fix(firewall): account for authentication failures exactly once

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>
2026-07-30 23:01:38 -04:00
parent 7aa8a27b1b
commit a5c10e9b9b
9 changed files with 112 additions and 11 deletions
@@ -219,6 +219,25 @@ class FirewallStoreTest extends TestCase
        self::assertSame(FirewallRuleManager::ORIGIN_MANUAL, $logs[0]->getMetadata()['origin']);
    }

+    #[TestDox('Event-backed firewall logs are inserted exactly once')]
+    public function testIdempotentLogPersistence(): void
+    {
+        $log = (new FirewallLogObject())
+            ->setEventId('event-123')
+            ->setTenantId('tenant-a')
+            ->setIpAddress('203.0.113.10')
+            ->setEventType(FirewallLogObject::EVENT_AUTH_FAILURE)
+            ->setResult(FirewallLogObject::RESULT_BLOCKED)
+            ->setTimestamp(new \DateTimeImmutable());
+
+        self::assertTrue($this->store->createLogOnce($log));
+        self::assertFalse($this->store->createLogOnce($log));
+
+        $logs = $this->store->listLogs('tenant-a');
+        self::assertCount(1, $logs);
+        self::assertSame('event-123', $logs[0]->getEventId());
+    }
+
    private function rule(
        string $reason,
        string $scope,