safe_bro 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: c4906ce3efcad72d1fe0d51afcd111672739b28a722a4745bf4b012b8f611fda
+  data.tar.gz: ba294a2ffd0d1434f2dd99463a6f858fc8ea1be017dcd0a17217d199726d4a6c
+SHA512:
+  metadata.gz: 38c8fc9959f76ccc547f8a7aa661a36270a1239a1a53c6c8c75816e88516fd46dc1e33ac9f5b0d373102de83479c801eec7de54f42acc0631985655bebabbe39
+  data.tar.gz: e1d93726cfd4dde7107fd6f0abbc1cd08144203657178e04dfa139d313720909373bd57f71b1bff5507fa25f5d6d3dca31b105a0e1ffd38b722abf37b7c29557

data/MIT-LICENSE

@@ -0,0 +1,20 @@
+Copyright 2026 Ruby Dev SRL (https://www.rubydev.ro)
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,215 @@
+# SafeBro
+
+Audited, guarded Rails console access, with a built-in review UI. One gem.
+
+- **Records** every console session: who, why, and every command (encrypted at rest).
+- **Locks** sensitive data until the person runs `unlock!` and explains why: encrypted attributes, credentials, secret `ENV` values, key files, protected systems like Redis or Elasticsearch.
+- **Checks** each command before it runs: forbidden ones are blocked, suspicious ones are flagged.
+- **Protects its own audit trail** from the console.
+- **Lets auditors review** sessions in a built-in UI: approve, or flag with notes. It's a section of the [BroHub](https://github.com/rubydevro/bro_hub) dashboard, the same shell [EnvBro](https://github.com/rubydevro/env_bro) uses.
+
+It covers what [console1984](https://github.com/basecamp/console1984) and [audits1984](https://github.com/basecamp/audits1984) do together, rebuilt from scratch as a single gem. Rails 7.1+, Ruby 3.2+, IRB 1.13+.
+
+> **Read [What this is not](#what-this-is-not).** SafeBro is a deterrent and an audit trail. It is not a sandbox.
+
+## Install
+
+```ruby
+gem "safe_bro"
+```
+
+```sh
+bin/rails generate safe_bro:install   # BroHub (mount + initializer), then SafeBro's initializer and migrations. --mount-path=/bro_hub skips the question
+bin/rails db:migrate
+```
+
+The generator pulls in [BroHub](https://github.com/rubydevro/bro_hub) (a dependency) and mounts it once:
+
+```ruby
+mount BroHub::Engine => "/bro_hub"   # the review UI is at /bro_hub/safe_bro
+```
+
+Then in `config/initializers/safe_bro.rb` say who may review sessions:
+
+```ruby
+SafeBro.configure do |config|
+  config.can_audit = ->(user) { user.admin? }
+end
+```
+
+### One dashboard for all the Bro gems
+
+SafeBro shows up as a **SafeBro · audit** section in BroHub's sidebar (Sessions, Flagged commands, Unlocks, Rules), only for people who pass `can_audit`. Who is signed in is configured **once**, in BroHub (`BroHub.configure { |c| c.current_user = ... }`, which by default calls `current_user` on your `ApplicationController`). SafeBro uses that unless you set `config.current_user` / `config.user_label` yourself.
+
+- SafeBro works with just BroHub installed. Add [EnvBro](https://github.com/rubydevro/env_bro) and it appears as a second section, with no extra mount or setup.
+- Already mounting `SafeBro::Engine` yourself? That keeps working: you get the same look with only the SafeBro section. Remove your mount to join the dashboard.
+
+By default SafeBro acts only in `production`. Nothing is installed by loading the gem; protection starts when a console starts (`config.protected_environments` to change it).
+
+### Telling SafeBro who is at the console
+
+SafeBro reads the user from `CONSOLE_USER`. **A name is only as trustworthy as whatever sets it.** Prefer the server setting it, not the client:
+
+```
+# ~/.ssh/authorized_keys on the server, one line per person
+environment="CONSOLE_USER=jane" ssh-ed25519 AAAA... jane@laptop
+```
+
+(needs `PermitUserEnvironment yes` in `sshd_config`). A client-side `SetEnv CONSOLE_USER=...` works too, but then anyone can claim to be anyone.
+
+With no `CONSOLE_USER` the console refuses to start. Use `config.username_resolver = -> { ... }` to resolve it another way, or `config.ask_for_username_if_empty = true` to ask on the terminal.
+
+## What it looks like
+
+```
+$ rails console
+
+You have access to production data here. That's a big deal. ...
+
+jane, why are you using this console today?
+> Fixing invoice 12, ticket #4521
+
