sessions 0.1.3 → 0.2.2

data/docs/research/07-device-detection.md

@@ -1,6 +1,6 @@
 # Device intelligence: UA parsing, Hotwire Native, client hints, IP capture
 
-Researched 2026-06-11. Code citations are from read-only clones under `/tmp/sessions-research/` (browser, device_detector, hotwire-native-ios, hotwire-native-android, turbo-rails, rails-stable @ v8.1.3) and the local apps under `/Users/javi/GitHub/`. Web citations carry URL + fetch date.
+Researched 2026-06-11. Code citations are from read-only clones under `/tmp/sessions-research/` (browser, device_detector, hotwire-native-ios, hotwire-native-android, turbo-rails, rails-stable @ v8.1.3) and the local apps under `/path/to/repos/`. Web citations carry URL + fetch date.
 
 ## Top findings
 
@@ -11,7 +11,7 @@ Researched 2026-06-11. Code citations are from read-only clones under `/tmp/sess
 - **Android WebView is explicitly excluded from Chrome's UA reduction** ("We don't have current plans for User-Agent Reduction on iOS and Android WebView" — chromium.org/updates/ua-reduction, fetched 2026-06-10). So Hotwire Native **Android** UAs still carry real device model + real Android version. Hotwire Native **iOS** UAs carry real iOS version but never the hardware model.
 - **Web Chrome UAs are husks since 2023**: frozen `Windows NT 10.0`, `Intel Mac OS X 10_15_7`, `Linux; Android 10; K`, minor versions `0.0.0`. Real data moved to UA Client Hints — which **only Chromium ships; Safari and Firefox still refuse as of June 2026**.
 - **iPadOS masquerades as macOS by default** since iPadOS 13 — server-side, an iPad on Safari is byte-identical to a Mac. No fix without JS.
-- **Our four local apps customize the UA prefix today but none embeds app version or (iOS) device model** — the gem should ship a recommended prefix convention; CarHey's native HTTP client already proves the pattern (`"CarHey Android 1.0.5 (build 6; Android 14; sdk 34; Pixel 7)"`).
+- **Our four local apps customize the UA prefix today but none embeds app version or (iOS) device model** — the gem should ship a recommended prefix convention; HostApp's native HTTP client already proves the pattern (`"HostApp Android 1.0.5 (build 6; Android 14; sdk 34; Pixel 7)"`).
 - **`request.remote_ip` behind Cloudflare returns a Cloudflare edge IP** unless CF ranges are added to `trusted_proxies` (which *replaces* the private-range defaults) — document `cloudflare-rails` or an `ip_resolver` hook. Portable IP column: `string limit: 45`; `inet` is Postgres-only.
 
 ## A. Ruby UA parsers: `browser` vs `device_detector`
@@ -56,7 +56,7 @@ Researched 2026-06-11. Code citations are from read-only clones under `/tmp/sess
 1. **Always persist the raw UA in a `text` column** (no 255 limit) plus the relevant raw Client-Hint headers when present. Parsing is a *projection* that can be re-run as parsers/conventions improve. Validated by uniform prior art.
 2. **Hard dependency on `browser`** as the default web parser: MIT, zero-dep, tiny, Rails-aware, good enough for "Chrome 137 on macOS" + bot flagging. A drop-in gem needs device intel working with zero setup; an adapter-only design would gut the first-run experience.
 3. **Optional `device_detector` adapter** (auto-upgrade if the host app bundles it): better device names on legacy/Android UAs, native Client-Hints handling, much bigger bot DB. Don't hard-depend: LGPL, 1.5 MB data, 2-years-stale releases.
-4. **Built-in native-app UA parser that runs first** (before any web parser): recognizes `Hotwire Native iOS|Android`, `Turbo Native`, the recommended prefix convention below, and CarHey's existing shapes. This is the gem's actual moat; no third-party parser does it.
+4. **Built-in native-app UA parser that runs first** (before any web parser): recognizes `Hotwire Native iOS|Android`, `Turbo Native`, the recommended prefix convention below, and HostApp's existing shapes. This is the gem's actual moat; no third-party parser does it.
 5. Expose `config.ua_parser = :browser | :device_detector | ->(ua, headers) { DeviceInfo.new(...) }` for escape hatches, and stamp rows with parser identity/version if cheap (optional).
 
