Nodarx/server
1
0
Fork 0
Code Issues 1 Pull Requests 5 Actions Projects Releases Activity

fix(firewall): register missing security audit events

Browse Source 
Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>
This commit is contained in:
Sebastian Krupinski
2026-07-30 22:50:42 -04:00
parent 12037da367
commit 5ada4c0c45
3 changed files with 62 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/lib/Module/Module.php
+2
View File
@@ -39,6 +39,8 @@ class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface, M
SecurityEvent::AUTH_SUCCESS,
SecurityEvent::ACCESS_DENIED,
SecurityEvent::BRUTE_FORCE_DETECTED,
SecurityEvent::RATE_LIMIT_EXCEEDED,
SecurityEvent::SUSPICIOUS_ACTIVITY,
] as $event) {
$this->events->listen(
'core',
tests/php/Unit/Module/CoreModuleTest.php
+7 -1
View File
@@ -28,12 +28,18 @@ final class CoreModuleTest extends TestCase
$module->boot();
$definitions = $registry->definitions();
self::assertCount(5, $definitions);
self::assertCount(7, $definitions);
self::assertSame(['core'], array_values(array_unique(array_column($definitions, 'module'))));
self::assertSame(
FirewallService::class,
$registry->listeners(SecurityEvent::AUTH_FAILURE, DeliveryMode::Immediate)[0]->service,
);
foreach ([SecurityEvent::RATE_LIMIT_EXCEEDED, SecurityEvent::SUSPICIOUS_ACTIVITY] as $event) {
$listeners = $registry->listeners($event, DeliveryMode::Deferred);
self::assertCount(1, $listeners);
self::assertSame(FirewallService::class, $listeners[0]->service);
self::assertSame('logSecurityEvent', $listeners[0]->method);
}
self::assertFalse($registry->frozen());
}
tests/php/Unit/Service/FirewallServiceTest.php
+53
View File
@@ -256,6 +256,59 @@ class FirewallServiceTest extends TestCase
);
}
#[TestDox('Rate-limit events retain their request and threshold audit data')]
public function testRateLimitAudit(): void
{
$this->store->expects($this->once())
->method('createLog')
->with(self::callback(static function (FirewallLogObject $log): bool {
$metadata = $log->getMetadata();
return $log->getEventType() === FirewallLogObject::EVENT_RATE_LIMIT
&& $log->getResult() === FirewallLogObject::RESULT_BLOCKED
&& $log->getIpAddress() === '203.0.113.10'
&& $log->getRequestPath() === '/login'
&& $metadata['requestCount'] === 101
&& $metadata['windowSeconds'] === 60;
}))
->willReturnArgument(0);
$event = \KTXF\Event\SecurityEvent::rateLimitExceeded(
'203.0.113.10',
101,
60,
'/login'
);
$event->setTenantId('tenant-a');
$this->service->logSecurityEvent($event);
}
#[TestDox('Suspicious-activity events retain request and detection metadata')]
public function testSuspiciousActivityAudit(): void
{
$this->store->expects($this->once())
->method('createLog')
->with(self::callback(static function (FirewallLogObject $log): bool {
return $log->getEventType() === FirewallLogObject::EVENT_SUSPICIOUS
&& $log->getResult() === FirewallLogObject::RESULT_BLOCKED
&& $log->getIpAddress() === '203.0.113.20'
&& $log->getRequestPath() === '/admin'
&& $log->getRequestMethod() === 'POST'
&& $log->getMetadata()['detector'] === 'payload-signature';
}))
->willReturnArgument(0);
$event = \KTXF\Event\SecurityEvent::create(
\KTXF\Event\SecurityEvent::SUSPICIOUS_ACTIVITY,
'203.0.113.20',
null,
['detector' => 'payload-signature']
);
$event->setTenantId('tenant-a')
->setRequestPath('/admin')
->setRequestMethod('POST');
$this->service->logSecurityEvent($event);
}
#[TestDox('Typed tenant firewall settings drive brute-force thresholds')]
public function testFirewallConfiguration(): void
{