refactor(security): replace generic event with severity enum

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

core/lib/Module/Module.php

@@ -23,7 +23,6 @@ use KTXC\Security\Event\FirewallRuleRemovedEvent;
 use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
 use KTXC\Security\Event\RateLimitExceededEvent;
 use KTXC\Security\Event\SuspiciousActivityEvent;
-use KTXC\Security\Event\SecurityEvent;
 use KTXF\Event\DeliveryMode;
 use KTXF\Event\EventListenerRegistrarInterface;
 use KTXF\Module\ModuleBrowserInterface;

core/lib/Security/Event/AccessDeniedEvent.php

@@ -81,8 +81,8 @@ final class AccessDeniedEvent extends Event implements SecurityRequestEventInter
         return $this->reason;
     }
 
-    public function getSeverity(): int
+    public function getSeverity(): SecurityEventSeverity
     {
-        return SecurityEvent::SEVERITY_WARNING;
+        return SecurityEventSeverity::WARNING;
     }
 }

core/lib/Security/Event/AuthenticationFailedEvent.php

@@ -32,8 +32,8 @@ final class AuthenticationFailedEvent extends Event implements SecurityEventInte
         return $this->reason;
     }
 
-    public function getSeverity(): int
+    public function getSeverity(): SecurityEventSeverity
     {
-        return SecurityEvent::SEVERITY_WARNING;
+        return SecurityEventSeverity::WARNING;
     }
 }

core/lib/Security/Event/AuthenticationSucceededEvent.php

@@ -63,8 +63,8 @@ final class AuthenticationSucceededEvent extends Event implements SecurityReques
         return null;
     }
 
-    public function getSeverity(): int
+    public function getSeverity(): SecurityEventSeverity
     {
-        return SecurityEvent::SEVERITY_INFO;
+        return SecurityEventSeverity::INFO;
     }
 }

core/lib/Security/Event/BruteForceDetectedEvent.php

@@ -84,8 +84,8 @@ final class BruteForceDetectedEvent extends Event implements SecurityRequestEven
         return $this->reason;
     }
 
-    public function getSeverity(): int
+    public function getSeverity(): SecurityEventSeverity
     {
-        return SecurityEvent::SEVERITY_CRITICAL;
+        return SecurityEventSeverity::CRITICAL;
     }
 }

core/lib/Security/Event/DeviceBlockedEvent.php

@@ -59,8 +59,8 @@ final class DeviceBlockedEvent extends Event implements SecurityRequestEventInte
         return $this->reason;
     }
 
-    public function getSeverity(): int
+    public function getSeverity(): SecurityEventSeverity
     {
-        return SecurityEvent::SEVERITY_CRITICAL;
+        return SecurityEventSeverity::CRITICAL;
     }
 }

core/lib/Security/Event/FirewallIpEvent.php

@@ -8,7 +8,7 @@ use KTXF\Event\Event;
 
 abstract class FirewallIpEvent extends Event implements SecurityRequestEventInterface
 {
-    protected const SEVERITY = SecurityEvent::SEVERITY_INFO;
+    protected const SecurityEventSeverity SEVERITY = SecurityEventSeverity::INFO;
 
     final public function __construct(
         private readonly string $ipAddress,
@@ -61,7 +61,7 @@ abstract class FirewallIpEvent extends Event implements SecurityRequestEventInte
         return $this->reason;
     }
 
-    public function getSeverity(): int
+    public function getSeverity(): SecurityEventSeverity
     {
         return static::SEVERITY;
     }

core/lib/Security/Event/FirewallRuleEvent.php

@@ -151,8 +151,8 @@ abstract class FirewallRuleEvent extends Event implements SecurityEventInterface
         return $this->reason;
     }
 
-    public function getSeverity(): int
+    public function getSeverity(): SecurityEventSeverity
     {
-        return SecurityEvent::SEVERITY_INFO;
+        return SecurityEventSeverity::INFO;
     }
 }

core/lib/Security/Event/FirewallSettingsUpdatedEvent.php

@@ -69,8 +69,8 @@ final class FirewallSettingsUpdatedEvent extends Event implements SecurityEventI
         return $this->changeReason;
     }
 