 ## B. Hotwire Native user agents
@@ -125,17 +125,17 @@ Substring contract: `"Turbo Native"` or `"Hotwire Native"` anywhere in the UA. T
 
 | App | Prefix set | Where | Effective UA shape |
 |---|---|---|---|
-| carhey-ios | `"CarHey iOS; RailsFast Native iOS;"` (`{App}` from `CFBundleDisplayName`) | `RailsFast/Core/AppConfiguration.swift:10-12`, applied `RailsFast/App/AppDelegate.swift:103` | `Mozilla/5.0 (iPhone; CPU iPhone OS x_y like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CarHey iOS; RailsFast Native iOS; Hotwire Native iOS; Turbo Native iOS; bridge-components: […]` |
+| hostapp-ios | `"HostApp iOS; RailsFast Native iOS;"` (`{App}` from `CFBundleDisplayName`) | `RailsFast/Core/AppConfiguration.swift:10-12`, applied `RailsFast/App/AppDelegate.swift:103` | `Mozilla/5.0 (iPhone; CPU iPhone OS x_y like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) HostApp iOS; RailsFast Native iOS; Hotwire Native iOS; Turbo Native iOS; bridge-components: […]` |
 | railsfast-ios | `"RailsFast iOS; RailsFast Native iOS;"` | `RailsFast/Core/AppConfiguration.swift:10-12`, `RailsFast/App/AppDelegate.swift:93-99` | same shape, `RailsFast` tokens |
-| carhey-android | `"CarHey Android;"` | `app/src/main/java/com/carhey/android/CarHeyApplication.kt:169` | `CarHey Android; Hotwire Native Android; Turbo Native Android; bridge-components: […]; Mozilla/5.0 (Linux; Android NN; <Model> Build/…; wv) … Chrome/NNN.0.0.0 Mobile Safari/537.36` |
+| hostapp-android | `"HostApp Android;"` | `app/src/main/java/com/hostapp/android/HostAppApplication.kt:169` | `HostApp Android; Hotwire Native Android; Turbo Native Android; bridge-components: […]; Mozilla/5.0 (Linux; Android NN; <Model> Build/…; wv) … Chrome/NNN.0.0.0 Mobile Safari/537.36` |
 | railsfast-android | `"${BuildConfig.APPLICATION_NAME} Android; RailsFast Native Android;"` | `app/src/main/java/com/railsfast/android/RailsFastApplication.kt:45-46` | same shape with two leading brand segments |
 
 So today: **no webview UA carries the app version anywhere, and iOS UAs carry no device model.** Android model/OS arrive free via the WebView default UA.
 
-However, CarHey's *native* (URLSession/OkHttp) calls already use a richer convention the gem should accept as prior art:
+However, HostApp's *native* (URLSession/OkHttp) calls already use a richer convention the gem should accept as prior art:
 
-- iOS: `"\(applicationName) iOS \(version) (build \(build); iOS \(osVersion); \(resolvedModel))"` → e.g. `CarHey iOS 1.0.5 (build 6; iOS 19.5; iPhone15,2)` (`carhey-ios/RailsFast/Core/NativeHttpClient.swift:61-71`), plus headers `X-Client-Platform/-Version/-Build/-OS` (`NativeHttpClient.swift:13-17`).
-- Android: `"CarHey Android $versionName (build $versionCode; Android $osRelease; sdk $sdkInt; $device)"` → e.g. `CarHey Android 1.0.5 (build 6; Android 14; sdk 34; Pixel 7)` (`carhey-android/app/src/main/java/com/carhey/android/ClientHeaders.kt:66-76`; header names `:25-29`).
+- iOS: `"\(applicationName) iOS \(version) (build \(build); iOS \(osVersion); \(resolvedModel))"` → e.g. `HostApp iOS 1.0.5 (build 6; iOS 19.5; iPhone15,2)` (`hostapp-ios/RailsFast/Core/NativeHttpClient.swift:61-71`), plus headers `X-Client-Platform/-Version/-Build/-OS` (`NativeHttpClient.swift:13-17`).
+- Android: `"HostApp Android $versionName (build $versionCode; Android $osRelease; sdk $sdkInt; $device)"` → e.g. `HostApp Android 1.0.5 (build 6; Android 14; sdk 34; Pixel 7)` (`hostapp-android/app/src/main/java/com/hostapp/android/ClientHeaders.kt:66-76`; header names `:25-29`).
 
