.datetime :period_hour,   null: false
+      t.integer  :event_count,   null: false, default: 0
+      t.datetime :last_seen_at
+      t.bigint   :application_id
+      t.timestamps
+    end
+
+    add_index :rails_error_dashboard_rack_attack_events,
+              :period_hour,
+              name: "index_rack_attack_events_on_period_hour"
+
+    add_index :rails_error_dashboard_rack_attack_events,
+              [ :application_id, :period_hour ],
+              name: "index_rack_attack_events_on_app_and_hour"
+
+    add_index :rails_error_dashboard_rack_attack_events,
+              [ :rule, :period_hour ],
+              name: "index_rack_attack_events_on_rule_and_hour"
+
+    # http_method is intentionally NOT part of the upsert key — it would push
+    # the index over the MySQL byte limit and adds no aggregation value.
+    add_index :rails_error_dashboard_rack_attack_events,
+              [ :rule, :match_type, :discriminator, :path, :period_hour, :application_id ],
+              unique: true,
+              name: "index_rack_attack_events_upsert_key"
+  end
+end

data/lib/rails_error_dashboard/commands/flush_rack_attack_events.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  module Commands
+    # Command: Upsert buffered Rack::Attack event counts into the database.
+    #
+    # Receives a snapshot hash from RackAttackTracker and merges it into
+    # hourly-bucketed rows. Uses find_or_initialize_by + increment for
+    # cross-database compatibility (no raw SQL upsert).
+    #
+    # counts keys: "rule\x1Fmatch_type\x1Fdiscriminator\x1Fpath\x1Fhttp_method"
+    class FlushRackAttackEvents
+      def self.call(counts:)
+        new(counts: counts).call
+      end
+
+      def initialize(counts:)
+        @counts = counts || {}
+      end
+
+      def call
+        return if @counts.empty?
+
+        period = Time.current.beginning_of_hour
+        app_id = current_application_id
+
+        @counts.each do |key, count|
+          rule, match_type, discriminator, path, http_method =
+            Services::RackAttackTracker.parse_key(key)
+
+          next if rule.blank? || match_type.blank?
+
+          upsert_event(
+            rule: rule,
+            match_type: match_type,
+            discriminator: discriminator,
+            path: path,
+            http_method: http_method,
+            period: period,
+            app_id: app_id,
+            count: count
+          )
+        end
+      rescue => e
+        RailsErrorDashboard::Logger.debug(
+          "[RailsErrorDashboard] FlushRackAttackEvents failed: #{e.class} - #{e.message}"
+        )
+      end
+
+      private
+
+      def upsert_event(rule:, match_type:, discriminator:, path:, http_method:, period:, app_id:, count:)
+        # nil and "" must map to the same row — the unique index treats them as
+        # distinct in some adapters, so normalize blanks to nil consistently.
+        record = RackAttackEvent.find_or_initialize_by(
+          rule: rule,
+          match_type: match_type,
+          discriminator: discriminator.presence,
+          path: path.presence,
+          period_hour: period,
+          application_id: app_id
+        )
+
+        record.http_method = http_method.presence if record.http_method.blank?
+        record.event_count = (record.event_count || 0) + count
+        record.last_seen_at = Time.current
+        record.save!
+      rescue => e
+        RailsErrorDashboard::Logger.debug(
+          "[RailsErrorDashboard] FlushRackAttackEvents.upsert_event failed for #{rule}: #{e.message}"
+        )
+      end
+
+      def current_application_id
+        app_name = RailsErrorDashboard.configuration.application_name
+        return nil unless app_name.present?
+
+        Application.find_by(name: app_name)&.id
+      rescue => e
+        nil
+      end
+    end
+  end
+end

data/lib/rails_error_dashboard/configuration.rb

@@ -195,8 +195,11 @@ module RailsErrorDashboard
     # Code path coverage (diagnostic mode — Ruby 3.2+)
     attr_accessor :enable_coverage_tracking             # Master switch (default: false)
 
