refactor(security): type firewall policy events

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

core/lib/Security/Event/DeviceBlockedEvent.php

@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXF\Event\Event;
+
+final class DeviceBlockedEvent extends Event implements SecurityRequestEventInterface
+{
+    public function __construct(
+        private readonly string $deviceFingerprint,
+        private readonly ?string $reason = null,
+        ?string $tenantId = null,
+    ) {
+        if ($deviceFingerprint === '') {
+            throw new \InvalidArgumentException('Device-block events require a fingerprint.');
+        }
+
+        parent::__construct(
+            self::class,
+            ['device' => $deviceFingerprint, 'reason' => $reason],
+            $tenantId,
+        );
+    }
+
+    public function getIpAddress(): ?string
+    {
+        return null;
+    }
+
+    public function getDeviceFingerprint(): string
+    {
+        return $this->deviceFingerprint;
+    }
+
+    public function getUserAgent(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestPath(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestMethod(): ?string
+    {
+        return null;
+    }
+
+    public function getUserId(): ?string
+    {
+        return null;
+    }
+
+    public function getReason(): ?string
+    {
+        return $this->reason;
+    }
+
+    public function getSeverity(): int
+    {
+        return SecurityEvent::SEVERITY_CRITICAL;
+    }
+}

core/lib/Security/Event/FirewallIpEvent.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXF\Event\Event;
+
+abstract class FirewallIpEvent extends Event implements SecurityRequestEventInterface
+{
+    protected const SEVERITY = SecurityEvent::SEVERITY_INFO;
+
+    final public function __construct(
+        private readonly string $ipAddress,
+        private readonly ?string $reason = null,
+        ?string $tenantId = null,
+    ) {
+        if ($ipAddress === '') {
+            throw new \InvalidArgumentException('Firewall IP events require an IP address.');
+        }
+
+        parent::__construct(
+            static::class,
+            ['ip' => $ipAddress, 'reason' => $reason],
+            $tenantId,
+        );
+    }
+
+    public function getIpAddress(): string
+    {
+        return $this->ipAddress;
+    }
+
+    public function getDeviceFingerprint(): ?string
+    {
+        return null;
+    }
+
+    public function getUserAgent(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestPath(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestMethod(): ?string
+    {
+        return null;
+    }
+
+    public function getUserId(): ?string
+    {
+        return null;
+    }
+
+    public function getReason(): ?string
+    {
+        return $this->reason;
+    }
+
+    public function getSeverity(): int
+    {
+        return static::SEVERITY;
+    }
+}

core/lib/Security/Event/FirewallSettingsUpdatedEvent.php

@@ -0,0 +1,76 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXF\Event\Event;
+
+final class FirewallSettingsUpdatedEvent extends Event implements SecurityEventInterface
+{
+    public function __construct(
+        private readonly string $changeReason,
+        private readonly array $previous,
+        private readonly array $current,
+        string $tenantId,
+        ?string $actorId = null,
+        private readonly string $changeOrigin = 'manual',
+    ) {
+        if ($changeReason === '') {
+            throw new \InvalidArgumentException('Firewall settings updates require a change reason.');
+        }
+        if ($tenantId === '') {
+            throw new \InvalidArgumentException('Firewall settings updates require a tenant ID.');
+        }
+        if ($changeOrigin === '') {
+            throw new \InvalidArgumentException('Firewall settings updates require a change origin.');
+        }
+
+        parent::__construct(
+            self::class,
+            [
+                'changeReason' => $changeReason,
+                'changeOrigin' => $changeOrigin,
+                'previous' => $previous,
+                'current' => $current,
+            ],
+            $tenantId,
+            $actorId,
+        );
+    }
+
+    public function getChangeReason(): string
+    {
+        return $this->changeReason;
+    }
+
+    public function getPrevious(): array
+    {
+        return $this->previous;
+    }
+
+    public function getCurrent(): array
+    {
+        return $this->current;
+    }
+
+    public function getChangeOrigin(): string
+    {
+        return $this->changeOrigin;
+    }
+
+    public function getUserId(): ?string
+    {
+        return null;
+    }
+
+    public function getReason(): string
+    {
+        return $this->changeReason;
+    }
+
+    public function getSeverity(): int
+    {
+        return SecurityEvent::SEVERITY_INFO;
+    }
+}

core/lib/Security/Event/IpAllowedEvent.php

@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+final class IpAllowedEvent extends FirewallIpEvent
+{
+}

core/lib/Security/Event/IpBlockedEvent.php

@@ -0,0 +1,10 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+final class IpBlockedEvent extends FirewallIpEvent
+{
+    protected const SEVERITY = SecurityEvent::SEVERITY_CRITICAL;
+}

core/lib/Security/Event/SecurityEvent.php

@@ -18,10 +18,6 @@ final class SecurityEvent extends Event implements SecurityRequestEventInterface
     
     public const ACCESS_GRANTED = 'security.access.granted';
     
-    public const IP_BLOCKED = 'security.ip.blocked';
-    public const IP_ALLOWED = 'security.ip.allowed';
-    public const DEVICE_BLOCKED = 'security.device.blocked';
-    public const FIREWALL_SETTINGS_UPDATED = 'security.firewall.settings.updated';
 
     // Severity levels
     public const SEVERITY_DEBUG = 0;
@@ -96,9 +92,6 @@ final class SecurityEvent extends Event implements SecurityRequestEventInterface
             self::AUTH_LOGOUT,
             self::TOKEN_REVOKED => self::SEVERITY_WARNING,
             
-            self::IP_BLOCKED,
-            self::DEVICE_BLOCKED => self::SEVERITY_CRITICAL,
-            
             default => self::SEVERITY_INFO,
         };
     }