refactor(security): type firewall rule lifecycle events
Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>
This commit is contained in:
@@ -11,7 +11,11 @@ use KTXC\Service\FirewallRuleManager;
|
||||
use KTXC\Service\FirewallRuleScope;
|
||||
use KTXC\Stores\FirewallStore;
|
||||
use KTXF\Event\EventDispatcherInterface;
|
||||
use KTXC\Security\Event\SecurityEvent;
|
||||
use KTXC\Security\Event\FirewallRuleCreatedEvent;
|
||||
use KTXC\Security\Event\FirewallRuleDisabledEvent;
|
||||
use KTXC\Security\Event\FirewallRuleEnabledEvent;
|
||||
use KTXC\Security\Event\FirewallRuleExtendedEvent;
|
||||
use KTXC\Security\Event\FirewallRuleRemovedEvent;
|
||||
use PHPUnit\Framework\Attributes\AllowMockObjectsWithoutExpectations;
|
||||
use PHPUnit\Framework\Attributes\TestDox;
|
||||
use PHPUnit\Framework\MockObject\MockObject;
|
||||
@@ -41,7 +45,10 @@ class FirewallRuleManagerTest extends TestCase
|
||||
$this->store->method('findExactIpRule')->willReturn(null);
|
||||
$this->store->expects($this->exactly(2))
|
||||
->method('depositRule')
|
||||
->willReturnArgument(0);
|
||||
->willReturnCallback(static function (FirewallRuleObject $rule): FirewallRuleObject {
|
||||
static $sequence = 0;
|
||||
return $rule->setId('rule-' . ++$sequence);
|
||||
});
|
||||
|
||||
$tenant = $this->manager->blockIp(
|
||||
FirewallRuleScope::tenant('tenant-a'), '203.0.113.10', null, 'admin-a'
|
||||
@@ -135,7 +142,11 @@ class FirewallRuleManagerTest extends TestCase
|
||||
public function testConfirmedCurrentIpBlock(): void
|
||||
{
|
||||
$this->store->method('findExactIpRule')->willReturn(null);
|
||||
$this->store->expects(self::once())->method('depositRule')->willReturnArgument(0);
|
||||
$this->store->expects(self::once())
|
||||
->method('depositRule')
|
||||
->willReturnCallback(static fn(FirewallRuleObject $rule): FirewallRuleObject =>
|
||||
$rule->setId('rule-confirmed')
|
||||
);
|
||||
|
||||
$rule = $this->manager->createManualRule(
|
||||
FirewallRuleScope::tenant('tenant-a'),
|
||||
@@ -249,7 +260,9 @@ class FirewallRuleManagerTest extends TestCase
|
||||
$cache = new FirewallRuleCache($this->store);
|
||||
$manager = new FirewallRuleManager($this->store, $cache, $this->events);
|
||||
$this->store->method('findExactIpRule')->willReturn(null);
|
||||
$this->store->method('depositRule')->willReturnArgument(0);
|
||||
$this->store->method('depositRule')->willReturnCallback(
|
||||
static fn(FirewallRuleObject $rule): FirewallRuleObject => $rule->setId('rule-cache')
|
||||
);
|
||||
|
||||
self::assertSame([], $cache->tenant('tenant-a'));
|
||||
$manager->blockIp(FirewallRuleScope::tenant('tenant-a'), '203.0.113.10', null, 'admin');
|
||||
@@ -280,7 +293,7 @@ class FirewallRuleManagerTest extends TestCase
|
||||
300
|
||||
);
|
||||
|
||||
$audit = $events[SecurityEvent::FIREWALL_RULE_CREATED];
|
||||
$audit = $events[FirewallRuleCreatedEvent::class];
|
||||
self::assertSame('rule-123', $audit->get('ruleId'));
|
||||
self::assertSame(FirewallRuleObject::SCOPE_TENANT, $audit->get('ruleScope'));
|
||||
self::assertSame(FirewallRuleObject::TYPE_IP, $audit->get('ruleType'));
|
||||
@@ -329,10 +342,10 @@ class FirewallRuleManagerTest extends TestCase
|
||||
self::assertGreaterThan($originalExpiry, $extended->getExpiresAt());
|
||||
self::assertCount(1, $extended->getMetadata()['extensions']);
|
||||
self::assertSame([
|
||||
SecurityEvent::FIREWALL_RULE_DISABLED,
|
||||
SecurityEvent::FIREWALL_RULE_ENABLED,
|
||||
SecurityEvent::FIREWALL_RULE_EXTENDED,
|
||||
SecurityEvent::FIREWALL_RULE_REMOVED,
|
||||
FirewallRuleDisabledEvent::class,
|
||||
FirewallRuleEnabledEvent::class,
|
||||
FirewallRuleExtendedEvent::class,
|
||||
FirewallRuleRemovedEvent::class,
|
||||
], array_map(static fn($event): string => $event->getName(), $audits));