-    # Rack Attack event tracking (requires enable_breadcrumbs = true)
+    # Rack Attack event tracking — persists throttle/blocklist/track events to
+    # their own table, independent of error capture (breadcrumbs optional).
     attr_accessor :enable_rack_attack_tracking          # Master switch (default: false)
+    attr_accessor :rack_attack_max_cache_size           # Max buffered keys per thread (default: 1000)
+    attr_accessor :rack_attack_flush_interval           # Seconds between DB flushes (default: 60)
 
     # ActionCable event tracking (requires enable_breadcrumbs = true)
     attr_accessor :enable_actioncable_tracking          # Master switch (default: false)
@@ -400,8 +403,11 @@ module RailsErrorDashboard
       # Code path coverage defaults - OFF by default (opt-in, Ruby 3.2+)
       @enable_coverage_tracking = false
 
-      # Rack Attack event tracking defaults - OFF by default (opt-in, requires breadcrumbs)
+      # Rack Attack event tracking defaults - OFF by default (opt-in).
+      # Persists to its own table; does NOT require breadcrumbs.
       @enable_rack_attack_tracking = false
+      @rack_attack_max_cache_size = 1000 # Max buffered keys per thread (LRU eviction)
+      @rack_attack_flush_interval = 60   # Seconds between DB flushes
 
       # ActionCable event tracking defaults - OFF by default (opt-in, requires breadcrumbs)
       @enable_actioncable_tracking = false
@@ -574,11 +580,16 @@ module RailsErrorDashboard
         end
       end
 
-      # Validate rack_attack tracking requires breadcrumbs
-      if enable_rack_attack_tracking && !enable_breadcrumbs
-        warnings << "enable_rack_attack_tracking requires enable_breadcrumbs = true. " \
-                    "Rack Attack tracking has been auto-disabled."
-        @enable_rack_attack_tracking = false
+      # Rack Attack tracking no longer requires breadcrumbs — events are persisted
+      # to their own table (issue #143). Breadcrumbs only add the event to the
+      # activity trail on error detail pages.
+      if enable_rack_attack_tracking
+        if rack_attack_max_cache_size && rack_attack_max_cache_size < 1
+          errors << "rack_attack_max_cache_size must be at least 1 (got: #{rack_attack_max_cache_size})"
+        end
+        if rack_attack_flush_interval && rack_attack_flush_interval < 1
+          errors << "rack_attack_flush_interval must be at least 1 (got: #{rack_attack_flush_interval})"
+        end
       end
 
       # Validate actioncable tracking requires breadcrumbs

data/lib/rails_error_dashboard/engine.rb

@@ -80,9 +80,9 @@ module RailsErrorDashboard
         RailsErrorDashboard::Subscribers::BreadcrumbSubscriber.subscribe!
       end
 
-      # Subscribe to Rack Attack AS::Notifications events (requires breadcrumbs + Rack::Attack)
+      # Subscribe to Rack Attack AS::Notifications events (requires Rack::Attack).
+      # Breadcrumbs are NOT required — events persist to their own table (issue #143).
       if RailsErrorDashboard.configuration.enable_rack_attack_tracking &&
-         RailsErrorDashboard.configuration.enable_breadcrumbs &&
          defined?(Rack::Attack)
         RailsErrorDashboard::Subscribers::RackAttackSubscriber.subscribe!
       end

data/lib/rails_error_dashboard/queries/rack_attack_summary.rb

@@ -2,9 +2,15 @@
 
 module RailsErrorDashboard
   module Queries
-    # Query: Aggregate Rack Attack events from breadcrumbs across all errors
-    # Scans error_logs breadcrumbs JSON, filters for "rack_attack" category crumbs,
-    # and groups by rule name with counts, unique IPs, paths, and error associations.
+    # Query: Aggregate Rack Attack events from the rack_attack_events table.
+    #
+    # Previously this scanned every error_log's breadcrumbs JSON in Ruby, which was
+    # both expensive (full-table scan + JSON.parse per row) and incomplete (events
+    # were only stored when an unrelated error happened to occur in the same
+    # request). Events now have their own table, so this is indexed SQL.
+    #
+    # Returns rows grouped by rule with counts, unique discriminators (IPs),
+    # the most frequent path, and last-seen timestamps.
     class RackAttackSummary
       def self.call(days = 30, application_id: nil)
         new(days, application_id: application_id).call
@@ -25,65 +31,70 @@ module RailsErrorDashboard
       private
 
