rails_nexus 2.0.6 → 2.1.2

data/app/views/rails_nexus/logged_exceptions/index.html.erb

@@ -13,103 +13,23 @@
     <% end %>
   </nav>
 
-  <%# ─── Stats Overview ──────────────────────────────────────── %>
-  <% if @stats %>
-    <div class="rn-stats">
-      <div class="rn-stat">
-        <span class="rn-stat-label">Total Exceptions</span>
-        <span class="rn-stat-value"><%= number_with_delimiter(@stats[:total]) %></span>
-        <span class="rn-stat-change">All time</span>
-      </div>
-      <div class="rn-stat">
-        <span class="rn-stat-label">This Week</span>
-        <span class="rn-stat-value <%= 'danger' if @stats[:this_week] > 10 %>"><%= @stats[:this_week] %></span>
-        <span class="rn-stat-change">Last 7 days</span>
-      </div>
-      <div class="rn-stat">
-        <span class="rn-stat-label">Today</span>
-        <span class="rn-stat-value <%= 'danger' if @stats[:today] > 5 %>"><%= @stats[:today] %></span>
-        <span class="rn-stat-change <%= 'up' if @stats[:today] > @stats[:yesterday] %>">
-          <% if @stats[:yesterday] > 0 %>
-            <%= ((@stats[:today].to_f / [@stats[:yesterday], 1].max - 1) * 100).round %>% vs yesterday
-          <% else %>
-            vs yesterday
-          <% end %>
-        </span>
-      </div>
-      <div class="rn-stat">
-        <span class="rn-stat-label">Unique Classes</span>
-        <span class="rn-stat-value"><%= @stats[:top_classes]&.size || 0 %></span>
-        <span class="rn-stat-change">Exception types</span>
-      </div>
-    </div>
-  <% end %>
-
-  <%# ─── User Impact Ranking ───────────────────────────────── %>
-  <% begin %>
-    <% if RailsNexus.configuration.user_impact_tracking %>
-      <% impact_data = RailsNexus::LoggedException.user_impact_ranking(limit: 5) %>
-      <% if impact_data.any? %>
-        <div class="rn-card">
-          <div class="p-4" style="border-bottom: 1px solid var(--rn-border-light)">
-            <div class="flex items-center gap-2">
-              <svg class="w-4 h-4" style="color: var(--rn-danger)" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor">
-                <path stroke-linecap="round" stroke-linejoin="round" d="M15 19.128a9.38 9.38 0 002.625.372 9.337 9.337 0 004.121-.952 4.125 4.125 0 00-7.533-2.493M15 19.128v-.003c0-1.113-.285-2.16-.786-3.07M15 19.128v.106A12.318 12.318 0 018.624 21c-2.331 0-4.512-.645-6.374-1.766l-.001-.109a6.375 6.375 0 0111.964-3.07M12 6.375a3.375 3.375 0 11-6.75 0 3.375 3.375 0 016.75 0zm8.25 2.25a2.625 2.625 0 11-5.25 0 2.625 2.625 0 015.25 0z" />
-              </svg>
-              <h2 class="text-sm font-semibold" style="color: var(--rn-text)">User Impact (Top 5)</h2>
-            </div>
-            <p class="text-xs mt-1" style="color: var(--rn-text-muted)">Errors ranked by unique users affected</p>
-          </div>
-          <div class="rn-table-wrap">
-            <table class="rn-table">
-              <thead>
-                <tr>
-                  <th>Exception</th>
-                  <th>Users Affected</th>
-                  <th>Occurrences</th>