-    public function getSeverity(): int
+    public function getSeverity(): SecurityEventSeverity
     {
-        return SecurityEvent::SEVERITY_INFO;
+        return SecurityEventSeverity::INFO;
     }
 }

core/lib/Security/Event/IpBlockedEvent.php

@@ -6,5 +6,5 @@ namespace KTXC\Security\Event;
 
 final class IpBlockedEvent extends FirewallIpEvent
 {
-    protected const SEVERITY = SecurityEvent::SEVERITY_CRITICAL;
+    protected const SecurityEventSeverity SEVERITY = SecurityEventSeverity::CRITICAL;
 }

core/lib/Security/Event/RateLimitExceededEvent.php

@@ -97,8 +97,8 @@ final class RateLimitExceededEvent extends Event implements SecurityRequestEvent
         return $this->reason;
     }
 
-    public function getSeverity(): int
+    public function getSeverity(): SecurityEventSeverity
     {
-        return SecurityEvent::SEVERITY_ERROR;
+        return SecurityEventSeverity::ERROR;
     }
 }

core/lib/Security/Event/SecurityEvent.php

@@ -1,141 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-use KTXF\Event\Event;
-
-/**
- * Security-specific event for authentication and access control events
- */
-final class SecurityEvent extends Event implements SecurityRequestEventInterface
-{
-    // Event names
-    public const AUTH_LOGOUT = 'security.auth.logout';
-    public const TOKEN_REFRESH = 'security.token.refresh';
-    public const TOKEN_REVOKED = 'security.token.revoked';
-    
-    public const ACCESS_GRANTED = 'security.access.granted';
-    
-
-    // Severity levels
-    public const SEVERITY_DEBUG = 0;
-    public const SEVERITY_INFO = 1;
-    public const SEVERITY_WARNING = 2;
-    public const SEVERITY_ERROR = 3;
-    public const SEVERITY_CRITICAL = 4;
-
-    private readonly int $severity;
-
-    public function __construct(
-        string $name,
-        array $data = [],
-        ?string $tenantId = null,
-        ?string $identityId = null,
-        private readonly ?string $ipAddress = null,
-        private readonly ?string $deviceFingerprint = null,
-        private readonly ?string $userAgent = null,
-        private readonly ?string $requestPath = null,
-        private readonly ?string $requestMethod = null,
-        private readonly ?string $userId = null,
-        private readonly ?string $reason = null,
-        ?int $severity = null,
-    ) {
-        parent::__construct($name, $data, $tenantId, $identityId);
-
-        $this->severity = $severity ?? self::getSeverityForEvent($name);
-    }
-
-    /**
-     * Create a security event with common parameters
-     */
-    public static function create(
-        string $name,
-        ?string $ipAddress = null,
-        ?string $deviceFingerprint = null,
-        array $data = [],
-        ?string $tenantId = null,
-        ?string $identityId = null,
-        ?string $userAgent = null,
-        ?string $requestPath = null,
-        ?string $requestMethod = null,
-        ?string $userId = null,
-        ?string $reason = null,
-        ?int $severity = null,
-    ): self {
-        return new self(
-            $name,
-            $data,
-            $tenantId,
-            $identityId,
-            $ipAddress,
-            $deviceFingerprint,
-            $userAgent,
-            $requestPath,
-            $requestMethod,
-            $userId,
-            $reason,
-            $severity,
-        );
-    }
-
-    /**
-     * Get default severity for event types
-     */
-    private static function getSeverityForEvent(string $eventName): int
-    {
-        return match ($eventName) {
-            self::ACCESS_GRANTED,
-            self::TOKEN_REFRESH => self::SEVERITY_INFO,
-            
-            self::AUTH_LOGOUT,
-            self::TOKEN_REVOKED => self::SEVERITY_WARNING,
-            
-            default => self::SEVERITY_INFO,
-        };
-    }
-
-    // Getters and setters
-
-    public function getIpAddress(): ?string
-    {
-        return $this->ipAddress;
-    }
-
-    public function getDeviceFingerprint(): ?string
-    {
-        return $this->deviceFingerprint;
-    }
-
-    public function getUserAgent(): ?string
-    {
-        return $this->userAgent;
-    }
-
-    public function getRequestPath(): ?string
-    {
-        return $this->requestPath;
-    }
-
-    public function getRequestMethod(): ?string
-    {
-        return $this->requestMethod;
-    }
-
-    public function getUserId(): ?string
-    {
-        return $this->userId;
-    }
-
-    public function getReason(): ?string
-    {
-        return $this->reason;
-    }
-
-    public function getSeverity(): int
-    {
-        return $this->severity;
-    }
-
-}

core/lib/Security/Event/SecurityEventInterface.php

@@ -22,5 +22,5 @@ interface SecurityEventInterface
 
     public function getReason(): ?string;
 
