refactor(security): add typed access-denied event

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

core/lib/Security/Event/AccessDeniedEvent.php

@@ -0,0 +1,88 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXC\Models\Firewall\FirewallRuleObject;
+use KTXF\Event\Event;
+
+final class AccessDeniedEvent extends Event implements SecurityRequestEventInterface
+{
+    public function __construct(
+        private readonly string $ipAddress,
+        private readonly string $ruleId,
+        private readonly string $ruleScope,
+        private readonly ?string $deviceFingerprint = null,
+        private readonly ?string $reason = null,
+        ?string $tenantId = null,
+        ?string $identityId = null,
+    ) {
+        if ($ipAddress === '') {
+            throw new \InvalidArgumentException('Access denial requires an IP address.');
+        }
+        if ($ruleId === '') {
+            throw new \InvalidArgumentException('Access denial requires a firewall rule ID.');
+        }
+        if (!in_array($ruleScope, [FirewallRuleObject::SCOPE_SYSTEM, FirewallRuleObject::SCOPE_TENANT], true)) {
+            throw new \InvalidArgumentException('Access denial requires a valid firewall rule scope.');
+        }
+
+        parent::__construct(
+            self::class,
+            ['ruleId' => $ruleId, 'ruleScope' => $ruleScope, 'reason' => $reason],
+            $tenantId,
+            $identityId,
+        );
+    }
+
+    public function getIpAddress(): string
+    {
+        return $this->ipAddress;
+    }
+
+    public function getRuleId(): string
+    {
+        return $this->ruleId;
+    }
+
+    public function getRuleScope(): string
+    {
+        return $this->ruleScope;
+    }
+
+    public function getDeviceFingerprint(): ?string
+    {
+        return $this->deviceFingerprint;
+    }
+
+    public function getUserAgent(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestPath(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestMethod(): ?string
+    {
+        return null;
+    }
+
+    public function getUserId(): ?string
+    {
+        return null;
+    }
+
+    public function getReason(): ?string
+    {
+        return $this->reason;
+    }
+
+    public function getSeverity(): int
+    {
+        return SecurityEvent::SEVERITY_WARNING;
+    }
+}

core/lib/Security/Event/SecurityEvent.php

@@ -17,7 +17,6 @@ final class SecurityEvent extends Event implements SecurityRequestEventInterface
     public const TOKEN_REFRESH = 'security.token.refresh';
     public const TOKEN_REVOKED = 'security.token.revoked';
     
-    public const ACCESS_DENIED = 'security.access.denied';
     public const ACCESS_GRANTED = 'security.access.granted';
     
     public const RATE_LIMIT_EXCEEDED = 'security.rate_limit.exceeded';
@@ -137,29 +136,6 @@ final class SecurityEvent extends Event implements SecurityRequestEventInterface
         );
     }
 
-    /**
-     * Create an access denied event
-     */
-    public static function accessDenied(
-        string $ipAddress,
-        ?string $deviceFingerprint = null,
-        ?string $ruleId = null,
-        ?string $ruleScope = null,
-        ?string $reason = null,
-        ?string $tenantId = null,
-        ?string $identityId = null,
-    ): self {
-        return self::create(
-            self::ACCESS_DENIED,
-            $ipAddress,
-            $deviceFingerprint,
-            ['ruleId' => $ruleId, 'ruleScope' => $ruleScope, 'reason' => $reason],
-            $tenantId,
-            $identityId,
-            reason: $reason,
-        );
-    }
-
     /**
      * Get default severity for event types
      */
@@ -170,7 +146,6 @@ final class SecurityEvent extends Event implements SecurityRequestEventInterface
             self::ACCESS_GRANTED,
             self::TOKEN_REFRESH => self::SEVERITY_INFO,
             
-            self::ACCESS_DENIED,
             self::AUTH_LOGOUT,
             self::TOKEN_REVOKED => self::SEVERITY_WARNING,