fix(firewall): account for authentication failures exactly once

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

core/lib/Service/FirewallService.php

@@ -139,6 +139,12 @@ class FirewallService
             return;
         }
 
+        $event->setTenantId($tenantId);
+        $log = $this->securityLog($event);
+        if ($log === null || !$this->store->createLogOnce($log)) {
+            return;
+        }
+
         // Check for brute force
         $windowSeconds = $this->getBoundedIntegerConfig(
             self::CONFIG_FAILURE_WINDOW,
@@ -157,9 +163,6 @@ class FirewallService
             $windowSeconds
         );
 
-        // Include current failure in count
-        $failureCount++;
-
         if ($failureCount >= $maxFailures) {
             $this->handleBruteForce($tenantId, $ipAddress, $failureCount, $windowSeconds);
         }
@@ -200,15 +203,24 @@ class FirewallService
      * Log security event to firewall logs
      */
     public function logSecurityEvent(SecurityEvent $event): void
+    {
+        $log = $this->securityLog($event);
+        if ($log !== null) {
+            $this->store->createLog($log);
+        }
+    }
+
+    private function securityLog(SecurityEvent $event): ?FirewallLogObject
     {
         $tenantId = $event->getTenantId() ?? $this->tenantContext->identifier();
         $ruleScope = $event->get('ruleScope');
         if (!$tenantId && $ruleScope !== FirewallRuleObject::SCOPE_SYSTEM) {
-            return;
+            return null;
         }
 
         $log = new FirewallLogObject();
-        $log->setTenantId($tenantId)
+        return $log->setEventId($event->getEventId())
+            ->setTenantId($tenantId)
             ->setIpAddress($event->getIpAddress())
             ->setDeviceFingerprint($event->getDeviceFingerprint())
             ->setUserAgent($event->getUserAgent())
@@ -221,8 +233,6 @@ class FirewallService
             ->setIdentityId($event->getUserId() ?? $event->getIdentityId())
             ->setTimestamp(new \DateTimeImmutable())
             ->setMetadata($event->getData());
-
-        $this->store->createLog($log);
     }
 
     /**