-                  <th>Last Seen</th>
-                </tr>
-              </thead>
-              <tbody>
-                <% impact_data.each do |row| %>
-                  <tr>
-                    <td>
-                      <span class="rn-badge rn-badge-danger"><%= row.exception_class %></span>
-                      <span class="text-xs ml-1" style="color: var(--rn-text-muted)"><%= row.controller_name %>#<%= row.action_name %></span>
-                    </td>
-                    <td>
-                      <span class="font-bold" style="color: var(--rn-danger)"><%= row.unique_users %></span>
-                    </td>
-                    <td>
-                      <span style="color: var(--rn-text-secondary)"><%= row.total_occurrences %></span>
-                    </td>
-                    <td>
-                      <span class="text-xs" style="color: var(--rn-text-muted)"><%= row.last_seen&.strftime("%b %d %H:%M") %></span>
-                    </td>
-                  </tr>
-                <% end %>
-              </tbody>
-            </table>
-          </div>
-        </div>
-      <% end %>
-    <% end %>
-  <% rescue => e %>
-    <%# Silently ignore if user_id column doesn't exist yet %>
-  <% end %>
-
-  <%# ─── Filters Card ────────────────────────────────────────── %>
-  <div class="rn-card">
-    <%# Filter header with icon %>
-    <div class="rn-filters" style="padding-bottom: 0.5rem">
-      <div class="flex items-center gap-2">
+  <%# ─── Collapsible Filters ─────────────────────────────────── %>
+  <% pills = active_filter_pills %>
+  <section class="rn-card rn-exceptions-panel">
+  <div class="rn-exceptions-main" style="min-height: 400px">
+  <details class="rn-filter-disclosure" open>
+    <summary class="rn-filter-summary">
+      <span class="flex items-center gap-2">
         <svg class="w-4 h-4" style="color: var(--rn-text-muted)" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" d="M12 3c2.755 0 5.455.232 8.083.678.533.09.917.556.917 1.096v1.044a2.25 2.25 0 01-.659 1.591l-5.432 5.432a2.25 2.25 0 00-.659 1.591v2.927a2.25 2.25 0 01-1.244 2.013L9.75 21v-6.568a2.25 2.25 0 00-.659-1.591L3.659 7.409A2.25 2.25 0 013 5.818V4.774c0-.54.384-1.006.917-1.096A48.32 48.32 0 0112 3z" /></svg>
-        <span class="text-xs font-semibold uppercase tracking-wider" style="color: var(--rn-text-muted)">Filters</span>
-        <% if filtered? %>
-          <%= link_to "Clear all", logged_exceptions_path(per_page: params[:per_page]), class: "ml-auto text-xs font-medium", style: "color: var(--rn-primary)" %>
+        <span class="text-sm font-semibold" style="color: var(--rn-text)">Filters</span>
+        <% if pills.any? %>
+          <span class="rn-filter-count"><%= pills.size %> active</span>
+        <% else %>
+          <span class="text-xs" style="color: var(--rn-text-muted)">Search and narrow exceptions</span>
         <% end %>
-      </div>
-    </div>
+      </span>
+      <svg class="rn-filter-chevron w-4 h-4" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" d="M19.5 8.25L12 15.75 4.5 8.25" /></svg>
+    </summary>
 
