sessions 0.2.0 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 10c90937b69181aefb74b594f97b4f0142d75148aac755cb3e180866df74e249
-  data.tar.gz: 94219c51f790720e0bff485db1242f288b48161ffb5adab0bf066be22d189a30
+  metadata.gz: 6ead91af5a7b6b9818df58d3c068ce4d59e09a5b865e80373ba2e7b7c5854e75
+  data.tar.gz: 6ad52d4780745c525de40a76cb462e5cedc87b3f54dfff7f9d803f69ad9f0033
 SHA512:
-  metadata.gz: 978aea94d42c6259b8add5117692fbfd28ef071b5c9a078ec45900173bc76041481cba36433d7ce6eaf2d6dafa2d7cf1365e92c2b55a6c0946f19ca212d3c8dd
-  data.tar.gz: 4d956731a73bbc7750f67161f6a69acc9e7befa96c0ad8b5e02bfb7ccedbac4002cc2fa39b43ab0643c07a062c0d3e84315757d72ccac0a291ca1a0ad3cb09a2
+  metadata.gz: f32fb15dbbef609551071da2de77a4b6c0f9117e496a2405548d87a5fcddad11bb14b1e7c738e0bdd70112634ad92d7b5a1ecf3fb041b4b2d3420e8d0fba3e3b
+  data.tar.gz: fffa0d52b6c6353b1d326f0a76c7a3e49ea8bac0f3bf8b160923675c99bfa9d7a12db4f85e3120a532b677e4539fedb90b5aa80917eb88f6c87455699d52726e

data/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.2.2 (2026-07-06)
+
+Closes the revocation-semantics gaps found auditing the 0.2.x lifecycle model against production data.
+
+- **Explicit revocations now kick tokenless remembered devices too.** Remember-me restores reattach to their device row as a tokenless tracking hint (0.1.3 semantics). Hints still never turn absence or housekeeping into a logout — but when the authenticated owner, the signed browser-continuity cookie, and the row all agree it is the same device AND that row was explicitly ended (`admin_revoked`, `user_revoked`, `logout_everywhere`, …), the next request now kicks, exactly as the admin/devices UI promises. Previously such devices kept their live host session until it expired naturally (remember-me revival was already blocked; the active rack session was not).
+- **`Sessions.current` resolves hint-tracked rows.** Remembered devices get their "this device" badge back on the devices page — and the page's refuse-to-revoke-current guard (plus `revoke_other_sessions!(current:)`) works for them again. The hint is corroborated against the signed browser-continuity cookie before being trusted.
+- **Sweep expiry no longer masquerades as revocation.** `Sessions.sweep!` ends idle/over-age sessions with `end!(reason: :expired)` (audit event written, kicks on resume) instead of `revoke!` — no more account-wide remember-me rotation or `on_session_revoked` fire for timeout policy, matching the adapter's inline expiry and Devise's own timeoutable semantics.
+- **Plain callable-object hooks receive `on_repeated_failed_logins` again.** 0.2.1's keyword-slicing dispatch introspected `#parameters`, which only Procs and Methods expose; a class-based hook (`def call(identity:, count:, event:)`) silently lost the alert. Dispatch now introspects `#method(:call)` for such objects.
+
+## 0.2.1 (2026-07-03)
+
+- Prevent fresh-install and adopted-table migrations from creating the `ended_by` polymorphic index twice.
+- Preserve custom string/ULID primary-key types in the 0.2 lifecycle upgrade migration.
+- Make generated Madmin revocation controls lifecycle-aware so ended rows cannot report a second successful revoke.
+- Correct the 0.2 documentation for `event.session`: it resolves retained lifecycle rows after logout/revocation and becomes `nil` only after hard deletion.
+- Document that Devise's `bypass_sign_in` skips the Warden callbacks required to register a new session.
+- Bound the device parser dependency to the tested `browser` 6.x API line.
+- Let `config.layout` be a callable (`->(controller) { ... }`) for hosts that switch layouts between web and native shells.
+- Pass `user:` (resolved best-effort, never persisted on the failed event) to `on_repeated_failed_logins` when the hook opts into the keyword.
+- Add `sessions_devices_for(user)` / `sessions_history_for(user)` helpers so ejected/custom views keep live-device and enumeration-safe history semantics in one place.
+- Add `rails generate sessions:madmin --user-panel` for the repeated per-user admin security panel concern/view.
+
 ## 0.2.0 (2026-06-21)
 
 Lifecycle-row rewrite and auth-safety correction for the Hotwire Native / Devise remember-me hardening introduced in 0.1.3.

data/README.md

@@ -98,7 +98,7 @@ That's it. Every sign-in from now on lands on the devices page and in the trail
 