+myapp(prod):001> Invoice.find(12).customer.email
+=> "{\"p\":\"iu6+LfnNlurC6sL++J...\"}"   # an encrypted attribute, shown as ciphertext while locked
+
+myapp(prod):002> ENV["STRIPE_SECRET_KEY"]
+SafeBro: flagged for review - Access to env is protected. (STRIPE_SECRET_KEY) Run unlock! ...
+
+myapp(prod):003> unlock! :env
+Before you access sensitive data ... say why and where we can find the consent or ticket.
+> Ticket #4521: customer asked us to rotate their key
+
+Unlocked. We pay extra close attention to everything you do now. Type lock! to protect it again.
+```
+
+Commands:
+
+| Command | What it does |
+| --- | --- |
+| `unlock!` | Unlock everything. Asks for a justification and records it. |
+| `unlock! :credentials` | Unlock only some resources (`encrypted_data`, `credentials`, `env`, `files`, `network`). |
+| `lock!` | Lock again. |
+
+Everything typed while unlocked is linked to that justification in the review UI.
+
+## What is protected
+
+| Resource | While locked |
+| --- | --- |
+| `encrypted_data` | Active Record encrypted attributes read as ciphertext, and can't be written. (Needs Active Record Encryption in your app.) |
+| `credentials` | `Rails.application.credentials`, `secret_key_base`, `key_generator`, `message_verifier`, and the encrypted file/key classes raise when called from the console. |
+| `env` | `ENV["SOME_SECRET"]` raises for names matching `config.protected_env_patterns`. Dumping `ENV` (`to_h`, `each`, `inspect`, ...) filters those values. |
+| `files` | `master.key`, `credentials/*.key` and `.env*` files can't be read or copied (`File`, `IO`, `Pathname`, `open`, `FileUtils`). |
+| `network` | Connections to `config.protected_urls` fail, including writes on connections opened earlier (a pool). |
+
+Library code is not affected: Rails reading its credentials while it runs your command works. Only calls made **directly from what the person typed** are blocked (SafeBro tells them apart by the file name IRB evaluates code under), except `network` and `inspect`, which apply to anything running during a command.
+
+## Guardrails
+
+Each command is checked before it runs:
+
+- **Blocked**: reopening protected classes (`class ActiveRecord::Base`, ...), referencing `SafeBro`/`IRB`/`ObjectSpace`, and calling `eval`, `instance_eval`, `class_eval`, `system`, `exec`, `spawn`, backticks, `IO.popen`, ...
+- **Flagged**: commands that mention `secret`, `credentials`, `ENV`, `master.key`, ... run, but are marked suspicious.
+- **Runtime backstops** for the obvious ways around static checks: `send(:eval, ...)`, `Object.const_get("Safe" + "Bro")`, `"SafeBro".constantize`, and so on.
+- **The audit trail can't be touched**: any SQL mentioning SafeBro's tables from the console raises.
+- **Frozen internals**: SafeBro's classes and config are frozen once installed, so they can't be monkey patched.
+
+All of it is configurable:
+
+```ruby
+config.forbidden_methods += [ "Kernel#open" ]          # "Owner#method" or "Owner.method"
+config.forbidden_constants[:locked] += [ "Net::HTTP" ] # only while locked (or :always)
+config.suspicious_terms += [ "DROP TABLE" ]
+config.protected_resources = %i[ encrypted_data credentials env ]
+config.protected_urls = [ "redis://cache.internal:6379" ]
+config.protected_env_patterns += [ /STRIPE/ ]
+config.protected_file_patterns += [ %r{config/.*\.pem\z} ]
+```
+
+## Reviewing sessions
+
+Mount point is chosen by the generator (default `/bro_hub`, SafeBro at `/bro_hub/safe_bro`). The sidebar has four pages:
+
+- **Sessions**: a filterable list (review tab, user, dates, "needs attention" = unlocked or flagged commands). Open one to read what happened, and approve it or flag it with notes. After deciding you land on the next pending session within the same filter.
+- **Flagged commands**: every command that was blocked or ran and looked suspicious, newest first, each linking to its session.
+- **Unlocks**: who unlocked sensitive data, which resources, and the reason they gave.
+- **Rules**: a read-only view of what's locked, blocked and flagged right now (never keys or URL passwords). Change it in the initializer.
+
+- Audits are append-only; the latest one decides the status and the history is kept.