     <%# Filter form %>
     <%= search_form_for @q, url: query_logged_exceptions_path, data: { turbo_frame: "exceptions" } do |f| %>
@@ -215,11 +135,13 @@
 
         <div class="flex items-center gap-2">
           <%= f.submit "Apply", class: "rn-btn rn-btn-primary" %>
+          <% if filtered? %>
+            <%= link_to "Clear", logged_exceptions_path(per_page: params[:per_page]), class: "rn-btn rn-btn-ghost" %>
+          <% end %>
         </div>
       </div>
 
       <%# Active filter pills %>
-      <% pills = active_filter_pills %>
       <% if pills.any? %>
         <div class="rn-filter-pills">
           <% pills.each do |pill| %>
@@ -231,11 +153,9 @@
         </div>
       <% end %>
     <% end %>
-  </div>
+  </details>
 
   <%# ─── Content Area ────────────────────────────────────────── %>
-  <div class="flex gap-4" style="min-height: 400px">
-
     <%# ─── Exception List ──────────────────────────────────── %>
     <div class="flex-1 min-w-0">
 
@@ -270,6 +190,8 @@
     </div>
   </div>
 
+  </section>
+
   <%# ─── Keyboard Shortcuts Dialog ───────────────────────────── %>
   <% if RailsNexus.configuration.keyboard_shortcuts %>
     <div class="rn-shortcuts-overlay" data-rails_nexus-target="shortcutsDialog" role="dialog" aria-modal="true" aria-labelledby="rn-shortcuts-title">

data/app/views/rails_nexus/stats/index.html.erb

@@ -339,7 +339,7 @@
                       </td>
                       <td>
                         <span class="text-sm" style="color: var(--rn-text-muted)">
-                          <%= table[:size_mb] > 0 ? "#{table[:size_mb]} MB" : "—" %>
+                          <%= table[:size_mb].to_f > 0 ? "#{table[:size_mb]} MB" : "—" %>
                         </span>
                       </td>
                       <td>

data/db/seeds/backup_configs.rb

@@ -18,8 +18,8 @@ configs = [
     database_name: "tti_erp",
     host: "localhost",
     port: 3306,
-    username: "root",
-    # password: "36B042D8948C4086F37FA@root",  # stored in mysql-config/cnf — set via env or UI
+    username: "ENV[DB_USERNAME]",
+    password: "ENV[DB_PASSWORD]",
     skip_tables: "tti_erp.logged_exceptions,tti_erp.sessions,tti_erp.versions",
 
     storage_path: "~/dumps",
@@ -58,7 +58,8 @@ configs = [
     database_name: "tti_erp",
     host: "localhost",
     port: 3306,
-    username: "root",
+    username: "ENV[DB_USERNAME]",
+    password: "ENV[DB_PASSWORD]",
     skip_tables: "",
 
     storage_path: "~/dumps",
@@ -92,7 +93,7 @@ configs = [
     database_name: "tti_erp",
     host: "localhost",
     port: 3306,
-    username: "root",
+    username: "ENV[DB_USERNAME]",
     skip_tables: "tti_erp.logged_exceptions,tti_erp.sessions,tti_erp.versions",
 
     storage_path: "~/dumps/sync",

data/lib/generators/rails_nexus/install_generator.rb

@@ -35,7 +35,7 @@ module RailsNexus
           content = File.read(destination_controller)
           unless content.include?("log_exception_handler")
             inject_into_class app_controller, "ApplicationController" do
-              "\n  rescue_from Exception, with: :log_exception_handler\n"
+              "\n  rescue_from StandardError, with: :log_exception_handler\n"
             end
           end
         end

data/lib/generators/rails_nexus/templates/INSTALL.md

@@ -7,3 +7,4 @@ Next steps:
 3. Visit `/rails_nexus` in the host application.
 
 The dashboard denies access until authentication is configured.
+The generator captures `StandardError` application failures and deliberately leaves fatal process and VM exceptions to Rails and Ruby.

data/lib/generators/rails_nexus/templates/migration.rb

@@ -114,7 +114,7 @@ class CreateRailsNexusTables < ActiveRecord::Migration[<%= "[#{ActiveRecord::Mig
 
     # ─── rails_nexus_backups ─────────────────────────────────────────
     create_table :rails_nexus_backups do |t|
-      t.string   :model_name,    null: false
+      t.string   :config_name,   null: false
       t.string   :status,        null: false
       t.text     :file_path
       t.bigint   :file_size
@@ -125,7 +125,7 @@ class CreateRailsNexusTables < ActiveRecord::Migration[<%= "[#{ActiveRecord::Mig
       t.datetime :completed_at
     end
 
-    add_index :rails_nexus_backups, [:model_name, :started_at]
+    add_index :rails_nexus_backups, [:config_name, :started_at]
     add_index :rails_nexus_backups, :status
     add_index :rails_nexus_backups, :started_at
 