-    public function getSeverity(): int;
+    public function getSeverity(): SecurityEventSeverity;
 }

core/lib/Security/Event/SecurityEventSeverity.php

@@ -0,0 +1,14 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+enum SecurityEventSeverity: int
+{
+    case DEBUG = 0;
+    case INFO = 1;
+    case WARNING = 2;
+    case ERROR = 3;
+    case CRITICAL = 4;
+}

core/lib/Security/Event/SuspiciousActivityEvent.php

@@ -93,8 +93,8 @@ final class SuspiciousActivityEvent extends Event implements SecurityRequestEven
         return $this->reason;
     }
 
-    public function getSeverity(): int
+    public function getSeverity(): SecurityEventSeverity
     {
-        return SecurityEvent::SEVERITY_ERROR;
+        return SecurityEventSeverity::ERROR;
     }
 }

core/lib/Service/FirewallService.php

@@ -22,7 +22,6 @@ use KTXC\Security\Event\FirewallRuleRemovedEvent;
 use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
 use KTXC\Security\Event\RateLimitExceededEvent;
 use KTXC\Security\Event\SuspiciousActivityEvent;
-use KTXC\Security\Event\SecurityEvent;
 use KTXC\Security\Event\SecurityEventInterface;
 use KTXC\Security\Event\SecurityRequestEventInterface;
 use KTXF\Event\EventDispatcherInterface;
@@ -311,8 +310,7 @@ class FirewallService
     private function mapEventToResult(SecurityEventInterface $event): string
     {
         return match ($event->getName()) {
-            AuthenticationSucceededEvent::class,
+            AuthenticationSucceededEvent::class => FirewallLogObject::RESULT_ALLOWED,
-            SecurityEvent::ACCESS_GRANTED => FirewallLogObject::RESULT_ALLOWED,
             FirewallRuleCreatedEvent::class,
             FirewallRuleExtendedEvent::class,
             FirewallRuleEnabledEvent::class,

tests/php/Unit/Event/AccessDeniedEventTest.php

@@ -6,7 +6,7 @@ namespace KTXT\Unit\Event;
 
 use KTXC\Models\Firewall\FirewallRuleObject;
 use KTXC\Security\Event\AccessDeniedEvent;
-use KTXC\Security\Event\SecurityEvent;
+use KTXC\Security\Event\SecurityEventSeverity;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
 use PHPUnit\Framework\TestCase;
@@ -35,7 +35,7 @@ final class AccessDeniedEventTest extends TestCase
         self::assertSame('Blocked by policy', $event->getReason());
         self::assertSame('tenant-a', $event->getTenantId());
         self::assertSame('identity-a', $event->getIdentityId());
-        self::assertSame(SecurityEvent::SEVERITY_WARNING, $event->getSeverity());
+        self::assertSame(SecurityEventSeverity::WARNING, $event->getSeverity());
     }
 
     #[Test]

tests/php/Unit/Event/AuthenticationFailedEventTest.php

@@ -5,7 +5,7 @@ declare(strict_types=1);
 namespace KTXT\Unit\Event;
 
 use KTXC\Security\Event\AuthenticationFailedEvent;
-use KTXC\Security\Event\SecurityEvent;
+use KTXC\Security\Event\SecurityEventSeverity;
 use KTXC\Security\Event\SecurityRequestEventInterface;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
@@ -29,7 +29,7 @@ final class AuthenticationFailedEventTest extends TestCase
         self::assertSame('Invalid credentials', $event->getReason());
         self::assertSame('tenant-a', $event->getTenantId());
         self::assertSame('identity-a', $event->getIdentityId());
-        self::assertSame(SecurityEvent::SEVERITY_WARNING, $event->getSeverity());
+        self::assertSame(SecurityEventSeverity::WARNING, $event->getSeverity());
         self::assertNotInstanceOf(SecurityRequestEventInterface::class, $event);
     }
 }

tests/php/Unit/Event/AuthenticationSucceededEventTest.php

@@ -5,7 +5,7 @@ declare(strict_types=1);
 namespace KTXT\Unit\Event;
 
 use KTXC\Security\Event\AuthenticationSucceededEvent;
-use KTXC\Security\Event\SecurityEvent;
+use KTXC\Security\Event\SecurityEventSeverity;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
 use PHPUnit\Framework\TestCase;
@@ -29,7 +29,7 @@ final class AuthenticationSucceededEventTest extends TestCase
         self::assertSame('tenant-a', $event->getTenantId());
         self::assertSame('device-a', $event->getDeviceFingerprint());
         self::assertSame(['userId' => 'user-a'], $event->getData());
-        self::assertSame(SecurityEvent::SEVERITY_INFO, $event->getSeverity());
+        self::assertSame(SecurityEventSeverity::INFO, $event->getSeverity());
     }
 