+- An auditor can't review their own session (`config.allow_self_audit = true` to allow).
+- Command text and audit notes are encrypted at rest with a key derived from `secret_key_base` (or `config.encryption_key`, 32 bytes).
+- The UI sends `Cache-Control: no-store` and requires SSL in production.
+- Hiding the section from someone is navigation only: every SafeBro page checks `can_audit` itself.
+
+### Notifications
+
+SafeBro instruments `ActiveSupport::Notifications`, so alerting is yours to wire up:
+
+```ruby
+ActiveSupport::Notifications.subscribe(/\.safe_bro\z/) do |name, _start, _finish, _id, payload|
+  # session_started, unlocked, command_flagged, session_flagged
+  SecurityMailer.console_event(name, payload).deliver_later
+end
+```
+
+### Retention
+
+Sessions older than `config.retention` (90 days) are removed, flagged ones are kept (`config.keep_flagged`). Schedule `SafeBro::PurgeJob` (daily) or run `bin/rails safe_bro:purge`. `config.retention = nil` keeps everything.
+
+### `rails runner`
+
+`config.audit_runner = true` also records `rails runner` invocations as sessions (`CONSOLE_USER` and `CONSOLE_REASON` are used if set). Runners aren't shielded; they run scripts, not a person exploring.
+
+### Non-interactive consoles
+
+With no terminal there is nobody to ask, so set `CONSOLE_REASON` (e.g. `CONSOLE_REASON="deploy check" rails console`). `unlock!` always needs a terminal.
+
+## For gem authors
+
+Anything sensitive your gem exposes can use the same lock:
+
+```ruby
+config.protected_resources += [ :billing ]   # host app config
+
+SafeBro.guard!(:billing)                     # in your code, before revealing something
+```
+
+`SafeBro.guard!` does nothing outside a console command, and raises `SafeBro::ProtectedResource` inside one until the person runs `unlock! :billing`.
+
+## What this is not
+
+Ruby is too dynamic to sandbox. Someone determined who has a console on your production box can get around the static checks and the runtime guards, for example by reading process memory, speaking to the database driver directly, using `dbconsole`, or loading code from disk. SafeBro raises the cost, catches mistakes, makes honest people stop and explain, and leaves a record that dishonest attempts show up in. That's valuable, but it's not a boundary.
+
+If you need a boundary, build it outside Ruby:
+
+- Don't leave the credentials key on machines people shell into. Deliver it to the app process only.
+- Give console users a database role that can't read what they shouldn't.
+- Control who can SSH in, and set `CONSOLE_USER` from the server side.
+- Have an auditor actually review sessions. An unreviewed audit trail deters nothing.
+
+Not covered: `rails dbconsole`, a raw `psql`/`mysql` session, other process managers or shells, and Pry (SafeBro hooks IRB).
+
+## Differences from console1984 + audits1984
+
+- One gem, one engine, one migration set (no shared base-model coupling between two gems), and a UI that plugs into the same dashboard as the other Bro gems.
+- Rails credentials, `ENV` and key files are first-class protected resources, not just encrypted attributes.
+- `unlock!` can be scoped to a resource, and gem authors can add their own with `SafeBro.guard!`.
+- Commands are encrypted with SafeBro's own key, so Active Record Encryption needn't be configured to use it (it's only needed for the `encrypted_data` protection).
+- Static checks use Ruby's tokenizer rather than a parser, so code that doesn't parse can't hide a name from them.
+- Audits are append-only with history, auditors can't approve themselves, and flagged sessions survive retention.
+- `rails runner` sessions can be recorded; notifications are `ActiveSupport::Notifications`.
+- Not carried over: Pry and other console support (SafeBro hooks IRB only).
+
+## Development
+
+```sh
+bin/rails test                                                    # Rails 8.x
+BUNDLE_GEMFILE=gemfiles/rails_7_1.gemfile bundle exec rails test  # Rails 7.1
+bin/rubocop
+```
+
+The suite includes tests that boot a real `rails console` in `test/dummy`, one with piped input and one driven through a pseudo-terminal, to prove the IRB hook works on the IRB you have.
+
+## License
+
+MIT.