@@ -148,6 +148,7 @@ class CreateRailsNexusTables < ActiveRecord::Migration[<%= "[#{ActiveRecord::Mig
       t.boolean :bzip2_compress, default: false
       t.boolean :encrypted,     default: false
       t.string  :encryption_password
+      t.boolean :encrypt_base64, default: false
       t.boolean :gpg_enabled,   default: false
       t.string  :gpg_password
 
@@ -157,6 +158,11 @@ class CreateRailsNexusTables < ActiveRecord::Migration[<%= "[#{ActiveRecord::Mig
       t.string  :rsync_user
       t.string  :rsync_path
       t.boolean :rsync_mirror,  default: false
+      t.boolean :rsync_archive, default: true
+      t.string  :rsync_directories
+      t.string  :rsync_excludes
+
+      t.string  :mysql_additional_options
 
       # S3 storage
       t.boolean :s3_enabled,    default: false

data/lib/generators/rails_nexus/templates/rails_nexus.rb

@@ -34,6 +34,9 @@ Rails.application.config.to_prepare do
     # config.webhooks = ["https://hooks.slack.com/services/xxx"]
     # config.webhook_timeout = 5
     # config.webhook_headers = { "Authorization" => "Bearer token" }
+    # config.webhook_allowed_hosts = ["hooks.example.com", "*.example.org"]
+    # config.webhook_denied_hosts = ["blocked.example.org"]
+    # config.webhook_allow_http_in_development = false
 
     # ─── Cleanup ─────────────────────────────────────────────
     # Auto-delete exceptions older than N days

data/lib/generators/rails_nexus/templates/views/layouts/rails_nexus/application.html.erb

@@ -7,7 +7,7 @@
   <title><%= content_for?(:title) ? yield(:title) : RailsNexus.configuration.application_name || "RailsNexus" %></title>
 
   <%= stylesheet_link_tag "rails_nexus/application", "data-turbo-track": "reload" %>
-  <%= javascript_importmap_tags "rails_nexus/application" %>
+  <%= javascript_include_tag "rails_nexus/application", defer: true, "data-turbo-track": "reload" %>
 
   <% if respond_to?(:turbo_refreshes_with) %>
     <%= turbo_refreshes_with method: :morph, scroll: :preserve %>

data/lib/rails_nexus/configuration.rb

@@ -49,6 +49,13 @@ module RailsNexus
     #   config.webhook_headers = { "Authorization" => "Bearer token123" }
     attr_accessor :webhook_headers
 
+    # Host allow/deny policies. Wildcards such as "*.example.com" are accepted.
+    attr_accessor :webhook_allowed_hosts
+    attr_accessor :webhook_denied_hosts
+
+    # HTTP remains disabled except when this is true and Rails.env is development.
+    attr_accessor :webhook_allow_http_in_development
+
     # ─── Logging ───────────────────────────────────────────────
 
     # Enable structured logging (default: true).
@@ -209,6 +216,9 @@ module RailsNexus
       @webhooks = []
       @webhook_timeout = 5
       @webhook_headers = {}
+      @webhook_allowed_hosts = []
+      @webhook_denied_hosts = []
+      @webhook_allow_http_in_development = false
 