       def base_query
-        scope = ErrorLog.where("occurred_at >= ?", @start_date)
-                        .where.not(breadcrumbs: nil)
-        scope = scope.where(application_id: @application_id) if @application_id.present?
+        scope = RackAttackEvent.where("period_hour >= ?", @start_date)
+        scope = scope.for_application(@application_id) if @application_id.present?
         scope
       end
 
       def aggregated_events
-        results = {}
+        rows = base_query.pluck(
+          :rule, :match_type, :discriminator, :path, :event_count, :last_seen_at, :period_hour
+        )
+        return [] if rows.empty?
 
-        base_query.select(:id, :breadcrumbs, :occurred_at).find_each(batch_size: 500) do |error_log|
-          crumbs = parse_breadcrumbs(error_log.breadcrumbs)
-          next if crumbs.empty?
+        grouped = {}
 
-          rack_attack_crumbs = crumbs.select { |c| c["c"] == "rack_attack" }
-          next if rack_attack_crumbs.empty?
+        rows.each do |rule, match_type, discriminator, path, event_count, last_seen_at, period_hour|
+          key = rule.to_s.presence || "unknown"
+          count = event_count.to_i
+          seen_at = last_seen_at || period_hour
 
-          rack_attack_crumbs.each do |crumb|
-            meta = crumb["meta"] || {}
-            rule = meta["rule"].to_s.presence || "unknown"
+          entry = grouped[key] ||= {
+            rule: key,
+            match_type: match_type.to_s,
+            count: 0,
+            ips: Set.new,
+            path_counts: Hash.new(0),
+            last_seen: nil
+          }
 
-            if results[rule]
-              results[rule][:count] += 1
-              results[rule][:ips] << meta["discriminator"].to_s if meta["discriminator"].present?
-              results[rule][:paths] << meta["path"].to_s if meta["path"].present?
-              results[rule][:error_ids] << error_log.id
-              results[rule][:last_seen] = [ results[rule][:last_seen], error_log.occurred_at ].compact.max
-            else
-              results[rule] = {
-                rule: rule,
-                match_type: meta["type"].to_s,
-                count: 1,
-                ips: Set.new([ meta["discriminator"].to_s ].reject(&:blank?)),
-                paths: Set.new([ meta["path"].to_s ].reject(&:blank?)),
-                error_ids: [ error_log.id ],
-                last_seen: error_log.occurred_at
-              }
-            end
-          end
+          entry[:count] += count
+          entry[:ips] << discriminator.to_s if discriminator.present?
+          entry[:path_counts][path.to_s] += count if path.present?
+          entry[:last_seen] = [ entry[:last_seen], seen_at ].compact.max
+
+          # Prefer the most severe match type when a rule spans several. A rule
+          # that both tracks and blocks should surface as "blocklist".
+          entry[:match_type] = match_type.to_s if severity(match_type) > severity(entry[:match_type])
         end
 
-        results.values.each do |r|
-          r[:error_ids] = r[:error_ids].uniq
-          r[:error_count] = r[:error_ids].size
+        grouped.values.each do |r|
+          # "Top path" now means genuinely most-frequent, not first-seen.
+          r[:top_path] = r[:path_counts].max_by { |_path, count| count }&.first
+          r[:paths] = r[:path_counts].sort_by { |_p, c| -c }.map(&:first)
           r[:unique_ips] = r[:ips].size
-          r[:top_path] = r[:paths].first
           r[:ips] = r[:ips].to_a
-          r[:paths] = r[:paths].to_a
+          # Distinct rate-limited clients is the meaningful figure here; the old
+          # breadcrumb-derived :error_count no longer applies now that events are
+          # stored independently of errors.
+          r[:error_count] = 0
+          r.delete(:path_counts)
         end
-        results.values.sort_by { |r| -r[:count] }
+
+        grouped.values.sort_by { |r| -r[:count] }
       rescue => e
         Rails.logger.error("[RailsErrorDashboard] RackAttackSummary query failed: #{e.class}: #{e.message}")
         []
       end
 