 ### Recommended UA convention for the gem's README
 
@@ -143,11 +143,11 @@ Use an RFC 9110-style product token as the `applicationUserAgentPrefix`, ending
 
 ```text
 <AppName>/<version> (<model>; <os> <os_version>; build <build>);
-e.g.  CarHey/2.4.1 (iPhone15,2; iOS 19.5; build 241);
-e.g.  CarHey/2.4.1 (Pixel 8; Android 16; build 241);
+e.g.  HostApp/2.4.1 (iPhone15,2; iOS 19.5; build 241);
+e.g.  HostApp/2.4.1 (Pixel 8; Android 16; build 241);
 ```
 
-Parse rule (gem-side, tolerant): `%r{(?<app>[\w .-]+)/(?<version>\d[\w.]*) \((?<fields>[^)]*)\)}` with semicolon-split, order-insensitive fields; also accept CarHey's space-separated legacy `"CarHey iOS 1.0.5 (build 6; …)"`. Everything else (Hotwire markers, WebView UA) stays intact, so `hotwire_native_app?` and bridge components keep working.
+Parse rule (gem-side, tolerant): `%r{(?<app>[\w .-]+)/(?<version>\d[\w.]*) \((?<fields>[^)]*)\)}` with semicolon-split, order-insensitive fields; also accept HostApp's space-separated legacy `"HostApp iOS 1.0.5 (build 6; …)"`. Everything else (Hotwire markers, WebView UA) stays intact, so `hotwire_native_app?` and bridge components keep working.
 
 README client snippets:
 
@@ -156,7 +156,7 @@ README client snippets:
 ```swift
 var u = utsname(); uname(&u)
 let model = withUnsafeBytes(of: &u.machine) { String(decoding: $0.prefix(while: { $0 != 0 }), as: UTF8.self) }
-Hotwire.config.applicationUserAgentPrefix = "CarHey/\(Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "0") (\(model); iOS \(UIDevice.current.systemVersion));"
+Hotwire.config.applicationUserAgentPrefix = "HostApp/\(Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "0") (\(model); iOS \(UIDevice.current.systemVersion));"
 ```
 
 (`model` is `"iPhone15,2"` on device, `"arm64"` on Simulator — fine for production traffic.)
@@ -165,7 +165,7 @@ Hotwire.config.applicationUserAgentPrefix = "CarHey/\(Bundle.main.infoDictionary
 
 ```kotlin
 Hotwire.config.applicationUserAgentPrefix =
-    "CarHey/${BuildConfig.VERSION_NAME} " +
+    "HostApp/${BuildConfig.VERSION_NAME} " +
     "(${Build.MODEL}; Android ${Build.VERSION.RELEASE}; build ${BuildConfig.VERSION_CODE});"
 ```
 

data/lib/generators/sessions/install_generator.rb

@@ -181,7 +181,7 @@ module Sessions
         say "           schedule: every day at 4am"
 
         say "\nEvery login now lands on the devices page and in the trail:"
-        say "  current_user.sessions.active     # live devices, revocable"
+        say "  current_user.sessions.live       # live devices, revocable"
         say "  current_user.session_history     # the trail — logins, failures, revocations"
         say "\nEvery session, every device, every login — tracked. 🔐✨\n", :green
       end

data/lib/generators/sessions/madmin_generator.rb

@@ -20,6 +20,9 @@ module Sessions
 
       desc "Generate Madmin resources + controllers for sessions and the login trail"
 
+      class_option :user_panel, type: :boolean, default: false,
+                                desc: "Also generate a per-user Sessions panel concern and view"
+
       def check_for_madmin!
         return if madmin_available?
 
@@ -28,7 +31,7 @@ module Sessions
 
           This generator produces Madmin resources for the session registry and
           the login trail. For other admin frameworks, build on the same
-          primitives it uses: Session.active / session.revoke! /
+          primitives it uses: Session.live / session.revoke! /
           Sessions::Event scopes (failed_logins, last_24_hours, …).
         MSG
       end
@@ -43,6 +46,13 @@ module Sessions
         template "session_events_controller.rb", "app/controllers/madmin/session_events_controller.rb"
       end
 
+      def create_user_panel
+        return unless options[:user_panel]
+
+        copy_file "user_panel/madmin_user_panel.rb", "app/controllers/concerns/sessions/madmin_user_panel.rb"
+        copy_file "user_panel/sessions.html.erb", "app/views/madmin/users/sessions.html.erb"
+      end
+
       def display_post_install_message
         say "\n🔐 Madmin resources for sessions installed.", :green
         say "\nTo complete the setup:"
@@ -70,13 +80,19 @@ module Sessions
         say "       end"
 
         say "\n  3. (Optional) For a per-user panel (devices + trail on the user's"
-        say "     show page), add a member action to your users controller that"
-        say "     loads `user.sessions.by_recency` and `user.session_history.recent`"
-        say "     — the README's Admin section has the full recipe."
+        say "     show page), re-run with --user-panel, include"
+        say "     `Sessions::MadminUserPanel` in Madmin::UsersController, and add:"
+        say ""
+        say "       resources :users do"
+        say "         member do"
+        say "           get :sessions"
+        say "           post :revoke_all_sessions"
+        say "         end"
+        say "       end"
 