       # Logging
       @logging_enabled = true

data/lib/rails_nexus/database_adapter.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module RailsNexus
+  module DatabaseAdapter
+    module_function
+
+    def family(connection = ActiveRecord::Base.connection)
+      name = connection.adapter_name.to_s.downcase
+      return :postgresql if name.include?("postgres")
+      return :mysql if name.include?("mysql") || name.include?("trilogy")
+      return :sqlite if name.include?("sqlite")
+
+      :unsupported
+    end
+
+    def time_bucket_expression(column: "created_at", period: :hour, connection: ActiveRecord::Base.connection)
+      column = connection.quote_column_name(column)
+
+      case [family(connection), period.to_sym]
+      when [:postgresql, :hour] then "TO_CHAR(DATE_TRUNC('hour', #{column}), 'YYYY-MM-DD HH24:00')"
+      when [:mysql, :hour] then "DATE_FORMAT(#{column}, '%Y-%m-%d %H:00')"
+      when [:sqlite, :hour] then "strftime('%Y-%m-%d %H:00', #{column})"
+      else
+        raise NotImplementedError, "Time grouping is not supported by this database adapter"
+      end
+    end
+
+    def time_component_expression(column: "created_at", component:, connection: ActiveRecord::Base.connection)
+      column = connection.quote_column_name(column)
+
+      case [family(connection), component.to_sym]
+      when [:postgresql, :hour] then "CAST(EXTRACT(HOUR FROM #{column}) AS INTEGER)"
+      when [:mysql, :hour] then "HOUR(#{column})"
+      when [:sqlite, :hour] then "CAST(strftime('%H', #{column}) AS INTEGER)"
+      when [:postgresql, :weekday] then "CAST(EXTRACT(DOW FROM #{column}) AS INTEGER)"
+      when [:mysql, :weekday] then "DAYOFWEEK(#{column}) - 1"
+      when [:sqlite, :weekday] then "CAST(strftime('%w', #{column}) AS INTEGER)"
+      else
+        raise NotImplementedError, "Time component grouping is not supported by this database adapter"
+      end
+    end
+
+    def database_version(connection = ActiveRecord::Base.connection)
+      case family(connection)
+      when :sqlite then connection.select_value("SELECT sqlite_version()")
+      when :postgresql, :mysql then connection.select_value("SELECT version()")
+      else "N/A"
+      end
+    rescue ActiveRecord::StatementInvalid
+      "N/A"
+    end
+  end
+end

data/lib/rails_nexus/engine.rb

@@ -11,8 +11,6 @@ module RailsNexus
     initializer "rails_nexus.assets", before: "propshaft.assets_middleware", group: :all do |app|
       next unless app.config.respond_to?(:assets)
 
-      app.config.assets.paths << root.join("app/javascript")
-
       # Sprockets 4 only compiles assets listed in a manifest or in the
       # precompile list. Register these here so mounting applications do not
       # need to modify their own asset manifest.
@@ -20,21 +18,10 @@ module RailsNexus
         app.config.assets.precompile += %w[
           rails_nexus/application.css
           rails_nexus/application.js
-          controllers/rails_nexus_controller.js
-          controllers/rails_nexus_detail_controller.js
-          controllers/rails_nexus_sidebar_controller.js
-          controllers/rails_nexus_theme_controller.js
         ]
       end
     end
 
-    # ─── Importmap support (for importmap-rails users) ────────────
-
-    initializer "rails_nexus.importmap", before: "importmap" do |app|
-      app.config.importmap.paths << root.join("config/importmap.rb")
-      app.config.importmap.cache_sweepers << root.join("app/javascript")
-    end
-
     # ─── Database connection (separate DB support) ─────────────────
 
     initializer "rails_nexus.database" do

data/lib/rails_nexus/logger.rb

@@ -170,18 +170,7 @@ module RailsNexus
       end
 
       def filter_params(params)
-        return {} unless params.is_a?(Hash)
-
-        rails_filters = Rails.application.config.filter_parameters
-        params.each_with_object({}) do |(key, value), result|
-          if rails_filters.any? { |f| key.to_s.include?(f.to_s) }
-            result[key] = "[FILTERED]"
-          elsif value.is_a?(Hash)
-            result[key] = filter_params(value)
-          else
-            result[key] = value
-          end
-        end
+        RailsNexus.filter_sensitive_data(params)
       end
     end
   end

data/lib/rails_nexus/notifications.rb

@@ -1,8 +1,7 @@
 # frozen_string_literal: true
 
-require "net/http"
-require "uri"
 require "json"
+require "rails_nexus/webhook_client"
 
