refactor(security): type firewall rule lifecycle events

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

tests/php/Unit/Event/FirewallRuleEventTest.php

@@ -0,0 +1,81 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Models\Firewall\FirewallRuleObject;
+use KTXC\Security\Event\FirewallRuleCreatedEvent;
+use KTXC\Security\Event\FirewallRuleDisabledEvent;
+use KTXC\Security\Event\FirewallRuleEnabledEvent;
+use KTXC\Security\Event\FirewallRuleExtendedEvent;
+use KTXC\Security\Event\FirewallRuleRemovedEvent;
+use KTXC\Security\Event\SecurityEvent;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class FirewallRuleEventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Firewall rule events capture immutable rule snapshots')]
+    public function capturesRuleSnapshot(): void
+    {
+        $expiresAt = new \DateTimeImmutable('+5 minutes');
+        $rule = (new FirewallRuleObject())
+            ->setId('rule-a')
+            ->setScope(FirewallRuleObject::SCOPE_TENANT)
+            ->setTenantId('tenant-a')
+            ->setType(FirewallRuleObject::TYPE_IP)
+            ->setAction(FirewallRuleObject::ACTION_BLOCK)
+            ->setValue('203.0.113.10')
+            ->setReason('Repeated abuse')
+            ->setCreatedBy('creator-a')
+            ->setExpiresAt($expiresAt)
+            ->setMetadata(['origin' => 'automatic', 'failureCount' => 5]);
+
+        $event = FirewallRuleExtendedEvent::fromRule(
+            $rule,
+            'operator-a',
+            ['changeReason' => 'Continue monitoring'],
+        );
+        $rule->setReason('Mutated after publication');
+
+        self::assertSame(FirewallRuleExtendedEvent::class, $event->getName());
+        self::assertSame('rule-a', $event->getRuleId());
+        self::assertSame(FirewallRuleObject::SCOPE_TENANT, $event->getRuleScope());
+        self::assertSame(FirewallRuleObject::TYPE_IP, $event->getRuleType());
+        self::assertSame(FirewallRuleObject::ACTION_BLOCK, $event->getRuleAction());
+        self::assertSame('203.0.113.10', $event->getRuleValue());
+        self::assertSame('Repeated abuse', $event->getReason());
+        self::assertSame('automatic', $event->getOrigin());
+        self::assertSame($expiresAt->format(\DateTimeInterface::ATOM), $event->getExpiresAt());
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('operator-a', $event->getIdentityId());
+        self::assertSame(5, $event->get('failureCount'));
+        self::assertSame('Continue monitoring', $event->get('changeReason'));
+        self::assertSame(SecurityEvent::SEVERITY_INFO, $event->getSeverity());
+    }
+
+    #[Test]
+    #[TestDox('Each firewall rule lifecycle operation has a dedicated event key')]
+    public function exposesDedicatedLifecycleKeys(): void
+    {
+        $rule = (new FirewallRuleObject())
+            ->setId('rule-a')
+            ->setScope(FirewallRuleObject::SCOPE_SYSTEM)
+            ->setType(FirewallRuleObject::TYPE_IP)
+            ->setAction(FirewallRuleObject::ACTION_BLOCK)
+            ->setValue('203.0.113.10');
+
+        foreach ([
+            FirewallRuleCreatedEvent::class,
+            FirewallRuleExtendedEvent::class,
+            FirewallRuleEnabledEvent::class,
+            FirewallRuleDisabledEvent::class,
+            FirewallRuleRemovedEvent::class,
+        ] as $eventClass) {
+            self::assertSame($eventClass, $eventClass::fromRule($rule)->getName());
+        }
+    }
+}

tests/php/Unit/Event/SecurityEventTest.php

@@ -25,7 +25,7 @@ final class SecurityEventTest extends TestCase
         );
         self::assertSame(
             SecurityEvent::SEVERITY_INFO,
-            (new SecurityEvent(SecurityEvent::FIREWALL_RULE_CREATED))->getSeverity(),
+            (new SecurityEvent(SecurityEvent::IP_ALLOWED))->getSeverity(),
         );
     }