data/Rakefile

@@ -0,0 +1,3 @@
+require "bundler/setup"
+
+require "bundler/gem_tasks"

data/app/controllers/safe_bro/application_controller.rb

@@ -0,0 +1,50 @@
+module SafeBro
+  class ApplicationController < SafeBro.config.parent_controller.constantize
+    include BroHub::Layout
+    bro_hub_section :safe_bro
+
+    protect_from_forgery with: :exception
+
+    before_action :safe_bro_require_ssl
+    before_action :safe_bro_no_store
+    before_action :safe_bro_authorize!
+
+    helper_method :safe_bro_user, :safe_bro_user_label
+
+    rescue_from SafeBro::Error, with: :safe_bro_forbidden
+
+    private
+      # The shell shows who is signed in, by SafeBro's rules.
+      def bro_hub_user
+        safe_bro_user
+      end
+
+      def safe_bro_user
+        return @safe_bro_user if defined?(@safe_bro_user)
+
+        @safe_bro_user = SafeBro.config.current_user.call(self)
+      end
+
+      def safe_bro_user_label
+        SafeBro.config.user_label.call(safe_bro_user) if safe_bro_user
+      end
+
+      def safe_bro_authorize!
+        raise SafeBro::Error, "Not allowed" unless safe_bro_user && SafeBro.config.can_audit.call(safe_bro_user)
+      end
+
+      def safe_bro_require_ssl
+        head :forbidden if SafeBro.config.require_ssl && !request.ssl?
+      end
+
+      # Sessions contain what people typed in production: keep it out of caches.
+      def safe_bro_no_store
+        response.headers["Cache-Control"] = "no-store"
+        response.headers["Pragma"] = "no-cache"
+      end
+
+      def safe_bro_forbidden
+        render "safe_bro/shared/forbidden", status: :forbidden
+      end
+  end
+end

data/app/controllers/safe_bro/audits_controller.rb

@@ -0,0 +1,35 @@
+module SafeBro
+  class AuditsController < ApplicationController
+    def create
+      session = Session.find(params[:session_id])
+      if !SafeBro.config.allow_self_audit && safe_bro_user_label.to_s == session.username
+        return redirect_to session_path(session), alert: "You can't audit your own session."
+      end
+
+      audit = session.audits.new(audit_params.merge(auditor: safe_bro_user_label))
+      if audit.save
+        redirect_to next_path_after(session), notice: "Session ##{session.id} #{audit.status}."
+      else
+        redirect_to session_path(session, filter_params), alert: audit.errors.full_messages.to_sentence
+      end
+    end
+
+    private
+      def audit_params
+        params.require(:audit).permit(:status, :notes)
+      end
+
+      def filter_params
+        params.permit(:attention, :username, :from, :to).to_h.symbolize_keys.merge(status: params[:filter_status]).compact_blank
+      end
+
+      # After deciding, move on to the next session still waiting, within the same filter.
+      def next_path_after(session)
+        scope = Session.review_pending.where.not(id: session.id)
+        scope = scope.needing_attention if params[:attention] == "1"
+        scope = scope.where(username: params[:username]) if params[:username].present?
+        following = scope.chronological.first
+        following ? session_path(following, filter_params) : root_path(status: params[:filter_status].presence || "pending")
+      end
+  end
+end

data/app/controllers/safe_bro/flagged_commands_controller.rb

@@ -0,0 +1,14 @@
+module SafeBro
+  # Every command that was blocked or flagged, newest first.
+  class FlaggedCommandsController < ApplicationController
+    PER_PAGE = SafeBro::ApplicationHelper::PER_PAGE
+
+    def index
+      @page = [ params[:page].to_i, 0 ].max
+      scope = Command.flagged
+      @total = scope.count
+      @commands = scope.includes(:session).order(created_at: :desc, id: :desc).limit(PER_PAGE).offset(@page * PER_PAGE)
+      @blocked_total = Command.blocked.count
+    end
+  end
+end