 module RailsNexus
   module Notifications
@@ -28,28 +27,36 @@ module RailsNexus
         config.webhooks.each do |url|
           deliver_webhook(url, payload, config)
         rescue StandardError => e
-          Rails.logger.error("[RailsNexus] Webhook failed for #{url}: #{e.message}")
-          log_webhook_delivery(url: url, payload: payload, error: e.message, event_type: "exception.logged")
+          Rails.logger.error("[RailsNexus] Webhook delivery failed: #{e.class}")
+          log_webhook_delivery(
+            url: RailsNexus::WebhookClient.redacted_url(url),
+            payload: payload,
+            error: "Webhook delivery failed",
+            event_type: "exception.logged"
+          )
         end
       end
 
       def deliver_webhook(url, payload, config)
-        uri = URI(url)
-
-        http = Net::HTTP.new(uri.host, uri.port)
-        http.use_ssl = uri.scheme == "https"
-        http.open_timeout = config.webhook_timeout
-        http.read_timeout = config.webhook_timeout
-
-        request = Net::HTTP::Post.new(uri)
-        request["Content-Type"] = "application/json"
-        config.webhook_headers.each { |k, v| request[k] = v }
-        request.body = payload.to_json
-
-        response = http.request(request)
-
-        unless response.is_a?(Net::HTTPSuccess)
-          Rails.logger.error("[RailsNexus] Webhook #{url} returned #{response.code}")
+        logged_url = RailsNexus::WebhookClient.redacted_url(url)
+        result = RailsNexus::WebhookClient.deliver(
+          url: url,
+          payload: payload,
+          headers: config.webhook_headers,
+          timeout: config.webhook_timeout
+        )
+
+        if result[:success]
+          log_webhook_delivery(
+            url: logged_url,
+            payload: payload,
+            status_code: result[:status_code],
+            response_body: result[:body],
+            event_type: "exception.logged"
+          )
+        else
+          Rails.logger.error("[RailsNexus] Webhook delivery failed: #{result[:error]}")
+          log_webhook_delivery(url: logged_url, payload: payload, error: result[:error], event_type: "exception.logged")
         end
       end
 

data/lib/rails_nexus/version.rb

@@ -1,3 +1,3 @@
 module RailsNexus
-  VERSION = "2.0.6"
+  VERSION = "2.1.2"
 end