-      def parse_breadcrumbs(raw)
-        return [] if raw.blank?
-        JSON.parse(raw)
-      rescue JSON::ParserError
-        []
+      # Ordering used to pick the most severe match type for a rule.
+      def severity(match_type)
+        case match_type.to_s
+        when "blocklist" then 3
+        when "throttle"  then 2
+        when "track"     then 1
+        else 0
+        end
       end
     end
   end

data/lib/rails_error_dashboard/services/rack_attack_tracker.rb

@@ -0,0 +1,194 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  module Services
+    # Buffers Rack::Attack events in a thread-local hash and flushes them to the
+    # database asynchronously.
+    #
+    # WHY THIS EXISTS (issue #143): Rack::Attack events were previously only
+    # recorded as breadcrumbs. Breadcrumbs are harvested exclusively by LogError,
+    # so an event was only ever persisted if an unrelated exception happened to be
+    # raised later in the same request. A throttled request returns HTTP 429 and
+    # raises nothing, so the event was always discarded when ErrorCatcher cleared
+    # the buffer. This tracker persists events independently of error capture.
+    #
+    # Events are aggregated by (rule, match_type, discriminator, path, method) and
+    # counted, rather than stored one row per event — a rate-limit flood is exactly
+    # when we must not do one INSERT per request.
+    #
+    # SAFETY RULES (HOST_APP_SAFETY.md):
+    # - Zero I/O in the record path (hash lookup + integer increment)
+    # - Never raises — every public method wrapped in rescue
+    # - Thread-local state, no mutex needed
+    # - LRU eviction bounds memory (rotating-IP attacks cannot grow it unbounded)
+    # - Async flush via background job
+    class RackAttackTracker
+      COUNTS_THREAD_KEY = :red_rack_attack_counts
+      FLUSH_THREAD_KEY  = :red_rack_attack_last_flush
+
+      # Field length caps — must match the column limits in the migration so that
+      # truncation happens before the value ever reaches the unique upsert index.
+      MAX_RULE_LENGTH          = 250
+      MAX_DISCRIMINATOR_LENGTH = 191
+      MAX_PATH_LENGTH          = 191
+      MAX_METHOD_LENGTH        = 10
+
+      # Separator for the composite buffer key. Chosen because it cannot appear in
+      # an HTTP method and is vanishingly unlikely in a rule name or path.
+      KEY_SEPARATOR = "
"
+
+      class << self
+        # Record a single Rack::Attack event. Called from the AS::Notifications
+        # subscriber on every throttle/blocklist/track match.
+        #
+        # @param rule [String] matched rule name (env["rack.attack.matched"])
+        # @param match_type [String] "throttle" | "blocklist" | "track"
+        # @param discriminator [String] rate-limit key (usually IP or user id)
+        # @param path [String] request path
+        # @param http_method [String] request method
+        def record(rule:, match_type:, discriminator: nil, path: nil, http_method: nil)
+          return unless enabled?
+
+          key = build_key(
+            truncate(rule, MAX_RULE_LENGTH),
+            match_type.to_s,
+            truncate(discriminator, MAX_DISCRIMINATOR_LENGTH),
+            truncate(path, MAX_PATH_LENGTH),
+            truncate(http_method, MAX_METHOD_LENGTH)
+          )
+
+          counts = (Thread.current[COUNTS_THREAD_KEY] ||= {})
+          counts[key] = (counts[key] || 0) + 1
+
+          # LRU eviction — Ruby hashes preserve insertion order, so the first key
+          # is the oldest. Bounds memory under rotating-discriminator attacks.
+          evict_oldest!(counts) if counts.size > max_cache_size
+
+          maybe_flush!
+          nil
+        rescue => e
+          RailsErrorDashboard::Logger.debug(
+            "[RailsErrorDashboard] RackAttackTracker.record failed: #{e.class} - #{e.message}"
+          )
+          nil
+        end
+
+        # Flush buffered counts to the database (async by default).
+        # Clears the thread-local buffer before dispatching so a slow/failed
+        # flush cannot double-count on the next call.
+        def flush!(sync: false)