 ### Upgrading
 
-Existing apps upgrading from 0.1.0, 0.1.1, or 0.1.2 should copy the upgrade migrations and run them:
+Existing apps upgrading from any 0.1.x release should copy the upgrade migrations and run them:
 
 ```bash
 rails generate sessions:upgrade
@@ -141,7 +141,7 @@ Three ways to ship it, pick your layer:
    (Revoke buttons render when the engine is mounted; without it you get the read-only registry.)
 3. **Eject and restyle** — `rails generate sessions:views` copies every template into `app/views/sessions/`, where your copies shadow the gem's automatically (the Devise move).
 
-The engine inherits from your `ApplicationController` (configurable via `config.parent_controller`), so your layout, auth and locale apply automatically. The current session is resolved on both stacks; destructive actions can be gated behind your own sudo/password-confirm flow with `config.require_reauthentication`. One heads-up: if your app layout leans heavily on host route helpers, isolated-engine rendering means those resolve through `main_app.*` — rendering the partials in your own page (layer 2) sidesteps the whole topic.
+The engine inherits from your `ApplicationController` (configurable via `config.parent_controller`), so your layout, auth and locale apply automatically. `config.layout` can be a string/symbol or a callable (`->(controller) { controller.hotwire_native_app? ? "app" : "web" }`) when native and browser shells differ. The current session is resolved on both stacks; destructive actions can be gated behind a sudo/password-confirm flow with `config.require_reauthentication`. One heads-up: if your app layout leans heavily on host route helpers, isolated-engine rendering means those resolve through `main_app.*` — rendering the partials in your own page (layer 2) sidesteps the whole topic.
 
 A hard rule the page enforces: **you can never touch a session you don't own** (foreign ids 404 — existence never leaks), and the current session is never revocable from the page (that's what sign-out is for).
 
@@ -152,7 +152,7 @@ A hard rule the page enforces: **you can never touch a session you don't own** (
 ```ruby
 Sessions::Event.logins / .failed_logins / .logouts / .revocations / .expirations
 Sessions::Event.recent.last_days(90).for_ip("203.0.113.7")
-event.session       # the live row it created — nil once revoked (that's the point)
+event.session       # the lifecycle row it created (live or explicitly ended)
 event.new_device?   # flagged when the login matched no prior device
 ```
 
@@ -212,6 +212,8 @@ Sessions.record_failed_attempt(request, scope: :user, identity: params[:email],
 
 Custom Warden strategies map with `config.strategy_methods = { "OtpAuthenticatable" => :otp }`. Everything else is `unknown` — the gem never guesses.
 
+Devise's `bypass_sign_in` writes directly to its session serializer and deliberately skips Warden callbacks. Do not use it to establish a new login that must appear in the registry; use `sign_in` instead. It remains appropriate for refreshing the serialization of an already-tracked login.
+
 ### Two-factor flows (TOTP apps, security keys, Touch ID)
 
 Every mainstream Ruby 2FA setup creates the session at **full** authentication — we verified each one against its source — so the registry and trail stay correct without configuration. What varies is the labeling, and where a recipe is needed it's one line:
@@ -278,13 +280,13 @@ Per-attempt alerts are notification fatigue *and* an abuse vector (an attacker h
 
 ```ruby
 config.repeated_failed_logins = { threshold: 5, within: 15.minutes }
-config.on_repeated_failed_logins = ->(identity:, count:, event:) do
-  user = User.find_by(email: identity) or next  # identity is AS TYPED — may match no account
+config.on_repeated_failed_logins = ->(identity:, count:, event:, user:) do
+  next unless user # nil when the typed identity matches no account
   SecurityMailer.with(user: user, event: event).repeated_failed_logins.deliver_later
 end
 ```
 
-The `event` is the attempt that tripped the threshold — IP, location and device included. This complements (not replaces) Devise's `:lockable` and Rails 8's `rate_limit`: they *stop* the attacker; this tells the *user*.
+The `event` is the attempt that tripped the threshold — IP, location and device included. `user:` is resolved in memory for the hook but still not persisted on failed events, preserving the no-enumeration data model. Existing hooks that only accept `identity:, count:, event:` keep working. This complements (not replaces) Devise's `:lockable` and Rails 8's `rate_limit`: they *stop* the attacker; this tells the *user*.
 
 ## 🌍 Geolocation (via `trackdown`, soft dependency)
 
@@ -353,7 +355,15 @@ Scopes are the admin product — `Sessions::Event.failed_logins.last_24_hours.gr
 rails generate sessions:madmin
 ```
 
-…generates the two resources (the lifecycle registry with a per-row **Revoke session** action, and the login trail with its triage scopes as filters) plus their controllers, with madmin's two namespacing footguns pre-solved. The generated files use only stock madmin APIs and are yours to restyle. For a per-user security panel (devices + trail on the user's show page), load `user.sessions.live.by_recency` and `user.session_events.recent` in a member action — including the user's *failed* attempts by matching `Sessions::Event.where(identity: Sessions::Event.normalize_identity(user.email))` (failures never link to accounts; matching the signed-in user's own identity is the safe way to show them).
+…generates the two resources (the lifecycle registry with a per-row **Revoke session** action, and the login trail with its triage scopes as filters) plus their controllers, with madmin's two namespacing footguns pre-solved. The generated files use only stock madmin APIs and are yours to restyle.
+
+For the per-user security panel that most admin dashboards want (live devices + that user's login trail), run:
+
+```bash
+rails generate sessions:madmin --user-panel
+```
+
+That adds a reusable `Sessions::MadminUserPanel` concern and `app/views/madmin/users/sessions.html.erb`. Include the concern in `Madmin::UsersController`, add the printed member routes, and add a `member_action` link from your `UserResource`.
 