data/lib/rails_nexus/webhook_client.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require "json"
+require "net/http"
+require "openssl"
+require "socket"
+require "uri"
+
+module RailsNexus
+  class WebhookClient
+    class ValidationError < StandardError; end
+
+    BLOCKED_NETWORKS = %w[
+      0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16
+      172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 192.168.0.0/16
+      198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/4 240.0.0.0/4
+      ::/128 ::1/128 ::ffff:0:0/96 100::/64 2001:db8::/32 fc00::/7 fe80::/10 ff00::/8
+    ].map { |network| IPAddr.new(network) }.freeze
+
+    def self.deliver(url:, payload:, headers: {}, timeout: nil)
+      new(url: url, payload: payload, headers: headers, timeout: timeout).deliver
+    end
+
+    def self.redacted_url(url)
+      uri = URI.parse(url.to_s)
+      return "invalid-webhook-url" if uri.host.blank?
+
+      port = uri.port && uri.port != uri.default_port ? ":#{uri.port}" : ""
+      "#{uri.scheme}://#{uri.host}#{port}/[REDACTED]"
+    rescue URI::InvalidURIError
+      "invalid-webhook-url"
+    end
+
+    def initialize(url:, payload:, headers: {}, timeout: nil, resolver: nil, http_factory: nil)
+      @url = url.to_s
+      @payload = payload
+      @headers = headers || {}
+      @timeout = Integer(timeout || RailsNexus.configuration.webhook_timeout || 5)
+      @resolver = resolver || method(:resolve_addresses)
+      @http_factory = http_factory || ->(host, port) { Net::HTTP.new(host, port) }
+    end
+
+    def deliver
+      started_at = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      uri, address = validated_destination
+      http = build_http(uri, address)
+      response = http.request(build_request(uri))
+      status = response.code.to_i
+      duration = Process.clock_gettime(Process::CLOCK_MONOTONIC) - started_at
+
+      if status.between?(300, 399)
+        return failure("Webhook redirects are not allowed", status_code: response.code, duration: duration)
+      end
+
+      {
+        success: status.between?(200, 299),
+        status_code: response.code,
+        body: response.body.to_s.truncate(500),
+        duration: duration.round(3),
+        error: status.between?(200, 299) ? nil : "Webhook returned HTTP #{status}"
+      }
+    rescue ValidationError => error
+      failure(error.message)
+    rescue StandardError
+      failure("Webhook delivery failed")
+    end
+
+    private
+
+    def validated_destination
+      uri = URI.parse(@url)
+      allowed_schemes = ["https"]
+      if Rails.env.development? && RailsNexus.configuration.webhook_allow_http_in_development
+        allowed_schemes << "http"
+      end
+
+      raise ValidationError, "Webhook URL must use HTTPS" unless allowed_schemes.include?(uri.scheme)
+      raise ValidationError, "Webhook URL must include a hostname" if uri.host.blank?
+      raise ValidationError, "Webhook URL credentials are not allowed" if uri.userinfo.present?
+      validate_host_policy!(uri.host)
+
+      addresses = Array(@resolver.call(uri.host)).map { |address| IPAddr.new(address.to_s) }.uniq
+      raise ValidationError, "Webhook host could not be resolved" if addresses.empty?
+      raise ValidationError, "Webhook destination is not publicly routable" if addresses.any? { |address| blocked_address?(address) }
+
+      [uri, addresses.first.to_s]
+    rescue URI::InvalidURIError, IPAddr::InvalidAddressError
+      raise ValidationError, "Webhook URL is invalid"
+    rescue SocketError
+      raise ValidationError, "Webhook host could not be resolved"
+    end
+
+    def resolve_addresses(host)
+      Addrinfo.getaddrinfo(host, nil, :UNSPEC, :STREAM).map(&:ip_address)
+    end
+
+    def blocked_address?(address)
+      BLOCKED_NETWORKS.any? { |network| network.include?(address) }
+    end
+
+    def validate_host_policy!(host)
+      denied = Array(RailsNexus.configuration.webhook_denied_hosts)
+      allowed = Array(RailsNexus.configuration.webhook_allowed_hosts)
+
+      raise ValidationError, "Webhook hostname is denied" if denied.any? { |pattern| host_matches?(host, pattern) }
+      if allowed.any? && allowed.none? { |pattern| host_matches?(host, pattern) }
+        raise ValidationError, "Webhook hostname is not allowed"
+      end
+    end
+
+    def host_matches?(host, pattern)
+      candidate = pattern.to_s.downcase
+      actual = host.to_s.downcase
+      return actual.end_with?(candidate.delete_prefix("*")) if candidate.start_with?("*.")
+      actual == candidate
+    end
+
+    def build_http(uri, address)
+      http = @http_factory.call(uri.host, uri.port)
+      http.ipaddr = address
+      http.use_ssl = uri.scheme == "https"
+      http.verify_mode = OpenSSL::SSL::VERIFY_PEER if http.use_ssl?
+      http.open_timeout = @timeout
+      http.read_timeout = @timeout
+      http
+    end
+
+    def build_request(uri)
+      request = Net::HTTP::Post.new(uri.request_uri)
+      request["Host"] = uri.port == uri.default_port ? uri.host : "#{uri.host}:#{uri.port}"
+      request["Content-Type"] = "application/json"
+      @headers.each do |name, value|
+        validate_header!(name, value)
+        request[name.to_s] = value.to_s
+      end
+      request.body = @payload.to_json
+      request
+    end
+
+    def validate_header!(name, value)
+      if name.to_s.match?(/[\r\n]/) || value.to_s.match?(/[\r\n]/)
+        raise ValidationError, "Webhook header is invalid"
+      end
+    end
+
+    def failure(message, status_code: nil, duration: nil)
+      { success: false, error: message, status_code: status_code, duration: duration&.round(3) }
+    end
+  end
+end