+          counts = Thread.current[COUNTS_THREAD_KEY]
+          return if counts.nil? || counts.empty?
+
+          snapshot = counts.dup
+          counts.clear
+          Thread.current[FLUSH_THREAD_KEY] = Time.now.to_f
+
+          dispatch_flush(snapshot, sync: sync)
+          nil
+        rescue => e
+          RailsErrorDashboard::Logger.debug(
+            "[RailsErrorDashboard] RackAttackTracker.flush! failed: #{e.class} - #{e.message}"
+          )
+          nil
+        end
+
+        # Clear thread-local state without persisting. Used by specs and by
+        # thread teardown paths.
+        def reset!
+          Thread.current[COUNTS_THREAD_KEY] = nil
+          Thread.current[FLUSH_THREAD_KEY] = nil
+          nil
+        rescue => e
+          nil
+        end
+
+        # Current buffered counts (inspection / specs). Non-destructive.
+        def buffered_counts
+          (Thread.current[COUNTS_THREAD_KEY] || {}).dup
+        rescue => e
+          {}
+        end
+
+        # Decompose a buffer key back into its parts.
+        # @return [Array<String>] [rule, match_type, discriminator, path, http_method]
+        def parse_key(key)
+          key.to_s.split(KEY_SEPARATOR, 5)
+        end
+
+        private
+
+        def enabled?
+          RailsErrorDashboard.configuration.enable_rack_attack_tracking
+        rescue => e
+          false
+        end
+
+        def build_key(*parts)
+          parts.map(&:to_s).join(KEY_SEPARATOR)
+        end
+
+        def evict_oldest!(hash)
+          oldest_key = hash.each_key.first
+          hash.delete(oldest_key) if oldest_key
+        end
+
+        # Cheap periodic flush check — a float subtraction, no I/O.
+        def maybe_flush!
+          now = Time.now.to_f
+          last_flush = Thread.current[FLUSH_THREAD_KEY] ||= now
+          return unless (now - last_flush) >= flush_interval
+
+          flush!
+        end
+
+        # Dispatch asynchronously so the request path never waits on the DB.
+        # Falls back to a synchronous write if enqueueing fails (e.g. no queue
+        # backend configured) — losing the events would be worse, and this only
+        # happens on the flush interval, not per event.
+        def dispatch_flush(snapshot, sync: false)
+          return if snapshot.empty?
+
+          if sync
+            Commands::FlushRackAttackEvents.call(counts: snapshot)
+          else
+            RackAttackFlushJob.perform_later(snapshot)
+          end
+        rescue => e
+          RailsErrorDashboard::Logger.debug(
+            "[RailsErrorDashboard] RackAttackTracker.dispatch_flush enqueue failed, " \
+            "falling back to sync: #{e.class} - #{e.message}"
+          )
+          begin
+            Commands::FlushRackAttackEvents.call(counts: snapshot)
+          rescue => inner
+            RailsErrorDashboard::Logger.debug(
+              "[RailsErrorDashboard] RackAttackTracker sync fallback failed: #{inner.class} - #{inner.message}"
+            )
+          end
+        end
+
+        def max_cache_size
+          RailsErrorDashboard.configuration.rack_attack_max_cache_size || 1000
+        rescue => e
+          1000
+        end
+
+        def flush_interval
+          RailsErrorDashboard.configuration.rack_attack_flush_interval || 60
+        rescue => e
+          60
+        end
+
+        # Truncate to the column limit and strip the key separator. A rule name
+        # or path containing KEY_SEPARATOR would otherwise shift every field on
+        # parse — silently writing the discriminator into the path column.
+        def truncate(str, max)
+          s = str.to_s
+          s = s.delete(KEY_SEPARATOR) if s.include?(KEY_SEPARATOR)
+          s.length > max ? s[0, max] : s
+        end
+      end
+    end
+  end
+end

data/lib/rails_error_dashboard/subscribers/rack_attack_subscriber.rb

@@ -63,8 +63,6 @@ module RailsErrorDashboard
         end
 
         def handle_rack_attack(event, event_name)
-          return unless Services::BreadcrumbCollector.current_buffer
-
           request = event.payload[:request]
           return unless request
 
