feat(firewall): audit rule lifecycle changes

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>
2026-07-30 22:57:25 -04:00
parent 5ada4c0c45
commit 7aa8a27b1b
11 changed files with 218 additions and 25 deletions
@@ -191,7 +191,8 @@ class FirewallService
            $ipAddress,
            sprintf('Auto-blocked: %d failed auth attempts in %d seconds', $failureCount, $windowSeconds),
            null, // System-created
-            $blockDuration
+            $blockDuration,
+            FirewallRuleManager::ORIGIN_AUTOMATIC
        );
    }

@@ -214,10 +215,10 @@ class FirewallService
            ->setRequestPath($event->getRequestPath())
            ->setRequestMethod($event->getRequestMethod())
            ->setEventType($this->mapEventToLogType($event->getName()))
-            ->setResult($this->mapEventToResult($event->getName()))
+            ->setResult($this->mapEventToResult($event))
            ->setRuleId($event->get('ruleId'))
            ->setRuleScope($ruleScope)
-            ->setIdentityId($event->getUserId())
+            ->setIdentityId($event->getUserId() ?? $event->getIdentityId())
            ->setTimestamp(new \DateTimeImmutable())
            ->setMetadata($event->getData());

@@ -236,6 +237,9 @@ class FirewallService
            SecurityEvent::RATE_LIMIT_EXCEEDED => FirewallLogObject::EVENT_RATE_LIMIT,
            SecurityEvent::ACCESS_DENIED => FirewallLogObject::EVENT_RULE_MATCH,
            SecurityEvent::SUSPICIOUS_ACTIVITY => FirewallLogObject::EVENT_SUSPICIOUS,
+            SecurityEvent::FIREWALL_RULE_CREATED => FirewallLogObject::EVENT_RULE_CREATED,
+            SecurityEvent::FIREWALL_RULE_DISABLED => FirewallLogObject::EVENT_RULE_DISABLED,
+            SecurityEvent::FIREWALL_RULE_REMOVED => FirewallLogObject::EVENT_RULE_REMOVED,
            default => FirewallLogObject::EVENT_ACCESS_CHECK,
        };
    }
@@ -243,11 +247,14 @@ class FirewallService
    /**
     * Map security event to result
     */
-    private function mapEventToResult(string $eventName): string
+    private function mapEventToResult(SecurityEvent $event): string
    {
-        return match ($eventName) {
+        return match ($event->getName()) {
            SecurityEvent::AUTH_SUCCESS,
            SecurityEvent::ACCESS_GRANTED => FirewallLogObject::RESULT_ALLOWED,
+            SecurityEvent::FIREWALL_RULE_CREATED,
+            SecurityEvent::FIREWALL_RULE_DISABLED,
+            SecurityEvent::FIREWALL_RULE_REMOVED => FirewallLogObject::RESULT_RECORDED,
            default => FirewallLogObject::RESULT_BLOCKED,
        };
    }