fix: Enforce security event severity defaults

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

core/lib/Security/Event/SecurityEvent.php

@@ -51,6 +51,13 @@ class SecurityEvent extends Event
     public const SEVERITY_ERROR = 3;
     public const SEVERITY_CRITICAL = 4;
 
+    public function __construct(string $name, array $data = [])
+    {
+        parent::__construct($name, $data);
+
+        $this->severity = self::getSeverityForEvent($name);
+    }
+
     /**
      * Create a security event with common parameters
      */
@@ -64,9 +71,6 @@ class SecurityEvent extends Event
         $event->ipAddress = $ipAddress;
         $event->deviceFingerprint = $deviceFingerprint;
 
-        // Set default severity based on event type
-        $event->severity = self::getSeverityForEvent($name);
-        
         return $event;
     }
 

tests/php/Unit/Event/SecurityEventTest.php

@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Security\Event\SecurityEvent;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class SecurityEventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Direct construction applies the event type default severity')]
+    public function appliesDefaultSeverityDuringConstruction(): void
+    {
+        self::assertSame(
+            SecurityEvent::SEVERITY_WARNING,
+            (new SecurityEvent(SecurityEvent::AUTH_FAILURE))->getSeverity(),
+        );
+        self::assertSame(
+            SecurityEvent::SEVERITY_ERROR,
+            (new SecurityEvent(SecurityEvent::RATE_LIMIT_EXCEEDED))->getSeverity(),
+        );
+        self::assertSame(
+            SecurityEvent::SEVERITY_CRITICAL,
+            (new SecurityEvent(SecurityEvent::DEVICE_BLOCKED))->getSeverity(),
+        );
+        self::assertSame(
+            SecurityEvent::SEVERITY_INFO,
+            (new SecurityEvent(SecurityEvent::FIREWALL_RULE_CREATED))->getSeverity(),
+        );
+    }
+
+    #[Test]
+    #[TestDox('Explicit severity can override the event type default')]
+    public function allowsSeverityOverride(): void
+    {
+        $event = new SecurityEvent(SecurityEvent::AUTH_FAILURE);
+
+        $event->setSeverity(SecurityEvent::SEVERITY_CRITICAL);
+
+        self::assertSame(SecurityEvent::SEVERITY_CRITICAL, $event->getSeverity());
+    }
+}