data/app/controllers/safe_bro/rules_controller.rb

@@ -0,0 +1,18 @@
+module SafeBro
+  # What SafeBro blocks, flags and locks right now. Read only: change it in the initializer.
+  class RulesController < ApplicationController
+    def show
+      @config = SafeBro.config
+      @protected_hosts = @config.protected_urls.filter_map { |url| host_of(url) }
+    end
+
+    private
+      # Only host and port: a URL can carry a password.
+      def host_of(url)
+        uri = URI.parse(url.to_s.include?("://") ? url.to_s : "tcp://#{url}")
+        [ uri.host, uri.port ].compact.join(":").presence
+      rescue URI::InvalidURIError
+        "(unreadable URL)"
+      end
+  end
+end

data/app/controllers/safe_bro/sessions_controller.rb

@@ -0,0 +1,67 @@
+module SafeBro
+  class SessionsController < ApplicationController
+    PER_PAGE = SafeBro::ApplicationHelper::PER_PAGE
+    STATUSES = %w[ pending approved flagged ].freeze
+
+    helper_method :filter_params
+
+    def index
+      @filter = filter_params
+      @sessions = filtered_sessions.chronological.limit(PER_PAGE).offset(page * PER_PAGE)
+      @total = filtered_sessions.count
+      @page = page
+      load_counts
+    end
+
+    def show
+      @session = Session.find(params[:id])
+      @commands = @session.commands.includes(:sensitive_access).chronological
+      @audits = @session.audits.order(:id)
+      @can_audit_this = can_audit?(@session)
+      @next_session = filtered_sessions.review_pending.where.not(id: @session.id).chronological.first
+    end
+
+    private
+      # One query each, instead of two per row, plus the totals for the page heading.
+      def load_counts
+        ids = @sessions.map(&:id)
+        @unlock_counts = SensitiveAccess.where(session_id: ids).group(:session_id).count
+        @flag_counts = Command.flagged.where(session_id: ids).group(:session_id).count
+        matching = filtered_sessions.select(:id)
+        @unlock_total = SensitiveAccess.where(session_id: matching).count
+        @flag_total = Command.flagged.where(session_id: matching).count
+      end
+
+      def filtered_sessions
+        scope = Session.all
+        scope = scope.where(review_status: filter_params[:status]) if STATUSES.include?(filter_params[:status])
+        scope = scope.needing_attention if filter_params[:attention] == "1"
+        scope = scope.where(username: filter_params[:username]) if filter_params[:username].present?
+        scope = scope.on_or_after(parse_date(filter_params[:from]).beginning_of_day) if parse_date(filter_params[:from])
+        scope = scope.before(parse_date(filter_params[:to]).end_of_day) if parse_date(filter_params[:to])
+        scope
+      end
+
+      def filter_params
+        @filter_params ||= begin
+          permitted = params.permit(:status, :attention, :username, :from, :to).to_h.symbolize_keys
+          permitted[:status] = "pending" unless params.key?(:status)
+          permitted.compact_blank
+        end
+      end
+
+      def page
+        [ params[:page].to_i, 0 ].max
+      end
+
+      def parse_date(value)
+        Date.iso8601(value.to_s) if value.present?
+      rescue ArgumentError
+        nil
+      end
+
+      def can_audit?(session)
+        SafeBro.config.allow_self_audit || safe_bro_user_label.to_s != session.username
+      end
+  end
+end

data/app/controllers/safe_bro/unlocks_controller.rb

@@ -0,0 +1,14 @@
+module SafeBro
+  # Every time someone unlocked sensitive data, with the reason they gave.
+  class UnlocksController < ApplicationController
+    PER_PAGE = SafeBro::ApplicationHelper::PER_PAGE
+
+    def index
+      @page = [ params[:page].to_i, 0 ].max
+      @total = SensitiveAccess.count
+      @unlocks = SensitiveAccess.includes(:session).order(started_at: :desc, id: :desc).limit(PER_PAGE).offset(@page * PER_PAGE)
+      @command_counts = Command.where(sensitive_access_id: @unlocks.map(&:id)).group(:sensitive_access_id).count
+      @open_total = SensitiveAccess.where(ended_at: nil).count
+    end
+  end
+end