 ## 🧹 Retention & the sweep
 
@@ -418,7 +428,7 @@ Sessions.configure do |config|
   config.parent_controller       = "::ApplicationController"
   config.current_user_method     = :current_user   # chain: this → current_user → Current.session&.user
   config.authenticate_method     = :authenticate_user!
-  config.layout                  = nil             # nil inherits the parent controller's layout
+  config.layout                  = nil             # nil, "app", or ->(controller) { ... }
   config.require_reauthentication = nil            # ->(controller) { ... } sudo gate
   config.session_class           = "Session"
   config.strategy_methods        = {}              # { "OtpAuthenticatable" => :otp }

data/app/controllers/sessions/application_controller.rb

@@ -112,7 +112,8 @@ module Sessions
     end
 
     def sessions_layout
-      Sessions.config.layout
+      configured = Sessions.config.layout
+      configured.respond_to?(:call) ? configured.call(self) : configured
     end
 
     # The optional sudo gate (ASVS 3.3.4's "having re-entered login

data/app/helpers/sessions/engine_helper.rb

@@ -45,6 +45,29 @@ module Sessions
       EVENT_ICON_NAMES.fetch(event.event.to_s, "information-circle")
     end
 
+    # Semantic queries for custom/ejected views. Keep liveness and
+    # enumeration-safe history semantics in the gem, so host styling changes
+    # don't accidentally regress the data contract.
+    def sessions_devices_for(user, limit: nil)
+      scope = if user.respond_to?(:sessions)
+                user.sessions.live.by_recency
+              else
+                Sessions.session_model.live.where(user: user).by_recency
+              end
+      limit ? scope.limit(limit) : scope
+    end
+
+    def sessions_history_for(user, limit: nil)
+      scope = if user.respond_to?(:session_history)
+                user.session_history.recent
+              elsif user.respond_to?(:session_events)
+                user.session_events.recent
+              else
+                Sessions::Event.where(authenticatable: user).recent
+              end
+      limit ? scope.limit(limit) : scope
+    end
+
     # "Active now" within the touch window, else "Active 3 minutes ago".
     def sessions_last_active_in_words(session)
       # active_now? owns the window (config.touch_every) — the badge can't

data/app/views/sessions/_devices.html.erb

@@ -1,13 +1,13 @@
 <%# The live device registry — renderable from the engine OR straight from %>
 <%# any host view: render "sessions/devices", user: current_user           %>
 <%# Locals:                                                                 %>
-<%#   sessions:        the rows to render (defaults to user.sessions)       %>
+<%#   sessions:        the rows to render (defaults via sessions_devices_for)%>
 <%#   user:            whose devices (only needed when sessions: isn't given)%>
 <%#   current_session: the row serving this request (badged, not revocable) %>
 <%
   current_session = local_assigns[:current_session] || Sessions.current(request)
   sessions = local_assigns[:sessions] ||
-             local_assigns[:user]&.sessions&.live&.by_recency&.to_a ||
+             (sessions_devices_for(local_assigns[:user]).to_a if local_assigns[:user] && respond_to?(:sessions_devices_for)) ||
              []
   routes = sessions_engine_routes if respond_to?(:sessions_engine_routes)
 %>

data/app/views/sessions/_history.html.erb

@@ -1,12 +1,12 @@
 <%# The login-activity trail — renderable from any host view too:          %>
 <%#   render "sessions/history", user: current_user, limit: 10              %>
 <%# Locals:                                                                 %>
-<%#   events: the trail rows (defaults to user.session_events.recent)       %>
+<%#   events: the trail rows (defaults via sessions_history_for)            %>
 <%#   user:   whose history (only needed when events: isn't given)          %>
 <%#   limit:  cap when deriving from user (default 10)                      %>
 <%
   events = local_assigns[:events] ||
-           local_assigns[:user]&.session_events&.recent&.limit(local_assigns.fetch(:limit, 10)) ||
+           (sessions_history_for(local_assigns[:user], limit: local_assigns.fetch(:limit, 10)) if local_assigns[:user] && respond_to?(:sessions_history_for)) ||
            []
 %>
 <% if events.respond_to?(:empty?) && events.empty? %>

data/lib/generators/sessions/madmin_generator.rb

@@ -20,6 +20,9 @@ module Sessions
 
       desc "Generate Madmin resources + controllers for sessions and the login trail"
 
+      class_option :user_panel, type: :boolean, default: false,
+                                desc: "Also generate a per-user Sessions panel concern and view"
+
       def check_for_madmin!
         return if madmin_available?
 