@@ -76,6 +74,22 @@ module RailsErrorDashboard
           path = request.respond_to?(:path) ? request.path.to_s : ""
           method = request.respond_to?(:request_method) ? request.request_method.to_s : ""
 
+          # Persist independently of error capture. A throttled request returns
+          # HTTP 429 and raises nothing, so it would otherwise never reach the
+          # database — breadcrumbs are only harvested by LogError (issue #143).
+          Services::RackAttackTracker.record(
+            rule: rule,
+            match_type: match_type,
+            discriminator: discriminator,
+            path: path,
+            http_method: method
+          )
+
+          # Also record a breadcrumb so the event still shows up in the activity
+          # trail on the error detail page when an error DOES occur in the same
+          # request. Requires an active request-scoped buffer.
+          return unless Services::BreadcrumbCollector.current_buffer
+
           message = "#{match_type}: #{rule} (#{discriminator}) #{method} #{path}"
 
           metadata = {

data/lib/rails_error_dashboard/version.rb

@@ -1,3 +1,3 @@
 module RailsErrorDashboard
-  VERSION = "0.8.2"
+  VERSION = "0.8.3"
 end

data/lib/rails_error_dashboard.rb

@@ -79,6 +79,7 @@ require "rails_error_dashboard/services/llm_summary"
 require "rails_error_dashboard/services/variable_serializer"
 require "rails_error_dashboard/services/local_variable_capturer"
 require "rails_error_dashboard/services/swallowed_exception_tracker"
+require "rails_error_dashboard/services/rack_attack_tracker"
 require "rails_error_dashboard/services/crash_capture"
 require "rails_error_dashboard/services/diagnostic_dump_generator"
 require "rails_error_dashboard/services/coverage_tracker"
@@ -124,6 +125,7 @@ require "rails_error_dashboard/commands/find_or_create_application"
 require "rails_error_dashboard/commands/upsert_cascade_pattern"
 require "rails_error_dashboard/commands/upsert_baseline"
 require "rails_error_dashboard/commands/flush_swallowed_exceptions"
+require "rails_error_dashboard/commands/flush_rack_attack_events"
 require "rails_error_dashboard/queries/errors_list"
 require "rails_error_dashboard/queries/dashboard_stats"
 require "rails_error_dashboard/queries/analytics_stats"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_error_dashboard
 version: !ruby/object:Gem::Version
-  version: 0.8.2
+  version: 0.8.3
 platform: ruby
 authors:
 - Anjan Jagirdar
@@ -57,20 +57,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.3.0
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: 1.3.7
+        version: '1.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.3.0
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: 1.3.7
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: rspec-rails
   requirement: !ruby/object:Gem::Requirement
@@ -226,13 +220,21 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0.15'
 description: 'Own your errors. Own your stack. A fully open-source, self-hosted error
-  tracking Rails engine for solo founders, indie hackers, and small teams. Exception
-  monitoring with beautiful dashboard UI, multi-channel notifications (Slack, Email,
-  Discord, PagerDuty), platform detection (iOS/Android/Web/API), advanced analytics,
-  workflow management, and cause chain capture. A self-hosted Sentry alternative with
-  5-minute setup that works out-of-the-box. Production error monitoring for Rails
-  7.0-8.1. BETA: API may change before v1.0.0. Live demo: https://rails-error-dashboard.anjan.dev
-  (gandalf/youshallnotpass)'
+  tracking Rails engine — a free Sentry alternative that runs entirely inside your
+  own process, with no external services and zero recurring cost. Captures what SaaS
+  tools charge extra for: local and instance variables at the moment of failure (via
+  TracePoint), exception cause chains, swallowed-exception detection, breadcrumbs,