-        say "\nRevoking from the index destroys the row: that device is signed out"
-        say "on its very next request, and the revocation lands in the trail with"
-        say "admin attribution. 🔐\n", :green
+        say "\nRevoking from the index ends the row in place: that device is signed out"
+        say "on its very next matching request, and the revocation lands in the trail"
+        say "with admin attribution. 🔐\n", :green
       end
 
       private

data/lib/generators/sessions/templates/add_lifecycle_to_sessions.rb.erb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+# v0.2 upgrade: session rows are lifecycle records now. A live device is
+# `ended_at: nil`; explicit ending state lives on the row instead of being
+# inferred from a missing row plus a sessions_events tombstone.
+class AddSessionsLifecycleTo<%= table_name.camelize %> < ActiveRecord::Migration<%= migration_version %>
+  def change
+    change_table :<%= table_name %>, bulk: true do |t|
+      t.datetime :ended_at unless column_exists?(:<%= table_name %>, :ended_at)
+      t.string :ended_reason unless column_exists?(:<%= table_name %>, :ended_reason)
+      t.string :ended_by_type unless column_exists?(:<%= table_name %>, :ended_by_type)
+      t.send(reference_column_type, :ended_by_id) unless column_exists?(:<%= table_name %>, :ended_by_id)
+      t.send(json_column_type, :ended_metadata) unless column_exists?(:<%= table_name %>, :ended_metadata)
+    end
+
+    add_index :<%= table_name %>, :ended_at unless index_exists?(:<%= table_name %>, :ended_at)
+    add_index :<%= table_name %>, :ended_reason unless index_exists?(:<%= table_name %>, :ended_reason)
+    add_index :<%= table_name %>, %i[ended_by_type ended_by_id] unless index_exists?(:<%= table_name %>, %i[ended_by_type ended_by_id])
+  end
+
+  private
+
+  def reference_column_type
+    config = Rails.configuration.generators
+    case config.options[config.orm][:primary_key_type]
+    when nil, :bigserial then :bigint
+    when :serial then :integer
+    else config.options[config.orm][:primary_key_type]
+    end
+  end
+
+  def json_column_type
+    return :jsonb if connection.adapter_name.match?(/postg/i)
+
+    :json
+  end
+end

data/lib/generators/sessions/templates/add_sessions_columns.rb.erb

@@ -64,6 +64,16 @@ class AddSessionsColumnsTo<%= table_name.camelize %> < ActiveRecord::Migration<%
       # Session.sweep recommendation always needed.
       t.datetime :last_seen_at
       t.string :last_seen_ip, limit: 45 # refreshed with the touch (roaming devices)
+
+      # Lifecycle state. `ended_at: nil` is the live-device set; ended rows
+      # remain as auditable history. Events are the trail, not the source of
+      # truth for whether a session should still be accepted.
+      t.datetime :ended_at
+      t.string :ended_reason
+      # The explicit index below keeps the generated name consistent across
+      # fresh installs and upgrades. Avoid the implicit duplicate index.
+      t.references :ended_by, polymorphic: true, type: foreign_key_type, index: false
+      t.send(json_column_type, :ended_metadata)
     end
 
     add_index :<%= table_name %>, :device_id
@@ -73,10 +83,28 @@ class AddSessionsColumnsTo<%= table_name.camelize %> < ActiveRecord::Migration<%
     add_index :<%= table_name %>, :auth_provider
     add_index :<%= table_name %>, :country_code
     add_index :<%= table_name %>, :last_seen_at
+    add_index :<%= table_name %>, :ended_at
+    add_index :<%= table_name %>, :ended_reason
+    add_index :<%= table_name %>, %i[ended_by_type ended_by_id]
   end
 
   private
 
+  def foreign_key_type
+    config = Rails.configuration.generators
+    reference_column_type(config.options[config.orm][:primary_key_type])
+  end
+
+  # Reference columns hold VALUES of the PK type, so serial pseudo-types map to
+  # their plain integer equivalents.
+  def reference_column_type(setting)
+    case setting
+    when nil, :bigserial then :bigint
+    when :serial then :integer
+    else setting
+    end
+  end
+
   # :jsonb on PostgreSQL, :json elsewhere — same adaptive pattern as the
   # rest of the gem ecosystem (chats, api_keys, …). match? (not equality):
   # PostGIS apps report adapter_name "PostGIS" and are PostgreSQL too.