@@ -43,6 +46,13 @@ module Sessions
         template "session_events_controller.rb", "app/controllers/madmin/session_events_controller.rb"
       end
 
+      def create_user_panel
+        return unless options[:user_panel]
+
+        copy_file "user_panel/madmin_user_panel.rb", "app/controllers/concerns/sessions/madmin_user_panel.rb"
+        copy_file "user_panel/sessions.html.erb", "app/views/madmin/users/sessions.html.erb"
+      end
+
       def display_post_install_message
         say "\n🔐 Madmin resources for sessions installed.", :green
         say "\nTo complete the setup:"
@@ -70,9 +80,15 @@ module Sessions
         say "       end"
 
         say "\n  3. (Optional) For a per-user panel (devices + trail on the user's"
-        say "     show page), add a member action to your users controller that"
-        say "     loads `user.sessions.live.by_recency` and `user.session_history.recent`"
-        say "     — the README's Admin section has the full recipe."
+        say "     show page), re-run with --user-panel, include"
+        say "     `Sessions::MadminUserPanel` in Madmin::UsersController, and add:"
+        say ""
+        say "       resources :users do"
+        say "         member do"
+        say "           get :sessions"
+        say "           post :revoke_all_sessions"
+        say "         end"
+        say "       end"
 
         say "\nRevoking from the index ends the row in place: that device is signed out"
         say "on its very next matching request, and the revocation lands in the trail"

data/lib/generators/sessions/templates/add_lifecycle_to_sessions.rb.erb

@@ -23,10 +23,9 @@ class AddSessionsLifecycleTo<%= table_name.camelize %> < ActiveRecord::Migration
   def reference_column_type
     config = Rails.configuration.generators
     case config.options[config.orm][:primary_key_type]
-    when :uuid then :uuid
-    when :string then :string
-    when :integer, :serial then :integer
-    else :bigint
+    when nil, :bigserial then :bigint
+    when :serial then :integer
+    else config.options[config.orm][:primary_key_type]
     end
   end
 

data/lib/generators/sessions/templates/add_sessions_columns.rb.erb

@@ -70,7 +70,9 @@ class AddSessionsColumnsTo<%= table_name.camelize %> < ActiveRecord::Migration<%
       # truth for whether a session should still be accepted.
       t.datetime :ended_at
       t.string :ended_reason
-      t.references :ended_by, polymorphic: true, type: foreign_key_type
+      # The explicit index below keeps the generated name consistent across
+      # fresh installs and upgrades. Avoid the implicit duplicate index.
+      t.references :ended_by, polymorphic: true, type: foreign_key_type, index: false
       t.send(json_column_type, :ended_metadata)
     end
 

data/lib/generators/sessions/templates/create_sessions.rb.erb

@@ -78,7 +78,10 @@ class Create<%= table_name.camelize %> < ActiveRecord::Migration<%= migration_ve
       # thing a Devise/Warden request is allowed to enforce.
       t.datetime :ended_at
       t.string :ended_reason
-      t.references :ended_by, polymorphic: true, type: foreign_key_type
+      # The explicit index below keeps the generated name consistent across
+      # create-table and upgrade paths. `references` indexes by default, so
+      # disable that implicit index to avoid two identical indexes.
+      t.references :ended_by, polymorphic: true, type: foreign_key_type, index: false
       t.send(json_column_type, :ended_metadata)
 
       t.timestamps

data/lib/generators/sessions/templates/initializer.rb

@@ -136,11 +136,12 @@ Sessions.configure do |config|
   # end
   #
   # Someone crossed the repeated_failed_logins threshold (see BEHAVIOR
-  # above). The identity is the email AS TYPED — it may match no account,
-  # so resolve it yourself before notifying:
+  # above). The event still stores no account link for failures; user: is a
+  # best-effort in-memory resolution for this hook and nil for unknown
+  # identities:
   #
-  # config.on_repeated_failed_logins = ->(identity:, count:, event:) do
-  #   user = User.find_by(email: identity) or next
+  # config.on_repeated_failed_logins = ->(identity:, count:, event:, user:) do
+  #   next unless user
   #   SecurityMailer.with(user: user, event: event).repeated_failed_logins.deliver_later
   # end
   #
@@ -172,10 +173,10 @@ Sessions.configure do |config|
   # config.authenticate_method = :authenticate_user!
   #
   # Render the devices page with a specific layout (nil inherits whatever
-  # your parent controller uses — set this if your signed-in surfaces use a
-  # different layout, e.g. "app"):
+  # your parent controller uses). Use a callable when web/native shells differ:
   #
   # config.layout = nil
+  # config.layout = ->(controller) { controller.hotwire_native_app? ? "app" : "web" }
   #
   # Optional sudo gate before destructive actions on the devices page (ASVS
   # 3.3.4's "having re-entered login credentials"). The action runs only

data/lib/generators/sessions/templates/madmin/session_resource.rb

@@ -2,8 +2,9 @@
 
 # Device lifecycle registry (sessions gem): one row = one signed-in device.
 # `ended_at: nil` is the live set that can act on your app right now; ended
-# rows stay around as durable state/audit context until retention or account
-# erasure removes them. The append-only history lives in Sessions::Event.
+# rows stay around as durable revocation state until account erasure or
+# explicit host cleanup removes them. The append-only history lives in
+# Sessions::Event.
 class SessionResource < Madmin::Resource
   model <%= session_class %>
 
