feat: make event state constructor-only and immutable

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

tests/php/Unit/Event/EventTest.php

@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXF\Event\Event;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class EventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Event data and context are supplied during construction')]
+    public function constructsCompleteEventState(): void
+    {
+        $event = new Event(
+            'test.event',
+            ['nested' => ['value' => 'original']],
+            'tenant-a',
+            'identity-a',
+        );
+
+        $copy = $event->getData();
+        $copy['nested']['value'] = 'changed';
+
+        self::assertSame('original', $event->get('nested')['value']);
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('identity-a', $event->getIdentityId());
+    }
+
+    #[Test]
+    #[TestDox('Event data rejects mutable object references')]
+    public function rejectsMutablePayloadValues(): void
+    {
+        $this->expectException(\InvalidArgumentException::class);
+
+        new Event('test.event', ['mutable' => new \stdClass()]);
+    }
+}

tests/php/Unit/Event/SecurityEventTest.php

@@ -34,13 +34,35 @@ final class SecurityEventTest extends TestCase
     }
 
     #[Test]
-    #[TestDox('Explicit severity can override the event type default')]
+    #[TestDox('Construction can override the event type default severity')]
     public function allowsSeverityOverride(): void
     {
-        $event = new SecurityEvent(SecurityEvent::AUTH_FAILURE);
-
-        $event->setSeverity(SecurityEvent::SEVERITY_CRITICAL);
+        $event = new SecurityEvent(
+            SecurityEvent::AUTH_FAILURE,
+            severity: SecurityEvent::SEVERITY_CRITICAL,
+        );
 
         self::assertSame(SecurityEvent::SEVERITY_CRITICAL, $event->getSeverity());
     }
+
+    #[Test]
+    #[TestDox('Event state exposes no mutation methods')]
+    public function exposesNoMutationMethods(): void
+    {
+        foreach ([
+            'set',
+            'setTenantId',
+            'setIdentityId',
+            'setIpAddress',
+            'setDeviceFingerprint',
+            'setUserAgent',
+            'setRequestPath',
+            'setRequestMethod',
+            'setUserId',
+            'setReason',
+            'setSeverity',
+        ] as $method) {
+            self::assertFalse(method_exists(SecurityEvent::class, $method));
+        }
+    }
 }