data/lib/generators/sessions/templates/create_sessions.rb.erb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-# The Rails-8-shaped sessions table for a Devise app: one row = one
-# signed-in device, destroyed on logout/revocation (rows = active sessions;
-# history lives in sessions_events). Deliberately the SAME base shape
+# The Rails-8-shaped sessions table for a Devise app: one row = one signed-in
+# device lifecycle (`ended_at: nil` means live; history lives in
+# sessions_events). Deliberately the SAME base shape
 # `rails generate authentication` creates — so if you ever migrate from
 # Devise to Rails auth, your sessions table is already waiting.
 class Create<%= table_name.camelize %> < ActiveRecord::Migration<%= migration_version %>
@@ -23,8 +23,8 @@ class Create<%= table_name.camelize %> < ActiveRecord::Migration<%= migration_ve
 
       # Devise/Warden mode: SHA-256 of a random token whose raw value lives
       # ONLY in the user's own session (OWASP: never persist raw session
-      # identifiers). The Warden adapter validates it on every request —
-      # destroy the row and that device is signed out on its next request.
+      # identifiers). The Warden adapter validates it on every request; only
+      # a matching token plus explicit lifecycle end may sign that device out.
       t.string :token_digest
 
       # The Warden scope ("user") — multi-scope Devise apps.
@@ -72,6 +72,18 @@ class Create<%= table_name.camelize %> < ActiveRecord::Migration<%= migration_ve
       t.datetime :last_seen_at
       t.string :last_seen_ip, limit: 45
 
+      # Lifecycle state. v0.2 keeps rows as the source of truth instead of
+      # deleting them and asking events to act as tombstones. `ended_at: nil`
+      # is the live-device set; explicit ended_reason values are the only
+      # thing a Devise/Warden request is allowed to enforce.
+      t.datetime :ended_at
+      t.string :ended_reason
+      # The explicit index below keeps the generated name consistent across
+      # create-table and upgrade paths. `references` indexes by default, so
+      # disable that implicit index to avoid two identical indexes.
+      t.references :ended_by, polymorphic: true, type: foreign_key_type, index: false
+      t.send(json_column_type, :ended_metadata)
+
       t.timestamps
     end
 
@@ -82,6 +94,9 @@ class Create<%= table_name.camelize %> < ActiveRecord::Migration<%= migration_ve
     add_index :<%= table_name %>, :auth_provider
     add_index :<%= table_name %>, :country_code
     add_index :<%= table_name %>, :last_seen_at
+    add_index :<%= table_name %>, :ended_at
+    add_index :<%= table_name %>, :ended_reason
+    add_index :<%= table_name %>, %i[ended_by_type ended_by_id]
   end
 
   private

data/lib/generators/sessions/templates/create_sessions_events.rb.erb

@@ -23,10 +23,10 @@ class CreateSessionsEvents < ActiveRecord::Migration<%= migration_version %>
       t.references :authenticatable, polymorphic: true, type: foreign_key_type, index: false
       t.string :scope
 
-      # The trail ↔ registry linkage. A plain column, NO foreign key: the
-      # registry row it points at gets destroyed on revoke; history must
-      # survive. A suspicious login here is one lookup away from revoking
-      # the live session it created.
+      # The trail ↔ registry linkage. A plain column, NO foreign key:
+      # lifecycle rows are normally ended in place, but account-erasure and
+      # legacy host deletes may still remove them. A suspicious login here
+      # is one lookup away from revoking the live session it created.
       t.send(session_id_column_type, :session_id)
 
       t.string :identity # email-as-typed (normalized), even for unknown accounts

data/lib/generators/sessions/templates/initializer.rb

@@ -122,8 +122,8 @@ Sessions.configure do |config|
   # "Was this you?" email here. Not fired on a user's very first login.
   #
   # PASS THE EVENT to your mailer, not the session: the event is a
-  # persisted, GlobalID-able record that survives revocation (the session
-  # row may be destroyed before an async job runs) and already carries
+  # persisted, GlobalID-able record that survives revocation and account
+  # erasure cleanup, and already carries
   # everything the email needs — event.user, event.device_name,
   # event.location, event.country_flag, event.occurred_at.
   #
@@ -136,11 +136,12 @@ Sessions.configure do |config|
   # end
   #
   # Someone crossed the repeated_failed_logins threshold (see BEHAVIOR
-  # above). The identity is the email AS TYPED — it may match no account,
-  # so resolve it yourself before notifying:
+  # above). The event still stores no account link for failures; user: is a
+  # best-effort in-memory resolution for this hook and nil for unknown
+  # identities:
   #
-  # config.on_repeated_failed_logins = ->(identity:, count:, event:) do
-  #   user = User.find_by(email: identity) or next
+  # config.on_repeated_failed_logins = ->(identity:, count:, event:, user:) do
+  #   next unless user
   #   SecurityMailer.with(user: user, event: event).repeated_failed_logins.deliver_later
   # end
   #
@@ -172,10 +173,10 @@ Sessions.configure do |config|
   # config.authenticate_method = :authenticate_user!
   #
   # Render the devices page with a specific layout (nil inherits whatever
-  # your parent controller uses — set this if your signed-in surfaces use a
-  # different layout, e.g. "app"):
+  # your parent controller uses). Use a callable when web/native shells differ:
   #
   # config.layout = nil
+  # config.layout = ->(controller) { controller.hotwire_native_app? ? "app" : "web" }
   #
   # Optional sudo gate before destructive actions on the devices page (ASVS
   # 3.3.4's "having re-entered login credentials"). The action runs only