@@ -65,10 +66,12 @@ class SessionResource < Madmin::Resource
   # attributed to the admin, and rotates the user's remember-me credentials
   # in Devise mode. The device is signed out on its next matching request.
   member_action do
-    button_to "Revoke session",
-      main_app.revoke_madmin_session_path(@record),
-      method: :post,
-      class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-red-700 shadow-sm ring-1 ring-inset ring-red-300 hover:bg-red-50",
-      data: { turbo_confirm: "Revoke this session? The device will be signed out on its next request." }
+    if @record.live?
+      button_to "Revoke session",
+        main_app.revoke_madmin_session_path(@record),
+        method: :post,
+        class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-red-700 shadow-sm ring-1 ring-inset ring-red-300 hover:bg-red-50",
+        data: { turbo_confirm: "Revoke this session? The device will be signed out on its next request." }
+    end
   end
 end

data/lib/generators/sessions/templates/madmin/sessions_controller.rb

@@ -10,12 +10,16 @@ module Madmin
       session_row = <%= session_class %>.find(params[:id])
       device = session_row.device_name
 
-      session_row.revoke!(reason: :admin_revoked, by: current_user)
-      flash[:notice] = "Session revoked (#{device}). The device will be signed out on its next request."
+      if session_row.live?
+        session_row.revoke!(reason: :admin_revoked, by: current_user)
+        flash[:notice] = "Session revoked (#{device}). The device will be signed out on its next request."
+      else
+        flash[:alert] = "That session had already ended (#{device}). There is no live device to sign out."
+      end
 
       redirect_back fallback_location: main_app.madmin_sessions_path
     rescue ActiveRecord::RecordNotFound
-      flash[:alert] = "That session no longer exists (probably already revoked)."
+      flash[:alert] = "That session no longer exists."
       redirect_back fallback_location: main_app.madmin_sessions_path
     end
 

data/lib/generators/sessions/templates/madmin/user_panel/madmin_user_panel.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Sessions
+  # Optional per-user Madmin panel actions. Include this in
+  # Madmin::UsersController, then draw the routes printed by
+  # `rails generate sessions:madmin --user-panel`.
+  module MadminUserPanel
+    extend ActiveSupport::Concern
+
+    SESSION_EVENTS_PER_PAGE = 30
+
+    def sessions
+      @user = User.find(params[:id])
+      @sessions = @user.sessions.live.by_recency.to_a
+      events = @user.session_history.recent
+
+      @failed_last_24h = events.failed_logins.last_24_hours.count
+      if respond_to?(:pagy, true)
+        @pagy, @events = pagy(events, limit: SESSION_EVENTS_PER_PAGE)
+      else
+        @events = events.limit(SESSION_EVENTS_PER_PAGE)
+      end
+    rescue StandardError => e
+      raise unless defined?(::Pagy::OptionError) && e.is_a?(::Pagy::OptionError)
+
+      @pagy, @events = pagy(events, page: 1, limit: SESSION_EVENTS_PER_PAGE)
+    end
+
+    # Account-takeover response: revoke every live row with admin attribution.
+    # Each row writes its own `revoked` event and, in Devise mode, rotates
+    # remember-me credentials so a long-lived cookie cannot revive the device.
+    def revoke_all_sessions
+      user = User.find(params[:id])
+      count = user.sessions.live.count
+
+      user.revoke_all_sessions!(by: current_user)
+      flash[:notice] = "#{count} #{"session".pluralize(count)} revoked. " \
+                       "Every device will be signed out on its next request."
+
+      redirect_to main_app.sessions_madmin_user_path(user)
+    end
+  end
+end

