feat(firewall): complete rule-match audit context

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

core/lib/Models/Firewall/FirewallLogObject.php

@@ -31,6 +31,7 @@ class FirewallLogObject implements \JsonSerializable, JsonDeserializable
     private ?string $eventType = null;
     private ?string $result = null;          // allowed, blocked
     private ?string $ruleId = null;          // Which rule triggered (if any)
+    private ?string $ruleScope = null;       // tenant or system
     private ?string $identityId = null;      // User ID if authenticated
     private ?\DateTimeImmutable $timestamp = null;
     private ?array $metadata = null;         // Additional context
@@ -74,6 +75,9 @@ class FirewallLogObject implements \JsonSerializable, JsonDeserializable
         if (array_key_exists('ruleId', $data)) {
             $this->ruleId = $data['ruleId'] !== null ? (string)$data['ruleId'] : null;
         }
+        if (array_key_exists('ruleScope', $data)) {
+            $this->ruleScope = $data['ruleScope'] !== null ? (string)$data['ruleScope'] : null;
+        }
         if (array_key_exists('identityId', $data)) {
             $this->identityId = $data['identityId'] !== null ? (string)$data['identityId'] : null;
         }
@@ -102,6 +106,7 @@ class FirewallLogObject implements \JsonSerializable, JsonDeserializable
             'eventType' => $this->eventType,
             'result' => $this->result,
             'ruleId' => $this->ruleId,
+            'ruleScope' => $this->ruleScope,
             'identityId' => $this->identityId,
             'timestamp' => $this->timestamp?->format(\DateTimeInterface::ATOM),
             'metadata' => $this->metadata,
@@ -220,6 +225,24 @@ class FirewallLogObject implements \JsonSerializable, JsonDeserializable
         return $this;
     }
 
+    public function getRuleScope(): ?string
+    {
+        return $this->ruleScope;
+    }
+
+    public function setRuleScope(?string $ruleScope): self
+    {
+        if (
+            $ruleScope !== null
+            && !in_array($ruleScope, [FirewallRuleObject::SCOPE_TENANT, FirewallRuleObject::SCOPE_SYSTEM], true)
+        ) {
+            throw new \InvalidArgumentException("Invalid firewall rule scope: {$ruleScope}");
+        }
+
+        $this->ruleScope = $ruleScope;
+        return $this;
+    }
+
     public function getIdentityId(): ?string
     {
         return $this->identityId;

core/lib/Service/FirewallService.php

@@ -201,7 +201,8 @@ class FirewallService
     public function logSecurityEvent(SecurityEvent $event): void
     {
         $tenantId = $event->getTenantId() ?? $this->tenantContext->identifier();
-        if (!$tenantId) {
+        $ruleScope = $event->get('ruleScope');
+        if (!$tenantId && $ruleScope !== FirewallRuleObject::SCOPE_SYSTEM) {
             return;
         }
 
@@ -214,6 +215,8 @@ class FirewallService
             ->setRequestMethod($event->getRequestMethod())
             ->setEventType($this->mapEventToLogType($event->getName()))
             ->setResult($this->mapEventToResult($event->getName()))
+            ->setRuleId($event->get('ruleId'))
+            ->setRuleScope($ruleScope)
             ->setIdentityId($event->getUserId())
             ->setTimestamp(new \DateTimeImmutable())
             ->setMetadata($event->getData());
@@ -261,6 +264,7 @@ class FirewallService
             $ipAddress,
             $deviceFingerprint,
             $rule->getId(),
+            $rule->getScope(),
             $rule->getReason()
         );
         $event->setTenantId($this->tenantContext->identifier());