From 2012d67be7fff69bc84cd7d28a23de51e47841e1 Mon Sep 17 00:00:00 2001
From: Sebastian Krupinski <krupinski01@gmail.com>
Date: Wed, 5 Aug 2026 22:17:04 -0400
Subject: [PATCH] fix: Enforce security event severity defaults

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>
---
 core/lib/Security/Event/SecurityEvent.php  | 12 ++++--
 tests/php/Unit/Event/SecurityEventTest.php | 46 ++++++++++++++++++++++
 2 files changed, 54 insertions(+), 4 deletions(-)
 create mode 100644 tests/php/Unit/Event/SecurityEventTest.php

diff --git a/core/lib/Security/Event/SecurityEvent.php b/core/lib/Security/Event/SecurityEvent.php
index 9f51cf7..ca9247f 100644
--- a/core/lib/Security/Event/SecurityEvent.php
+++ b/core/lib/Security/Event/SecurityEvent.php
@@ -51,6 +51,13 @@ class SecurityEvent extends Event
     public const SEVERITY_ERROR = 3;
     public const SEVERITY_CRITICAL = 4;
 
+    public function __construct(string $name, array $data = [])
+    {
+        parent::__construct($name, $data);
+
+        $this->severity = self::getSeverityForEvent($name);
+    }
+
     /**
      * Create a security event with common parameters
      */
@@ -63,10 +70,7 @@ class SecurityEvent extends Event
         $event = new self($name, $data);
         $event->ipAddress = $ipAddress;
         $event->deviceFingerprint = $deviceFingerprint;
-        
-        // Set default severity based on event type
-        $event->severity = self::getSeverityForEvent($name);
-        
+
         return $event;
     }
 
diff --git a/tests/php/Unit/Event/SecurityEventTest.php b/tests/php/Unit/Event/SecurityEventTest.php
new file mode 100644
index 0000000..ac04c8f
--- /dev/null
+++ b/tests/php/Unit/Event/SecurityEventTest.php
@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Security\Event\SecurityEvent;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class SecurityEventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Direct construction applies the event type default severity')]
+    public function appliesDefaultSeverityDuringConstruction(): void
+    {
+        self::assertSame(
+            SecurityEvent::SEVERITY_WARNING,
+            (new SecurityEvent(SecurityEvent::AUTH_FAILURE))->getSeverity(),
+        );
+        self::assertSame(
+            SecurityEvent::SEVERITY_ERROR,
+            (new SecurityEvent(SecurityEvent::RATE_LIMIT_EXCEEDED))->getSeverity(),
+        );
+        self::assertSame(
+            SecurityEvent::SEVERITY_CRITICAL,
+            (new SecurityEvent(SecurityEvent::DEVICE_BLOCKED))->getSeverity(),
+        );
+        self::assertSame(
+            SecurityEvent::SEVERITY_INFO,
+            (new SecurityEvent(SecurityEvent::FIREWALL_RULE_CREATED))->getSeverity(),
+        );
+    }
+
+    #[Test]
+    #[TestDox('Explicit severity can override the event type default')]
+    public function allowsSeverityOverride(): void
+    {
+        $event = new SecurityEvent(SecurityEvent::AUTH_FAILURE);
+
+        $event->setSeverity(SecurityEvent::SEVERITY_CRITICAL);
+
+        self::assertSame(SecurityEvent::SEVERITY_CRITICAL, $event->getSeverity());
+    }
+}