feat(security): emit authentication failures for firewall handling

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

core/lib/Security/AuthenticationManager.php

@@ -8,11 +8,13 @@ use KTXC\Models\Identity\User;
 use KTXC\Resource\ProviderManager;
 use KTXC\Security\Authentication\AuthenticationRequest;
 use KTXC\Security\Authentication\AuthenticationResponse;
+use KTXC\Security\Event\AuthenticationFailedEvent;
 use KTXC\Service\TokenService;
 use KTXC\Service\UserAccountsService;
 use KTXC\Context\TenantContextInterface;
 use KTXF\Cache\CacheScope;
 use KTXF\Cache\EphemeralCacheInterface;
+use KTXF\Event\EventDispatcherInterface;
 use KTXF\Security\Authentication\AuthenticationProviderInterface;
 use KTXF\Security\Authentication\AuthenticationSession;
 use KTXF\Security\Authentication\ProviderContext;
@@ -31,6 +33,7 @@ class AuthenticationManager
         private readonly ProviderManager $providerManager,
         private readonly TokenService $tokenService,
         private readonly UserAccountsService $userService,
+        private readonly EventDispatcherInterface $events,
     ) {
         $this->securityCode = $this->tenantContext->configuration()->security()->code();
     }
@@ -187,6 +190,10 @@ class AuthenticationManager
 
         if (!$result->isSuccess()) {
             $this->saveSession($session);
+            $this->publishAuthenticationFailure(
+                $session,
+                $result->errorCode ?? AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
+            );
             return AuthenticationResponse::failed(
                 AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
                 'Authentication failed. If you haven\'t set up this method, try another option.',
@@ -389,6 +396,10 @@ class AuthenticationManager
         $result = $provider->completeRedirect($context, $request->params);
 
         if ($result->isFailed()) {
+            $this->publishAuthenticationFailure(
+                $session,
+                $result->errorCode ?? AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
+            );
             $this->deleteSession($session->id);
             return AuthenticationResponse::failed(
                 AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
@@ -566,6 +577,17 @@ class AuthenticationManager
     // Helper Methods
     // =========================================================================
 
+    private function publishAuthenticationFailure(
+        AuthenticationSession $session,
+        string $reason,
+    ): void {
+        $this->events->dispatch(new AuthenticationFailedEvent(
+            userId: $session->userIdentifier,
+            reason: $reason,
+            tenantId: $session->tenantIdentifier,
+        ));
+    }
+
     /**
      * Build provider context from session
      */