data/lib/generators/sessions/templates/madmin/user_panel/sessions.html.erb

@@ -0,0 +1,133 @@
+<% content_for :title, "Sessions - #{@user.try(:email) || @user.try(:email_address) || @user.id}" %>
+
+<div class="mx-auto w-full max-w-6xl px-4 py-6">
+  <header class="mb-6 flex flex-wrap items-center justify-between gap-4">
+    <div>
+      <p class="text-sm text-gray-500">
+        <%= link_to "Users", madmin_users_path, class: "hover:text-gray-700" %>
+        <span class="mx-1 text-gray-400">/</span>
+        <%= link_to @user.try(:email) || @user.try(:email_address) || @user.id, madmin_user_path(@user), class: "hover:text-gray-700" %>
+      </p>
+      <h1 class="mt-1 text-2xl font-semibold text-gray-900">Sessions &amp; devices</h1>
+    </div>
+
+    <div class="flex items-center gap-2">
+      <%= link_to "Back to user", madmin_user_path(@user),
+            class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-gray-700 shadow-sm ring-1 ring-inset ring-gray-300 hover:bg-gray-50" %>
+      <% if @sessions.any? %>
+        <%= button_to "Revoke all sessions", revoke_all_sessions_madmin_user_path(@user),
+              method: :post,
+              class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-red-700 shadow-sm ring-1 ring-inset ring-red-300 hover:bg-red-50",
+              data: { turbo_confirm: "Revoke ALL #{@sessions.size} sessions? Every device will be signed out on its next request." } %>
+      <% end %>
+    </div>
+  </header>
+
+  <div class="mb-6 grid grid-cols-1 gap-4 sm:grid-cols-3">
+    <div class="rounded-lg border border-gray-200 bg-white p-4">
+      <p class="text-xs font-medium uppercase text-gray-500">Live sessions</p>
+      <p class="mt-1 text-2xl font-semibold text-gray-900"><%= @sessions.size %></p>
+    </div>
+    <div class="rounded-lg border border-gray-200 bg-white p-4">
+      <p class="text-xs font-medium uppercase text-gray-500">Last activity</p>
+      <p class="mt-1 text-2xl font-semibold text-gray-900">
+        <% if (latest = @sessions.filter_map(&:last_active_at).max) %>
+          <%= time_ago_in_words(latest) %> ago
+        <% else %>
+          -
+        <% end %>
+      </p>
+    </div>
+    <div class="rounded-lg border border-gray-200 bg-white p-4">
+      <p class="text-xs font-medium uppercase text-gray-500">Failed logins (24h)</p>
+      <p class="mt-1 text-2xl font-semibold <%= @failed_last_24h.positive? ? "text-red-700" : "text-gray-900" %>">
+        <%= @failed_last_24h %>
+      </p>
+    </div>
+  </div>
+
+  <section class="mb-6 overflow-hidden rounded-lg border border-gray-200 bg-white">
+    <header class="border-b border-gray-200 px-6 py-4">
+      <h2 class="text-base font-semibold text-gray-900">Live devices</h2>
+    </header>
+
+    <% if @sessions.any? %>
+      <ul class="divide-y divide-gray-100">
+        <% @sessions.each do |session_row| %>
+          <li class="flex items-start justify-between gap-4 px-6 py-4">
+            <div class="min-w-0">
+              <p class="text-sm font-medium text-gray-900">
+                <%= link_to session_row.device_name, madmin_session_path(session_row), class: "hover:underline" %>
+              </p>
+              <p class="mt-1 text-xs text-gray-500">
+                <% bits = [] %>
+                <% bits << session_row.location if session_row.location %>
+                <% bits << "IP #{session_row.last_seen_ip || session_row.ip_address}" if session_row.last_seen_ip || session_row.ip_address %>
+                <% bits << "via #{session_row.auth_method_label}" if session_row.auth_method_label %>
+                <% bits << "last seen #{time_ago_in_words(session_row.last_active_at)} ago" if session_row.last_active_at %>
+                <%= bits.join(" - ") %>
+              </p>
+            </div>
+
+            <%= button_to "Revoke", revoke_madmin_session_path(session_row),
+                  method: :post,
+                  class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-red-700 shadow-sm ring-1 ring-inset ring-red-300 hover:bg-red-50",
+                  data: { turbo_confirm: "Revoke #{session_row.device_name}?" } %>
+          </li>
+        <% end %>
+      </ul>
+    <% else %>
+      <div class="px-6 py-10 text-center text-sm text-gray-500">No live sessions.</div>
+    <% end %>
+  </section>
+
+  <section class="overflow-hidden rounded-lg border border-gray-200 bg-white">
+    <header class="border-b border-gray-200 px-6 py-4">
+      <h2 class="text-base font-semibold text-gray-900">Login activity</h2>
+    </header>
+
+    <% if @events.any? %>
+      <div class="overflow-x-auto">
+        <table class="min-w-full divide-y divide-gray-200 text-sm">
+          <thead class="bg-gray-50 text-xs uppercase text-gray-500">
+            <tr>
+              <th class="px-4 py-2 text-left font-medium">When</th>
+              <th class="px-4 py-2 text-left font-medium">Event</th>
+              <th class="px-4 py-2 text-left font-medium">Device</th>
+              <th class="px-4 py-2 text-left font-medium">IP / Location</th>
+              <th class="px-4 py-2 text-left font-medium">Via</th>
+            </tr>
+          </thead>
+          <tbody class="divide-y divide-gray-100">
+            <% @events.each do |event| %>
+              <tr>
+                <td class="whitespace-nowrap px-4 py-3 align-top">
+                  <%= l(event.occurred_at, format: :short) %>
+                </td>
+                <td class="px-4 py-3 align-top">
+                  <%= event.label %>
+                  <% if event.reason %>
+                    <div class="text-xs text-gray-500"><%= event.reason_label %></div>
+                  <% end %>
+                </td>
+                <td class="px-4 py-3 align-top"><%= event.device_name %></td>
+                <td class="whitespace-nowrap px-4 py-3 align-top">
+                  <%= [ event.ip_address, event.location ].compact.join(" - ").presence || "-" %>
+                </td>
+                <td class="px-4 py-3 align-top"><%= event.auth_method_label || "-" %></td>
+              </tr>
+            <% end %>
+          </tbody>
+        </table>
+      </div>
+
+      <% if defined?(@pagy) && @pagy.respond_to?(:last) && @pagy.last > 1 %>
+        <div class="border-t border-gray-100 bg-gray-50 px-6 py-3">
+          <%= render "madmin/shared/pagination", pagy: @pagy %>
+        </div>
+      <% end %>
+    <% else %>
+      <div class="px-6 py-10 text-center text-sm text-gray-500">No login activity.</div>
+    <% end %>
+  </section>
+</div>