data/app/helpers/safe_bro/application_helper.rb

@@ -0,0 +1,59 @@
+module SafeBro
+  module ApplicationHelper
+    PER_PAGE = 50
+
+    REVIEW_LABELS = { "pending" => "Pending", "approved" => "Appropriate", "flagged" => "Flagged" }.freeze
+    REVIEW_TONES = { "pending" => "muted", "approved" => "green", "flagged" => "red" }.freeze
+
+    def safe_bro_time(time)
+      return "-" unless time
+
+      content_tag(:time, time.utc.strftime("%Y-%m-%d %H:%M"), datetime: time.iso8601, title: time.utc.to_s)
+    end
+
+    def safe_bro_duration(seconds)
+      return "#{seconds}s" if seconds < 60
+      return "#{seconds / 60}m" if seconds < 3600
+
+      "#{seconds / 3600}h #{seconds % 3600 / 60}m"
+    end
+
+    def safe_bro_review_label(status)
+      REVIEW_LABELS.fetch(status.to_s, status.to_s.capitalize)
+    end
+
+    def safe_bro_review_tone(status)
+      REVIEW_TONES.fetch(status.to_s, "muted")
+    end
+
+    # Coloured review status, as text.
+    def review_status_text(status)
+      content_tag(:span, safe_bro_review_label(status), class: "bh-status bh-tone-#{safe_bro_review_tone(status)}")
+    end
+
+    def command_flag(command)
+      case command.status
+      when "blocked" then content_tag(:span, "Blocked", class: "bh-flag")
+      when "suspicious" then content_tag(:span, "Flagged", class: "bh-flag")
+      end
+    end
+
+    def safe_bro_count(count, singular, plural = singular.pluralize)
+      "#{count} #{count == 1 ? singular : plural}"
+    end
+
+    # "← Newer / Older →" for pages of PER_PAGE rows. `page` counts from 0.
+    def safe_bro_pager(total:, page:, noun:)
+      newer = link_to("← Newer", url_for(request.query_parameters.merge(page: page - 1))) if page > 0
+      older = link_to("Older →", url_for(request.query_parameters.merge(page: page + 1))) if (page + 1) * PER_PAGE < total
+      content_tag(:div, class: "bh-meta", style: "display:flex;justify-content:space-between;gap:16px;margin-top:14px") do
+        safe_join([ content_tag(:span, safe_bro_count(total, noun)), content_tag(:span, safe_join([ newer, older ].compact, " ")) ])
+      end
+    end
+
+    # Short, readable text for a list of config values (never raw secrets: callers pass patterns and names).
+    def safe_bro_rule(value)
+      value.respond_to?(:source) ? value.inspect : value.to_s
+    end
+  end
+end

data/app/jobs/safe_bro/purge_job.rb

@@ -0,0 +1,10 @@
+module SafeBro
+  # Schedule this (daily is plenty) to enforce config.retention.
+  class PurgeJob < ActiveJob::Base
+    queue_as :default
+
+    def perform
+      SafeBro::Session.purge!
+    end
+  end
+end

data/app/models/safe_bro/application_record.rb

@@ -0,0 +1,6 @@
+module SafeBro
+  class ApplicationRecord < ActiveRecord::Base
+    self.abstract_class = true
+    self.table_name_prefix = "safe_bro_"
+  end
+end

data/app/models/safe_bro/audit.rb

@@ -0,0 +1,19 @@
+require "safe_bro/encrypted_type"
+
+module SafeBro
+  # An auditor's verdict on a session. Audits are append-only: re-auditing adds a new row,
+  # so the history of who decided what is kept.
+  class Audit < ApplicationRecord
+    belongs_to :session
+
+    enum :status, { approved: 1, flagged: 2 }
+
+    attribute :notes, SafeBro::EncryptedType.new
+
+    validates :auditor, presence: true
+    validates :notes, presence: true, if: :flagged?
+
+    after_create { session.update!(review_status: status) }
+    after_create { SafeBro.notify(:session_flagged, session: session, auditor: auditor, notes: notes) if flagged? }
+  end
+end

data/app/models/safe_bro/command.rb

@@ -0,0 +1,20 @@
+require "safe_bro/encrypted_type"
+
+module SafeBro
+  class Command < ApplicationRecord
+    belongs_to :session
+    belongs_to :sensitive_access, optional: true
+
+    attribute :statements, SafeBro::EncryptedType.new
+
+    # executed: ran normally. suspicious: ran, but flagged. blocked: never ran.
+    enum :status, { executed: 0, suspicious: 1, blocked: 2 }
+
+    scope :flagged, -> { where(status: [ statuses[:suspicious], statuses[:blocked] ]) }
+    scope :chronological, -> { order(:created_at, :id) }
+
+    def flagged?
+      suspicious? || blocked?
+    end
+  end
+end