     #[Test]

tests/php/Unit/Event/BruteForceDetectedEventTest.php

@@ -5,7 +5,7 @@ declare(strict_types=1);
 namespace KTXT\Unit\Event;
 
 use KTXC\Security\Event\BruteForceDetectedEvent;
-use KTXC\Security\Event\SecurityEvent;
+use KTXC\Security\Event\SecurityEventSeverity;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
 use PHPUnit\Framework\TestCase;
@@ -33,7 +33,7 @@ final class BruteForceDetectedEventTest extends TestCase
             ['failureCount' => 5, 'windowSeconds' => 300],
             $event->getData(),
         );
-        self::assertSame(SecurityEvent::SEVERITY_CRITICAL, $event->getSeverity());
+        self::assertSame(SecurityEventSeverity::CRITICAL, $event->getSeverity());
     }
 
     #[Test]

tests/php/Unit/Event/FirewallPolicyEventTest.php

@@ -8,7 +8,7 @@ use KTXC\Security\Event\DeviceBlockedEvent;
 use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
 use KTXC\Security\Event\IpAllowedEvent;
 use KTXC\Security\Event\IpBlockedEvent;
-use KTXC\Security\Event\SecurityEvent;
+use KTXC\Security\Event\SecurityEventSeverity;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
 use PHPUnit\Framework\TestCase;
@@ -26,13 +26,13 @@ final class FirewallPolicyEventTest extends TestCase
         self::assertSame(IpBlockedEvent::class, $blocked->getName());
         self::assertSame('203.0.113.10', $blocked->getIpAddress());
         self::assertSame('Repeated abuse', $blocked->getReason());
-        self::assertSame(SecurityEvent::SEVERITY_CRITICAL, $blocked->getSeverity());
+        self::assertSame(SecurityEventSeverity::CRITICAL, $blocked->getSeverity());
         self::assertSame(IpAllowedEvent::class, $allowed->getName());
         self::assertSame('203.0.113.11', $allowed->getIpAddress());
-        self::assertSame(SecurityEvent::SEVERITY_INFO, $allowed->getSeverity());
+        self::assertSame(SecurityEventSeverity::INFO, $allowed->getSeverity());
         self::assertSame(DeviceBlockedEvent::class, $device->getName());
         self::assertSame('device-a', $device->getDeviceFingerprint());
-        self::assertSame(SecurityEvent::SEVERITY_CRITICAL, $device->getSeverity());
+        self::assertSame(SecurityEventSeverity::CRITICAL, $device->getSeverity());
     }
 
     #[Test]
@@ -54,7 +54,7 @@ final class FirewallPolicyEventTest extends TestCase
         self::assertSame('tenant-a', $event->getTenantId());
         self::assertSame('operator-a', $event->getIdentityId());
         self::assertSame('manual', $event->getChangeOrigin());
-        self::assertSame(SecurityEvent::SEVERITY_INFO, $event->getSeverity());
+        self::assertSame(SecurityEventSeverity::INFO, $event->getSeverity());
     }
 
     #[Test]

tests/php/Unit/Event/FirewallRuleEventTest.php

@@ -10,7 +10,7 @@ use KTXC\Security\Event\FirewallRuleDisabledEvent;
 use KTXC\Security\Event\FirewallRuleEnabledEvent;
 use KTXC\Security\Event\FirewallRuleExtendedEvent;
 use KTXC\Security\Event\FirewallRuleRemovedEvent;
-use KTXC\Security\Event\SecurityEvent;
+use KTXC\Security\Event\SecurityEventSeverity;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
 use PHPUnit\Framework\TestCase;
@@ -54,7 +54,7 @@ final class FirewallRuleEventTest extends TestCase
         self::assertSame('operator-a', $event->getIdentityId());
         self::assertSame(5, $event->get('failureCount'));
         self::assertSame('Continue monitoring', $event->get('changeReason'));
-        self::assertSame(SecurityEvent::SEVERITY_INFO, $event->getSeverity());
+        self::assertSame(SecurityEventSeverity::INFO, $event->getSeverity());
     }
 
