feat(firewall): complete rule-match audit context

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

tests/php/Integration/Stores/FirewallStoreTest.php

@@ -6,6 +6,7 @@ namespace KTXT\Integration\Stores;
 
 use KTXC\Db\DataStore;
 use KTXC\Models\Firewall\FirewallRuleObject;
+use KTXC\Models\Firewall\FirewallLogObject;
 use KTXC\Service\FirewallRuleCache;
 use KTXC\Service\FirewallRuleManager;
 use KTXC\Service\FirewallRuleScope;
@@ -175,6 +176,26 @@ class FirewallStoreTest extends TestCase
         self::assertTrue($rules[0]->isSystemScoped());
     }
 
+    #[TestDox('Firewall log persistence retains matched rule context')]
+    public function testRuleAuditPersistence(): void
+    {
+        $log = (new FirewallLogObject())
+            ->setTenantId('tenant-a')
+            ->setIpAddress('203.0.113.10')
+            ->setEventType(FirewallLogObject::EVENT_RULE_MATCH)
+            ->setResult(FirewallLogObject::RESULT_BLOCKED)
+            ->setRuleId('rule-123')
+            ->setRuleScope(FirewallRuleObject::SCOPE_TENANT)
+            ->setTimestamp(new \DateTimeImmutable());
+        $this->store->createLog($log);
+
+        $logs = $this->store->listLogs('tenant-a');
+
+        self::assertCount(1, $logs);
+        self::assertSame('rule-123', $logs[0]->getRuleId());
+        self::assertSame(FirewallRuleObject::SCOPE_TENANT, $logs[0]->getRuleScope());
+    }
+
     private function rule(
         string $reason,
         string $scope,