data/lib/generators/sessions/templates/madmin/session_resource.rb

@@ -1,9 +1,10 @@
 # frozen_string_literal: true
 
-# Live device registry (sessions gem): one row = one signed-in device,
-# destroyed on logout/revocation — so this index IS the set of sessions that
-# can act on your app right now. The append-only history lives in
-# Sessions::Event (see Sessions::EventResource).
+# Device lifecycle registry (sessions gem): one row = one signed-in device.
+# `ended_at: nil` is the live set that can act on your app right now; ended
+# rows stay around as durable revocation state until account erasure or
+# explicit host cleanup removes them. The append-only history lives in
+# Sessions::Event.
 class SessionResource < Madmin::Resource
   model <%= session_class %>
 
@@ -30,6 +31,8 @@ class SessionResource < Madmin::Resource
   attribute :app_build, index: false, form: false
   attribute :user_agent, index: false, form: false
   attribute :last_seen_at, index: true, form: false, label: "Last seen"
+  attribute :ended_at, index: true, form: false, label: "Ended"
+  attribute :ended_reason, index: true, form: false, label: "Ended because"
   attribute :created_at, index: true, form: false, label: "Signed in"
   attribute :updated_at, show: false, form: false
 
@@ -39,8 +42,14 @@ class SessionResource < Madmin::Resource
   attribute :adoption_key, show: false, form: false
   attribute :auth_detail, show: false, form: false
   attribute :client_hints, show: false, form: false
+  attribute :ended_by_type, show: false, form: false
+  attribute :ended_by_id, show: false, form: false
+  attribute :ended_metadata, show: false, form: false
 
-  # Gem scopes: active = last activity within 30 days.
+  # Gem scopes: live/ended are lifecycle state; active/inactive are UI
+  # grouping within the live set (last activity within 30 days).
+  scope :live
+  scope :ended
   scope :active
   scope :inactive
 
@@ -53,14 +62,16 @@ class SessionResource < Madmin::Resource
   def self.default_sort_column = "created_at"
   def self.default_sort_direction = "desc"
 
-  # Remote logout: destroys the row (the device is signed out on its next
-  # request), writes the `revoked` trail event attributed to the admin, and
-  # rotates the user's remember-me credentials in Devise mode.
+  # Remote logout: ends the row in place, writes the `revoked` trail event
+  # attributed to the admin, and rotates the user's remember-me credentials
+  # in Devise mode. The device is signed out on its next matching request.
   member_action do
-    button_to "Revoke session",
-      main_app.revoke_madmin_session_path(@record),
-      method: :post,
-      class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-red-700 shadow-sm ring-1 ring-inset ring-red-300 hover:bg-red-50",
-      data: { turbo_confirm: "Revoke this session? The device will be signed out on its next request." }
+    if @record.live?
+      button_to "Revoke session",
+        main_app.revoke_madmin_session_path(@record),
+        method: :post,
+        class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-red-700 shadow-sm ring-1 ring-inset ring-red-300 hover:bg-red-50",
+        data: { turbo_confirm: "Revoke this session? The device will be signed out on its next request." }
+    end
   end
 end

data/lib/generators/sessions/templates/madmin/sessions_controller.rb

@@ -2,20 +2,24 @@
 
 module Madmin
   class SessionsController < Madmin::ResourceController
-    # Admin remote logout. `revoke!` destroys the row (the device is kicked
-    # on its next request — the cookie session and, in Devise mode, any
-    # remember-me revival), and writes the immutable `revoked` trail event
-    # with `by:` attribution.
+    # Admin remote logout. `revoke!` ends the row in place (the device is
+    # kicked on its next matching request — the cookie session and, in Devise
+    # mode, any remember-me revival), and writes the immutable `revoked`
+    # trail event with `by:` attribution.
     def revoke
       session_row = <%= session_class %>.find(params[:id])
       device = session_row.device_name
 