data/lib/sessions/adapters/warden.rb

@@ -202,12 +202,21 @@ module Sessions
             # v0.1.3 intentionally reattached remember-me restores to an
             # existing device row without writing another login event, storing
             # [row_id, nil] in Warden. That is fine as a tracking hint, but it
-            # must never become an auth/liveness check. Touch when the signed
-            # browser-continuity cookie still agrees; otherwise clear only the
-            # gem's tracking key and let Devise/Rails keep owning auth.
+            # must never become an auth/liveness check FROM ABSENCE: missing
+            # rows, mismatched cookies and quiet housekeeping all fail open.
+            # An EXPLICIT ending is different — when the authenticated owner,
+            # the signed browser-continuity cookie and the row all agree this
+            # is the same device, and that row was deliberately ended
+            # (admin/user revoke, sign-out-everywhere), the revocation must
+            # mean what the UI promised: signed out on its next request.
+            # Housekeeping reasons (superseded) never kick and fall through
+            # to the live-replacement reattach below.
             # Source: https://github.com/rameerez/sessions/blob/v0.1.3/CHANGELOG.md
-            if existing_row_session?(found, record, scope, warden.request) && found.live?
+            same_device = existing_row_session?(found, record, scope, warden.request)
+            if same_device && found.live?
               Sessions.safely("warden.remembered_existing.touch") { found.touch_last_seen!(warden.request) }
+            elsif same_device && found.sessions_kicks_on_resume?
+              kick!(warden, scope)
             elsif (replacement = live_replacement_for(found, record, scope, warden.request))
               attach_existing_row(replacement, warden, scope)
             else

data/lib/sessions/configuration.rb

@@ -181,7 +181,7 @@ module Sessions
     # whatever layout the parent controller resolves — usually the host's
     # `application` layout. Set it when your signed-in surfaces render with
     # a different one (e.g. "app").
-    attr_accessor :layout
+    attr_reader :layout
 
     # ->(controller) — optional sudo gate run before destructive actions on
     # the devices page (ASVS 3.3.4's "having re-entered login credentials").
@@ -377,6 +377,15 @@ module Sessions
       @parent_controller = name
     end
 
+    def layout=(value)
+      if value.nil? || value.respond_to?(:call) || value.is_a?(String) || value.is_a?(Symbol)
+        @layout = value
+        return
+      end
+
+      raise ConfigurationError, "layout must be a String, Symbol, callable, or nil, got #{value.inspect}"
+    end
+
     def require_reauthentication=(value)
       if value.nil?
         @require_reauthentication = nil

data/lib/sessions/models/event.rb

@@ -179,11 +179,14 @@ module Sessions
                 .count
         return unless count == config[:threshold]
 
+        user = Sessions.user_for_identity(event.identity, scope: event.scope)
+
         Sessions.safely("on_repeated_failed_logins hook") do
-          Sessions.config.on_repeated_failed_logins.call(
+          call_repeated_failed_logins_hook(
             identity: event.identity,
             count: count,
-            event: event
+            event: event,
+            user: user
           )
         end
       end
@@ -199,6 +202,30 @@ module Sessions
         normalized.empty? ? nil : normalized
       end
 
+      def call_repeated_failed_logins_hook(**kwargs)
+        hook = Sessions.config.on_repeated_failed_logins
+        params = hook_keyword_parameters(hook)
+        return hook.call(**kwargs) if params.nil?
+        return hook.call(**kwargs) if params.any? { |type, _name| type == :keyrest }
+
+        accepted = params.select { |type, _name| %i[key keyreq].include?(type) }
+                         .filter_map { |_type, name| name }
+        hook.call(**kwargs.slice(*accepted))
+      end
+
+      # Procs/lambdas/Method objects expose #parameters directly; a plain
+      # callable object (a class with #call) only exposes them through
+      # #method(:call). nil means "cannot introspect" — dispatch everything
+      # and let the hook decide.
+      def hook_keyword_parameters(hook)
+        return hook.parameters if hook.respond_to?(:parameters)
+        return hook.method(:call).parameters if hook.respond_to?(:call)
+
+        nil
+      rescue StandardError
+        nil
+      end
+
       def context_for(request)
         params = request.respond_to?(:path_parameters) ? request.path_parameters : nil
         return nil unless params && params[:controller]
@@ -221,8 +248,9 @@ module Sessions
       authenticatable
     end
 