|
||||
self::assertSame(
|
||||
['Investigation', 'Threat confirmed', 'Continue monitoring', 'Case closed'],
|
||||
@@ -401,7 +414,7 @@ class FirewallRuleManagerTest extends TestCase
|
||||
$this->events->expects(self::once())
|
||||
->method('dispatch')
|
||||
->with(self::callback(static fn(\KTXF\Event\Event $event): bool =>
|
||||
$event->getName() === SecurityEvent::FIREWALL_RULE_EXTENDED
|
||||
$event instanceof FirewallRuleExtendedEvent
|
||||
&& $event->get('lastFailureCount') === 8
|
||||
));
|
||||
|
||||
|
||||
@@ -102,7 +102,9 @@ class FirewallRuleServicesTest extends TestCase
|
||||
->with(self::callback(static fn(FirewallRuleObject $rule): bool =>
|
||||
$rule->isTenantScoped() && $rule->getTenantId() === 'tenant-a'
|
||||
))
|
||||
->willReturnArgument(0);
|
||||
->willReturnCallback(static fn(FirewallRuleObject $rule): FirewallRuleObject =>
|
||||
$rule->setId('tenant-rule')
|
||||
);
|
||||
|
||||
$this->tenantService()->blockIp('203.0.113.10');
|
||||
}
|
||||
@@ -117,7 +119,9 @@ class FirewallRuleServicesTest extends TestCase
|
||||
->with(self::callback(static fn(FirewallRuleObject $rule): bool =>
|
||||
$rule->isSystemScoped() && $rule->getTenantId() === null
|
||||
))
|
||||
->willReturnArgument(0);
|
||||
->willReturnCallback(static fn(FirewallRuleObject $rule): FirewallRuleObject =>
|
||||
$rule->setId('system-rule')
|
||||
);
|
||||
|
||||
$this->systemService()->blockIp('203.0.113.10');
|
||||
}
|
||||
|
||||
@@ -14,6 +14,8 @@ use KTXC\Security\Event\AccessDeniedEvent;
|
||||
use KTXC\Security\Event\AuthenticationFailedEvent;
|
||||
use KTXC\Security\Event\AuthenticationSucceededEvent;
|
||||
use KTXC\Security\Event\BruteForceDetectedEvent;
|
||||
use KTXC\Security\Event\FirewallRuleCreatedEvent;
|
||||
use KTXC\Security\Event\FirewallRuleDisabledEvent;
|
||||
use KTXC\Security\Event\RateLimitExceededEvent;
|
||||
use KTXC\Security\Event\SuspiciousActivityEvent;
|
||||
use KTXC\Service\FirewallService;
|
||||
@@ -367,14 +369,15 @@ class FirewallServiceTest extends TestCase
|
||||
&& $log->getIdentityId() === 'operator';
|
||||
}))
|
||||
->willReturnArgument(0);
|
||||
$event = new \KTXC\Security\Event\SecurityEvent(
|
||||
\KTXC\Security\Event\SecurityEvent::FIREWALL_RULE_DISABLED,
|
||||
[
|
||||
'ruleId' => 'rule-123',
|
||||
'ruleScope' => FirewallRuleObject::SCOPE_SYSTEM,
|
||||
'origin' => FirewallRuleManager::ORIGIN_MANUAL,
|
||||
],
|
||||
identityId: 'operator',
|
||||
$event = FirewallRuleDisabledEvent::fromRule(
|
||||
(new FirewallRuleObject())
|
||||
->setId('rule-123')
|
||||
->setScope(FirewallRuleObject::SCOPE_SYSTEM)
|
||||
->setType(FirewallRuleObject::TYPE_IP)
|
||||
->setAction(FirewallRuleObject::ACTION_BLOCK)
|
||||
->setValue('203.0.113.10')
|
||||
->setMetadata(['origin' => FirewallRuleManager::ORIGIN_MANUAL]),
|
||||
'operator',
|
||||
);
|
||||
|
||||
$this->service->logSecurityEvent($event);
|
||||
@@ -521,7 +524,9 @@ class FirewallServiceTest extends TestCase
|
||||
&& $metadata['lastFailureCount'] === 5
|
||||
&& $metadata['blockDurationSeconds'] === 3600;
|
||||
}))
|
||||
->willReturnArgument(0);
|
||||
->willReturnCallback(static fn(FirewallRuleObject $rule): FirewallRuleObject =>
|
||||
$rule->setId('automatic-rule')
|
||||
);
|
||||
|
||||
$publishedTenants = [];
|
||||
$lifecycleOrigin = null;
|
||||
@@ -537,7 +542,7 @@ class FirewallServiceTest extends TestCase
|
||||
if ($event instanceof BruteForceDetectedEvent) {
|
||||
$bruteForceEvent = $event;
|
||||
}
|
||||
if ($event->getName() === \KTXC\Security\Event\SecurityEvent::FIREWALL_RULE_CREATED) {
|
||||
if ($event instanceof FirewallRuleCreatedEvent) {
|
||||
$lifecycleOrigin = $event->get('origin');
|
||||
}
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user