feat(firewall): complete operational reliability phase

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>
2026-07-30 23:39:37 -04:00
parent 90d847ffae
commit 4ee91a7918
15 changed files with 574 additions and 22 deletions
@@ -167,4 +167,80 @@ class FirewallRuleManagerTest extends TestCase
        self::assertSame('operator', $events[SecurityEvent::FIREWALL_RULE_DISABLED]->getIdentityId());
        self::assertSame('operator', $events[SecurityEvent::FIREWALL_RULE_REMOVED]->getIdentityId());
    }
+
+    #[TestDox('Continued attacks extend automatic blocks and retain their audit history')]
+    public function testAutomaticBlockExtension(): void
+    {
+        $originalExpiry = new \DateTimeImmutable('+5 minutes');
+        $rule = (new FirewallRuleObject())
+            ->setId('rule-123')
+            ->setScope(FirewallRuleObject::SCOPE_TENANT)
+            ->setTenantId('tenant-a')
+            ->setType(FirewallRuleObject::TYPE_IP)
+            ->setAction(FirewallRuleObject::ACTION_BLOCK)
+            ->setValue('203.0.113.10')
+            ->setExpiresAt($originalExpiry)
+            ->setMetadata([
+                'origin' => FirewallRuleManager::ORIGIN_AUTOMATIC,
+                'originalExpiresAt' => $originalExpiry->format(\DateTimeInterface::ATOM),
+                'extensions' => [],
+            ]);
+        $this->store->method('findExactIpRule')->willReturn($rule);
+        $this->store->expects(self::once())
+            ->method('depositRule')
+            ->with(self::callback(static function (FirewallRuleObject $extended) use ($originalExpiry): bool {
+                $metadata = $extended->getMetadata();
+                return $extended->getExpiresAt() > $originalExpiry
+                    && $metadata['failureThreshold'] === 5
+                    && $metadata['failureWindowSeconds'] === 300
+                    && $metadata['lastFailureCount'] === 8
+                    && $metadata['originalExpiresAt'] === $originalExpiry->format(\DateTimeInterface::ATOM)
+                    && count($metadata['extensions']) === 1;
+            }))
+            ->willReturnArgument(0);
+        $this->events->expects(self::once())
+            ->method('dispatch')
+            ->with(self::callback(static fn(\KTXF\Event\Event $event): bool =>
+                $event->getName() === SecurityEvent::FIREWALL_RULE_EXTENDED
+                && $event->get('lastFailureCount') === 8
+            ));
+
+        $extended = $this->manager->blockIp(
+            FirewallRuleScope::tenant('tenant-a'),
+            '203.0.113.10',
+            'Continued attack',
+            null,
+            3600,
+            FirewallRuleManager::ORIGIN_AUTOMATIC,
+            [
+                'failureThreshold' => 5,
+                'failureWindowSeconds' => 300,
+                'lastFailureCount' => 8,
+                'blockDurationSeconds' => 3600,
+            ]
+        );
+
+        self::assertSame('rule-123', $extended->getId());
+    }
+
+    #[TestDox('Automatic detection never extends a manual block')]
+    public function testManualBlockIsNotExtended(): void
+    {
+        $rule = (new FirewallRuleObject())
+            ->setScope(FirewallRuleObject::SCOPE_TENANT)
+            ->setTenantId('tenant-a')
+            ->setMetadata(['origin' => FirewallRuleManager::ORIGIN_MANUAL]);
+        $this->store->method('findExactIpRule')->willReturn($rule);
+        $this->store->expects(self::never())->method('depositRule');
+        $this->events->expects(self::never())->method('dispatch');
+
+        self::assertSame($rule, $this->manager->blockIp(
+            FirewallRuleScope::tenant('tenant-a'),
+            '203.0.113.10',
+            null,
+            null,
+            3600,
+            FirewallRuleManager::ORIGIN_AUTOMATIC
+        ));
+    }
 }