feat(firewall): audit rule lifecycle changes

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>
2026-07-30 22:57:25 -04:00
parent 5ada4c0c45
commit 7aa8a27b1b
11 changed files with 218 additions and 25 deletions
@@ -196,6 +196,29 @@ class FirewallStoreTest extends TestCase
        self::assertSame(FirewallRuleObject::SCOPE_TENANT, $logs[0]->getRuleScope());
    }

+    #[TestDox('Rule lifecycle audit persistence retains actor and origin')]
+    public function testLifecycleAuditPersistence(): void
+    {
+        $log = (new FirewallLogObject())
+            ->setTenantId('tenant-a')
+            ->setEventType(FirewallLogObject::EVENT_RULE_CREATED)
+            ->setResult(FirewallLogObject::RESULT_RECORDED)
+            ->setRuleId('rule-456')
+            ->setRuleScope(FirewallRuleObject::SCOPE_TENANT)
+            ->setIdentityId('admin-a')
+            ->setTimestamp(new \DateTimeImmutable())
+            ->setMetadata(['origin' => FirewallRuleManager::ORIGIN_MANUAL]);
+        $this->store->createLog($log);
+
+        $logs = $this->store->listLogs('tenant-a');
+
+        self::assertCount(1, $logs);
+        self::assertSame(FirewallLogObject::EVENT_RULE_CREATED, $logs[0]->getEventType());
+        self::assertSame(FirewallLogObject::RESULT_RECORDED, $logs[0]->getResult());
+        self::assertSame('admin-a', $logs[0]->getIdentityId());
+        self::assertSame(FirewallRuleManager::ORIGIN_MANUAL, $logs[0]->getMetadata()['origin']);
+    }
+
    private function rule(
        string $reason,
        string $scope,