refactor(security): type firewall policy events

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

tests/php/Unit/Event/FirewallPolicyEventTest.php

@@ -0,0 +1,79 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Security\Event\DeviceBlockedEvent;
+use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
+use KTXC\Security\Event\IpAllowedEvent;
+use KTXC\Security\Event\IpBlockedEvent;
+use KTXC\Security\Event\SecurityEvent;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class FirewallPolicyEventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('IP and device policy events expose typed immutable state')]
+    public function constructsSubjectPolicyEvents(): void
+    {
+        $blocked = new IpBlockedEvent('203.0.113.10', 'Repeated abuse', 'tenant-a');
+        $allowed = new IpAllowedEvent('203.0.113.11', 'Trusted service', 'tenant-a');
+        $device = new DeviceBlockedEvent('device-a', 'Compromised device', 'tenant-a');
+
+        self::assertSame(IpBlockedEvent::class, $blocked->getName());
+        self::assertSame('203.0.113.10', $blocked->getIpAddress());
+        self::assertSame('Repeated abuse', $blocked->getReason());
+        self::assertSame(SecurityEvent::SEVERITY_CRITICAL, $blocked->getSeverity());
+        self::assertSame(IpAllowedEvent::class, $allowed->getName());
+        self::assertSame('203.0.113.11', $allowed->getIpAddress());
+        self::assertSame(SecurityEvent::SEVERITY_INFO, $allowed->getSeverity());
+        self::assertSame(DeviceBlockedEvent::class, $device->getName());
+        self::assertSame('device-a', $device->getDeviceFingerprint());
+        self::assertSame(SecurityEvent::SEVERITY_CRITICAL, $device->getSeverity());
+    }
+
+    #[Test]
+    #[TestDox('Firewall settings events capture the complete configuration transition')]
+    public function constructsSettingsEvent(): void
+    {
+        $event = new FirewallSettingsUpdatedEvent(
+            'Tighten controls',
+            ['maxAuthFailures' => 5],
+            ['maxAuthFailures' => 3],
+            'tenant-a',
+            'operator-a',
+        );
+
+        self::assertSame(FirewallSettingsUpdatedEvent::class, $event->getName());
+        self::assertSame('Tighten controls', $event->getChangeReason());
+        self::assertSame(['maxAuthFailures' => 5], $event->getPrevious());
+        self::assertSame(['maxAuthFailures' => 3], $event->getCurrent());
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('operator-a', $event->getIdentityId());
+        self::assertSame('manual', $event->getChangeOrigin());
+        self::assertSame(SecurityEvent::SEVERITY_INFO, $event->getSeverity());
+    }
+
+    #[Test]
+    #[TestDox('Firewall policy events reject missing subject and ownership context')]
+    public function rejectsIncompletePolicyContext(): void
+    {
+        foreach ([
+            static fn() => new IpBlockedEvent(''),
+            static fn() => new IpAllowedEvent(''),
+            static fn() => new DeviceBlockedEvent(''),
+            static fn() => new FirewallSettingsUpdatedEvent('', [], [], 'tenant-a'),
+            static fn() => new FirewallSettingsUpdatedEvent('Reason', [], [], ''),
+        ] as $construction) {
+            try {
+                $construction();
+                self::fail('Incomplete firewall policy context was accepted.');
+            } catch (\InvalidArgumentException) {
+                $this->addToAssertionCount(1);
+            }
+        }
+    }
+}

tests/php/Unit/Event/SecurityEventTest.php

@@ -19,13 +19,9 @@ final class SecurityEventTest extends TestCase
             SecurityEvent::SEVERITY_WARNING,
             (new SecurityEvent(SecurityEvent::AUTH_LOGOUT))->getSeverity(),
         );
-        self::assertSame(
-            SecurityEvent::SEVERITY_CRITICAL,
-            (new SecurityEvent(SecurityEvent::DEVICE_BLOCKED))->getSeverity(),
-        );
         self::assertSame(
             SecurityEvent::SEVERITY_INFO,
-            (new SecurityEvent(SecurityEvent::IP_ALLOWED))->getSeverity(),
+            (new SecurityEvent(SecurityEvent::ACCESS_GRANTED))->getSeverity(),
         );
     }