-      session_row.revoke!(reason: :admin_revoked, by: current_user)
-      flash[:notice] = "Session revoked (#{device}). The device will be signed out on its next request."
+      if session_row.live?
+        session_row.revoke!(reason: :admin_revoked, by: current_user)
+        flash[:notice] = "Session revoked (#{device}). The device will be signed out on its next request."
+      else
+        flash[:alert] = "That session had already ended (#{device}). There is no live device to sign out."
+      end
 
       redirect_back fallback_location: main_app.madmin_sessions_path
     rescue ActiveRecord::RecordNotFound
-      flash[:alert] = "That session no longer exists (probably already revoked)."
+      flash[:alert] = "That session no longer exists."
       redirect_back fallback_location: main_app.madmin_sessions_path
     end
 

data/lib/generators/sessions/templates/madmin/user_panel/madmin_user_panel.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Sessions
+  # Optional per-user Madmin panel actions. Include this in
+  # Madmin::UsersController, then draw the routes printed by
+  # `rails generate sessions:madmin --user-panel`.
+  module MadminUserPanel
+    extend ActiveSupport::Concern
+
+    SESSION_EVENTS_PER_PAGE = 30
+
+    def sessions
+      @user = User.find(params[:id])
+      @sessions = @user.sessions.live.by_recency.to_a
+      events = @user.session_history.recent
+
+      @failed_last_24h = events.failed_logins.last_24_hours.count
+      if respond_to?(:pagy, true)
+        @pagy, @events = pagy(events, limit: SESSION_EVENTS_PER_PAGE)
+      else
+        @events = events.limit(SESSION_EVENTS_PER_PAGE)
+      end
+    rescue StandardError => e
+      raise unless defined?(::Pagy::OptionError) && e.is_a?(::Pagy::OptionError)
+
+      @pagy, @events = pagy(events, page: 1, limit: SESSION_EVENTS_PER_PAGE)
+    end
+
+    # Account-takeover response: revoke every live row with admin attribution.
+    # Each row writes its own `revoked` event and, in Devise mode, rotates
+    # remember-me credentials so a long-lived cookie cannot revive the device.
+    def revoke_all_sessions
+      user = User.find(params[:id])
+      count = user.sessions.live.count
+
+      user.revoke_all_sessions!(by: current_user)
+      flash[:notice] = "#{count} #{"session".pluralize(count)} revoked. " \
+                       "Every device will be signed out on its next request."
+
+      redirect_to main_app.sessions_madmin_user_path(user)
+    end
+  end
+end