-    # The live registry row this event points at — nil once it's been
-    # revoked/logged out (that's the point of the trail).
+    # The lifecycle registry row this event points at. In v0.2 an ended row
+    # remains available as explicit revocation state; nil means the host later
+    # hard-deleted it (for example during account erasure).
     def session
       return nil if session_id.nil?
 

data/lib/sessions/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Sessions
-  VERSION = "0.2.0"
+  VERSION = "0.2.2"
 end

data/lib/sessions.rb

@@ -94,6 +94,27 @@ module Sessions
       config.session_model
     end
 
+    # Resolve a typed login identity to an account for host hooks. Failed
+    # login events still do NOT persist an account link (enumeration safety);
+    # this is only an in-process convenience for notification hooks that are
+    # already allowed to know whether the account exists.
+    def user_for_identity(identity, scope: nil)
+      normalized = Sessions::Event.normalize_identity(identity)
+      return nil if normalized.blank?
+
+      safely("user_for_identity") do
+        model = user_model_for_identity(scope)
+        next nil unless model.respond_to?(:column_names)
+
+        column = %w[email email_address login username phone].find { |name| model.column_names.include?(name) }
+        next nil unless column
+
+        table = model.quoted_table_name
+        quoted_column = model.connection.quote_column_name(column)
+        model.where("LOWER(#{table}.#{quoted_column}) = ?", normalized).first
+      end
+    end
+
     # --- Request-side API -----------------------------------------------------
 
     # Label the login that's about to happen on this request — for flows
@@ -312,6 +333,20 @@ module Sessions
 
     private
 
+    def user_model_for_identity(scope)
+      if scope && defined?(::Devise) && ::Devise.respond_to?(:mappings)
+        mapping = ::Devise.mappings[scope.to_sym] || ::Devise.mappings[scope.to_s]
+        return mapping.to if mapping.respond_to?(:to)
+      end
+
+      reflection = session_model.reflect_on_association(:user)
+      return nil if reflection&.polymorphic?
+
+      reflection&.klass
+    rescue StandardError
+      nil
+    end
+
     def omakase_current(_request)
       return nil unless defined?(::Current) && ::Current.respond_to?(:session)
 
@@ -329,10 +364,22 @@ module Sessions
         next unless key.to_s.match?(pattern) && value.is_a?(Hash)
 
         tracking = Adapters::Warden.parse_tracking_state(value[Adapters::Warden::SESSION_KEY])
-        next unless tracking && tracking[:mode] == "credential"
+        next unless tracking
 
         row = session_model.live.find_by(id: tracking[:id])
-        return row if row.respond_to?(:sessions_token_matches?) && row&.sessions_token_matches?(tracking[:token])
+        next unless row
+
+        case tracking[:mode]
+        when "credential"
+          return row if row.respond_to?(:sessions_token_matches?) && row.sessions_token_matches?(tracking[:token])
+        when "hint"
+          # Tokenless remembered reattach: the tracking state is written
+          # server-side, but corroborate with the signed browser-continuity
+          # cookie before answering "this is the current device" — the same
+          # proof the adapter demands before touching or kicking a hint row.
+          device_id = Adapters::Warden.device_id_from_request(request)
+          return row if device_id.present? && device_id == row.try(:device_id)
+        end
       end
       nil
     rescue StandardError
@@ -362,7 +409,13 @@ module Sessions
 
       count = 0
       expired_sessions_scope.find_each do |session|
-        session.revoke!(reason: :expired)
+        # Expiry is timeout POLICY, not a revocation: end the row (writes the
+        # `expired` audit event; `expired` kicks on resume) but never rotate
+        # the account-wide remember-me credential or fire on_session_revoked.
+        # This matches the adapter's inline expiry and Devise's timeoutable,
+        # where remember-me revival after a timeout is the host's own
+        # rememberable policy — not ours to nuke for every other device.
+        session.end!(reason: :expired)
         count += 1
       end
       count

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: sessions
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.2
 platform: ruby
 authors:
 - rameerez
 bindir: exe
 cert_chain: []
-date: 2026-06-21 00:00:00.000000000 Z
+date: 2026-07-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -73,14 +73,14 @@ dependencies:
   name: browser
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '6.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '6.0'
 - !ruby/object:Gem::Dependency
@@ -174,6 +174,8 @@ files:
 - lib/generators/sessions/templates/madmin/session_events_controller.rb
 - lib/generators/sessions/templates/madmin/session_resource.rb
 - lib/generators/sessions/templates/madmin/sessions_controller.rb
+- lib/generators/sessions/templates/madmin/user_panel/madmin_user_panel.rb
+- lib/generators/sessions/templates/madmin/user_panel/sessions.html.erb
 - lib/generators/sessions/templates/session.rb.erb
 - lib/generators/sessions/templates/sessions_sweep_job.rb
 - lib/generators/sessions/upgrade_generator.rb