     #[Test]

tests/php/Unit/Event/RateLimitExceededEventTest.php

@@ -5,7 +5,7 @@ declare(strict_types=1);
 namespace KTXT\Unit\Event;
 
 use KTXC\Security\Event\RateLimitExceededEvent;
-use KTXC\Security\Event\SecurityEvent;
+use KTXC\Security\Event\SecurityEventSeverity;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
 use PHPUnit\Framework\TestCase;
@@ -32,7 +32,7 @@ final class RateLimitExceededEventTest extends TestCase
         self::assertSame('/login', $event->getRequestPath());
         self::assertSame('tenant-a', $event->getTenantId());
         self::assertSame('101 requests in 60 seconds', $event->getReason());
-        self::assertSame(SecurityEvent::SEVERITY_ERROR, $event->getSeverity());
+        self::assertSame(SecurityEventSeverity::ERROR, $event->getSeverity());
     }
 
     #[Test]

tests/php/Unit/Event/SecurityEventSeverityTest.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Security\Event\SecurityEventSeverity;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class SecurityEventSeverityTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Security severity levels expose stable numeric values')]
+    public function exposesStableNumericValues(): void
+    {
+        self::assertSame(0, SecurityEventSeverity::DEBUG->value);
+        self::assertSame(1, SecurityEventSeverity::INFO->value);
+        self::assertSame(2, SecurityEventSeverity::WARNING->value);
+        self::assertSame(3, SecurityEventSeverity::ERROR->value);
+        self::assertSame(4, SecurityEventSeverity::CRITICAL->value);
+    }
+}

tests/php/Unit/Event/SecurityEventTest.php

@@ -1,60 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXT\Unit\Event;
-
-use KTXC\Security\Event\SecurityEvent;
-use PHPUnit\Framework\Attributes\Test;
-use PHPUnit\Framework\Attributes\TestDox;
-use PHPUnit\Framework\TestCase;
-
-final class SecurityEventTest extends TestCase
-{
-    #[Test]
-    #[TestDox('Direct construction applies the event type default severity')]
-    public function appliesDefaultSeverityDuringConstruction(): void
-    {
-        self::assertSame(
-            SecurityEvent::SEVERITY_WARNING,
-            (new SecurityEvent(SecurityEvent::AUTH_LOGOUT))->getSeverity(),
-        );
-        self::assertSame(
-            SecurityEvent::SEVERITY_INFO,
-            (new SecurityEvent(SecurityEvent::ACCESS_GRANTED))->getSeverity(),
-        );
-    }
-
-    #[Test]
-    #[TestDox('Construction can override the event type default severity')]
-    public function allowsSeverityOverride(): void
-    {
-        $event = new SecurityEvent(
-            SecurityEvent::AUTH_LOGOUT,
-            severity: SecurityEvent::SEVERITY_CRITICAL,
-        );
-
-        self::assertSame(SecurityEvent::SEVERITY_CRITICAL, $event->getSeverity());
-    }
-
-    #[Test]
-    #[TestDox('Event state exposes no mutation methods')]
-    public function exposesNoMutationMethods(): void
-    {
-        foreach ([
-            'set',
-            'setTenantId',
-            'setIdentityId',
-            'setIpAddress',
-            'setDeviceFingerprint',
-            'setUserAgent',
-            'setRequestPath',
-            'setRequestMethod',
-            'setUserId',
-            'setReason',
-            'setSeverity',
-        ] as $method) {
-            self::assertFalse(method_exists(SecurityEvent::class, $method));
-        }
-    }
-}

tests/php/Unit/Event/SuspiciousActivityEventTest.php

@@ -4,7 +4,7 @@ declare(strict_types=1);
 
 namespace KTXT\Unit\Event;
 
-use KTXC\Security\Event\SecurityEvent;
+use KTXC\Security\Event\SecurityEventSeverity;
 use KTXC\Security\Event\SuspiciousActivityEvent;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
@@ -43,7 +43,7 @@ final class SuspiciousActivityEventTest extends TestCase
         self::assertSame('POST', $event->getRequestMethod());
         self::assertSame('user-a', $event->getUserId());
         self::assertSame('Matched a blocked payload signature', $event->getReason());
-        self::assertSame(SecurityEvent::SEVERITY_ERROR, $event->getSeverity());
+        self::assertSame(SecurityEventSeverity::ERROR, $event->getSeverity());
     }
 
     #[Test]

tests/php/Unit/Module/CoreModuleTest.php

@@ -28,7 +28,6 @@ use KTXC\Security\Event\FirewallRuleRemovedEvent;
 use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
 use KTXC\Security\Event\RateLimitExceededEvent;
 use KTXC\Security\Event\SuspiciousActivityEvent;
-use KTXC\Security\Event\SecurityEvent;
 use KTXF\Event\DeliveryMode;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;