data/lib/generators/sessions/templates/madmin/user_panel/sessions.html.erb

@@ -0,0 +1,133 @@
+<% content_for :title, "Sessions - #{@user.try(:email) || @user.try(:email_address) || @user.id}" %>
+
+<div class="mx-auto w-full max-w-6xl px-4 py-6">
+  <header class="mb-6 flex flex-wrap items-center justify-between gap-4">
+    <div>
+      <p class="text-sm text-gray-500">
+        <%= link_to "Users", madmin_users_path, class: "hover:text-gray-700" %>
+        <span class="mx-1 text-gray-400">/</span>
+        <%= link_to @user.try(:email) || @user.try(:email_address) || @user.id, madmin_user_path(@user), class: "hover:text-gray-700" %>
+      </p>
+      <h1 class="mt-1 text-2xl font-semibold text-gray-900">Sessions &amp; devices</h1>
+    </div>
+
+    <div class="flex items-center gap-2">
+      <%= link_to "Back to user", madmin_user_path(@user),
+            class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-gray-700 shadow-sm ring-1 ring-inset ring-gray-300 hover:bg-gray-50" %>
+      <% if @sessions.any? %>
+        <%= button_to "Revoke all sessions", revoke_all_sessions_madmin_user_path(@user),
+              method: :post,
+              class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-red-700 shadow-sm ring-1 ring-inset ring-red-300 hover:bg-red-50",
+              data: { turbo_confirm: "Revoke ALL #{@sessions.size} sessions? Every device will be signed out on its next request." } %>
+      <% end %>
+    </div>
+  </header>
+
+  <div class="mb-6 grid grid-cols-1 gap-4 sm:grid-cols-3">
+    <div class="rounded-lg border border-gray-200 bg-white p-4">
+      <p class="text-xs font-medium uppercase text-gray-500">Live sessions</p>
+      <p class="mt-1 text-2xl font-semibold text-gray-900"><%= @sessions.size %></p>
+    </div>
+    <div class="rounded-lg border border-gray-200 bg-white p-4">
+      <p class="text-xs font-medium uppercase text-gray-500">Last activity</p>
+      <p class="mt-1 text-2xl font-semibold text-gray-900">
+        <% if (latest = @sessions.filter_map(&:last_active_at).max) %>
+          <%= time_ago_in_words(latest) %> ago
+        <% else %>
+          -
+        <% end %>
+      </p>
+    </div>
+    <div class="rounded-lg border border-gray-200 bg-white p-4">
+      <p class="text-xs font-medium uppercase text-gray-500">Failed logins (24h)</p>
+      <p class="mt-1 text-2xl font-semibold <%= @failed_last_24h.positive? ? "text-red-700" : "text-gray-900" %>">
+        <%= @failed_last_24h %>
+      </p>
+    </div>
+  </div>
+
+  <section class="mb-6 overflow-hidden rounded-lg border border-gray-200 bg-white">
+    <header class="border-b border-gray-200 px-6 py-4">
+      <h2 class="text-base font-semibold text-gray-900">Live devices</h2>
+    </header>
+
+    <% if @sessions.any? %>
+      <ul class="divide-y divide-gray-100">
+        <% @sessions.each do |session_row| %>
+          <li class="flex items-start justify-between gap-4 px-6 py-4">
+            <div class="min-w-0">
+              <p class="text-sm font-medium text-gray-900">
+                <%= link_to session_row.device_name, madmin_session_path(session_row), class: "hover:underline" %>
+              </p>
+              <p class="mt-1 text-xs text-gray-500">
+                <% bits = [] %>
+                <% bits << session_row.location if session_row.location %>
+                <% bits << "IP #{session_row.last_seen_ip || session_row.ip_address}" if session_row.last_seen_ip || session_row.ip_address %>
+                <% bits << "via #{session_row.auth_method_label}" if session_row.auth_method_label %>
+                <% bits << "last seen #{time_ago_in_words(session_row.last_active_at)} ago" if session_row.last_active_at %>
+                <%= bits.join(" - ") %>
+              </p>
+            </div>
+
+            <%= button_to "Revoke", revoke_madmin_session_path(session_row),
+                  method: :post,
+                  class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-red-700 shadow-sm ring-1 ring-inset ring-red-300 hover:bg-red-50",
+                  data: { turbo_confirm: "Revoke #{session_row.device_name}?" } %>
+          </li>
+        <% end %>
+      </ul>
+    <% else %>
+      <div class="px-6 py-10 text-center text-sm text-gray-500">No live sessions.</div>
+    <% end %>
+  </section>
+
+  <section class="overflow-hidden rounded-lg border border-gray-200 bg-white">
+    <header class="border-b border-gray-200 px-6 py-4">
+      <h2 class="text-base font-semibold text-gray-900">Login activity</h2>
+    </header>
+
+    <% if @events.any? %>
+      <div class="overflow-x-auto">
+        <table class="min-w-full divide-y divide-gray-200 text-sm">
+          <thead class="bg-gray-50 text-xs uppercase text-gray-500">
+            <tr>
+              <th class="px-4 py-2 text-left font-medium">When</th>
+              <th class="px-4 py-2 text-left font-medium">Event</th>
+              <th class="px-4 py-2 text-left font-medium">Device</th>
+              <th class="px-4 py-2 text-left font-medium">IP / Location</th>
+              <th class="px-4 py-2 text-left font-medium">Via</th>
+            </tr>
+          </thead>
+          <tbody class="divide-y divide-gray-100">
+            <% @events.each do |event| %>
+              <tr>
+                <td class="whitespace-nowrap px-4 py-3 align-top">
+                  <%= l(event.occurred_at, format: :short) %>
+                </td>
+                <td class="px-4 py-3 align-top">
+                  <%= event.label %>
+                  <% if event.reason %>
+                    <div class="text-xs text-gray-500"><%= event.reason_label %></div>
+                  <% end %>
+                </td>
+                <td class="px-4 py-3 align-top"><%= event.device_name %></td>
+                <td class="whitespace-nowrap px-4 py-3 align-top">
+                  <%= [ event.ip_address, event.location ].compact.join(" - ").presence || "-" %>
+                </td>
+                <td class="px-4 py-3 align-top"><%= event.auth_method_label || "-" %></td>
+              </tr>
+            <% end %>
+          </tbody>
+        </table>
+      </div>
+
+      <% if defined?(@pagy) && @pagy.respond_to?(:last) && @pagy.last > 1 %>
+        <div class="border-t border-gray-100 bg-gray-50 px-6 py-3">
+          <%= render "madmin/shared/pagination", pagy: @pagy %>
+        </div>
+      <% end %>
+    <% else %>
+      <div class="px-6 py-10 text-center text-sm text-gray-500">No login activity.</div>
+    <% end %>
+  </section>
+</div>