data/app/models/safe_bro/sensitive_access.rb

@@ -0,0 +1,13 @@
+module SafeBro
+  # A window during which the console was unlocked, with the justification given for it.
+  class SensitiveAccess < ApplicationRecord
+    belongs_to :session
+    has_many :commands, dependent: :nullify
+
+    validates :justification, :resources, :started_at, presence: true
+
+    def open?
+      ended_at.nil?
+    end
+  end
+end

data/app/models/safe_bro/session.rb

@@ -0,0 +1,52 @@
+module SafeBro
+  # One console session: who, why, from where, and everything they did.
+  class Session < ApplicationRecord
+    has_many :commands, dependent: :delete_all
+    has_many :sensitive_accesses, dependent: :delete_all
+    has_many :audits, dependent: :delete_all
+
+    # The latest audit decides the status.
+    enum :review_status, { pending: 0, approved: 1, flagged: 2 }, prefix: :review
+
+    validates :username, :reason, :started_at, presence: true
+
+    scope :chronological, -> { order(started_at: :desc, id: :desc) }
+    scope :on_or_after, ->(time) { where(started_at: time..) }
+    scope :before, ->(time) { where(started_at: ...time) }
+
+    # Sessions that deserve a look: someone unlocked sensitive data or a command was flagged.
+    scope :needing_attention, -> {
+      where(id: SensitiveAccess.select(:session_id)).or(where(id: Command.flagged.select(:session_id)))
+    }
+
+    # Sessions that nobody has audited, and aren't empty housekeeping.
+    scope :awaiting_review, -> { where(review_status: :pending) }
+
+    class << self
+      # Deletes old sessions and everything under them. Flagged ones stay unless told otherwise.
+      def purge!(older_than: SafeBro.config.retention, keep_flagged: SafeBro.config.keep_flagged)
+        return 0 if older_than.nil?
+
+        scope = where(started_at: ...older_than.ago)
+        scope = scope.where.not(review_status: :flagged) if keep_flagged
+        scope.find_each.sum { |session| session.destroy ? 1 : 0 }
+      end
+    end
+
+    def sensitive?
+      sensitive_accesses.exists? || commands.flagged.exists?
+    end
+
+    def open?
+      ended_at.nil?
+    end
+
+    def duration
+      ((ended_at || Time.current) - started_at).to_i
+    end
+
+    def last_audit
+      audits.order(:id).last
+    end
+  end
+end

data/app/views/safe_bro/flagged_commands/index.html.erb

@@ -0,0 +1,22 @@
+<% bro_hub_crumb "Flagged commands" %>
+<%= bro_hub_hero eyebrow: "Flagged commands", title: @total, tone: (:red if @total > 0), subtitle: (@total == 1 ? "command" : "commands"),
+      lead: "Everything that was blocked before it ran, or that ran and looked suspicious. Newest first.",
+      stats: [ [ @blocked_total, "blocked", :red ], [ @total - @blocked_total, "ran, flagged", :amber ] ] %>
+
+<div class="bh-table-wrap">
+  <div class="bh-table" style="--cols: 150px 120px minmax(240px,1.2fr) minmax(200px,1fr) 90px 80px; --min: 940px">
+    <div class="bh-row is-head"><span>When</span><span>User</span><span>Command</span><span>Why</span><span>Outcome</span><span>Session</span></div>
+    <% @commands.each do |command| %>
+      <%= link_to session_path(command.session_id), class: "bh-row bh-edge-red" do %>
+        <span class="bh-tone-violet"><%= safe_bro_time(command.created_at) %></span>
+        <span class="bh-cell-strong"><%= command.session.username %></span>
+        <span style="overflow-wrap:anywhere"><%= truncate(command.statements.to_s, length: 140) %></span>
+        <span class="bh-cell-text"><%= command.flag_reason %></span>
+        <span class="bh-status <%= command.blocked? ? "bh-tone-red" : "bh-tone-amber" %>"><%= command.blocked? ? "Blocked" : "Ran" %></span>
+        <span class="bh-tone-violet">#<%= command.session_id %></span>
+      <% end %>
+    <% end %>
+    <% if @commands.empty? %><div class="bh-empty">Nothing flagged.</div><% end %>
+    <%= safe_bro_pager total: @total, page: @page, noun: "flagged command" %>
+  </div>
+</div>