feat(security): emit authentication failures for firewall handling

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

core/lib/Security/AuthenticationManager.php

@@ -8,11 +8,13 @@ use KTXC\Models\Identity\User;
 use KTXC\Resource\ProviderManager;
 use KTXC\Security\Authentication\AuthenticationRequest;
 use KTXC\Security\Authentication\AuthenticationResponse;
+use KTXC\Security\Event\AuthenticationFailedEvent;
 use KTXC\Service\TokenService;
 use KTXC\Service\UserAccountsService;
 use KTXC\Context\TenantContextInterface;
 use KTXF\Cache\CacheScope;
 use KTXF\Cache\EphemeralCacheInterface;
+use KTXF\Event\EventDispatcherInterface;
 use KTXF\Security\Authentication\AuthenticationProviderInterface;
 use KTXF\Security\Authentication\AuthenticationSession;
 use KTXF\Security\Authentication\ProviderContext;
@@ -31,6 +33,7 @@ class AuthenticationManager
         private readonly ProviderManager $providerManager,
         private readonly TokenService $tokenService,
         private readonly UserAccountsService $userService,
+        private readonly EventDispatcherInterface $events,
     ) {
         $this->securityCode = $this->tenantContext->configuration()->security()->code();
     }
@@ -187,6 +190,10 @@ class AuthenticationManager
 
         if (!$result->isSuccess()) {
             $this->saveSession($session);
+            $this->publishAuthenticationFailure(
+                $session,
+                $result->errorCode ?? AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
+            );
             return AuthenticationResponse::failed(
                 AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
                 'Authentication failed. If you haven\'t set up this method, try another option.',
@@ -389,6 +396,10 @@ class AuthenticationManager
         $result = $provider->completeRedirect($context, $request->params);
 
         if ($result->isFailed()) {
+            $this->publishAuthenticationFailure(
+                $session,
+                $result->errorCode ?? AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
+            );
             $this->deleteSession($session->id);
             return AuthenticationResponse::failed(
                 AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
@@ -566,6 +577,17 @@ class AuthenticationManager
     // Helper Methods
     // =========================================================================
 
+    private function publishAuthenticationFailure(
+        AuthenticationSession $session,
+        string $reason,
+    ): void {
+        $this->events->dispatch(new AuthenticationFailedEvent(
+            userId: $session->userIdentifier,
+            reason: $reason,
+            tenantId: $session->tenantIdentifier,
+        ));
+    }
+
     /**
      * Build provider context from session
      */

core/lib/Security/Event/AuthenticationFailedEvent.php

@@ -9,15 +9,10 @@ use KTXF\Event\Event;
 final class AuthenticationFailedEvent extends Event implements SecurityEventInterface
 {
     public function __construct(
-        private readonly string $ipAddress,
-        private readonly ?string $deviceFingerprint = null,
         private readonly ?string $userId = null,
         private readonly ?string $reason = null,
         ?string $tenantId = null,
         ?string $identityId = null,
-        private readonly ?string $userAgent = null,
-        private readonly ?string $requestPath = null,
-        private readonly ?string $requestMethod = null,
     ) {
         parent::__construct(
             self::class,
@@ -27,31 +22,6 @@ final class AuthenticationFailedEvent extends Event implements SecurityEventInte
         );
     }
 
-    public function getIpAddress(): string
-    {
-        return $this->ipAddress;
-    }
-
-    public function getDeviceFingerprint(): ?string
-    {
-        return $this->deviceFingerprint;
-    }
-
-    public function getUserAgent(): ?string
-    {
-        return $this->userAgent;
-    }
-
-    public function getRequestPath(): ?string
-    {
-        return $this->requestPath;
-    }
-
-    public function getRequestMethod(): ?string
-    {
-        return $this->requestMethod;
-    }
-
     public function getUserId(): ?string
     {
         return $this->userId;

core/lib/Security/Event/SecurityEvent.php

@@ -9,7 +9,7 @@ use KTXF\Event\Event;
 /**
  * Security-specific event for authentication and access control events
  */
-final class SecurityEvent extends Event implements SecurityEventInterface
+final class SecurityEvent extends Event implements SecurityRequestEventInterface
 {
     // Event names
     public const AUTH_SUCCESS = 'security.auth.success';

core/lib/Security/Event/SecurityEventInterface.php

@@ -18,16 +18,6 @@ interface SecurityEventInterface
 
     public function getIdentityId(): ?string;
 
-    public function getIpAddress(): ?string;
-
-    public function getDeviceFingerprint(): ?string;
-
-    public function getUserAgent(): ?string;
-
-    public function getRequestPath(): ?string;
-
-    public function getRequestMethod(): ?string;
-
     public function getUserId(): ?string;
 
     public function getReason(): ?string;

core/lib/Security/Event/SecurityRequestEventInterface.php

@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+interface SecurityRequestEventInterface extends SecurityEventInterface
+{
+    public function getIpAddress(): ?string;
+
+    public function getDeviceFingerprint(): ?string;
+
+    public function getUserAgent(): ?string;
+
+    public function getRequestPath(): ?string;
+
+    public function getRequestMethod(): ?string;
+}