+  and system-health snapshots (GC, memory, threads, connection pool, Puma). Plus N+1
+  query detection, storm protection (a circuit breaker that shields your app from
+  error floods, ON by default), multi-app support, error sampling, and async logging
+  via Sidekiq, SolidQueue, or GoodJob. Runs on SQLite, PostgreSQL, or MySQL/Trilogy
+  — in your app''s existing database or an isolated separate error database. Beautiful
+  dashboard UI (dark/light), multi-channel notifications (Slack, Email, Discord, PagerDuty,
+  webhooks), workflow management, advanced analytics, platform detection (iOS/Android/Web/API),
+  and two-way issue sync with GitHub, GitLab, Codeberg, and Linear. Also: LLM observability,
+  AI-powered debugging help, and OpenTelemetry span export. 5-minute setup, works
+  out-of-the-box. Rails 7.0-8.1, Ruby 3.2-4.0. BETA: API may change before v1.0.0.
+  Live demo: https://rails-error-dashboard.anjan.dev (gandalf/youshallnotpass)'
 email:
 - anjan.jagirdar@gmail.com
 executables: []
@@ -258,6 +260,7 @@ files:
 - app/jobs/rails_error_dashboard/discord_error_notification_job.rb
 - app/jobs/rails_error_dashboard/email_error_notification_job.rb
 - app/jobs/rails_error_dashboard/pagerduty_error_notification_job.rb
+- app/jobs/rails_error_dashboard/rack_attack_flush_job.rb
 - app/jobs/rails_error_dashboard/reopen_linked_issue_job.rb
 - app/jobs/rails_error_dashboard/retention_cleanup_job.rb
 - app/jobs/rails_error_dashboard/scheduled_digest_job.rb
@@ -277,6 +280,7 @@ files:
 - app/models/rails_error_dashboard/error_log.rb
 - app/models/rails_error_dashboard/error_logs_record.rb
 - app/models/rails_error_dashboard/error_occurrence.rb
+- app/models/rails_error_dashboard/rack_attack_event.rb
 - app/models/rails_error_dashboard/storm_event.rb
 - app/models/rails_error_dashboard/swallowed_exception.rb
 - app/views/layouts/rails_error_dashboard.html.erb
@@ -364,6 +368,7 @@ files:
 - db/migrate/20260326000001_add_issue_tracking_to_error_logs.rb
 - db/migrate/20260503000001_backfill_resolved_status.rb
 - db/migrate/20260613000001_create_storm_events.rb
+- db/migrate/20260730000001_create_rails_error_dashboard_rack_attack_events.rb
 - lib/generators/rails_error_dashboard/install/install_generator.rb
 - lib/generators/rails_error_dashboard/install/templates/README
 - lib/generators/rails_error_dashboard/install/templates/initializer.rb
@@ -381,6 +386,7 @@ files:
 - lib/rails_error_dashboard/commands/create_issue.rb
 - lib/rails_error_dashboard/commands/find_or_create_application.rb
 - lib/rails_error_dashboard/commands/find_or_increment_error.rb
+- lib/rails_error_dashboard/commands/flush_rack_attack_events.rb
 - lib/rails_error_dashboard/commands/flush_storm_counts.rb
 - lib/rails_error_dashboard/commands/flush_swallowed_exceptions.rb
 - lib/rails_error_dashboard/commands/increment_cascade_detection.rb
@@ -484,6 +490,7 @@ files:
 - lib/rails_error_dashboard/services/pearson_correlation.rb
 - lib/rails_error_dashboard/services/platform_detector.rb
 - lib/rails_error_dashboard/services/priority_score_calculator.rb
+- lib/rails_error_dashboard/services/rack_attack_tracker.rb
 - lib/rails_error_dashboard/services/rspec_generator.rb
 - lib/rails_error_dashboard/services/sensitive_data_filter.rb
 - lib/rails_error_dashboard/services/severity_classifier.rb
@@ -523,7 +530,7 @@ metadata:
   funding_uri: https://github.com/sponsors/AnjanJ
 post_install_message: |
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-    RED (Rails Error Dashboard) v0.8.2
+    RED (Rails Error Dashboard) v0.8.3
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 
   First install:
@@ -561,5 +568,6 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 3.6.9
 specification_version: 4
-summary: Self-hosted error tracking and exception monitoring for Rails. Free, forever.
+summary: Self-hosted error tracking for Rails — local variables, system health, separate
+  or shared database. A free, open-source Sentry alternative.
 test_files: []